build(deps): bump the dependencies group with 7 updates

[dependabot]

Bumps the dependencies group with 7 updates:

Package	From	To
CodSpeedHQ/action	5.0.1	5.0.2
taiki-e/install-action	2.85.5	2.85.7
github/codeql-action/init	4.37.4	4.37.5
github/codeql-action/analyze	4.37.4	4.37.5
pnpm/action-setup	6.0.9	6.0.10
bnjbvr/cargo-machete	ac0dd02a52045ebd396ee85252f8a4919fdbf6f1	5a6550345dd59f4450caa4cf7779438e875e8914
zizmorcore/zizmor-action	0.6.1	0.6.2

Updates CodSpeedHQ/action from 5.0.1 to 5.0.2

Release notes

Sourced from CodSpeedHQ/action's releases.

v5.0.2

What's Changed

• feat: add cycle-estimation and exclude-allocations inputs by @​not-matthias in CodSpeedHQ/action#229

Full Changelog: CodSpeedHQ/action@v5.0.1...v5.0.2

Commits

• 0ca9cbb Release v5.0.2 🚀
• 551137a ci: restrict GITHUB_TOKEN to contents: read
• fc63264 feat: add cycle-estimation and exclude-allocations inputs
• See full diff in compare view

Updates taiki-e/install-action from 2.85.5 to 2.85.7

Release notes

Sourced from taiki-e/install-action's releases.

2.85.7

• Update wasmtime@latest to 47.0.3.

• Update uv@latest to 0.12.1.

• Update rclone@latest to 1.75.0.

• Update kingfisher@latest to 1.110.0.

2.85.6

• Update wasm-tools@latest to 1.255.0.

• Update tombi@latest to 1.2.5.

• Update mise@latest to 2026.7.18.

• Update cargo-neat@latest to 0.5.3.

• Update cargo-crap@latest to 0.4.0.

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.85.11] - 2026-08-09

• Update zola@latest to 0.23.2.

• Update wasm-bindgen@latest to 0.2.127.

• Update uv@latest to 0.12.3.

• Update osv-scanner@latest to 2.5.0.

• Update mise@latest to 2026.8.3.

• Update kingfisher@latest to 1.112.0.

• Update editorconfig-checker@latest to 3.10.0.

[2.85.10] - 2026-08-07

• Update uv@latest to 0.12.2.

• Update tombi@latest to 1.2.7.

• Update cosign@latest to 3.1.3.

• Update coreutils@latest to 0.10.0.

• Update cargo-rdme@latest to 2.2.0.

• Update cargo-crap@latest to 0.4.3.

[2.85.9] - 2026-08-06

• Update zola@latest to 0.23.1.

• Update wild@latest to 0.10.0.

• Update mise@latest to 2026.8.2.

... (truncated)

Commits

• 67729d5 Release 2.85.7
• d247d7e Update wasmtime manifest
• 9197a82 Update zizmor manifest
• 68f6cd5 Update wasmtime@latest to 47.0.3
• 377ee3f Update uv@latest to 0.12.1
• 8724fbf Update rclone@latest to 1.75.0
• 8d0062e Update mise manifest
• 28977a5 Update kingfisher@latest to 1.110.0
• b951679 Update cargo-semver-checks manifest
• 1beb33e Release 2.85.6
• Additional commits viewable in compare view

Updates github/codeql-action/init from 4.37.4 to 4.37.5

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

... (truncated)

Commits

• d1ba80a Merge pull request #4067 from github/update-v4.37.5-1cd4d01d5
• e74600b Update changelog for v4.37.5
• 1cd4d01 Merge pull request #4061 from github/henrymercer/turbo-system
• d2bfc30 Merge pull request #4050 from github/mbg/status/registries
• 68028fc Merge pull request #4062 from github/sam-robson/migrate-enterprise-release-pat
• c29563e ci: use federated enterprise release PAT
• 155e522 Link the PR from the changelog entry
• 2d3b351 Handle network errors when streaming the CodeQL bundle download
• 5d3eb98 Merge pull request #4055 from github/dependabot/npm_and_yarn/npm-minor-203262...
• c5f739b Merge branch 'main' into dependabot/npm_and_yarn/npm-minor-2032624187
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.4 to 4.37.5

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

... (truncated)

Commits

• d1ba80a Merge pull request #4067 from github/update-v4.37.5-1cd4d01d5
• e74600b Update changelog for v4.37.5
• 1cd4d01 Merge pull request #4061 from github/henrymercer/turbo-system
• d2bfc30 Merge pull request #4050 from github/mbg/status/registries
• 68028fc Merge pull request #4062 from github/sam-robson/migrate-enterprise-release-pat
• c29563e ci: use federated enterprise release PAT
• 155e522 Link the PR from the changelog entry
• 2d3b351 Handle network errors when streaming the CodeQL bundle download
• 5d3eb98 Merge pull request #4055 from github/dependabot/npm_and_yarn/npm-minor-203262...
• c5f739b Merge branch 'main' into dependabot/npm_and_yarn/npm-minor-2032624187
• Additional commits viewable in compare view

Updates pnpm/action-setup from 6.0.9 to 6.0.10

Release notes

Sourced from pnpm/action-setup's releases.

v6.0.10

What's Changed

• docs(README): point users to the successor pnpm/setup action by @​BlackHole1 in pnpm/action-setup#282
• refactor: introduce restore keys for cache by @​SukkaW in pnpm/action-setup#280
• ci: use pnpm 11 for pr-check by @​jamietanna in pnpm/action-setup#284
• fix: update pnpm to v11.19.0 by @​jamietanna in pnpm/action-setup#283
• docs: update README to include devEngines.packageManager by @​nemchik in pnpm/action-setup#273

New Contributors

• @​jamietanna made their first contribution in pnpm/action-setup#284
• @​nemchik made their first contribution in pnpm/action-setup#273

Full Changelog: pnpm/action-setup@v6...v6.0.10

Commits

• 0977fd9 docs: Update README to include devEngines.packageManager (#273)
• 48261ac fix: update pnpm to v11.19.0 (#283)
• 75677f7 ci: use pnpm 11 for pr-check (#284)
• 769ae71 refactor: introduce restore keys for cache (#280)
• 6fed91f docs(README): point users to the successor pnpm/setup action (#282)
• See full diff in compare view

Updates bnjbvr/cargo-machete from ac0dd02a52045ebd396ee85252f8a4919fdbf6f1 to 5a6550345dd59f4450caa4cf7779438e875e8914

Changelog

Sourced from bnjbvr/cargo-machete's changelog.

unreleased

• Improved: add renamed table to track renamed crates (#152 #153).

0.7.0 (released on 2024-09-25)

• Breaking change: Don't search in ignored files (those specified in .ignore/.gitignore) by default. It's possible to use --no-ignore to search in these directories by default (#137).
• Improved: fix false positives for multi dependencies single use statements (#120). This improves precision at the cost of a small performance hit.
• Improved: make usage of --with-metadata more accurate (#122, #132).
• Improved: instead of displaying . for the current directory, cargo-machete will now display this directory (#109).
• Added: There's now an automated docker image build that publishes to the github repository (#121).
• Added: --ignore flag which make cargo-machete respect .ignore and .gitignore files when searching for files (#95).

0.6.2 (released on 2024-03-24)

• Added: shorter display when scanning the current directory (#109).
• Fix: adapt to latest pkgid specification, so as not to crash with --with-metadata (#106).

0.6.1 (released on 2024-02-21)

• Chore: bump major dependencies, to fix parsing issues of Cargo.toml files (#101, #105).

0.6.0 (released on 2023-09-23)

• Breaking/improved: match against crate name case-insensitive (#69).
• Added: Github action (#85). See README for documentation.
• Added: support for ignored workspace dependencies (#57, #86). See README for documentation.
• Added: --version switch to print the version (#66).
• Fix: avoid searching for workspace Cargo.toml longer than needed (#84).
• Chore: better documentation and reporting (#63, #72, #80).

0.5.0 (released on 2022-11-15)

• Breaking: Use argh for parsing. Now, paths of directories to scan must be passed in the last position, when running from the command line (#51).
• Fix rare false positive and speed up most common case (#53).
• Fix loading properties from workspace (#54).

0.4.0 (released on 2022-10-16)

• Added --skip-target-dir to not analyze target/ directories.
• Added a message indicating of any unused dependencies were found or not.
• Support for workspace properties

0.3.1 (released on 2022-06-12)

• Support empty global prefix, e.g. use ::log;.

0.3.0 (released on 2022-05-09)

... (truncated)

Commits

• 5a65503 build(deps): bump ignore from 0.4.31 to 0.4.33
• See full diff in compare view

Updates zizmorcore/zizmor-action from 0.6.1 to 0.6.2

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.2

zizmor 1.29.0 is now the default version.

Commits

• 3dc1ecc Sync zizmor versions (#149)
• dc57e30 chore(deps): bump the github-actions group with 3 updates (#147)
• d94880a README: bump pins (#146)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions