chore(deps): bump the dependencies group across 1 directory with 5 updates by dependabot[bot] · Pull Request #283 · webpack/tapable

dependabot · 2026-10-16T15:54:50Z

Bumps the dependencies group with 5 updates in the / directory:

Package	From	To
actions/setup-node	`7.0.0`	`7.1.0`
CodSpeedHQ/action	`4.19.1`	`5.4.2`
actions/create-github-app-token	`3.2.0`	`3.3.0`
changesets/action	`1.9.0`	`2.1.2`
codecov/codecov-action	`7.0.0`	`7.1.1`

Updates actions/setup-node from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Add support for mise.toml file by @gperdomor in actions/setup-node#1421

Support absolute paths in node-version-file by @v-mahabaleshwars in actions/setup-node#1633

Bug fixes:

Add Node version validation and manifest fetch retry by @v-jitenderpalsingh in actions/setup-node#1580

Documentation updates:

README.md: bump actions/checkout to latest version 7 by @deining in actions/setup-node#1578

docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by @v-gowridurgad in actions/setup-node#1593

Fixed cache recommendation syntax by @SubJunk in actions/setup-node#1603

Dependency updates:

Update workflow pins and migrate Node matrices to modern versions by @v-HarithaVattikuti in actions/setup-node#1583

Upgrade @actions/cache to 6.2.0 by @philip-gai in actions/setup-node#1584

Pin @types/node to v24 by @v-priyagupta108 in actions/setup-node#1585

Override brace-expansion to 5.0.8 by @v-priyagupta108 with @Copilot in actions/setup-node#1599

Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-node#1598

Upgrade prettier from 3.8.4 to 3.9.6 by @dependabot in actions/setup-node#1590

Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in actions/setup-node#1610

Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by @dependabot in actions/setup-node#1602

Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by @dependabot in actions/setup-node#1629

Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in actions/setup-node#1616

Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in actions/setup-node#1615

Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by @dependabot in actions/setup-node#1631

Upgrade jest-each from 30.4.1 to 30.5.2 by @dependabot in actions/setup-node#1636

Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by @dependabot in actions/setup-node#1638

Update dependencies and add license files by @v-HarithaVattikuti in actions/setup-node#1642

Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by @dependabot in actions/setup-node#1635

New Contributors

@v-jitenderpalsingh made their first contribution in actions/setup-node#1580

@philip-gai made their first contribution in actions/setup-node#1584

@gperdomor made their first contribution in actions/setup-node#1421

@SubJunk made their first contribution in actions/setup-node#1603

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits

949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
7207c4f chore: update dependencies and add license files (#1642)
54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
0c54c7b Bump @typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
a829419 Bump @types/semver from 7.7.1 to 7.8.0 (#1616)
680d1e4 Support absolute paths in node-version-file (#1633)
db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
Additional commits viewable in compare view

Updates CodSpeedHQ/action from 4.19.1 to 5.4.2

Release notes

Sourced from CodSpeedHQ/action's releases.

v5.4.2

Bumps the CodSpeed runner to v5.4.2, including v5.4.1.

This release improves and adds support for memory flamegraphs in C++, Python and Node.js.

Fixes flamegraphs for Python in simulation mode in the exec CLI.

🚀 Features

Name Python and Node.js frames in memory flamegraphs: emit their perf maps in memory mode, and harvest perf maps and JIT unwind data for memory tracking, by @not-matthias in #556

Launch node with the codspeed-node V8 flags for the current mode in codspeed exec, including through npm, npx and #!/usr/bin/env node scripts, by @not-matthias in #556

🐛 Bug Fixes

Always set PYTHONPERFSUPPORT, so Python codspeed exec targets keep their Python frames in simulation-mode flamegraphs, by @not-matthias in #577

Fix memory flamegraph stacks: restore return addresses hijacked by uretprobes in nested allocator calls, compare mapped modules against their mapping, and keep every placement of a module mapped more than once, by @not-matthias in #564, #563 and #556

Only pass --interpreted-frames-native-stack to node in analysis mode by @not-matthias in #556

Label dropped benchmarks in the comparison table by @adriencaccia in #570

⚙️ Internals

Pin memtrack 1.6.1 and exec-harness 1.4.1, through 1.4.0, by @adriencaccia in #575 and #580

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

chore: bump runner version to 5.4.2 by @github-actions[bot] in CodSpeedHQ/action#246

Full Changelog: CodSpeedHQ/action@v5.4.0...v5.4.2

v5.4.0

Bumps the CodSpeed runner to v5.4.0, including v5.3.0 and v5.3.1.

The Memory instrument now tracks physical (resident) memory and captures allocation call stacks to build memory flamegraphs. Both are enabled by default and can be turned off with the new disable-memory-track-physical and disable-memory-capture-stack inputs. Serialization is also faster on large memory benchmarks.

The action now exposes the id of the CodSpeed run as a run-id output, and CodSpeed now works on non-Ubuntu/Debian distributions such as Arch Linux.

🚀 Features

Track physical memory and capture allocation call stacks for memory flamegraphs, both enabled by default by @not-matthias in #529, #522 and #553

Expose the run id as a GitHub Actions step output by @moha-bekh in #551

Add an --experimental-disable-pythonmalloc-override flag (CODSPEED_EXPERIMENTAL_DISABLE_PYTHONMALLOC_OVERRIDE) to stop overriding the Python allocator, which can break free-threaded Python in simulation mode, by @not-matthias in #539

Apply kernel memory tunables before memory-mode runs, and fail early when the kernel has no BTF by @not-matthias in #507 and #524

Pause producers under ring buffer pressure in memory mode, and log process stops per reason by @not-matthias in #543

Log which authentication method the run uses by @fargito in #521

🐛 Bug Fixes

... (truncated)

Commits

f842b9a Release v5.4.2 🚀
d71714c chore: bump runner version to 5.4.2 (#246)
c4fd08a Release v5.4.0 🚀
759ae97 feat: add disable-memory-capture-stack and disable-memory-track-physical inputs
fe42bc0 chore: bump runner version to 5.4.0 (#244)
c205870 feat: add a run-id output (#243)
48820ec chore: bump runner version to 5.3.1 (#240)
0fc899a feat: add experimental-memory-track-physical input
2d26491 chore: bump runner version to 5.3.0 (#239)
373d686 Release v5.2.1 🚀
Additional commits viewable in compare view

Updates actions/create-github-app-token from 3.2.0 to 3.3.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

update permission inputs (#399) (a47236f)

Bug Fixes

deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)

deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

update permission inputs (#399) (a47236f)

Bug Fixes

deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)

deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

add support for enterprise-level GitHub Apps (#263) (952a2a7)

support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

deps: bump @actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)

validate private-key input (#376) (f24bbd8)

Commits

64ab729 chore(main): release 3.3.0 (#402)
f3a828e ci: create signed dist commits in release workflow (#404)
655017f docs: clarify when owner grants access to all repositories (#378)
12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
a47236f feat: update permission inputs (#399)
a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
e85f677 test: omit stack traces from snapshots (#401)
9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
Additional commits viewable in compare view

Updates changesets/action from 1.9.0 to 2.1.2

Release notes

Sourced from changesets/action's releases.

v2.1.2

Patch Changes

#735 8833883 Thanks @bluwy! - Handle error when pushing git tags with the git CLI

#724 36f529f Thanks @bluwy! - Improve log messages

#724 36f529f Thanks @bluwy! - Fix root action double error logs

#729 ca85897 Thanks @bluwy! - Always switch and reset branch when generating version commits, similar to if push-with-git-cli is enabled

v2.1.1

Patch Changes

#721 da1ea29 Thanks @KEBABSELLER6! - Fixed typo in renamed inputs from v1 to v2

v2.1.0

Minor Changes

#718 3b7c71c Thanks @bluwy! - Add a cwd input to the root action, /select-mode, /version, /pack, and /publish sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.

Patch Changes

#716 6f58ba3 Thanks @bluwy! - Update pr-status message to link to the new faq page

v2.0.0

Major Changes

#692 cb3f011 Thanks @Andarist! - Release commits and tags are now pushed using the GitHub API by default.

Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

#680 ca57073 Thanks @bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

#657 4f718b5 Thanks @Andarist! - Removed compatibility support for old Changesets v1.

#681 7359107 Thanks @bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

Inputs:

version -> version-script

publish -> publish-script

commit -> commit-message

title -> pr-title

branch -> pr-base-branch

... (truncated)

Changelog

Sourced from changesets/action's changelog.

@changesets/action

2.1.2

Patch Changes

#735 8833883 Thanks @bluwy! - Handle error when pushing git tags with the git CLI

#724 36f529f Thanks @bluwy! - Improve log messages

#724 36f529f Thanks @bluwy! - Fix root action double error logs

#729 ca85897 Thanks @bluwy! - Always switch and reset branch when generating version commits, similar to if push-with-git-cli is enabled

2.1.1

Patch Changes

#721 da1ea29 Thanks @KEBABSELLER6! - Fixed typo in renamed inputs from v1 to v2

2.1.0

Minor Changes

#718 3b7c71c Thanks @bluwy! - Add a cwd input to the root action, /select-mode, /version, /pack, and /publish sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.

Patch Changes

#716 6f58ba3 Thanks @bluwy! - Update pr-status message to link to the new faq page

2.0.0

Major Changes

#692 cb3f011 Thanks @Andarist! - Release commits and tags are now pushed using the GitHub API by default.

Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

#680 ca57073 Thanks @bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

#657 4f718b5 Thanks @Andarist! - Removed compatibility support for old Changesets v1.

#681 7359107 Thanks @bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

Inputs:

... (truncated)

Commits

ae32849 v2.1.2
0138f45 Version Packages (#726)
8833883 Handle error when pushing git tags with the git CLI (#735)
e08fde7 Improve log messages (#730)
371fd77 Bump human-id in the production-dependencies group across 1 directory (#732)
85efcaf Bump actions/checkout in the github-actions group across 1 directory (#734)
5bb9d5c Bump the development-dependencies group across 1 directory with 7 updates (#733)
ca85897 Always prepare branch for version (#729)
36f529f Fix root action double error logs (#724)
d7669c8 Version Packages (#722)
Additional commits viewable in compare view

Updates codecov/codecov-action from 7.0.0 to 7.1.1

Release notes

Sourced from codecov/codecov-action's releases.

v7.1.1

What's Changed

chore(release): 7.1.1 by @thomasrockhu-codecov in codecov/codecov-action#1973

Full Changelog: codecov/codecov-action@v7.1.0...v7.1.1

v7.1.0

What's Changed

chore(release): 7.1.0 by @thomasrockhu-codecov in codecov/codecov-action#1971

Full Changelog: codecov/codecov-action@v7.0.0...v7.1.0

Commits

303a32d chore(release): 7.1.1 (#1973)
0b35c9e chore(release): 7.1.0 (#1971)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…dates Bumps the dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | | [CodSpeedHQ/action](https://github.com/codspeedhq/action) | `4.19.1` | `5.4.2` | | [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.2.0` | `3.3.0` | | [changesets/action](https://github.com/changesets/action) | `1.9.0` | `2.1.2` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `7.0.0` | `7.1.1` | Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@8207627...949feb2) Updates `CodSpeedHQ/action` from 4.19.1 to 5.4.2 - [Release notes](https://github.com/codspeedhq/action/releases) - [Changelog](https://github.com/CodSpeedHQ/action/blob/main/CHANGELOG.md) - [Commits](CodSpeedHQ/action@f22792b...f842b9a) Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](actions/create-github-app-token@bcd2ba4...64ab729) Updates `changesets/action` from 1.9.0 to 2.1.2 - [Release notes](https://github.com/changesets/action/releases) - [Changelog](https://github.com/changesets/action/blob/main/CHANGELOG.md) - [Commits](changesets/action@a45c4d5...ae32849) Updates `codecov/codecov-action` from 7.0.0 to 7.1.1 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@fb8b358...303a32d) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: CodSpeedHQ/action dependency-version: 5.4.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies - dependency-name: actions/create-github-app-token dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: changesets/action dependency-version: 2.1.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies - dependency-name: codecov/codecov-action dependency-version: 7.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <[email protected]>

changeset-bot · 2026-10-16T15:54:56Z

⚠️ No Changeset found

Latest commit: 83e3849

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

codspeed · 2026-10-16T15:59:37Z

Hooray! CodSpeed harness just leveled up!

The base and head of this comparison were measured with different runner settings, so their benchmark values are not directly comparable.

What changed between base and head:

CodSpeed runner v5 changed how benchmarks are measured (base 4.19.1 → head 5.4.2). View release notes
Cycle estimation (off → on) changes how benchmark performance is calculated. Learn more about cycle estimation

Re-run the base with the same settings to get a valid performance comparison.

_{Comparing dependabot/github_actions/dependencies-c24b90e8fb (83e3849) with main (b94c118)}

dependabot Bot added the dependencies label Oct 16, 2026

Navigation Menu

Repository navigation

chore(deps): bump the dependencies group across 1 directory with 5 updates - #283

chore(deps): bump the dependencies group across 1 directory with 5 updates#283
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/dependencies-c24b90e8fb

dependabot Bot commented on behalf of github Oct 16, 2026

Uh oh!

changeset-bot Bot commented Oct 16, 2026

Uh oh!

codspeed Bot commented Oct 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 16, 2026

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

v5.4.2

🚀 Features

🐛 Bug Fixes

⚙️ Internals

What's Changed

v5.4.0

🚀 Features

🐛 Bug Fixes

v3.3.0

3.3.0 (2026-10-12)

Features

Bug Fixes

Changelog

3.3.0 (2026-10-12)

Features

Bug Fixes

3.2.0 (2026-05-12)

Features

Bug Fixes

v2.1.2

Patch Changes

v2.1.1

Patch Changes

v2.1.0

Minor Changes

Patch Changes

v2.0.0

Major Changes

@​changesets/action

2.1.2

Patch Changes

2.1.1

Patch Changes

2.1.0

Minor Changes

Patch Changes

2.0.0

Major Changes

v7.1.1

What's Changed

v7.1.0

What's Changed

Uh oh!

changeset-bot Bot commented Oct 16, 2026

⚠️ No Changeset found

Uh oh!

codspeed Bot commented Oct 16, 2026

Hooray! CodSpeed harness just leveled up!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`@changesets/action`