chore(deps): update github actions (#27573)

This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) | action | minor | `v5.2.1` → `v5.4.0` | `v5.4.2` | | [actions/download-artifact](https://redirect.github.com/actions/download-artifact) | action | patch | `v8.0.1` → `v8.0.2` | | | [actions/upload-artifact](https://redirect.github.com/actions/upload-artifact) | action | patch | `v7.0.1` → `v7.0.2` | | | [semgrep/semgrep](https://redirect.github.com/semgrep/semgrep-proprietary) | container | minor | `1.179.0` → `1.180.0` | | | [taiki-e/install-action](https://redirect.github.com/taiki-e/install-action) | action | patch | `v2.87.22` → `v2.87.26` | `v2.87.27` | --- ### Release Notes <details> <summary>CodSpeedHQ/action (CodSpeedHQ/action)</summary> ### [`v5.4.0`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.4.0) [Compare Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.2.1...v5.4.0) Bumps the CodSpeed runner to [v5.4.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.4.0), including [v5.3.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.3.0) and [v5.3.1](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.3.1). The [Memory instrument](https://codspeed.io/docs/instruments/memory) now tracks physical (resident) memory and captures allocation call stacks to build memory flamegraphs. Both are enabled by default and can be turned off with the new `disable-memory-track-physical` and `disable-memory-capture-stack` inputs. Serialization is also faster on large memory benchmarks. The action now exposes the id of the CodSpeed run as a `run-id` output, and CodSpeed now works on non-Ubuntu/Debian distributions such as Arch Linux. ##### 🚀 Features - Track physical memory and capture allocation call stacks for memory flamegraphs, both enabled by default by [@not-matthias](https://redirect.github.com/not-matthias) in [#529](https://redirect.github.com/CodSpeedHQ/codspeed/pull/529), [#522](https://redirect.github.com/CodSpeedHQ/codspeed/pull/522) and [#553](https://redirect.github.com/CodSpeedHQ/codspeed/pull/553) - Expose the run id as a GitHub Actions step output by [@moha-bekh](https://redirect.github.com/moha-bekh) in [#551](https://redirect.github.com/CodSpeedHQ/codspeed/pull/551) - Add an `--experimental-disable-pythonmalloc-override` flag (`CODSPEED_EXPERIMENTAL_DISABLE_PYTHONMALLOC_OVERRIDE`) to stop overriding the Python allocator, which can break free-threaded Python in simulation mode, by [@not-matthias](https://redirect.github.com/not-matthias) in [#539](https://redirect.github.com/CodSpeedHQ/codspeed/pull/539) - Apply kernel memory tunables before memory-mode runs, and fail early when the kernel has no BTF by [@not-matthias](https://redirect.github.com/not-matthias) in [#507](https://redirect.github.com/CodSpeedHQ/codspeed/pull/507) and [#524](https://redirect.github.com/CodSpeedHQ/codspeed/pull/524) - Pause producers under ring buffer pressure in memory mode, and log process stops per reason by [@not-matthias](https://redirect.github.com/not-matthias) in [#543](https://redirect.github.com/CodSpeedHQ/codspeed/pull/543) - Log which authentication method the run uses by [@fargito](https://redirect.github.com/fargito) in [#521](https://redirect.github.com/CodSpeedHQ/codspeed/pull/521) ##### 🐛 Bug Fixes - Support distributions CodSpeed publishes no valgrind package for (Arch, rolling releases) by [@moha-bekh](https://redirect.github.com/moha-bekh) in [#525](https://redirect.github.com/CodSpeedHQ/codspeed/pull/525) - Error out when the profile archive exceeds the upload size limit by [@lvaroqui](https://redirect.github.com/lvaroqui) in [#557](https://redirect.github.com/CodSpeedHQ/codspeed/pull/557) - Detect free-threaded Python from venv and uv before setting `PYTHONMALLOC` by [@not-matthias](https://redirect.github.com/not-matthias) in [#539](https://redirect.github.com/CodSpeedHQ/codspeed/pull/539) - Honor deprecated experimental flags, including their falsey values, instead of ignoring them by [@not-matthias](https://redirect.github.com/not-matthias) in [#532](https://redirect.github.com/CodSpeedHQ/codspeed/pull/532) and [#553](https://redirect.github.com/CodSpeedHQ/codspeed/pull/553) - Fix memory tracking edge cases: reused pids, stack-ring overflow, BPF links held by forked processes, and allocator symbols aliased at an attached offset by [@not-matthias](https://redirect.github.com/not-matthias) in [#522](https://redirect.github.com/CodSpeedHQ/codspeed/pull/522) and [#543](https://redirect.github.com/CodSpeedHQ/codspeed/pull/543) - Attach memory tracking hooks without `perf_event_open` by [@GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange) in [#536](https://redirect.github.com/CodSpeedHQ/codspeed/pull/536) - Restore profiling sysctls in walltime mode by [@not-matthias](https://redirect.github.com/not-matthias) in [#507](https://redirect.github.com/CodSpeedHQ/codspeed/pull/507) ##### ⚡ Performance - Speed up memory serialization and reduce the tracker's memory usage on large memory benchmarks by [@not-matthias](https://redirect.github.com/not-matthias) in [#522](https://redirect.github.com/CodSpeedHQ/codspeed/pull/522), [#537](https://redirect.github.com/CodSpeedHQ/codspeed/pull/537), [#548](https://redirect.github.com/CodSpeedHQ/codspeed/pull/548), [#558](https://redirect.github.com/CodSpeedHQ/codspeed/pull/558) and [#560](https://redirect.github.com/CodSpeedHQ/codspeed/pull/560) ##### ⚙️ Internals - Pin memtrack to 1.6.0, through 1.5.0 and 1.5.1, by [@adriencaccia](https://redirect.github.com/adriencaccia) in [#530](https://redirect.github.com/CodSpeedHQ/codspeed/pull/530), [#541](https://redirect.github.com/CodSpeedHQ/codspeed/pull/541) and [#561](https://redirect.github.com/CodSpeedHQ/codspeed/pull/561) - Keep mmap/munmap/brk as deprecated memtrack artifact variants by [@GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange) in [#538](https://redirect.github.com/CodSpeedHQ/codspeed/pull/538) **Full Runner Changelog**: <https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md> #### What's Changed - chore: bump runner version to 5.3.0 by [@github-actions](https://redirect.github.com/github-actions)\[bot] in [#239](https://redirect.github.com/CodSpeedHQ/action/pull/239) - feat: add memory-track-physical experimental input by [@not-matthias](https://redirect.github.com/not-matthias) in [#238](https://redirect.github.com/CodSpeedHQ/action/pull/238) - chore: bump runner version to 5.3.1 by [@github-actions](https://redirect.github.com/github-actions)\[bot] in [#240](https://redirect.github.com/CodSpeedHQ/action/pull/240) - feat: add a run-id output by [@moha-bekh](https://redirect.github.com/moha-bekh) in [#243](https://redirect.github.com/CodSpeedHQ/action/pull/243) - chore: bump runner version to 5.4.0 by [@github-actions](https://redirect.github.com/github-actions)\[bot] in [#244](https://redirect.github.com/CodSpeedHQ/action/pull/244) - feat: add disable-memory-capture-stack and disable-memory-track-physical inputs by [@not-matthias](https://redirect.github.com/not-matthias) in [#242](https://redirect.github.com/CodSpeedHQ/action/pull/242) #### New Contributors - [@moha-bekh](https://redirect.github.com/moha-bekh) made their first contribution in [#243](https://redirect.github.com/CodSpeedHQ/action/pull/243) **Full Changelog**: <https://github.com/CodSpeedHQ/action/compare/v5.2.1...v5.4.0> </details> <details> <summary>actions/download-artifact (actions/download-artifact)</summary> ### [`v8.0.2`](https://redirect.github.com/actions/download-artifact/releases/tag/v8.0.2) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v8.0.1...v8.0.2) ##### What's Changed - Update the readme by [@danwkennedy](https://redirect.github.com/danwkennedy) in [#473](https://redirect.github.com/actions/download-artifact/pull/473) - Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers. - Update [@actions/artifact](https://redirect.github.com/actions/artifact) to 6.3.1 by [@tunc-d](https://redirect.github.com/tunc-d) in [#492](https://redirect.github.com/actions/download-artifact/pull/492) - Prepare download-artifact v8.0.2 by [@tunc-d](https://redirect.github.com/tunc-d) in [#493](https://redirect.github.com/actions/download-artifact/pull/493) ##### New Contributors - [@tunc-d](https://redirect.github.com/tunc-d) made their first contribution in [#492](https://redirect.github.com/actions/download-artifact/pull/492) **Full Changelog**: <https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2> </details> <details> <summary>actions/upload-artifact (actions/upload-artifact)</summary> ### [`v7.0.2`](https://redirect.github.com/actions/upload-artifact/releases/tag/v7.0.2) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2) ##### What's Changed - Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers. - Updates [@actions/artifact](https://redirect.github.com/actions/artifact) to v6.3.1. ##### New Contributors - [@tunc-d](https://redirect.github.com/tunc-d) made their first contribution in [#821](https://redirect.github.com/actions/upload-artifact/pull/821) **Full Changelog**: <https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2> </details> <details> <summary>taiki-e/install-action (taiki-e/install-action)</summary> ### [`v2.87.26`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.87.26): 2.87.26 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.87.25...v2.87.26) - Update `tombi@latest` to 1.7.2. - Update `prek@latest` to 0.5.5. - Update `mise@latest` to 2026.10.3. - Update `kache@latest` to 1.0.0. - Update `hyperfine@latest` to 1.21.0. ### [`v2.87.25`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.87.25): 2.87.25 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.87.24...v2.87.25) - Update `uv@latest` to 0.12.23. - Update `mise@latest` to 2026.10.2. - Update `kingfisher@latest` to 2.10.0. - Update `dprint@latest` to 0.60.1. - Update `cargo-semver-checks@latest` to 0.51.0. - Update `cargo-binstall@latest` to 1.25.1. ### [`v2.87.24`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.87.24): 2.87.24 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.87.23...v2.87.24) - Update `wasmtime@latest` to 49.0.2. - Update `dprint@latest` to 0.59.0. - Update `cargo-leptos@latest` to 0.3.11. - Update `cargo-insta@latest` to 1.49.0. - Update `cargo-binstall@latest` to 1.25.0. ### [`v2.87.23`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.87.23): 2.87.23 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.87.22...v2.87.23) - Update `wasm-tools@latest` to 1.261.0. - Update `uv@latest` to 0.12.22. - Update `trivy@latest` to 0.75.0. - Update `tombi@latest` to 1.7.1. - Update `protoc-gen-connect-openapi@latest` to 0.28.0. - Update `mise@latest` to 2026.10.0. - Update `kingfisher@latest` to 2.9.1. - Update `kache@latest` to 0.28.1. - Update `espup@latest` to 0.18.0. - Update `dprint@latest` to 0.58.0. - Update `cargo-crap@latest` to 0.6.1. - Update `cargo-auditable@latest` to 0.7.7. - Update `biome@latest` to 2.5.15. - Update `syft@latest` to 1.54.0. </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Shanghai) - Branch creation - "before 10am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-11-04 10:29:58 +00:00 · 2026-10-12 01:40:10 +00:00
1 parent 565509bc07
commit 1f1d7eae2e
@@ -97,7 +97,7 @@ jobs:
          rm target/codspeed/analysis/oxc_benchmark/*.d

      - name: Run benchmark
-        uses: CodSpeedHQ/action@373d6868929f444bc08d901fd0eb0ad52a8875ea # v5.2.1
+        uses: CodSpeedHQ/action@c4fd08a3a159bd0cc208da1e0edf32b8c47d75e5 # v5.4.0
        timeout-minutes: 30
        with:
          mode: ${{ matrix.mode }}
@@ -22,7 +22,7 @@ jobs:
      - uses: oxc-project/setup-rust@3d6fb132fbe7cdcb66bf8ec193911c2945369d12 # v1.0.17

      - name: Install cargo-llvm-lines
-        uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+        uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
        with:
          tool: cargo-llvm-lines

@@ -144,7 +144,7 @@ jobs:
        with:
          path: /home/runner/.rustup
          cache: rust
-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+      - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
        with:
          tool: cross
      # `--lib --bins --tests` to skip doctests which are very slow to run via `cross`.
@@ -162,7 +162,7 @@ jobs:
        with:
          path: /home/runner/.rustup
          cache: rust
-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+      - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
        with:
          tool: cross
      # `--lib --bins --tests` to skip doctests which are very slow to run via `cross`.
@@ -638,7 +638,7 @@ jobs:
            rust
            pnpm

-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+      - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
        if: steps.filter.outputs.changed == 'true'
        with:
          tool: just
@@ -701,7 +701,7 @@ jobs:
          path: /home/runner/.rustup
          cache: rust

-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+      - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
        if: steps.filter.outputs.changed == 'true'
        with:
          tool: just
@@ -763,7 +763,7 @@ jobs:
          path: /home/runner/.rustup
          cache: rust

-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+      - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
        if: steps.filter.outputs.changed == 'true'
        with:
          tool: just
@@ -39,7 +39,7 @@ jobs:
          - uses: oxc-project/setup-node@f46a72f95efdc55273fcd042d61c84e723b2892c # v1.4.1

      - run: rustup component add llvm-tools-preview
-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+      - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
        with:
          tool: cargo-llvm-cov

@@ -54,7 +54,7 @@ jobs:
        run: cargo codecov --lcov --output-path lcov.info

      - name: Upload Artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          if-no-files-found: error
          name: codecov
@@ -75,7 +75,7 @@ jobs:

      - name: Download coverage file
        if: env.CODECOV_TOKEN
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: codecov

@@ -149,7 +149,7 @@ jobs:

      - name: Install cross
        id: install-cross
-        uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+        uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
        with:
          tool: cross # cross installs the latest rust toolchain
        background: true
@@ -190,7 +190,7 @@ jobs:

      - parallel:
          - name: Upload NAPI artifact
-            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+            uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
            with:
              if-no-files-found: error
              name: oxlint-bindings-${{ matrix.target }}
@@ -209,7 +209,7 @@ jobs:
      # For github release
      - name: Upload Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          if-no-files-found: error
          name: rust-oxlint-${{ matrix.target }}
@@ -246,7 +246,7 @@ jobs:

      - parallel:
          - name: Upload NAPI artifact
-            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+            uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
            with:
              if-no-files-found: error
              name: oxlint-bindings-x86_64-unknown-freebsd
@@ -259,7 +259,7 @@ jobs:
              archive_name: rust-oxlint-x86_64-unknown-freebsd

      - name: Upload Rust binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          if-no-files-found: error
          name: rust-oxlint-x86_64-unknown-freebsd
@@ -295,7 +295,7 @@ jobs:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - parallel:
-          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+          - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
            with:
              path: artifacts
              pattern: oxlint-bindings-*
@@ -442,7 +442,7 @@ jobs:

      - name: Install cross
        id: install-cross
-        uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+        uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
        with:
          tool: cross # cross installs the latest rust toolchain
        background: true
@@ -483,7 +483,7 @@ jobs:

      - parallel:
          - name: Upload NAPI artifact
-            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+            uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
            with:
              if-no-files-found: error
              name: oxfmt-bindings-${{ matrix.target }}
@@ -502,7 +502,7 @@ jobs:
      # For github release
      - name: Upload Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          if-no-files-found: error
          name: rust-oxfmt-${{ matrix.target }}
@@ -539,7 +539,7 @@ jobs:

      - parallel:
          - name: Upload NAPI artifact
-            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+            uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
            with:
              if-no-files-found: error
              name: oxfmt-bindings-x86_64-unknown-freebsd
@@ -552,7 +552,7 @@ jobs:
              archive_name: rust-oxfmt-x86_64-unknown-freebsd

      - name: Upload Rust binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          if-no-files-found: error
          name: rust-oxfmt-x86_64-unknown-freebsd
@@ -575,7 +575,7 @@ jobs:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - parallel:
-          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+          - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
            with:
              path: artifacts
              pattern: oxfmt-bindings-*
@@ -655,7 +655,7 @@ jobs:
          git tag oxlint_v${NEEDS_CHECK_OUTPUTS_OXLINT_VERSION} ${{ github.sha }}
          git push origin oxlint_v${NEEDS_CHECK_OUTPUTS_OXLINT_VERSION} oxfmt_v${NEEDS_CHECK_OUTPUTS_OXFMT_VERSION}

-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: ./release-artifacts
          pattern: rust-*
@@ -159,7 +159,7 @@ jobs:
          # `*-pc-windows-msvc` targets and let cc-rs pick `cl.exe`.
          TARGET_CC: ${{ !contains(matrix.target, 'pc-windows-msvc') && 'clang' || '' }} # for mimalloc

-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          if-no-files-found: error
          name: bindings-${{ matrix.target }}
@@ -193,7 +193,7 @@ jobs:
        run: pnpm build --target x86_64-unknown-freebsd -x

      - name: Upload artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          if-no-files-found: error
          name: bindings-freebsd
@@ -218,7 +218,7 @@ jobs:

      - parallel:
          - uses: oxc-project/setup-node@f46a72f95efdc55273fcd042d61c84e723b2892c # v1.4.1
-          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+          - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
            with:
              path: artifacts

@@ -19,7 +19,7 @@ jobs:
    name: Semgrep
    runs-on: ubuntu-latest
    container:
-      image: semgrep/semgrep:1.179.0
+      image: semgrep/semgrep:1.180.0
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2