chore(deps): update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/setup-node (changelog)	action	digest	48b55a0 → 2499707
dtolnay/rust-toolchain (changelog)	action	digest	4be7066 → 4cda84d
github/codeql-action	action	minor	v4.36.3 → v4.37.1
rust (source, changelog)	uses-with	minor	1.96.1 → 1.97.1
taiki-e/install-action	action	minor	v2.82.7 → v2.83.3	v2.83.4
taiki-e/setup-cross-toolchain-action (changelog)	action	digest	3d9770c → 12b7ad4
zizmorcore/zizmor-action	action	minor	v0.5.7 → v0.6.0

---

Release Notes

github/codeql-action (github/codeql-action)

v4.37.1

Compare Source

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #​3956
• Update default CodeQL bundle version to 2.26.1. #​4019

v4.37.0

Compare Source

• Update default CodeQL bundle version to 2.26.0. #​3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@​ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #​3973

rust-lang/rust (rust)

v1.97.1

Compare Source

==========================

• rustc: Fix miscompilation in LLVM optimization
  This backports an LLVM submodule bump to include the LLVM-side fix and a
  revert of the rustc change that is one known trigger for the bug. The rustc
  side revert should not be strictly necessary but is done out of abundance of caution.

v1.97.0

Compare Source

==========================

Language

• Consider Result<T, Uninhabited> and ControlFlow<Uninhabited, T> to be equivalent to T for must use lint
• Add allow-by-default dead_code_pub_in_binary lint for unused pub items in binary crates
• Stabilize the div32, lam-bh, lamcas, ld-seq-sa and scq target features
• Stabilize cfg(target_has_atomic_primitive_alignment)
• Allow trailing self in imports in more cases

Platform Support

• nvptx64-nvidia-cuda: drop support for old architectures and old ISAs

Refer to Rust's platform support page
for more information on Rust's tiered platform support.

Stabilized APIs

• Default for RepeatN
• Copy for ffi::FromBytesUntilNulError
• Send for std::fs::File on UEFI
• <{integer}>::isolate_highest_one
• <{integer}>::isolate_lowest_one
• <{integer}>::highest_one
• <{integer}>::lowest_one
• <{integer}>::bit_width
• NonZero<{integer}>::isolate_highest_one
• NonZero<{integer}>::isolate_lowest_one
• NonZero<{integer}>::highest_one
• NonZero<{integer}>::lowest_one
• NonZero<{integer}>::bit_width

These previously stable APIs are now stable in const contexts:

• char::is_control

Cargo

• Stabilize build.warnings config. This controls how lint warnings from local packages are treated. Useful for enforcing a warning-free build in CI, replacing -Dwarnings. docs
• Stabilize resolver.lockfile-path config. This allows specifying the path to the lockfile to use when resolving dependencies. Useful when working with read-only source directories. docs
• cargo-clean: Error when --target-dir doesn't look like a Cargo target directory. This prevents accidental deletion of non-target directories.
• Add -m shorthand for --manifest-path
• Remove curl dependency from crates-io crate

Rustdoc

• Stabilize --emit flag
• Stabilize --remap-path-prefix

Compatibility Notes

• Emit a future-compatibility warning when relying on f32: From<{float}> to constrain {float}
• Rust will use the v0 symbol mangling scheme by default. This may cause some tools (such as debuggers or profilers, especially with old versions) to fail to demangle symbols emitted by Rust. It may also cause the formatting of text in backtraces to change.
• Prevent deref coercions in pin!, in order to prevent unsoundness. The most likely case where this might impact users is: writing pin!(x) where x has type &mut T will now always correctly produce a value of type Pin<&mut &mut T>, instead of sometimes allowing a coercion that produces a value of type Pin<&mut T>. This coercion was previously incorrectly allowed since Rust 1.88.0.
• Deprecate std::char constants and functions
• Warn on linker output by default
• Remove hidden f64 methods which have been deprecated since 1.0
• report the varargs_without_pattern lint in deps
• Forbid passing generic arguments to module path segments even if the module reexports a generic enum variant
• Error on invalid macho link_section specifier
• The encoding of certain enums have changed. This is not a breaking change, as it only applies to enums without layout guarantees, but is noted here as we've seen people impacted from having made assumptions about the layout algorithm.
• Error on #[export_name = "..."] where the name is empty
• Syntactically reject tuple index shorthands in struct patterns
• validate #[link_name = "..."] & #[link(name = "...")] parameters
• On Windows, after calling shutdown on a socket to shut down the write side, attempting to write to the socket will now produce a BrokenPipe error rather than Other. Map WSAESHUTDOWN to io::ErrorKind::BrokenPipe

taiki-e/install-action (taiki-e/install-action)

v2.83.3: 2.83.3

Compare Source

• Update release-plz@latest to 0.3.160.

• Update prek@latest to 0.4.9.

• Update mise@latest to 2026.7.6.

• Update dprint@latest to 0.55.2.

• Update cargo-dinghy@latest to 0.8.5.

• Update cargo-binstall@latest to 1.21.0.

• Update biome@latest to 2.5.4.

v2.83.2: 2.83.2

Compare Source

• Update parse-dockerfile@latest to 0.1.8.

• Update mise@latest to 2026.7.5.

• Update just@latest to 1.56.0.

• Update gungraun-runner@latest to 0.19.4.

• Update cargo-neat@latest to 0.4.1.

v2.83.1: 2.83.1

Compare Source

• Update rclone@latest to 1.74.4.

• Update mise@latest to 2026.7.4.

• Update cargo-deny@latest to 0.20.2.

v2.83.0: 2.83.0

Compare Source

• Support cargo-about. (#​1924, thanks @​ruffsl)

• Update uv@latest to 0.11.28.

• Update martin@latest to 1.12.0.

• Update kingfisher@latest to 1.106.0.

• Update biome@latest to 2.5.3.

v2.82.11: 2.82.11

Compare Source

• Update wasm-tools@latest to 1.253.0.

• Update uv@latest to 0.11.27.

• Update mise@latest to 2026.7.2.

• Update mdbook@latest to 0.5.4.

v2.82.10: 2.82.10

Compare Source

• Update tombi@latest to 1.2.0.

• Update cargo-nextest@latest to 0.9.140.

v2.82.9: 2.82.9

Compare Source

• Update vacuum@latest to 0.29.9.

• Update prek@latest to 0.4.8.

• Update cargo-tarpaulin@latest to 0.37.0.

• Update cargo-leptos@latest to 0.3.7.

v2.82.8: 2.82.8

Compare Source

• Update vacuum@latest to 0.29.8.

• Update uv@latest to 0.11.26.

• Update typos@latest to 1.48.0.

• Update trivy@latest to 0.72.0.

• Update tombi@latest to 1.1.7.

• Update prek@latest to 0.4.6.

• Update mise@latest to 2026.7.0.

• Update just@latest to 1.55.1.

• Update biome@latest to 2.5.2.

zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.6.0

Compare Source

zizmor 1.27.0 is now the default version used by the action.

What's Changed

• Fold Docker image pull output into a collapsed Actions log group by @​woodruffw with @​Copilot in #​132
• Readme: document missing inputs by @​staabm in #​130
• ci: block version sync workflow on forks by @​shaanmajid in #​129
• Sync zizmor versions by @​github-actions[bot] in #​137
• Add collect input by @​woodruffw in #​139

New Contributors

• @​woodruffw with @​Copilot made their first contribution in #​132
• @​staabm made their first contribution in #​130
• @​shaanmajid made their first contribution in #​129

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[aptu-dev]

Aptu Review

✅ Approve — This PR performs routine dependency updates for GitHub Actions and the Rust toolchain, bumping the Rust version from 1.96.1 to 1.97.1 and updating several action digests and versions. These changes ensure the CI environment remains current with security patches and feature improvements.

---

_{Posted by aptu}