Skip to content

[COD-3196] fix(callgrind): represent os threads under --separate-threads=yes - #24

Merged
GuillaumeLagrange merged 2 commits into
masterfrom
cod-3196-fix-valgrind-separate-threadsyes-behavior-to-represent-os
Jul 30, 2026
Merged

[COD-3196] fix(callgrind): represent os threads under --separate-threads=yes#24
GuillaumeLagrange merged 2 commits into
masterfrom
cod-3196-fix-valgrind-separate-threadsyes-behavior-to-represent-os

Conversation

@GuillaumeLagrange

Copy link
Copy Markdown
Contributor

Make callgrind per-thread dumps (--separate-threads=yes) behave like OS
threads: a thread spawns, runs, ends, and its costs stay attributed to it —
under the part being dumped, kept separate from other threads that reused its
slot, and tagged with its name.

Why it misbehaved

Two independent causes:

  1. Slot reuse. The valgrind core recycles ThreadId slots on exit.
    Callgrind keyed all per-thread state — and BBCC identity — on that slot with
    no thread-exit hook, so a new OS thread landing on a recycled slot silently
    appended its costs to the dead thread's containers.
  2. Mid-run dumps only flushed the caller. CALLGRIND_DUMP_STATS dumped only
    the current thread; since dumping is destructive, every other thread's whole
    history was deferred to the termination dump, showing up once under the final
    part.

What changed

  • Each thread_info gets a monotonic serial, independent of the recycled
    slot; used for the thread: header and -NN file suffix.
  • BBCC identity re-keyed on the serial (was the raw tid). This is the real
    fix for slot reuse — the per-BB LRU cache and hash lookup compared the tid, so
    a reused slot otherwise re-merged or tripped the clone_bbcc assertion.
  • A pre_thread_ll_exit hook unwinds the exiting thread, snapshots its name,
    and retires it (freed once flushed). Gated on separate_threads — the =no
    path is byte-for-byte untouched.
  • Every thread is flushed at each part dump (live + retired), so each
    thread's delta lands under the part being dumped. Zero-delta threads are
    skipped uniformly (incl. termination), which cleanly absorbs a thread that
    lived entirely inside an instrumentation-off window.
  • CALLGRIND_ZERO_STATS zeros all threads under separate_threads.
  • New VG_(get_thread_name) tool API surfaces the core's thread name, emitted
    as a desc: Thread name: line for the backend (COD-3197) to parse.

The retire path is safe on an already-unwound/empty state, so it survives the
STOP/START_INSTRUMENTATION the codspeed integrations wrap benchmarks in.

Review notes

  • callgrind/threads.c (retire + retired-list iteration) and callgrind/dump.c
    (per-part flush, retired-thread install, zero-delta skip) are the core of the
    change; bbcc.c is the serial re-keying.
  • The main thread is itself retired on its own exit before finalisation, so the
    termination dump also iterates the retired list.

Validation

Two new regression tests: thread-serial (sequential named workers with a dump
between them → two distinct serials, name emitted, costs under the dumped part)
and thread-instr (instrumentation toggling + an off-window thread → no crash,
no spurious section). Full callgrind make check (25 tests, incl. the existing
--separate-threads=yes threads/threads-use) and cachegrind suite (17,
guards the shared core change) pass. Manually re-ran the COD-3188 repros
(sequential, parallel, dump-while-running) — topology as expected.

Draft: opening for early review; will un-draft once the backend side (COD-3197)
is ready to consume the format.

Refs COD-3196

@greptile-apps

greptile-apps Bot commented Jul 20, 2026

Copy link
Copy Markdown

Greptile Summary

This PR fixes Callgrind per-thread dumps for recycled thread slots and mid-run dumps. The main changes are:

  • Tracks a stable OS thread ID on each Callgrind thread record.
  • Re-keys BBCC ownership checks on the stable thread ID.
  • Retires exited thread state so it can be flushed after exit.
  • Flushes live and retired threads for each dump part in separate-thread mode.
  • Drops retired thread state when stats are zeroed.
  • Adds tool APIs for reading live thread names and LWP IDs.

Confidence Score: 5/5

This looks safe to merge.

  • The retired-thread zero boundary is now handled by resetting live threads and dropping exited thread state.
  • No blocking issues were found in the changed code.

Important Files Changed

Filename Overview
callgrind/main.c Updates stats zeroing so separate-thread mode resets live threads and clears retired thread state.
callgrind/threads.c Adds stable thread identity, retired-thread tracking, exit handling, and cleanup helpers.
callgrind/dump.c Flushes live and retired thread sections per dump part and emits thread metadata.
callgrind/bbcc.c Uses stable OS thread IDs for BBCC lookup, creation, and clone checks.
callgrind/global.h Extends thread metadata and declares the new thread lifecycle helpers.
coregrind/m_threadstate.c Adds guarded core accessors for thread names and LWP IDs.
include/pub_tool_threadstate.h Exposes thread name and LWP ID accessors to Valgrind tools.

Reviews (8): Last reviewed commit: "fix(callgrind): represent os threads und..." | Re-trigger Greptile

Comment thread callgrind/main.c
Comment thread callgrind/tests/thread-serial.c Outdated
Comment thread callgrind/tests/thread-instr.c Outdated
@codspeed-hq

codspeed-hq Bot commented Jul 20, 2026

Copy link
Copy Markdown

Merging this PR will not alter performance

✅ 84 untouched benchmarks
⏩ 60 skipped benchmarks1


Comparing cod-3196-fix-valgrind-separate-threadsyes-behavior-to-represent-os (8a969c4) with master (448b7d0)2

Open in CodSpeed

Footnotes

  1. 60 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports.

  2. No successful run was found on master (8a969c4) during the generation of this report, so 448b7d0 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report.

@GuillaumeLagrange
GuillaumeLagrange force-pushed the cod-3196-fix-valgrind-separate-threadsyes-behavior-to-represent-os branch from 3da752a to 2450e56 Compare July 21, 2026 09:23
Comment thread callgrind/main.c
Comment thread callgrind/tests/thread-serial.c Outdated
Comment thread callgrind/tests/thread-instr.c Outdated
@GuillaumeLagrange
GuillaumeLagrange force-pushed the cod-3196-fix-valgrind-separate-threadsyes-behavior-to-represent-os branch from 2450e56 to e29c5d7 Compare July 21, 2026 15:07
Comment thread callgrind/main.c
@GuillaumeLagrange
GuillaumeLagrange force-pushed the cod-3196-fix-valgrind-separate-threadsyes-behavior-to-represent-os branch from e29c5d7 to 8e927b0 Compare July 21, 2026 15:11
Comment thread callgrind/main.c
@GuillaumeLagrange
GuillaumeLagrange force-pushed the cod-3196-fix-valgrind-separate-threadsyes-behavior-to-represent-os branch from 8e927b0 to 5cae7e2 Compare July 21, 2026 15:49
@GuillaumeLagrange
GuillaumeLagrange marked this pull request as ready for review July 22, 2026 07:48
@art049

art049 commented Jul 22, 2026

Copy link
Copy Markdown
Member

I'll review as well

@art049
art049 self-requested a review July 22, 2026 08:13

@not-matthias not-matthias left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Comment thread callgrind/global.h
Comment thread callgrind/threads.c Outdated
@GuillaumeLagrange
GuillaumeLagrange force-pushed the cod-3196-fix-valgrind-separate-threadsyes-behavior-to-represent-os branch 6 times, most recently from c54604c to 76813e6 Compare July 29, 2026 10:00
GuillaumeLagrange and others added 2 commits July 30, 2026 17:31
Make per-thread dumps behave like OS threads. The valgrind core recycles
ThreadId slots and callgrind keyed all per-thread state on that slot, so
a new OS thread reusing a slot silently inherited the dead thread's
identity and costs. Mid-run client-request dumps also only flushed the
calling thread, deferring every other thread's history to the
termination dump.

- Key thread identity (BBCC lookup, "thread:" header, dump suffix) on a
  monotonic serial instead of the recycled ThreadId slot.
- Retire exiting threads via a pre_thread_ll_exit hook: unwind, snapshot
  their name, move them to a retired list so their costs stay attributed
  across the rest of the run. Gated on separate_threads.
- Flush every thread, live and retired, at each dump so per-thread
  deltas land under the part being dumped, in ascending serial order.
  Threads with a zero delta are skipped; if that skips a whole part
  (metadata dumps with instrumentation off, termination), force one
  empty section so the part and its trigger metadata survive. Key the
  combined-dump header on file state, not out_counter, so it is written
  even when leading parts are skipped.
- Zero every thread on CALLGRIND_ZERO_STATS under separate_threads.
- Emit the core's thread name as a "desc: Thread name:" line, picked up
  by the backend in COD-3197.

Refs COD-3196
Only the thread issuing CALLGRIND_START_INSTRUMENTATION had its shadow
call stack seeded from the native one. A thread parked in a syscall at
the transition has a non-empty native stack and an empty shadow stack
just the same, so its first ret underflows: handleUnderflow pushes the
returned-into frame as a fresh top-level context without consulting
fn->skip, and an obj-skipped frame becomes a visible root carrying
everything the thread runs afterwards.

Under pytest-codspeed this put a CPython interpreter frame at the root
of every thread-pool worker, holding ~100% of that thread's cost. With
CPython 3.14's tail-calling interpreter the leaked frame is a
_TAIL_CALL_<OPCODE> handler, named after whichever opcode was
mid-execution when the worker parked in queue.get().

Seed all live threads instead, each under its own switch_thread since
the call stack, context chain and fn stack live in globals belonging to
whichever thread is switched in. A thread other than the running one is
unwound from the register state saved when it was descheduled; if that
yields a single frame the unwinder never got past the syscall, and
seeding one entry with a fabricated entry SP would re-parent the
thread's later work under it, so leave it empty.

Threads created after the transition are deliberately not covered: they
start at their real entry point with a genuinely empty stack.

Closes COD-2349
Co-Authored-By: Claude <noreply@anthropic.com>
@GuillaumeLagrange
GuillaumeLagrange force-pushed the cod-3196-fix-valgrind-separate-threadsyes-behavior-to-represent-os branch from f33ed05 to 8a969c4 Compare July 30, 2026 15:31
@GuillaumeLagrange
GuillaumeLagrange merged commit 8a969c4 into master Jul 30, 2026
7 checks passed
@GuillaumeLagrange
GuillaumeLagrange deleted the cod-3196-fix-valgrind-separate-threadsyes-behavior-to-represent-os branch July 30, 2026 15:34
euntaek-hong pushed a commit to wrongbutworks/opentelemetry-collector that referenced this pull request Aug 25, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) |
action | minor | `v5.0.3` → `v5.2.1` |

---

### Release Notes

<details>
<summary>CodSpeedHQ/action (CodSpeedHQ/action)</summary>

###
[`v5.2.1`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.2.1)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.2.0...v5.2.1)

Bumps the CodSpeed runner to
[v5.2.1](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.2.1).

