From 37bdbde05074be171a3a42efabf2928379d28585 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 13:34:41 +0000 Subject: [PATCH 01/24] Update changelog and version after v4.37.6 --- CHANGELOG.md | 4 ++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bbe7e65e68..bd770ab5f4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. +## [UNRELEASED] + +No user facing changes. + ## 4.37.6 - 04 Aug 2026 - Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://github.com/github/codeql-action/pull/4070) diff --git a/package-lock.json b/package-lock.json index 212400948a..5f3010a6bd 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codeql", - "version": "4.37.6", + "version": "4.37.7", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codeql", - "version": "4.37.6", + "version": "4.37.7", "license": "MIT", "workspaces": [ "pr-checks" diff --git a/package.json b/package.json index caf12f15c0..23fe11a875 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "4.37.6", + "version": "4.37.7", "private": true, "description": "CodeQL action", "scripts": { From 7d82f1132f0de33d07be119009641a28d5110906 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 13:34:54 +0000 Subject: [PATCH 02/24] Rebuild --- lib/entry-points.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index cdd0db217d..836def6b82 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145426,7 +145426,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) { return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME); } function getActionVersion() { - return "4.37.6"; + return "4.37.7"; } function getWorkflowEventName(env = getEnv()) { return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */); From 76c44396d33f17460892166dd0d4ef323ad0c6cc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 14:18:04 +0000 Subject: [PATCH 03/24] Bump brace-expansion from 1.1.16 to 1.1.18 Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.16 to 1.1.18. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.16...v1.1.18) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- package-lock.json | 42 +++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/package-lock.json b/package-lock.json index 5f3010a6bd..58752c7216 100644 --- a/package-lock.json +++ b/package-lock.json @@ -374,9 +374,9 @@ "license": "Apache-2.0" }, "node_modules/@actions/artifact/node_modules/brace-expansion": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", - "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" @@ -2843,9 +2843,9 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "5.0.8", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", - "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { @@ -3864,9 +3864,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "1.1.16", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", - "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", @@ -5115,16 +5115,16 @@ } }, "node_modules/eslint-plugin-import-x/node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/eslint-plugin-import-x/node_modules/minimatch": { @@ -6111,15 +6111,15 @@ } }, "node_modules/glob/node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/glob/node_modules/minimatch": { @@ -8090,15 +8090,15 @@ } }, "node_modules/readdir-glob/node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/readdir-glob/node_modules/minimatch": { From c5995f544d0a503524a4acfe4c84806a470b5f6c Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 14:19:52 +0000 Subject: [PATCH 04/24] Rebuild --- lib/entry-points.js | 600 +++++++++++++++++++++++++++++--------------- 1 file changed, 402 insertions(+), 198 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 836def6b82..dd77444e02 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -31227,6 +31227,8 @@ var require_brace_expansion = __commonJS({ var escClose2 = "\0CLOSE" + Math.random() + "\0"; var escComma2 = "\0COMMA" + Math.random() + "\0"; var escPeriod2 = "\0PERIOD" + Math.random() + "\0"; + var EXPANSION_MAX2 = 1e5; + var EXPANSION_MAX_LENGTH2 = 4e6; function numeric2(str) { return parseInt(str, 10) == str ? parseInt(str, 10) : str.charCodeAt(0); } @@ -31260,11 +31262,12 @@ var require_brace_expansion = __commonJS({ if (!str) return []; options = options || {}; - var max = options.max == null ? Infinity : options.max; + var max = options.max == null ? EXPANSION_MAX2 : options.max; + var maxLength = options.maxLength == null ? EXPANSION_MAX_LENGTH2 : options.maxLength; if (str.substr(0, 2) === "{}") { str = "\\{\\}" + str.substr(2); } - return expand3(escapeBraces2(str), max, true).map(unescapeBraces2); + return expand3(escapeBraces2(str), max, maxLength, true).map(unescapeBraces2); } function embrace2(str) { return "{" + str + "}"; @@ -31278,11 +31281,82 @@ var require_brace_expansion = __commonJS({ function gte7(i, y) { return i >= y; } - function expand3(str, max, isTop) { - var expansions = []; + function combine2(acc, base, pre, values, max, maxLength, dropEmpties, outBase) { + var out = []; + var length = 0; + for (var a = 0; a < acc.length; a++) { + for (var v = 0; v < values.length; v++) { + if (out.length >= max) return out; + var expansion = acc[a] + pre + values[v]; + if (dropEmpties && expansion.length === base[a]) continue; + if (length + expansion.length > maxLength) return out; + out.push(expansion); + outBase.push(base[a]); + length += expansion.length; + } + } + return out; + } + function expandSequence2(body, isAlphaSequence, max, maxLength) { + var n = body.split(/\.\./); + var N = []; + if (n[0] === void 0 || n[1] === void 0) { + return N; + } + var x = numeric2(n[0]); + var y = numeric2(n[1]); + var width = Math.max(n[0].length, n[1].length); + var incr = n.length === 3 && n[2] !== void 0 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; + var test = lte2; + var reverse = y < x; + if (reverse) { + incr *= -1; + test = gte7; + } + var pad = n.some(isPadded2); + var length = 0; + for (var i = x; test(i, y) && N.length < max; i += incr) { + var c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === "\\") { + c = ""; + } + } else { + c = String(i); + if (pad) { + var need = width - c.length; + if (need > 0) { + var z = new Array(need + 1).join("0"); + if (i < 0) { + c = "-" + z + c.slice(1); + } else { + c = z + c; + } + } + } + } + if (length + c.length > maxLength) break; + N.push(c); + length += c.length; + } + return N; + } + function expand3(str, max, maxLength, isTop) { + var acc = [""]; + var accBase = [0]; + var dropEmpties = false; + var firstGroup = true; + var nextBase; for (; ; ) { var m = balanced2("{", "}", str); - if (!m || /\$$/.test(m.pre)) return [str]; + if (!m) { + return combine2(acc, accBase, str, [""], max, maxLength, dropEmpties, []); + } + var pre = m.pre; + if (/\$$/.test(pre)) { + return combine2(acc, accBase, str, [""], max, maxLength, dropEmpties, []); + } var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); var isSequence = isNumericSequence || isAlphaSequence; @@ -31291,76 +31365,91 @@ var require_brace_expansion = __commonJS({ if (m.post.match(/,(?!,).*\}/)) { str = m.pre + "{" + m.body + escClose2 + m.post; isTop = true; + firstGroup = true; + dropEmpties = false; + accBase = []; + for (var b = 0; b < acc.length; b++) { + accBase.push(acc[b].length); + } continue; } - return [str]; + return combine2( + acc, + accBase, + pre + "{" + m.body + "}" + m.post, + [""], + max, + maxLength, + dropEmpties, + [] + ); + } + if (firstGroup) { + dropEmpties = isTop && !isSequence; + firstGroup = false; } - var n; + var values; if (isSequence) { - n = m.body.split(/\.\./); + values = expandSequence2(m.body, isAlphaSequence, max, maxLength); } else { - n = parseCommaParts2(m.body); - if (n.length === 1) { - n = expand3(n[0], max, false).map(embrace2); + var n = parseCommaParts2(m.body); + if (n.length === 1 && n[0] !== void 0) { + n = expand3(n[0], max, maxLength, false).map(embrace2); if (n.length === 1) { - var post = m.post.length ? expand3(m.post, max, false) : [""]; - return post.map(function(p) { - return m.pre + n[0] + p; - }); + nextBase = []; + acc = combine2( + acc, + accBase, + pre + n[0], + [""], + max, + maxLength, + dropEmpties && !m.post.length, + nextBase + ); + accBase = nextBase; + if (!m.post.length) break; + str = m.post; + continue; } } - } - var pre = m.pre; - var post = m.post.length ? expand3(m.post, max, false) : [""]; - var N; - if (isSequence) { - var x = numeric2(n[0]); - var y = numeric2(n[1]); - var width = Math.max(n[0].length, n[1].length); - var incr = n.length == 3 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; - var test = lte2; - var reverse = y < x; - if (reverse) { - incr *= -1; - test = gte7; - } - var pad = n.some(isPadded2); - N = []; - for (var i = x; test(i, y) && N.length < max; i += incr) { - var c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === "\\") - c = ""; - } else { - c = String(i); - if (pad) { - var need = width - c.length; - if (need > 0) { - var z = new Array(need + 1).join("0"); - if (i < 0) - c = "-" + z + c.slice(1); - else - c = z + c; - } - } + var dropsEmpties = dropEmpties && !m.post.length && !pre; + for (var d = 0; dropsEmpties && d < acc.length; d++) { + if (acc[d].length !== accBase[d]) { + dropsEmpties = false; } - N.push(c); } - } else { - N = concatMap(n, function(el) { - return expand3(el, max, false); - }); - } - for (var j = 0; j < N.length; j++) { - for (var k = 0; k < post.length && expansions.length < max; k++) { - var expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) - expansions.push(expansion); + values = []; + var valuesLength = 0; + outer: for (var j = 0; j < n.length; j++) { + var expanded = expand3(n[j], max, maxLength, false); + for (var k = 0; k < expanded.length; k++) { + var v = expanded[k]; + if (dropsEmpties && !v) continue; + if (values.length >= max || valuesLength + v.length > maxLength) { + break outer; + } + values.push(v); + valuesLength += v.length; + } } } - return expansions; + nextBase = []; + acc = combine2( + acc, + accBase, + pre, + values, + max, + maxLength, + dropEmpties && !m.post.length, + nextBase + ); + accBase = nextBase; + if (!m.post.length) break; + str = m.post; } + return acc; } } }); @@ -89012,6 +89101,8 @@ var require_brace_expansion2 = __commonJS({ var escClose2 = "\0CLOSE" + Math.random() + "\0"; var escComma2 = "\0COMMA" + Math.random() + "\0"; var escPeriod2 = "\0PERIOD" + Math.random() + "\0"; + var EXPANSION_MAX2 = 1e5; + var EXPANSION_MAX_LENGTH2 = 4e6; function numeric2(str) { return parseInt(str, 10) == str ? parseInt(str, 10) : str.charCodeAt(0); } @@ -89045,11 +89136,12 @@ var require_brace_expansion2 = __commonJS({ if (!str) return []; options = options || {}; - var max = options.max == null ? Infinity : options.max; + var max = options.max == null ? EXPANSION_MAX2 : options.max; + var maxLength = options.maxLength == null ? EXPANSION_MAX_LENGTH2 : options.maxLength; if (str.substr(0, 2) === "{}") { str = "\\{\\}" + str.substr(2); } - return expand3(escapeBraces2(str), max, true).map(unescapeBraces2); + return expand3(escapeBraces2(str), max, maxLength, true).map(unescapeBraces2); } function embrace2(str) { return "{" + str + "}"; @@ -89063,19 +89155,89 @@ var require_brace_expansion2 = __commonJS({ function gte7(i, y) { return i >= y; } - function expand3(str, max, isTop) { - var expansions = []; + function combine2(acc, pre, values, max, maxLength, dropEmpties) { + var out = []; + var length = 0; + for (var a = 0; a < acc.length; a++) { + for (var v = 0; v < values.length; v++) { + if (out.length >= max) return out; + var expansion = acc[a] + pre + values[v]; + if (dropEmpties && !expansion) continue; + if (length + expansion.length > maxLength) return out; + out.push(expansion); + length += expansion.length; + } + } + return out; + } + function expandSequence2(body, isAlphaSequence, max, maxLength) { + var n = body.split(/\.\./); + var N = []; + if (n[0] === void 0 || n[1] === void 0) { + return N; + } + var x = numeric2(n[0]); + var y = numeric2(n[1]); + var width = Math.max(n[0].length, n[1].length); + var incr = n.length === 3 && n[2] !== void 0 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; + var test = lte2; + var reverse = y < x; + if (reverse) { + incr *= -1; + test = gte7; + } + var pad = n.some(isPadded2); + var length = 0; + for (var i = x; test(i, y) && N.length < max; i += incr) { + var c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === "\\") { + c = ""; + } + } else { + c = String(i); + if (pad) { + var need = width - c.length; + if (need > 0) { + var z = new Array(need + 1).join("0"); + if (i < 0) { + c = "-" + z + c.slice(1); + } else { + c = z + c; + } + } + } + } + if (length + c.length > maxLength) break; + N.push(c); + length += c.length; + } + return N; + } + function expand3(str, max, maxLength, isTop) { + var acc = [""]; + var dropEmpties = false; + var firstGroup = true; for (; ; ) { const m = balanced2("{", "}", str); - if (!m) return [str]; + if (!m) { + return combine2(acc, str, [""], max, maxLength, dropEmpties); + } const pre = m.pre; - if (/\$$/.test(m.pre)) { - const post2 = m.post.length ? expand3(m.post, max, false) : [""]; - for (let k2 = 0; k2 < post2.length && k2 < max; k2++) { - const expansion2 = pre + "{" + m.body + "}" + post2[k2]; - expansions.push(expansion2); - } - return expansions; + if (/\$$/.test(pre)) { + acc = combine2( + acc, + pre + "{" + m.body + "}", + [""], + max, + maxLength, + dropEmpties && !m.post.length + ); + firstGroup = false; + if (!m.post.length) break; + str = m.post; + continue; } var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); @@ -89087,73 +89249,66 @@ var require_brace_expansion2 = __commonJS({ isTop = true; continue; } - return [str]; + return combine2( + acc, + pre + "{" + m.body + "}" + m.post, + [""], + max, + maxLength, + dropEmpties + ); } - const post = m.post.length ? expand3(m.post, max, false) : [""]; - var n; + if (firstGroup) { + dropEmpties = isTop && !isSequence; + firstGroup = false; + } + var values; if (isSequence) { - n = m.body.split(/\.\./); + values = expandSequence2(m.body, isAlphaSequence, max, maxLength); } else { - n = parseCommaParts2(m.body); - if (n.length === 1) { - n = expand3(n[0], max, false).map(embrace2); + var n = parseCommaParts2(m.body); + if (n.length === 1 && n[0] !== void 0) { + n = expand3(n[0], max, maxLength, false).map(embrace2); if (n.length === 1) { - return post.map(function(p) { - return m.pre + n[0] + p; - }); + acc = combine2( + acc, + pre + n[0], + [""], + max, + maxLength, + dropEmpties && !m.post.length + ); + if (!m.post.length) break; + str = m.post; + continue; } } - } - var N; - if (isSequence) { - var x = numeric2(n[0]); - var y = numeric2(n[1]); - var width = Math.max(n[0].length, n[1].length); - var incr = n.length == 3 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; - var test = lte2; - var reverse = y < x; - if (reverse) { - incr *= -1; - test = gte7; - } - var pad = n.some(isPadded2); - N = []; - for (var i = x; test(i, y) && N.length < max; i += incr) { - var c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === "\\") - c = ""; - } else { - c = String(i); - if (pad) { - var need = width - c.length; - if (need > 0) { - var z = new Array(need + 1).join("0"); - if (i < 0) - c = "-" + z + c.slice(1); - else - c = z + c; - } - } + var dropsEmpties = dropEmpties && !m.post.length && !pre; + for (var d = 0; dropsEmpties && d < acc.length; d++) { + if (acc[d]) { + dropsEmpties = false; } - N.push(c); } - } else { - N = []; - for (var j = 0; j < n.length; j++) { - N.push.apply(N, expand3(n[j], max, false)); - } - } - for (var j = 0; j < N.length; j++) { - for (var k = 0; k < post.length && expansions.length < max; k++) { - var expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) - expansions.push(expansion); + values = []; + var valuesLength = 0; + outer: for (var j = 0; j < n.length; j++) { + var expanded = expand3(n[j], max, maxLength, false); + for (var k = 0; k < expanded.length; k++) { + var v = expanded[k]; + if (dropsEmpties && !v) continue; + if (values.length >= max || valuesLength + v.length > maxLength) { + break outer; + } + values.push(v); + valuesLength += v.length; + } } } - return expansions; + acc = combine2(acc, pre, values, max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) break; + str = m.post; } + return acc; } } }); @@ -155679,6 +155834,7 @@ var closePattern = /\\}/g; var commaPattern = /\\,/g; var periodPattern = /\\\./g; var EXPANSION_MAX = 1e5; +var EXPANSION_MAX_LENGTH = 4e6; function numeric(str) { return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0); } @@ -155713,11 +155869,11 @@ function expand2(str, options = {}) { if (!str) { return []; } - const { max = EXPANSION_MAX } = options; + const { max = EXPANSION_MAX, maxLength = EXPANSION_MAX_LENGTH } = options; if (str.slice(0, 2) === "{}") { str = "\\{\\}" + str.slice(2); } - return expand_(escapeBraces(str), max, true).map(unescapeBraces); + return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces); } function embrace(str) { return "{" + str + "}"; @@ -155731,20 +155887,87 @@ function lte(i, y) { function gte6(i, y) { return i >= y; } -function expand_(str, max, isTop) { - const expansions = []; +function combine(acc, pre, values, max, maxLength, dropEmpties) { + const out = []; + let length = 0; + for (let a = 0; a < acc.length; a++) { + for (let v = 0; v < values.length; v++) { + if (out.length >= max) + return out; + const expansion = acc[a] + pre + values[v]; + if (dropEmpties && !expansion) + continue; + if (length + expansion.length > maxLength) + return out; + out.push(expansion); + length += expansion.length; + } + } + return out; +} +function expandSequence(body, isAlphaSequence, max, maxLength) { + const n = body.split(/\.\./); + const N = []; + if (n[0] === void 0 || n[1] === void 0) { + return N; + } + const x = numeric(n[0]); + const y = numeric(n[1]); + const width = Math.max(n[0].length, n[1].length); + let incr = n.length === 3 && n[2] !== void 0 ? Math.max(Math.abs(numeric(n[2])), 1) : 1; + let test = lte; + const reverse = y < x; + if (reverse) { + incr *= -1; + test = gte6; + } + const pad = n.some(isPadded); + let length = 0; + for (let i = x; test(i, y) && N.length < max; i += incr) { + let c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === "\\") { + c = ""; + } + } else { + c = String(i); + if (pad) { + const need = width - c.length; + if (need > 0) { + const z = new Array(need + 1).join("0"); + if (i < 0) { + c = "-" + z + c.slice(1); + } else { + c = z + c; + } + } + } + } + if (length + c.length > maxLength) + break; + N.push(c); + length += c.length; + } + return N; +} +function expand_(str, max, maxLength, isTop) { + let acc = [""]; + let dropEmpties = false; + let firstGroup = true; for (; ; ) { const m = balanced("{", "}", str); - if (!m) - return [str]; + if (!m) { + return combine(acc, str, [""], max, maxLength, dropEmpties); + } const pre = m.pre; - if (/\$$/.test(m.pre)) { - const post2 = m.post.length ? expand_(m.post, max, false) : [""]; - for (let k = 0; k < post2.length && k < max; k++) { - const expansion = pre + "{" + m.body + "}" + post2[k]; - expansions.push(expansion); - } - return expansions; + if (/\$$/.test(pre)) { + acc = combine(acc, pre + "{" + m.body + "}", [""], max, maxLength, dropEmpties && !m.post.length); + firstGroup = false; + if (!m.post.length) + break; + str = m.post; + continue; } const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); @@ -155756,74 +155979,55 @@ function expand_(str, max, isTop) { isTop = true; continue; } - return [str]; + return combine(acc, pre + "{" + m.body + "}" + m.post, [""], max, maxLength, dropEmpties); } - const post = m.post.length ? expand_(m.post, max, false) : [""]; - let n; + if (firstGroup) { + dropEmpties = isTop && !isSequence; + firstGroup = false; + } + let values; if (isSequence) { - n = m.body.split(/\.\./); + values = expandSequence(m.body, isAlphaSequence, max, maxLength); } else { - n = parseCommaParts(m.body); + let n = parseCommaParts(m.body); if (n.length === 1 && n[0] !== void 0) { - n = expand_(n[0], max, false).map(embrace); + n = expand_(n[0], max, maxLength, false).map(embrace); if (n.length === 1) { - return post.map((p) => m.pre + n[0] + p); + acc = combine(acc, pre + n[0], [""], max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) + break; + str = m.post; + continue; } } - } - let N; - if (isSequence && n[0] !== void 0 && n[1] !== void 0) { - const x = numeric(n[0]); - const y = numeric(n[1]); - const width = Math.max(n[0].length, n[1].length); - let incr = n.length === 3 && n[2] !