[dependabot]

Bumps the github-actions group with 2 updates: chromaui/action and CodSpeedHQ/action.

Updates chromaui/action from 18.13.0 to 18.13.3

Changelog

Sourced from chromaui/action's changelog.

v18.13.3 (Thu Oct 22 2026)

Release Notes

Lower default TurboSnap lockfile parse concurrency to 1 (#1564)

TurboSnap now parses one lockfile at a time by default (previously 200), which greatly reduces peak memory in repositories with many package manifests. Wall time is unchanged, since parsing is synchronous. Set CHROMATIC_TURBOSNAP_PACKAGE_CONCURRENCY to override the default.

---

🐛 Bug Fix

• Lower default TurboSnap lockfile parse concurrency to 1 #1564 (@​codykaup)
• [TurboSnap v2] Skip generated directories under node_modules #1557 (@​codykaup)
• Replace raceFulfilled with Promise.any and fix findChangedPackageFiles short-circuit #1556 (@​codykaup)
• Show upload task as skipped when TurboSnap bypasses the build #1559 (@​codykaup)

Authors: 1

• Cody Kaup (@​codykaup)

---

v18.13.2 (Wed Oct 21 2026)

🐛 Bug Fix

• [git] Speed up baseline commit filtering #1561 (@​sharmila-oai)
• Fold webpack loader-chain stats ids onto their resource #1550 (@​codykaup)

Authors: 2

• Cody Kaup (@​codykaup)
• Sharmila (@​sharmila-oai)

---

v18.13.1 (Wed Oct 21 2026)

🐛 Bug Fix

• Confirm COMPONENTOWNERS upload outside the interactive UI #1551 (@​justin-thurman)
• [TurboSnap v2] Tighten context-marker matching #1554 (@​ObviousApp @​codykaup @​obvious-autobuild[bot])
• Authenticate action publish pushes with a credential helper #1552 (@​justin-thurman)
• Remove no-secrets lint rule #1555 (@​codykaup)
• [TurboSnap v2]: fold NUL-prefixed and query-suffixed stats ids into the file they stand for #1529 (@​ObviousApp @​codykaup @​obvious-autobuild[bot])
• Keep credentials out of the diagnostics and log files #1536 (@​ObviousApp @​codykaup @​obvious-autobuild[bot])
• Merge TurboSnap V1 modules that normalize to one name #1530 (@​ObviousApp @​codykaup @​obvious-autobuild[bot])
• Skip tests on PRs that only change docs and agent files #1540 (@​codykaup)
• Skip release when there is nothing to release #1545 (@​codykaup)

... (truncated)

Commits

• 5bcadb5 v18.13.3
• 882b472 v18.13.2
• e24559f v18.13.1
• See full diff in compare view

Updates CodSpeedHQ/action from 5.5.0 to 5.6.0

Release notes

Sourced from CodSpeedHQ/action's releases.

v5.6.0

Bumps the CodSpeed runner to v5.6.0.

Highlights

More consistent CPU Simulation results

Changes to your CI environment, like a different path or an extra environment variable, no longer change the performance. Each benchmark now starts with the same memory layout, reducing the chance of false regressions.

🐛 Bug Fixes

• Keep the user's HOME when wrapping commands with sudo by @​lvaroqui in #588

⚙️ Internals

• Bump pinned valgrind-codspeed to 3.26.0-0codspeed10 by @​adriencaccia in #593
  • fix(callgrind): suppress L3 warning for explicit LL settings by @​not-matthias in CodSpeedHQ/valgrind-codspeed#52
  • fix(initimg): stabilize Linux startup stack layout by @​not-matthias in CodSpeedHQ/valgrind-codspeed#53

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

• chore: bump runner version to 5.6.0 by @​github-actions[bot] in CodSpeedHQ/action#253

Full Changelog: CodSpeedHQ/action@v5.5.0...v5.6.0

Commits

• 78102a4 Release v5.6.0 🚀
• 3bb0242 chore: bump runner version to 5.6.0 (#253)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Summary by cubic

Bumps chromaui/action from 18.13.0 to 18.13.3 and CodSpeedHQ/action from 5.5.0 to 5.6.0 in the CI workflows.

• chromaui/action lowers TurboSnap lockfile parse concurrency to reduce peak memory and includes several bug fixes.
• CodSpeedHQ/action makes CPU simulation results more consistent by stabilizing the memory layout across CI environments.

^{Written for commit 8e3008e. Summary will update on new commits.}

[codspeed]

Merging this PR will not alter performance

1 warning

⚠️ 6 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 26 untouched benchmarks

---

_{Comparing dependabot/github_actions/github-actions-27a8d20631 (8e3008e) with main (2e2db25)}