chore(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/cache	action	minor	v4.1.2 → v4.3.0
actions/checkout	action	minor	v4.2.2 → v4.3.1
actions/download-artifact	action	minor	v3.0.2 → v3.1.0
actions/setup-node	action	minor	v4.1.0 → v4.4.0
actions/upload-artifact	action	patch	v3.2.1 → v3.2.2
codspeed-criterion-compat (source)	dev-dependencies	minor	2.7.2 → 2.10.1
criterion (source)	dev-dependencies	minor	0.5.1 → 0.8.2
cross-platform-actions/action	action	minor	v0.25.0 → v0.32.0
napi	dependencies	patch	^2.16.13 → ^2.16.17
napi	dependencies	patch	2.16.13 → 2.16.17
napi-build	build-dependencies	minor	2.1.3 → 2.3.2
napi-derive	dependencies	patch	2.16.12 → 2.16.13
node (source)		minor	20.18.0 → 20.20.2
node (source)	volta	minor	20.18.0 → 20.20.2
node	uses-with	minor	20 → 20.20.2
node	uses-with	minor	16 → 16.20.2
npm (source)	volta	patch	10.9.0 → 10.9.8
serde (source)	dependencies	patch	1.0.214 → 1.0.228
strum_macros	dependencies	minor	0.26.4 → 0.28.0
wasm-bindgen (source)	dependencies	patch	0.2.95 → 0.2.126
wasm-bindgen (source)	dependencies	patch	^0.2.95 → ^0.2.126
wasm-bindgen-test	dev-dependencies	patch	0.3.45 → 0.3.76

---

Release Notes

actions/cache (actions/cache)

v4.3.0

Compare Source

What's Changed

• Add note on runner versions by @​GhadimiR in #​1642
• Prepare v4.3.0 release by @​Link- in #​1655

New Contributors

• @​GhadimiR made their first contribution in #​1642

Full Changelog: actions/cache@v4...v4.3.0

v4.2.4

Compare Source

What's Changed

• Update README.md by @​nebuk89 in #​1620
• Upgrade @actions/cache to 4.0.5 and move @protobuf-ts/plugin to dev depdencies by @​Link- in #​1634
• Prepare release 4.2.4 by @​Link- in #​1636

New Contributors

• @​nebuk89 made their first contribution in #​1620

Full Changelog: actions/cache@v4...v4.2.4

v4.2.3

Compare Source

What's Changed

• Update to use @​actions/cache 4.0.3 package & prepare for new release by @​salmanmkc in #​1577 (SAS tokens for cache entries are now masked in debug logs)

New Contributors

• @​salmanmkc made their first contribution in #​1577

Full Changelog: actions/cache@v4.2.2...v4.2.3

v4.2.2

Compare Source

What's Changed

[!IMPORTANT]
As a reminder, there were important backend changes to release v4.2.0, see those release notes and the announcement for more details.

• Bump @​actions/cache to v4.0.2 by @​robherley in #​1560

Full Changelog: actions/cache@v4.2.1...v4.2.2

v4.2.1

Compare Source

What's Changed

[!IMPORTANT]
As a reminder, there were important backend changes to release v4.2.0, see those release notes and the announcement for more details.

• docs: GitHub is spelled incorrectly in caching-strategies.md by @​janco-absa in #​1526
• docs: Make the "always save prime numbers" example more clear by @​Tobbe in #​1525
• Update force deletion docs due a recent deprecation by @​sebbalex in #​1500
• Bump @​actions/cache to v4.0.1 by @​robherley in #​1554

New Contributors

• @​janco-absa made their first contribution in #​1526
• @​Tobbe made their first contribution in #​1525
• @​sebbalex made their first contribution in #​1500

Full Changelog: actions/cache@v4.2.0...v4.2.1

v4.2.0

Compare Source

⚠️ Important Changes

The cache backend service has been rewritten from the ground up for improved performance and reliability. actions/cache now integrates with the new cache service (v2) APIs.

The new service will gradually roll out as of February 1st, 2025. The legacy service will also be sunset on the same date. Changes in these release are fully backward compatible.

We are deprecating some versions of this action. We recommend upgrading to version v4 or v3 as soon as possible before February 1st, 2025. (Upgrade instructions below).

If you are using pinned SHAs, please use the SHAs of versions v4.2.0 or v3.4.0

If you do not upgrade, all workflow runs using any of the deprecated actions/cache will fail.

Upgrading to the recommended versions will not break your workflows.

Read more about the change & access the migration guide: reference to the announcement.

Minor changes

Minor and patch version updates for these dependencies:

• @​actions/core: 1.11.1
• @​actions/io: 1.1.3
• @​vercel/ncc: 0.38.3

Full Changelog: actions/cache@v4.1.2...v4.2.0

actions/checkout (actions/checkout)

v4.3.1

Compare Source

• Port v6 cleanup to v4 by @​ericsciple in #​2305

v4.3.0

Compare Source

• docs: update README.md by @​motss in #​1971
• Add internal repos for checking out multiple repositories by @​mouismail in #​1977
• Documentation update - add recommended permissions to Readme by @​benwells in #​2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in #​2044
• Update README.md by @​nebuk89 in #​2194
• Update CODEOWNERS for actions by @​TingluoHuang in #​2224
• Update package dependencies by @​salmanmkc in #​2236

actions/download-artifact (actions/download-artifact)

v3.1.0

Compare Source

v3.1.0 - What's new

[!Important]
actions/download-artifact@​v3.1.0 runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

This is a backport security updates release for GHES users. This version is deprecated on github.com and should not be used!

Node.js 24

This release updates the runtime to Node.js 24. The previous v3.0.2 ran on Node.js 16, which has reached end-of-life. Now this action will run on Node.js 24.

Pin your workflows to: https://github.com/actions/download-artifact/releases/tag/v3.1.0-node20 which is available if you're still in the process of phasing out Node 20.

What's Changed

• Upgrade @​actions/artifact to 1.1.3 by @​Link-
• Security updates for direct and transitive dependencies

Full Changelog: actions/download-artifact@v3.0.2...v3.1.0-node20

actions/setup-node (actions/setup-node)

v4.4.0

Compare Source

What's Changed

Bug fixes:

• Make eslint-compact matcher compatible with Stylelint by @​FloEdelmann in #​98
• Add support for indented eslint output by @​fregante in #​1245

Enhancement:

• Support private mirrors by @​marco-ippolito in #​1240

Dependency update:

• Upgrade @​action/cache from 4.0.2 to 4.0.3 by @​aparnajyothi-y in #​1262

New Contributors

• @​FloEdelmann made their first contribution in #​98
• @​fregante made their first contribution in #​1245
• @​marco-ippolito made their first contribution in #​1240

Full Changelog: actions/setup-node@v4...v4.4.0

v4.3.0

Compare Source

What's Changed

Dependency updates

• Upgrade @​actions/glob from 0.4.0 to 0.5.0 by @​dependabot in #​1200
• Upgrade @​action/cache from 4.0.0 to 4.0.2 by @​gowridurgad in #​1251
• Upgrade @​vercel/ncc from 0.38.1 to 0.38.3 by @​dependabot in #​1203
• Upgrade @​actions/tool-cache from 2.0.1 to 2.0.2 by @​dependabot in #​1220

New Contributors

• @​gowridurgad made their first contribution in #​1251

Full Changelog: actions/setup-node@v4...v4.3.0

v4.2.0

Compare Source

What's Changed

• Enhance workflows and upgrade publish-actions from 0.2.2 to 0.3.0 by @​aparnajyothi-y in #​1174
• Add recommended permissions section to readme by @​benwells in #​1193
• Configure Dependabot settings by @​HarithaVattikuti in #​1192
• Upgrade @actions/cache to ^4.0.0 by @​priyagupta108 in #​1191
• Upgrade pnpm/action-setup from 2 to 4 by @​dependabot in #​1194
• Upgrade actions/publish-immutable-action from 0.0.3 to 0.0.4 by @​dependabot in #​1195
• Upgrade semver from 7.6.0 to 7.6.3 by @​dependabot in #​1196
• Upgrade @​types/jest from 29.5.12 to 29.5.14 by @​dependabot in #​1201
• Upgrade undici from 5.28.4 to 5.28.5 by @​dependabot in #​1205

New Contributors

• @​benwells made their first contribution in #​1193

Full Changelog: actions/setup-node@v4...v4.2.0

actions/upload-artifact (actions/upload-artifact)

v3.2.2

Compare Source

v3.2.2 - What's new

[!Important]
actions/upload-artifact@​v3.2.2 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

This is a backport security updates release for GHES users. This version is deprecated on github.com and should not be used!

Node.js 24

This release updates the runtime to Node.js 24. The previous v3.2.1 ran on Node.js 16, which has reached end-of-life. Now this action will run on Node.js 24.

Pin your workflows to: https://github.com/actions/upload-artifact/releases/tag/v3.2.2-node20 which is available if you're still in the process of phasing out Node 20.

What's Changed

• Upgrade @​actions/artifact to 1.1.3 by @​Link-
• Security updates for direct and transitive dependencies
• Use node20 by @​robherley in #​606
• Ensure hidden files input is used by @​joshmgross in #​608
• Upgrade the actions used in workflows by @​Link-

Full Changelog: actions/upload-artifact@v3.2.1...v3.2.2

CodSpeedHQ/codspeed-rust (codspeed-criterion-compat)

v2.10.1

Compare Source

What's Changed

• chore(cargo-codspeed): bump cargo_metadata to v0.19.2 by @​Boshen in #​94

Internals

• chore(ci): add time scale measurement benches by @​art049 in #​88
• tests: add an env variable bench for testing by @​art049 in #​89

Full Changelog: CodSpeedHQ/codspeed-rust@v2.10.0...v2.10.1

v2.10.0

Compare Source

What's Changed

• feat(cargo-codspeed): support --jobs flag in build command by @​GuillaumeLagrange in #​91
• fix: file name missing in codspeed rust flamegraph by @​GuillaumeLagrange in #​93

Full Changelog: CodSpeedHQ/codspeed-rust@v2.9.1...v2.10.0

v2.9.1

Compare Source

What's Changed

• feat: add support for all-features and no-default-features by @​not-matthias in #​83
• feat: add support consts with divan by @​not-matthias in #​84
• feat(cargo-codspeed): rethrow exit code by @​not-matthias in #​86
• chore(divan_compat): remove consts from unsupported features in README by @​GuillaumeLagrange in #​87
• feat(criterion_compat): fork criterion and add walltime support by @​not-matthias in #​85

New Contributors

• @​not-matthias made their first contribution in #​83

Full Changelog: CodSpeedHQ/codspeed-rust@v2.8.1...v2.9.1

v2.8.1

Compare Source

What's Changed

• chore: remove deprecated feature from cargo-codspeed release build by @​GuillaumeLagrange in #​76
• chore(divan_compat): fix readme typo by @​GuillaumeLagrange in #​77
• ci: build musl targets for cargo-codspeed binary artifacts by @​GuillaumeLagrange in #​80
• ci: add targets to moon-repo/setup in binary artifact build by @​GuillaumeLagrange in #​81

Full Changelog: CodSpeedHQ/codspeed-rust@v2.8.0...v2.8.1

v2.8.0

Compare Source

What's Changed

This introduces Divan compatibility layer and also Wall Time support. Check out the documentation to try it out here.

Details

• ci: bump actions/checkout to v4 by @​fargito in #​56
• docs: simplify rust benchmarks definition by @​adriencaccia in #​44
• Support walltime runs with divan by @​art049 in #​66
• Make cargo-codspeed build targets to different directories between walltime and instrumented by @​GuillaumeLagrange in #​68
• feat: make codspeed raw results in the walltime directory as well by @​GuillaumeLagrange in #​70
• chore: add an internal divan fork by @​art049 in #​69
• Add codspeed<>divan compat layer by @​GuillaumeLagrange in #​65
• fix: only show walltime collection warning when appropriate by @​art049 in #​71
• feat(divan_compat): support types and manage types and args in codspeed uri by @​GuillaumeLagrange in #​72
• feat: add some TheAlgorithm benches by @​art049 in #​73
• Add divan_compat msrv check in CI by @​GuillaumeLagrange in #​74
• feat: add readme to divan_compat by @​GuillaumeLagrange in #​75

New Contributors

• @​fargito made their first contribution in #​56

New Contributors

• @​fargito made their first contribution in #​56

Full Changelog: CodSpeedHQ/codspeed-rust@v2.7.2...v2.8.0

criterion-rs/criterion.rs (criterion)

v0.8.2

Compare Source

Fixed

• don't build alloca on unsupported targets

Other

• (deps) bump crate-ci/typos from 1.40.0 to 1.43.0
• Fix panic with uniform iteration durations in benchmarks
• Update Readme
• Exclude development scripts from published package

v0.8.1

Compare Source

Fixed

• Homepage link

Other

• (deps) bump crate-ci/typos from 1.23.5 to 1.40.0
• (deps) bump jontze/action-mdbook from 3 to 4
• (deps) bump actions/checkout from 4 to 6

v0.8.0

Compare Source

BREAKING

• Drop async-std support

Changed

• Bump MSRV to 1.86, stable to 1.91.1

Added

• Add ability to plot throughput on summary page.
• Add support for reporting throughput in elements and bytes - Throughput::ElementsAndBytes allows the text summary to report throughput in both units simultaneously.
• Add alloca-based memory layout randomisation to mitigate memory effects on measurements.
• Add doc comment to benchmark runner in criterion_group macro (removes linter warnings)

Fixed

• Fix plotting NaN bug

Other

• Remove Master API Docs links temporarily while we restore the docs publishing.

v0.7.0

Compare Source

• Bump version of criterion-plot to align dependencies.

v0.6.0

Compare Source

Changed

• MSRV bumped to 1.80
• The real_blackbox feature no longer has any impact. Criterion always uses std::hint::black_box() now.
  Users of criterion::black_box() should switch to std::hint::black_box().
• clap dependency unpinned.

Fixed

• gnuplot version is now correctly detected when using certain Windows binaries/configurations that used to fail

Added

• Async benchmarking with Tokio may be done via a tokio::runtime::Handle, not only a tokio::runtime::Runtime

cross-platform-actions/action (cross-platform-actions/action)

v0.32.0: Cross Platform Action 0.32.0

Compare Source

Added

• Add support for OmniOS

v0.31.0: Cross Platform Action 0.31.0

Compare Source

Added

• Add support for FreeBSD 15.0 (#​114)

Fixed

• Fix empty hostname (#​113)

Changed

• Releases are now immutable (#​117)

v0.30.0: Cross Platform Action 0.30.0

Compare Source

Added

• Document how to report a security vulnerability
• Add support for OpenBSD 7.8 (#​112)

Security

• Fix potential code injection in the GitHub release workflow (#GHSA-928q-63gf-mc2x)

v0.29.0: Cross Platform Action 0.29.0

Compare Source

Added

• Add support for FreeBSD 14.3 (#​106, freebsd-builder#9)

Fixed

• Fix file sync on Haiku (#​104)

v0.28.0: Cross Platform Action 0.28.0

Compare Source

Added

• Add support for FreeBSD 13.5 (#​99)
• Add support for OpenBSD 7.7 (openbsd-builder#21)
• Add support for Haiku (#​30)

v0.27.0: Cross Platform Action 0.27.0

Compare Source

Added

• Add support for NetBSD 10.1 (#​95)

v0.26.0: Cross Platform Action 0.26.0

Compare Source

Summary

Version 0.26.0 brings several enhancements and support updates. Key changes include added support for new operating systems and Below is a detailed overview of the changes.

🚀 New Features

• FreeBSD 14.2 Support: The project now supports FreeBSD 14.2, ensuring compatibility with the latest updates in the FreeBSD ecosystem.
• OpenBSD 7.6 Support: Added support for OpenBSD 7.6, expanding functionality for users of this operating system.
• FreeBSD 13.4 Support: Introduced compatibility with FreeBSD 13.4, broadening FreeBSD version coverage.

🛠 Fixes and Maintenance

• Documentation Update: Corrected a missing reference to OpenBSD 7.5 in the README to reflect supported platforms accurately.
• README Improvements: Updated examples in the README to use the latest GitHub Action workflows. This ensures consistency with current best practices.

Acknowledgements

We would like to thank all contributors and users for their feedback and support to make this release possible!

For a detailed list of changes, please refer to the changelog on our repository.

napi-rs/napi-rs (napi)

v2.16.17

Compare Source

What's Changed

• fix: backport BigInt changes from #​2028 & #​2356 by @​Wodann in #​2524

Full Changelog: https://github.com/napi-rs/napi-rs/compare/napi@2.16.16...napi@2.16.17

v2.16.16

Compare Source

What Changed

• fix(napi): add back tokio runtime reference count on macOS, close #​2460 by @​Brooooooklyn

Full Changelog: https://github.com/napi-rs/napi-rs/compare/napi@2.16.15...napi@2.16.16

v2.16.15

Compare Source

What's Changed

• fix(napi): Update from_raw methods on External<T> by @​zackradisic in #​2453

Full Changelog: https://github.com/napi-rs/napi-rs/compare/napi@2.16.14...napi@2.16.15

v2.16.14

Compare Source

What Changed

• chore(napi): expose functions which turn raw pointer into External by @​zackradisic (#​2449)

Full Changelog: https://github.com/napi-rs/napi-rs/compare/napi-derive@2.16.13...napi@2.16.14

nodejs/node (node)

v20.20.2: 2026-03-24, Version 20.20.2 'Iron' (LTS), @​marco-ippolito

Compare Source

This is a security release.

