chore(deps): update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Adoption	Passing	Confidence
actions/setup-node	action	minor	v6.3.0 → v6.4.0
cargo-bins/cargo-binstall	action	digest	d125de8 → 7884ded
codecov/codecov-action	action	patch	v6.0.0 → v6.0.1
pnpm (source)	uses-with	patch	10.33.2 → 10.33.4
pnpm/action-setup	action	patch	v6.0.5 → v6.0.8
taiki-e/install-action	action	minor	v2.75.18 → v2.79.1	v2.79.8 (+6)

---

Release Notes

actions/setup-node (actions/setup-node)

v6.4.0

Compare Source

codecov/codecov-action (codecov/codecov-action)

v6.0.1

Compare Source

What's Changed

• fix: prevent template injection in run: steps (VULN-1652) by @​thomasrockhu-codecov in #​1947
• chore(release): 6.0.1 by @​thomasrockhu-codecov in #​1949

Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1

pnpm/pnpm (pnpm)

v10.33.4: pnpm 10.33.4

Compare Source

Patch Changes

• Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.

  A new gitHosted: true field is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.

• Fix a regression where pnpm --recursive --filter '!<pkg>' run/exec/test/add would include the workspace root in the matched projects. The workspace root is now correctly excluded by default when only negative --filter arguments are provided, matching the documented behavior. To include the root, pass --include-workspace-root #​11341.

Platinum Sponsors

Gold Sponsors

v10.33.3

Compare Source

pnpm/action-setup (pnpm/action-setup)

v6.0.8

Compare Source

v6.0.7

Compare Source

v6.0.6

Compare Source

What's Changed

• fix: bin_dest output points to self-updated pnpm, not bootstrap by @​zkochan in #​249

Full Changelog: pnpm/action-setup@v6.0.5...v6.0.6

taiki-e/install-action (taiki-e/install-action)

v2.79.1: 2.79.1

Compare Source

• Update tombi@latest to 0.11.5.

• Update cargo-nextest@latest to 0.9.136.

• Update typos@latest to 1.46.2.

• Update mise@latest to 2026.5.10.

v2.79.0: 2.79.0

Compare Source

• Support more host architectures. (#​1841, thanks @​Gelbpunkt)

• Deprecate mdbook-alerts because the feature now included in mdbook and the repository has been archived. (#​1844)

• Deprecate iai-callgrind-runner because it has been renamed to gungraun-runner. gungraun-runner is also supported by this action. (#​1844)

v2.78.3: 2.78.3

Compare Source

• Update zizmor@latest to 1.25.2.

• Update cargo-zigbuild@latest to 0.22.3. (#​1814, thanks @​simonhollingshead)

• Update wasm-tools@latest to 1.249.0.

• Update gungraun-runner@latest to 0.19.0.

v2.78.2: 2.78.2

Compare Source

• Update wasm-pack@latest to 0.15.0.

• Update zizmor@latest to 1.25.0.

• Update mise@latest to 2026.5.9.

• Update cargo-nextest@latest to 0.9.135.

• Update cyclonedx@latest to 0.32.0.

• Update prek@latest to 0.4.0.

v2.78.1: 2.78.1

Compare Source

• Update mise@latest to 2026.5.7.

• Diagnostic improvements.

v2.78.0: 2.78.0

Compare Source

• Support cargo-mutants. (#​1812, thanks @​jakewimmer)

• Update covgate@latest to 0.2.0.

• Update cargo-llvm-cov@latest to 0.8.7.

• Update uv@latest to 0.11.14.

• Update martin@latest to 1.9.1.

• Update tombi@latest to 0.11.4.

v2.77.7: 2.77.7

Compare Source

• Update mise@latest to 2026.5.6.

• Update cargo-deny@latest to 0.19.6.

v2.77.6: 2.77.6

Compare Source

• Fix wasm-pack installation failure.

• Update mise@latest to 2026.5.5.

• Update release-plz@latest to 0.3.158.

• Update just@latest to 1.51.0.

v2.77.5: 2.77.5

Compare Source

• Update biome@latest to 2.4.15.

• Update mise@latest to 2026.5.4.

• Update cargo-deny@latest to 0.19.5.

v2.77.4: 2.77.4

Compare Source

• Update tombi@latest to 0.11.1.

• Update cargo-llvm-cov@latest to 0.8.6.

• Update uv@latest to 0.11.12.

v2.77.3: 2.77.3

Compare Source

• Update typos@latest to 1.46.1.

• Update rclone@latest to 1.74.1.

• Update tombi@latest to 0.11.0.

• Update osv-scanner@latest to 2.3.8.

• Update mise@latest to 2026.5.3.

v2.77.2: 2.77.2

Compare Source

• Update martin@latest to 1.9.0.

• Update wasm-bindgen@latest to 0.2.121.

