Skip to content

fix: hangs on ARM64 due to atomics#23

Merged
not-matthias merged 3 commits into
masterfrom
cod-3103-valgrind-atomics-have-incorrect-time-cause-hangs
Jul 9, 2026
Merged

fix: hangs on ARM64 due to atomics#23
not-matthias merged 3 commits into
masterfrom
cod-3103-valgrind-atomics-have-incorrect-time-cause-hangs

Conversation

@not-matthias

@not-matthias not-matthias commented Jul 9, 2026

Copy link
Copy Markdown
Member

This reverts commit e0e62db which was previously thought to be an issue in the stress-ng utility, but turned out to be a valgrind bug.

@greptile-apps

greptile-apps Bot commented Jul 9, 2026

Copy link
Copy Markdown

Greptile Summary

This PR fixes intermittent ARM64 hangs in callgrind CI by extending the Cortex-A72 (implementer 0x41, part 0xd08) detection in /proc/cpuinfo to auto-enable the fallback LL/SC implementation, alongside the existing Cavium/ThunderX check. Under Valgrind instrumentation, the LDAXR..STXR window spans two translated superblocks with hundreds of host instructions, so the hardware exclusive monitor cannot be relied on for forward progress.

  • coregrind/m_machine.c: Adds Cortex-A72 identification to VG_(parse_cpuinfo), setting arm64_requires_fallback_LLSC when both 0x41 (ARM Ltd implementer) and 0xd08 (A72 part) appear in /proc/cpuinfo; the comment correctly notes that a false positive only enables the safe fallback.
  • bench/testdata/llsc_tzconvert_bench.c (Git LFS): New benchmark fixture exercising the localtime()/__tz_convert() call path that triggered the livelock; compiled from source in CI.
  • bench/generate_config.py / .github/workflows/codspeed.yml: Adds stress-ng and the new fixture to the benchmark suite with a CI compile step.

Confidence Score: 5/5

Safe to merge. The fix is a targeted extension of an existing, well-tested detection path, and the fallback it enables is the conservative direction.

The Cortex-A72 detection is correctly guarded by requiring both the implementer and part strings, matches the same proven pattern used for Cavium, and the comment explicitly documents that a false positive is safe. The new benchmark fixture is compiled from source in CI after an LFS-aware checkout, so there is no risk of a stale binary. No existing logic is removed or weakened.

No files require special attention.

Important Files Changed

Filename Overview
coregrind/m_machine.c Extends parse_cpuinfo to detect Cortex-A72 (0x41/0xd08) alongside Cavium; false-positive-safe and well-commented.
bench/testdata/llsc_tzconvert_bench.c New Git LFS file; CI checks out with lfs:true so the compile step receives the actual C source.
bench/generate_config.py Adds stress-ng and llsc_tzconvert_bench commands; follows existing relative-path convention.
.github/workflows/codspeed.yml Adds compile step for new C fixture; source and libc are both available unconditionally.
.gitignore Correctly ignores compiled fixture binary and Python bytecode cache.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[VG_machine_get_hwcaps] --> B[VG_parse_cpuinfo]
    B --> C[Read /proc/cpuinfo]
    C --> D{Cavium?\nimplementer 0x43}
    D -->|yes| E[arm64_requires_fallback_LLSC = True]
    D -->|no| F{ARM Ltd?\nimplementer 0x41}
    F -->|no| G[return True - no fallback]
    F -->|yes| H{Cortex-A72?\npart 0xd08}
    H -->|no| G
    H -->|yes| E
    E --> I[return True - fallback enabled]
    I --> J[Guest LDAXR/STXR via host CAS]
    G --> K[Guest LDAXR/STXR via hardware monitor]
Loading
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[VG_machine_get_hwcaps] --> B[VG_parse_cpuinfo]
    B --> C[Read /proc/cpuinfo]
    C --> D{Cavium?\nimplementer 0x43}
    D -->|yes| E[arm64_requires_fallback_LLSC = True]
    D -->|no| F{ARM Ltd?\nimplementer 0x41}
    F -->|no| G[return True - no fallback]
    F -->|yes| H{Cortex-A72?\npart 0xd08}
    H -->|no| G
    H -->|yes| E
    E --> I[return True - fallback enabled]
    I --> J[Guest LDAXR/STXR via host CAS]
    G --> K[Guest LDAXR/STXR via hardware monitor]
Loading

Reviews (5): Last reviewed commit: "test(bench): add llsc_tzconvert_bench fi..." | Re-trigger Greptile

Comment thread coregrind/m_machine.c
Comment thread bench/generate_config.py
@codspeed-hq

codspeed-hq Bot commented Jul 9, 2026

Copy link
Copy Markdown

Merging this PR will not alter performance

⚡ 11 improved benchmarks
❌ 2 regressed benchmarks
✅ 57 untouched benchmarks
🆕 14 new benchmarks
⏩ 60 skipped benchmarks1

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

Benchmark BASE HEAD Efficiency
test_valgrind[valgrind-3.25.1, python3 testdata/test.py, no-inline] 4.4 s 337.4 s -98.68%
test_valgrind[valgrind-3.25.1, python3 testdata/test.py, full-with-inline] 7.1 s 8.4 s -15.27%
test_valgrind[valgrind.codspeed, stress-ng --cpu 4 --cpu-ops 10, full-no-inline] 20 s 2.9 s ×6.8
test_valgrind[valgrind.codspeed, stress-ng --cpu 4 --cpu-ops 10, full-with-inline-with-cycle-estimation] 14.6 s 3.5 s ×4.2
test_valgrind[valgrind.codspeed, stress-ng --cpu 1 --cpu-ops 10, no-inline] 4.4 s 3.7 s +17.19%
test_valgrind[valgrind.codspeed, stress-ng --cpu 4 --cpu-ops 10, inline] 2.3 s 2 s +15.98%
test_valgrind[valgrind.codspeed, stress-ng --cpu 1 --cpu-ops 10, cycle-estimation] 4.8 s 4.2 s +15.75%
test_valgrind[valgrind.codspeed, stress-ng --cpu 4 --cpu-ops 10, cycle-estimation] 2.3 s 2 s +15.48%
test_valgrind[valgrind.codspeed, stress-ng --cpu 4 --cpu-ops 10, no-inline] 2.1 s 1.8 s +15.14%
test_valgrind[valgrind-3.26.0, python3 testdata/test.py, full-with-inline] 8.3 s 7.2 s +14.85%
test_valgrind[valgrind.codspeed, stress-ng --cpu 4 --cpu-ops 10, full-with-inline] 3.6 s 3.2 s +14.11%
test_valgrind[valgrind.codspeed, stress-ng --cpu 1 --cpu-ops 10, full-with-inline] 8.8 s 7.8 s +13.06%
test_valgrind[valgrind.codspeed, stress-ng --cpu 1 --cpu-ops 10, full-with-inline-with-cycle-estimation] 9.5 s 8.5 s +12.15%
🆕 test_valgrind[valgrind-3.25.1, testdata/llsc_tzconvert_bench 5000, full-no-inline] N/A 1 s N/A
🆕 test_valgrind[valgrind-3.25.1, testdata/llsc_tzconvert_bench 5000, full-with-inline] N/A 1.2 s N/A
🆕 test_valgrind[valgrind-3.25.1, testdata/llsc_tzconvert_bench 5000, inline] N/A 887.8 ms N/A
🆕 test_valgrind[valgrind-3.25.1, testdata/llsc_tzconvert_bench 5000, no-inline] N/A 711.1 ms N/A
🆕 test_valgrind[valgrind.codspeed, testdata/llsc_tzconvert_bench 5000, cycle-estimation] N/A 797.5 ms N/A
🆕 test_valgrind[valgrind.codspeed, testdata/llsc_tzconvert_bench 5000, full-no-inline] N/A 1 s N/A
🆕 test_valgrind[valgrind.codspeed, testdata/llsc_tzconvert_bench 5000, full-with-inline-with-cycle-estimation] N/A 1.3 s N/A
... ... ... ... ...

ℹ️ Only the first 20 benchmarks are displayed. Go to the app to view all benchmarks.

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.


Comparing cod-3103-valgrind-atomics-have-incorrect-time-cause-hangs (b738cff) with master (8a82521)2

Open in CodSpeed

Footnotes

  1. 60 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports.

  2. No successful run was found on master (b738cff) during the generation of this report, so 8a82521 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report.

@not-matthias not-matthias force-pushed the cod-3103-valgrind-atomics-have-incorrect-time-cause-hangs branch from f6e15e9 to 4a421a2 Compare July 9, 2026 14:11
@not-matthias not-matthias marked this pull request as ready for review July 9, 2026 15:29
…livelocks

An AArch64 conditional branch always ends a VEX superblock, so a guest CAS
loop (ldaxr; cmp; b.ne; stxr; cbnz - e.g. glibc's outline-atomics
__aarch64_cas4_acq, used by every glibc lock on non-LSE cores) has its
LDAXR and STXR in two different translations, with hundreds of host
instructions (tool helpers, dispatcher, event checks) executing inside the
exclusive window. The default (non-fallback) LL/SC mode passes stxr through
to hardware, so guest progress depends on the exclusive monitor surviving
that window - which is IMPLEMENTATION DEFINED and on Cortex-A72 was observed
to intermittently fail as a sticky per-run state (live capture: an
uncontended CAS retrying ~1M/s at 100% CPU for minutes, zero page faults,
~6 ctxsw/s). This caused the intermittent ARM64 callgrind CI hangs, and it
also silently inflates callgrind-measured costs at atomic sites whenever
retries occur (retry iterations are counted as real guest instructions).

Extend the existing Cavium/ThunderX (#369459) cpuinfo autodetection to also
enable the fallback (CAS-based) LL/SC implementation on Cortex-A72
(implementer 0x41 + part 0xd08): SC becomes a real host CAS against the
recorded LL value, independent of the hardware monitor. Other cores keep
upstream behavior; --sim-hints=fallback-llsc still force-enables it there.

Validation on a loaded Cortex-A72 host: the trigger config (callgrind
--cache-sim=yes, pinned core, same-core load) hung 4x within 55 iterations
before, 0x in 300 after; 8x200k-thread __atomic_fetch_add counts exact;
memcheck/tests/atomic_incs and none/tests/arm64/atomics_v81 pass; ls/python
timings unchanged.
…repro

Repeated localtime()/__tz_convert() calls exercise the outline-atomics
LDAXR/STXR CAS loop (glibc tzset_lock) that triggered the ARM64
fallback-LL/SC livelock. Wired into generate_config.py's CI matrix; the
CI workflow compiles it fresh (no arch-specific deps beyond libc), so
unlike testdata/take_strings-* it isn't checked in as a binary.
@not-matthias not-matthias force-pushed the cod-3103-valgrind-atomics-have-incorrect-time-cause-hangs branch from 8de45a3 to b738cff Compare July 9, 2026 15:55
@not-matthias not-matthias merged commit b738cff into master Jul 9, 2026
8 checks passed
@not-matthias not-matthias deleted the cod-3103-valgrind-atomics-have-incorrect-time-cause-hangs branch July 9, 2026 16:09
MrAlias pushed a commit to open-telemetry/opentelemetry-go that referenced this pull request Jul 9, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) |
action | patch | `v4.18.4` → `v4.18.5` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/5322) for more information.

---

### Release Notes

<details>
<summary>CodSpeedHQ/action (CodSpeedHQ/action)</summary>

###
[`v4.18.5`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v4.18.5)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v4.18.4...v4.18.5)

#### Release Notes

##### <!-- 10 -->💼 Other

- Bump pinned valgrind-codspeed to
[3.26.0-0codspeed6](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/releases/tag/3.26.0-0codspeed6)
([#&#8203;448](https://redirect.github.com/CodSpeedHQ/action/issues/448))
by [@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;448](https://redirect.github.com/CodSpeedHQ/runner/pull/448)
- fix: hangs on ARM64 due to atomics by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[CodSpeedHQ/valgrind-codspeed#23](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/23)
- fix(aspacem): raise amd64 managed address ceiling to 1 TiB by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[CodSpeedHQ/valgrind-codspeed#22](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/22)