Notable Changes

• (CVE-2026-21717) fix array index hash collision (Joyee Cheung)
• (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan)
• (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina)
• (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS)pull/795>
• (CVE-2026-21715) add permission check to realpath.native (RafaelGSS)
• (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS)
• (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina)

Commits

• [cfb51fa9ce] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) nodejs-private/node-private#831
• [f333d0be5f] - deps: V8: override depot_tools version (Richard Lau) #​62344
• [2acd5d1226] - deps: update undici to v6.24.1 (Matteo Collina) #​62285
• [af5c144ebc] - (CVE-2026-21717) deps,build,test: fix array index hash collision (Joyee Cheung) nodejs-private/node-private#834
• [00ad47a28e] - (CVE-2026-21710) http: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) nodejs-private/node-private#821
• [0123309566] - (CVE-2026-21716) permission: include permission check on lib/fs/promises (RafaelGSS) nodejs-private/node-private#840
• [00830712bc] - (CVE-2026-21715) permission: add permission check to realpath.native (RafaelGSS) nodejs-private/node-private#838
• [a0c73425da] - (CVE-2026-21714) src: handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) nodejs-private/node-private#832
• [cc3f294507] - (CVE-2026-21637) tls: wrap SNICallback invocation in try/catch (Matteo Collina) nodejs-private/node-private#839

v20.20.1: 2026-03-05, Version 20.20.1 'Iron' (LTS), @​marco-ippolito

Compare Source

Notable Changes

• [91a66e671c] - build: test on Python 3.14 (Christian Clauss) #​59983
• [f66056054b] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #​61419
• [80feacaddb] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #​60741

Commits

• [6f580d5399] - assert: fix deepEqual always return true on URL (Xuguang Mei) #​50853
• [91a66e671c] - build: test on Python 3.14 (Christian Clauss) #​59983
• [cc4f7af6f3] - build: skip sscache action on non-main branches (Joyee Cheung) #​61790
• [f66056054b] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #​61419
• [80feacaddb] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #​60741
• [fa88cc07e2] - crypto: ensure documented RSA-PSS saltLength default is used (Filip Skokan) #​60662
• [88b2eec88a] - deps: update minimatch to 10.2.2 (Node.js GitHub Bot) #​61830
• [5c053264f1] - deps: V8: backport 6a0a25a (Vivian Wang) #​61687
• [4a398699d0] - deps: update googletest to 5a9c3f9 (Node.js GitHub Bot) #​61731
• [4fa43adf15] - deps: update googletest to 56efe39 (Node.js GitHub Bot) #​61605
• [1a855d490c] - deps: update googletest to 8508785 (Node.js GitHub Bot) #​61417
• [d8a9359826] - deps: update icu to 78.2 (Node.js GitHub Bot) #​60523
• [e79cd3a0bb] - deps: update acorn-walk to 8.3.5 (Node.js GitHub Bot) #​61928
• [0707ade464] - deps: update acorn to 8.16.0 (Node.js GitHub Bot) #​61925
• [dc5a3cddef] - deps: update llhttp to 9.3.1 (Node.js GitHub Bot) #​61827
• [46043b94c7] - deps: update zlib to 1.3.1-e00f703 (Node.js GitHub Bot) #​61135
• [6be15a596e] - deps: update cjs-module-lexer to 2.2.0 (Node.js GitHub Bot) #​61271
• [10881404cd] - deps: update timezone to 2025c (Node.js GitHub Bot) #​61138
• [1594a78c85] - deps: update googletest to 065127f (Node.js GitHub Bot) #​61055
• [7fa2ee1933] - deps: update zlib to 1.3.1-63d7e16 (Node.js GitHub Bot) #​60898
• [09259532ef] - deps: update googletest to 1b96fa1 (Node.js GitHub Bot) #​60739
• [aa8bdb6886] - deps: update cjs-module-lexer to 2.1.1 (Node.js GitHub Bot) #​60646
• [cc849fde27] - deps: update googletest to 279f847 (Node.js GitHub Bot) #​60219
• [a99ba553a2] - deps: update googletest to 50b8600 (Node.js GitHub Bot) #​59955
• [[6349a79f5f](https://redirect.github.com

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codspeed-hq]

Merging this PR will improve performance by 11.93%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
✅ 11 untouched benchmarks

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	original case	6.7 µs	6 µs	+11.93%

Tip

Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing renovate/all-minor-patch (909ef7a) with main (f471c61)}