Skip to content

chore(deps): update github actions - #1089

Open
renovate-bot wants to merge 1 commit into
taskcluster:mainfrom
renovate-bot:renovate/github-actions
Open

chore(deps): update github actions#1089
renovate-bot wants to merge 1 commit into
taskcluster:mainfrom
renovate-bot:renovate/github-actions

Conversation

@renovate-bot

@renovate-bot renovate-bot commented Nov 1, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending
CodSpeedHQ/action action minor v5.2.1 → v5.6.0 v5.6.1
actions/setup-python action minor v7.0.0 → v7.1.0
astral-sh/setup-uv action minor v10.2.0 → v10.3.3
github/codeql-action action minor v4.38.2 → v4.39.1
pypa/gh-action-pypi-publish action patch v1.14.2 → v1.14.3
python uses-with minor 3.14 → 3.15

Release Notes

CodSpeedHQ/action

v5.6.0

Compare Source

Bumps the CodSpeed runner to v5.6.0.

Highlights
More consistent CPU Simulation results

Changes to your CI environment, like a different path or an extra environment variable, no longer change the performance. Each benchmark now starts with the same memory layout, reducing the chance of false regressions.

🐛 Bug Fixes
⚙️ Internals

Full Runner Changelog:
https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

Full Changelog: CodSpeedHQ/action@v5.5.0...v5.6.0

v5.5.0

Compare Source

Bumps the CodSpeed runner to v5.5.0.

This release adds support for Ubuntu 26.04, on both x86_64 and arm64. The officially supported distributions are now Ubuntu 22.04, 24.04 and 26.04, and Debian 12.

Profile uploads are also faster on GitHub-hosted runners, and archives larger than 5 GiB can now be uploaded.

Results from the Memory instrument are processed much faster and with less memory on large benchmarks.

This release also fixes a crash that could affect some pytest-codspeed benchmarks since v5.4.2.

🚀 Features
🐛 Bug Fixes
⚡ Performance
⚙️ Internals

Full Runner Changelog:
https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

New Contributors

Full Changelog: CodSpeedHQ/action@v5.4.2...v5.5.0

v5.4.2

Compare Source

Bumps the CodSpeed runner to v5.4.2, including v5.4.1.

This release improves and adds support for memory flamegraphs in C++, Python and Node.js.

Fixes flamegraphs for Python in simulation mode in the exec CLI.

🚀 Features
  • Name Python and Node.js frames in memory flamegraphs: emit their perf maps in memory mode, and harvest perf maps and JIT unwind data for memory tracking, by @​not-matthias in #​556
  • Launch node with the codspeed-node V8 flags for the current mode in codspeed exec, including through npm, npx and #!/usr/bin/env node scripts, by @​not-matthias in #​556
🐛 Bug Fixes
  • Always set PYTHONPERFSUPPORT, so Python codspeed exec targets keep their Python frames in simulation-mode flamegraphs, by @​not-matthias in #​577
  • Fix memory flamegraph stacks: restore return addresses hijacked by uretprobes in nested allocator calls, compare mapped modules against their mapping, and keep every placement of a module mapped more than once, by @​not-matthias in #​564, #​563 and #​556
  • Only pass --interpreted-frames-native-stack to node in analysis mode by @​not-matthias in #​556
  • Label dropped benchmarks in the comparison table by @​adriencaccia in #​570
⚙️ Internals

Full Runner Changelog:
https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

Full Changelog: CodSpeedHQ/action@v5.4.0...v5.4.2

v5.4.0

Compare Source

Bumps the CodSpeed runner to v5.4.0, including v5.3.0 and v5.3.1.

The Memory instrument now tracks physical (resident) memory and captures allocation call stacks to build memory flamegraphs. Both are enabled by default and can be turned off with the new disable-memory-track-physical and disable-memory-capture-stack inputs. Serialization is also faster on large memory benchmarks.

The action now exposes the id of the CodSpeed run as a run-id output, and CodSpeed now works on non-Ubuntu/Debian distributions such as Arch Linux.

🚀 Features
  • Track physical memory and capture allocation call stacks for memory flamegraphs, both enabled by default by @​not-matthias in #​529, #​522 and #​553
  • Expose the run id as a GitHub Actions step output by @​moha-bekh in #​551
  • Add an --experimental-disable-pythonmalloc-override flag (CODSPEED_EXPERIMENTAL_DISABLE_PYTHONMALLOC_OVERRIDE) to stop overriding the Python allocator, which can break free-threaded Python in simulation mode, by @​not-matthias in #​539
  • Apply kernel memory tunables before memory-mode runs, and fail early when the kernel has no BTF by @​not-matthias in #​507 and #​524
  • Pause producers under ring buffer pressure in memory mode, and log process stops per reason by @​not-matthias in #​543
  • Log which authentication method the run uses by @​fargito in #​521
🐛 Bug Fixes
⚡ Performance
⚙️ Internals

Full Runner Changelog:
https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

New Contributors

Full Changelog: CodSpeedHQ/action@v5.2.1...v5.4.0

actions/setup-python

v7.1.0

Compare Source

What's Changed

Enhancements
Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

astral-sh/setup-uv

v10.3.3: 🌈 Use Astral mirror for version manifests with GitHub fallback

Compare Source

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable.
(Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v10.3.2: 🌈 update known checksums for 0.13.5

Compare Source

Changes
🧰 Maintenance
📚 Documentation

v10.3.1: 🌈 preserve cache error class names in save-cache bundle

Compare Source

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v10.3.0: 🌈 Add Python architecture selection

Compare Source

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

github/codeql-action

v4.39.1

Compare Source

v4.39.0

Compare Source

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198

v4.38.3

Compare Source

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4188
  • Update default CodeQL bundle version to 2.27.2. #​4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #​4184
pypa/gh-action-pypi-publish

v1.14.3

Compare Source

Keeping the community safe is a collaborative effort! 💛💙

[!important]
🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #​427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via #​420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

GH Sponsors badge

actions/python-versions (python)

v3.15.2: 3.15.2

Compare Source

Python 3.15.2

v3.15.1: 3.15.1

Compare Source

Python 3.15.1

v3.15.0: 3.15.0

Compare Source

Python 3.15.0

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • On day 1 of the month (* * 1 * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate-bot
renovate-bot requested a review from a team as a code owner November 1, 2026 00:35
@renovate-bot
renovate-bot requested a review from bhearsum November 1, 2026 00:35

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bhearsum bhearsum Awaiting requested review from bhearsum bhearsum is a code owner automatically assigned from taskcluster/releng

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@renovate-bot