#3836 chore(deps): update minor and patch updates to github actions Pull request opened by renovate[bot] This PR contains the following updates: | Package | Type | Update | Change | Pending | | -------------------------------------------------------------------------------- | ------ | ------ | ----------------- | ------- | | [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) | action | minor | v5.4.2 → v5.5.0 | v5.6.0 | | [github/codeql-action](https://redirect.github.com/github/codeql-action) | action | minor | v4.38.3 → v4.39.0 | v4.39.1 | | [zizmorcore/zizmor-action](https://redirect.github.com/zizmorcore/zizmor-action) | action | minor | v0.6.4 → v0.7.1 | v0.8.0 | --- Release Notes CodSpeedHQ/action `v5.5.0` Compare Source Bumps the CodSpeed runner to v5.5.0. This release adds support for Ubuntu 26.04, on both x86_64 and arm64. The officially supported distributions are now Ubuntu 22.04, 24.04 and 26.04, and Debian 12. Profile uploads are also faster on GitHub-hosted runners, and archives larger than 5 GiB can now be uploaded. Results from the Memory instrument are processed much faster and with less memory on large benchmarks. This release also fixes a crash that could affect some

pytest-codspeed

benchmarks since v5.4.2. 🚀 Features • Split profile archive uploads into concurrent parts by @​lvaroqui in #​565 🐛 Bug Fixes • Only set

PYTHONPERFSUPPORT

for exec-harness benchmarks by @​not-matthias in #​584 ⚡ Performance • Stream memtrack frames and decode them in parallel when finding module events by @​not-matthias in #​578 • Use mimalloc as the runner's global allocator by @​not-matthias in #​581 ⚙️ Internals • Support Ubuntu 26.04 by @​lvaroqui in #​574 Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md What's Changed • ci: migrate to github default arm runners by @​lvaroqui in #​250 • chore: bump runner version to 5.5.0 by @​github-actions[bot] in #​251 New Contributors • @​lvaroqui made their first contribution in #​250 Full Changelog: CodSpeedHQ/action@v5.4.2...v5.5.0 github/codeql-action `v4.39.0` Compare Source • _Breaking change_: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205 • The

codeql-action/analyze

step now validates that a correct argument for the

checkout_path

input has been provided. The

checkout_path

input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by

codeql-action/init

, then the CodeQL Action now produces a warning. #​4148 • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206 • The

codeql-action/start-proxy

step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as

codeql-action/init

. This primarily benefits customers who are using GitHub instances other than

<http://github.com|github.com>

where the

codeql-action/start-proxy

step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198 zizmorcore/zizmor-action `v0.7.1` Compare Source zizmor changes Bug Fixes 🐛🔗 • Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit action changes The default version of zizmor is now 1.31.1. What's Changed • Sync zizmor versions by @​github-actions[bot] in #​178 Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1 `v0.7.0` Compare Source Sponsorship is appreciated! zizmor notes Enhancements 🌱:link: • The typosquat-uses audit now supports pre-commit config inputs (#​2437) • The self-hosted-runner audit is now significantly more precise (#​2350) Many thanks to @​ubiratansoares for proposing and implementing this enhancement! • The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#​2396) • zizmor is now aware of the image_version workflow trigger (#​2397) • The dangerous-triggers audit now produces more precise finding/diagnostic spans (#​2402) • The cache-poisoning audit is now aware of pnpm/setup (#​2409) • The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#​2395) Many thanks to @​ubiratansoares for proposing and implementing this enhancement! • The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#​2418) • The <https://docs.zizmor.sh/audits/#cache-poisoning|c… meltano/sdk