renovate[bot] 1f1d7eae2e chore(deps): update github actions (#27573)
This PR contains the following updates:

| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) |
action | minor | `v5.2.1` → `v5.4.0` | `v5.4.2` |
|
[actions/download-artifact](https://redirect.github.com/actions/download-artifact)
| action | patch | `v8.0.1` → `v8.0.2` | |
|
[actions/upload-artifact](https://redirect.github.com/actions/upload-artifact)
| action | patch | `v7.0.1` → `v7.0.2` | |
|
[semgrep/semgrep](https://redirect.github.com/semgrep/semgrep-proprietary)
| container | minor | `1.179.0` → `1.180.0` | |
|
[taiki-e/install-action](https://redirect.github.com/taiki-e/install-action)
| action | patch | `v2.87.22` → `v2.87.26` | `v2.87.27` |

---

### Release Notes

<details>
<summary>CodSpeedHQ/action (CodSpeedHQ/action)</summary>

###
[`v5.4.0`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.4.0)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.2.1...v5.4.0)

Bumps the CodSpeed runner to
[v5.4.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.4.0),
including
[v5.3.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.3.0)
and
[v5.3.1](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.3.1).

The [Memory instrument](https://codspeed.io/docs/instruments/memory) now
tracks physical (resident) memory and captures allocation call stacks to
build memory flamegraphs. Both are enabled by default and can be turned
off with the new `disable-memory-track-physical` and
`disable-memory-capture-stack` inputs. Serialization is also faster on
large memory benchmarks.

The action now exposes the id of the CodSpeed run as a `run-id` output,
and CodSpeed now works on non-Ubuntu/Debian distributions such as Arch
Linux.

##### 🚀 Features

- Track physical memory and capture allocation call stacks for memory
flamegraphs, both enabled by default by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;529](https://redirect.github.com/CodSpeedHQ/codspeed/pull/529),
[#&#8203;522](https://redirect.github.com/CodSpeedHQ/codspeed/pull/522)
and
[#&#8203;553](https://redirect.github.com/CodSpeedHQ/codspeed/pull/553)
- Expose the run id as a GitHub Actions step output by
[@&#8203;moha-bekh](https://redirect.github.com/moha-bekh) in
[#&#8203;551](https://redirect.github.com/CodSpeedHQ/codspeed/pull/551)
- Add an `--experimental-disable-pythonmalloc-override` flag
(`CODSPEED_EXPERIMENTAL_DISABLE_PYTHONMALLOC_OVERRIDE`) to stop
overriding the Python allocator, which can break free-threaded Python in
simulation mode, by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;539](https://redirect.github.com/CodSpeedHQ/codspeed/pull/539)
- Apply kernel memory tunables before memory-mode runs, and fail early
when the kernel has no BTF by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;507](https://redirect.github.com/CodSpeedHQ/codspeed/pull/507)
and
[#&#8203;524](https://redirect.github.com/CodSpeedHQ/codspeed/pull/524)
- Pause producers under ring buffer pressure in memory mode, and log
process stops per reason by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;543](https://redirect.github.com/CodSpeedHQ/codspeed/pull/543)
- Log which authentication method the run uses by
[@&#8203;fargito](https://redirect.github.com/fargito) in
[#&#8203;521](https://redirect.github.com/CodSpeedHQ/codspeed/pull/521)

##### 🐛 Bug Fixes

- Support distributions CodSpeed publishes no valgrind package for
(Arch, rolling releases) by
[@&#8203;moha-bekh](https://redirect.github.com/moha-bekh) in
[#&#8203;525](https://redirect.github.com/CodSpeedHQ/codspeed/pull/525)
- Error out when the profile archive exceeds the upload size limit by
[@&#8203;lvaroqui](https://redirect.github.com/lvaroqui) in
[#&#8203;557](https://redirect.github.com/CodSpeedHQ/codspeed/pull/557)
- Detect free-threaded Python from venv and uv before setting
`PYTHONMALLOC` by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;539](https://redirect.github.com/CodSpeedHQ/codspeed/pull/539)
- Honor deprecated experimental flags, including their falsey values,
instead of ignoring them by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;532](https://redirect.github.com/CodSpeedHQ/codspeed/pull/532)
and
[#&#8203;553](https://redirect.github.com/CodSpeedHQ/codspeed/pull/553)
- Fix memory tracking edge cases: reused pids, stack-ring overflow, BPF
links held by forked processes, and allocator symbols aliased at an
attached offset by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;522](https://redirect.github.com/CodSpeedHQ/codspeed/pull/522)
and
[#&#8203;543](https://redirect.github.com/CodSpeedHQ/codspeed/pull/543)
- Attach memory tracking hooks without `perf_event_open` by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&#8203;536](https://redirect.github.com/CodSpeedHQ/codspeed/pull/536)
- Restore profiling sysctls in walltime mode by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;507](https://redirect.github.com/CodSpeedHQ/codspeed/pull/507)

##### ⚡ Performance

- Speed up memory serialization and reduce the tracker's memory usage on
large memory benchmarks by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;522](https://redirect.github.com/CodSpeedHQ/codspeed/pull/522),
[#&#8203;537](https://redirect.github.com/CodSpeedHQ/codspeed/pull/537),
[#&#8203;548](https://redirect.github.com/CodSpeedHQ/codspeed/pull/548),
[#&#8203;558](https://redirect.github.com/CodSpeedHQ/codspeed/pull/558)
and
[#&#8203;560](https://redirect.github.com/CodSpeedHQ/codspeed/pull/560)

##### ⚙️ Internals

- Pin memtrack to 1.6.0, through 1.5.0 and 1.5.1, by
[@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;530](https://redirect.github.com/CodSpeedHQ/codspeed/pull/530),
[#&#8203;541](https://redirect.github.com/CodSpeedHQ/codspeed/pull/541)
and
[#&#8203;561](https://redirect.github.com/CodSpeedHQ/codspeed/pull/561)
- Keep mmap/munmap/brk as deprecated memtrack artifact variants by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#&#8203;538](https://redirect.github.com/CodSpeedHQ/codspeed/pull/538)

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

#### What's Changed

- chore: bump runner version to 5.3.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;239](https://redirect.github.com/CodSpeedHQ/action/pull/239)
- feat: add memory-track-physical experimental input by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;238](https://redirect.github.com/CodSpeedHQ/action/pull/238)
- chore: bump runner version to 5.3.1 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;240](https://redirect.github.com/CodSpeedHQ/action/pull/240)
- feat: add a run-id output by
[@&#8203;moha-bekh](https://redirect.github.com/moha-bekh) in
[#&#8203;243](https://redirect.github.com/CodSpeedHQ/action/pull/243)
- chore: bump runner version to 5.4.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;244](https://redirect.github.com/CodSpeedHQ/action/pull/244)
- feat: add disable-memory-capture-stack and
disable-memory-track-physical inputs by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;242](https://redirect.github.com/CodSpeedHQ/action/pull/242)

#### New Contributors

- [@&#8203;moha-bekh](https://redirect.github.com/moha-bekh) made their
first contribution in
[#&#8203;243](https://redirect.github.com/CodSpeedHQ/action/pull/243)

**Full Changelog**:
<https://github.com/CodSpeedHQ/action/compare/v5.2.1...v5.4.0>

</details>

<details>
<summary>actions/download-artifact (actions/download-artifact)</summary>

###
[`v8.0.2`](https://redirect.github.com/actions/download-artifact/releases/tag/v8.0.2)

[Compare
Source](https://redirect.github.com/actions/download-artifact/compare/v8.0.1...v8.0.2)

##### What's Changed

- Update the readme by
[@&#8203;danwkennedy](https://redirect.github.com/danwkennedy) in
[#&#8203;473](https://redirect.github.com/actions/download-artifact/pull/473)
- Improves artifact download retries when the service returns HTTP 429
(rate limiting), including honoring valid Retry-After headers.
- Update
[@&#8203;actions/artifact](https://redirect.github.com/actions/artifact)
to 6.3.1 by [@&#8203;tunc-d](https://redirect.github.com/tunc-d) in
[#&#8203;492](https://redirect.github.com/actions/download-artifact/pull/492)
- Prepare download-artifact v8.0.2 by
[@&#8203;tunc-d](https://redirect.github.com/tunc-d) in
[#&#8203;493](https://redirect.github.com/actions/download-artifact/pull/493)

##### New Contributors

- [@&#8203;tunc-d](https://redirect.github.com/tunc-d) made their first
contribution in
[#&#8203;492](https://redirect.github.com/actions/download-artifact/pull/492)

**Full Changelog**:
<https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2>

</details>

<details>
<summary>actions/upload-artifact (actions/upload-artifact)</summary>

###
[`v7.0.2`](https://redirect.github.com/actions/upload-artifact/releases/tag/v7.0.2)

[Compare
Source](https://redirect.github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2)

##### What's Changed

- Improves artifact download retries when the service returns HTTP 429
(rate limiting), including honoring valid Retry-After headers.
- Updates
[@&#8203;actions/artifact](https://redirect.github.com/actions/artifact)
to v6.3.1.

##### New Contributors

- [@&#8203;tunc-d](https://redirect.github.com/tunc-d) made their first
contribution in
[#&#8203;821](https://redirect.github.com/actions/upload-artifact/pull/821)

**Full Changelog**:
<https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2>

</details>

<details>
<summary>taiki-e/install-action (taiki-e/install-action)</summary>

###
[`v2.87.26`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.87.26):
2.87.26

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.87.25...v2.87.26)

- Update `tombi@latest` to 1.7.2.

- Update `prek@latest` to 0.5.5.

- Update `mise@latest` to 2026.10.3.

- Update `kache@latest` to 1.0.0.

- Update `hyperfine@latest` to 1.21.0.

###
[`v2.87.25`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.87.25):
2.87.25

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.87.24...v2.87.25)

- Update `uv@latest` to 0.12.23.

- Update `mise@latest` to 2026.10.2.

- Update `kingfisher@latest` to 2.10.0.

- Update `dprint@latest` to 0.60.1.

- Update `cargo-semver-checks@latest` to 0.51.0.

- Update `cargo-binstall@latest` to 1.25.1.

###
[`v2.87.24`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.87.24):
2.87.24

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.87.23...v2.87.24)

- Update `wasmtime@latest` to 49.0.2.

- Update `dprint@latest` to 0.59.0.

- Update `cargo-leptos@latest` to 0.3.11.

- Update `cargo-insta@latest` to 1.49.0.

- Update `cargo-binstall@latest` to 1.25.0.

###
[`v2.87.23`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.87.23):
2.87.23

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.87.22...v2.87.23)

- Update `wasm-tools@latest` to 1.261.0.

- Update `uv@latest` to 0.12.22.

- Update `trivy@latest` to 0.75.0.

- Update `tombi@latest` to 1.7.1.

- Update `protoc-gen-connect-openapi@latest` to 0.28.0.

- Update `mise@latest` to 2026.10.0.

- Update `kingfisher@latest` to 2.9.1.

- Update `kache@latest` to 0.28.1.

- Update `espup@latest` to 0.18.0.

- Update `dprint@latest` to 0.58.0.

- Update `cargo-crap@latest` to 0.6.1.

- Update `cargo-auditable@latest` to 0.7.7.

- Update `biome@latest` to 2.5.15.

- Update `syft@latest` to 1.54.0.

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - "before 10am on monday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-10-12 01:40:10 +00:00
…
2026-10-06 12:08:17 +00:00
…



Oxc logo


MIT licensed Build Status Code Coverage CodSpeed Badge

Discord chat Playground Website

⚓ Oxc

/oʊ ɛks siː/

The Oxidation Compiler is a collection of high-performance tools for JavaScript and TypeScript written in Rust.

Oxc is part of VoidZero's vision for a unified, high-performance toolchain for JavaScript. It powers Rolldown (Vite's bundler) and enables the next generation of ultra-fast development tools that work seamlessly together.

For more information, check out our website at oxc.rs.

* Oxidation is the chemical process that creates rust

🙋 Who's using Oxc?

Rolldown and Nuxt use Oxc for parsing. Rolldown also uses Oxc for transformation and minification. Nova, swc-node, and knip use oxc_resolver for module resolution. Preact, Shopify, ByteDance, and Shopee use oxlint for linting.

See more projects using Oxc →

🔧 Lint or Format a Codebase

  • Lint: Oxlint — npx oxlint@latest
  • Format: Oxfmt — npx oxfmt@latest

🧰 Build Tooling on Top of Oxc

  • Parse JavaScript and TypeScript: Parser
  • Transform TypeScript, JSX, and modern JavaScript: Transformer
  • Minify JavaScript for production builds: Minifier
  • Resolve modules for JavaScript and TypeScript: Resolver

✍️ Contribute

Check out some of the good first issues or ask us on Discord.

See CONTRIBUTING.md for guidance, or read the complete contributing guide on our website →

If you are unable to contribute by code, you can still participate by:

📚 Other Resources

Sponsored By

Our sponsors

📖 License

Oxc is free and open-source software licensed under the MIT License.

Thank you to namespace.so for powering our CI/CD pipelines with fast, free macOS and Linux runners.

Oxc ports or copies code from other open source projects, their licenses are listed in Third-party library licenses.

Languages
Rust 80.6%
JavaScript 12.3%
TypeScript 7%