build(deps): bump the actions group with 4 updates #181

dependabot · 2025-09-08T22:14:14Z

Bumps the actions group with 4 updates: CodSpeedHQ/action, actions/setup-python, actions/setup-node and pypa/gh-action-pypi-publish.

Updates CodSpeedHQ/action from 3 to 4

Release notes

Sourced from CodSpeedHQ/action's releases.

v4.0.0

💥 BREAKING

It's now required to explicitly set the runner mode to instrumentation or walltime using either:

the mode argument

or the CODSPEED_RUNNER_MODE environment variable

[!TIP] Before, this variable was automatically set to instrumentation on every runner except for CodSpeed macro runners where it was set to walltime by default.

Find more details in the instruments documentation.

Details

🚀 Features

Make perf profiling enabled by default by @GuillaumeLagrange in #110

Make the runner mode argument required by @GuillaumeLagrange

Use introspected node in walltime mode by @GuillaumeLagrange in #108

Add instrumented go shell script by @not-matthias in #102

🐛 Bug Fixes

Compute proper load bias by @not-matthias in #107

Increase timeout for first perf ping by @GuillaumeLagrange

Prevent running with valgrind by @not-matthias in #106

🏗️ Refactor

Change go-runner binary name by @not-matthias in #111

Full Runner Changelog: https://github.com/CodSpeedHQ/runner/blob/main/CHANGELOG.md

v3.8.1

What's Changed

🐛 Bug Fixes

Don't show error when libpython is not found by @not-matthias

🏗️ Refactor

Improve conditional compilation in get_pipe_open_options by @art049 in #100

⚙️ Internals

Change log level to warn for venv_compat error by @not-matthias in #104

Full Changelog: CodSpeedHQ/action@v3.8.0...v3.8.1 Full Runner Changelog: https://github.com/CodSpeedHQ/runner/blob/main/CHANGELOG.md

v3.8.0

What's Changed

... (truncated)

Commits

6eeb021 Release v4.0.0 🚀
74312da chore: improve the release script
8a17a35 ci: add modes to the matrix
8e3f02a feat: make the mode argument required
97c7a6f chore: bump runner version to 4.0.0
8a4cadd chore: point the changelog to the runner
See full diff in compare view

Updates actions/setup-python from 5 to 6

Release notes

Sourced from actions/setup-python's releases.

v6.0.0

What's Changed

Breaking Changes

Upgrade to node 24 by @salmanmkc in actions/setup-python#1164

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Enhancements:

Add support for pip-version by @priyagupta108 in actions/setup-python#1129

Enhance reading from .python-version by @krystof-k in actions/setup-python#787

Add version parsing from Pipfile by @aradkdj in actions/setup-python#1067

Bug fixes:

Clarify pythonLocation behaviour for PyPy and GraalPy in environment variables by @aparnajyothi-y in actions/setup-python#1183

Change missing cache directory error to warning by @aparnajyothi-y in actions/setup-python#1182

Add Architecture-Specific PATH Management for Python with --user Flag on Windows by @aparnajyothi-y in actions/setup-python#1122

Include python version in PyPy python-version output by @cdce8p in actions/setup-python#1110

Update docs: clarification on pip authentication with setup-python by @priya-kinthali in actions/setup-python#1156

Dependency updates:

Upgrade idna from 2.9 to 3.7 in /tests/data by @dependabot[bot] in actions/setup-python#843

Upgrade form-data to fix critical vulnerabilities #182 & #183 by @aparnajyothi-y in actions/setup-python#1163

Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIndex.download by @aparnajyothi-y in actions/setup-python#1165

Upgrade actions/checkout from 4 to 5 by @dependabot[bot] in actions/setup-python#1181

Upgrade @actions/tool-cache from 2.0.1 to 2.0.2 by @dependabot[bot] in actions/setup-python#1095

New Contributors

@krystof-k made their first contribution in actions/setup-python#787

@cdce8p made their first contribution in actions/setup-python#1110

@aradkdj made their first contribution in actions/setup-python#1067

Full Changelog: actions/setup-python@v5...v6.0.0

v5.6.0

What's Changed

Workflow updates related to Ubuntu 20.04 by @aparnajyothi-y in actions/setup-python#1065

Fix for Candidate Not Iterable Error by @aparnajyothi-y in actions/setup-python#1082

Upgrade semver and @types/semver by @dependabot in actions/setup-python#1091

Upgrade prettier from 2.8.8 to 3.5.3 by @dependabot in actions/setup-python#1046

Upgrade ts-jest from 29.1.2 to 29.3.2 by @dependabot in actions/setup-python#1081

Full Changelog: actions/setup-python@v5...v5.6.0

v5.5.0

What's Changed

Enhancements:

Support free threaded Python versions like '3.13t' by @colesbury in actions/setup-python#973

Enhance Workflows: Include ubuntu-arm runners, Add e2e Testing for free threaded and Upgrade @action/cache from 4.0.0 to 4.0.3 by @priya-kinthali in actions/setup-python#1056

Add support for .tool-versions file in setup-python by @mahabaleshwars in actions/setup-python#1043

Bug fixes:

Fix architecture for pypy on Linux ARM64 by @mayeut in actions/setup-python#1011 This update maps arm64 to aarch64 for Linux ARM64 PyPy installations.

... (truncated)

Commits

e797f83 Upgrade to node 24 (#1164)
3d1e2d2 Revert "Enhance cache-dependency-path handling to support files outside the w...
65b0712 Clarify pythonLocation behavior for PyPy and GraalPy in environment variables...
5b668cf Bump actions/checkout from 4 to 5 (#1181)
f62a0e2 Change missing cache directory error to warning (#1182)
9322b3c Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIn...
fbeb884 Bump form-data to fix critical vulnerabilities #182 & #183 (#1163)
03bb615 Bump idna from 2.9 to 3.7 in /tests/data (#843)
36da51d Add version parsing from Pipfile (#1067)
3c6f142 update documentation (#1156)
Additional commits viewable in compare view

Updates actions/setup-node from 4 to 5

Release notes

Sourced from actions/setup-node's releases.

v5.0.0

What's Changed

Breaking Changes

Enhance caching in setup-node with automatic package manager detection by @priya-kinthali in actions/setup-node#1348

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless. To disable this automatic caching, set package-manager-cache: false
steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false
Upgrade action to use node24 by @salmanmkc in actions/setup-node#1325

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

Upgrade @octokit/request-error and @actions/github by @dependabot[bot] in actions/setup-node#1227

Upgrade uuid from 9.0.1 to 11.1.0 by @dependabot[bot] in actions/setup-node#1273

Upgrade undici from 5.28.5 to 5.29.0 by @dependabot[bot] in actions/setup-node#1295

Upgrade form-data to bring in fix for critical vulnerability by @gowridurgad in actions/setup-node#1332

Upgrade actions/checkout from 4 to 5 by @dependabot[bot] in actions/setup-node#1345

New Contributors

@priya-kinthali made their first contribution in actions/setup-node#1348

@salmanmkc made their first contribution in actions/setup-node#1325

Full Changelog: actions/setup-node@v4...v5.0.0

v4.4.0

What's Changed

Bug fixes:

Make eslint-compact matcher compatible with Stylelint by @FloEdelmann in actions/setup-node#98

Add support for indented eslint output by @fregante in actions/setup-node#1245

Enhancement:

Support private mirrors by @marco-ippolito in actions/setup-node#1240

Dependency update:

Upgrade @action/cache from 4.0.2 to 4.0.3 by @aparnajyothi-y in actions/setup-node#1262

New Contributors

@FloEdelmann made their first contribution in actions/setup-node#98

@fregante made their first contribution in actions/setup-node#1245

@marco-ippolito made their first contribution in actions/setup-node#1240

Full Changelog: actions/setup-node@v4...v4.4.0

... (truncated)

Commits

a0853c2 Bump actions/checkout from 4 to 5 (#1345)
b7234cc Upgrade action to use node24 (#1325)
d7a1131 Enhance caching in setup-node with automatic package manager detection (#1348)
5e2628c Bumps form-data (#1332)
65becef Bump undici from 5.28.5 to 5.29.0 (#1295)
7e24a65 Bump uuid from 9.0.1 to 11.1.0 (#1273)
08f58d1 Bump @octokit/request-error and @actions/github (#1227)
See full diff in compare view

Updates pypa/gh-action-pypi-publish from 1.12.4 to 1.13.0

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.13.0

[!important] 🚨 This release includes fixes for GHSA-vxmw-7h4f-hqxh discovered by @woodruffw💰. We've also integrated Zizmor to catch similar issues in the future and you should too.

✨ New Stuff

@woodruffw💰 updated the README to no longer mention the attestations feature being experimental in #347: it's been rather stable for a year already 🎉 He also added more diagnostic output which includes printing out the GitHub Environment claim via #371 and warning about the unsupported reusable workflows configurations #306, when using Trusted Publishing.

[!tip] The official support for reusable workflows is currently blocked on changes to PyPI. To get updates about progress on the action side, you may want to subscribe to #166. At PyCon US 2025 Sprints, @facutuesca💰, @miketheman💰, @woodruffw💰 and I💰 spent several hours IRL brainstorming how to fix this and migrate projects that happen to rely on an obscure corner case with reusable workflows that temporarily allows them to function by accident. The result of that discussion is posted @ pypi/warehouse#11096. Note that this is a volunteer-led effort and there is no ETA. If you need this soon, make your employer sponsor the PSF and maybe they'll be able to hire somebody for this work on Warehouse.

In addition to that, @konstin💰 sent #378 to pin actions/setup-python to a SHA hash. This makes pypi-publish compatible with new GitHub policies that allow organizations to mandate hash-pinning actions used in workflows.

🛠️ Internal Dependencies

@webknjaz💰 made a bunch of updates to the action runtime which includes bumping it to Python 3.13 in #331 and updating the dependency tree across the board. pip-with-requires-python is no longer being installed (#332). Some related bumps were contributed by @woodruffw💰 (#359) and @kurtmckee💰 sent a contributor-facing PR, bumping the linting configuration via #335.

💪 New Contributors

@kurtmckee made their first contribution in #335

@konstin made their first contribution in #378

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.12.4...v1.13.0

🧔‍♂️ Release Manager: @webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

ed0c539 📦📌 Bump the pinned dependency tree
77db1b7 Merge branch PR #306, GHSA-vxmw-7h4f-hqxh fix and PR #378 into unstable/v1
280b3a1 Alias typing as t in imports
e380240 Use object in place of typing.Any in annotations
e50bff6 Deduplicate claim ref lookup
decbc9a Hint people to subscribe to #166 for notifications
8208ad3 Ask not to report bugs with reusable workflow
ff0fef5 🧪 Scope WPS202 suppression to specific files
1293b8c Use yamllint disable line length lint
ed01280 Linter (different rule)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 4 updates: [CodSpeedHQ/action](https://github.com/codspeedhq/action), [actions/setup-python](https://github.com/actions/setup-python), [actions/setup-node](https://github.com/actions/setup-node) and [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish). Updates `CodSpeedHQ/action` from 3 to 4 - [Release notes](https://github.com/codspeedhq/action/releases) - [Changelog](https://github.com/CodSpeedHQ/action/blob/main/CHANGELOG.md) - [Commits](CodSpeedHQ/action@v3...v4) Updates `actions/setup-python` from 5 to 6 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v5...v6) Updates `actions/setup-node` from 4 to 5 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v4...v5) Updates `pypa/gh-action-pypi-publish` from 1.12.4 to 1.13.0 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@76f52bc...ed0c539) --- updated-dependencies: - dependency-name: CodSpeedHQ/action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-python dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-node dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

codecov · 2025-09-08T22:26:33Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.90%. Comparing base (77a447e) to head (56a64cf).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #181   +/-   ##
=======================================
  Coverage   96.90%   96.90%           
=======================================
  Files          14       14           
  Lines        3132     3132           
=======================================
  Hits         3035     3035           
  Misses         97       97

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

2bndy5 · 2025-09-08T22:37:41Z

💥 BREAKING

It's now required to explicitly set the runner mode to instrumentation or walltime using either:

the mode argument

or the CODSPEED_RUNNER_MODE environment variable

[!TIP]
Before, this variable was automatically set to instrumentation on every runner except for CodSpeed macro runners where it was set to walltime by default.

Find more details in the instruments documentation.

I think I'll set it to walltime. Measuring the CPU performance is highly complex for this project. And the current benchmark takes about 2 hours to measure the CPU performance. Ultimately, we only care about the overall runtime.

2bndy5 · 2025-09-08T23:00:12Z

well I set it walltime, but the CI failed saying

Running the benchmarks
  [cargo-codspeed] Measurement mode: Walltime
  Error: No benchmarks found. Run `cargo codspeed build` first.

even though the previous step executes cargo codspeed build.
I'll set it back to instrumentation, but I think it is time to revert back to hyperfine (undo #92). I'm tired of waiting 2 hours before merging anything that might affect the benchmark performance.

codspeed-hq · 2025-09-09T01:24:14Z

CodSpeed Performance Report

Merging #181 will not alter performance

_{Comparing dependabot/github_actions/actions-21d9f7f4ea (56a64cf) with main (77a447e)¹}

Summary

✅ 1 untouched benchmarks

No successful run was found on main (8664b99) during the generation of this report, so 77a447e was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

.github/workflows/python-packaging.yml

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 8, 2025

explicitly set benchmark to measure instrumentation

57e81ae

2bndy5 force-pushed the dependabot/github_actions/actions-21d9f7f4ea branch from 926c9fe to 57e81ae Compare September 8, 2025 23:01

2bndy5 mentioned this pull request Sep 9, 2025

switch (back) to hyperfine for benchmarks #182

Open

2bndy5 reviewed Sep 9, 2025

View reviewed changes

.github/workflows/python-packaging.yml Outdated Show resolved Hide resolved

append version comment to pinned SHA

56a64cf

2bndy5 merged commit 7b18e9f into main Sep 9, 2025
56 checks passed

2bndy5 deleted the dependabot/github_actions/actions-21d9f7f4ea branch September 9, 2025 10:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

build(deps): bump the actions group with 4 updates #181

build(deps): bump the actions group with 4 updates #181

Uh oh!

dependabot bot commented on behalf of github Sep 8, 2025

Uh oh!

codecov bot commented Sep 8, 2025 •

edited

Loading

Uh oh!

2bndy5 commented Sep 8, 2025 •

edited

Loading

💥 BREAKING

Uh oh!

2bndy5 commented Sep 8, 2025

Uh oh!

codspeed-hq bot commented Sep 9, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

build(deps): bump the actions group with 4 updates #181

build(deps): bump the actions group with 4 updates #181

Uh oh!

Conversation

dependabot bot commented on behalf of github Sep 8, 2025

v4.0.0

💥 BREAKING

Details

🚀 Features

🐛 Bug Fixes

🏗️ Refactor

v3.8.1

What's Changed

🐛 Bug Fixes

🏗️ Refactor

⚙️ Internals

v3.8.0

What's Changed

v6.0.0

What's Changed

Breaking Changes

Enhancements:

Bug fixes:

Dependency updates:

New Contributors

v5.6.0

What's Changed

v5.5.0

What's Changed

Enhancements:

Bug fixes:

v5.0.0

What's Changed

Breaking Changes

Dependency Upgrades

New Contributors

v4.4.0

What's Changed

Bug fixes:

Enhancement:

Dependency update:

New Contributors

v1.13.0

✨ New Stuff

🛠️ Internal Dependencies

💪 New Contributors

Uh oh!

codecov bot commented Sep 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

2bndy5 commented Sep 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💥 BREAKING

Uh oh!

2bndy5 commented Sep 8, 2025

Uh oh!

codspeed-hq bot commented Sep 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CodSpeed Performance Report

Merging #181 will not alter performance

Summary

Footnotes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov bot commented Sep 8, 2025 •

edited

Loading

2bndy5 commented Sep 8, 2025 •

edited

Loading

codspeed-hq bot commented Sep 9, 2025 •

edited

Loading