##### 🚀 Features

- Add a `simulation-track-subprocess` input, which enables measuring the
subprocesses spawned by the benchmarked process in `simulation` mode by
[@&open-telemetry#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&open-telemetry#8203;235](https://redirect.github.com/CodSpeedHQ/action/pull/235)
- Bump the go-runner to
[v1.3.0](https://redirect.github.com/CodSpeedHQ/codspeed-go/releases/tag/v1.3.0),
adding Go 1.26 and 1.27 support by
[@&open-telemetry#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&open-telemetry#8203;516](https://redirect.github.com/CodSpeedHQ/codspeed/pull/516)

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

#### What's Changed

- feat: add simulation-track-subprocess input by
[@&open-telemetry#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&open-telemetry#8203;235](https://redirect.github.com/CodSpeedHQ/action/pull/235)
- chore: bump runner version to 5.2.1 by
[@&open-telemetry#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&open-telemetry#8203;236](https://redirect.github.com/CodSpeedHQ/action/pull/236)

**Full Changelog**:
<CodSpeedHQ/action@v5.2.0...v5.2.1>

###
[`v5.2.0`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.2.0)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.0.3...v5.2.0)

Bumps the CodSpeed runner to
[v5.2.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.2.0),
including
[v5.1.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.1.0).

##### 🚀 Features

- Add a `--simulation-track-subprocess` flag that enables tracking
benchmark subprocesses, along with per-thread dumps by
[@&open-telemetry#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&open-telemetry#8203;493](https://redirect.github.com/CodSpeedHQ/codspeed/pull/493)
and
[#&open-telemetry#8203;513](https://redirect.github.com/CodSpeedHQ/codspeed/pull/513)
- Collect RSS via rss\_stat and folio-rmap reconstruction by
[@&open-telemetry#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&open-telemetry#8203;453](https://redirect.github.com/CodSpeedHQ/codspeed/pull/453)
- Support CircleCI for GitHub repositories by
[@&open-telemetry#8203;fargito](https://redirect.github.com/fargito) in
[#&open-telemetry#8203;482](https://redirect.github.com/CodSpeedHQ/codspeed/pull/482)

##### 🐛 Bug Fixes

- Fix cache behavior that was causing an apt reinstall of the libc debug
symbols despite cache restore by
[@&open-telemetry#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&open-telemetry#8203;509](https://redirect.github.com/CodSpeedHQ/codspeed/pull/509)

##### ⚙️ Internals

- Bump pinned valgrind-codspeed to
[3.26.0-0codspeed7](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/releases/tag/3.26.0-0codspeed7)
by [@&open-telemetry#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&open-telemetry#8203;515](https://redirect.github.com/CodSpeedHQ/codspeed/pull/515)
- fix(callgrind): represent os threads under `--separate-threads=yes` by
[@&open-telemetry#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[CodSpeedHQ/valgrind-codspeed#24](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/24)
- feat(callgrind): track subprocesses across fork and exec by
[@&open-telemetry#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[CodSpeedHQ/valgrind-codspeed#25](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/25)
- Stop skipping the rustup wrapper for valgrind by
[@&open-telemetry#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&open-telemetry#8203;493](https://redirect.github.com/CodSpeedHQ/codspeed/pull/493)

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

#### What's Changed

- fix: add the distribution to the instruments cache key by
[@&open-telemetry#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in [#&open-telemetry#8203;233](https://redirect.github.com/CodSpeedHQ/action/pull/233)
- chore: bump runner version to 5.1.0 by
[@&open-telemetry#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&open-telemetry#8203;232](https://redirect.github.com/CodSpeedHQ/action/pull/232)
- chore: bump runner version to 5.2.0 by
[@&open-telemetry#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&open-telemetry#8203;234](https://redirect.github.com/CodSpeedHQ/action/pull/234)

**Full Changelog**:
<CodSpeedHQ/action@v5.0.3...v5.2.0>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - "on tuesday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/open-telemetry/opentelemetry-collector).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zOS4wIiwidXBkYXRlZEluVmVyIjoiNDQuMzkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwicmVub3ZhdGVib3QiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Aureliolo added a commit to Aureliolo/synthorg that referenced this pull request Aug 29, 2026
> ℹ️ **Note**
> 
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Type | Update | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) |
action | minor | `v5.0.3` → `v5.2.1` |
![age](https://developer.mend.io/api/mc/badges/age/github-tags/CodSpeedHQ%2faction/v5.2.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/CodSpeedHQ%2faction/v5.0.3/v5.2.1?slim=true)
|
| [anchore/sbom-action](https://redirect.github.com/anchore/sbom-action)
| action | patch | `v0.24.0` → `v0.24.2` |
![age](https://developer.mend.io/api/mc/badges/age/github-tags/anchore%2fsbom-action/v0.24.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/anchore%2fsbom-action/v0.24.0/v0.24.2?slim=true)
|
| [astral-sh/uv](https://redirect.github.com/astral-sh/uv) | | patch |
`0.12.5` → `0.12.7` |
![age](https://developer.mend.io/api/mc/badges/age/github-releases/astral-sh%2fuv/0.12.7?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/astral-sh%2fuv/0.12.5/0.12.7?slim=true)
|
| cgr.dev/chainguard/apko |  | digest | `e398a22` → `b942538` |  |  |
| [chainguard-dev/apko](https://redirect.github.com/chainguard-dev/apko)
| | patch | `v1.2.39` → `v1.2.41` |
![age](https://developer.mend.io/api/mc/badges/age/github-releases/chainguard-dev%2fapko/v1.2.41?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/chainguard-dev%2fapko/v1.2.39/v1.2.41?slim=true)
|
|
[chainguard-dev/melange](https://redirect.github.com/chainguard-dev/melange)
| | patch | `v0.59.1` → `v0.59.2` |
![age](https://developer.mend.io/api/mc/badges/age/github-releases/chainguard-dev%2fmelange/v0.59.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/chainguard-dev%2fmelange/v0.59.1/v0.59.2?slim=true)
|
|
[charm.land/bubbles/v2](https://redirect.github.com/charmbracelet/bubbles)
| require | patch | `v2.2.0` → `v2.2.1` |
![age](https://developer.mend.io/api/mc/badges/age/go/charm.land%2fbubbles%2fv2/v2.2.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/charm.land%2fbubbles%2fv2/v2.2.0/v2.2.1?slim=true)
|
| debian | final | digest | `3a39a05` → `d7e1218` |  |  |
| [dhi.io/nats](https://dhi.io/catalog/nats)
([source](https://redirect.github.com/docker-hardened-images/definitions))
| | digest | `6e380f3` → `66af06f` | | |
| [dhi.io/pgvector](https://dhi.io/catalog/pgvector)
([source](https://redirect.github.com/docker-hardened-images/definitions))
| | digest | `9387a61` → `eac200f` | | |
| [errata-ai/vale](https://redirect.github.com/errata-ai/vale) | | minor
| `v3.18.0` → `v3.19.0` |
![age](https://developer.mend.io/api/mc/badges/age/github-releases/errata-ai%2fvale/v3.19.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/errata-ai%2fvale/v3.18.0/v3.19.0?slim=true)
|
| [ghcr.io/astral-sh/uv](https://redirect.github.com/astral-sh/uv) |
stage | patch | `0.12.5` → `0.12.7` |
![age](https://developer.mend.io/api/mc/badges/age/docker/ghcr.io%2fastral-sh%2fuv/0.12.7?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/ghcr.io%2fastral-sh%2fuv/0.12.5/0.12.7?slim=true)
|
| [github.com/gofrs/flock](https://redirect.github.com/gofrs/flock) |
require | patch | `v0.13.0` → `v0.13.1` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgofrs%2fflock/v0.13.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgofrs%2fflock/v0.13.0/v0.13.1?slim=true)
|
|
[github.com/golangci/golangci-lint/v2/cmd/golangci-lint](https://redirect.github.com/golangci/golangci-lint)
| | patch | `v2.13.1` → `v2.13.2` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgolangci%2fgolangci-lint%2fv2%2fcmd%2fgolangci-lint/v2.13.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgolangci%2fgolangci-lint%2fv2%2fcmd%2fgolangci-lint/v2.13.1/v2.13.2?slim=true)
|
|
[github.com/google/go-containerregistry](https://redirect.github.com/google/go-containerregistry)
| require | minor | `v0.21.9` → `v0.22.0` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgoogle%2fgo-containerregistry/v0.22.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgoogle%2fgo-containerregistry/v0.21.9/v0.22.0?slim=true)
|
|
[github/codeql-action](https://redirect.github.com/github/codeql-action)
| action | patch | `v4.37.8` → `v4.37.9` |
![age](https://developer.mend.io/api/mc/badges/age/github-tags/github%2fcodeql-action/v4.37.9?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/github%2fcodeql-action/v4.37.8/v4.37.9?slim=true)
|
| [golang](https://hub.docker.com/_/golang)
([source](https://redirect.github.com/docker-library/golang)) | stage |
digest | `70b4654` → `28d89ee` | | |
|
[golangci/golangci-lint](https://redirect.github.com/golangci/golangci-lint)
| | patch | `v2.13.1` → `v2.13.2` |
![age](https://developer.mend.io/api/mc/badges/age/github-releases/golangci%2fgolangci-lint/v2.13.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/golangci%2fgolangci-lint/v2.13.1/v2.13.2?slim=true)
|
|
[golangci/golangci-lint](https://redirect.github.com/golangci/golangci-lint)
| uses-with | patch | `v2.13.1` → `v2.13.2` |
![age](https://developer.mend.io/api/mc/badges/age/github-releases/golangci%2fgolangci-lint/v2.13.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/golangci%2fgolangci-lint/v2.13.1/v2.13.2?slim=true)
|
|
[goreleaser/goreleaser](https://redirect.github.com/goreleaser/goreleaser)
| | minor | `v2.17.1` → `v2.18.0` |
![age](https://developer.mend.io/api/mc/badges/age/github-releases/goreleaser%2fgoreleaser/v2.18.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/goreleaser%2fgoreleaser/v2.17.1/v2.18.0?slim=true)
|
|
[hadolint/hadolint-action](https://redirect.github.com/hadolint/hadolint-action)
| action | minor | `v3.4.0` → `v3.5.0` |
![age](https://developer.mend.io/api/mc/badges/age/github-tags/hadolint%2fhadolint-action/v3.5.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/hadolint%2fhadolint-action/v3.4.0/v3.5.0?slim=true)
|
| [node](https://redirect.github.com/actions/node-versions) | uses-with
| minor | `24.19.0` → `24.20.0` |
![age](https://developer.mend.io/api/mc/badges/age/github-releases/actions%2fnode-versions/24.20.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/actions%2fnode-versions/24.19.0/24.20.0?slim=true)
|
| [terrastruct/d2](https://redirect.github.com/terrastruct/d2) | | minor
| `v0.7.1` → `v0.8.2` |
![age](https://developer.mend.io/api/mc/badges/age/github-releases/terrastruct%2fd2/v0.8.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/terrastruct%2fd2/v0.7.1/v0.8.2?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/1730) for more information.

---

### Release Notes

<details>
<summary>CodSpeedHQ/action (CodSpeedHQ/action)</summary>

###
[`v5.2.1`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.2.1)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.2.0...v5.2.1)

Bumps the CodSpeed runner to
[v5.2.1](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.2.1).

##### 🚀 Features

- Add a `simulation-track-subprocess` input, which enables measuring the
subprocesses spawned by the benchmarked process in `simulation` mode by
[@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;235](https://redirect.github.com/CodSpeedHQ/action/pull/235)
- Bump the go-runner to
[v1.3.0](https://redirect.github.com/CodSpeedHQ/codspeed-go/releases/tag/v1.3.0),
adding Go 1.26 and 1.27 support by
[@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;516](https://redirect.github.com/CodSpeedHQ/codspeed/pull/516)

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

##### What's Changed

- feat: add simulation-track-subprocess input by
[@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;235](https://redirect.github.com/CodSpeedHQ/action/pull/235)
- chore: bump runner version to 5.2.1 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;236](https://redirect.github.com/CodSpeedHQ/action/pull/236)

**Full Changelog**:
<https://github.com/CodSpeedHQ/action/compare/v5.2.0...v5.2.1>

###
[`v5.2.0`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.2.0)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.0.3...v5.2.0)

Bumps the CodSpeed runner to
[v5.2.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.2.0),
including
[v5.1.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.1.0).

##### 🚀 Features

- Add a `--simulation-track-subprocess` flag that enables tracking
benchmark subprocesses, along with per-thread dumps by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&#8203;493](https://redirect.github.com/CodSpeedHQ/codspeed/pull/493)
and
[#&#8203;513](https://redirect.github.com/CodSpeedHQ/codspeed/pull/513)
- Collect RSS via rss\_stat and folio-rmap reconstruction by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;453](https://redirect.github.com/CodSpeedHQ/codspeed/pull/453)
- Support CircleCI for GitHub repositories by
[@&#8203;fargito](https://redirect.github.com/fargito) in
[#&#8203;482](https://redirect.github.com/CodSpeedHQ/codspeed/pull/482)

##### 🐛 Bug Fixes

- Fix cache behavior that was causing an apt reinstall of the libc debug
symbols despite cache restore by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&#8203;509](https://redirect.github.com/CodSpeedHQ/codspeed/pull/509)

##### ⚙️ Internals

- Bump pinned valgrind-codspeed to
[3.26.0-0codspeed7](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/releases/tag/3.26.0-0codspeed7)
by [@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;515](https://redirect.github.com/CodSpeedHQ/codspeed/pull/515)
- fix(callgrind): represent os threads under `--separate-threads=yes` by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[CodSpeedHQ/valgrind-codspeed#24](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/24)
- feat(callgrind): track subprocesses across fork and exec by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[CodSpeedHQ/valgrind-codspeed#25](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/25)
- Stop skipping the rustup wrapper for valgrind by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&#8203;493](https://redirect.github.com/CodSpeedHQ/codspeed/pull/493)

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

##### What's Changed

- fix: add the distribution to the instruments cache key by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in [#&#8203;233](https://redirect.github.com/CodSpeedHQ/action/pull/233)
- chore: bump runner version to 5.1.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;232](https://redirect.github.com/CodSpeedHQ/action/pull/232)
- chore: bump runner version to 5.2.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;234](https://redirect.github.com/CodSpeedHQ/action/pull/234)

**Full Changelog**:
<https://github.com/CodSpeedHQ/action/compare/v5.0.3...v5.2.0>

</details>

<details>
<summary>anchore/sbom-action (anchore/sbom-action)</summary>

###
[`v0.24.2`](https://redirect.github.com/anchore/sbom-action/releases/tag/v0.24.2)

[Compare
Source](https://redirect.github.com/anchore/sbom-action/compare/v0.24.1...v0.24.2)

##### Added Features

- bump eslint from 10.8.1 to 10.9.0
\[[#&#8203;724](https://redirect.github.com/anchore/sbom-action/pull/724)
[@&#8203;dependabot](https://redirect.github.com/dependabot)]

##### Additional Changes

- add makefile target to bump syft
\[[#&#8203;620](https://redirect.github.com/anchore/sbom-action/pull/620)
[@&#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]
- update zizmor workflow triggers
\[[#&#8203;624](https://redirect.github.com/anchore/sbom-action/pull/624)
[@&#8203;wagoodman](https://redirect.github.com/wagoodman)]
- require zizmor security events
\[[#&#8203;621](https://redirect.github.com/anchore/sbom-action/pull/621)
[@&#8203;wagoodman](https://redirect.github.com/wagoodman)]

**[(Full
Changelog)](https://redirect.github.com/anchore/sbom-action/compare/v0.24.0...v0.24.2)**

###
[`v0.24.1`](https://redirect.github.com/anchore/sbom-action/compare/v0.24.0...v0.24.1)

[Compare
Source](https://redirect.github.com/anchore/sbom-action/compare/v0.24.0...v0.24.1)

</details>

<details>
<summary>astral-sh/uv (astral-sh/uv)</summary>

###
[`v0.12.7`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0127)

[Compare
Source](https://redirect.github.com/astral-sh/uv/compare/0.12.6...0.12.7)

Released on 2026-08-27.

##### Python

- Replace managed Python installations when upgrading to a newer build
of the same version
([#&#8203;21323](https://redirect.github.com/astral-sh/uv/pull/21323))

##### Enhancements

- Support Linux `s390x`, `ppc64le`, and `loongarch64` targets for
cross-platform dependency resolution
([#&#8203;21313](https://redirect.github.com/astral-sh/uv/pull/21313))
- Retry downloads with configured credentials when Azure Storage denies
anonymous access to an endpoint configured via `UV_AZURE_ENDPOINT_URL`
([#&#8203;21318](https://redirect.github.com/astral-sh/uv/pull/21318))

##### Preview features

- Use content-based directory hashes to deduplicate extracted wheels in
the cache with the `content-addressed-cache` preview feature
([#&#8203;19693](https://redirect.github.com/astral-sh/uv/pull/19693))

##### Bug fixes

- Reject source archives with hash mismatches before persisting their
extracted contents to the cache
([#&#8203;21248](https://redirect.github.com/astral-sh/uv/pull/21248))

##### Other changes

- remove pyx specific features
([#&#8203;21182](https://redirect.github.com/astral-sh/uv/pull/21182),
[#&#8203;21183](https://redirect.github.com/astral-sh/uv/pull/21183),
[#&#8203;21184](https://redirect.github.com/astral-sh/uv/pull/21184),
[#&#8203;21185](https://redirect.github.com/astral-sh/uv/pull/21185),
[#&#8203;21186](https://redirect.github.com/astral-sh/uv/pull/21186))

###
[`v0.12.6`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0126)

[Compare
Source](https://redirect.github.com/astral-sh/uv/compare/0.12.5...0.12.6)

Released on 2026-08-25.

##### Python

- Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8
[#&#8203;21295](https://redirect.github.com/astral-sh/uv/pull/21295))

##### Enhancements

- Report cache-cleaning space savings from filesystem block allocation
and avoid double-counting hard links
([#&#8203;21261](https://redirect.github.com/astral-sh/uv/pull/21261))
- Limit warnings about unbounded `uv_build` requirements to
source-distribution builds
([#&#8203;21078](https://redirect.github.com/astral-sh/uv/pull/21078))
- Display byte counts below 1 KiB without a fractional part
([#&#8203;21237](https://redirect.github.com/astral-sh/uv/pull/21237))

##### Preview features

- Add `uv workspace metadata --sync --exact` to remove packages outside
the selected resolution
([#&#8203;21117](https://redirect.github.com/astral-sh/uv/pull/21117))
- Add the `artifact-hash-filtering` preview feature to make `uv pip
compile --generate-hashes` honor `--only-binary` and `--no-binary`
([#&#8203;21235](https://redirect.github.com/astral-sh/uv/pull/21235))
- Respect package-specific `exclude-newer` cutoffs when `uv check`
selects its `ty` executable
([#&#8203;21227](https://redirect.github.com/astral-sh/uv/pull/21227))
- Preserve virtual-environment hints from `tar-codec`
source-distribution errors when the base interpreter is outside a `bin`
directory
([#&#8203;21146](https://redirect.github.com/astral-sh/uv/pull/21146))

##### Performance

- Enable profile-guided optimization for Linux x86-64 release binaries
([#&#8203;21001](https://redirect.github.com/astral-sh/uv/pull/21001))
- Enable profile-guided optimization for Windows x86-64 release binaries
([#&#8203;21003](https://redirect.github.com/astral-sh/uv/pull/21003))
- Enable profile-guided optimization for macOS ARM64 release binaries
([#&#8203;21002](https://redirect.github.com/astral-sh/uv/pull/21002))
- Enable profile-guided optimization for Linux ARM64 release binaries
([#&#8203;21004](https://redirect.github.com/astral-sh/uv/pull/21004))
- Speed up syncing projects with many activated conflict items by
reusing their encoded representation
([#&#8203;21148](https://redirect.github.com/astral-sh/uv/pull/21148))

##### Bug fixes

- Allow explicit `uv build` and non-editable first-party workspace
packages when `no-build` is enabled
([#&#8203;21294](https://redirect.github.com/astral-sh/uv/pull/21294))
- Reuse configured index credentials during `uv tool upgrade` when the
tool receipt references the same index
([#&#8203;21275](https://redirect.github.com/astral-sh/uv/pull/21275))
- Ensure full 40-character Git commit pins resolve to the requested
object instead of a SHA-named branch
([#&#8203;21224](https://redirect.github.com/astral-sh/uv/pull/21224))
- Prevent TLS segfaults in riscv64 musl release binaries
([#&#8203;21158](https://redirect.github.com/astral-sh/uv/pull/21158))
- Preserve dependencies selected by recursive extras when markers mix
production and extra conditions
([#&#8203;21181](https://redirect.github.com/astral-sh/uv/pull/21181))
- Preserve version constraints from transitively referenced recursive
extras
([#&#8203;21209](https://redirect.github.com/astral-sh/uv/pull/21209))
- Resolve repository-relative Git archive dependencies inside the
checkout during the initial `uv sync`
([#&#8203;21264](https://redirect.github.com/astral-sh/uv/pull/21264))
- Return an error instead of panicking when a bearer token cannot be
encoded as an HTTP header
([#&#8203;21282](https://redirect.github.com/astral-sh/uv/pull/21282))
- Do not misclassify package URLs ending in `.py` as local script paths
([#&#8203;21144](https://redirect.github.com/astral-sh/uv/pull/21144))
- Use directory creation times consistently across libc implementations
for directory `cache-keys` entries
([#&#8203;21137](https://redirect.github.com/astral-sh/uv/pull/21137))
- Promote human-readable sizes to the next unit at rounding boundaries
([#&#8203;21136](https://redirect.github.com/astral-sh/uv/pull/21136))

##### Other changes

- Add Python 3.15 release-candidate Docker images
([#&#8203;21293](https://redirect.github.com/astral-sh/uv/pull/21293))
- Raise the minimum supported Rust version to 1.96 and update the
repository toolchain to Rust 1.98
([#&#8203;21258](https://redirect.github.com/astral-sh/uv/pull/21258))

</details>

<details>
<summary>chainguard-dev/apko (chainguard-dev/apko)</summary>

###
[`v1.2.41`](https://redirect.github.com/chainguard-dev/apko/releases/tag/v1.2.41)

[Compare
Source](https://redirect.github.com/chainguard-dev/apko/compare/v1.2.40...v1.2.41)

##### Changelog

-
[`326edce`](https://redirect.github.com/chainguard-dev/apko/commit/326edceed8d0f8987cde35623be734eadf0cdcc3)
apk: expose cache metrics
([#&#8203;2435](https://redirect.github.com/chainguard-dev/apko/issues/2435))
-
[`d7ffba3`](https://redirect.github.com/chainguard-dev/apko/commit/d7ffba39ce3a96739af261ced2300c4a9d861d55)
build(deps): bump chainguard-dev/actions/setup-registry from 1.6.31 to
1.6.32
([#&#8203;2421](https://redirect.github.com/chainguard-dev/apko/issues/2421))
-
[`aeedd74`](https://redirect.github.com/chainguard-dev/apko/commit/aeedd74f2113205a720e9c414df18ca1a21fb2c1)
build(deps): bump chainguard.dev/sdk from 0.1.197 to 0.1.204
([#&#8203;2425](https://redirect.github.com/chainguard-dev/apko/issues/2425))
-
[`c0b1316`](https://redirect.github.com/chainguard-dev/apko/commit/c0b1316becd4928e7b7a4cb9122e3c9725fe0df3)
build(deps): bump chainguard.dev/sdk from 0.1.204 to 0.1.210
([#&#8203;2428](https://redirect.github.com/chainguard-dev/apko/issues/2428))
-
[`c89724f`](https://redirect.github.com/chainguard-dev/apko/commit/c89724f244e9d41f5e14cc7a5f3d0bd08a82128e)
build(deps): bump chainguard.dev/sdk from 0.1.210 to 0.1.212
([#&#8203;2434](https://redirect.github.com/chainguard-dev/apko/issues/2434))
-
[`a2e35ac`](https://redirect.github.com/chainguard-dev/apko/commit/a2e35acdf791159eac2e1ef9e0b749af605e2535)
build(deps): bump github.com/package-url/packageurl-go from 0.1.6 to
0.1.7
([#&#8203;2430](https://redirect.github.com/chainguard-dev/apko/issues/2430))
-
[`e202915`](https://redirect.github.com/chainguard-dev/apko/commit/e202915336e55f7d4b6f464f77bc334726d4c66b)
build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1
([#&#8203;2419](https://redirect.github.com/chainguard-dev/apko/issues/2419))
-
[`5eab44e`](https://redirect.github.com/chainguard-dev/apko/commit/5eab44e4b31ca569b6c08feda482ca3825934aae)
build(deps): bump go.step.sm/crypto from 0.88.0 to 0.89.0
([#&#8203;2424](https://redirect.github.com/chainguard-dev/apko/issues/2424))
-
[`de11e49`](https://redirect.github.com/chainguard-dev/apko/commit/de11e492797f8f0094be458cf435aa4d4bd111fb)
build(deps): bump k8s.io/apimachinery from 0.36.3 to 0.36.4
([#&#8203;2429](https://redirect.github.com/chainguard-dev/apko/issues/2429))
-
[`1520c60`](https://redirect.github.com/chainguard-dev/apko/commit/1520c603b2f2df983f5ee06af19d0b87b41b41de)
build(deps): bump step-security/action-actionlint from 1.72.0 to 1.73.1
([#&#8203;2420](https://redirect.github.com/chainguard-dev/apko/issues/2420))
-
[`51d37b4`](https://redirect.github.com/chainguard-dev/apko/commit/51d37b413dd5ab8d43f7ea888f701fc87088f517)
build(deps): bump the codeql group with 2 updates
([#&#8203;2431](https://redirect.github.com/chainguard-dev/apko/issues/2431))
-
[`883c5ad`](https://redirect.github.com/chainguard-dev/apko/commit/883c5ad1e3036eebfb75efb5e554976db101493d)
fix(apk): stop racing on the shared indexOpts authenticator
([#&#8203;2432](https://redirect.github.com/chainguard-dev/apko/issues/2432))
-
[`6a223c2`](https://redirect.github.com/chainguard-dev/apko/commit/6a223c20c6c14015fdc9554e8ff385e22c5ac4fb)
go1.27
([#&#8203;2427](https://redirect.github.com/chainguard-dev/apko/issues/2427))

###
[`v1.2.40`](https://redirect.github.com/chainguard-dev/apko/releases/tag/v1.2.40)

[Compare
Source](https://redirect.github.com/chainguard-dev/apko/compare/v1.2.39...v1.2.40)

##### Changelog

-
[`d1b5d5e`](https://redirect.github.com/chainguard-dev/apko/commit/d1b5d5ec7633ad7288e5841b38fc8103a9773436)
erofs: add 'apko erofs mount' and 'apko erofs umount'
([#&#8203;2415](https://redirect.github.com/chainguard-dev/apko/issues/2415))

</details>

<details>
<summary>chainguard-dev/melange (chainguard-dev/melange)</summary>

###
[`v0.59.2`](https://redirect.github.com/chainguard-dev/melange/releases/tag/v0.59.2)

[Compare
Source](https://redirect.github.com/chainguard-dev/melange/compare/v0.59.1...v0.59.2)

#### What's Changed

- build(deps): bump the gomod group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2618](https://redirect.github.com/chainguard-dev/melange/pull/2618)
- build(deps): bump chainguard-dev/actions/setup-gitsign from 1.6.30 to
1.6.31 in the actions group by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2617](https://redirect.github.com/chainguard-dev/melange/pull/2617)
- Remove stale SHA-1 signature references by
[@&#8203;xnox](https://redirect.github.com/xnox) in
[#&#8203;2620](https://redirect.github.com/chainguard-dev/melange/pull/2620)
- build(deps): bump google.golang.org/protobuf from
1.36.12-0.20260120151049-f2248ac996af to 1.36.12 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2622](https://redirect.github.com/chainguard-dev/melange/pull/2622)
- build(deps): bump step-security/harden-runner from 2.20.1 to 2.21.0 in
the actions group by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2623](https://redirect.github.com/chainguard-dev/melange/pull/2623)
- build(deps): bump the gomod group across 1 directory with 4 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2621](https://redirect.github.com/chainguard-dev/melange/pull/2621)

**Full Changelog**:
<https://github.com/chainguard-dev/melange/compare/v0.59.1...v0.59.2>

</details>

<details>
<summary>charmbracelet/bubbles (charm.land/bubbles/v2)</summary>

###
[`v2.2.1`](https://redirect.github.com/charmbracelet/bubbles/releases/tag/v2.2.1)

[Compare
Source](https://redirect.github.com/charmbracelet/bubbles/compare/v2.2.0...v2.2.1)

### Tiny Monday bugfix

Textarea element had a bug, where you used to be able to go 1 word
backwards, even if there was nothing, which resulted in the whole TUI
freezing. It was now fixed by
[@&#8203;OxQuasar](https://redirect.github.com/OxQuasar)!

#### Changelog

##### Fixed

-
[`f613411`](https://redirect.github.com/charmbracelet/bubbles/commit/f6134114d735cf40e95c15ff62e7359e46d04fc9):
fix(textarea): stop word-left at input boundary
([#&#8203;1036](https://redirect.github.com/charmbracelet/bubbles/issues/1036))
([@&#8203;OxQuasar](https://redirect.github.com/OxQuasar))

##### Docs

-
[`87d4458`](https://redirect.github.com/charmbracelet/bubbles/commit/87d445838781700cb25e3fc3a6b26006eab97b41):
docs: update godoc link in readme to new package
([@&#8203;meowgorithm](https://redirect.github.com/meowgorithm))

##### Other stuff

-
[`10489b5`](https://redirect.github.com/charmbracelet/bubbles/commit/10489b5fafe92bfaea873297cab8ac8b5c5237f4):
readme: drop tree section for now
([@&#8203;meowgorithm](https://redirect.github.com/meowgorithm))
-
[`4909481`](https://redirect.github.com/charmbracelet/bubbles/commit/490948109eb4731927ba2f4cd464d8175a9630d7):
v2.2.1 ([@&#8203;andrinoff](https://redirect.github.com/andrinoff))

***

<a href="https://charm.land/"><img alt="The Charm logo"
src="https://stuff.charm.sh/charm-banner-next.jpg" width="400"></a>

Thoughts? Questions? We love hearing from you. Feel free to reach out on
[X](https://x.com/charmcli), [Discord](https://charm.land/discord),
[Slack](https://charm.land/slack), [The
Fediverse](https://mastodon.social/@&#8203;charmcli),
[Bluesky](https://bsky.app/profile/charm.land).

</details>

<details>
<summary>errata-ai/vale (errata-ai/vale)</summary>

###
[`v3.19.0`](https://redirect.github.com/vale-cli/vale/releases/tag/v3.19.0)

[Compare
Source](https://redirect.github.com/errata-ai/vale/compare/v3.18.0...v3.19.0)

#### MDX: JSX children are now linted

Vale now reads a JSX element's children as the Markdown they are —
matching MDX's own grammar, where only tags, attributes, and `{...}`
expressions are JavaScript. The prose inside wrapping components like
`<Steps>`, `<Tabs>`, or `<Aside>` is linted at its exact source
position, as is the text of inline elements (`<abbr>HTML</abbr>` —
"HTML" is read as part of its sentence). For documentation built on
component-heavy frameworks like Astro Starlight, this can mean a quarter
of your prose is now covered.

Children carry the element's name as a [class
scope](https://docs.vale.sh/topics/scopes), the same way MyST and Quarto
directives work — so a rule can target one component's content (`scope:
text.class.Aside`), and a component whose content shouldn't be linted
can be excluded by name:

```ini
IgnoredClasses = RawOutput
```

That's also the escape hatch if you preferred the old skip-everything
behavior. Attribute values, expressions, self-closing elements, and
elements opened and closed on a single standalone line are still treated
as code.

#### Changelog

-
[`405a7da`](https://redirect.github.com/errata-ai/vale/commit/405a7dab)
fix: strip a comment's delimiters, not its prose's
([#&#8203;1151](https://redirect.github.com/errata-ai/vale/issues/1151))
-
[`7766415`](https://redirect.github.com/errata-ai/vale/commit/7766415d)
feat(code): add Elixir comment and doc-attribute extraction
([#&#8203;1151](https://redirect.github.com/errata-ai/vale/issues/1151))
-
[`055db43`](https://redirect.github.com/errata-ai/vale/commit/055db438)
feat: let a sequence token ask for repeated occurrences
([#&#8203;899](https://redirect.github.com/errata-ai/vale/issues/899))
-
[`9ba5dea`](https://redirect.github.com/errata-ai/vale/commit/9ba5dea6)
feat: lint a JSX element's children as the Markdown they are
([#&#8203;1155](https://redirect.github.com/errata-ai/vale/issues/1155))
-
[`8702043`](https://redirect.github.com/errata-ai/vale/commit/87020434)
fix: lint a block title as written, without its generated label
([#&#8203;1152](https://redirect.github.com/errata-ai/vale/issues/1152))
-
[`d0e65f4`](https://redirect.github.com/errata-ai/vale/commit/d0e65f41)
docs: update contributing for native MDX and Typst

</details>

<details>
<summary>gofrs/flock (github.com/gofrs/flock)</summary>

###
[`v0.13.1`](https://redirect.github.com/gofrs/flock/releases/tag/v0.13.1)

[Compare
Source](https://redirect.github.com/gofrs/flock/compare/v0.13.0...v0.13.1)

#### What's Changed

- chore: update Path method comment by
[@&#8203;thiagola92](https://redirect.github.com/thiagola92) in
[#&#8203;129](https://redirect.github.com/gofrs/flock/pull/129)
- chore(deps): bump the github-actions group with 2 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;130](https://redirect.github.com/gofrs/flock/pull/130)
- chore(deps): bump golang.org/x/sys from 0.37.0 to 0.38.0 in the gomod
group by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;131](https://redirect.github.com/gofrs/flock/pull/131)
- chore(deps): bump golang.org/x/sys from 0.38.0 to 0.39.0 in the gomod
group by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;132](https://redirect.github.com/gofrs/flock/pull/132)
- chore(deps): bump the github-actions group with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;133](https://redirect.github.com/gofrs/flock/pull/133)
- chore(deps): bump golang.org/x/sys from 0.39.0 to 0.40.0 in the gomod
group by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;134](https://redirect.github.com/gofrs/flock/pull/134)
- chore(deps): bump the github-actions group with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;135](https://redirect.github.com/gofrs/flock/pull/135)
- chore(deps): bump golang.org/x/sys from 0.40.0 to 0.41.0 in the gomod
group by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;136](https://redirect.github.com/gofrs/flock/pull/136)
- chore(deps): bump the github-actions group with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;137](https://redirect.github.com/gofrs/flock/pull/137)
- chore(deps): bump golang.org/x/sys from 0.41.0 to 0.42.0 in the gomod
group by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;138](https://redirect.github.com/gofrs/flock/pull/138)
- chore(deps): bump the github-actions group with 2 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;139](https://redirect.github.com/gofrs/flock/pull/139)
- chore(deps): bump golang.org/x/sys from 0.42.0 to 0.43.0 in the gomod
group by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;140](https://redirect.github.com/gofrs/flock/pull/140)
- chore(deps): bump the github-actions group with 2 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;141](https://redirect.github.com/gofrs/flock/pull/141)
- chore: improve workflows by
[@&#8203;ldez](https://redirect.github.com/ldez) in
[#&#8203;142](https://redirect.github.com/gofrs/flock/pull/142)
- chore(deps): bump github/codeql-action from 3.35.3 to 4.35.2 in the
github-actions group by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;143](https://redirect.github.com/gofrs/flock/pull/143)
- chore(deps): bump golang.org/x/sys from 0.43.0 to 0.45.0 in the gomod
group by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;144](https://redirect.github.com/gofrs/flock/pull/144)
- chore(deps): bump the github-actions group across 1 directory with 3
updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;145](https://redirect.github.com/gofrs/flock/pull/145)
- chore(deps): bump the github-actions group with 4 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;147](https://redirect.github.com/gofrs/flock/pull/147)
- chore(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 in the gomod
group across 1 directory by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;146](https://redirect.github.com/gofrs/flock/pull/146)
- chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 in the gomod
group by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;149](https://redirect.github.com/gofrs/flock/pull/149)
- chore(deps): bump the github-actions group across 1 directory with 6
updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;150](https://redirect.github.com/gofrs/flock/pull/150)
- chore: update linter by
[@&#8203;ldez](https://redirect.github.com/ldez) in
[#&#8203;154](https://redirect.github.com/gofrs/flock/pull/154)
- chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 in
the gomod group across 1 directory by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;153](https://redirect.github.com/gofrs/flock/pull/153)

#### New Contributors

- [@&#8203;thiagola92](https://redirect.github.com/thiagola92) made
their first contribution in
[#&#8203;129](https://redirect.github.com/gofrs/flock/pull/129)

**Full Changelog**:
<https://github.com/gofrs/flock/compare/v0.13.0...v0.13.1>

</details>

<details>
<summary>golangci/golangci-lint
(github.com/golangci/golangci-lint/v2/cmd/golangci-lint)</summary>

###
[`v2.13.2`](https://redirect.github.com/golangci/golangci-lint/blob/HEAD/CHANGELOG.md#v2132)

[Compare
Source](https://redirect.github.com/golangci/golangci-lint/compare/v2.13.1...v2.13.2)

*Released on 2026-08-28*

1. Bug fixes
   - Decrease cache entropy
2. Linters bug fixes
   - `iface`: from 1.5.0 to 1.5.1
   - `staticcheck`: from 0.8.0 to 0.8.1
- `unparam`: from
[`3f964bc`](https://redirect.github.com/golangci/golangci-lint/commit/3f964bcb5673)
to
[`2fa3d84`](https://redirect.github.com/golangci/golangci-lint/commit/2fa3d841b0c8)
   - `canonicalheader`: from v1.1.2 to a temporary fork

</details>

<details>
<summary>google/go-containerregistry
(github.com/google/go-containerregistry)</summary>

###
[`v0.22.0`](https://redirect.github.com/google/go-containerregistry/releases/tag/v0.22.0)

[Compare
Source](https://redirect.github.com/google/go-containerregistry/compare/v0.21.9...v0.22.0)

#### What's Changed

- mutate: let Time and Canonical take tarball.LayerOption by
[@&#8203;mzihlmann](https://redirect.github.com/mzihlmann) in
[#&#8203;2403](https://redirect.github.com/google/go-containerregistry/pull/2403)
- build: add multi-architecture Cloud Build configurations for crane,
gcrane, and krane by
[@&#8203;tprussak](https://redirect.github.com/tprussak) in
[#&#8203;2412](https://redirect.github.com/google/go-containerregistry/pull/2412)
- remote: resolve push-check credentials against the repository by
[@&#8203;mzihlmann](https://redirect.github.com/mzihlmann) in
[#&#8203;2411](https://redirect.github.com/google/go-containerregistry/pull/2411)
- Allow single-character repository paths by
[@&#8203;semx](https://redirect.github.com/semx) in
[#&#8203;2407](https://redirect.github.com/google/go-containerregistry/pull/2407)
- fix: add missing substitutions and workspace cleanup to new build
files by [@&#8203;tprussak](https://redirect.github.com/tprussak) in
[#&#8203;2413](https://redirect.github.com/google/go-containerregistry/pull/2413)
- remote: retry failed Puller and Pusher initialization by
[@&#8203;iahsanGill](https://redirect.github.com/iahsanGill) in
[#&#8203;2406](https://redirect.github.com/google/go-containerregistry/pull/2406)
- build(deps): bump the actions group across 1 directory with 8 updates
by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2405](https://redirect.github.com/google/go-containerregistry/pull/2405)
- build(deps): bump the go-deps group across 1 directory with 3 updates
by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2415](https://redirect.github.com/google/go-containerregistry/pull/2415)
- go.mod: bump Go version + add toolchain directive to replace
.go-version file by
[@&#8203;Subserial](https://redirect.github.com/Subserial) in
[#&#8203;2416](https://redirect.github.com/google/go-containerregistry/pull/2416)
- fix: Fix new build options and provenance by
[@&#8203;tprussak](https://redirect.github.com/tprussak) in
[#&#8203;2417](https://redirect.github.com/google/go-containerregistry/pull/2417)
- fix(build): unify new build flow into cloudbuild\_v2.yaml by
[@&#8203;tprussak](https://redirect.github.com/tprussak) in
[#&#8203;2419](https://redirect.github.com/google/go-containerregistry/pull/2419)

#### New Contributors

- [@&#8203;mzihlmann](https://redirect.github.com/mzihlmann) made their
first contribution in
[#&#8203;2403](https://redirect.github.com/google/go-containerregistry/pull/2403)
- [@&#8203;tprussak](https://redirect.github.com/tprussak) made their
first contribution in
[#&#8203;2412](https://redirect.github.com/google/go-containerregistry/pull/2412)
- [@&#8203;semx](https://redirect.github.com/semx) made their first
contribution in
[#&#8203;2407](https://redirect.github.com/google/go-containerregistry/pull/2407)

**Full Changelog**:
<https://github.com/google/go-containerregistry/compare/v0.21.9...v0.21.10>

</details>

<details>
<summary>github/codeql-action (github/codeql-action)</summary>

###
[`v4.37.9`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.9)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v4.37.8...v4.37.9)

- Update default CodeQL bundle version to
[2.26.4](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4).
[#&#8203;4106](https://redirect.github.com/github/codeql-action/pull/4106)

</details>

<details>
<summary>goreleaser/goreleaser (goreleaser/goreleaser)</summary>

###
[`v2.18.0`](https://redirect.github.com/goreleaser/goreleaser/releases/tag/v2.18.0)

[Compare
Source](https://redirect.github.com/goreleaser/goreleaser/compare/v2.17.1...v2.18.0-97002309-nightly)

#### Announcement

Read the official announcement: [Announcing GoReleaser
v2.18](https://goreleaser.com/blog/goreleaser-v2.18/).

#### Changelog

##### New Features

-
[`601cd87`](https://redirect.github.com/goreleaser/goreleaser/commit/601cd877957f6dba2180a5405886acace8f2e022):
feat(ko): support templating for local\_domain, base\_image, and
repositories
([#&#8203;6741](https://redirect.github.com/goreleaser/goreleaser/issues/6741))
([@&#8203;mrueg](https://redirect.github.com/mrueg))
-
[`de88f38`](https://redirect.github.com/goreleaser/goreleaser/commit/de88f3820cf137cd665c30ba8f54304ec1dd0b07):
feat(winget): support publishing additional locale manifests
([#&#8203;6733](https://redirect.github.com/goreleaser/goreleaser/issues/6733))
([@&#8203;MohammedAnasuddinZaid](https://redirect.github.com/MohammedAnasuddinZaid))
-
[`cefbc6f`](https://redirect.github.com/goreleaser/goreleaser/commit/cefbc6faba0c5746ba2edefa32204c77cc26b1fd):
feat: add iru custom apps publisher
([#&#8203;6709](https://redirect.github.com/goreleaser/goreleaser/issues/6709))
([@&#8203;wimwenigerkind](https://redirect.github.com/wimwenigerkind))
-
[`1d6e7c0`](https://redirect.github.com/goreleaser/goreleaser/commit/1d6e7c06e47ec4bf283bb3231ae1348500e0bf3b):
feat: allow PR creation to use a different auth token
([#&#8203;6717](https://redirect.github.com/goreleaser/goreleaser/issues/6717))
([@&#8203;emily-curry](https://redirect.github.com/emily-curry))
-
[`4c41ac0`](https://redirect.github.com/goreleaser/goreleaser/commit/4c41ac0e2fe68b30f2035ca9f760c1329b7330a5):
feat: preflight checks
([#&#8203;6704](https://redirect.github.com/goreleaser/goreleaser/issues/6704))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`060260a`](https://redirect.github.com/goreleaser/goreleaser/commit/060260ae7c0ba358a494c2ce175beceee9d7382b):
feat: release summary
([#&#8203;6810](https://redirect.github.com/goreleaser/goreleaser/issues/6810))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`82a5aba`](https://redirect.github.com/goreleaser/goreleaser/commit/82a5aba0a9a3d7907da4163b89512f1d3da658ab):
feat: update to Go 1.27
([#&#8203;6802](https://redirect.github.com/goreleaser/goreleaser/issues/6802))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))

##### Security updates

-
[`b1cafd4`](https://redirect.github.com/goreleaser/goreleaser/commit/b1cafd427fa798312d3429c63781512bb45d7dca):
sec(deps): bump go-openapi/spec and go-openapi/validade
([#&#8203;6766](https://redirect.github.com/goreleaser/goreleaser/issues/6766))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))

##### Bug fixes

-
[`1970443`](https://redirect.github.com/goreleaser/goreleaser/commit/197044372e624c80bfb982b356f4bdf0ddf2ffb6):
fix(aur): expand description templates before escaping quotes
([#&#8203;6791](https://redirect.github.com/goreleaser/goreleaser/issues/6791))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX) and
[@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`a27402d`](https://redirect.github.com/goreleaser/goreleaser/commit/a27402dd9f2ce59a31aed5e4ded249cd6502e1e7):
fix(blob): honor s3\_force\_path\_style without a custom endpoint
([#&#8203;6789](https://redirect.github.com/goreleaser/goreleaser/issues/6789))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX) and
[@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`db65b99`](https://redirect.github.com/goreleaser/goreleaser/commit/db65b99a43786ae3cebbf39637f530534fa8d485):
fix(brew): a formula without a repository stops the ones after it
([#&#8203;6783](https://redirect.github.com/goreleaser/goreleaser/issues/6783))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`2b5fb31`](https://redirect.github.com/goreleaser/goreleaser/commit/2b5fb317cb771bedb09c5b2acb592fa37da64431):
fix(build): node windows targets get no .exe extension
([#&#8203;6777](https://redirect.github.com/goreleaser/goreleaser/issues/6777))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX) and
[@&#8203;vxncxnx](https://redirect.github.com/vxncxnx))
-
[`951fc57`](https://redirect.github.com/goreleaser/goreleaser/commit/951fc57101613cb5fc86a9ae55a05febe7b25aa8):
fix(cask): a cask without a repository stops the ones after it
([#&#8203;6785](https://redirect.github.com/goreleaser/goreleaser/issues/6785))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`54a6c8e`](https://redirect.github.com/goreleaser/goreleaser/commit/54a6c8e941da2236e1704e23d8481ca3311fc726):
fix(cask): emit Casks that pass brew style
([#&#8203;6752](https://redirect.github.com/goreleaser/goreleaser/issues/6752))
([@&#8203;r0h1tb](https://redirect.github.com/r0h1tb))
-
[`2d6b235`](https://redirect.github.com/goreleaser/goreleaser/commit/2d6b235930f39c538fcdd58eba8ef045b47f31a6):
fix(changelog): a commit matching two include filters is listed twice
([#&#8203;6773](https://redirect.github.com/goreleaser/goreleaser/issues/6773))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX) and
[@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`c4cc86f`](https://redirect.github.com/goreleaser/goreleaser/commit/c4cc86f7b8436e6735c9929f5b2ebfa7684eabe6):
fix(chocolatey): error on multiple archives for the same platform
([#&#8203;6792](https://redirect.github.com/goreleaser/goreleaser/issues/6792))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX))
-
[`1a246da`](https://redirect.github.com/goreleaser/goreleaser/commit/1a246da4164ae81e3b435228995074164f9c701e):
fix(config): type retry durations as strings in schema
([#&#8203;6801](https://redirect.github.com/goreleaser/goreleaser/issues/6801))
([@&#8203;skatkov](https://redirect.github.com/skatkov))
-
[`8be344b`](https://redirect.github.com/goreleaser/goreleaser/commit/8be344b19e5bb723590a207c46b124d383458fc1):
fix(docker): add gpg-agent to the image
([#&#8203;6763](https://redirect.github.com/goreleaser/goreleaser/issues/6763))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`5282589`](https://redirect.github.com/goreleaser/goreleaser/commit/5282589091a7a0df652ae039467bfc5be9187346):
fix(dockers/v2): annotation scopes
([#&#8203;6800](https://redirect.github.com/goreleaser/goreleaser/issues/6800))
([@&#8203;CraigAstillRVU](https://redirect.github.com/CraigAstillRVU)
and [@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`5560bb9`](https://redirect.github.com/goreleaser/goreleaser/commit/5560bb9acf609f23de14d2c4f7d31808d46b364e):
fix(flatpak): a disabled flatpak stops the ones after it
([#&#8203;6781](https://redirect.github.com/goreleaser/goreleaser/issues/6781))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX))
-
[`b68113a`](https://redirect.github.com/goreleaser/goreleaser/commit/b68113a4a78e95de2efcde8384a61d526279625f):
fix(git): tag templates strip apostrophes from the message
([#&#8203;6779](https://redirect.github.com/goreleaser/goreleaser/issues/6779))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX) and
[@&#8203;vxncxnx](https://redirect.github.com/vxncxnx))
-
[`1bc6ec7`](https://redirect.github.com/goreleaser/goreleaser/commit/1bc6ec7dfe77db0961b44588a4f8efe5120b7f84):
fix(healthcheck): register upx and makeself dependency checkers
([#&#8203;6793](https://redirect.github.com/goreleaser/goreleaser/issues/6793))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX))
-
[`9d7d49f`](https://redirect.github.com/goreleaser/goreleaser/commit/9d7d49ff17546abd01f4588636a04201cf3d6bf7):
fix(krew): a manifest without a name stops the ones after it
([#&#8203;6787](https://redirect.github.com/goreleaser/goreleaser/issues/6787))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`4276c51`](https://redirect.github.com/goreleaser/goreleaser/commit/4276c5174e80a4240dee31d3af8d11438cbfeae0):
fix(krew): apply the documented goarm default
([#&#8203;6775](https://redirect.github.com/goreleaser/goreleaser/issues/6775))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX) and
[@&#8203;vxncxnx](https://redirect.github.com/vxncxnx))
-
[`9700230`](https://redirect.github.com/goreleaser/goreleaser/commit/97002309efe9b11cee15426c940a42c44a9f55b2):
fix(mcp): mcp.disable is documented but never read
([#&#8203;6795](https://redirect.github.com/goreleaser/goreleaser/issues/6795))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX))
-
[`1d79a09`](https://redirect.github.com/goreleaser/goreleaser/commit/1d79a09e56ea59226ff554959ba562c172db9ca9):
fix(milestone): a milestone with close disabled stops the ones after it
([#&#8203;6778](https://redirect.github.com/goreleaser/goreleaser/issues/6778))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX) and
[@&#8203;vxncxnx](https://redirect.github.com/vxncxnx))
-
[`2a0393d`](https://redirect.github.com/goreleaser/goreleaser/commit/2a0393dc951468dff3cf37603b9a92d3fb268d09):
fix(nfpm): don't set deb arch variant for goamd64 v1
([#&#8203;6765](https://redirect.github.com/goreleaser/goreleaser/issues/6765))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`912704c`](https://redirect.github.com/goreleaser/goreleaser/commit/912704c71ce0649ef87d41d427fc103e69544b45):
fix(nfpm): overrides ignore package\_name, epoch, release and prerelease
([#&#8203;6782](https://redirect.github.com/goreleaser/goreleaser/issues/6782))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX))
-
[`3cf25c0`](https://redirect.github.com/goreleaser/goreleaser/commit/3cf25c0db61ed7b1684a974995deb3ff29d09ecf):
fix(nfpm): record the conventional extension, not the format name
([#&#8203;6776](https://redirect.github.com/goreleaser/goreleaser/issues/6776))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX) and
[@&#8203;vxncxnx](https://redirect.github.com/vxncxnx))
-
[`ad028a3`](https://redirect.github.com/goreleaser/goreleaser/commit/ad028a32aa82dd98b5986e2a000a3ac9e9913f7f):
fix(nix): a skipped nix entry stops the ones after it
([#&#8203;6788](https://redirect.github.com/goreleaser/goreleaser/issues/6788))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX))
-
[`b787cd2`](https://redirect.github.com/goreleaser/goreleaser/commit/b787cd207c28f5ec4664bde7bbd0cf181bf606a3):
fix(notarize): cap macOS notarization timeout at 20m
([#&#8203;6758](https://redirect.github.com/goreleaser/goreleaser/issues/6758))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`81a5509`](https://redirect.github.com/goreleaser/goreleaser/commit/81a55090039d93c90a24a0d18139021522e4471d):
fix(sign): artifacts: none masks real signing failures
([#&#8203;6790](https://redirect.github.com/goreleaser/goreleaser/issues/6790))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX))
-
[`4eb6037`](https://redirect.github.com/goreleaser/goreleaser/commit/4eb603712f4418671f76a97fe4cbd435e7b7fdd6):
fix(snapcraft): a disabled snap stops the ones after it
([#&#8203;6784](https://redirect.github.com/goreleaser/goreleaser/issues/6784))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`d93d0f1`](https://redirect.github.com/goreleaser/goreleaser/commit/d93d0f196d4a76458c2531b6b0c4af61790a0d46):
fix(snapcraft): assumes, hooks and plugs are dropped when apps is
omitted
([#&#8203;6780](https://redirect.github.com/goreleaser/goreleaser/issues/6780))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX) and
[@&#8203;vxncxnx](https://redirect.github.com/vxncxnx))
-
[`b3bbd53`](https://redirect.github.com/goreleaser/goreleaser/commit/b3bbd53334b2d5e9f545ecfcf65850548938a94f):
fix(srpm): make documented rpm fields actually configurable
([#&#8203;6762](https://redirect.github.com/goreleaser/goreleaser/issues/6762))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`7304fdb`](https://redirect.github.com/goreleaser/goreleaser/commit/7304fdbd72f445fed66d5a206e2d2aa6bda1a1ff):
fix(tmpl): register the documented join template function
([#&#8203;6772](https://redirect.github.com/goreleaser/goreleaser/issues/6772))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX))
-
[`6f88b00`](https://redirect.github.com/goreleaser/goreleaser/commit/6f88b00188cbc1afdc2995bbfe7374e540f32e85):
fix(upload): a misconfigured upload stops the others
([#&#8203;6786](https://redirect.github.com/goreleaser/goreleaser/issues/6786))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`67e4c45`](https://redirect.github.com/goreleaser/goreleaser/commit/67e4c45090e842817467ca94a51b3d68f549b2b3):
fix(winget): a skipped winget entry stops the ones after it
([#&#8203;6797](https://redirect.github.com/goreleaser/goreleaser/issues/6797))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX))
-
[`92453c1`](https://redirect.github.com/goreleaser/goreleaser/commit/92453c1dbdf592d227cb236600093a503f2351f3):
fix(winget): count arm64 in the duplicate-archive check
([#&#8203;6774](https://redirect.github.com/goreleaser/goreleaser/issues/6774))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX) and
[@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`9a43dd0`](https://redirect.github.com/goreleaser/goreleaser/commit/9a43dd006d7cf164646c3f20df8bee715fc0cbd7):
fix(winget): fall back to the default description in additional locales
([#&#8203;6771](https://redirect.github.com/goreleaser/goreleaser/issues/6771))
([@&#8203;VXNCXNX](https://redirect.github.com/VXNCXNX))
-
[`6127e0f`](https://redirect.github.com/goreleaser/goreleaser/commit/6127e0feff9cfaf54c25ca9562d4103a5fe9049c):
fix: do not panic decoding a commit whose message contains a log marker
([#&#8203;6738](https://redirect.github.com/goreleaser/goreleaser/issues/6738))
([@&#8203;arpitjain099](https://redirect.github.com/arpitjain099))
-
[`02cfda7`](https://redirect.github.com/goreleaser/goreleaser/commit/02cfda7102906edff9dd067bcea516574fa68308):
fix: lint ([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`b990083`](https://redirect.github.com/goreleaser/goreleaser/commit/b9900831dd40b3d88df95fdc2e420713a88c85f9):
fix: surface archive Close errors when writing release archives
([#&#8203;6690](https://redirect.github.com/goreleaser/goreleaser/issues/6690))
([@&#8203;SebTardif](https://redirect.github.com/SebTardif) and
[@&#8203;caarlos0](https://redirect.github.com/caarlos0))

##### Documentation updates

-
[`33a3f22`](https://redirect.github.com/goreleaser/goreleaser/commit/33a3f227d1592e583e055368d309c685d1f052bf):
docs(dockers\_v2): clarify that build and push are a single step
([#&#8203;6742](https://redirect.github.com/goreleaser/goreleaser/issues/6742))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`1eb0ee9`](https://redirect.github.com/goreleaser/goreleaser/commit/1eb0ee94b4a2987b063e312e1ecbbd3d394f27c0):
docs: download SBOMs
([#&#8203;6803](https://redirect.github.com/goreleaser/goreleaser/issues/6803))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`16debcb`](https://redirect.github.com/goreleaser/goreleaser/commit/16debcb0a11d7f4792f02277841c74ebb0d81c10):
docs: many fixes
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`ff2822a`](https://redirect.github.com/goreleaser/goreleaser/commit/ff2822a2b69b05eb8731ec4284dc2926c9e88aa8):
docs: update dockers\_v2
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`686946e`](https://redirect.github.com/goreleaser/goreleaser/commit/686946ed407a7f68ab9757d92da9f4b8a7695852):
docs: use correct script for debconf
([#&#8203;6759](https://redirect.github.com/goreleaser/goreleaser/issues/6759))
([@&#8203;Daniel15](https://redirect.github.com/Daniel15))
-
[`9921479`](https://redirect.github.com/goreleaser/goreleaser/commit/9921479b6b53236e88306d1641bda2b92f0f4d27):
docs: use formats plural syntax
([#&#8203;6756](https://redirect.github.com/goreleaser/goreleaser/issues/6756))
([@&#8203;FelicianoTech](https://redirect.github.com/FelicianoTech))

##### Other work

-
[`2b80858`](https://redirect.github.com/goreleaser/goreleaser/commit/2b80858a3a93ba4df282e4cde697916281d90f15):
chore: auto-update generated files
([#&#8203;6731](https://redirect.github.com/goreleaser/goreleaser/issues/6731))
([@&#8203;goreleaserbot](https://redirect.github.com/goreleaserbot))
-
[`7df2cd5`](https://redirect.github.com/goreleaser/goreleaser/commit/7df2cd53abea0e92af6b5e498c8aea0fef3bbc01):
chore: auto-update generated files
([#&#8203;6732](https://redirect.github.com/goreleaser/goreleaser/issues/6732))
([@&#8203;goreleaserbot](https://redirect.github.com/goreleaserbot))
-
[`dd08c1f`](https://redirect.github.com/goreleaser/goreleaser/commit/dd08c1f12e373abfcdd5285da5cd836f301cd7c3):
chore: auto-update generated files
([#&#8203;6740](https://redirect.github.com/goreleaser/goreleaser/issues/6740))
([@&#8203;goreleaserbot](https://redirect.github.com/goreleaserbot))
-
[`ee0e3c1`](https://redirect.github.com/goreleaser/goreleaser/commit/ee0e3c11ede0ba9736e665bee11535ae2d581b57):
chore: auto-update generated files
([#&#8203;6744](https://redirect.github.com/goreleaser/goreleaser/issues/6744))
([@&#8203;goreleaserbot](https://redirect.github.com/goreleaserbot))
-
[`cab7c6e`](https://redirect.github.com/goreleaser/goreleaser/commit/cab7c6ef5d4ffc2429828f031ff7bb4645de7dad):
chore: auto-update generated files
([#&#8203;6769](https://redirect.github.com/goreleaser/goreleaser/issues/6769))
([@&#8203;goreleaserbot](https://redirect.github.com/goreleaserbot))
- [`39552ca`](https://redirect.github.com/go

> ✂ **Note**
> 
> PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (in timezone Etc/UTC)

- Branch creation
  - Between 12:00 AM and 06:59 AM, only on Saturday (`* 0-6 * * 6`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Aureliolo/synthorg).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwidHlwZTppbmZyYSJdfQ==-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Aurelio <19254254+Aureliolo@users.noreply.github.com>
renovate Bot added a commit to oxc-project/oxc-browserslist that referenced this pull request Aug 30, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) |
action | minor | `v5.0.3` → `v5.2.1` |
|
[voidzero-dev/setup-vp](https://redirect.github.com/voidzero-dev/setup-vp)
| action | minor | `v1.17.0` → `v1.18.0` |

---

### Release Notes

<details>
<summary>CodSpeedHQ/action (CodSpeedHQ/action)</summary>

###
[`v5.2.1`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.2.1)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.2.0...v5.2.1)

Bumps the CodSpeed runner to
[v5.2.1](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.2.1).

##### 🚀 Features

- Add a `simulation-track-subprocess` input, which enables measuring the
subprocesses spawned by the benchmarked process in `simulation` mode by
[@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;235](https://redirect.github.com/CodSpeedHQ/action/pull/235)
- Bump the go-runner to
[v1.3.0](https://redirect.github.com/CodSpeedHQ/codspeed-go/releases/tag/v1.3.0),
adding Go 1.26 and 1.27 support by
[@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;516](https://redirect.github.com/CodSpeedHQ/codspeed/pull/516)

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

#### What's Changed

- feat: add simulation-track-subprocess input by
[@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;235](https://redirect.github.com/CodSpeedHQ/action/pull/235)
- chore: bump runner version to 5.2.1 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;236](https://redirect.github.com/CodSpeedHQ/action/pull/236)

**Full Changelog**:
<CodSpeedHQ/action@v5.2.0...v5.2.1>

###
[`v5.2.0`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.2.0)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.0.3...v5.2.0)

Bumps the CodSpeed runner to
[v5.2.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.2.0),
including
[v5.1.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.1.0).

##### 🚀 Features

- Add a `--simulation-track-subprocess` flag that enables tracking
benchmark subprocesses, along with per-thread dumps by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&#8203;493](https://redirect.github.com/CodSpeedHQ/codspeed/pull/493)
and
[#&#8203;513](https://redirect.github.com/CodSpeedHQ/codspeed/pull/513)
- Collect RSS via rss\_stat and folio-rmap reconstruction by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;453](https://redirect.github.com/CodSpeedHQ/codspeed/pull/453)
- Support CircleCI for GitHub repositories by
[@&#8203;fargito](https://redirect.github.com/fargito) in
[#&#8203;482](https://redirect.github.com/CodSpeedHQ/codspeed/pull/482)

##### 🐛 Bug Fixes

- Fix cache behavior that was causing an apt reinstall of the libc debug
symbols despite cache restore by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&#8203;509](https://redirect.github.com/CodSpeedHQ/codspeed/pull/509)

##### ⚙️ Internals

- Bump pinned valgrind-codspeed to
[3.26.0-0codspeed7](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/releases/tag/3.26.0-0codspeed7)
by [@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;515](https://redirect.github.com/CodSpeedHQ/codspeed/pull/515)
- fix(callgrind): represent os threads under `--separate-threads=yes` by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[CodSpeedHQ/valgrind-codspeed#24](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/24)
- feat(callgrind): track subprocesses across fork and exec by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[CodSpeedHQ/valgrind-codspeed#25](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/25)
- Stop skipping the rustup wrapper for valgrind by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&#8203;493](https://redirect.github.com/CodSpeedHQ/codspeed/pull/493)

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

#### What's Changed

- fix: add the distribution to the instruments cache key by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in [#&#8203;233](https://redirect.github.com/CodSpeedHQ/action/pull/233)
- chore: bump runner version to 5.1.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;232](https://redirect.github.com/CodSpeedHQ/action/pull/232)
- chore: bump runner version to 5.2.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;234](https://redirect.github.com/CodSpeedHQ/action/pull/234)

**Full Changelog**:
<CodSpeedHQ/action@v5.0.3...v5.2.0>

</details>

<details>
<summary>voidzero-dev/setup-vp (voidzero-dev/setup-vp)</summary>

###
[`v1.18.0`](https://redirect.github.com/voidzero-dev/setup-vp/releases/tag/v1.18.0)

[Compare
Source](https://redirect.github.com/voidzero-dev/setup-vp/compare/v1.17.0...v1.18.0)

##### What's Changed

- chore(deps): update vite-plus to v0.2.9 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;125](https://redirect.github.com/voidzero-dev/setup-vp/pull/125)
- chore(deps): update pnpm/action-setup action to v6.0.10 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;124](https://redirect.github.com/voidzero-dev/setup-vp/pull/124)
- feat: pin the install script to the requested version by
[@&#8203;fengmk2](https://redirect.github.com/fengmk2) in
[#&#8203;127](https://redirect.github.com/voidzero-dev/setup-vp/pull/127)
- docs: clarify automatic Node.js resolution by
[@&#8203;fengmk2](https://redirect.github.com/fengmk2) in
[#&#8203;130](https://redirect.github.com/voidzero-dev/setup-vp/pull/130)
- ci: add GitLab end-to-end testing by
[@&#8203;fengmk2](https://redirect.github.com/fengmk2) in
[#&#8203;132](https://redirect.github.com/voidzero-dev/setup-vp/pull/132)
- feat: resolve Vite+ executable paths from VpDirs by
[@&#8203;fengmk2](https://redirect.github.com/fengmk2) in
[#&#8203;131](https://redirect.github.com/voidzero-dev/setup-vp/pull/131)
- chore: release v1.18.0 by
[@&#8203;fengmk2](https://redirect.github.com/fengmk2) in
[#&#8203;133](https://redirect.github.com/voidzero-dev/setup-vp/pull/133)

**Full Changelog**:
<voidzero-dev/setup-vp@v1.17.0...v1.18.0>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - "before 10am on monday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc-browserslist).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot added a commit to oxc-project/json-strip-comments that referenced this pull request Aug 30, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) |
action | minor | `v5.0.3` → `v5.2.1` |

---

### Release Notes

<details>
<summary>CodSpeedHQ/action (CodSpeedHQ/action)</summary>

###
[`v5.2.1`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.2.1)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.2.0...v5.2.1)

Bumps the CodSpeed runner to
[v5.2.1](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.2.1).

##### 🚀 Features

- Add a `simulation-track-subprocess` input, which enables measuring the
subprocesses spawned by the benchmarked process in `simulation` mode by
[@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;235](https://redirect.github.com/CodSpeedHQ/action/pull/235)
- Bump the go-runner to
[v1.3.0](https://redirect.github.com/CodSpeedHQ/codspeed-go/releases/tag/v1.3.0),
adding Go 1.26 and 1.27 support by
[@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;516](https://redirect.github.com/CodSpeedHQ/codspeed/pull/516)

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

#### What's Changed

- feat: add simulation-track-subprocess input by
[@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;235](https://redirect.github.com/CodSpeedHQ/action/pull/235)
- chore: bump runner version to 5.2.1 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;236](https://redirect.github.com/CodSpeedHQ/action/pull/236)

**Full Changelog**:
<CodSpeedHQ/action@v5.2.0...v5.2.1>

###
[`v5.2.0`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.2.0)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.0.3...v5.2.0)

Bumps the CodSpeed runner to
[v5.2.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.2.0),
including
[v5.1.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.1.0).

##### 🚀 Features

- Add a `--simulation-track-subprocess` flag that enables tracking
benchmark subprocesses, along with per-thread dumps by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&#8203;493](https://redirect.github.com/CodSpeedHQ/codspeed/pull/493)
and
[#&#8203;513](https://redirect.github.com/CodSpeedHQ/codspeed/pull/513)
- Collect RSS via rss\_stat and folio-rmap reconstruction by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;453](https://redirect.github.com/CodSpeedHQ/codspeed/pull/453)
- Support CircleCI for GitHub repositories by
[@&#8203;fargito](https://redirect.github.com/fargito) in
[#&#8203;482](https://redirect.github.com/CodSpeedHQ/codspeed/pull/482)

##### 🐛 Bug Fixes

- Fix cache behavior that was causing an apt reinstall of the libc debug
symbols despite cache restore by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&#8203;509](https://redirect.github.com/CodSpeedHQ/codspeed/pull/509)

##### ⚙️ Internals

- Bump pinned valgrind-codspeed to
[3.26.0-0codspeed7](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/releases/tag/3.26.0-0codspeed7)
by [@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;515](https://redirect.github.com/CodSpeedHQ/codspeed/pull/515)
- fix(callgrind): represent os threads under `--separate-threads=yes` by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[CodSpeedHQ/valgrind-codspeed#24](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/24)
- feat(callgrind): track subprocesses across fork and exec by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[CodSpeedHQ/valgrind-codspeed#25](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/25)
- Stop skipping the rustup wrapper for valgrind by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&#8203;493](https://redirect.github.com/CodSpeedHQ/codspeed/pull/493)

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

#### What's Changed

- fix: add the distribution to the instruments cache key by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in [#&#8203;233](https://redirect.github.com/CodSpeedHQ/action/pull/233)
- chore: bump runner version to 5.1.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;232](https://redirect.github.com/CodSpeedHQ/action/pull/232)
- chore: bump runner version to 5.2.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;234](https://redirect.github.com/CodSpeedHQ/action/pull/234)

**Full Changelog**:
<CodSpeedHQ/action@v5.0.3...v5.2.0>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - "before 10am on monday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/json-strip-comments).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot added a commit to oxc-project/oxc-resolver that referenced this pull request Aug 30, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) |
action | minor | `v5.0.3` → `v5.2.1` |

---

### Release Notes

<details>
<summary>CodSpeedHQ/action (CodSpeedHQ/action)</summary>

###
[`v5.2.1`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.2.1)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.2.0...v5.2.1)

Bumps the CodSpeed runner to
[v5.2.1](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.2.1).

##### 🚀 Features

- Add a `simulation-track-subprocess` input, which enables measuring the
subprocesses spawned by the benchmarked process in `simulation` mode by
[@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;235](https://redirect.github.com/CodSpeedHQ/action/pull/235)
- Bump the go-runner to
[v1.3.0](https://redirect.github.com/CodSpeedHQ/codspeed-go/releases/tag/v1.3.0),
adding Go 1.26 and 1.27 support by
[@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;516](https://redirect.github.com/CodSpeedHQ/codspeed/pull/516)

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

#### What's Changed

- feat: add simulation-track-subprocess input by
[@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;235](https://redirect.github.com/CodSpeedHQ/action/pull/235)
- chore: bump runner version to 5.2.1 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;236](https://redirect.github.com/CodSpeedHQ/action/pull/236)

**Full Changelog**:
<CodSpeedHQ/action@v5.2.0...v5.2.1>

###
[`v5.2.0`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.2.0)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.0.3...v5.2.0)

Bumps the CodSpeed runner to
[v5.2.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.2.0),
including
[v5.1.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.1.0).

##### 🚀 Features

- Add a `--simulation-track-subprocess` flag that enables tracking
benchmark subprocesses, along with per-thread dumps by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&#8203;493](https://redirect.github.com/CodSpeedHQ/codspeed/pull/493)
and
[#&#8203;513](https://redirect.github.com/CodSpeedHQ/codspeed/pull/513)
- Collect RSS via rss\_stat and folio-rmap reconstruction by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;453](https://redirect.github.com/CodSpeedHQ/codspeed/pull/453)
- Support CircleCI for GitHub repositories by
[@&#8203;fargito](https://redirect.github.com/fargito) in
[#&#8203;482](https://redirect.github.com/CodSpeedHQ/codspeed/pull/482)

##### 🐛 Bug Fixes

- Fix cache behavior that was causing an apt reinstall of the libc debug
symbols despite cache restore by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&#8203;509](https://redirect.github.com/CodSpeedHQ/codspeed/pull/509)

##### ⚙️ Internals

- Bump pinned valgrind-codspeed to
[3.26.0-0codspeed7](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/releases/tag/3.26.0-0codspeed7)
by [@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;515](https://redirect.github.com/CodSpeedHQ/codspeed/pull/515)
- fix(callgrind): represent os threads under `--separate-threads=yes` by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[CodSpeedHQ/valgrind-codspeed#24](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/24)
- feat(callgrind): track subprocesses across fork and exec by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[CodSpeedHQ/valgrind-codspeed#25](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/25)
- Stop skipping the rustup wrapper for valgrind by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&#8203;493](https://redirect.github.com/CodSpeedHQ/codspeed/pull/493)

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

#### What's Changed

- fix: add the distribution to the instruments cache key by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in [#&#8203;233](https://redirect.github.com/CodSpeedHQ/action/pull/233)
- chore: bump runner version to 5.1.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;232](https://redirect.github.com/CodSpeedHQ/action/pull/232)
- chore: bump runner version to 5.2.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;234](https://redirect.github.com/CodSpeedHQ/action/pull/234)

**Full Changelog**:
<CodSpeedHQ/action@v5.0.3...v5.2.0>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - "before 10am on monday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc-resolver).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot added a commit to oxc-project/oxc that referenced this pull request Aug 30, 2026
This PR contains the following updates:

| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) |
action | minor | `v5.0.3` → `v5.2.1` | |
|
[semgrep/semgrep](https://redirect.github.com/semgrep/semgrep-proprietary)
| container | minor | `1.174.0` → `1.175.0` | |
|
[taiki-e/install-action](https://redirect.github.com/taiki-e/install-action)
| action | minor | `v2.86.4` → `v2.87.0` | `v2.87.2` (+1) |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the warning logs for
more information.

---

### Release Notes

<details>
<summary>CodSpeedHQ/action (CodSpeedHQ/action)</summary>

###
[`v5.2.1`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.2.1)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.2.0...v5.2.1)

Bumps the CodSpeed runner to
[v5.2.1](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.2.1).

##### 🚀 Features

- Add a `simulation-track-subprocess` input, which enables measuring the
subprocesses spawned by the benchmarked process in `simulation` mode by
[@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;235](https://redirect.github.com/CodSpeedHQ/action/pull/235)
- Bump the go-runner to
[v1.3.0](https://redirect.github.com/CodSpeedHQ/codspeed-go/releases/tag/v1.3.0),
adding Go 1.26 and 1.27 support by
[@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;516](https://redirect.github.com/CodSpeedHQ/codspeed/pull/516)

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

#### What's Changed

- feat: add simulation-track-subprocess input by
[@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;235](https://redirect.github.com/CodSpeedHQ/action/pull/235)
- chore: bump runner version to 5.2.1 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;236](https://redirect.github.com/CodSpeedHQ/action/pull/236)

**Full Changelog**:
<CodSpeedHQ/action@v5.2.0...v5.2.1>

###
[`v5.2.0`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.2.0)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.0.3...v5.2.0)

Bumps the CodSpeed runner to
[v5.2.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.2.0),
including
[v5.1.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.1.0).

##### 🚀 Features

- Add a `--simulation-track-subprocess` flag that enables tracking
benchmark subprocesses, along with per-thread dumps by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&#8203;493](https://redirect.github.com/CodSpeedHQ/codspeed/pull/493)
and
[#&#8203;513](https://redirect.github.com/CodSpeedHQ/codspeed/pull/513)
- Collect RSS via rss\_stat and folio-rmap reconstruction by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;453](https://redirect.github.com/CodSpeedHQ/codspeed/pull/453)
- Support CircleCI for GitHub repositories by
[@&#8203;fargito](https://redirect.github.com/fargito) in
[#&#8203;482](https://redirect.github.com/CodSpeedHQ/codspeed/pull/482)

##### 🐛 Bug Fixes

- Fix cache behavior that was causing an apt reinstall of the libc debug
symbols despite cache restore by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&#8203;509](https://redirect.github.com/CodSpeedHQ/codspeed/pull/509)

##### ⚙️ Internals

- Bump pinned valgrind-codspeed to
[3.26.0-0codspeed7](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/releases/tag/3.26.0-0codspeed7)
by [@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;515](https://redirect.github.com/CodSpeedHQ/codspeed/pull/515)
- fix(callgrind): represent os threads under `--separate-threads=yes` by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[CodSpeedHQ/valgrind-codspeed#24](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/24)
- feat(callgrind): track subprocesses across fork and exec by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[CodSpeedHQ/valgrind-codspeed#25](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/25)
- Stop skipping the rustup wrapper for valgrind by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&#8203;493](https://redirect.github.com/CodSpeedHQ/codspeed/pull/493)

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

#### What's Changed

- fix: add the distribution to the instruments cache key by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in [#&#8203;233](https://redirect.github.com/CodSpeedHQ/action/pull/233)
- chore: bump runner version to 5.1.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;232](https://redirect.github.com/CodSpeedHQ/action/pull/232)
- chore: bump runner version to 5.2.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;234](https://redirect.github.com/CodSpeedHQ/action/pull/234)

**Full Changelog**:
<CodSpeedHQ/action@v5.0.3...v5.2.0>

</details>

<details>
<summary>taiki-e/install-action (taiki-e/install-action)</summary>

###
[`v2.87.0`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.87.0):
2.87.0

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.86.8...v2.87.0)

- Support `kache`.
([#&#8203;1980](https://redirect.github.com/taiki-e/install-action/pull/1980),
thanks [@&#8203;ChrisJr404](https://redirect.github.com/ChrisJr404))

- Update `vacuum@latest` to 0.30.1.

- Update `uv@latest` to 0.12.6.

- Update `mise@latest` to 2026.8.14.

- Update `editorconfig-checker@latest` to 3.11.2.

###
[`v2.86.8`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.86.8):
2.86.8

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.86.7...v2.86.8)

- Update `wasmtime@latest` to 48.0.1.

- Update `wasm-tools@latest` to 1.258.0.

- Update `oxfmt@latest` to 1.80.0.

- Update `mise@latest` to 2026.8.12.

- Update `kingfisher@latest` to 2.0.0.

- Update `cargo-zigbuild@latest` to 0.23.2.

###
[`v2.86.7`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.86.7):
2.86.7

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.86.6...v2.86.7)

- Update `tombi@latest` to 1.4.1.

- Update `rafn@latest` to 0.1.5.

- Update `cargo-binstall@latest` to 1.22.0.

###
[`v2.86.6`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.86.6):
2.86.6

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.86.5...v2.86.6)

- Update `dprint@latest` to 0.56.1.

- Update `cargo-lambda@latest` to 1.9.2.

- Update `biome@latest` to 2.5.10.

###
[`v2.86.5`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.86.5):
2.86.5

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.86.4...v2.86.5)

- Update `zola@latest` to 0.23.4.

- Update `wasm-tools@latest` to 1.257.1.

- Update `protoc@latest` to 3.36.0.

- Update `mise@latest` to 2026.8.10.

- Update `cargo-dinghy@latest` to 0.8.6.

- Update `wasmtime@latest` to 48.0.0.

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - "before 10am on monday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants