chore(deps): update github-actions (#359)

renovate[bot] · web-flow · commit 48c6dab69382 · 2026-04-26T21:49:18.000Z
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-node](https://redirect.github.com/actions/setup-node) | action | minor | `v6.1.0` → `v6.4.0` | | [dorny/paths-filter](https://redirect.github.com/dorny/paths-filter) | action | patch | `v3.0.2` → `v3.0.3` | | [mlugg/setup-zig](https://redirect.github.com/mlugg/setup-zig) | action | minor | `v2` → `v2.2.1` | | [oxc-project/setup-node](https://redirect.github.com/oxc-project/setup-node) | action | minor | `v1.0.4` → `v1.2.0` | | [oxc-project/setup-rust](https://redirect.github.com/oxc-project/setup-rust) | action | patch | `v1.0.2` → `v1.0.16` | | [pnpm/action-setup](https://redirect.github.com/pnpm/action-setup) | action | minor | `v4.1.0` → `v4.4.0` | --- ### Release Notes <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v6.4.0`](https://redirect.github.com/actions/setup-node/compare/v6.3.0...v6.4.0) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v6.3.0...v6.4.0) ### [`v6.3.0`](https://redirect.github.com/actions/setup-node/releases/tag/v6.3.0) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v6.2.0...v6.3.0) #### What's Changed ##### Enhancements: - Support parsing `devEngines` field by [@&#8203;susnux](https://redirect.github.com/susnux) in [#&#8203;1283](https://redirect.github.com/actions/setup-node/pull/1283) > When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node. ##### Dependency updates: - Fix npm audit issues by [@&#8203;gowridurgad](https://redirect.github.com/gowridurgad) in [#&#8203;1491](https://redirect.github.com/actions/setup-node/pull/1491) - Replace uuid with crypto.randomUUID() by [@&#8203;trivikr](https://redirect.github.com/trivikr) in [#&#8203;1378](https://redirect.github.com/actions/setup-node/pull/1378) - Upgrade minimatch from 3.1.2 to 3.1.5 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [#&#8203;1498](https://redirect.github.com/actions/setup-node/pull/1498) ##### Bug fixes: - Remove hardcoded bearer for mirror-url [@&#8203;marco-ippolito](https://redirect.github.com/marco-ippolito) in [#&#8203;1467](https://redirect.github.com/actions/setup-node/pull/1467) - Scope test lockfiles by package manager and update cache tests by [@&#8203;gowridurgad](https://redirect.github.com/gowridurgad) in [#&#8203;1495](https://redirect.github.com/actions/setup-node/pull/1495) #### New Contributors - [@&#8203;susnux](https://redirect.github.com/susnux) made their first contribution in [#&#8203;1283](https://redirect.github.com/actions/setup-node/pull/1283) **Full Changelog**: <actions/setup-node@v6...v6.3.0> ### [`v6.2.0`](https://redirect.github.com/actions/setup-node/compare/v6.1.0...v6.2.0) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v6.1.0...v6.2.0) </details> <details> <summary>dorny/paths-filter (dorny/paths-filter)</summary> ### [`v3.0.3`](https://redirect.github.com/dorny/paths-filter/blob/HEAD/CHANGELOG.md#v303) [Compare Source](https://redirect.github.com/dorny/paths-filter/compare/v3.0.2...v3.0.3) - [Add missing predicate-quantifier](https://redirect.github.com/dorny/paths-filter/pull/279) </details> <details> <summary>mlugg/setup-zig (mlugg/setup-zig)</summary> ### [`v2.2.1`](https://redirect.github.com/mlugg/setup-zig/releases/tag/v2.2.1) [Compare Source](https://redirect.github.com/mlugg/setup-zig/compare/v2.2.0...v2.2.1) - Print which version of Zig was installed - Add a little more log output (helps debug cache issues) > \[!NOTE] > The setup-zig project is now hosted on [Codeberg](https://codeberg.org/mlugg/setup-zig), and this GitHub repository exists as a mirror solely to work around the vendor lock-in mechanisms employed by GitHub Actions. While there are **no plans** to discontinue GitHub Actions support, I would nonetheless encourage users to consider upgrading to Forgejo Actions on a non-profit forge like Codeberg to avoid being affected by GitHub's profit-driven behavior (such as attempting to [charge users by the minute for using their own hardware](https://resources.github.com/actions/2026-pricing-changes-for-github-actions/)). ### [`v2.2.0`](https://redirect.github.com/mlugg/setup-zig/releases/tag/v2.2.0) [Compare Source](https://redirect.github.com/mlugg/setup-zig/compare/v2.1.0...v2.2.0) - Update dependencies - Replace libsodium dependency with node:crypto, improving target support - Use hardcoded mirror list when ziglang.org is inaccessible - Fix incorrect tarball names when fetching certain versions > \[!NOTE] > The setup-zig project is now hosted on [Codeberg](https://codeberg.org/mlugg/setup-zig), and this GitHub repository exists as a mirror solely to work around the vendor lock-in mechanisms employed by GitHub Actions. While there are **no plans** to discontinue GitHub Actions support, I would nonetheless encourage users to consider upgrading to Forgejo Actions on a non-profit forge like Codeberg to avoid being affected by GitHub's profit-driven behavior (such as attempting to [charge users by the minute for using their own hardware](https://resources.github.com/actions/2026-pricing-changes-for-github-actions/)). ### [`v2.1.0`](https://redirect.github.com/mlugg/setup-zig/releases/tag/v2.1.0) [Compare Source](https://redirect.github.com/mlugg/setup-zig/compare/v2.0.5...v2.1.0) - Support Forgejo Actions - Support recent Zig versions on ARM - Progress towards better OS support - Redirect Zig caches to working directory to avoid sharing the cache on self-hosted runners ### [`v2.0.5`](https://redirect.github.com/mlugg/setup-zig/releases/tag/v2.0.5) [Compare Source](https://redirect.github.com/mlugg/setup-zig/compare/v2.0.4...v2.0.5) - Fix exception identifying Zig cache directory on recent Zig builds ([#&#8203;49](https://redirect.github.com/mlugg/setup-zig/issues/49)) ### [`v2.0.4`](https://redirect.github.com/mlugg/setup-zig/releases/tag/v2.0.4) [Compare Source](https://redirect.github.com/mlugg/setup-zig/compare/v2.0.3...v2.0.4) - Fix canonical `ziglang.org` download URL - Use more descriptive `?source` query parameter value ### [`v2.0.3`](https://redirect.github.com/mlugg/setup-zig/releases/tag/v2.0.3) [Compare Source](https://redirect.github.com/mlugg/setup-zig/compare/v2.0.2...v2.0.3) This release switches from a hardcoded `mirrors.json` list, to fetching the list of mirrors [now available](https://ziglang.org/download/community-mirrors/) from the Zig website. There are no user-facing changes. ### [`v2.0.2`](https://redirect.github.com/mlugg/setup-zig/releases/tag/v2.0.2) [Compare Source](https://redirect.github.com/mlugg/setup-zig/compare/v2.0.1...v2.0.2) - Update dependencies - Remove some mirrors experiencing issues - Don't use tool cache on GitHub-hosted runners by default ([#&#8203;34](https://redirect.github.com/mlugg/setup-zig/issues/34)) - Improve logging, in particular to help debug potential issues ### [`v2.0.1`](https://redirect.github.com/mlugg/setup-zig/releases/tag/v2.0.1) [Compare Source](https://redirect.github.com/mlugg/setup-zig/compare/v2...v2.0.1) The recent Zig 0.14.1 release flipped the "arch" and "OS" fields in the tarball name; for instance, `zig-x86_64-linux-0.14.1.tar.xz` instead of `zig-linux-x86_64-0.14.1.tar.xz`. This brings the tarball names in line with target triple syntax. The change does *not* retroactively apply to old Zig tarballs. So, this patch has only one fix: - Add support for new Zig tarball name format as of Zig 0.14.1 / 0.15.0-dev.631+9a3540d61 > \[!NOTE] > > **I do not intend to update v1 to support the new tarball name format.** > `setup-zig` version 1 is considered deprecated. Please upgrade to version 2. </details> <details> <summary>oxc-project/setup-node (oxc-project/setup-node)</summary> ### [`v1.2.0`](https://redirect.github.com/oxc-project/setup-node/compare/v1.1.0...v1.2.0) [Compare Source](https://redirect.github.com/oxc-project/setup-node/compare/v1.1.0...v1.2.0) ### [`v1.1.0`](https://redirect.github.com/oxc-project/setup-node/compare/v1.0.7...v1.1.0) [Compare Source](https://redirect.github.com/oxc-project/setup-node/compare/v1.0.7...v1.1.0) ### [`v1.0.7`](https://redirect.github.com/oxc-project/setup-node/compare/v1.0.6...v1.0.7) [Compare Source](https://redirect.github.com/oxc-project/setup-node/compare/v1.0.6...v1.0.7) ### [`v1.0.6`](https://redirect.github.com/oxc-project/setup-node/compare/v1.0.5...v1.0.6) [Compare Source](https://redirect.github.com/oxc-project/setup-node/compare/v1.0.5...v1.0.6) ### [`v1.0.5`](https://redirect.github.com/oxc-project/setup-node/releases/tag/v1.0.5) [Compare Source](https://redirect.github.com/oxc-project/setup-node/compare/v1.0.4...v1.0.5) ##### What's Changed - Update actions/cache action to v4.3.0 by [@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in [#&#8203;5](https://redirect.github.com/oxc-project/setup-node/pull/5) - Update pnpm/action-setup action to v4.2.0 by [@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in [#&#8203;6](https://redirect.github.com/oxc-project/setup-node/pull/6) - Update actions/setup-node action to v6 by [@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in [#&#8203;7](https://redirect.github.com/oxc-project/setup-node/pull/7) **Full Changelog**: <oxc-project/setup-node@v1.0.4...v1.0.5> </details> <details> <summary>oxc-project/setup-rust (oxc-project/setup-rust)</summary> ### [`v1.0.16`](https://redirect.github.com/oxc-project/setup-rust/releases/tag/v1.0.16): v.1.0.16 [Compare Source](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.15...v1.0.16) ### [`v1.0.15`](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.14...v1.0.15) [Compare Source](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.14...v1.0.15) ### [`v1.0.14`](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.13...v1.0.14) [Compare Source](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.13...v1.0.14) ### [`v1.0.13`](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.12...v1.0.13) [Compare Source](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.12...v1.0.13) ### [`v1.0.12`](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.11...v1.0.12) [Compare Source](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.11...v1.0.12) ### [`v1.0.11`](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.10...v1.0.11) [Compare Source](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.10...v1.0.11) ### [`v1.0.10`](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.9...v1.0.10) [Compare Source](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.9...v1.0.10) ### [`v1.0.9`](https://redirect.github.com/oxc-project/setup-rust/releases/tag/v1.0.9) [Compare Source](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.8...v1.0.9) ##### What's Changed - chore(deps): update taiki-e/install-action action to v2.62.47 by [@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in [#&#8203;26](https://redirect.github.com/oxc-project/setup-rust/pull/26) **Full Changelog**: <oxc-project/setup-rust@v1.0.8...v1.0.9> ### [`v1.0.8`](https://redirect.github.com/oxc-project/setup-rust/releases/tag/v1.0.8) [Compare Source](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.7...v1.0.8) ##### What's Changed - chore(deps): update taiki-e/install-action action to v2.62.16 by [@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in [#&#8203;22](https://redirect.github.com/oxc-project/setup-rust/pull/22) - chore(deps): update taiki-e/install-action action to v2.62.33 by [@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in [#&#8203;23](https://redirect.github.com/oxc-project/setup-rust/pull/23) - chore(deps): update taiki-e/install-action action to v2.62.37 by [@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in [#&#8203;24](https://redirect.github.com/oxc-project/setup-rust/pull/24) - chore(deps): update taiki-e/install-action action to v2.62.41 by [@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in [#&#8203;25](https://redirect.github.com/oxc-project/setup-rust/pull/25) **Full Changelog**: <oxc-project/setup-rust@v1.0.7...v1.0.8> ### [`v1.0.7`](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.6...v1.0.7) [Compare Source](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.6...v1.0.7) ### [`v1.0.6`](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.5...v1.0.6) [Compare Source](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.5...v1.0.6) ### [`v1.0.5`](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.4...v1.0.5) [Compare Source](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.4...v1.0.5) ### [`v1.0.4`](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.3...v1.0.4) [Compare Source](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.3...v1.0.4) ### [`v1.0.3`](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.2...v1.0.3) [Compare Source](https://redirect.github.com/oxc-project/setup-rust/compare/v1.0.2...v1.0.3) </details> <details> <summary>pnpm/action-setup (pnpm/action-setup)</summary> ### [`v4.4.0`](https://redirect.github.com/pnpm/action-setup/releases/tag/v4.4.0) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v4.3.0...v4.4.0) Updated the action to use Node.js 24. ### [`v4.3.0`](https://redirect.github.com/pnpm/action-setup/releases/tag/v4.3.0) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v4.2.0...v4.3.0) #### What's Changed - docs: fix the run\_install example in the Readme by [@&#8203;dreyks](https://redirect.github.com/dreyks) in [#&#8203;175](https://redirect.github.com/pnpm/action-setup/pull/175) - chore: remove unused `@types/node-fetch` dependency by [@&#8203;silverwind](https://redirect.github.com/silverwind) in [#&#8203;186](https://redirect.github.com/pnpm/action-setup/pull/186) - Clarify that package\_json\_file is relative to GITHUB\_WORKSPACE by [@&#8203;chris-martin](https://redirect.github.com/chris-martin) in [#&#8203;184](https://redirect.github.com/pnpm/action-setup/pull/184) - feat: store caching by [@&#8203;jrmajor](https://redirect.github.com/jrmajor) in [#&#8203;188](https://redirect.github.com/pnpm/action-setup/pull/188) - refactor: remove star imports by [@&#8203;KSXGitHub](https://redirect.github.com/KSXGitHub) in [#&#8203;196](https://redirect.github.com/pnpm/action-setup/pull/196) - fix(ci): exclude macos by [@&#8203;KSXGitHub](https://redirect.github.com/KSXGitHub) in [#&#8203;197](https://redirect.github.com/pnpm/action-setup/pull/197) #### New Contributors - [@&#8203;dreyks](https://redirect.github.com/dreyks) made their first contribution in [#&#8203;175](https://redirect.github.com/pnpm/action-setup/pull/175) - [@&#8203;silverwind](https://redirect.github.com/silverwind) made their first contribution in [#&#8203;186](https://redirect.github.com/pnpm/action-setup/pull/186) - [@&#8203;chris-martin](https://redirect.github.com/chris-martin) made their first contribution in [#&#8203;184](https://redirect.github.com/pnpm/action-setup/pull/184) - [@&#8203;jrmajor](https://redirect.github.com/jrmajor) made their first contribution in [#&#8203;188](https://redirect.github.com/pnpm/action-setup/pull/188) - [@&#8203;Boosted-Bonobo](https://redirect.github.com/Boosted-Bonobo) made their first contribution in [#&#8203;199](https://redirect.github.com/pnpm/action-setup/pull/199) **Full Changelog**: <pnpm/action-setup@v4.2.0...v4.3.0> ### [`v4.2.0`](https://redirect.github.com/pnpm/action-setup/releases/tag/v4.2.0) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v4.1.0...v4.2.0) When there's a `.npmrc` file at the root of the repository, pnpm will be fetched from the registry that is specified in that `.npmrc` file [#&#8203;179](https://redirect.github.com/pnpm/action-setup/pull/179) </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Shanghai) - Branch creation - "before 10am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/voidzero-dev/vite-task).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -32,7 +32,7 @@ jobs:
       code-changed: ${{ steps.filter.outputs.code }}
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3.0.3
         id: filter
         with:
           filters: |
@@ -50,7 +50,7 @@ jobs:
       - name: Update submodules
         run: git submodule update --init --recursive
 
-      - uses: oxc-project/setup-rust@d286d43bc1f606abbd98096666ff8be68c8d5f57 # v1.0.2
+      - uses: oxc-project/setup-rust@23f38cfb0c04af97a055f76acee94d5be71c7c82 # v1.0.16
         with:
           save-cache: ${{ github.ref_name == 'main' }}
           cache-key: clippy
@@ -60,7 +60,7 @@ jobs:
       - run: pipx install cargo-zigbuild
       # pipx isolates cargo-zigbuild in its own venv, so its ziglang dependency
       # (which bundles zig) isn't on PATH. Install zig separately.
-      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
+      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
 
       # --locked: verify Cargo.lock is up to date (replaces the removed `cargo check --locked`)
       - run: cargo clippy --locked --all-targets --all-features -- -D warnings
@@ -105,7 +105,7 @@ jobs:
             CARGO_HOME,{{ DEV_DRIVE }}/.cargo
             RUSTUP_HOME,{{ DEV_DRIVE }}/.rustup
 
-      - uses: oxc-project/setup-rust@d286d43bc1f606abbd98096666ff8be68c8d5f57 # v1.0.2
+      - uses: oxc-project/setup-rust@23f38cfb0c04af97a055f76acee94d5be71c7c82 # v1.0.16
         with:
           save-cache: ${{ github.ref_name == 'main' }}
           cache-key: test
@@ -120,7 +120,7 @@ jobs:
 
       # pipx isolates cargo-zigbuild in its own venv, so its ziglang dependency
       # (which bundles zig) isn't on PATH. Install zig separately.
-      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
+      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
         if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' }}
 
       - name: Build tests
@@ -136,16 +136,16 @@ jobs:
       # (compiled for x86_64) can be injected into node processes running under Rosetta.
       # oxc-project/setup-node doesn't support the architecture input, so use
       # pnpm/action-setup + actions/setup-node directly.
-      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
         if: ${{ matrix.target == 'x86_64-apple-darwin' }}
 
-      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: .node-version
           architecture: x64
         if: ${{ matrix.target == 'x86_64-apple-darwin' }}
 
-      - uses: oxc-project/setup-node@fdbf0dfd334c4e6d56ceeb77d91c76339c2a0885 # v1.0.4
+      - uses: oxc-project/setup-node@4c26e7cb3605b6bdef5450dacd02c434b10fd8ba # v1.2.0
         if: ${{ matrix.target != 'x86_64-apple-darwin' }}
 
       # `pnpm install` prepares test bins used in snapshot tests
@@ -218,14 +218,14 @@ jobs:
       - name: Update submodules
         run: git submodule update --init --recursive
 
-      - uses: oxc-project/setup-rust@d286d43bc1f606abbd98096666ff8be68c8d5f57 # v1.0.2
+      - uses: oxc-project/setup-rust@23f38cfb0c04af97a055f76acee94d5be71c7c82 # v1.0.16
         with:
           save-cache: ${{ github.ref_name == 'main' }}
           cache-key: fmt
           tools: cargo-shear@1.11.1,cargo-autoinherit@0.1.6
           components: clippy rust-docs rustfmt
 
-      - uses: oxc-project/setup-node@fdbf0dfd334c4e6d56ceeb77d91c76339c2a0885 # v1.0.4
+      - uses: oxc-project/setup-node@4c26e7cb3605b6bdef5450dacd02c434b10fd8ba # v1.2.0
       - run: pnpm oxfmt --check
       - run: cargo autoinherit && git diff --exit-code
       - run: cargo shear --deny-warnings
