[dependabot]

Bumps the github-actions group with 3 updates: SonarSource/sonarqube-scan-action, chromaui/action and CodSpeedHQ/action.

Updates SonarSource/sonarqube-scan-action from 8.4.0 to 8.4.1

Release notes

Sourced from SonarSource/sonarqube-scan-action's releases.

v8.4.1

What's Changed

• Update dependency node to v26 by @​renovate[bot] in SonarSource/sonarqube-scan-action#294
• SQSCANGHA-184 Bump undici from 6.28.1 to 6.29.1 by @​dependabot[bot] in SonarSource/sonarqube-scan-action#289
• SQSCANGHA-191 Bump scanner-cli version to 8.3.1.16491 by @​jerome-chetelat-sonarsource in SonarSource/sonarqube-scan-action#298

New Contributors

• @​jerome-chetelat-sonarsource made their first contribution in SonarSource/sonarqube-scan-action#298

Full Changelog: SonarSource/sonarqube-scan-action@v8.4.0...v8.4.1

Commits

• e805d87 SQSCANGHA-191 Bump scanner-cli version to 8.3.1.16491 (#298)
• 5e62cf2 SQSCANGHA-189 docs: remove duplicate README logo (#295)
• afe7ea1 SQSCANGHA-184 Bump undici from 6.28.1 to 6.29.1 (#289)
• d86a3b3 Update dependency node to v26 (#294)
• 8a538b9 Run build and build-wrapper compatibility checks every weekday (#292)
• See full diff in compare view

Updates chromaui/action from 18.13.6 to 18.14.2

Changelog

Sourced from chromaui/action's changelog.

v18.14.3 (Mon Nov 09 2026)

🐛 Bug Fix

• Hash TurboSnap v2 story subtrees from a shared index #1641 (@​codykaup)
• Limit untracked-file discovery to TurboSnap manifest inputs #1644 (@​tayloroai @​codykaup)
• Bump adm-zip from 0.5.17 to 0.6.1 #1649 (@​dependabot[bot] @​codykaup)
• Bump the npm_and_yarn group across 2 directories with 1 update #1655 (@​dependabot[bot])
• Bump @​sentry/cli from 2.58.5 to 3.8.2 #1653 (@​dependabot[bot])
• Bump fake-tag from 2.0.0 to 5.0.0 #1652 (@​dependabot[bot])
• Bump eslint-plugin-security from 3.0.1 to 4.2.1 #1650 (@​dependabot[bot])

Authors: 3

• @​dependabot[bot]
• @​tayloroai
• Cody Kaup (@​codykaup)

---

v18.14.2 (Fri Nov 06 2026)

🐛 Bug Fix

• Let users skip TurboSnap 1.0 when the Index applies 2.0 #1645 (@​codykaup)
• Align smoke-tests Storybook packages with storybook 10.6.5 #1643 (@​ObviousApp @​obvious-autobuild[bot])

Authors: 3

• @​obvious-autobuild[bot]
• Cody Kaup (@​codykaup)
• Obvious (@​ObviousApp)

---

v18.14.1 (Wed Nov 04 2026)

Release Notes

Add knip dead code audit and restore dotenv 16 (#1630)

The CLI reads .env files with dotenv 16 again, as it did before 18.10.0. Releases 18.10.0 through 18.13.9 accidentally bundled dotenv 8, which kept inline comments in values: KEY=value # comment became value # comment. With dotenv 16, an unquoted # starts a comment. If you added a value with a literal # while on those releases, quote it, for example CHROMATIC_BRANCH="fix#123".

---

🐛 Bug Fix

• Narrow the Git index scan for scoped TurboSnap externals #1609 (@​tayloroai)
• Document how TurboSnap 2.0 manifest hashes decide recaptures #1632 (@​codykaup)
• Fail CI when an e2e fixture mixes Storybook versions #1640 (@​codykaup)

... (truncated)

Commits

• 6ac4c49 v18.14.2
• 1efa9d9 v18.14.1
• add73a4 v18.14.0
• 8037994 v18.13.9
• eb9c008 v18.13.8
• 31bcbaf v18.13.7
• See full diff in compare view

Updates CodSpeedHQ/action from 5.6.1 to 5.6.3

Release notes

Sourced from CodSpeedHQ/action's releases.

v5.6.3

Bumps the CodSpeed runner to v5.6.3, including v5.6.2.

Highlights

Go benchmark times match go test

b.Loop() benchmarks that stop and restart the timer inside an iteration now report all of their timed work. A round previously counted only the time since the most recent StartTimer, so results for those benchmarks will move.

Unsupported go test flags no longer fail the run

go test -p 1 ./... -bench . used to strip -p, parse 1 as a package, and fail with package 1 is not in std after every benchmark had passed. Flags and their values are now dropped together.

Fixed randomness in CPU Simulation

getrandom(), /dev/urandom, AT_RANDOM and hardware RNG instructions now return the same values on every CPU Simulation run, removing one source of run-to-run variance.

Fixes

• Simulation: fix SIGILL on arm64 when programs read previously unsupported CPU ID registers or TPIDRRO_EL0 (#59).
• Go: benchmarks that draw from the global math/rand now start from the same seed on every run, so their results no longer vary between runs (#596).

🚀 Features

• Seed Go's global math/rand deterministically (#596) by @​not-matthias in #596
• Always enable deterministic RNG (#600) by @​not-matthias in #600

🐛 Bug Fixes

• Bump go-runner to 1.4.0 (#605) by @​adriencaccia in #605
  • fix(cli): drop the value of unsupported go test flags by @​not-matthias in CodSpeedHQ/codspeed-go#67
  • fix(go-runner): count all timed segments of a b.Loop() iteration by @​not-matthias in CodSpeedHQ/codspeed-go#69

⚙️ Internals

• Bump pinned valgrind-codspeed to 3.26.0-0codspeed12 (#604) by @​adriencaccia in #604
  • feat: add --deterministic-rng to make client randomness reproducible by @​not-matthias in CodSpeedHQ/valgrind-codspeed#54
  • feat(vex): serve arm64 RNDR and RNDRRS with --deterministic-rng by @​not-matthias in CodSpeedHQ/valgrind-codspeed#56
  • fix(vex): decode arm64 MRS of all EL0-visible ID registers by @​not-matthias in CodSpeedHQ/valgrind-codspeed#59

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

• chore: bump runner version to 5.6.2 by @​github-actions[bot] in CodSpeedHQ/action#255
• chore: bump runner version to 5.6.3 by @​github-actions[bot] in CodSpeedHQ/action#256

Full Changelog: CodSpeedHQ/action@v5.6.1...v5.6.3

Commits

• af75f77 Release v5.6.3 🚀
• 3a5fe1c chore: bump runner version to 5.6.3 (#256)
• ca7c971 chore: bump runner version to 5.6.2 (#255)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Summary by cubic

Updates the pinned versions of three GitHub Actions used in CI: SonarQube scan (8.4.0→8.4.1), Chromatic (18.13.6→18.14.2), and CodSpeed benchmarks (5.6.1→5.6.3).

• Chromatic 18.14.1 restored dotenv 16 parsing, so env values with a literal # must now be quoted.
• CodSpeed 5.6.3 makes RNG deterministic, so Go benchmark runs are reproducible, and fixes arm64 simulation crashes and go test flag handling.

^{Written for commit 97ae1b6. Summary will update on new commits.}

[codspeed]

Merging this PR will not alter performance

1 warning

⚠️ 1 benchmark is dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 26 untouched benchmarks

---

_{Comparing dependabot/github_actions/github-actions-1e7020a589 (97ae1b6) with main (8b9024a)}