• Update uv@latest to 0.11.11.

• Update mise@latest to 2026.5.1.

• Update prek@latest to 0.3.13.

• Update tombi@latest to 0.10.6.

v2.77.1: 2.77.1

Compare Source

• Support taiki-e/install-action@rust tag.

• Update tombi@latest to 0.10.3.

• Update martin@latest to 1.8.2.

v2.77.0: 2.77.0

Compare Source

• Support rust. (#​1779)

  This installs rust using rustup.

  If rustup is not yet installed, this action downloads rustup-init for the current platform using HTTPS with tlsv1.2+, verifies SHA256 checksum, and then installs rustup using it.

  This also supports installing additional components at the same time by +<additional> syntax:

  - uses: taiki-e/install-action@v2
    with:
      # Install rust stable with rustfmt component and wasm32-wasip1 target.
      tool: rust+rustfmt+wasm32-wasip1
      # When installing another rust version:
      # tool: rust@nightly + rustfmt + wasm32-wasip1

• Fix issue where x86_64 binary will be installed on AArch64 Windows even when AArch64 Windows binary available.

• Update mise@latest to 2026.5.0.

• Diagnostic improvements.

v2.76.0: 2.76.0

Compare Source

• Support mdbook-d2. (#​1737, thanks @​nhu)

• Support cargo-apple-runner. (#​1731, thanks @​madsmtm)

• Support cargo-binstall on riscv64 Linux.

• Update cargo-deb@latest to 3.7.0.

• Update tombi@latest to 0.10.2.

v2.75.30: 2.75.30

Compare Source

• Support cargo-spellcheck on AArch64 Linux/Windows.

• Update cargo-spellcheck@latest to 0.15.7.

• Update biome@latest to 2.4.14.

v2.75.29: 2.75.29

Compare Source

• Update syft@latest to 1.44.0.

• Update rclone@latest to 1.74.0.

• Update osv-scanner@latest to 2.3.6.

v2.75.28: 2.75.28

Compare Source

• Update wasmtime@latest to 44.0.1.

• Update typos@latest to 1.46.0.

• Update tombi@latest to 0.10.1.

• Update sccache@latest to 0.15.0.

• Update mise@latest to 2026.4.28.

• Update gungraun-runner@latest to 0.18.2.

• Update cyclonedx@latest to 0.31.0.

v2.75.27: 2.75.27

Compare Source

• Update cargo-udeps@latest to 0.1.61.

• Update wasm-tools@latest to 1.248.0.

• Update cargo-deb@latest to 3.6.4.

v2.75.26: 2.75.26

Compare Source

• Update wasm-bindgen@latest to 0.2.120.

• Update mise@latest to 2026.4.25.

• Update martin@latest to 1.8.0.

• Update vacuum@latest to 0.26.4.

v2.75.25: 2.75.25

Compare Source

• Update uv@latest to 0.11.8.

• Update typos@latest to 1.45.2.

• Update tombi@latest to 0.9.25.

• Update mise@latest to 2026.4.24.

v2.75.24: 2.75.24

Compare Source

• Update prek@latest to 0.3.11.

• Update mise@latest to 2026.4.23.

• Update vacuum@latest to 0.26.3.

v2.75.23: 2.75.23

Compare Source

• Update vacuum@latest to 0.26.2.

• Update tombi@latest to 0.9.24.

• Update mise@latest to 2026.4.22.

• Update martin@latest to 1.7.0.

• Update git-cliff@latest to 2.13.1.

• Update cargo-tarpaulin@latest to 0.35.4.

• Update cargo-sort@latest to 2.1.4.

v2.75.22: 2.75.22

Compare Source

• Update tombi@latest to 0.9.22.

• Update biome@latest to 2.4.13.

v2.75.21: 2.75.21

Compare Source

• Update mise@latest to 2026.4.19.

• Update tombi@latest to 0.9.21.

• Update syft@latest to 1.43.0.

v2.75.20: 2.75.20

Compare Source

• Update prek@latest to 0.3.10.

• Update cargo-xwin@latest to 0.22.0.

v2.75.19: 2.75.19

Compare Source

• Update wasmtime@latest to 44.0.0.

• Update tombi@latest to 0.9.20.

• Update martin@latest to 1.6.0.

• Update just@latest to 1.50.0.

• Update mise@latest to 2026.4.18.

• Update rclone@latest to 1.73.5.

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "before 8am on saturday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codspeed-hq]

Merging this PR will not alter performance

⚡ 1 improved benchmark
❌ 1 regressed benchmark
✅ 10 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
⚡	Memory	resolver[pnp resolve]	8.8 KB	8.4 KB	+4.25%
❌	Memory	resolver[multi-thread]	10.6 MB	11 MB	-3.02%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing renovate/github-actions (eb4b233) with main (c7167a1)}

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.