#### Install codspeed-runner 4.18.4

##### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-installer.sh | sh
```

#### Download codspeed-runner 4.18.4

| File | Platform | Checksum |
|
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------
| ------------------- |
-------------------------------------------------------------------------------------------------------------------------------------
|
|
[codspeed-runner-aarch64-apple-darwin.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-aarch64-apple-darwin.tar.gz.sha256)
|
|
[codspeed-runner-aarch64-unknown-linux-musl.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-aarch64-unknown-linux-musl.tar.gz)
| ARM64 MUSL Linux |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-aarch64-unknown-linux-musl.tar.gz.sha256)
|
|
[codspeed-runner-x86\_64-unknown-linux-musl.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-x86_64-unknown-linux-musl.tar.gz)
| x64 MUSL Linux |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-x86_64-unknown-linux-musl.tar.gz.sha256)
|

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

**Full Changelog**:
<CodSpeedHQ/action@v4.18.4...v4.18.5>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/open-telemetry/opentelemetry-go).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDIuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI0Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJTa2lwIENoYW5nZWxvZyIsImRlcGVuZGVuY2llcyJdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Aureliolo pushed a commit to Aureliolo/synthorg that referenced this pull request Jul 11, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) |
action | patch | `v4.18.1` → `v4.18.5` |
![age](https://developer.mend.io/api/mc/badges/age/github-tags/CodSpeedHQ%2faction/v4.18.5?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/CodSpeedHQ%2faction/v4.18.1/v4.18.5?slim=true)
|
| [chainguard-dev/apko](https://redirect.github.com/chainguard-dev/apko)
| | patch | `v1.2.21` → `v1.2.24` |
![age](https://developer.mend.io/api/mc/badges/age/github-releases/chainguard-dev%2fapko/v1.2.24?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/chainguard-dev%2fapko/v1.2.21/v1.2.24?slim=true)
|
|
[chainguard-dev/melange](https://redirect.github.com/chainguard-dev/melange)
| | patch | `v0.56.0` → `v0.56.1` |
![age](https://developer.mend.io/api/mc/badges/age/github-releases/chainguard-dev%2fmelange/v0.56.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/chainguard-dev%2fmelange/v0.56.0/v0.56.1?slim=true)
|
|
[charm.land/bubbles/v2](https://redirect.github.com/charmbracelet/bubbles)
| require | patch | `v2.1.0` → `v2.1.1` |
![age](https://developer.mend.io/api/mc/badges/age/go/charm.land%2fbubbles%2fv2/v2.1.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/charm.land%2fbubbles%2fv2/v2.1.0/v2.1.1?slim=true)
|
|
[charm.land/lipgloss/v2](https://redirect.github.com/charmbracelet/lipgloss)
| require | patch | `v2.0.4` → `v2.0.5` |
![age](https://developer.mend.io/api/mc/badges/age/go/charm.land%2flipgloss%2fv2/v2.0.5?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/charm.land%2flipgloss%2fv2/v2.0.4/v2.0.5?slim=true)
|
| [dhi.io/nats](https://dhi.io/catalog/nats)
([source](https://redirect.github.com/docker-hardened-images/definitions))
| | digest | `d42d0f3` → `a142c2d` | | |
| [dhi.io/postgres](https://dhi.io/catalog/postgres)
([source](https://redirect.github.com/docker-hardened-images/definitions))
| | digest | `50a57c1` → `2ff0d4a` | | |
| [ghcr.io/astral-sh/uv](https://redirect.github.com/astral-sh/uv) |
stage | patch | `0.11.26` → `0.11.28` |
![age](https://developer.mend.io/api/mc/badges/age/docker/ghcr.io%2fastral-sh%2fuv/0.11.28?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/ghcr.io%2fastral-sh%2fuv/0.11.26/0.11.28?slim=true)
|
|
[github.com/sigstore/sigstore-go](https://redirect.github.com/sigstore/sigstore-go)
| require | patch | `v1.2.1` → `v1.2.2` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fsigstore%2fsigstore-go/v1.2.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fsigstore%2fsigstore-go/v1.2.1/v1.2.2?slim=true)
|
|
[github/codeql-action](https://redirect.github.com/github/codeql-action)
| action | minor | `v4.36.3` → `v4.37.0` |
![age](https://developer.mend.io/api/mc/badges/age/github-tags/github%2fcodeql-action/v4.37.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/github%2fcodeql-action/v4.36.3/v4.37.0?slim=true)
|
| golang | stage | digest | `3ad5730` → `0178a64` |  |  |
| [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | require |
minor | [`v0.44.0` →
`v0.45.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.44.0...refs/tags/v0.45.0)
|
![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fterm/v0.45.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fterm/v0.44.0/v0.45.0?slim=true)
|
|
[goreleaser/goreleaser](https://redirect.github.com/goreleaser/goreleaser)
| | minor | `v2.16.0` → `v2.17.0` |
![age](https://developer.mend.io/api/mc/badges/age/github-releases/goreleaser%2fgoreleaser/v2.17.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/goreleaser%2fgoreleaser/v2.16.0/v2.17.0?slim=true)
|

---

### Release Notes

<details>
<summary>CodSpeedHQ/action (CodSpeedHQ/action)</summary>

###
[`v4.18.5`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v4.18.5)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v4.18.4...v4.18.5)

#### Release Notes

##### <!-- 10 -->💼 Other

- Bump pinned valgrind-codspeed to
[3.26.0-0codspeed6](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/releases/tag/3.26.0-0codspeed6)
([#&#8203;448](https://redirect.github.com/CodSpeedHQ/action/issues/448))
by [@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;448](https://redirect.github.com/CodSpeedHQ/runner/pull/448)
- fix: hangs on ARM64 due to atomics by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[CodSpeedHQ/valgrind-codspeed#23](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/23)
- fix(aspacem): raise amd64 managed address ceiling to 1 TiB by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[CodSpeedHQ/valgrind-codspeed#22](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/22)

#### Install codspeed-runner 4.18.4

##### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-installer.sh | sh
```

#### Download codspeed-runner 4.18.4

| File | Platform | Checksum |
|
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------
| ------------------- |
-------------------------------------------------------------------------------------------------------------------------------------
|
|
[codspeed-runner-aarch64-apple-darwin.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-aarch64-apple-darwin.tar.gz.sha256)
|
|
[codspeed-runner-aarch64-unknown-linux-musl.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-aarch64-unknown-linux-musl.tar.gz)
| ARM64 MUSL Linux |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-aarch64-unknown-linux-musl.tar.gz.sha256)
|
|
[codspeed-runner-x86\_64-unknown-linux-musl.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-x86_64-unknown-linux-musl.tar.gz)
| x64 MUSL Linux |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-x86_64-unknown-linux-musl.tar.gz.sha256)
|

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

**Full Changelog**:
<CodSpeedHQ/action@v4.18.4...v4.18.5>

###
[`v4.18.4`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v4.18.4)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v4.18.2...v4.18.4)

#### What's Changed

- fix 4.18.3 runner hash –
[`bf19f56`](https://redirect.github.com/CodSpeedHQ/action/commit/bf19f56fe8857e83e4343138c1a927e56f666e3b)
by [@&#8203;adriencaccia](https://redirect.github.com/adriencaccia)

**Full Changelog**:
<CodSpeedHQ/action@v4.18.3...v4.18.4>

###
[`v4.18.2`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v4.18.2)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v4.18.1...v4.18.2)

#### Release Notes

##### <!-- 1 -->🐛 Bug Fixes

- Source forwarded env below memtrack's capability boundary by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;439](https://redirect.github.com/CodSpeedHQ/runner/pull/439)

##### <!-- 7 -->⚙️ Internals

- chore: bump runner version to 4.18.2 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;219](https://redirect.github.com/CodSpeedHQ/action/pull/219)

#### Install codspeed-runner 4.18.2

##### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-installer.sh | sh
```

#### Download codspeed-runner 4.18.2

| File | Platform | Checksum |
|
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------
| ------------------- |
-------------------------------------------------------------------------------------------------------------------------------------
|
|
[codspeed-runner-aarch64-apple-darwin.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-aarch64-apple-darwin.tar.gz.sha256)
|
|
[codspeed-runner-aarch64-unknown-linux-musl.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-aarch64-unknown-linux-musl.tar.gz)
| ARM64 MUSL Linux |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-aarch64-unknown-linux-musl.tar.gz.sha256)
|
|
[codspeed-runner-x86\_64-unknown-linux-musl.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-x86_64-unknown-linux-musl.tar.gz)
| x64 MUSL Linux |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-x86_64-unknown-linux-musl.tar.gz.sha256)
|

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

**Full Changelog**:
<CodSpeedHQ/action@v4.18.1...v4.18.2>

</details>

<details>
<summary>chainguard-dev/apko (chainguard-dev/apko)</summary>

###
[`v1.2.24`](https://redirect.github.com/chainguard-dev/apko/releases/tag/v1.2.24)

[Compare
Source](https://redirect.github.com/chainguard-dev/apko/compare/v1.2.23...v1.2.24)

##### Changelog

-
[`f2ad955`](https://redirect.github.com/chainguard-dev/apko/commit/f2ad95570365329f3063fc617162455f32c1afda)
lock: embed keyring content in the lock file
([#&#8203;2322](https://redirect.github.com/chainguard-dev/apko/issues/2322))

###
[`v1.2.23`](https://redirect.github.com/chainguard-dev/apko/releases/tag/v1.2.23)

[Compare
Source](https://redirect.github.com/chainguard-dev/apko/compare/v1.2.22...v1.2.23)

##### Changelog

-
[`9d4b52d`](https://redirect.github.com/chainguard-dev/apko/commit/9d4b52d913063421165620da75b7926bbe211321)
Add contents.runtime\_keyring for runtime APK trust
([#&#8203;2297](https://redirect.github.com/chainguard-dev/apko/issues/2297))
-
[`ebe71ff`](https://redirect.github.com/chainguard-dev/apko/commit/ebe71ff2908910610421e5817298838f1e865400)
Use flightCache for index cache implementation
([#&#8203;2175](https://redirect.github.com/chainguard-dev/apko/issues/2175))

###
[`v1.2.22`](https://redirect.github.com/chainguard-dev/apko/releases/tag/v1.2.22)

[Compare
Source](https://redirect.github.com/chainguard-dev/apko/compare/v1.2.21...v1.2.22)

##### Changelog

-
[`463cab4`](https://redirect.github.com/chainguard-dev/apko/commit/463cab44ae3454c02406d55c259e36f4ebfcc1f7)
build(deps): bump chainguard-dev/actions/setup-registry from 1.6.24 to
1.6.26
([#&#8203;2313](https://redirect.github.com/chainguard-dev/apko/issues/2313))
-
[`59d7f49`](https://redirect.github.com/chainguard-dev/apko/commit/59d7f49ccdf5b333cd3be875a3563fae1b14d354)
build(deps): bump chainguard.dev/sdk from 0.1.74 to 0.1.94
([#&#8203;2309](https://redirect.github.com/chainguard-dev/apko/issues/2309))
-
[`74c4920`](https://redirect.github.com/chainguard-dev/apko/commit/74c49209db70fe6b488ffc17c2be95a529cfbb79)
build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.19.0
([#&#8203;2314](https://redirect.github.com/chainguard-dev/apko/issues/2314))
-
[`8165fd4`](https://redirect.github.com/chainguard-dev/apko/commit/8165fd40c5dfad902122385ae6a78beb257ba3aa)
build(deps): bump go.step.sm/crypto from 0.83.0 to 0.84.1
([#&#8203;2301](https://redirect.github.com/chainguard-dev/apko/issues/2301))
-
[`6fb33c4`](https://redirect.github.com/chainguard-dev/apko/commit/6fb33c44faab2f3b6155b5190ae389ceaf60a298)
build(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0
([#&#8203;2312](https://redirect.github.com/chainguard-dev/apko/issues/2312))
-
[`d7dc9ca`](https://redirect.github.com/chainguard-dev/apko/commit/d7dc9ca44ed085c9a2ae59cc23af8b06b5d6254a)
build(deps): bump google.golang.org/api from 0.285.0 to 0.286.0
([#&#8203;2298](https://redirect.github.com/chainguard-dev/apko/issues/2298))
-
[`891d275`](https://redirect.github.com/chainguard-dev/apko/commit/891d27560c80f61cca2fd27e20408ca7e921b67d)
build(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3
([#&#8203;2308](https://redirect.github.com/chainguard-dev/apko/issues/2308))
-
[`f9189c2`](https://redirect.github.com/chainguard-dev/apko/commit/f9189c2afb477dd0f7ecab00f3751f0888553c4b)
build(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7
([#&#8203;2295](https://redirect.github.com/chainguard-dev/apko/issues/2295))

</details>

<details>
<summary>chainguard-dev/melange (chainguard-dev/melange)</summary>

###
[`v0.56.1`](https://redirect.github.com/chainguard-dev/melange/releases/tag/v0.56.1)

[Compare
Source](https://redirect.github.com/chainguard-dev/melange/compare/v0.56.0...v0.56.1)

#### What's Changed

- build(deps): bump the actions group across 1 directory with 4 updates
by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2583](https://redirect.github.com/chainguard-dev/melange/pull/2583)
- build(deps): bump the gomod group across 1 directory with 6 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2585](https://redirect.github.com/chainguard-dev/melange/pull/2585)

**Full Changelog**:
<chainguard-dev/melange@v0.56.0...v0.56.1>

</details>

<details>
<summary>charmbracelet/bubbles (charm.land/bubbles/v2)</summary>

###
[`v2.1.1`](https://redirect.github.com/charmbracelet/bubbles/releases/tag/v2.1.1)

[Compare
Source](https://redirect.github.com/charmbracelet/bubbles/compare/v2.1.0...v2.1.1)

### Lil’ Textarea Fix

This is a tiny patch to fix a bug in `textarea` where the prompt
character could be missing styling on empty lines. That’s all for now!

Thanks for using Bubbles,
Charm 🌞

#### Changelog

##### Fixed

-
[`d2b2217`](https://redirect.github.com/charmbracelet/bubbles/commit/d2b2217d6352ce04183623d66d4266115419733c):
fix(textarea): apply prompt style on all lines, including fillers
([@&#8203;meowgorithm](https://redirect.github.com/meowgorithm))

##### Docs

-
[`a13f110`](https://redirect.github.com/charmbracelet/bubbles/commit/a13f110fba4f13ce5fe9bc7fd51619f5782077b9):
docs: fix typo in README
([#&#8203;921](https://redirect.github.com/charmbracelet/bubbles/issues/921))
([@&#8203;Rohan5commit](https://redirect.github.com/Rohan5commit))

***

<a href="https://charm.land/"><img alt="The Charm logo"
src="https://stuff.charm.sh/charm-banner-next.jpg" width="400"></a>

Thoughts? Questions? We love hearing from you. Feel free to reach out on
[X](https://x.com/charmcli), [Discord](https://charm.land/discord),
[Slack](https://charm.land/slack), [The
Fediverse](https://mastodon.social/@&#8203;charmcli),
[Bluesky](https://bsky.app/profile/charm.land).

</details>

<details>
<summary>charmbracelet/lipgloss (charm.land/lipgloss/v2)</summary>

###
[`v2.0.5`](https://redirect.github.com/charmbracelet/lipgloss/releases/tag/v2.0.5)

[Compare
Source](https://redirect.github.com/charmbracelet/lipgloss/compare/v2.0.4...v2.0.5)

#### Changelog

***

<a href="https://charm.land/"><img alt="The Charm logo"
src="https://stuff.charm.sh/charm-banner-next.jpg" width="400"></a>

Thoughts? Questions? We love hearing from you. Feel free to reach out on
[X](https://x.com/charmcli), [Discord](https://charm.land/discord),
[Slack](https://charm.land/slack), [The
Fediverse](https://mastodon.social/@&#8203;charmcli),
[Bluesky](https://bsky.app/profile/charm.land).

</details>

<details>
<summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary>

###
[`v0.11.28`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01128)

[Compare
Source](https://redirect.github.com/astral-sh/uv/compare/0.11.27...0.11.28)

Released on 2026-07-07.

##### Security

This release updates our ZIP library,
[astral-async-zip](https://redirect.github.com/astral-sh/rs-async-zip),
to v0.0.20, which includes 15 changes that harden our ZIP handling
against [parser
differentials](https://www.brainonfire.net/blog/2022/04/11/what-is-parser-mismatch/).
uv may reject ZIP archives with malformed or ambiguous content that were
previously accepted.

See the [upstream
commits](https://redirect.github.com/astral-sh/rs-async-zip/compare/v0.0.18...v0.0.20)
for a full list of changes.

##### Python

- Upgrade GraalPy to 25.1.3
([#&#8203;20069](https://redirect.github.com/astral-sh/uv/pull/20069))

##### Enhancements

- Improve trace logs for unexpected error chains
([#&#8203;20220](https://redirect.github.com/astral-sh/uv/pull/20220))
- Move lockfile update guidance to a hint
([#&#8203;20219](https://redirect.github.com/astral-sh/uv/pull/20219))
- Preserve indentation for multiline error causes
([#&#8203;20156](https://redirect.github.com/astral-sh/uv/pull/20156))
- Render user errors with their cause chains
([#&#8203;20217](https://redirect.github.com/astral-sh/uv/pull/20217))
- Route final command errors through the printer to respect `-q` and
`-qq`
([#&#8203;20163](https://redirect.github.com/astral-sh/uv/pull/20163))
- Use standard rendering for `uv build` errors
([#&#8203;20159](https://redirect.github.com/astral-sh/uv/pull/20159))
- Use standard rendering for tool requirement errors
([#&#8203;20160](https://redirect.github.com/astral-sh/uv/pull/20160))

##### Performance

- Only compile bytecode for installed distributions in `uv pip install`
([#&#8203;19914](https://redirect.github.com/astral-sh/uv/pull/19914))
- Avoid allocating URL-safe Git revisions
([#&#8203;20194](https://redirect.github.com/astral-sh/uv/pull/20194))
- Avoid allocating canonical Python request strings
([#&#8203;20193](https://redirect.github.com/astral-sh/uv/pull/20193))
- Avoid allocating custom Astral mirror URLs
([#&#8203;20204](https://redirect.github.com/astral-sh/uv/pull/20204))
- Avoid allocating expanded compatibility tags
([#&#8203;20190](https://redirect.github.com/astral-sh/uv/pull/20190))
- Avoid allocating shell strings that need no escaping
([#&#8203;20196](https://redirect.github.com/astral-sh/uv/pull/20196))
- Avoid allocating static ABI descriptions
([#&#8203;20201](https://redirect.github.com/astral-sh/uv/pull/20201))
- Avoid allocating static Windows executable names
([#&#8203;20200](https://redirect.github.com/astral-sh/uv/pull/20200))
- Avoid allocating static dependency table names
([#&#8203;20199](https://redirect.github.com/astral-sh/uv/pull/20199))
- Avoid allocating static platform triple components
([#&#8203;20195](https://redirect.github.com/astral-sh/uv/pull/20195))
- Avoid allocating static resolver report labels
([#&#8203;20198](https://redirect.github.com/astral-sh/uv/pull/20198))
- Avoid allocating static unavailable-version messages
([#&#8203;20197](https://redirect.github.com/astral-sh/uv/pull/20197))
- Avoid allocating unchanged Python download architectures
([#&#8203;20202](https://redirect.github.com/astral-sh/uv/pull/20202))
- Avoid allocating unchanged paths during case normalization
([#&#8203;20203](https://redirect.github.com/astral-sh/uv/pull/20203))
- Avoid allocations when expanding group conflicts
([#&#8203;20211](https://redirect.github.com/astral-sh/uv/pull/20211))
- Avoid allocations when formatting requirements
([#&#8203;20206](https://redirect.github.com/astral-sh/uv/pull/20206))
- Avoid cloning credential lookup services
([#&#8203;20210](https://redirect.github.com/astral-sh/uv/pull/20210))
- Avoid cloning dry-run distributions
([#&#8203;20209](https://redirect.github.com/astral-sh/uv/pull/20209))
- Avoid cloning owned dependency metadata
([#&#8203;20212](https://redirect.github.com/astral-sh/uv/pull/20212))
- Avoid redundant direct URL clones
([#&#8203;20207](https://redirect.github.com/astral-sh/uv/pull/20207))
- Create metadata version errors lazily
([#&#8203;20205](https://redirect.github.com/astral-sh/uv/pull/20205))
- Optimize expanded tag compatibility checks
([#&#8203;20171](https://redirect.github.com/astral-sh/uv/pull/20171))
- Optimize parsing of single-digit three-part versions
([#&#8203;20118](https://redirect.github.com/astral-sh/uv/pull/20118))

##### Bug fixes

- Avoid overflow when computing HTTP cache age
([#&#8203;20178](https://redirect.github.com/astral-sh/uv/pull/20178))
- Respect `--upgrade` when `upgrade-package` is configured
([#&#8203;19955](https://redirect.github.com/astral-sh/uv/pull/19955))
- Support `uv tree` in dependency-group-only projects
([#&#8203;20167](https://redirect.github.com/astral-sh/uv/pull/20167))
- Treat cache entries as stale at exact expiration
([#&#8203;20183](https://redirect.github.com/astral-sh/uv/pull/20183))

###
[`v0.11.27`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01127)

[Compare
Source](https://redirect.github.com/astral-sh/uv/compare/0.11.26...0.11.27)

Released on 2026-07-06.

##### Enhancements

- Continue on ignored errors when fetching wheel metadata
([#&#8203;12255](https://redirect.github.com/astral-sh/uv/pull/12255))
- Use caching for `--python-downloads-json-url`
([#&#8203;16749](https://redirect.github.com/astral-sh/uv/pull/16749))

##### Preview features

- Discover extensionless shebang scripts in `uv workspace list
--scripts`
([#&#8203;20099](https://redirect.github.com/astral-sh/uv/pull/20099))

##### Performance

- Avoid full site-packages scans for direct reinstalls
([#&#8203;20119](https://redirect.github.com/astral-sh/uv/pull/20119))
- Avoid redundant pyproject parsing
([#&#8203;20076](https://redirect.github.com/astral-sh/uv/pull/20076))
- Cache default dependency markers when reading locks
([#&#8203;20125](https://redirect.github.com/astral-sh/uv/pull/20125))
- Enable SIMD-accelerated TOML parsing
([#&#8203;20079](https://redirect.github.com/astral-sh/uv/pull/20079))
- Intern `requires-python` specifiers in Simple API parsing
([#&#8203;20104](https://redirect.github.com/astral-sh/uv/pull/20104))
- Read cache entries into exact-sized buffers
([#&#8203;20120](https://redirect.github.com/astral-sh/uv/pull/20120))
- Reduce VersionSpecifiers parsing allocations
([#&#8203;20105](https://redirect.github.com/astral-sh/uv/pull/20105))
- Reduce site-packages scan allocation overhead
([#&#8203;20087](https://redirect.github.com/astral-sh/uv/pull/20087))
- Reuse package names when parsing wheel filenames
([#&#8203;20110](https://redirect.github.com/astral-sh/uv/pull/20110))
- Sort Simple API files after grouping
([#&#8203;20112](https://redirect.github.com/astral-sh/uv/pull/20112))

##### Bug fixes

- Always emit `packages` table for pylock.toml
([#&#8203;20145](https://redirect.github.com/astral-sh/uv/pull/20145))
- Avoid blank line for empty `uv pip tree`
([#&#8203;20062](https://redirect.github.com/astral-sh/uv/pull/20062))
- Encode hashes in file paths
([#&#8203;19807](https://redirect.github.com/astral-sh/uv/pull/19807))
- Error on a registry uv.lock package without a version instead of
panicking
([#&#8203;19855](https://redirect.github.com/astral-sh/uv/pull/19855))
- Preserve conditional extra markers in exports
([#&#8203;20148](https://redirect.github.com/astral-sh/uv/pull/20148))
- Skip the ambiguous authority check for file transport VCS URLs
([#&#8203;20086](https://redirect.github.com/astral-sh/uv/pull/20086))
- Sync index format when `uv add --index` updates an existing index URL
([#&#8203;19818](https://redirect.github.com/astral-sh/uv/pull/19818))

##### Other changes

- Re-add `pub` APIs used in Pixi
([#&#8203;20074](https://redirect.github.com/astral-sh/uv/pull/20074))
- Update Rust toolchain to 1.96.1
([#&#8203;20103](https://redirect.github.com/astral-sh/uv/pull/20103))

</details>

<details>
<summary>sigstore/sigstore-go
(github.com/sigstore/sigstore-go)</summary>

###
[`v1.2.2`](https://redirect.github.com/sigstore/sigstore-go/releases/tag/v1.2.2)

[Compare
Source](https://redirect.github.com/sigstore/sigstore-go/compare/v1.2.1...v1.2.2)

##### What's Changed

- Reject certificate identity with no SAN or issuer criteria in
[#&#8203;645](https://redirect.github.com/sigstore/sigstore-go/pull/645)
- Support Verification in sigstore/cosign with X.509 Certificate Chain
in
[#&#8203;581](https://redirect.github.com/sigstore/sigstore-go/pull/581)

**Full Changelog**:
<sigstore/sigstore-go@v1.2.1...v1.2.2>

</details>

<details>
<summary>github/codeql-action (github/codeql-action)</summary>

###
[`v4.37.0`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.0)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v4.36.3...v4.37.0)

- Update default CodeQL bundle version to
[2.26.0](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0).
[#&#8203;3995](https://redirect.github.com/github/codeql-action/pull/3995)
- In addition to the existing input format, the `config-file` input for
the `codeql-action/init` step will soon support a new
`[owner/]repo[@&#8203;ref][:path]` format. All components except the
repository name are optional. If omitted, `owner` defaults to the same
owner as the repository the analysis is running for, `ref` to `main`,
and `path` to `.github/codeql-action.yaml`. Support for this format
ships in this version of the CodeQL Action, but will only be enabled
over the coming weeks.
[#&#8203;3973](https://redirect.github.com/github/codeql-action/pull/3973)

</details>

<details>
<summary>goreleaser/goreleaser (goreleaser/goreleaser)</summary>

###
[`v2.17.0`](https://redirect.github.com/goreleaser/goreleaser/releases/tag/v2.17.0)

[Compare
Source](https://redirect.github.com/goreleaser/goreleaser/compare/v2.16.0...v2.17.0)

#### Announcement

Read the official announcement: [Announcing GoReleaser
v2.17](https://goreleaser.com/blog/goreleaser-v2.17/).

#### Changelog

##### New Features

-
[`31d4279`](https://redirect.github.com/goreleaser/goreleaser/commit/31d427926bf91dede0f208d4b034c4b35dfb5507):
feat(brew,cask,krew,nix,scoop,winget): default pull request branch name
([#&#8203;6685](https://redirect.github.com/goreleaser/goreleaser/issues/6685))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`e5f075b`](https://redirect.github.com/goreleaser/goreleaser/commit/e5f075b7a372541a1db505f3dc4015d1495714c5):
feat(dockers/v2): retry build
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`cd5f16b`](https://redirect.github.com/goreleaser/goreleaser/commit/cd5f16b42e09c8b8994e7722e034fb79770d9273):
feat(nfpm): support msix packages
([#&#8203;6647](https://redirect.github.com/goreleaser/goreleaser/issues/6647))
([@&#8203;umaidshahid](https://redirect.github.com/umaidshahid) and
[@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`43be34a`](https://redirect.github.com/goreleaser/goreleaser/commit/43be34a1cd33dc36fad9a2626251f29fa81eed61):
feat(scm): allow a custom token on the release repository
([#&#8203;6689](https://redirect.github.com/goreleaser/goreleaser/issues/6689))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`5ed70f2`](https://redirect.github.com/goreleaser/goreleaser/commit/5ed70f2d19c85eb9589f0316073ef42930a78c3b):
feat(winget): allow configuring the manifest locale
([#&#8203;6680](https://redirect.github.com/goreleaser/goreleaser/issues/6680))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`6f7175a`](https://redirect.github.com/goreleaser/goreleaser/commit/6f7175a0ec98ecae6b00548922648da27c330716):
feat: Allow GOARM softfloat and hardfloat
([#&#8203;6198](https://redirect.github.com/goreleaser/goreleaser/issues/6198))
([@&#8203;MDr164](https://redirect.github.com/MDr164) and
[@&#8203;caarlos0](https://redirect.github.com/caarlos0))

##### Security updates

-
[`b985ca8`](https://redirect.github.com/goreleaser/goreleaser/commit/b985ca8dc6b231440d98ff5e018c7c40678f0baa):
sec(deps): bump go-pkcs12 to v0.7.2 (GO-2026-5052)
([#&#8203;6683](https://redirect.github.com/goreleaser/goreleaser/issues/6683))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`7c73b82`](https://redirect.github.com/goreleaser/goreleaser/commit/7c73b82e0822ebaded3b193e045ffb173befa58a):
sec(deps): update golang.org/x/net
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))

##### Bug fixes

-
[`7d602ff`](https://redirect.github.com/goreleaser/goreleaser/commit/7d602ff39b52b7edbdf3340dd548f1238ccd656b):
fix(builders): reject empty target string
([#&#8203;6679](https://redirect.github.com/goreleaser/goreleaser/issues/6679))
([@&#8203;sueun-dev](https://redirect.github.com/sueun-dev))
-
[`355d706`](https://redirect.github.com/goreleaser/goreleaser/commit/355d706ba6ee76a8dcabbc55902840376548d774):
fix(client): skip merge-upstream when target repo is not a fork
([#&#8203;6646](https://redirect.github.com/goreleaser/goreleaser/issues/6646))
([@&#8203;jamessawle](https://redirect.github.com/jamessawle) and
[@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`944bbb2`](https://redirect.github.com/goreleaser/goreleaser/commit/944bbb2de2c80e04e03f3509a781c82a2bb312d1):
fix(deps): drop dep on docker/docker
([#&#8203;6682](https://redirect.github.com/goreleaser/goreleaser/issues/6682))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`a85ce26`](https://redirect.github.com/goreleaser/goreleaser/commit/a85ce26032280f8cb4ba2f32cd5223176ecd86fb):
fix(mcp): clean subfolder path
([#&#8203;6649](https://redirect.github.com/goreleaser/goreleaser/issues/6649))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`99a7173`](https://redirect.github.com/goreleaser/goreleaser/commit/99a71731d269c1f036b0caea92032ac0a1fdce8a):
fix(nfpm): produce valid arch for Termux packages
([#&#8203;6668](https://redirect.github.com/goreleaser/goreleaser/issues/6668))
([@&#8203;bltavares](https://redirect.github.com/bltavares) and
[@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`7200ec7`](https://redirect.github.com/goreleaser/goreleaser/commit/7200ec73ecf09b4266d4e7ae21464e51dade7ec0):
fix(winget): default head branch to a versioned template
([#&#8203;6684](https://redirect.github.com/goreleaser/goreleaser/issues/6684))
([@&#8203;Sanjays2402](https://redirect.github.com/Sanjays2402))
-
[`6645820`](https://redirect.github.com/goreleaser/goreleaser/commit/6645820ffb384318c8486802cd7770f4f1646b4b):
fix: return error when go.mod is unreadable in CheckGoModPipe
([#&#8203;6644](https://redirect.github.com/goreleaser/goreleaser/issues/6644))
([@&#8203;SebTardif](https://redirect.github.com/SebTardif))

##### Documentation updates

-
[`da7ce30`](https://redirect.github.com/goreleaser/goreleaser/commit/da7ce304ee4e0dd4b7b7f42231727becd4d99278):
docs(casks): fix private-repo example broken by Homebrew 5.1.14
([#&#8203;6639](https://redirect.github.com/goreleaser/goreleaser/issues/6639))
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`09ebd03`](https://redirect.github.com/goreleaser/goreleaser/commit/09ebd035a7737f67816369cbdd6aff93656d93a7):
docs(nfpm): note tilde ConventionalFileName
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`ab7481e`](https://redirect.github.com/goreleaser/goreleaser/commit/ab7481ed082cbad81805823b9ffd911776e8bbc7):
docs: doc authoring skill
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`b945ca3`](https://redirect.github.com/goreleaser/goreleaser/commit/b945ca35c5515cfbb99f3162a738897334ac0c7c):
docs: fix ([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`7e87fd3`](https://redirect.github.com/goreleaser/goreleaser/commit/7e87fd39b283119906598461860dcec6e51f99f4):
docs: fix "lets" -> "let's" in quick-start guide
([#&#8203;6661](https://redirect.github.com/goreleaser/goreleaser/issues/6661))
([@&#8203;s3onghyun](https://redirect.github.com/s3onghyun))
-
[`698dae5`](https://redirect.github.com/goreleaser/goreleaser/commit/698dae55da5585136be0417502f2467edb213719):
docs: fix typo in notarize.md
([#&#8203;6655](https://redirect.github.com/goreleaser/goreleaser/issues/6655))
([@&#8203;albertchae](https://redirect.github.com/albertchae))
-
[`f09c887`](https://redirect.github.com/goreleaser/goreleaser/commit/f09c88738c004e4a1df8858064f368e1f1878b98):
docs: good bye discord
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`2642319`](https://redirect.github.com/goreleaser/goreleaser/commit/2642319f753cde16df470c9da5c5f6124a50a681):
docs: improve home
([@&#8203;caarlos0](https://redirect.github.com/caarlos0))
-
[`6b7710e`](https://redirect.github.com/goreleaser/goreleaser/commit/6b7710eb4a6b4fc181c21994e694130bc57a1a9b):
docs: updates ([@&#8203;caarlos0](https://redirect.github.com/caarlos0))

##### Other work

-
[`2e6f200`](https://redirect.github.com/goreleaser/goreleaser/commit/2e6f200efaaf702d1008f37bc75fc28cdf3cdd0d):
chore: auto-update generated files
([#&#8203;6662](https://redirect.github.com/goreleaser/goreleaser/issues/6662))
([@&#8203;goreleaserbot](https://redirect.github.com/goreleaserbot))
-
[`4bd4e38`](https://redirect.github.com/goreleaser/goreleaser/commit/4bd4e386d2d260e5efb9cb962a727a3f28c718c7):
chore: auto-update generated files
([#&#8203;6671](https://redirect.github.com/goreleaser/goreleaser/issues/6671))
([@&#8203;goreleaserbot](https://redirect.github.com/goreleaserbot))
-
[`dcf5a6b`](https://redirect.github.com/goreleaser/goreleaser/commit/dcf5a6b3b48314ea07b14098bf55372b2d1fa984):
chore: auto-update generated files
([#&#8203;6675](https://redirect.github.com/goreleaser/goreleaser/issues/6675))
([@&#8203;goreleaserbot](https://redirect.github.com/goreleaserbot))
-
[`baf110d`](https://redirect.github.com/goreleaser/goreleaser/commit/baf110d41e81f273070e2a092ae1bbac1c22bc6a):
chore: auto-update generated files
([#&#8203;6688](https://redirect.github.com/goreleaser/goreleaser/issues/6688))
([@&#8203;goreleaserbot](https://redirect.github.com/goreleaserbot))
-
[`3fa8a94`](https://redirect.github.com/goreleaser/goreleaser/commit/3fa8a94c5b57e0ae3bc7ea0b7f0a89d63afa666a):
chore: godoc ([@&#8203;caarlos0](https://redirect.github.com/caarlos0))

**Full Changelog**:
<goreleaser/goreleaser@v2.16.0...v2.17.0>

#### Helping out

This release is only possible thanks to **all** the support of some
**awesome people**!

Want to be one of them?
You can [sponsor](https://goreleaser.com/sponsors/), get a [Pro
License](https://goreleaser.com/pro) or [contribute with
code](https://goreleaser.com/contributing).

#### Where to go next?

- Find examples and commented usage of all options in our
[website](https://goreleaser.com/intro/).
- Reach out on [Discord](https://discord.gg/RGEBtg8vQ6),
[Twitter](https://twitter.com/goreleaser), and
[Telegram](https://t.me/goreleasernews)!

<a href="https://goreleaser.com"><img
src="https://raw.githubusercontent.com/goreleaser/artwork/master/opencollective-header.png"
with="100%" alt="GoReleaser logo"></a>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Etc/UTC)

- Branch creation
  - Between 12:00 AM and 06:59 AM, only on Saturday (`* 0-6 * * 6`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Aureliolo/synthorg).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDIuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI0Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJ0eXBlOmluZnJhIl19-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Glatzel pushed a commit to Glatzel/pyxis that referenced this pull request Jul 11, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) |
action | patch | `v4.18.1` → `v4.18.5` |

---

### Release Notes

<details>
<summary>CodSpeedHQ/action (CodSpeedHQ/action)</summary>

###
[`v4.18.5`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v4.18.5)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v4.18.4...v4.18.5)

#### Release Notes

##### <!-- 10 -->💼 Other

- Bump pinned valgrind-codspeed to
[3.26.0-0codspeed6](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/releases/tag/3.26.0-0codspeed6)
([#&#8203;448](https://redirect.github.com/CodSpeedHQ/action/issues/448))
by [@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&#8203;448](https://redirect.github.com/CodSpeedHQ/runner/pull/448)
- fix: hangs on ARM64 due to atomics by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[CodSpeedHQ/valgrind-codspeed#23](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/23)
- fix(aspacem): raise amd64 managed address ceiling to 1 TiB by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[CodSpeedHQ/valgrind-codspeed#22](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/22)

#### Install codspeed-runner 4.18.4

##### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-installer.sh | sh
```

#### Download codspeed-runner 4.18.4

| File | Platform | Checksum |
|
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------
| ------------------- |
-------------------------------------------------------------------------------------------------------------------------------------
|
|
[codspeed-runner-aarch64-apple-darwin.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-aarch64-apple-darwin.tar.gz.sha256)
|
|
[codspeed-runner-aarch64-unknown-linux-musl.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-aarch64-unknown-linux-musl.tar.gz)
| ARM64 MUSL Linux |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-aarch64-unknown-linux-musl.tar.gz.sha256)
|
|
[codspeed-runner-x86\_64-unknown-linux-musl.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-x86_64-unknown-linux-musl.tar.gz)
| x64 MUSL Linux |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-x86_64-unknown-linux-musl.tar.gz.sha256)
|

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

**Full Changelog**:
<CodSpeedHQ/action@v4.18.4...v4.18.5>

###
[`v4.18.4`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v4.18.4)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v4.18.2...v4.18.4)

#### What's Changed

- fix 4.18.3 runner hash –
[`bf19f56`](https://redirect.github.com/CodSpeedHQ/action/commit/bf19f56fe8857e83e4343138c1a927e56f666e3b)
by [@&#8203;adriencaccia](https://redirect.github.com/adriencaccia)

**Full Changelog**:
<CodSpeedHQ/action@v4.18.3...v4.18.4>

###
[`v4.18.2`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v4.18.2)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v4.18.1...v4.18.2)

#### Release Notes

##### <!-- 1 -->🐛 Bug Fixes

- Source forwarded env below memtrack's capability boundary by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;439](https://redirect.github.com/CodSpeedHQ/runner/pull/439)

##### <!-- 7 -->⚙️ Internals

- chore: bump runner version to 4.18.2 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;219](https://redirect.github.com/CodSpeedHQ/action/pull/219)

#### Install codspeed-runner 4.18.2

##### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-installer.sh | sh
```

#### Download codspeed-runner 4.18.2

| File | Platform | Checksum |
|
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------
| ------------------- |
-------------------------------------------------------------------------------------------------------------------------------------
|
|
[codspeed-runner-aarch64-apple-darwin.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-aarch64-apple-darwin.tar.gz.sha256)
|
|
[codspeed-runner-aarch64-unknown-linux-musl.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-aarch64-unknown-linux-musl.tar.gz)
| ARM64 MUSL Linux |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-aarch64-unknown-linux-musl.tar.gz.sha256)
|
|
[codspeed-runner-x86\_64-unknown-linux-musl.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-x86_64-unknown-linux-musl.tar.gz)
| x64 MUSL Linux |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-x86_64-unknown-linux-musl.tar.gz.sha256)
|

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

**Full Changelog**:
<CodSpeedHQ/action@v4.18.1...v4.18.2>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - On day 1 of the month (`* * 1 * *`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Glatzel/pyxis).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDIuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI0Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants