[dependabot]

Bumps the github-actions group with 6 updates in the / directory:

Package	From	To
codecov/codecov-action	7.0.0	7.1.1
jdx/mise-action	4.3.0	5.1.1
CodSpeedHQ/action	5.2.1	5.4.2
cloudflare/wrangler-action	4.0.0	4.1.3
actions/upload-artifact	7.0.1	7.0.2
actions/download-artifact	8.0.1	8.0.2

Updates codecov/codecov-action from 7.0.0 to 7.1.1

Release notes

Sourced from codecov/codecov-action's releases.

v7.1.1

What's Changed

• chore(release): 7.1.1 by @​thomasrockhu-codecov in codecov/codecov-action#1973

Full Changelog: codecov/codecov-action@v7.1.0...v7.1.1

v7.1.0

What's Changed

• chore(release): 7.1.0 by @​thomasrockhu-codecov in codecov/codecov-action#1971

Full Changelog: codecov/codecov-action@v7.0.0...v7.1.0

Commits

• 303a32d chore(release): 7.1.1 (#1973)
• 0b35c9e chore(release): 7.1.0 (#1971)
• See full diff in compare view

Updates jdx/mise-action from 4.3.0 to 5.1.1

Release notes

Sourced from jdx/mise-action's releases.

v5.1.1: GitHub token is no longer exported to later steps by default

mise-action no longer exports its GitHub token as MISE_GITHUB_TOKEN to every later step in the job. A new persist_github_token input lets you turn that back on, or pass a different token to later steps. This changes the default behavior. If later steps need the token, see Breaking Changes below.

Fixed

• The GitHub token now stays inside the action by default. Before this release, the github_token input (which defaults to ${{ github.token }}) was written to GITHUB_ENV as MISE_GITHUB_TOKEN. That let any later step read the token and call the GitHub API with the job's permissions, even if the step never asked for a credential. Now the token is set only for the mise-action step and the processes it starts. The action masks the token in logs. (#658 by @​jdx, reported in #657)

Added

• persist_github_token input (default false). It takes one of three values:

  • false: the token stays inside the action.
  • true: the token the action used is exported to later steps. If env.MISE_GITHUB_TOKEN is already set, it takes precedence over github_token.
  • A token value: that token is exported to later steps instead, for example a read-only token. The action still installs tools with github_token, or with MISE_GITHUB_TOKEN if it's already set.

  Setting false doesn't clear a MISE_GITHUB_TOKEN that was already set at the job level or exported by an earlier step. (#658 by @​jdx)

Breaking Changes

Check your workflow if a later step needs MISE_GITHUB_TOKEN, such as mise shims, mise exec, mise run or lazy tool installs that call the GitHub API. Those steps no longer get the token automatically and may hit GitHub API rate limits. To get the old behavior back, opt in:

- uses: jdx/mise-action@v5
  with:
    persist_github_token: true

Or give later steps a separate token:

- uses: jdx/mise-action@v5
  with:
    persist_github_token: ${{ secrets.READ_ONLY_TOKEN }}

Full Changelog: jdx/mise-action@v5.1.0...v5.1.1

v5.1.0: Tool version outputs, plugins input, and cached mise reuse

mise-action now reports the tool versions it installed as step outputs, can install mise plugins before tools, and can save the cache at the end of the job. Several caching fixes stop the action from downloading mise again on every run.

Added

• Tool versions as step outputs. After install, the action runs mise ls --json --current and sets a versions output. This is a JSON object of the active, installed tools. Each tool maps to a list of {version, requested_version, install_path, source} entries. Each tool also gets its own output with its resolved version, such as steps.mise.outputs.node. A tool only gets its own output if its name is a valid output name and isn't cache-hit or versions. Names like npm:@scope/pkg appear only in versions. If the action can't read the versions, it prints a warning and the step still succeeds. (#655 by @​jdx)

  - uses: jdx/mise-action@v5
    id: mise
  - run: echo "node ${{ steps.mise.outputs.node }}"

• plugins input. List plugins one per line as name or name url. Blank lines and # comments are ignored. The action runs mise plugins install -y for each one before mise install. Plugins that are already installed, for example restored from the cache, are left as they are. An unknown plugin fails the step. When plugins is set, its hash is added to the default cache key. Custom cache_key templates can use it as {{plugins_hash}}. If plugins is unset, existing cache keys don't change. (#656 by @​jdx)

  - uses: jdx/mise-action@v5

... (truncated)

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

---

5.1.2 - 2026-10-10

🐛 Bug Fixes

• continue with the existing mise when auto-update cannot replace it (#665) by @​jdx in #665
• export mise_dir as MISE_DATA_DIR so mise installs tools there (#672) by @​jdx in #672

📚 Documentation

• explain MISE_ENABLE_TOOLS in GitHub Actions (#667) by @​zeitlinger in #667
• update the Rust cache section for mise 2026.9.2 (#670) by @​jdx in #670

⚙️ Miscellaneous Tasks

• (ci) update pr-closer to v1.3.0 by @​jdx in 076ebfb
• (ci) lint workflows with jactionlint (#673) by @​jdx in #673
• (ci) switch to jactionlint v2 and drop zizmor (#674) by @​jdx in #674
• update pr-closer policy by @​jdx in 88f13e0
• fix the upload-artifact version comment (#671) by @​jdx in #671

---

5.1.1 - 2026-10-04

🐛 Bug Fixes

• make GitHub token persistence opt-in (#658) by @​jdx in #658

---

5.1.0 - 2026-10-04

🚀 Features

• output active tool versions (#655) by @​jdx in #655
• add opt-in cache_save_post input (#649) by @​jdx in #649
• add plugins input (#656) by @​jdx in #656

🐛 Bug Fixes

• (cache) keep a cached mise instead of re-downloading when version is unset (#642) by @​jdx in #642
• save cache after inexact cache restore (#646) by @​jdx in #646
• extract mise zip with PowerShell instead of unzip on Windows (#650) by @​jdx in #650
• cache mise binary for caches saved without a version record (#648) by @​jdx in #648

📚 Documentation

• explain the Rust cache caveat and workarounds (#651) by @​jdx in #651
• add matrix and external cache guides; warn on shadowed mise_toml (#654) by @​jdx in #654

... (truncated)

Commits

• 2d8d4ca chore: release v5.1.1 (#659)
• 3eb43e3 fix: make GitHub token persistence opt-in (#658)
• 94c60b3 chore: release v5.1.0 (#640)
• 4fff0c6 feat: add plugins input (#656)
• 893fc72 docs: add matrix and external cache guides; warn on shadowed mise_toml (#654)
• 41f5868 feat: add opt-in cache_save_post input (#649)
• 2fe229b fix: cache mise binary for caches saved without a version record (#648)
• abd75d9 fix: extract mise zip with PowerShell instead of unzip on Windows (#650)
• 4b9c295 docs: explain the Rust cache caveat and workarounds (#651)
• 7927c6f feat: output active tool versions (#655)
• Additional commits viewable in compare view

Updates CodSpeedHQ/action from 5.2.1 to 5.4.2

Release notes

Sourced from CodSpeedHQ/action's releases.

v5.4.2

Bumps the CodSpeed runner to v5.4.2, including v5.4.1.

This release improves and adds support for memory flamegraphs in C++, Python and Node.js.

Fixes flamegraphs for Python in simulation mode in the exec CLI.

🚀 Features

• Name Python and Node.js frames in memory flamegraphs: emit their perf maps in memory mode, and harvest perf maps and JIT unwind data for memory tracking, by @​not-matthias in #556
• Launch node with the codspeed-node V8 flags for the current mode in codspeed exec, including through npm, npx and #!/usr/bin/env node scripts, by @​not-matthias in #556

🐛 Bug Fixes

• Always set PYTHONPERFSUPPORT, so Python codspeed exec targets keep their Python frames in simulation-mode flamegraphs, by @​not-matthias in #577
• Fix memory flamegraph stacks: restore return addresses hijacked by uretprobes in nested allocator calls, compare mapped modules against their mapping, and keep every placement of a module mapped more than once, by @​not-matthias in #564, #563 and #556
• Only pass --interpreted-frames-native-stack to node in analysis mode by @​not-matthias in #556
• Label dropped benchmarks in the comparison table by @​adriencaccia in #570

⚙️ Internals

• Pin memtrack 1.6.1 and exec-harness 1.4.1, through 1.4.0, by @​adriencaccia in #575 and #580

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

• chore: bump runner version to 5.4.2 by @​github-actions[bot] in CodSpeedHQ/action#246

Full Changelog: CodSpeedHQ/action@v5.4.0...v5.4.2

v5.4.0

Bumps the CodSpeed runner to v5.4.0, including v5.3.0 and v5.3.1.

The Memory instrument now tracks physical (resident) memory and captures allocation call stacks to build memory flamegraphs. Both are enabled by default and can be turned off with the new disable-memory-track-physical and disable-memory-capture-stack inputs. Serialization is also faster on large memory benchmarks.

The action now exposes the id of the CodSpeed run as a run-id output, and CodSpeed now works on non-Ubuntu/Debian distributions such as Arch Linux.

🚀 Features

• Track physical memory and capture allocation call stacks for memory flamegraphs, both enabled by default by @​not-matthias in #529, #522 and #553
• Expose the run id as a GitHub Actions step output by @​moha-bekh in #551
• Add an --experimental-disable-pythonmalloc-override flag (CODSPEED_EXPERIMENTAL_DISABLE_PYTHONMALLOC_OVERRIDE) to stop overriding the Python allocator, which can break free-threaded Python in simulation mode, by @​not-matthias in #539
• Apply kernel memory tunables before memory-mode runs, and fail early when the kernel has no BTF by @​not-matthias in #507 and #524
• Pause producers under ring buffer pressure in memory mode, and log process stops per reason by @​not-matthias in #543
• Log which authentication method the run uses by @​fargito in #521

🐛 Bug Fixes

... (truncated)

Commits

• f842b9a Release v5.4.2 🚀
• d71714c chore: bump runner version to 5.4.2 (#246)
• c4fd08a Release v5.4.0 🚀
• 759ae97 feat: add disable-memory-capture-stack and disable-memory-track-physical inputs
• fe42bc0 chore: bump runner version to 5.4.0 (#244)
• c205870 feat: add a run-id output (#243)
• 48820ec chore: bump runner version to 5.3.1 (#240)
• 0fc899a feat: add experimental-memory-track-physical input
• 2d26491 chore: bump runner version to 5.3.0 (#239)
• See full diff in compare view

Updates cloudflare/wrangler-action from 4.0.0 to 4.1.3

Release notes

Sourced from cloudflare/wrangler-action's releases.

v4.1.3

Patch Changes

• #456 d3cfe74 Thanks @​podonnell-dev! - Document Wrangler 4.136.3 as the minimum version required for Workers Previews.

v4.1.2

Patch Changes

• #453 876f5b5 Thanks @​ericclemmons! - Create GitHub releases only after their compiled action tags are ready so immutable releases do not block publishing.

v4.1.1

[!WARNING] This release is broken due to a publishing issue and will fail when used in a workflow. Please update to v4.1.2 or v4. See #454 for details.

Patch Changes

• #451 429a99d Thanks @​podonnell-dev! - Pin Workers Preview examples and integration tests to Wrangler 4.136.3, which includes the Worker name in Preview artifacts.

v4.1.0

[!WARNING] This release is broken due to a publishing issue and will fail when used in a workflow. Please update to v4.1.2 or v4. See #454 for details.

Minor Changes

• #450 9500699 Thanks @​podonnell-dev! - Add support for Workers Previews, including Preview artifact parsing, Preview outputs, GitHub Deployments, and job summaries for wrangler preview.

Patch Changes

• #418 789ac84 Thanks @​vliggio! - Surface wrangler error messages in the action step output instead of showing only a generic failure message.

Changelog

Sourced from cloudflare/wrangler-action's changelog.

Changelog

4.1.3

Patch Changes

• #456 d3cfe74 Thanks @​podonnell-dev! - Document Wrangler 4.136.3 as the minimum version required for Workers Previews.

4.1.2

Patch Changes

• #453 876f5b5 Thanks @​ericclemmons! - Create GitHub releases only after their compiled action tags are ready so immutable releases do not block publishing.

4.1.1

Patch Changes

• #451 429a99d Thanks @​podonnell-dev! - Pin Workers Preview examples and integration tests to Wrangler 4.136.3, which includes the Worker name in Preview artifacts.

4.1.0

Minor Changes

• #450 9500699 Thanks @​podonnell-dev! - Add support for Workers Previews, including Preview artifact parsing, Preview outputs, GitHub Deployments, and job summaries for wrangler preview.

Patch Changes

• #418 789ac84 Thanks @​vliggio! - Surface wrangler error messages in the action step output instead of showing only a generic failure message.

4.0.0

Major Changes

• #412 1029e90 Thanks @​ericclemmons! - Update default Wrangler version to v4 (latest). The action now installs Wrangler v4 by default when no wranglerVersion input is specified. Users can still pin to v3 by setting wranglerVersion: "3.90.0" explicitly.

3.15.0

Minor Changes

• #426 febbda6 Thanks @​WillTaylorDev! - Support version ranges and tags in wranglerVersion input. You can now set wranglerVersion to values like 4, ^4.0.0, 4.x, or latest instead of only exact versions like 4.81.0.

3.14.1

Patch Changes

• #358 cd6314a Thanks @​penalosa! - Use secret bulk instead of deprecated secret:bulk command

3.14.0

... (truncated)

Commits

• 953926a Automatic compilation
• a17640a Merge pull request #457 from cloudflare/changeset-release/main
• 8d350f6 Version Packages
• df82e37 Merge pull request #456 from cloudflare/podonnell/preview-comms
• d3cfe74 WC-6082 [previews] adjust wrangler guidance to v4.136.3
• d4d1b2d Merge pull request #455 from cloudflare/changeset-release/main
• 1e45d72 Version Packages
• 194026b Merge pull request #453 from cloudflare/codex/fix-immutable-releases
• 5fa9855 docs: Explain immutable release sequencing
• d7fd981 refactor: Keep release publishing retryable
• Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

• cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
• c2acded chore: prepare v7.0.2 release
• 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
• 8cbe1be Bump @​actions/artifact to 6.3.1
• See full diff in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

• Update the readme by @​danwkennedy in actions/download-artifact#473
• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Update @​actions/artifact to 6.3.1 by @​tunc-d in actions/download-artifact#492
• Prepare download-artifact v8.0.2 by @​tunc-d in actions/download-artifact#493

New Contributors

• @​tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits

• 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
• e455989 Prepare download-artifact v8.0.2
• a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
• 29bb7ce Update @​actions/artifact to 6.3.1
• 484a0b5 Update the readme (#473)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Summary by cubic

Bumps six GitHub Actions across the CI workflows to their latest versions, including a major bump for jdx/mise-action from v4 to v5.

Migration

• jdx/mise-action v5 no longer exports the GitHub token as MISE_GITHUB_TOKEN to subsequent steps by default. The current workflows don't read that token after the action step, so no changes are needed.

^{Written for commit 413f74d. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T02:36:34.125925Z	413f74d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codspeed]

Merging this PR will not alter performance

⚠️ 1 benchmark spent significant time in system calls

System calls cannot be consistently instrumented, so they are not included in the measure, which understates the real cost. Please switch to the Walltime instrument to accurately measure system calls.

Measurement and system calls

• parse_sql_statement[SELECT * FROM public.orders WHERE id = 1]

✅ 18 untouched benchmarks

---

_{Comparing dependabot/github_actions/github-actions-f85dccba16 (413f74d) with main (e722aca)}

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.