== void 0 ? Math.max(Math.abs(numeric(n[2])), 1) : 1; - let test = lte; - const reverse = y < x; - if (reverse) { - incr *= -1; - test = gte6; - } - const pad = n.some(isPadded); - N = []; - for (let i = x; test(i, y) && N.length < max; i += incr) { - let c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === "\\") { - c = ""; - } - } else { - c = String(i); - if (pad) { - const need = width - c.length; - if (need > 0) { - const z = new Array(need + 1).join("0"); - if (i < 0) { - c = "-" + z + c.slice(1); - } else { - c = z + c; - } - } - } + let dropsEmpties = dropEmpties && !m.post.length && !pre; + for (let d = 0; dropsEmpties && d < acc.length; d++) { + if (acc[d]) { + dropsEmpties = false; } - N.push(c); - } - } else { - N = []; - for (let j = 0; j < n.length; j++) { - N.push.apply(N, expand_(n[j], max, false)); } - } - for (let j = 0; j < N.length; j++) { - for (let k = 0; k < post.length && expansions.length < max; k++) { - const expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) { - expansions.push(expansion); + values = []; + let valuesLength = 0; + outer: for (let j = 0; j < n.length; j++) { + const expanded = expand_(n[j], max, maxLength, false); + for (let k = 0; k < expanded.length; k++) { + const v = expanded[k]; + if (dropsEmpties && !v) + continue; + if (values.length >= max || valuesLength + v.length > maxLength) { + break outer; + } + values.push(v); + valuesLength += v.length; } } } - return expansions; + acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) + break; + str = m.post; } + return acc; } // node_modules/readdir-glob/node_modules/minimatch/dist/esm/assert-valid-pattern.js From 47a0a833bb564f3d97f560feed33b14037b09885 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 5 Aug 2026 17:54:39 +0000 Subject: [PATCH 05/24] Bump globals in the npm-minor group across 1 directory Bumps the npm-minor group with 1 update in the / directory: [globals](https://github.com/sindresorhus/globals). Updates `globals` from 17.7.0 to 17.8.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.7.0...v17.8.0) --- updated-dependencies: - dependency-name: globals dependency-version: 17.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor ... Signed-off-by: dependabot[bot] --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index 58752c7216..d7e08b9248 100644 --- a/package-lock.json +++ b/package-lock.json @@ -61,7 +61,7 @@ "eslint-plugin-jsdoc": "^62.9.0", "eslint-plugin-no-async-foreach": "^0.1.1", "glob": "^13.0.6", - "globals": "^17.7.0", + "globals": "^17.8.0", "nock": "^14.0.16", "sinon": "^22.1.0", "typescript": "^6.0.3", @@ -6138,9 +6138,9 @@ } }, "node_modules/globals": { - "version": "17.7.0", - "resolved": "https://registry.npmjs.org/globals/-/globals-17.7.0.tgz", - "integrity": "sha512-Czmyns5dUsq4seFBR/Kdydhmo8y9kC79hiSkPn0YcGtNnYWnrgt0vjrSjx9tspoDGWm2CMarffRuLjM4xUz8xg==", + "version": "17.8.0", + "resolved": "https://registry.npmjs.org/globals/-/globals-17.8.0.tgz", + "integrity": "sha512-Zz/LMDZScFmkakeL2cTHzf+PbWKdpU3uclqkZT7TjDG58j5WPt0PpA+n9uPI24fZtlw07q0OtEi84K+umsRzqQ==", "dev": true, "license": "MIT", "engines": { diff --git a/package.json b/package.json index 23fe11a875..0924e874c1 100644 --- a/package.json +++ b/package.json @@ -69,7 +69,7 @@ "eslint-plugin-jsdoc": "^62.9.0", "eslint-plugin-no-async-foreach": "^0.1.1", "glob": "^13.0.6", - "globals": "^17.7.0", + "globals": "^17.8.0", "nock": "^14.0.16", "sinon": "^22.1.0", "typescript": "^6.0.3", From 74cfae9be6203473356477ab950b788c8cb4b46a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 5 Aug 2026 17:56:46 +0000 Subject: [PATCH 06/24] Bump actions/setup-java Bumps the actions-minor group with 1 update in the /.github/workflows directory: [actions/setup-java](https://github.com/actions/setup-java). Updates `actions/setup-java` from 5.6.0 to 5.7.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/03ad4de0992f5dab5e18fcb136590ce7c4a0ac95...b6effb05e454b25005698d916606bdc6ffcbf961) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 5.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] --- .../workflows/__autobuild-direct-tracing-with-working-dir.yml | 2 +- .github/workflows/__build-mode-autobuild.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml index f3bc58c691..b527638feb 100644 --- a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml +++ b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml @@ -63,7 +63,7 @@ jobs: - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Java - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: ${{ inputs.java-version || '17' }} distribution: temurin diff --git a/.github/workflows/__build-mode-autobuild.yml b/.github/workflows/__build-mode-autobuild.yml index 280dbf569c..5043433ee3 100644 --- a/.github/workflows/__build-mode-autobuild.yml +++ b/.github/workflows/__build-mode-autobuild.yml @@ -63,7 +63,7 @@ jobs: - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Java - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: ${{ inputs.java-version || '17' }} distribution: temurin From bdf39710a2188cdbe1e45fcfd3d2e77a436d6f39 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 5 Aug 2026 17:59:47 +0000 Subject: [PATCH 07/24] Rebuild --- pr-checks/sync.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 0517feddbd..9dcce16fe5 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -253,8 +253,8 @@ const languageSetups: LanguageSetups = { name: "Install Java", uses: pinnedUses( "actions/setup-java", - "03ad4de0992f5dab5e18fcb136590ce7c4a0ac95", - "v5.6.0", + "b6effb05e454b25005698d916606bdc6ffcbf961", + "v5.7.0", ), with: { "java-version": `\${{ inputs.java-version || '${defaultLanguageVersions.java}' }}`, From acb38565c9ef611c5c861d009ec0bcbabab5dae8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 23:57:27 +0000 Subject: [PATCH 08/24] Bump js-yaml from 5.2.2 to 5.2.3 Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 5.2.2 to 5.2.3. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.2.2...5.2.3) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.2.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index d7e08b9248..3ecde2f706 100644 --- a/package-lock.json +++ b/package-lock.json @@ -31,7 +31,7 @@ "follow-redirects": "^1.16.0", "get-folder-size": "^5.0.0", "https-proxy-agent": "^7.0.6", - "js-yaml": "^5.2.2", + "js-yaml": "^5.2.3", "jsonschema": "1.5.0", "long": "^5.3.2", "node-forge": "^1.4.0", @@ -6981,9 +6981,9 @@ } }, "node_modules/js-yaml": { - "version": "5.2.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.2.tgz", - "integrity": "sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==", + "version": "5.2.3", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.3.tgz", + "integrity": "sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==", "funding": [ { "type": "github", diff --git a/package.json b/package.json index 0924e874c1..4176f5db35 100644 --- a/package.json +++ b/package.json @@ -39,7 +39,7 @@ "follow-redirects": "^1.16.0", "get-folder-size": "^5.0.0", "https-proxy-agent": "^7.0.6", - "js-yaml": "^5.2.2", + "js-yaml": "^5.2.3", "jsonschema": "1.5.0", "long": "^5.3.2", "node-forge": "^1.4.0", From b5225f21c58fd7a6dff7e07e9d80cc804f57fefb Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 23:59:22 +0000 Subject: [PATCH 09/24] Rebuild --- lib/entry-points.js | 56 +++++++++++++++++++++++++++++---------------- 1 file changed, 36 insertions(+), 20 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index dd77444e02..f2be624b77 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -142238,6 +142238,11 @@ var binaryTag = defineScalarTag("tag:yaml.org,2002:binary", { }); var YAML_DATE_REGEXP = /* @__PURE__ */ new RegExp("^([0-9][0-9][0-9][0-9])-([0-9][0-9])-([0-9][0-9])$"); var YAML_TIMESTAMP_REGEXP = /* @__PURE__ */ new RegExp("^([0-9][0-9][0-9][0-9])-([0-9][0-9]?)-([0-9][0-9]?)(?:[Tt]|[ \\t]+)([0-9][0-9]?):([0-9][0-9]):([0-9][0-9])(?:\\.([0-9]*))?(?:[ \\t]*(Z|([-+])([0-9][0-9]?)(?::([0-9][0-9]))?))?$"); +function makeUtcDate(year, month, day, hour = 0, minute = 0, second = 0, fraction = 0) { + const date = new Date(Date.UTC(year, month, day, hour, minute, second, fraction)); + date.setUTCFullYear(year, month, day); + return date; +} function resolveYamlTimestamp(source) { let match2 = YAML_DATE_REGEXP.exec(source); if (match2 === null) match2 = YAML_TIMESTAMP_REGEXP.exec(source); @@ -142246,7 +142251,7 @@ function resolveYamlTimestamp(source) { const month = +match2[2] - 1; const day = +match2[3]; if (!match2[4]) { - const date2 = new Date(Date.UTC(year, month, day)); + const date2 = makeUtcDate(year, month, day); if (date2.getUTCFullYear() !== year || date2.getUTCMonth() !== month || date2.getUTCDate() !== day) return NOT_RESOLVED; return date2; } @@ -142260,7 +142265,7 @@ function resolveYamlTimestamp(source) { while (value.length < 3) value += "0"; fraction = +value; } - const date = new Date(Date.UTC(year, month, day, hour, minute, second, fraction)); + const date = makeUtcDate(year, month, day, hour, minute, second, fraction); if (date.getUTCFullYear() !== year || date.getUTCMonth() !== month || date.getUTCDate() !== day) return NOT_RESOLVED; if (match2[9]) { const offsetHour = +match2[10]; @@ -142358,7 +142363,11 @@ var mapTag = defineMappingTag("tag:yaml.org,2002:map", { return Object.prototype.hasOwnProperty.call(container, String(key)); }, keys: (container) => Object.keys(container), - get: (container, key) => container[String(key)] + get: (container, key) => { + const normalizedKey = String(key); + if (!Object.prototype.hasOwnProperty.call(container, normalizedKey)) return null; + return container[normalizedKey]; + } }); var setTag = defineMappingTag("tag:yaml.org,2002:set", { create: () => /* @__PURE__ */ new Set(), @@ -142379,9 +142388,9 @@ var setTag = defineMappingTag("tag:yaml.org,2002:set", { }); function createTagDefinitionMap() { return { - scalar: {}, - sequence: {}, - mapping: {} + scalar: /* @__PURE__ */ Object.create(null), + sequence: /* @__PURE__ */ Object.create(null), + mapping: /* @__PURE__ */ Object.create(null) }; } function createTagDefinitionListMap() { @@ -142551,7 +142560,11 @@ var legacyMapTag = defineMappingTag("tag:yaml.org,2002:map", { return normalizedKey !== null && Object.prototype.hasOwnProperty.call(container, normalizedKey); }, keys: (container) => Object.keys(container), - get: (container, key) => container[String(key)] + get: (container, key) => { + const normalizedKey = String(key); + if (!Object.prototype.hasOwnProperty.call(container, normalizedKey)) return null; + return container[normalizedKey]; + } }); var DEFAULT_SNIPPET_OPTIONS = { maxLength: 79, @@ -142887,10 +142900,10 @@ function getScalarValue(input, scalar) { return getPlainValue(input, valueStart, valueEnd); } } -var DEFAULT_TAG_HANDLERS = { +var DEFAULT_TAG_HANDLERS = Object.assign(/* @__PURE__ */ Object.create(null), { "!": "!", "!!": "tag:yaml.org,2002:" -}; +}); function tagPercentEncode(source) { return encodeURI(source).replace(/!/g, "%21"); } @@ -143143,6 +143156,10 @@ function constructFromEvents(events, options) { } case 6: { const frame = state.frames.pop(); + if (frame.kind === "mapping" && frame.hasKey) { + state.position = frame.keyPosition; + throwError$1(state, "incomplete mapping pair in event stream"); + } if (frame.kind === "document") state.documents.push(frame.value); else { const value = frame.tag.carrierIsResult ? frame.value : finalizeCollection(state, frame.position, frame.tag, frame.value); @@ -143813,10 +143830,6 @@ function parseNode(state, parentIndent, nodeContext, allowToSeek, allowCompact, else if (state.lineIndent === parentIndent) indentStatus = 0; else indentStatus = -1; } - if (state.position === state.lineStart && testDocumentSeparator(state)) { - state.depth--; - return false; - } if (indentStatus === 1) while (true) { const ch = state.input.charCodeAt(state.position); const propertyState = snapshotState(state); @@ -144365,14 +144378,14 @@ function chooseScalarStyle(state, string2, layout, singleLineOnly, forceQuote, i if (char === CHAR_LINE_FEED) { hasLineBreak = true; if (shouldTrackWidth) { - hasFoldableLine = hasFoldableLine || i - previousLineBreak - 1 > lineWidth && string2[previousLineBreak + 1] !== " "; + hasFoldableLine = hasFoldableLine || i - previousLineBreak - 1 > lineWidth && !isMoreIndented(string2[previousLineBreak + 1]); previousLineBreak = i; } } else if (!isPrintable(char)) return STYLE_DOUBLE; plain = plain && isPlainSafe(char, prevChar, inblock); prevChar = char; } - hasFoldableLine = hasFoldableLine || shouldTrackWidth && i - previousLineBreak - 1 > lineWidth && string2[previousLineBreak + 1] !== " "; + hasFoldableLine = hasFoldableLine || shouldTrackWidth && i - previousLineBreak - 1 > lineWidth && !isMoreIndented(string2[previousLineBreak + 1]); } if (!hasLineBreak && !hasFoldableLine) { if (plain && !forceQuote) return STYLE_PLAIN; @@ -144437,27 +144450,30 @@ function encodeFlowBreaks(string2, indent) { function dropEndingNewline(string2) { return string2[string2.length - 1] === "\n" ? string2.slice(0, -1) : string2; } +function isMoreIndented(char) { + return char === " " || char === " "; +} function foldBlockScalar(string2, width) { const lineRe = /(\n+)([^\n]*)/g; let nextLF = string2.indexOf("\n"); if (nextLF === -1) nextLF = string2.length; lineRe.lastIndex = nextLF; let result = foldLine(string2.slice(0, nextLF), width); - let prevMoreIndented = string2[0] === "\n" || string2[0] === " "; + let prevMoreIndented = string2[0] === "\n" || isMoreIndented(string2[0]); let moreIndented; let match2; while (match2 = lineRe.exec(string2)) { const prefix = match2[1]; const line = match2[2]; - moreIndented = line[0] === " "; + moreIndented = line !== "" && isMoreIndented(line[0]); result += prefix + (!prevMoreIndented && !moreIndented && line !== "" ? "\n" : "") + foldLine(line, width); prevMoreIndented = moreIndented; } return result; } function foldLine(line, width) { - if (line === "" || line[0] === " ") return line; - const breakRe = / [^ ]/g; + if (line === "" || isMoreIndented(line[0])) return line; + const breakRe = / [^ \t]/g; let match2; let start = 0; let end; @@ -163375,7 +163391,7 @@ tmp/lib/tmp.js: *) js-yaml/dist/js-yaml.mjs: - (*! js-yaml 5.2.2 https://github.com/nodeca/js-yaml @license MIT *) + (*! js-yaml 5.2.3 https://github.com/nodeca/js-yaml @license MIT *) long/index.js: (** From 71311390373a4e40146c33f95fdab34da9c7dd8f Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 11 Aug 2026 13:38:57 +0100 Subject: [PATCH 10/24] Trigger workflows From c205ff6f09225f1b58086f3c7eca4b453ab2e857 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 11 Aug 2026 14:03:49 +0100 Subject: [PATCH 11/24] Promote `OverlayAnalysisResourceChecksV2` This feature has been rolled out to 100% and therefore the default behaviour for some time. --- lib/entry-points.js | 28 ++++++---------------------- src/config-utils.test.ts | 23 +---------------------- src/config-utils.ts | 30 ++++-------------------------- src/feature-flags.ts | 10 ---------- 4 files changed, 11 insertions(+), 80 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index dd77444e02..60e8458e2b 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -147382,11 +147382,6 @@ var featureConfig = { envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION_DRY_RUN", minimumVersion: void 0 }, - ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: { - defaultValue: false, - envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2", - minimumVersion: void 0 - }, ["overlay_analysis_status_check" /* OverlayAnalysisStatusCheck */]: { defaultValue: false, envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_CHECK", @@ -149617,10 +149612,8 @@ async function cachePrefix(codeql, language) { } // src/config-utils.ts -var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 2e4; +var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 14e3; var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB * 1e6; -var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB = 14e3; -var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB * 1e6; var OVERLAY_MINIMUM_MEMORY_MB = 5 * 1024; var CODEQL_VERSION_REDUCED_OVERLAY_MEMORY_USAGE = "2.24.3"; async function getSupportedLanguageMap(codeql, logger) { @@ -149870,8 +149863,8 @@ async function checkOverlayAnalysisFeatureEnabled(features, codeql, languages, c } return new Success(void 0); } -function runnerHasSufficientDiskSpace(diskUsage, logger, useV2ResourceChecks) { - const minimumDiskSpaceBytes = useV2ResourceChecks ? OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES : OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES; +function runnerHasSufficientDiskSpace(diskUsage, logger) { + const minimumDiskSpaceBytes = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES; if (diskUsage.numAvailableBytes < minimumDiskSpaceBytes) { const diskSpaceMb = Math.round(diskUsage.numAvailableBytes / 1e6); const minimumDiskSpaceMb = Math.round(minimumDiskSpaceBytes / 1e6); @@ -149904,8 +149897,8 @@ async function runnerHasSufficientMemory(codeql, ramInput, logger) { ); return true; } -async function checkRunnerResources(codeql, diskUsage, ramInput, logger, useV2ResourceChecks) { - if (!runnerHasSufficientDiskSpace(diskUsage, logger, useV2ResourceChecks)) { +async function checkRunnerResources(codeql, diskUsage, ramInput, logger) { + if (!runnerHasSufficientDiskSpace(diskUsage, logger)) { return new Failure("insufficient-disk-space" /* InsufficientDiskSpace */); } if (!await runnerHasSufficientMemory(codeql, ramInput, logger)) { @@ -149953,9 +149946,6 @@ async function checkOverlayEnablement(codeql, features, languages, sourceRoot, b "overlay_analysis_skip_resource_checks" /* OverlayAnalysisSkipResourceChecks */, codeql ); - const useV2ResourceChecks = await features.getValue( - "overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */ - ); const checkOverlayStatus = await features.getValue( "overlay_analysis_status_check" /* OverlayAnalysisStatusCheck */ ); @@ -149967,13 +149957,7 @@ async function checkOverlayEnablement(codeql, features, languages, sourceRoot, b ); return new Failure("unable-to-determine-disk-usage" /* UnableToDetermineDiskUsage */); } - const resourceResult = performResourceChecks && diskUsage !== void 0 ? await checkRunnerResources( - codeql, - diskUsage, - ramInput, - logger, - useV2ResourceChecks - ) : new Success(void 0); + const resourceResult = performResourceChecks && diskUsage !== void 0 ? await checkRunnerResources(codeql, diskUsage, ramInput, logger) : new Success(void 0); if (resourceResult.isFailure()) { return resourceResult; } diff --git a/src/config-utils.test.ts b/src/config-utils.test.ts index 84c709e72a..10509710af 100644 --- a/src/config-utils.test.ts +++ b/src/config-utils.test.ts @@ -1301,7 +1301,6 @@ checkOverlayEnablementMacro.serial( features: [ Feature.OverlayAnalysis, Feature.OverlayAnalysisCodeScanningJavascript, - Feature.OverlayAnalysisResourceChecksV2, ], isDefaultBranch: true, diskUsage: { @@ -1315,13 +1314,12 @@ checkOverlayEnablementMacro.serial( ); checkOverlayEnablementMacro.serial( - "Overlay-base database on default branch if runner disk space is between v2 and v1 limits and v2 resource checks enabled", + "Overlay-base database on default branch if runner disk space is above minimum", { languages: [BuiltInLanguage.javascript], features: [ Feature.OverlayAnalysis, Feature.OverlayAnalysisCodeScanningJavascript, - Feature.OverlayAnalysisResourceChecksV2, ], isDefaultBranch: true, diskUsage: { @@ -1335,25 +1333,6 @@ checkOverlayEnablementMacro.serial( }, ); -checkOverlayEnablementMacro.serial( - "No overlay-base database on default branch if runner disk space is between v2 and v1 limits and v2 resource checks not enabled", - { - languages: [BuiltInLanguage.javascript], - features: [ - Feature.OverlayAnalysis, - Feature.OverlayAnalysisCodeScanningJavascript, - ], - isDefaultBranch: true, - diskUsage: { - numAvailableBytes: 15_000_000_000, - numTotalBytes: 100_000_000_000, - }, - }, - { - disabledReason: OverlayDisabledReason.InsufficientDiskSpace, - }, -); - checkOverlayEnablementMacro.serial( "No overlay-base database on default branch if memory flag is too low", { diff --git a/src/config-utils.ts b/src/config-utils.ts index b5a880ba7b..6d1efaa1ba 100644 --- a/src/config-utils.ts +++ b/src/config-utils.ts @@ -102,19 +102,10 @@ export { type Config } from "./config/action-config"; * analysis unless overlay analysis has been explicitly enabled via environment * variable. */ -const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 20000; +const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 14000; const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB * 1_000_000; -/** - * The v2 minimum available disk space (in MB) required to perform overlay - * analysis. This is a lower threshold than the v1 limit, allowing overlay - * analysis to run on runners with less available disk space. - */ -const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB = 14000; -const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES = - OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB * 1_000_000; - /** * The minimum memory (in MB) that must be available for CodeQL to perform overlay analysis. If * CodeQL will be given less memory than this threshold, then the action will not perform overlay @@ -592,11 +583,8 @@ async function checkOverlayAnalysisFeatureEnabled( function runnerHasSufficientDiskSpace( diskUsage: DiskUsage, logger: Logger, - useV2ResourceChecks: boolean, ): boolean { - const minimumDiskSpaceBytes = useV2ResourceChecks - ? OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES - : OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES; + const minimumDiskSpaceBytes = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES; if (diskUsage.numAvailableBytes < minimumDiskSpaceBytes) { const diskSpaceMb = Math.round(diskUsage.numAvailableBytes / 1_000_000); const minimumDiskSpaceMb = Math.round(minimumDiskSpaceBytes / 1_000_000); @@ -651,9 +639,8 @@ async function checkRunnerResources( diskUsage: DiskUsage, ramInput: string | undefined, logger: Logger, - useV2ResourceChecks: boolean, ): Promise> { - if (!runnerHasSufficientDiskSpace(diskUsage, logger, useV2ResourceChecks)) { + if (!runnerHasSufficientDiskSpace(diskUsage, logger)) { return new Failure(OverlayDisabledReason.InsufficientDiskSpace); } if (!(await runnerHasSufficientMemory(codeql, ramInput, logger))) { @@ -752,9 +739,6 @@ export async function checkOverlayEnablement( Feature.OverlayAnalysisSkipResourceChecks, codeql, )); - const useV2ResourceChecks = await features.getValue( - Feature.OverlayAnalysisResourceChecksV2, - ); const checkOverlayStatus = await features.getValue( Feature.OverlayAnalysisStatusCheck, ); @@ -768,13 +752,7 @@ export async function checkOverlayEnablement( } const resourceResult = performResourceChecks && diskUsage !== undefined - ? await checkRunnerResources( - codeql, - diskUsage, - ramInput, - logger, - useV2ResourceChecks, - ) + ? await checkRunnerResources(codeql, diskUsage, ramInput, logger) : new Success(undefined); if (resourceResult.isFailure()) { return resourceResult; diff --git a/src/feature-flags.ts b/src/feature-flags.ts index b3107af962..fff7ef0440 100644 --- a/src/feature-flags.ts +++ b/src/feature-flags.ts @@ -122,11 +122,6 @@ export enum Feature { */ OverlayAnalysisMatchCodeqlVersionDryRun = "overlay_analysis_match_codeql_version_dry_run", OverlayAnalysisPython = "overlay_analysis_python", - /** - * Controls whether lower disk space requirements are used for overlay hardware checks. - * Has no effect if `OverlayAnalysisSkipResourceChecks` is enabled. - */ - OverlayAnalysisResourceChecksV2 = "overlay_analysis_resource_checks_v2", OverlayAnalysisRuby = "overlay_analysis_ruby", /** Controls whether hardware checks are skipped for overlay analysis. */ OverlayAnalysisSkipResourceChecks = "overlay_analysis_skip_resource_checks", @@ -354,11 +349,6 @@ export const featureConfig = { envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION_DRY_RUN", minimumVersion: undefined, }, - [Feature.OverlayAnalysisResourceChecksV2]: { - defaultValue: false, - envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2", - minimumVersion: undefined, - }, [Feature.OverlayAnalysisStatusCheck]: { defaultValue: false, envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_CHECK", From f47bb7b9aa0937411b425809418d83594e9f2eba Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 11 Aug 2026 14:08:57 +0100 Subject: [PATCH 12/24] Remove `v2` from test title --- src/config-utils.test.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/config-utils.test.ts b/src/config-utils.test.ts index 10509710af..aec214cd64 100644 --- a/src/config-utils.test.ts +++ b/src/config-utils.test.ts @@ -1295,7 +1295,7 @@ checkOverlayEnablementMacro.serial( ); checkOverlayEnablementMacro.serial( - "No overlay-base database on default branch if runner disk space is below v2 limit and v2 resource checks enabled", + "No overlay-base database on default branch if runner disk space is below minimum", { languages: [BuiltInLanguage.javascript], features: [ From 54a084632e348559349cf916aba71936331974ce Mon Sep 17 00:00:00 2001 From: Mads Navntoft Date: Wed, 12 Aug 2026 11:46:02 +0200 Subject: [PATCH 13/24] Bump undici from ^6.24.0 to ^6.28.0 --- lib/entry-points.js | 94 ++++++++++++++++++++++++++++++++++++++++++--- package-lock.json | 9 +++-- package.json | 4 +- 3 files changed, 95 insertions(+), 12 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 92b1ff3ead..9b8dc585eb 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -2218,7 +2218,11 @@ var require_request = __commonJS({ } else if (typeof val[i] === "object") { throw new InvalidArgumentError(`invalid ${key} header`); } else { - arr.push(`${val[i]}`); + const str = `${val[i]}`; + if (!isValidHeaderValue(str)) { + throw new InvalidArgumentError(`invalid ${key} header`); + } + arr.push(str); } } val = arr; @@ -2230,6 +2234,9 @@ var require_request = __commonJS({ val = ""; } else { val = `${val}`; + if (!isValidHeaderValue(val)) { + throw new InvalidArgumentError(`invalid ${key} header`); + } } if (headerName === "host") { if (request3.host !== null) { @@ -5960,6 +5967,7 @@ var require_client_h1 = __commonJS({ RequestContentLengthMismatchError, ResponseContentLengthMismatchError, RequestAbortedError, + InvalidArgumentError, HeadersTimeoutError, HeadersOverflowError, SocketError, @@ -6686,8 +6694,16 @@ var require_client_h1 = __commonJS({ } body = bodyStream.stream; contentLength = bodyStream.length; - } else if (util3.isBlobLike(body) && request3.contentType == null && body.type) { - headers.push("content-type", body.type); + } else if (util3.isBlobLike(body) && request3.contentType == null) { + const contentType = body.type; + if (contentType) { + const contentTypeValue = `${contentType}`; + if (!util3.isValidHeaderValue(contentTypeValue)) { + util3.errorRequest(client, request3, new InvalidArgumentError("invalid content-type header")); + return false; + } + headers.push("content-type", contentTypeValue); + } } if (body && typeof body.read === "function") { body.read(0); @@ -9239,6 +9255,24 @@ var require_retry_handler = __commonJS({ const current = Date.now(); return new Date(retryAfter).getTime() - current; } + function validatePartialResponseContentLength(headers, range2, statusCode, retryCount) { + const contentLength = headers["content-length"]; + if (contentLength == null) { + return null; + } + if (!Number.isFinite(range2.start) || !Number.isFinite(range2.end)) { + return null; + } + const length = Number(contentLength); + const expectedLength = range2.end - range2.start + 1; + if (!Number.isFinite(length) || length !== expectedLength) { + return new RequestRetryError("Content-Length mismatch", statusCode, { + headers, + data: { count: retryCount } + }); + } + return null; + } var RetryHandler = class _RetryHandler { constructor(opts, handlers) { const { retryOptions, ...dispatchOpts } = opts; @@ -9411,6 +9445,11 @@ var require_retry_handler = __commonJS({ ); return false; } + const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount); + if (contentLengthError != null) { + this.abort(contentLengthError); + return false; + } const { start, size, end = size - 1 } = contentRange; assert(this.start === start, "content-range mismatch"); assert(this.end == null || this.end === end, "content-range mismatch"); @@ -9428,6 +9467,11 @@ var require_retry_handler = __commonJS({ statusMessage ); } + const contentLengthError = validatePartialResponseContentLength(headers, range2, statusCode, this.retryCount); + if (contentLengthError != null) { + this.abort(contentLengthError); + return false; + } const { start, size, end = size - 1 } = range2; assert( start != null && Number.isFinite(start), @@ -16273,14 +16317,48 @@ var require_util6 = __commonJS({ for (let i = 0; i < path29.length; ++i) { const code = path29.charCodeAt(i); if (code < 32 || // exclude CTLs (0-31) - code === 127 || // DEL + code > 126 || // exclude DEL and non-ascii code === 59) { throw new Error("Invalid cookie path"); } } } + function isLetterOrDigit(code) { + return code >= 48 && code <= 57 || // 0-9 + code >= 65 && code <= 90 || // A-Z + code >= 97 && code <= 122; + } function validateCookieDomain(domain) { - if (domain.startsWith("-") || domain.endsWith(".") || domain.endsWith("-")) { + if (domain === " ") { + return; + } + if (domain.length > 255) { + throw new Error("Invalid cookie domain"); + } + let labelLength = 0; + for (let i = 0; i < domain.length; ++i) { + const code = domain.charCodeAt(i); + if (code === 46) { + if (labelLength === 0) { + throw new Error("Invalid cookie domain"); + } + if (domain.charCodeAt(i - 1) === 45) { + throw new Error("Invalid cookie domain"); + } + labelLength = 0; + continue; + } + if (labelLength === 0 && !isLetterOrDigit(code)) { + throw new Error("Invalid cookie domain"); + } + if (!isLetterOrDigit(code) && code !== 45) { + throw new Error("Invalid cookie domain"); + } + if (++labelLength > 63) { + throw new Error("Invalid cookie domain"); + } + } + if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 45) { throw new Error("Invalid cookie domain"); } } @@ -16363,7 +16441,11 @@ var require_util6 = __commonJS({ throw new Error("Invalid unparsed"); } const [key, ...value] = part.split("="); - out.push(`${key.trim()}=${value.join("=")}`); + const trimmedKey = key.trim(); + const joinedValue = value.join("="); + validateCookieName(trimmedKey); + validateCookieValue(joinedValue); + out.push(`${trimmedKey}=${joinedValue}`); } return out.join("; "); } diff --git a/package-lock.json b/package-lock.json index 3ecde2f706..e9081aee73 100644 --- a/package-lock.json +++ b/package-lock.json @@ -36,7 +36,7 @@ "long": "^5.3.2", "node-forge": "^1.4.0", "semver": "^7.8.5", - "undici": "^6.24.0", + "undici": "^6.28.0", "uuid": "^14.0.1" }, "devDependencies": { @@ -9363,9 +9363,10 @@ } }, "node_modules/undici": { - "version": "6.27.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz", - "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==", + "version": "6.28.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz", + "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==", + "license": "MIT", "engines": { "node": ">=18.17" } diff --git a/package.json b/package.json index 4176f5db35..0e3d1c7e96 100644 --- a/package.json +++ b/package.json @@ -45,7 +45,7 @@ "node-forge": "^1.4.0", "semver": "^7.8.5", "uuid": "^14.0.1", - "undici": "^6.24.0" + "undici": "^6.28.0" }, "devDependencies": { "@ava/typescript": "6.0.0", @@ -95,6 +95,6 @@ "semver": ">=6.3.1" }, "glob": "^13.0.6", - "undici": "^6.24.0" + "undici": "^6.28.0" } } From 0e8a5d99f8eb4a07306f1ecbdd1fde8793f44f4a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 15:30:15 +0000 Subject: [PATCH 14/24] Update default bundle to codeql-bundle-v2.26.3 --- lib/defaults.json | 8 ++++---- lib/entry-points.js | 4 ++-- src/defaults.json | 8 ++++---- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/lib/defaults.json b/lib/defaults.json index 558dce6e24..b5d9f13644 100644 --- a/lib/defaults.json +++ b/lib/defaults.json @@ -1,6 +1,6 @@ { - "bundleVersion": "codeql-bundle-v2.26.2", - "cliVersion": "2.26.2", - "priorBundleVersion": "codeql-bundle-v2.26.1", - "priorCliVersion": "2.26.1" + "bundleVersion": "codeql-bundle-v2.26.3", + "cliVersion": "2.26.3", + "priorBundleVersion": "codeql-bundle-v2.26.2", + "priorCliVersion": "2.26.2" } diff --git a/lib/entry-points.js b/lib/entry-points.js index 92b1ff3ead..9ae4f875aa 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -147085,8 +147085,8 @@ var path5 = __toESM(require("path")); var semver4 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.26.2"; -var cliVersion = "2.26.2"; +var bundleVersion = "codeql-bundle-v2.26.3"; +var cliVersion = "2.26.3"; // src/overlay/index.ts var fs4 = __toESM(require("fs")); diff --git a/src/defaults.json b/src/defaults.json index 558dce6e24..b5d9f13644 100644 --- a/src/defaults.json +++ b/src/defaults.json @@ -1,6 +1,6 @@ { - "bundleVersion": "codeql-bundle-v2.26.2", - "cliVersion": "2.26.2", - "priorBundleVersion": "codeql-bundle-v2.26.1", - "priorCliVersion": "2.26.1" + "bundleVersion": "codeql-bundle-v2.26.3", + "cliVersion": "2.26.3", + "priorBundleVersion": "codeql-bundle-v2.26.2", + "priorCliVersion": "2.26.2" } From ca1c97228cf88b7fd58cae44d5f4f8c566f5709a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 15:30:22 +0000 Subject: [PATCH 15/24] Add changelog note --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bd770ab5f4..1ed123883f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th ## [UNRELEASED] -No user facing changes. +- Update default CodeQL bundle version to [2.26.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3). [#4085](https://github.com/github/codeql-action/pull/4085) ## 4.37.6 - 04 Aug 2026 From dc1b98ad1c2f13ccf9fc33fb82f32fc76f944253 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 12 Aug 2026 16:43:22 +0100 Subject: [PATCH 16/24] Make `logger` available to `getCodeQLForCmd` --- lib/entry-points.js | 30 ++++++++++++++++-------------- src/analyze-action-post.ts | 2 +- src/analyze-action.ts | 2 +- src/autobuild-action.ts | 2 +- src/autobuild.ts | 2 +- src/codeql.ts | 13 +++++++------ src/init-action-post-helper.ts | 5 ++++- src/init-action-post.ts | 2 +- src/resolve-environment.ts | 2 +- src/upload-lib.ts | 2 +- 10 files changed, 34 insertions(+), 28 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 92b1ff3ead..c6292e61a1 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -151830,7 +151830,7 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV `Unsupported platform: ${process.platform}` ); } - cachedCodeQL = await getCodeQLForCmd(codeqlCmd, checkVersion); + cachedCodeQL = await getCodeQLForCmd(logger, codeqlCmd, checkVersion); return { codeql: cachedCodeQL, toolsDownloadStatusReport, @@ -151847,13 +151847,13 @@ Details: ${e.stack}` : ""}` ); } } -async function getCodeQL(cmd) { +async function getCodeQL(logger, cmd) { if (cachedCodeQL === void 0) { - cachedCodeQL = await getCodeQLForCmd(cmd, true); + cachedCodeQL = await getCodeQLForCmd(logger, cmd, true); } return cachedCodeQL; } -async function getCodeQLForCmd(cmd, checkVersion) { +async function getCodeQLForCmd(logger, cmd, checkVersion) { const codeql = { getPath() { return cmd; @@ -151890,7 +151890,7 @@ async function getCodeQLForCmd(cmd, checkVersion) { async isScannedLanguage(language) { return !await this.isTracedLanguage(language); }, - async databaseInitCluster(config, sourceRoot, processName, qlconfigFile, logger) { + async databaseInitCluster(config, sourceRoot, processName, qlconfigFile) { const extraArgs = config.languages.map( (language) => `--language=${language}` ); @@ -152446,7 +152446,7 @@ async function setupCppAutobuild(codeql, logger) { } async function runAutobuild(config, language, logger) { logger.startGroup(`Attempting to automatically build ${language} code`); - const codeQL = await getCodeQL(config.codeQLCmd); + const codeQL = await getCodeQL(logger, config.codeQLCmd); if (language === "cpp" /* cpp */) { await setupCppAutobuild(codeQL, logger); } @@ -154786,7 +154786,7 @@ async function combineSarifFilesUsingCLI(sarifFiles, gitHubVersion, features, lo let tempDir = getTemporaryDirectory(); const config = await getConfig(tempDir, logger); if (config !== void 0) { - codeQL = await getCodeQL(config.codeQLCmd); + codeQL = await getCodeQL(logger, config.codeQLCmd); tempDir = config.tempDir; } else { logger.info( @@ -155523,7 +155523,7 @@ async function run({ startedAt, logger }) { "Config file could not be found at expected location. Has the 'init' action been called?" ); } - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); if (hasBadExpectErrorInput()) { throw new ConfigurationError( "`expect-error` input parameter is for internal use only. It should only be set by codeql-action or a fork." @@ -160646,7 +160646,7 @@ async function runWrapper2() { logger ); if (config !== void 0) { - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); const version = await codeql.getVersion(); await uploadCombinedSarifArtifacts( logger, @@ -160726,7 +160726,7 @@ async function run2({ startedAt, logger }) { "Config file could not be found at expected location. Has the 'init' action been called?" ); } - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); languages = await determineAutobuildLanguages(codeql, config, logger); if (languages !== void 0) { const workingDirectory = getOptionalInput("working-directory"); @@ -161616,6 +161616,7 @@ async function prepareFailedSarif(logger, features, config) { const category = `/language:${language}`; const checkoutPath = "."; const result = await generateFailedSarif( + logger, features, config, category, @@ -161636,6 +161637,7 @@ async function prepareFailedSarif(logger, features, config) { const category = getCategoryInputOrThrow(workflow, jobName, matrix); const checkoutPath = getCheckoutPathInputOrThrow(workflow, jobName, matrix); const result = await generateFailedSarif( + logger, features, config, category, @@ -161644,9 +161646,9 @@ async function prepareFailedSarif(logger, features, config) { return new Success(result); } } -async function generateFailedSarif(features, config, category, checkoutPath, sarifFile) { +async function generateFailedSarif(logger, features, config, category, checkoutPath, sarifFile) { const databasePath = config.dbLocation; - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); if (sarifFile === void 0) { sarifFile = "../codeql-failed-run.sarif"; } @@ -161912,7 +161914,7 @@ async function run4(startedAt) { "Debugging artifacts are unavailable since the 'init' Action failed before it could produce any." ); } else { - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); uploadFailedSarifResult = await uploadFailureInfo( tryUploadAllAvailableDebugArtifacts, printDebugLogs, @@ -162015,7 +162017,7 @@ var core23 = __toESM(require_core()); // src/resolve-environment.ts async function runResolveBuildEnvironment(cmd, logger, workingDir, language) { logger.startGroup(`Attempting to resolve build environment for ${language}`); - const codeql = await getCodeQL(cmd); + const codeql = await getCodeQL(logger, cmd); if (workingDir !== void 0) { logger.info(`Using ${workingDir} as the working directory.`); } diff --git a/src/analyze-action-post.ts b/src/analyze-action-post.ts index fe8fbea61c..732b52af19 100644 --- a/src/analyze-action-post.ts +++ b/src/analyze-action-post.ts @@ -38,7 +38,7 @@ export async function runWrapper() { logger, ); if (config !== undefined) { - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); const version = await codeql.getVersion(); await debugArtifacts.uploadCombinedSarifArtifacts( logger, diff --git a/src/analyze-action.ts b/src/analyze-action.ts index 5104719bc7..c3c2e40e7f 100644 --- a/src/analyze-action.ts +++ b/src/analyze-action.ts @@ -255,7 +255,7 @@ async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) { ); } - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); if (hasBadExpectErrorInput()) { throw new util.ConfigurationError( diff --git a/src/autobuild-action.ts b/src/autobuild-action.ts index b78bffb9d8..9fa8016578 100644 --- a/src/autobuild-action.ts +++ b/src/autobuild-action.ts @@ -99,7 +99,7 @@ async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) { ); } - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); languages = await determineAutobuildLanguages(codeql, config, logger); if (languages !== undefined) { diff --git a/src/autobuild.ts b/src/autobuild.ts index 7ec6ba9873..49b790102d 100644 --- a/src/autobuild.ts +++ b/src/autobuild.ts @@ -155,7 +155,7 @@ export async function runAutobuild( logger: Logger, ) { logger.startGroup(`Attempting to automatically build ${language} code`); - const codeQL = await getCodeQL(config.codeQLCmd); + const codeQL = await getCodeQL(logger, config.codeQLCmd); if (language === BuiltInLanguage.cpp) { await setupCppAutobuild(codeQL, logger); } diff --git a/src/codeql.ts b/src/codeql.ts index a29df90865..10e44a5b58 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -23,7 +23,7 @@ import { } from "./feature-flags"; import { isAnalyzingDefaultBranch } from "./git-utils"; import { Language } from "./languages"; -import { Logger } from "./logging"; +import { getRunnerLogger, Logger } from "./logging"; import { writeBaseDatabaseOidsFile, writeOverlayChangesFile } from "./overlay"; import { OverlayDatabaseMode } from "./overlay/overlay-database-mode"; import * as setupCodeql from "./setup-codeql"; @@ -346,7 +346,7 @@ export async function setupCodeQL( ); } - cachedCodeQL = await getCodeQLForCmd(codeqlCmd, checkVersion); + cachedCodeQL = await getCodeQLForCmd(logger, codeqlCmd, checkVersion); return { codeql: cachedCodeQL, toolsDownloadStatusReport, @@ -372,9 +372,9 @@ export async function setupCodeQL( /** * Use the CodeQL executable located at the given path. */ -export async function getCodeQL(cmd: string): Promise { +export async function getCodeQL(logger: Logger, cmd: string): Promise { if (cachedCodeQL === undefined) { - cachedCodeQL = await getCodeQLForCmd(cmd, true); + cachedCodeQL = await getCodeQLForCmd(logger, cmd, true); } return cachedCodeQL; } @@ -481,8 +481,9 @@ export function createStubCodeQL(partialCodeql: Partial): CodeQL { */ export async function getCodeQLForTesting( cmd = "codeql-for-testing", + logger: Logger = getRunnerLogger(true), ): Promise { - return getCodeQLForCmd(cmd, false); + return getCodeQLForCmd(logger, cmd, false); } /** @@ -494,6 +495,7 @@ export async function getCodeQLForTesting( * @returns A new CodeQL object */ async function getCodeQLForCmd( + logger: Logger, cmd: string, checkVersion: boolean, ): Promise { @@ -539,7 +541,6 @@ async function getCodeQLForCmd( sourceRoot: string, processName: string | undefined, qlconfigFile: string | undefined, - logger: Logger, ) { const extraArgs = config.languages.map( (language) => `--language=${language}`, diff --git a/src/init-action-post-helper.ts b/src/init-action-post-helper.ts index 23695b6d1c..7b7b056a1c 100644 --- a/src/init-action-post-helper.ts +++ b/src/init-action-post-helper.ts @@ -123,6 +123,7 @@ async function prepareFailedSarif( const category = `/language:${language}`; const checkoutPath = "."; const result = await generateFailedSarif( + logger, features, config, category, @@ -146,6 +147,7 @@ async function prepareFailedSarif( const checkoutPath = getCheckoutPathInputOrThrow(workflow, jobName, matrix); const result = await generateFailedSarif( + logger, features, config, category, @@ -156,6 +158,7 @@ async function prepareFailedSarif( } async function generateFailedSarif( + logger: Logger, features: FeatureEnablement, config: Config, category: string | undefined, @@ -163,7 +166,7 @@ async function generateFailedSarif( sarifFile?: string, ) { const databasePath = config.dbLocation; - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); // Set the filename for the SARIF file if not already set. if (sarifFile === undefined) { diff --git a/src/init-action-post.ts b/src/init-action-post.ts index b407cfb99e..2261b56ea6 100644 --- a/src/init-action-post.ts +++ b/src/init-action-post.ts @@ -75,7 +75,7 @@ async function run(startedAt: Date) { "Debugging artifacts are unavailable since the 'init' Action failed before it could produce any.", ); } else { - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); uploadFailedSarifResult = await initActionPostHelper.uploadFailureInfo( debugArtifacts.tryUploadAllAvailableDebugArtifacts, diff --git a/src/resolve-environment.ts b/src/resolve-environment.ts index d202efa83e..3a1a6ca6bf 100644 --- a/src/resolve-environment.ts +++ b/src/resolve-environment.ts @@ -9,7 +9,7 @@ export async function runResolveBuildEnvironment( ) { logger.startGroup(`Attempting to resolve build environment for ${language}`); - const codeql = await getCodeQL(cmd); + const codeql = await getCodeQL(logger, cmd); if (workingDir !== undefined) { logger.info(`Using ${workingDir} as the working directory.`); diff --git a/src/upload-lib.ts b/src/upload-lib.ts index 83d1eaffb0..da5552cf24 100644 --- a/src/upload-lib.ts +++ b/src/upload-lib.ts @@ -140,7 +140,7 @@ async function combineSarifFilesUsingCLI( const config = await getConfig(tempDir, logger); if (config !== undefined) { - codeQL = await getCodeQL(config.codeQLCmd); + codeQL = await getCodeQL(logger, config.codeQLCmd); tempDir = config.tempDir; } else { logger.info( From 38055a3c3cf3979323eaf70fc6c73a8690250bde Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 12 Aug 2026 16:49:45 +0100 Subject: [PATCH 17/24] Drop `logger` from `databaseInitCluster` in interface --- lib/entry-points.js | 11 ++++------- src/codeql.test.ts | 4 ---- src/codeql.ts | 1 - src/init-action.ts | 2 -- src/init.ts | 2 -- 5 files changed, 4 insertions(+), 16 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index c6292e61a1..841c13bf48 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -154473,7 +154473,7 @@ async function initConfig2(actionState, inputs) { return await initConfig(actionState, inputs); }); } -async function runDatabaseInitCluster(databaseInitEnvironment, codeql, config, sourceRoot, processName, qlconfigFile, logger) { +async function runDatabaseInitCluster(databaseInitEnvironment, codeql, config, sourceRoot, processName, qlconfigFile) { fs19.mkdirSync(config.dbLocation, { recursive: true }); await wrapEnvironment( databaseInitEnvironment, @@ -154481,8 +154481,7 @@ async function runDatabaseInitCluster(databaseInitEnvironment, codeql, config, s config, sourceRoot, processName, - qlconfigFile, - logger + qlconfigFile ) ); } @@ -161496,8 +161495,7 @@ exec ${goBinaryPath} "$@"` config, sourceRoot, "Runner.Worker.exe", - qlconfigFile, - logger + qlconfigFile ); if (config.overlayDatabaseMode !== "none" /* None */ && !await checkPacksForOverlayCompatibility(codeql, config, logger)) { logger.info( @@ -161513,8 +161511,7 @@ exec ${goBinaryPath} "$@"` config, sourceRoot, "Runner.Worker.exe", - qlconfigFile, - logger + qlconfigFile ); } const tracerConfig = await getCombinedTracerConfig(codeql, config); diff --git a/src/codeql.test.ts b/src/codeql.test.ts index 84f48b83c9..e8208888e7 100644 --- a/src/codeql.test.ts +++ b/src/codeql.test.ts @@ -580,7 +580,6 @@ const injectedConfigMacro = makeMacro({ "", undefined, undefined, - getRunnerLogger(true), ); const args = runnerConstructorStub.firstCall.args[1] as string[]; @@ -856,7 +855,6 @@ test.serial( "", undefined, "/path/to/qlconfig.yml", - getRunnerLogger(true), ); const args = runnerConstructorStub.firstCall.args[1] as string[]; @@ -887,7 +885,6 @@ test.serial( "", undefined, undefined, // undefined qlconfigFile - getRunnerLogger(true), ); const args = runnerConstructorStub.firstCall.args[1] as any[]; @@ -1066,7 +1063,6 @@ test.serial( "sourceRoot", undefined, undefined, - getRunnerLogger(false), ); t.true(runnerConstructorStub.calledOnce); diff --git a/src/codeql.ts b/src/codeql.ts index 10e44a5b58..9b064620eb 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -91,7 +91,6 @@ export interface CodeQL { sourceRoot: string, processName: string | undefined, qlconfigFile: string | undefined, - logger: Logger, ): Promise; /** * Runs the autobuilder for the given language. diff --git a/src/init-action.ts b/src/init-action.ts index 00143df427..6b5ed392ef 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -689,7 +689,6 @@ async function run( sourceRoot, "Runner.Worker.exe", qlconfigFile, - logger, ); // To check custom query packs for compatibility with overlay analysis, we @@ -718,7 +717,6 @@ async function run( sourceRoot, "Runner.Worker.exe", qlconfigFile, - logger, ); } diff --git a/src/init.ts b/src/init.ts index dee62913c2..c6a258e58c 100644 --- a/src/init.ts +++ b/src/init.ts @@ -89,7 +89,6 @@ export async function runDatabaseInitCluster( sourceRoot: string, processName: string | undefined, qlconfigFile: string | undefined, - logger: Logger, ): Promise { fs.mkdirSync(config.dbLocation, { recursive: true }); await configUtils.wrapEnvironment( @@ -100,7 +99,6 @@ export async function runDatabaseInitCluster( sourceRoot, processName, qlconfigFile, - logger, ), ); } From ab5db2519c3344f2fa61c711fa2d6ad135829200 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 17:54:58 +0000 Subject: [PATCH 18/24] Bump the npm-minor group across 1 directory with 8 updates Bumps the npm-minor group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@octokit/core](https://github.com/octokit/core.js) | `7.0.6` | `7.0.7` | | [@octokit/plugin-retry](https://github.com/octokit/plugin-retry.js) | `8.1.0` | `8.1.1` | | [@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver) | `7.7.1` | `7.8.0` | | [eslint-plugin-github](https://github.com/github/eslint-plugin-github) | `6.1.1` | `6.1.2` | | [globals](https://github.com/sindresorhus/globals) | `17.8.0` | `17.9.0` | | [nock](https://github.com/nock/nock) | `14.0.16` | `14.0.17` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.65.0` | `8.66.0` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.8` | Updates `@octokit/core` from 7.0.6 to 7.0.7 - [Release notes](https://github.com/octokit/core.js/releases) - [Commits](https://github.com/octokit/core.js/compare/v7.0.6...v7.0.7) Updates `@octokit/plugin-retry` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/octokit/plugin-retry.js/releases) - [Commits](https://github.com/octokit/plugin-retry.js/compare/v8.1.0...v8.1.1) Updates `@types/semver` from 7.7.1 to 7.8.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver) Updates `eslint-plugin-github` from 6.1.1 to 6.1.2 - [Release notes](https://github.com/github/eslint-plugin-github/releases) - [Commits](https://github.com/github/eslint-plugin-github/compare/v6.1.1...v6.1.2) Updates `globals` from 17.8.0 to 17.9.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0) Updates `nock` from 14.0.16 to 14.0.17 - [Release notes](https://github.com/nock/nock/releases) - [Changelog](https://github.com/nock/nock/blob/main/CHANGELOG.md) - [Commits](https://github.com/nock/nock/compare/v14.0.16...v14.0.17) Updates `typescript-eslint` from 8.65.0 to 8.66.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.66.0/packages/typescript-eslint) Updates `tsx` from 4.23.1 to 4.23.8 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](https://github.com/privatenumber/tsx/compare/v4.23.1...v4.23.8) --- updated-dependencies: - dependency-name: "@octokit/core" dependency-version: 7.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@octokit/plugin-retry" dependency-version: 8.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@types/semver" dependency-version: 7.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: eslint-plugin-github dependency-version: 6.1.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: globals dependency-version: 17.9.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: nock dependency-version: 14.0.17 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: typescript-eslint dependency-version: 8.66.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: tsx dependency-version: 4.23.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] --- package-lock.json | 439 ++++++++++++++++++++++------------------- package.json | 14 +- pr-checks/package.json | 4 +- 3 files changed, 246 insertions(+), 211 deletions(-) diff --git a/package-lock.json b/package-lock.json index e9081aee73..50ebd990cd 100644 --- a/package-lock.json +++ b/package-lock.json @@ -22,10 +22,10 @@ "@actions/http-client": "^3.0.0", "@actions/io": "^2.0.0", "@actions/tool-cache": "^3.0.1", - "@octokit/core": "^7.0.6", + "@octokit/core": "^7.0.7", "@octokit/plugin-paginate-rest": "^14.0.0", "@octokit/plugin-rest-endpoint-methods": "^17.0.0", - "@octokit/plugin-retry": "^8.1.0", + "@octokit/plugin-retry": "^8.1.1", "archiver": "^8.0.0", "fast-deep-equal": "^3.1.3", "follow-redirects": "^1.16.0", @@ -50,22 +50,22 @@ "@types/node": "^20.19.43", "@types/node-forge": "^1.3.14", "@types/sarif": "^2.1.7", - "@types/semver": "^7.7.1", + "@types/semver": "^7.8.0", "@types/sinon": "^22.0.0", "ava": "^6.4.1", "esbuild": "^0.28.1", "eslint": "^9.39.5", "eslint-import-resolver-typescript": "^4.4.5", - "eslint-plugin-github": "^6.1.1", + "eslint-plugin-github": "^6.1.2", "eslint-plugin-import-x": "^4.17.1", "eslint-plugin-jsdoc": "^62.9.0", "eslint-plugin-no-async-foreach": "^0.1.1", "glob": "^13.0.6", - "globals": "^17.8.0", - "nock": "^14.0.16", + "globals": "^17.9.0", + "nock": "^14.0.17", "sinon": "^22.1.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.65.0" + "typescript-eslint": "^8.66.0" } }, "node_modules/@aashutoshrathi/word-wrap": { @@ -1498,9 +1498,9 @@ } }, "node_modules/@eslint/eslintrc": { - "version": "3.3.5", - "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.5.tgz", - "integrity": "sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==", + "version": "3.3.6", + "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.6.tgz", + "integrity": "sha512-l2Ul9PrHsPCKcEY/ac7VgFj9D80C7S68sOKc618SyHDPK36s1XcFebXY0iTzUVn4Yq+YbwvSnDmCz9yxjX+QrA==", "dev": true, "license": "MIT", "dependencies": { @@ -1510,7 +1510,7 @@ "globals": "^14.0.0", "ignore": "^5.2.0", "import-fresh": "^3.2.1", - "js-yaml": "^4.1.1", + "js-yaml": "^4.3.0", "minimatch": "^3.1.5", "strip-json-comments": "^3.1.1" }, @@ -1526,6 +1526,7 @@ "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz", "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==", "dev": true, + "license": "MIT", "engines": { "node": ">=18" }, @@ -1534,9 +1535,9 @@ } }, "node_modules/@eslint/eslintrc/node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "dev": true, "funding": [ { @@ -2086,16 +2087,16 @@ } }, "node_modules/@octokit/core": { - "version": "7.0.6", - "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz", - "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==", + "version": "7.0.7", + "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.7.tgz", + "integrity": "sha512-DcB0M3KFgr9ECI328lhBMVsyFT2DnmNucSBTqEN3exyNKUzkkpUSCHmTRcunF41Eou2TIQKW4seewri8ON9bSA==", "license": "MIT", "dependencies": { "@octokit/auth-token": "^6.0.0", - "@octokit/graphql": "^9.0.3", - "@octokit/request": "^10.0.6", - "@octokit/request-error": "^7.0.2", - "@octokit/types": "^16.0.0", + "@octokit/graphql": "^9.0.4", + "@octokit/request": "^10.0.13", + "@octokit/request-error": "^7.1.1", + "@octokit/types": "^17.0.0", "before-after-hook": "^4.0.0", "universal-user-agent": "^7.0.0" }, @@ -2103,6 +2104,21 @@ "node": ">= 20" } }, + "node_modules/@octokit/core/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/core/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, "node_modules/@octokit/core/node_modules/universal-user-agent": { "version": "7.0.3", "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz", @@ -2110,18 +2126,33 @@ "license": "ISC" }, "node_modules/@octokit/endpoint": { - "version": "11.0.2", - "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.2.tgz", - "integrity": "sha512-4zCpzP1fWc7QlqunZ5bSEjxc6yLAlRTnDwKtgXfcI/FxxGoqedDG8V2+xJ60bV2kODqcGB+nATdtap/XYq2NZQ==", + "version": "11.0.4", + "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.4.tgz", + "integrity": "sha512-f1cOWoHPmxryJFknxbtDdjODWfV8A9tc8Aae6ermXPNgHFZ/x91AtHIz4gicEjL8hkJiip+u21QHJORfBv/qiA==", "license": "MIT", "dependencies": { - "@octokit/types": "^16.0.0", + "@octokit/types": "^17.0.0", "universal-user-agent": "^7.0.2" }, "engines": { "node": ">= 20" } }, + "node_modules/@octokit/endpoint/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/endpoint/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, "node_modules/@octokit/endpoint/node_modules/universal-user-agent": { "version": "7.0.3", "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz", @@ -2129,19 +2160,34 @@ "license": "ISC" }, "node_modules/@octokit/graphql": { - "version": "9.0.3", - "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz", - "integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==", + "version": "9.0.4", + "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.4.tgz", + "integrity": "sha512-5s15CCiY8XXQ+FG+b1YQcl6Z2FA++nwAz/tg2VUrTmnMncP+2nnGUEYANImdnxsA2Fnq+Mbl7hDjUTw7cFAwcg==", "license": "MIT", "dependencies": { - "@octokit/request": "^10.0.6", - "@octokit/types": "^16.0.0", + "@octokit/request": "^10.0.13", + "@octokit/types": "^17.0.0", "universal-user-agent": "^7.0.0" }, "engines": { "node": ">= 20" } }, + "node_modules/@octokit/graphql/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/graphql/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, "node_modules/@octokit/graphql/node_modules/universal-user-agent": { "version": "7.0.3", "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz", @@ -2194,13 +2240,13 @@ } }, "node_modules/@octokit/plugin-retry": { - "version": "8.1.0", - "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-8.1.0.tgz", - "integrity": "sha512-O1FZgXeiGb2sowEr/hYTr6YunGdSAFWnr2fyW39Ah85H8O33ELASQxcvOFF5LE6Tjekcyu2ms4qAzJVhSaJxTw==", + "version": "8.1.1", + "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-8.1.1.tgz", + "integrity": "sha512-VCVvZ/R1+u3WuiBWpNavZ0mY4aaJNAsENrpBP9aLSR2QyOpQgd7DhM5j4AW7z4MQpnJYgwBPf0XqPQoNBRdQwg==", "license": "MIT", "dependencies": { - "@octokit/request-error": "^7.0.2", - "@octokit/types": "^16.0.0", + "@octokit/request-error": "^7.1.1", + "@octokit/types": "^17.0.0", "bottleneck": "^2.15.3" }, "engines": { @@ -2210,16 +2256,32 @@ "@octokit/core": ">=7" } }, + "node_modules/@octokit/plugin-retry/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/plugin-retry/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, "node_modules/@octokit/request": { - "version": "10.0.7", - "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.7.tgz", - "integrity": "sha512-v93h0i1yu4idj8qFPZwjehoJx4j3Ntn+JhXsdJrG9pYaX6j/XRz2RmasMUHtNgQD39nrv/VwTWSqK0RNXR8upA==", + "version": "10.0.13", + "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.13.tgz", + "integrity": "sha512-v2269YxL9Yf+x3d+gRI63FP0vFQEiWgLyBzxe/Y+0yFDg2B/Tzf5dhh9VNfccVAQnfcfwQWyk/y6Bn7rUXXs7A==", "license": "MIT", "dependencies": { - "@octokit/endpoint": "^11.0.2", - "@octokit/request-error": "^7.0.2", - "@octokit/types": "^16.0.0", - "fast-content-type-parse": "^3.0.0", + "@octokit/endpoint": "^11.0.3", + "@octokit/request-error": "^7.1.1", + "@octokit/types": "^17.0.0", + "content-type": "^2.0.0", + "json-with-bigint": "^3.5.3", "universal-user-agent": "^7.0.2" }, "engines": { @@ -2227,17 +2289,47 @@ } }, "node_modules/@octokit/request-error": { - "version": "7.1.0", - "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz", - "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==", + "version": "7.1.1", + "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.1.tgz", + "integrity": "sha512-+eaY7G2VVpSf2pc5Gn1+mph837V/d/TYTJAgWL9Tb0ogGYcpN3IlAVFgjL+Vv93F/sevrxkvsYCedtpLdcFLzA==", "license": "MIT", "dependencies": { - "@octokit/types": "^16.0.0" + "@octokit/types": "^17.0.0" }, "engines": { "node": ">= 20" } }, + "node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/request-error/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, + "node_modules/@octokit/request/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/request/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, "node_modules/@octokit/request/node_modules/universal-user-agent": { "version": "7.0.3", "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz", @@ -2569,9 +2661,9 @@ "license": "MIT" }, "node_modules/@types/semver": { - "version": "7.7.1", - "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.7.1.tgz", - "integrity": "sha512-FmgJfu+MOcQ370SD0ev7EI8TlCAfKYU+B4m5T3yXc1CiRN94g/SZPtsCkk506aUDtlMnFZvasDwHHUcZUEaYuA==", + "version": "7.8.0", + "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.8.0.tgz", + "integrity": "sha512-1mAINjtQCXXeLkJ9ehXkwOcBpqtLxiVtKhpUf83DdRNdQKV0iXZpaHYqRr7nj+wvxuJzoAmAwXI+sCNMv1CzLQ==", "dev": true, "license": "MIT" }, @@ -2591,17 +2683,17 @@ "license": "MIT" }, "node_modules/@typescript-eslint/eslint-plugin": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.65.0.tgz", - "integrity": "sha512-IEgob78X12rHpUmtcwFsXhZdVGJtwTVP8FiCLZkR6GlYVrl2PcuB+KhCE5BlVC/eQpQnu8WXRtkHZuPar+gCRA==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.66.0.tgz", + "integrity": "sha512-p088eaGrzYz1s+7cov0aMOCkNGTJlVxF4jgubf28c8L0Cv9Rloj8YBHnv4hXLq6IIEE1AsjNWavO+k+8kP2Y0A==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/regexpp": "^4.12.2", - "@typescript-eslint/scope-manager": "8.65.0", - "@typescript-eslint/type-utils": "8.65.0", - "@typescript-eslint/utils": "8.65.0", - "@typescript-eslint/visitor-keys": "8.65.0", + "@typescript-eslint/scope-manager": "8.66.0", + "@typescript-eslint/type-utils": "8.66.0", + "@typescript-eslint/utils": "8.66.0", + "@typescript-eslint/visitor-keys": "8.66.0", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" @@ -2614,7 +2706,7 @@ "url": "https://opencollective.com/typescript-eslint" }, "peerDependencies": { - "@typescript-eslint/parser": "^8.65.0", + "@typescript-eslint/parser": "^8.66.0", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } @@ -2630,16 +2722,16 @@ } }, "node_modules/@typescript-eslint/parser": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.65.0.tgz", - "integrity": "sha512-CZ4nMxWwgu1HEEFNkeaCptra9QCtkmKdgf3sWh1rl1trIhmxLilgTV4cwcbQ4wemnT4sWQN8CaKOmdYx+g2gMA==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.66.0.tgz", + "integrity": "sha512-X6ypGChaWYk6PBtUg2BwuTZEFFcHJAtGTVJ9/lCTOufhZ4i9fNolQNnktq+kkMCwMj7V8Svsq7+TxSDslmhE0g==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/scope-manager": "8.65.0", - "@typescript-eslint/types": "8.65.0", - "@typescript-eslint/typescript-estree": "8.65.0", - "@typescript-eslint/visitor-keys": "8.65.0", + "@typescript-eslint/scope-manager": "8.66.0", + "@typescript-eslint/types": "8.66.0", + "@typescript-eslint/typescript-estree": "8.66.0", + "@typescript-eslint/visitor-keys": "8.66.0", "debug": "^4.4.3" }, "engines": { @@ -2673,14 +2765,14 @@ } }, "node_modules/@typescript-eslint/project-service": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.65.0.tgz", - "integrity": "sha512-SxnPhbTsGahizDgbu7oqFH/xVtzIqMd/s+WtnSxNxJZJpLbdT5IPdzg8EZxO3+PoKahXmwJLeNQOpKJb3/bi7Q==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.66.0.tgz", + "integrity": "sha512-7MthGPTt4BP69lSryqpqq8HQqxuzynssckL/jyDyk3+TNMQ3y2jFWkptCrktWvBrP+EH787Nl5N5Qpw7WZg+5g==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/tsconfig-utils": "^8.65.0", - "@typescript-eslint/types": "^8.65.0", + "@typescript-eslint/tsconfig-utils": "^8.66.0", + "@typescript-eslint/types": "^8.66.0", "debug": "^4.4.3" }, "engines": { @@ -2713,14 +2805,14 @@ } }, "node_modules/@typescript-eslint/scope-manager": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.65.0.tgz", - "integrity": "sha512-Esbl8OSYiVxBokYgWPf7VVWg/BE798wXhimnn9ML9Pt5qoDf8bfQlgjlKXR/k98+AcNzlLKYrpCcrcuZ9DZLgg==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.66.0.tgz", + "integrity": "sha512-8TGcH25j9zqJ/IULB/ppyhRvxA8QYfFEZ7nfbg6/BN9spDgb8fPWQXlE5l8TWBL50EtUx007uZ1o9VOwrq2/9g==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.65.0", - "@typescript-eslint/visitor-keys": "8.65.0" + "@typescript-eslint/types": "8.66.0", + "@typescript-eslint/visitor-keys": "8.66.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2731,9 +2823,9 @@ } }, "node_modules/@typescript-eslint/tsconfig-utils": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.65.0.tgz", - "integrity": "sha512-j6GzGqCiRdA7Qhur2VVmKZAkBLfnHFQfx4TaJGL9RMveZqCo48jSHHO0DTgizEnGhtWnqmbtCUSrqSkdiY/0Hg==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.66.0.tgz", + "integrity": "sha512-9D5gLYZG4rOjcoag8MQ/fWI8WqA9wcPDyOGyWtWFhvM1lHRbliqUSPIY5J3zqCU1tvSwzXxnnjhQhz5Ne7mJ4g==", "dev": true, "license": "MIT", "engines": { @@ -2748,15 +2840,15 @@ } }, "node_modules/@typescript-eslint/type-utils": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.65.0.tgz", - "integrity": "sha512-YjaZ7PRI5qY7ax2L3PbvX0rRyGtipAReCWs0mhhDBHjH/vl0g0BonaGXrKdKpMbIIsMIwDgbk/xzkBTyAltS5g==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.66.0.tgz", + "integrity": "sha512-LG2dWfjZQQp0ADtAu/EWJVayefGL2UEZ3CDeI44D9v3rXB/WYUqE/jpO28KrEKul5AySrmI+Zh1v6v+xW2U9+g==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.65.0", - "@typescript-eslint/typescript-estree": "8.65.0", - "@typescript-eslint/utils": "8.65.0", + "@typescript-eslint/types": "8.66.0", + "@typescript-eslint/typescript-estree": "8.66.0", + "@typescript-eslint/utils": "8.66.0", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, @@ -2791,9 +2883,9 @@ } }, "node_modules/@typescript-eslint/types": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.65.0.tgz", - "integrity": "sha512-JSSwWNy+H0E/01jJEM+hrX6N0OFDzFzeIhHFSAS01tlVaevpG8cFyYRPhS5yjGOvBUx3sqQHVMjCL1CAZZMxBg==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.66.0.tgz", + "integrity": "sha512-H6gcYaSDOyvL3AD/jHUtUFo2jqGgn/F6nuyuZSu0QTesxL+cP4dQoIMrODRofuJC09g64+WgZ6tE19Y1N2YIFQ==", "dev": true, "license": "MIT", "engines": { @@ -2805,16 +2897,16 @@ } }, "node_modules/@typescript-eslint/typescript-estree": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.65.0.tgz", - "integrity": "sha512-JboAE2swaYt4tb1fHhHTABE2K+OLy09XfcTbhnk4Pw96f9dd2e9iYsJ28gBggHlo5z5x1rkyWvcPoTuNTd4oGg==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.66.0.tgz", + "integrity": "sha512-8/x4INiiQb10jGgXYD7116/zQ+OL84ZIFn0za68wwFHCanT/VLbBEroWht8RV8fn0/ZCAoazHLQgwUC0UQcDfg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.65.0", - "@typescript-eslint/tsconfig-utils": "8.65.0", - "@typescript-eslint/types": "8.65.0", - "@typescript-eslint/visitor-keys": "8.65.0", + "@typescript-eslint/project-service": "8.66.0", + "@typescript-eslint/tsconfig-utils": "8.66.0", + "@typescript-eslint/types": "8.66.0", + "@typescript-eslint/visitor-keys": "8.66.0", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", @@ -2890,16 +2982,16 @@ } }, "node_modules/@typescript-eslint/utils": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.65.0.tgz", - "integrity": "sha512-gXiwIHsYreboxeJucHKPvgwl7dXt50mF8s1/c00cP/WoVTyWKFdtfhRWwZiXYFU5H2O8vVoSLNrexFZjYS/SGA==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.66.0.tgz", + "integrity": "sha512-jasearZPolBw5NJNYGMwxzHMF83niVWmMU1VdHzG1CyfI2VS7f7nZltnKtHcg20hW+7Uo5GfK4MeDPoU3qI8EA==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", - "@typescript-eslint/scope-manager": "8.65.0", - "@typescript-eslint/types": "8.65.0", - "@typescript-eslint/typescript-estree": "8.65.0" + "@typescript-eslint/scope-manager": "8.66.0", + "@typescript-eslint/types": "8.66.0", + "@typescript-eslint/typescript-estree": "8.66.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2914,13 +3006,13 @@ } }, "node_modules/@typescript-eslint/visitor-keys": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.65.0.tgz", - "integrity": "sha512-8C71BQkGjiMmXtop7pHVJu1l2NNShFdkCyD6a2ezzs5vU/L3LRtb69EtcteFwz0mYMPzIgOw0n6OV4VBUWZd7A==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.66.0.tgz", + "integrity": "sha512-dkKR8q+lKciskj1Y3vthHktl+3cMLWGyVUP23bRiPZ5O9BRT++4EqDDV+TVeIKBL1VXVEqrJlz8MYbcnvJcAlg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.65.0", + "@typescript-eslint/types": "8.66.0", "eslint-visitor-keys": "^5.0.0" }, "engines": { @@ -4293,6 +4385,19 @@ "node": "^14.18.0 || >=16.10.0" } }, + "node_modules/content-type": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz", + "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==", + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, "node_modules/convert-to-spaces": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/convert-to-spaces/-/convert-to-spaces-2.0.1.tgz", @@ -4988,15 +5093,15 @@ } }, "node_modules/eslint-plugin-github": { - "version": "6.1.1", - "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-6.1.1.tgz", - "integrity": "sha512-xCqu1S/s/CCvoRLafaXNvwiVrxhroNOFLGyG9Dhi4i1PWZgPHlipjXysH6wccPFQyhSKE7gAjSLqdSdM204bZQ==", + "version": "6.1.2", + "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-6.1.2.tgz", + "integrity": "sha512-XU1fVItfnwYWXG0GqH0MV2VY9EzvgbPxDnUJ9I1915Cpn24z13Vgx1pttrdQy6bhLmDYp+Wl7pX/L1YMKdG+6g==", "dev": true, "license": "MIT", "dependencies": { "@eslint/compat": "^2.0.0", - "@eslint/eslintrc": "^3.1.0", - "@eslint/js": "^9.14.0", + "@eslint/eslintrc": "^3.3.6", + "@eslint/js": "^9.39.5", "@github/browserslist-config": "^1.0.0", "@typescript-eslint/eslint-plugin": "^8.0.0", "@typescript-eslint/parser": "^8.0.0", @@ -5391,30 +5496,6 @@ "node": "^18.18.0 || ^20.9.0 || >=21.1.0" } }, - "node_modules/eslint/node_modules/@eslint/eslintrc": { - "version": "3.3.6", - "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.6.tgz", - "integrity": "sha512-l2Ul9PrHsPCKcEY/ac7VgFj9D80C7S68sOKc618SyHDPK36s1XcFebXY0iTzUVn4Yq+YbwvSnDmCz9yxjX+QrA==", - "dev": true, - "license": "MIT", - "dependencies": { - "ajv": "^6.14.0", - "debug": "^4.3.2", - "espree": "^10.0.1", - "globals": "^14.0.0", - "ignore": "^5.2.0", - "import-fresh": "^3.2.1", - "js-yaml": "^4.3.0", - "minimatch": "^3.1.5", - "strip-json-comments": "^3.1.1" - }, - "engines": { - "node": "^18.18.0 || ^20.9.0 || >=21.1.0" - }, - "funding": { - "url": "https://opencollective.com/eslint" - } - }, "node_modules/eslint/node_modules/ansi-styles": { "version": "4.2.1", "dev": true, @@ -5480,42 +5561,6 @@ "node": ">=10.13.0" } }, - "node_modules/eslint/node_modules/globals": { - "version": "14.0.0", - "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz", - "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=18" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/eslint/node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/puzrin" - }, - { - "type": "github", - "url": "https://github.com/sponsors/nodeca" - } - ], - "license": "MIT", - "dependencies": { - "argparse": "^2.0.1" - }, - "bin": { - "js-yaml": "bin/js-yaml.js" - } - }, "node_modules/espree": { "version": "10.4.0", "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz", @@ -5650,22 +5695,6 @@ "url": "https://github.com/sindresorhus/execa?sponsor=1" } }, - "node_modules/fast-content-type-parse": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-3.0.0.tgz", - "integrity": "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/fastify" - }, - { - "type": "opencollective", - "url": "https://opencollective.com/fastify" - } - ], - "license": "MIT" - }, "node_modules/fast-deep-equal": { "version": "3.1.3", "license": "MIT" @@ -6138,9 +6167,9 @@ } }, "node_modules/globals": { - "version": "17.8.0", - "resolved": "https://registry.npmjs.org/globals/-/globals-17.8.0.tgz", - "integrity": "sha512-Zz/LMDZScFmkakeL2cTHzf+PbWKdpU3uclqkZT7TjDG58j5WPt0PpA+n9uPI24fZtlw07q0OtEi84K+umsRzqQ==", + "version": "17.9.0", + "resolved": "https://registry.npmjs.org/globals/-/globals-17.9.0.tgz", + "integrity": "sha512-m/MvAW61QVU5VDNF1Vj8axt016h8w7L5TU1e9zlab7XIttAT2YAlCwl75K1fOqvMM9apmD7lbCIRhpfkhmxhCg==", "dev": true, "license": "MIT", "engines": { @@ -7044,6 +7073,12 @@ "dev": true, "license": "ISC" }, + "node_modules/json-with-bigint": { + "version": "3.5.10", + "resolved": "https://registry.npmjs.org/json-with-bigint/-/json-with-bigint-3.5.10.tgz", + "integrity": "sha512-Vcx+JVNEBts/xfcoCS69sKrOhOk/3TVlvlT+XzUOefVKnnrbYSCKpDCm10pohsJFtsJVYnwa/cXRZ4eElzaM6w==", + "license": "MIT" + }, "node_modules/json5": { "version": "1.0.2", "dev": true, @@ -7446,9 +7481,9 @@ "license": "MIT" }, "node_modules/nock": { - "version": "14.0.16", - "resolved": "https://registry.npmjs.org/nock/-/nock-14.0.16.tgz", - "integrity": "sha512-8r4KEc6nT1D/fdLD/R1BO1CPaVEL8o40u/guFRJlXabN7vr3RmMqyjsY5Krt0nMwhsOAwXQ/mtN5vy5Jh3aErg==", + "version": "14.0.17", + "resolved": "https://registry.npmjs.org/nock/-/nock-14.0.17.tgz", + "integrity": "sha512-EjRr1weMa4ALQX35AgZTEnP+weJJjlW1KGDiNM2IQC2069YDHas4f4B4UUYR+TTLyKWxJvOz2wObDKQs/LNreA==", "dev": true, "license": "MIT", "dependencies": { @@ -9168,9 +9203,9 @@ "license": "0BSD" }, "node_modules/tsx": { - "version": "4.23.1", - "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.1.tgz", - "integrity": "sha512-GQHnkIfxyx1wYCOS/wonik5MVRZU9hi1TEZmzGZSCJB1y9YgoZ8H6itNE/u4suE+yLmOzuE4E5S4TZ/ZX2wcWQ==", + "version": "4.23.8", + "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.8.tgz", + "integrity": "sha512-8W675THjbzfFmLOQzjDBIBna+WjqMGIxmSZ1mMc1+o9qoVsEuAgQu5j5ueLhau8inOkDu9OslVg0FmfBs1RIHw==", "dev": true, "license": "MIT", "dependencies": { @@ -9320,16 +9355,16 @@ } }, "node_modules/typescript-eslint": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.65.0.tgz", - "integrity": "sha512-/ggrHAwyjENDusvyxbuqxAC2dTnZg/Z8F+fgQtYIz+L6n/9HfSlEZcFGV/NsMNa6CkGk0xUjUAFwC0vHOflvIA==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.66.0.tgz", + "integrity": "sha512-QlEbBPz/RuJ1XUHj29nm3t0F/O/cSlEnntozqPOYHnnTGAXFamnMBu5i9Vn6vhUPHGAjR+Vl+5J8vPN/BMUrJw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/eslint-plugin": "8.65.0", - "@typescript-eslint/parser": "8.65.0", - "@typescript-eslint/typescript-estree": "8.65.0", - "@typescript-eslint/utils": "8.65.0" + "@typescript-eslint/eslint-plugin": "8.66.0", + "@typescript-eslint/parser": "8.66.0", + "@typescript-eslint/typescript-estree": "8.66.0", + "@typescript-eslint/utils": "8.66.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -9810,7 +9845,7 @@ "dependencies": { "@actions/core": "^2.0.3", "@actions/github": "^8.0.1", - "@octokit/core": "^7.0.6", + "@octokit/core": "^7.0.7", "@octokit/plugin-paginate-rest": ">=9.2.2", "@octokit/plugin-rest-endpoint-methods": "^17.0.0", "semver": "^7.8.5", @@ -9818,7 +9853,7 @@ }, "devDependencies": { "@types/node": "^20.19.43", - "tsx": "^4.23.1" + "tsx": "^4.23.8" } } } diff --git a/package.json b/package.json index 0e3d1c7e96..17229b4b7b 100644 --- a/package.json +++ b/package.json @@ -30,10 +30,10 @@ "@actions/http-client": "^3.0.0", "@actions/io": "^2.0.0", "@actions/tool-cache": "^3.0.1", - "@octokit/core": "^7.0.6", + "@octokit/core": "^7.0.7", "@octokit/plugin-paginate-rest": "^14.0.0", "@octokit/plugin-rest-endpoint-methods": "^17.0.0", - "@octokit/plugin-retry": "^8.1.0", + "@octokit/plugin-retry": "^8.1.1", "archiver": "^8.0.0", "fast-deep-equal": "^3.1.3", "follow-redirects": "^1.16.0", @@ -58,22 +58,22 @@ "@types/node": "^20.19.43", "@types/node-forge": "^1.3.14", "@types/sarif": "^2.1.7", - "@types/semver": "^7.7.1", + "@types/semver": "^7.8.0", "@types/sinon": "^22.0.0", "ava": "^6.4.1", "esbuild": "^0.28.1", "eslint": "^9.39.5", "eslint-import-resolver-typescript": "^4.4.5", - "eslint-plugin-github": "^6.1.1", + "eslint-plugin-github": "^6.1.2", "eslint-plugin-import-x": "^4.17.1", "eslint-plugin-jsdoc": "^62.9.0", "eslint-plugin-no-async-foreach": "^0.1.1", "glob": "^13.0.6", - "globals": "^17.8.0", - "nock": "^14.0.16", + "globals": "^17.9.0", + "nock": "^14.0.17", "sinon": "^22.1.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.65.0" + "typescript-eslint": "^8.66.0" }, "overrides": { "@actions/tool-cache": { diff --git a/pr-checks/package.json b/pr-checks/package.json index 07d599bb68..6c23d847f2 100644 --- a/pr-checks/package.json +++ b/pr-checks/package.json @@ -4,7 +4,7 @@ "dependencies": { "@actions/core": "^2.0.3", "@actions/github": "^8.0.1", - "@octokit/core": "^7.0.6", + "@octokit/core": "^7.0.7", "@octokit/plugin-paginate-rest": ">=9.2.2", "@octokit/plugin-rest-endpoint-methods": "^17.0.0", "semver": "^7.8.5", @@ -12,6 +12,6 @@ }, "devDependencies": { "@types/node": "^20.19.43", - "tsx": "^4.23.1" + "tsx": "^4.23.8" } } From b4d8a54218a8792de9af2f6f32e33af899ca5212 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 17:57:08 +0000 Subject: [PATCH 19/24] Rebuild --- lib/entry-points.js | 667 +++++++++++++++++++++++++++++++++++--------- 1 file changed, 530 insertions(+), 137 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index bbcd0690a0..c7b8eb6416 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -22251,7 +22251,7 @@ function isKeyOperator(operator) { function getValues(context5, operator, key, modifier) { var value = context5[key], result = []; if (isDefined(value) && value !== "") { - if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") { + if (typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean") { value = value.toString(); if (modifier && modifier !== "*") { value = value.substring(0, parseInt(modifier, 10)); @@ -22464,99 +22464,474 @@ var init_universal_user_agent3 = __esm({ } }); -// node_modules/fast-content-type-parse/index.js -var require_fast_content_type_parse = __commonJS({ - "node_modules/fast-content-type-parse/index.js"(exports2, module2) { +// node_modules/content-type/dist/index.js +var require_dist = __commonJS({ + "node_modules/content-type/dist/index.js"(exports2) { "use strict"; - var NullObject = function NullObject2() { - }; - NullObject.prototype = /* @__PURE__ */ Object.create(null); - var paramRE = /; *([!#$%&'*+.^\w`|~-]+)=("(?:[\v\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\v\u0020-\u00ff])*"|[!#$%&'*+.^\w`|~-]+) */gu; - var quotedPairRE = /\\([\v\u0020-\u00ff])/gu; - var mediaTypeRE = /^[!#$%&'*+.^\w|~-]+\/[!#$%&'*+.^\w|~-]+$/u; - var defaultContentType = { type: "", parameters: new NullObject() }; - Object.freeze(defaultContentType.parameters); - Object.freeze(defaultContentType); - function parse2(header) { - if (typeof header !== "string") { - throw new TypeError("argument header is required and must be a string"); - } - let index2 = header.indexOf(";"); - const type = index2 !== -1 ? header.slice(0, index2).trim() : header.trim(); - if (mediaTypeRE.test(type) === false) { - throw new TypeError("invalid media type"); - } - const result = { - type: type.toLowerCase(), - parameters: new NullObject() - }; - if (index2 === -1) { - return result; + Object.defineProperty(exports2, "__esModule", { value: true }); + exports2.format = format; + exports2.parse = parse3; + var TEXT_REGEXP = /^[\u0009\u0020-\u007e\u0080-\u00ff]*$/; + var TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/; + var QUOTE_REGEXP = /[\\"]/g; + var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/; + var NullObject = /* @__PURE__ */ (() => { + const C = function() { + }; + C.prototype = /* @__PURE__ */ Object.create(null); + return C; + })(); + function format(obj) { + const { type, parameters } = obj; + if (!type || !TYPE_REGEXP.test(type)) { + throw new TypeError(`Invalid type: ${type}`); } - let key; - let match2; - let value; - paramRE.lastIndex = index2; - while (match2 = paramRE.exec(header)) { - if (match2.index !== index2) { - throw new TypeError("invalid parameter format"); + let result = type; + if (parameters) { + for (const param of Object.keys(parameters)) { + if (!TOKEN_REGEXP.test(param)) { + throw new TypeError(`Invalid parameter name: ${param}`); + } + result += `; ${param}=${qstring(parameters[param])}`; } - index2 += match2[0].length; - key = match2[1].toLowerCase(); - value = match2[2]; - if (value[0] === '"') { - value = value.slice(1, value.length - 1); - quotedPairRE.test(value) && (value = value.replace(quotedPairRE, "$1")); + } + return result; + } + function parse3(header, options) { + const len = header.length; + let index2 = skipOWS(header, 0, len); + const valueStart = index2; + index2 = skipValue(header, index2, len); + const valueEnd = trailingOWS(header, valueStart, index2); + const type = header.slice(valueStart, valueEnd).toLowerCase(); + const parameters = options?.parameters === false ? new NullObject() : parseParameters(header, index2, len); + return { type, parameters }; + } + var SP = 32; + var HTAB = 9; + var SEMI = 59; + var EQ = 61; + var DQUOTE = 34; + var BSLASH = 92; + function parseParameters(header, index2, len) { + const parameters = new NullObject(); + parameter: while (index2 < len) { + index2 = skipOWS(header, index2 + 1, len); + const keyStart = index2; + while (index2 < len) { + const code = header.charCodeAt(index2); + if (code === SEMI) + continue parameter; + if (code === EQ) { + const keyEnd = trailingOWS(header, keyStart, index2); + const key = header.slice(keyStart, keyEnd).toLowerCase(); + index2 = skipOWS(header, index2 + 1, len); + if (index2 < len && header.charCodeAt(index2) === DQUOTE) { + index2++; + let value = ""; + while (index2 < len) { + const code2 = header.charCodeAt(index2++); + if (code2 === DQUOTE) { + index2 = skipValue(header, index2, len); + if (parameters[key] === void 0) + parameters[key] = value; + break; + } + if (code2 === BSLASH && index2 < len) { + value += header[index2++]; + continue; + } + value += String.fromCharCode(code2); + } + continue parameter; + } + const valueStart = index2; + index2 = skipValue(header, index2, len); + if (parameters[key] === void 0) { + const valueEnd = trailingOWS(header, valueStart, index2); + parameters[key] = header.slice(valueStart, valueEnd); + } + continue parameter; + } + index2++; } - result.parameters[key] = value; } - if (index2 !== header.length) { - throw new TypeError("invalid parameter format"); + return parameters; + } + function skipValue(str, index2, len) { + while (index2 < len) { + const char = str.charCodeAt(index2); + if (char === SEMI) + break; + index2++; } - return result; + return index2; } - function safeParse2(header) { - if (typeof header !== "string") { - return defaultContentType; + function skipOWS(header, index2, len) { + while (index2 < len) { + const char = header.charCodeAt(index2); + if (char !== SP && char !== HTAB) + break; + index2++; } - let index2 = header.indexOf(";"); - const type = index2 !== -1 ? header.slice(0, index2).trim() : header.trim(); - if (mediaTypeRE.test(type) === false) { - return defaultContentType; + return index2; + } + function trailingOWS(header, start, end) { + while (end > start) { + const char = header.charCodeAt(end - 1); + if (char !== SP && char !== HTAB) + break; + end--; } - const result = { - type: type.toLowerCase(), - parameters: new NullObject() + return end; + } + function qstring(str) { + if (TOKEN_REGEXP.test(str)) + return str; + if (TEXT_REGEXP.test(str)) + return `"${str.replace(QUOTE_REGEXP, "\\$&")}"`; + throw new TypeError(`Invalid parameter value: ${str}`); + } + } +}); + +// node_modules/json-with-bigint/json-with-bigint.js +var intRegex, noiseValue, originalStringify, originalParse, customFormat, bigIntsStringify, noiseStringify, isUnstringifiable, isRawJSON, stringifyIteratively, JSONStringify, featureCache, isContextSourceSupported, convertMarkedBigIntsReviver, JSONParseV2, MAX_INT, MAX_DIGITS, stringsOrLargeNumbers, noiseValueWithQuotes, applyReviverIteratively, serializeBigInts, JSONParse; +var init_json_with_bigint = __esm({ + "node_modules/json-with-bigint/json-with-bigint.js"() { + intRegex = /^-?\d+$/; + noiseValue = /^-?\d+n+$/; + originalStringify = JSON.stringify; + originalParse = JSON.parse; + customFormat = /^-?\d+n$/; + bigIntsStringify = /([\[:])?"(-?\d+)n"($|\s*[,\}\]])/g; + noiseStringify = /([\[:])?("-?\d+n+)n("$|"\s*[,\}\]])/g; + isUnstringifiable = (val) => val === void 0 || typeof val === "function" || typeof val === "symbol"; + isRawJSON = (val) => val !== null && typeof val === "object" && val.constructor && val.constructor.name === "RawJSON"; + stringifyIteratively = (rootValue, replacer, spaceParam) => { + let space2 = ""; + if (typeof spaceParam === "number") { + space2 = " ".repeat(Math.min(10, Math.max(0, Math.floor(spaceParam)))); + } else if (typeof spaceParam === "string") { + space2 = spaceParam.slice(0, 10); + } + const isFunctionReplacer = typeof replacer === "function"; + const propertyList = Array.isArray(replacer) ? new Set(replacer.map(String)) : null; + const prepareVal = (parent, key, val) => { + const isObject2 = val !== null && typeof val === "object"; + const hasToJSON = isObject2 && typeof val.toJSON === "function"; + if (hasToJSON) { + val = val.toJSON(key); + } + const isNoise = typeof val === "string" && noiseValue.test(val); + if (isNoise) return val + "n"; + const isBigInt = typeof val === "bigint"; + if (isBigInt) { + const supportsRawJSON = "rawJSON" in JSON; + if (supportsRawJSON) return JSON.rawJSON(val.toString()); + return val.toString() + "n"; + } + if (isFunctionReplacer) { + val = replacer.call(parent, key, val); + } + const isPostReplacerObject = val !== null && typeof val === "object"; + if (isPostReplacerObject) { + const isPrimitiveWrapper = val instanceof Number || val instanceof String || val instanceof Boolean; + if (isPrimitiveWrapper) { + val = val.valueOf(); + } + } + return val; }; - if (index2 === -1) { - return result; + const rootProcessed = prepareVal({ "": rootValue }, "", rootValue); + if (isUnstringifiable(rootProcessed)) { + return void 0; } - let key; - let match2; - let value; - paramRE.lastIndex = index2; - while (match2 = paramRE.exec(header)) { - if (match2.index !== index2) { - return defaultContentType; + const isRootPrimitive = rootProcessed === null || typeof rootProcessed !== "object"; + const isRootNativeRawJSON = isRawJSON(rootProcessed); + if (isRootPrimitive || isRootNativeRawJSON) { + return originalStringify(rootProcessed); + } + const chunks = []; + let level = 0; + const stack = [ + { + parent: { "": rootProcessed }, + key: "", + val: rootProcessed, + isArray: Array.isArray(rootProcessed), + keys: Array.isArray(rootProcessed) ? null : Object.keys(rootProcessed), + index: 0, + first: true + } + ]; + const visited = new WeakSet([rootProcessed]); + while (stack.length > 0) { + const node = stack[stack.length - 1]; + if (node.index === 0) { + chunks.push(node.isArray ? "[" : "{"); + level++; + } + let isDone = false; + if (node.isArray) { + if (node.index < node.val.length) { + if (!node.first) chunks.push(","); + if (space2) chunks.push("\n" + space2.repeat(level)); + const childRaw = node.val[node.index]; + const childVal = prepareVal(node.val, String(node.index), childRaw); + if (isUnstringifiable(childVal)) { + chunks.push("null"); + node.first = false; + node.index++; + } else { + const isComplexObject = childVal !== null && typeof childVal === "object"; + const isNativeRaw = isRawJSON(childVal); + if (isComplexObject && !isNativeRaw) { + if (visited.has(childVal)) { + throw new TypeError("Converting circular structure to JSON"); + } + visited.add(childVal); + stack.push({ + parent: node.val, + key: String(node.index), + val: childVal, + isArray: Array.isArray(childVal), + keys: Array.isArray(childVal) ? null : Object.keys(childVal), + index: 0, + first: true + }); + node.first = false; + node.index++; + } else { + chunks.push(originalStringify(childVal)); + node.first = false; + node.index++; + } + } + } else { + isDone = true; + } + } else { + while (node.index < node.keys.length) { + const k = node.keys[node.index++]; + const isFilteredOutByArray = propertyList && !propertyList.has(k); + if (isFilteredOutByArray) continue; + const childRaw = node.val[k]; + const childVal = prepareVal(node.val, k, childRaw); + if (isUnstringifiable(childVal)) continue; + if (!node.first) chunks.push(","); + if (space2) { + chunks.push("\n" + space2.repeat(level) + originalStringify(k) + ": "); + } else { + chunks.push(originalStringify(k) + ":"); + } + const isComplexObject = childVal !== null && typeof childVal === "object"; + const isNativeRaw = isRawJSON(childVal); + if (isComplexObject && !isNativeRaw) { + if (visited.has(childVal)) { + throw new TypeError("Converting circular structure to JSON"); + } + visited.add(childVal); + stack.push({ + parent: node.val, + key: k, + val: childVal, + isArray: Array.isArray(childVal), + keys: Array.isArray(childVal) ? null : Object.keys(childVal), + index: 0, + first: true + }); + node.first = false; + break; + } else { + chunks.push(originalStringify(childVal)); + node.first = false; + } + } + const isNodeFullyProcessed = node.index >= node.keys.length && stack[stack.length - 1] === node; + if (isNodeFullyProcessed) { + isDone = true; + } } - index2 += match2[0].length; - key = match2[1].toLowerCase(); - value = match2[2]; - if (value[0] === '"') { - value = value.slice(1, value.length - 1); - quotedPairRE.test(value) && (value = value.replace(quotedPairRE, "$1")); + if (isDone) { + level--; + if (!node.first && space2) chunks.push("\n" + space2.repeat(level)); + chunks.push(node.isArray ? "]" : "}"); + visited.delete(node.val); + stack.pop(); } - result.parameters[key] = value; } - if (index2 !== header.length) { - return defaultContentType; + return chunks.join(""); + }; + JSONStringify = (value, replacer, space2) => { + try { + const supportsRawJSON = "rawJSON" in JSON; + if (supportsRawJSON) { + return originalStringify( + value, + (key, val) => { + if (typeof val === "bigint") return JSON.rawJSON(val.toString()); + const hasFunctionReplacer = typeof replacer === "function"; + if (hasFunctionReplacer) return replacer(key, val); + const isKeyInArrayReplacer = Array.isArray(replacer) && replacer.includes(key); + if (isKeyInArrayReplacer) return val; + return val; + }, + space2 + ); + } + if (!value) return originalStringify(value, replacer, space2); + const convertedToCustomJSON = originalStringify( + value, + (key, val) => { + const isNoise = typeof val === "string" && noiseValue.test(val); + if (isNoise) return val.toString() + "n"; + if (typeof val === "bigint") return val.toString() + "n"; + const hasFunctionReplacer = typeof replacer === "function"; + if (hasFunctionReplacer) return replacer(key, val); + const isKeyInArrayReplacer = Array.isArray(replacer) && replacer.includes(key); + if (isKeyInArrayReplacer) return val; + return val; + }, + space2 + ); + const processedJSON = convertedToCustomJSON.replace( + bigIntsStringify, + "$1$2$3" + ); + const denoisedJSON = processedJSON.replace(noiseStringify, "$1$2$3"); + return denoisedJSON; + } catch (error3) { + if (error3 instanceof RangeError) { + const convertedJSON = stringifyIteratively(value, replacer, space2); + if (convertedJSON === void 0) return void 0; + const supportsRawJSON = "rawJSON" in JSON; + if (supportsRawJSON) return convertedJSON; + const processedJSON = convertedJSON.replace(bigIntsStringify, "$1$2$3"); + return processedJSON.replace(noiseStringify, "$1$2$3"); + } + throw error3; } - return result; - } - module2.exports.default = { parse: parse2, safeParse: safeParse2 }; - module2.exports.parse = parse2; - module2.exports.safeParse = safeParse2; - module2.exports.defaultContentType = defaultContentType; + }; + featureCache = /* @__PURE__ */ new Map(); + isContextSourceSupported = () => { + const parseFingerprint = JSON.parse.toString(); + if (featureCache.has(parseFingerprint)) { + return featureCache.get(parseFingerprint); + } + try { + const result = JSON.parse( + "1", + (_2, __, context5) => !!context5?.source && context5.source === "1" + ); + featureCache.set(parseFingerprint, result); + return result; + } catch { + featureCache.set(parseFingerprint, false); + return false; + } + }; + convertMarkedBigIntsReviver = (key, value, context5, userReviver) => { + const isCustomFormatBigInt = typeof value === "string" && customFormat.test(value); + if (isCustomFormatBigInt) return BigInt(value.slice(0, -1)); + const isNoiseValue = typeof value === "string" && noiseValue.test(value); + if (isNoiseValue) return value.slice(0, -1); + const hasUserReviver = typeof userReviver === "function"; + if (!hasUserReviver) return value; + return userReviver(key, value, context5); + }; + JSONParseV2 = (text, reviver) => { + return JSON.parse(text, (key, value, context5) => { + const isNumber2 = typeof value === "number"; + const isOutOfBounds = value > Number.MAX_SAFE_INTEGER || value < Number.MIN_SAFE_INTEGER; + const isBigNumber = isNumber2 && isOutOfBounds; + const isInt = context5 && intRegex.test(context5.source); + const isBigInt = isBigNumber && isInt; + if (isBigInt) return BigInt(context5.source); + const hasCustomReviver = typeof reviver === "function"; + if (!hasCustomReviver) return value; + return reviver(key, value, context5); + }); + }; + MAX_INT = Number.MAX_SAFE_INTEGER.toString(); + MAX_DIGITS = MAX_INT.length; + stringsOrLargeNumbers = /"(?:\\.|[^"])*"|-?(0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?/g; + noiseValueWithQuotes = /^"-?\d+n+"$/; + applyReviverIteratively = (parsed, userReviver) => { + const rootHolder = { "": parsed }; + const stack = [{ parent: rootHolder, key: "", visited: false }]; + while (stack.length > 0) { + const node = stack[stack.length - 1]; + if (!node.visited) { + node.visited = true; + const value = node.parent[node.key]; + const isComplexObject = value !== null && typeof value === "object"; + if (isComplexObject) { + const keys = Object.keys(value); + for (let i = keys.length - 1; i >= 0; i--) { + stack.push({ parent: value, key: keys[i], visited: false }); + } + } + } else { + const { parent, key } = node; + let value = parent[key]; + if (typeof value === "string") { + const isCustomFormatBigInt = customFormat.test(value); + if (isCustomFormatBigInt) { + value = BigInt(value.slice(0, -1)); + } else { + const isNoise = noiseValue.test(value); + if (isNoise) value = value.slice(0, -1); + } + } + const hasUserReviver = typeof userReviver === "function"; + if (hasUserReviver) { + value = userReviver.call(parent, key, value); + } + const isDeleted = value === void 0; + if (isDeleted) { + delete parent[key]; + } else { + parent[key] = value; + } + stack.pop(); + } + } + return rootHolder[""]; + }; + serializeBigInts = (text) => { + return text.replace( + stringsOrLargeNumbers, + (match2, digits, fractional, exponential) => { + const isString3 = match2[0] === '"'; + const isNoise = isString3 && noiseValueWithQuotes.test(match2); + if (isNoise) return match2.substring(0, match2.length - 1) + 'n"'; + const hasFractionalOrExponential = fractional || exponential; + const isLessThanMaxSafeInt = digits && (digits.length < MAX_DIGITS || digits.length === MAX_DIGITS && digits <= MAX_INT); + const isStandardValue = isString3 || hasFractionalOrExponential || isLessThanMaxSafeInt; + if (isStandardValue) return match2; + return '"' + match2 + 'n"'; + } + ); + }; + JSONParse = (text, reviver) => { + if (!text) return originalParse(text, reviver); + try { + if (isContextSourceSupported()) return JSONParseV2(text, reviver); + const serializedData = serializeBigInts(text); + return originalParse( + serializedData, + (key, value, context5) => convertMarkedBigIntsReviver(key, value, context5, reviver) + ); + } catch (error3) { + if (error3 instanceof RangeError) { + const serializedData = serializeBigInts(text); + const parsed = originalParse(serializedData); + return applyReviverIteratively(parsed, reviver); + } + throw error3; + } + }; } }); @@ -22622,7 +22997,7 @@ async function fetchWrapper(requestOptions) { } const log = requestOptions.request?.log || console; const parseSuccessResponseBody = requestOptions.request?.parseSuccessResponseBody !== false; - const body = isPlainObject2(requestOptions.body) || Array.isArray(requestOptions.body) ? JSON.stringify(requestOptions.body) : requestOptions.body; + const body = isPlainObject2(requestOptions.body) || Array.isArray(requestOptions.body) ? JSONStringify(requestOptions.body) : requestOptions.body; const requestHeaders = Object.fromEntries( Object.entries(requestOptions.headers).map(([name, value]) => [ name, @@ -22716,16 +23091,19 @@ async function getResponseData(response) { if (!contentType) { return response.text().catch(noop); } - const mimetype = (0, import_fast_content_type_parse.safeParse)(contentType); + const mimetype = (0, import_content_type.parse)(contentType); if (isJSONResponse(mimetype)) { let text = ""; try { text = await response.text(); - return JSON.parse(text); + return JSONParse(text); } catch (err) { return text; } - } else if (mimetype.type.startsWith("text/") || mimetype.parameters.charset?.toLowerCase() === "utf-8") { + } else if (mimetype.type.startsWith("text/") || // `application/octet-stream` is the canonical "arbitrary binary" type + // (RFC 2046) and must never be decoded as text, even when the response + // carries a (misleading) `charset=utf-8` parameter — see #751. + mimetype.parameters.charset?.toLowerCase() === "utf-8" && mimetype.type !== "application/octet-stream") { return response.text().catch(noop); } else { return response.arrayBuffer().catch( @@ -22744,9 +23122,10 @@ function toErrorMessage(data) { if (data instanceof ArrayBuffer) { return "Unknown error"; } - if ("message" in data) { - const suffix = "documentation_url" in data ? ` - ${data.documentation_url}` : ""; - return Array.isArray(data.errors) ? `${data.message}: ${data.errors.map((v) => JSON.stringify(v)).join(", ")}${suffix}` : `${data.message}${suffix}`; + if (typeof data === "object" && data !== null && "message" in data) { + const objectData = data; + const suffix = "documentation_url" in objectData ? ` - ${objectData.documentation_url}` : ""; + return Array.isArray(objectData.errors) ? `${objectData.message}: ${objectData.errors.map((v) => JSON.stringify(v)).join(", ")}${suffix}` : `${objectData.message}${suffix}`; } return `Unknown error: ${JSON.stringify(data)}`; } @@ -22773,14 +23152,15 @@ function withDefaults2(oldEndpoint, newDefaults) { defaults: withDefaults2.bind(null, endpoint2) }); } -var import_fast_content_type_parse, VERSION2, defaults_default, noop, request; +var import_content_type, VERSION2, defaults_default, noop, request; var init_dist_bundle2 = __esm({ "node_modules/@octokit/request/dist-bundle/index.js"() { init_dist_bundle(); init_universal_user_agent3(); - import_fast_content_type_parse = __toESM(require_fast_content_type_parse(), 1); + import_content_type = __toESM(require_dist(), 1); + init_json_with_bigint(); init_dist_src(); - VERSION2 = "10.0.7"; + VERSION2 = "10.0.13"; defaults_default = { headers: { "user-agent": `octokit-request.js/${VERSION2} ${getUserAgent3()}` @@ -22894,6 +23274,9 @@ var init_dist_bundle3 = __esm({ Error.captureStackTrace(this, this.constructor); } } + request; + headers; + response; name = "GraphqlResponseError"; errors; data; @@ -22974,7 +23357,7 @@ var init_dist_bundle4 = __esm({ var VERSION4; var init_version = __esm({ "node_modules/@octokit/core/dist-src/version.js"() { - VERSION4 = "7.0.6"; + VERSION4 = "7.0.7"; } }); @@ -26592,7 +26975,7 @@ var require_parse2 = __commonJS({ "node_modules/semver/functions/parse.js"(exports2, module2) { "use strict"; var SemVer = require_semver(); - var parse2 = (version, options, throwErrors = false) => { + var parse3 = (version, options, throwErrors = false) => { if (version instanceof SemVer) { return version; } @@ -26605,7 +26988,7 @@ var require_parse2 = __commonJS({ throw er; } }; - module2.exports = parse2; + module2.exports = parse3; } }); @@ -26613,9 +26996,9 @@ var require_parse2 = __commonJS({ var require_valid = __commonJS({ "node_modules/semver/functions/valid.js"(exports2, module2) { "use strict"; - var parse2 = require_parse2(); + var parse3 = require_parse2(); var valid4 = (version, options) => { - const v = parse2(version, options); + const v = parse3(version, options); return v ? v.version : null; }; module2.exports = valid4; @@ -26626,9 +27009,9 @@ var require_valid = __commonJS({ var require_clean = __commonJS({ "node_modules/semver/functions/clean.js"(exports2, module2) { "use strict"; - var parse2 = require_parse2(); + var parse3 = require_parse2(); var clean3 = (version, options) => { - const s = parse2(version.trim().replace(/^[=v]+/, ""), options); + const s = parse3(version.trim().replace(/^[=v]+/, ""), options); return s ? s.version : null; }; module2.exports = clean3; @@ -26663,10 +27046,10 @@ var require_inc = __commonJS({ var require_diff = __commonJS({ "node_modules/semver/functions/diff.js"(exports2, module2) { "use strict"; - var parse2 = require_parse2(); + var parse3 = require_parse2(); var diff = (version1, version2) => { - const v1 = parse2(version1, null, true); - const v2 = parse2(version2, null, true); + const v1 = parse3(version1, null, true); + const v2 = parse3(version2, null, true); const comparison = v1.compare(v2); if (comparison === 0) { return null; @@ -26737,9 +27120,9 @@ var require_patch = __commonJS({ var require_prerelease = __commonJS({ "node_modules/semver/functions/prerelease.js"(exports2, module2) { "use strict"; - var parse2 = require_parse2(); + var parse3 = require_parse2(); var prerelease = (version, options) => { - const parsed = parse2(version, options); + const parsed = parse3(version, options); return parsed && parsed.prerelease.length ? parsed.prerelease : null; }; module2.exports = prerelease; @@ -26925,7 +27308,7 @@ var require_coerce = __commonJS({ "node_modules/semver/functions/coerce.js"(exports2, module2) { "use strict"; var SemVer = require_semver(); - var parse2 = require_parse2(); + var parse3 = require_parse2(); var { safeRe: re, t } = require_re(); var coerce3 = (version, options) => { if (version instanceof SemVer) { @@ -26960,7 +27343,7 @@ var require_coerce = __commonJS({ const patch = match2[4] || "0"; const prerelease = options.includePrerelease && match2[5] ? `-${match2[5]}` : ""; const build2 = options.includePrerelease && match2[6] ? `+${match2[6]}` : ""; - return parse2(`${major}.${minor}.${patch}${prerelease}${build2}`, options); + return parse3(`${major}.${minor}.${patch}${prerelease}${build2}`, options); }; module2.exports = coerce3; } @@ -26970,7 +27353,7 @@ var require_coerce = __commonJS({ var require_truncate = __commonJS({ "node_modules/semver/functions/truncate.js"(exports2, module2) { "use strict"; - var parse2 = require_parse2(); + var parse3 = require_parse2(); var constants = require_constants6(); var SemVer = require_semver(); var truncate = (version, truncation, options) => { @@ -26982,7 +27365,7 @@ var require_truncate = __commonJS({ }; var cloneInputVersion = (version, options) => { const versionStringToParse = version instanceof SemVer ? version.version : version; - return parse2(versionStringToParse, options); + return parse3(versionStringToParse, options); }; var doTruncation = (version, truncation) => { if (isPrerelease(truncation)) { @@ -28026,7 +28409,7 @@ var require_semver2 = __commonJS({ var constants = require_constants6(); var SemVer = require_semver(); var identifiers = require_identifiers(); - var parse2 = require_parse2(); + var parse3 = require_parse2(); var valid4 = require_valid(); var clean3 = require_clean(); var inc = require_inc(); @@ -28065,7 +28448,7 @@ var require_semver2 = __commonJS({ var simplifyRange = require_simplify(); var subset = require_subset(); module2.exports = { - parse: parse2, + parse: parse3, valid: valid4, clean: clean3, inc, @@ -31728,9 +32111,9 @@ var require_minimatch = __commonJS({ throw new TypeError("pattern is too long"); } }; - Minimatch2.prototype.parse = parse2; + Minimatch2.prototype.parse = parse3; var SUBPARSE = {}; - function parse2(pattern, isSub) { + function parse3(pattern, isSub) { assertValidPattern2(pattern); var options = this.options; if (pattern === "**") { @@ -33180,8 +33563,8 @@ var require_semver3 = __commonJS({ } } var i; - exports2.parse = parse2; - function parse2(version, options) { + exports2.parse = parse3; + function parse3(version, options) { if (!options || typeof options !== "object") { options = { loose: !!options, @@ -33209,12 +33592,12 @@ var require_semver3 = __commonJS({ } exports2.valid = valid4; function valid4(version, options) { - var v = parse2(version, options); + var v = parse3(version, options); return v ? v.version : null; } exports2.clean = clean3; function clean3(version, options) { - var s = parse2(version.trim().replace(/^[=v]+/, ""), options); + var s = parse3(version.trim().replace(/^[=v]+/, ""), options); return s ? s.version : null; } exports2.SemVer = SemVer; @@ -33450,8 +33833,8 @@ var require_semver3 = __commonJS({ if (eq(version1, version2)) { return null; } else { - var v1 = parse2(version1); - var v2 = parse2(version2); + var v1 = parse3(version1); + var v2 = parse3(version2); var prefix = ""; if (v1.prerelease.length || v2.prerelease.length) { prefix = "pre"; @@ -34157,7 +34540,7 @@ var require_semver3 = __commonJS({ } exports2.prerelease = prerelease; function prerelease(version, options) { - var parsed = parse2(version, options); + var parsed = parse3(version, options); return parsed && parsed.prerelease.length ? parsed.prerelease : null; } exports2.intersects = intersects; @@ -34194,7 +34577,7 @@ var require_semver3 = __commonJS({ if (match2 === null) { return null; } - return parse2(match2[2] + "." + (match2[3] || "0") + "." + (match2[4] || "0"), options); + return parse3(match2[2] + "." + (match2[3] || "0") + "." + (match2[4] || "0"), options); } } }); @@ -36894,7 +37277,7 @@ var require_ms = __commonJS({ options = options || {}; var type = typeof val; if (type === "string" && val.length > 0) { - return parse2(val); + return parse3(val); } else if (type === "number" && isFinite(val)) { return options.long ? fmtLong(val) : fmtShort(val); } @@ -36902,7 +37285,7 @@ var require_ms = __commonJS({ "val is not a non-empty string or a valid number. val=" + JSON.stringify(val) ); }; - function parse2(str) { + function parse3(str) { str = String(str); if (str.length > 100) { return; @@ -37715,7 +38098,7 @@ var require_helpers3 = __commonJS({ }); // node_modules/agent-base/dist/index.js -var require_dist = __commonJS({ +var require_dist2 = __commonJS({ "node_modules/agent-base/dist/index.js"(exports2) { "use strict"; var __createBinding2 = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) { @@ -37967,7 +38350,7 @@ var require_parse_proxy_response = __commonJS({ }); // node_modules/https-proxy-agent/dist/index.js -var require_dist2 = __commonJS({ +var require_dist3 = __commonJS({ "node_modules/https-proxy-agent/dist/index.js"(exports2) { "use strict"; var __createBinding2 = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) { @@ -38006,7 +38389,7 @@ var require_dist2 = __commonJS({ var tls = __importStar2(require("tls")); var assert_1 = __importDefault2(require("assert")); var debug_1 = __importDefault2(require_src()); - var agent_base_1 = require_dist(); + var agent_base_1 = require_dist2(); var url_1 = require("url"); var parse_proxy_response_1 = require_parse_proxy_response(); var debug6 = (0, debug_1.default)("https-proxy-agent"); @@ -38117,7 +38500,7 @@ var require_dist2 = __commonJS({ }); // node_modules/http-proxy-agent/dist/index.js -var require_dist3 = __commonJS({ +var require_dist4 = __commonJS({ "node_modules/http-proxy-agent/dist/index.js"(exports2) { "use strict"; var __createBinding2 = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) { @@ -38156,7 +38539,7 @@ var require_dist3 = __commonJS({ var tls = __importStar2(require("tls")); var debug_1 = __importDefault2(require_src()); var events_1 = require("events"); - var agent_base_1 = require_dist(); + var agent_base_1 = require_dist2(); var url_1 = require("url"); var debug6 = (0, debug_1.default)("http-proxy-agent"); var HttpProxyAgent = class extends agent_base_1.Agent { @@ -38255,8 +38638,8 @@ var require_proxyPolicy = __commonJS({ exports2.loadNoProxy = loadNoProxy; exports2.getDefaultProxySettings = getDefaultProxySettings; exports2.proxyPolicy = proxyPolicy; - var https_proxy_agent_1 = require_dist2(); - var http_proxy_agent_1 = require_dist3(); + var https_proxy_agent_1 = require_dist3(); + var http_proxy_agent_1 = require_dist4(); var log_js_1 = require_log2(); var HTTPS_PROXY = "HTTPS_PROXY"; var HTTP_PROXY = "HTTP_PROXY"; @@ -42838,7 +43221,7 @@ var require_deserializationPolicy = __commonJS({ return result; } async function deserializeResponseBody(jsonContentTypes, xmlContentTypes, response, options, parseXML) { - const parsedResponse = await parse2(jsonContentTypes, xmlContentTypes, response, options, parseXML); + const parsedResponse = await parse3(jsonContentTypes, xmlContentTypes, response, options, parseXML); if (!shouldDeserializeResponse(parsedResponse)) { return parsedResponse; } @@ -42939,7 +43322,7 @@ var require_deserializationPolicy = __commonJS({ } return { error: error3, shouldReturnResponse: false }; } - async function parse2(jsonContentTypes, xmlContentTypes, operationResponse, opts, parseXML) { + async function parse3(jsonContentTypes, xmlContentTypes, operationResponse, opts, parseXML) { if (!operationResponse.request.streamResponseStatusCodes?.has(operationResponse.status) && operationResponse.bodyAsText) { const text = operationResponse.bodyAsText; const contentType = operationResponse.headers.get("Content-Type") || ""; @@ -75024,7 +75407,7 @@ var require_requestUtils = __commonJS({ }); // node_modules/@azure/abort-controller/dist/index.js -var require_dist4 = __commonJS({ +var require_dist5 = __commonJS({ "node_modules/@azure/abort-controller/dist/index.js"(exports2) { "use strict"; Object.defineProperty(exports2, "__esModule", { value: true }); @@ -75250,7 +75633,7 @@ var require_downloadUtils = __commonJS({ var utils = __importStar2(require_cacheUtils()); var constants_1 = require_constants7(); var requestUtils_1 = require_requestUtils(); - var abort_controller_1 = require_dist4(); + var abort_controller_1 = require_dist5(); function pipeResponseToStream(response, output) { return __awaiter2(this, void 0, void 0, function* () { const pipeline2 = util3.promisify(stream2.pipeline); @@ -110320,7 +110703,7 @@ var require_tar2 = __commonJS({ }); // node_modules/buffer-crc32/dist/index.cjs -var require_dist5 = __commonJS({ +var require_dist6 = __commonJS({ "node_modules/buffer-crc32/dist/index.cjs"(exports2, module2) { "use strict"; function getDefaultExportFromCjs(x) { @@ -110632,7 +111015,7 @@ var require_json = __commonJS({ "node_modules/@actions/artifact/node_modules/archiver/lib/plugins/json.js"(exports2, module2) { var inherits = require("util").inherits; var Transform5 = require_ours().Transform; - var crc325 = require_dist5(); + var crc325 = require_dist6(); var util3 = require_archiver_utils(); var Json2 = function(options) { if (!(this instanceof Json2)) { @@ -112267,7 +112650,7 @@ var require_dist_node2 = __commonJS({ return template.replace(/\/$/, ""); } } - function parse2(options) { + function parse3(options) { let method = options.method.toUpperCase(); let url2 = (options.url || "/").replace(/:([a-z]\w+)/g, "{$1}"); let headers = Object.assign({}, options.headers); @@ -112331,7 +112714,7 @@ var require_dist_node2 = __commonJS({ ); } function endpointWithDefaults2(defaults3, route, options) { - return parse2(merge2(defaults3, route, options)); + return parse3(merge2(defaults3, route, options)); } function withDefaults4(oldDefaults, newDefaults) { const DEFAULTS22 = merge2(oldDefaults, newDefaults); @@ -112340,7 +112723,7 @@ var require_dist_node2 = __commonJS({ DEFAULTS: DEFAULTS22, defaults: withDefaults4.bind(null, DEFAULTS22), merge: merge2.bind(null, DEFAULTS22), - parse: parse2 + parse: parse3 }); } var endpoint2 = withDefaults4(null, DEFAULTS2); @@ -116572,7 +116955,7 @@ var require_binary = __commonJS({ }); return stream2; }; - exports2.parse = function parse2(buffer) { + exports2.parse = function parse3(buffer) { var self2 = words(function(bytes, cb) { return function(name) { if (offset + bytes <= buffer.length) { @@ -162895,7 +163278,7 @@ async function checkProxyEnvironment(logger, language) { // src/start-proxy/reachability.ts var https2 = __toESM(require("https")); -var import_https_proxy_agent = __toESM(require_dist2()); +var import_https_proxy_agent = __toESM(require_dist3()); var connectionTestConfig = { nuget_feed: { path: "v3/index.json" } }; @@ -163367,6 +163750,13 @@ undici/lib/web/fetch/body.js: undici/lib/web/websocket/frame.js: (*! ws. MIT License. Einar Otto Stangvik *) +content-type/dist/index.js: + (*! + * content-type + * Copyright(c) 2015 Douglas Christopher Wilson + * MIT Licensed + *) + @octokit/request-error/dist-src/index.js: (* v8 ignore else -- @preserve -- Bug with vitest coverage where it sees an else branch that doesn't exist *) @@ -163374,6 +163764,9 @@ undici/lib/web/websocket/frame.js: (* v8 ignore next -- @preserve *) (* v8 ignore else -- @preserve *) +@octokit/graphql/dist-bundle/index.js: + (* v8 ignore if -- @preserve *) + normalize-path/index.js: (*! * normalize-path From 951a133f96aa2114dd747e9e437305335d0bde16 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 13 Aug 2026 10:59:59 +0000 Subject: [PATCH 20/24] Update changelog for v4.37.7 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1ed123883f..db809345bc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. -## [UNRELEASED] +## 4.37.7 - 13 Aug 2026 - Update default CodeQL bundle version to [2.26.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3). [#4085](https://github.com/github/codeql-action/pull/4085) From 8b2ec470a0be91eab6254d4edf78516bc6853e08 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 13 Aug 2026 13:31:20 +0000 Subject: [PATCH 21/24] Revert "Update version and changelog for v3.37.6" This reverts commit f6580d2b8f7c6548775fd0f1243d62cce0a8660a. --- CHANGELOG.md | 86 ++++++++++++++++++++++++++-------------------------- package.json | 2 +- 2 files changed, 44 insertions(+), 44 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1d5bc81883..bbe7e65e68 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,70 +2,70 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. -## 3.37.6 - 04 Aug 2026 +## 4.37.6 - 04 Aug 2026 - Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://github.com/github/codeql-action/pull/4070) -## 3.37.5 - 03 Aug 2026 +## 4.37.5 - 03 Aug 2026 - Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://github.com/github/codeql-action/pull/4061) -## 3.37.4 - 29 Jul 2026 +## 4.37.4 - 29 Jul 2026 - This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037) - Update default CodeQL bundle version to [2.26.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://github.com/github/codeql-action/pull/4051) -## 3.37.3 - 22 Jul 2026 +## 4.37.3 - 22 Jul 2026 No user facing changes. -## 3.37.2 - 21 Jul 2026 +## 4.37.2 - 21 Jul 2026 - The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://github.com/github/codeql-action/pull/4023) - The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://github.com/github/codeql-action/pull/4007) -## 3.37.1 - 16 Jul 2026 +## 4.37.1 - 16 Jul 2026 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://github.com/github/codeql-action/pull/3956) - Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://github.com/github/codeql-action/pull/4019) -## 3.37.0 - 08 Jul 2026 +## 4.37.0 - 08 Jul 2026 - Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://github.com/github/codeql-action/pull/3995) - In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://github.com/github/codeql-action/pull/3973) -## 3.36.3 - 01 Jul 2026 +## 4.36.3 - 01 Jul 2026 No user facing changes. -## 3.36.2 - 04 Jun 2026 +## 4.36.2 - 04 Jun 2026 - Cache CodeQL CLI version information across Actions steps. [#3943](https://github.com/github/codeql-action/pull/3943) - Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://github.com/github/codeql-action/pull/3937) - Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://github.com/github/codeql-action/pull/3948) -## 3.36.1 - 02 Jun 2026 +## 4.36.1 - 02 Jun 2026 No user facing changes. -## 3.36.0 - 22 May 2026 +## 4.36.0 - 22 May 2026 - _Breaking change_: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://github.com/github/codeql-action/pull/3894) - Add support for SHA-256 Git object IDs. [#3893](https://github.com/github/codeql-action/pull/3893) - Update default CodeQL bundle version to [2.25.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5). [#3926](https://github.com/github/codeql-action/pull/3926) -## 3.35.5 - 15 May 2026 +## 4.35.5 - 15 May 2026 - We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://github.com/github/codeql-action/pull/3899) - For performance and accuracy reasons, [improved incremental analysis](https://github.com/github/roadmap/issues/1158) will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. [#3791](https://github.com/github/codeql-action/pull/3791) - If multiple inputs are provided for the GitHub-internal `analysis-kinds` input, only `code-scanning` will be enabled. The `analysis-kinds` input is experimental, for GitHub-internal use only, and may change without notice at any time. [#3892](https://github.com/github/codeql-action/pull/3892) - Added an experimental change which, when running a Code Scanning analysis for a PR with [improved incremental analysis](https://github.com/github/roadmap/issues/1158) enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. [#3880](https://github.com/github/codeql-action/pull/3880) -## 3.35.4 - 07 May 2026 +## 4.35.4 - 07 May 2026 - Update default CodeQL bundle version to [2.25.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4). [#3881](https://github.com/github/codeql-action/pull/3881) -## 3.35.3 - 01 May 2026 +## 4.35.3 - 01 May 2026 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. [#3837](https://github.com/github/codeql-action/pull/3837) - Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. [#3850](https://github.com/github/codeql-action/pull/3850) @@ -73,7 +73,7 @@ No user facing changes. - Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. [#3852](https://github.com/github/codeql-action/pull/3852) - Update default CodeQL bundle version to [2.25.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3). [#3865](https://github.com/github/codeql-action/pull/3865) -## 3.35.2 - 15 Apr 2026 +## 4.35.2 - 15 Apr 2026 - The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#3795](https://github.com/github/codeql-action/pull/3795) - The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. [#3789](https://github.com/github/codeql-action/pull/3789) @@ -81,26 +81,26 @@ No user facing changes. - Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. [#3807](https://github.com/github/codeql-action/pull/3807) - Update default CodeQL bundle version to [2.25.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2). [#3823](https://github.com/github/codeql-action/pull/3823) -## 3.35.1 - 27 Mar 2026 +## 4.35.1 - 27 Mar 2026 - Fix incorrect minimum required Git version for [improved incremental analysis](https://github.com/github/roadmap/issues/1158): it should have been 2.36.0, not 2.11.0. [#3781](https://github.com/github/codeql-action/pull/3781) -## 3.35.0 - 27 Mar 2026 +## 4.35.0 - 27 Mar 2026 - Reduced the minimum Git version required for [improved incremental analysis](https://github.com/github/roadmap/issues/1158) from 2.38.0 to 2.11.0. [#3767](https://github.com/github/codeql-action/pull/3767) - Update default CodeQL bundle version to [2.25.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1). [#3773](https://github.com/github/codeql-action/pull/3773) -## 3.34.1 - 20 Mar 2026 +## 4.34.1 - 20 Mar 2026 - Downgrade default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3) due to issues with a small percentage of Actions and JavaScript analyses. [#3762](https://github.com/github/codeql-action/pull/3762) -## 3.34.0 - 20 Mar 2026 +## 4.34.0 - 20 Mar 2026 - Added an experimental change which disables TRAP caching when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. [#3569](https://github.com/github/codeql-action/pull/3569) - We are rolling out improved incremental analysis to C/C++ analyses that use build mode `none`. We expect this rollout to be complete by the end of April 2026. [#3584](https://github.com/github/codeql-action/pull/3584) - Update default CodeQL bundle version to [2.25.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0). [#3585](https://github.com/github/codeql-action/pull/3585) -## 3.33.0 - 16 Mar 2026 +## 4.33.0 - 16 Mar 2026 - Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. [#3562](https://github.com/github/codeql-action/pull/3562) @@ -114,11 +114,11 @@ No user facing changes. - Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". [#3564](https://github.com/github/codeql-action/pull/3564) - A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. [#3570](https://github.com/github/codeql-action/pull/3570) -## 3.32.6 - 05 Mar 2026 +## 4.32.6 - 05 Mar 2026 - Update default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3). [#3548](https://github.com/github/codeql-action/pull/3548) -## 3.32.5 - 02 Mar 2026 +## 4.32.5 - 02 Mar 2026 - Repositories owned by an organization can now set up the `github-codeql-disable-overlay` custom repository property to disable [improved incremental analysis for CodeQL](https://github.com/github/roadmap/issues/1158). First, create a custom repository property with the name `github-codeql-disable-overlay` and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to `true` to disable improved incremental analysis. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature is not yet available on GitHub Enterprise Server. [#3507](https://github.com/github/codeql-action/pull/3507) - Added an experimental change so that when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. [#3487](https://github.com/github/codeql-action/pull/3487) @@ -128,7 +128,7 @@ No user facing changes. - Added an experimental change which allows the `start-proxy` action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. [#3512](https://github.com/github/codeql-action/pull/3512) - The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. [#3503](https://github.com/github/codeql-action/pull/3503), [#3504](https://github.com/github/codeql-action/pull/3504) -## 3.32.4 - 20 Feb 2026 +## 4.32.4 - 20 Feb 2026 - Update default CodeQL bundle version to [2.24.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2). [#3493](https://github.com/github/codeql-action/pull/3493) - Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. [#3473](https://github.com/github/codeql-action/pull/3473) @@ -136,89 +136,89 @@ No user facing changes. - Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. [#3485](https://github.com/github/codeql-action/pull/3485) - Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a [nightly CodeQL CLI release](https://github.com/dsp-testing/codeql-cli-nightlies) instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. [#3484](https://github.com/github/codeql-action/pull/3484) -## 3.32.3 - 13 Feb 2026 +## 4.32.3 - 13 Feb 2026 - Added experimental support for testing connections to [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. [#3466](https://github.com/github/codeql-action/pull/3466) -## 3.32.2 - 05 Feb 2026 +## 4.32.2 - 05 Feb 2026 - Update default CodeQL bundle version to [2.24.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.1). [#3460](https://github.com/github/codeql-action/pull/3460) -## 3.32.1 - 02 Feb 2026 +## 4.32.1 - 02 Feb 2026 - A warning is now shown in Default Setup workflow logs if a [private package registry is configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) using a GitHub Personal Access Token (PAT), but no username is configured. [#3422](https://github.com/github/codeql-action/pull/3422) - Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. [#3421](https://github.com/github/codeql-action/pull/3421) -## 3.32.0 - 26 Jan 2026 +## 4.32.0 - 26 Jan 2026 - Update default CodeQL bundle version to [2.24.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.0). [#3425](https://github.com/github/codeql-action/pull/3425) -## 3.31.11 - 23 Jan 2026 +## 4.31.11 - 23 Jan 2026 - When running a Default Setup workflow with [Actions debugging enabled](https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging), the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. [#3409](https://github.com/github/codeql-action/pull/3409) - Improved error handling throughout the CodeQL Action. [#3415](https://github.com/github/codeql-action/pull/3415) - Added experimental support for automatically excluding [generated files](https://docs.github.com/en/repositories/working-with-files/managing-files/customizing-how-changed-files-appear-on-github) from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. [#3318](https://github.com/github/codeql-action/pull/3318) - The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. [#3403](https://github.com/github/codeql-action/pull/3403) -## 3.31.10 - 12 Jan 2026 +## 4.31.10 - 12 Jan 2026 - Update default CodeQL bundle version to 2.23.9. [#3393](https://github.com/github/codeql-action/pull/3393) -## 3.31.9 - 16 Dec 2025 +## 4.31.9 - 16 Dec 2025 No user facing changes. -## 3.31.8 - 11 Dec 2025 +## 4.31.8 - 11 Dec 2025 - Update default CodeQL bundle version to 2.23.8. [#3354](https://github.com/github/codeql-action/pull/3354) -## 3.31.7 - 05 Dec 2025 +## 4.31.7 - 05 Dec 2025 - Update default CodeQL bundle version to 2.23.7. [#3343](https://github.com/github/codeql-action/pull/3343) -## 3.31.6 - 01 Dec 2025 +## 4.31.6 - 01 Dec 2025 No user facing changes. -## 3.31.5 - 24 Nov 2025 +## 4.31.5 - 24 Nov 2025 - Update default CodeQL bundle version to 2.23.6. [#3321](https://github.com/github/codeql-action/pull/3321) -## 3.31.4 - 18 Nov 2025 +## 4.31.4 - 18 Nov 2025 No user facing changes. -## 3.31.3 - 13 Nov 2025 +## 4.31.3 - 13 Nov 2025 - CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see [Upcoming deprecation of CodeQL Action v3](https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/). - Update default CodeQL bundle version to 2.23.5. [#3288](https://github.com/github/codeql-action/pull/3288) -## 3.31.2 - 30 Oct 2025 +## 4.31.2 - 30 Oct 2025 No user facing changes. -## 3.31.1 - 30 Oct 2025 +## 4.31.1 - 30 Oct 2025 - The `add-snippets` input has been removed from the `analyze` action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced. -## 3.31.0 - 24 Oct 2025 +## 4.31.0 - 24 Oct 2025 - Bump minimum CodeQL bundle version to 2.17.6. [#3223](https://github.com/github/codeql-action/pull/3223) - When SARIF files are uploaded by the `analyze` or `upload-sarif` actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the `upload-sarif` action. For `analyze`, this may affect Advanced Setup for CodeQL users who specify a value other than `always` for the `upload` input. [#3222](https://github.com/github/codeql-action/pull/3222) -## 3.30.9 - 17 Oct 2025 +## 4.30.9 - 17 Oct 2025 - Update default CodeQL bundle version to 2.23.3. [#3205](https://github.com/github/codeql-action/pull/3205) - Experimental: A new `setup-codeql` action has been added which is similar to `init`, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. [#3204](https://github.com/github/codeql-action/pull/3204) -## 3.30.8 - 10 Oct 2025 +## 4.30.8 - 10 Oct 2025 No user facing changes. -## 3.30.7 - 06 Oct 2025 +## 4.30.7 - 06 Oct 2025 +- [v4+ only] The CodeQL Action now runs on Node.js v24. [#3169](https://github.com/github/codeql-action/pull/3169) -No user facing changes. ## 3.30.6 - 02 Oct 2025 - Update default CodeQL bundle version to 2.23.2. [#3168](https://github.com/github/codeql-action/pull/3168) diff --git a/package.json b/package.json index 4fa85d6931..caf12f15c0 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "3.37.6", + "version": "4.37.6", "private": true, "description": "CodeQL action", "scripts": { From 4da5eae9f4c503e420710355d15ad88437491f0c Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 13 Aug 2026 13:31:20 +0000 Subject: [PATCH 22/24] Revert "Rebuild" This reverts commit b4d147f9bcd48aefd3c123fa27da62356375e7bb. --- lib/entry-points.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 4d3a143bee..cdd0db217d 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145426,7 +145426,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) { return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME); } function getActionVersion() { - return "3.37.6"; + return "4.37.6"; } function getWorkflowEventName(env = getEnv()) { return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */); From 5f47b57df6975d24be2504e63b2c931ffbb6cf5f Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 13 Aug 2026 13:31:20 +0000 Subject: [PATCH 23/24] Update version and changelog for v3.37.7 --- CHANGELOG.md | 88 ++++++++++++++++++++++++++-------------------------- package.json | 2 +- 2 files changed, 45 insertions(+), 45 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index db809345bc..ebd4c2effa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,74 +2,74 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. -## 4.37.7 - 13 Aug 2026 +## 3.37.7 - 13 Aug 2026 - Update default CodeQL bundle version to [2.26.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3). [#4085](https://github.com/github/codeql-action/pull/4085) -## 4.37.6 - 04 Aug 2026 +## 3.37.6 - 04 Aug 2026 - Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://github.com/github/codeql-action/pull/4070) -## 4.37.5 - 03 Aug 2026 +## 3.37.5 - 03 Aug 2026 - Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://github.com/github/codeql-action/pull/4061) -## 4.37.4 - 29 Jul 2026 +## 3.37.4 - 29 Jul 2026 - This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037) - Update default CodeQL bundle version to [2.26.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://github.com/github/codeql-action/pull/4051) -## 4.37.3 - 22 Jul 2026 +## 3.37.3 - 22 Jul 2026 No user facing changes. -## 4.37.2 - 21 Jul 2026 +## 3.37.2 - 21 Jul 2026 - The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://github.com/github/codeql-action/pull/4023) - The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://github.com/github/codeql-action/pull/4007) -## 4.37.1 - 16 Jul 2026 +## 3.37.1 - 16 Jul 2026 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://github.com/github/codeql-action/pull/3956) - Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://github.com/github/codeql-action/pull/4019) -## 4.37.0 - 08 Jul 2026 +## 3.37.0 - 08 Jul 2026 - Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://github.com/github/codeql-action/pull/3995) - In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://github.com/github/codeql-action/pull/3973) -## 4.36.3 - 01 Jul 2026 +## 3.36.3 - 01 Jul 2026 No user facing changes. -## 4.36.2 - 04 Jun 2026 +## 3.36.2 - 04 Jun 2026 - Cache CodeQL CLI version information across Actions steps. [#3943](https://github.com/github/codeql-action/pull/3943) - Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://github.com/github/codeql-action/pull/3937) - Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://github.com/github/codeql-action/pull/3948) -## 4.36.1 - 02 Jun 2026 +## 3.36.1 - 02 Jun 2026 No user facing changes. -## 4.36.0 - 22 May 2026 +## 3.36.0 - 22 May 2026 - _Breaking change_: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://github.com/github/codeql-action/pull/3894) - Add support for SHA-256 Git object IDs. [#3893](https://github.com/github/codeql-action/pull/3893) - Update default CodeQL bundle version to [2.25.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5). [#3926](https://github.com/github/codeql-action/pull/3926) -## 4.35.5 - 15 May 2026 +## 3.35.5 - 15 May 2026 - We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://github.com/github/codeql-action/pull/3899) - For performance and accuracy reasons, [improved incremental analysis](https://github.com/github/roadmap/issues/1158) will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. [#3791](https://github.com/github/codeql-action/pull/3791) - If multiple inputs are provided for the GitHub-internal `analysis-kinds` input, only `code-scanning` will be enabled. The `analysis-kinds` input is experimental, for GitHub-internal use only, and may change without notice at any time. [#3892](https://github.com/github/codeql-action/pull/3892) - Added an experimental change which, when running a Code Scanning analysis for a PR with [improved incremental analysis](https://github.com/github/roadmap/issues/1158) enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. [#3880](https://github.com/github/codeql-action/pull/3880) -## 4.35.4 - 07 May 2026 +## 3.35.4 - 07 May 2026 - Update default CodeQL bundle version to [2.25.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4). [#3881](https://github.com/github/codeql-action/pull/3881) -## 4.35.3 - 01 May 2026 +## 3.35.3 - 01 May 2026 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. [#3837](https://github.com/github/codeql-action/pull/3837) - Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. [#3850](https://github.com/github/codeql-action/pull/3850) @@ -77,7 +77,7 @@ No user facing changes. - Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. [#3852](https://github.com/github/codeql-action/pull/3852) - Update default CodeQL bundle version to [2.25.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3). [#3865](https://github.com/github/codeql-action/pull/3865) -## 4.35.2 - 15 Apr 2026 +## 3.35.2 - 15 Apr 2026 - The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#3795](https://github.com/github/codeql-action/pull/3795) - The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. [#3789](https://github.com/github/codeql-action/pull/3789) @@ -85,26 +85,26 @@ No user facing changes. - Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. [#3807](https://github.com/github/codeql-action/pull/3807) - Update default CodeQL bundle version to [2.25.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2). [#3823](https://github.com/github/codeql-action/pull/3823) -## 4.35.1 - 27 Mar 2026 +## 3.35.1 - 27 Mar 2026 - Fix incorrect minimum required Git version for [improved incremental analysis](https://github.com/github/roadmap/issues/1158): it should have been 2.36.0, not 2.11.0. [#3781](https://github.com/github/codeql-action/pull/3781) -## 4.35.0 - 27 Mar 2026 +## 3.35.0 - 27 Mar 2026 - Reduced the minimum Git version required for [improved incremental analysis](https://github.com/github/roadmap/issues/1158) from 2.38.0 to 2.11.0. [#3767](https://github.com/github/codeql-action/pull/3767) - Update default CodeQL bundle version to [2.25.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1). [#3773](https://github.com/github/codeql-action/pull/3773) -## 4.34.1 - 20 Mar 2026 +## 3.34.1 - 20 Mar 2026 - Downgrade default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3) due to issues with a small percentage of Actions and JavaScript analyses. [#3762](https://github.com/github/codeql-action/pull/3762) -## 4.34.0 - 20 Mar 2026 +## 3.34.0 - 20 Mar 2026 - Added an experimental change which disables TRAP caching when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. [#3569](https://github.com/github/codeql-action/pull/3569) - We are rolling out improved incremental analysis to C/C++ analyses that use build mode `none`. We expect this rollout to be complete by the end of April 2026. [#3584](https://github.com/github/codeql-action/pull/3584) - Update default CodeQL bundle version to [2.25.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0). [#3585](https://github.com/github/codeql-action/pull/3585) -## 4.33.0 - 16 Mar 2026 +## 3.33.0 - 16 Mar 2026 - Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. [#3562](https://github.com/github/codeql-action/pull/3562) @@ -118,11 +118,11 @@ No user facing changes. - Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". [#3564](https://github.com/github/codeql-action/pull/3564) - A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. [#3570](https://github.com/github/codeql-action/pull/3570) -## 4.32.6 - 05 Mar 2026 +## 3.32.6 - 05 Mar 2026 - Update default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3). [#3548](https://github.com/github/codeql-action/pull/3548) -## 4.32.5 - 02 Mar 2026 +## 3.32.5 - 02 Mar 2026 - Repositories owned by an organization can now set up the `github-codeql-disable-overlay` custom repository property to disable [improved incremental analysis for CodeQL](https://github.com/github/roadmap/issues/1158). First, create a custom repository property with the name `github-codeql-disable-overlay` and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to `true` to disable improved incremental analysis. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature is not yet available on GitHub Enterprise Server. [#3507](https://github.com/github/codeql-action/pull/3507) - Added an experimental change so that when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. [#3487](https://github.com/github/codeql-action/pull/3487) @@ -132,7 +132,7 @@ No user facing changes. - Added an experimental change which allows the `start-proxy` action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. [#3512](https://github.com/github/codeql-action/pull/3512) - The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. [#3503](https://github.com/github/codeql-action/pull/3503), [#3504](https://github.com/github/codeql-action/pull/3504) -## 4.32.4 - 20 Feb 2026 +## 3.32.4 - 20 Feb 2026 - Update default CodeQL bundle version to [2.24.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2). [#3493](https://github.com/github/codeql-action/pull/3493) - Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. [#3473](https://github.com/github/codeql-action/pull/3473) @@ -140,89 +140,89 @@ No user facing changes. - Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. [#3485](https://github.com/github/codeql-action/pull/3485) - Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a [nightly CodeQL CLI release](https://github.com/dsp-testing/codeql-cli-nightlies) instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. [#3484](https://github.com/github/codeql-action/pull/3484) -## 4.32.3 - 13 Feb 2026 +## 3.32.3 - 13 Feb 2026 - Added experimental support for testing connections to [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. [#3466](https://github.com/github/codeql-action/pull/3466) -## 4.32.2 - 05 Feb 2026 +## 3.32.2 - 05 Feb 2026 - Update default CodeQL bundle version to [2.24.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.1). [#3460](https://github.com/github/codeql-action/pull/3460) -## 4.32.1 - 02 Feb 2026 +## 3.32.1 - 02 Feb 2026 - A warning is now shown in Default Setup workflow logs if a [private package registry is configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) using a GitHub Personal Access Token (PAT), but no username is configured. [#3422](https://github.com/github/codeql-action/pull/3422) - Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. [#3421](https://github.com/github/codeql-action/pull/3421) -## 4.32.0 - 26 Jan 2026 +## 3.32.0 - 26 Jan 2026 - Update default CodeQL bundle version to [2.24.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.0). [#3425](https://github.com/github/codeql-action/pull/3425) -## 4.31.11 - 23 Jan 2026 +## 3.31.11 - 23 Jan 2026 - When running a Default Setup workflow with [Actions debugging enabled](https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging), the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. [#3409](https://github.com/github/codeql-action/pull/3409) - Improved error handling throughout the CodeQL Action. [#3415](https://github.com/github/codeql-action/pull/3415) - Added experimental support for automatically excluding [generated files](https://docs.github.com/en/repositories/working-with-files/managing-files/customizing-how-changed-files-appear-on-github) from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. [#3318](https://github.com/github/codeql-action/pull/3318) - The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. [#3403](https://github.com/github/codeql-action/pull/3403) -## 4.31.10 - 12 Jan 2026 +## 3.31.10 - 12 Jan 2026 - Update default CodeQL bundle version to 2.23.9. [#3393](https://github.com/github/codeql-action/pull/3393) -## 4.31.9 - 16 Dec 2025 +## 3.31.9 - 16 Dec 2025 No user facing changes. -## 4.31.8 - 11 Dec 2025 +## 3.31.8 - 11 Dec 2025 - Update default CodeQL bundle version to 2.23.8. [#3354](https://github.com/github/codeql-action/pull/3354) -## 4.31.7 - 05 Dec 2025 +## 3.31.7 - 05 Dec 2025 - Update default CodeQL bundle version to 2.23.7. [#3343](https://github.com/github/codeql-action/pull/3343) -## 4.31.6 - 01 Dec 2025 +## 3.31.6 - 01 Dec 2025 No user facing changes. -## 4.31.5 - 24 Nov 2025 +## 3.31.5 - 24 Nov 2025 - Update default CodeQL bundle version to 2.23.6. [#3321](https://github.com/github/codeql-action/pull/3321) -## 4.31.4 - 18 Nov 2025 +## 3.31.4 - 18 Nov 2025 No user facing changes. -## 4.31.3 - 13 Nov 2025 +## 3.31.3 - 13 Nov 2025 - CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see [Upcoming deprecation of CodeQL Action v3](https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/). - Update default CodeQL bundle version to 2.23.5. [#3288](https://github.com/github/codeql-action/pull/3288) -## 4.31.2 - 30 Oct 2025 +## 3.31.2 - 30 Oct 2025 No user facing changes. -## 4.31.1 - 30 Oct 2025 +## 3.31.1 - 30 Oct 2025 - The `add-snippets` input has been removed from the `analyze` action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced. -## 4.31.0 - 24 Oct 2025 +## 3.31.0 - 24 Oct 2025 - Bump minimum CodeQL bundle version to 2.17.6. [#3223](https://github.com/github/codeql-action/pull/3223) - When SARIF files are uploaded by the `analyze` or `upload-sarif` actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the `upload-sarif` action. For `analyze`, this may affect Advanced Setup for CodeQL users who specify a value other than `always` for the `upload` input. [#3222](https://github.com/github/codeql-action/pull/3222) -## 4.30.9 - 17 Oct 2025 +## 3.30.9 - 17 Oct 2025 - Update default CodeQL bundle version to 2.23.3. [#3205](https://github.com/github/codeql-action/pull/3205) - Experimental: A new `setup-codeql` action has been added which is similar to `init`, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. [#3204](https://github.com/github/codeql-action/pull/3204) -## 4.30.8 - 10 Oct 2025 +## 3.30.8 - 10 Oct 2025 No user facing changes. -## 4.30.7 - 06 Oct 2025 +## 3.30.7 - 06 Oct 2025 -- [v4+ only] The CodeQL Action now runs on Node.js v24. [#3169](https://github.com/github/codeql-action/pull/3169) +No user facing changes. ## 3.30.6 - 02 Oct 2025 - Update default CodeQL bundle version to 2.23.2. [#3168](https://github.com/github/codeql-action/pull/3168) diff --git a/package.json b/package.json index 17229b4b7b..637738eb7e 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "4.37.7", + "version": "3.37.7", "private": true, "description": "CodeQL action", "scripts": { From 2a073c8c9acaff5a8c0f7ffb4cb91cb19aca9106 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 13 Aug 2026 13:31:29 +0000 Subject: [PATCH 24/24] Rebuild --- lib/entry-points.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index af11ed2bb8..9f49cbc176 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146062,7 +146062,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) { return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME); } function getActionVersion() { - return "4.37.7"; + return "3.37.7"; } function getWorkflowEventName(env = getEnv()) { return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */);