From c3455c55c1eca92492f511e20f52b4cc9ed44afd Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 1 Dec 2025 09:50:22 +0000 Subject: [PATCH 01/12] Update changelog and version after v4.31.6 --- CHANGELOG.md | 4 ++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5fe221f689..e305995c25 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. +## [UNRELEASED] + +No user facing changes. + ## 4.31.6 - 01 Dec 2025 No user facing changes. diff --git a/package-lock.json b/package-lock.json index c24715d343..c7cd50c880 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codeql", - "version": "4.31.6", + "version": "4.31.7", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codeql", - "version": "4.31.6", + "version": "4.31.7", "license": "MIT", "dependencies": { "@actions/artifact": "^4.0.0", diff --git a/package.json b/package.json index 14f1e770e6..60eb70ed7e 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "4.31.6", + "version": "4.31.7", "private": true, "description": "CodeQL action", "scripts": { From c1ca379fc0b6429602e9a3f43c60ac0bb355636f Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 1 Dec 2025 09:55:25 +0000 Subject: [PATCH 02/12] Rebuild --- lib/analyze-action-post.js | 2 +- lib/analyze-action.js | 2 +- lib/autobuild-action.js | 2 +- lib/init-action-post.js | 2 +- lib/init-action.js | 2 +- lib/resolve-environment-action.js | 2 +- lib/setup-codeql-action.js | 2 +- lib/start-proxy-action-post.js | 2 +- lib/start-proxy-action.js | 2 +- lib/upload-lib.js | 2 +- lib/upload-sarif-action-post.js | 2 +- lib/upload-sarif-action.js | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/lib/analyze-action-post.js b/lib/analyze-action-post.js index 2dd4d601dd..b4ee3c8d5b 100644 --- a/lib/analyze-action-post.js +++ b/lib/analyze-action-post.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.6", + version: "4.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/analyze-action.js b/lib/analyze-action.js index 1ee89a8320..1ba7f39e93 100644 --- a/lib/analyze-action.js +++ b/lib/analyze-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.6", + version: "4.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/autobuild-action.js b/lib/autobuild-action.js index 520a42f6a9..10b30f64d5 100644 --- a/lib/autobuild-action.js +++ b/lib/autobuild-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.6", + version: "4.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/init-action-post.js b/lib/init-action-post.js index 841e2eaabc..b6a4215af5 100644 --- a/lib/init-action-post.js +++ b/lib/init-action-post.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.6", + version: "4.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/init-action.js b/lib/init-action.js index 05ee04747a..8f5b7f8871 100644 --- a/lib/init-action.js +++ b/lib/init-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.6", + version: "4.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/resolve-environment-action.js b/lib/resolve-environment-action.js index 4eee8e6ca3..6e159d31a4 100644 --- a/lib/resolve-environment-action.js +++ b/lib/resolve-environment-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.6", + version: "4.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/setup-codeql-action.js b/lib/setup-codeql-action.js index 019d53e311..74b84a122f 100644 --- a/lib/setup-codeql-action.js +++ b/lib/setup-codeql-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.6", + version: "4.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/start-proxy-action-post.js b/lib/start-proxy-action-post.js index 95c4a1ffd5..d4e01eebae 100644 --- a/lib/start-proxy-action-post.js +++ b/lib/start-proxy-action-post.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.6", + version: "4.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/start-proxy-action.js b/lib/start-proxy-action.js index 271c38e7ec..e129f29d40 100644 --- a/lib/start-proxy-action.js +++ b/lib/start-proxy-action.js @@ -47321,7 +47321,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.6", + version: "4.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/upload-lib.js b/lib/upload-lib.js index 5c04f54973..4f3f1fa46b 100644 --- a/lib/upload-lib.js +++ b/lib/upload-lib.js @@ -28924,7 +28924,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.6", + version: "4.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/upload-sarif-action-post.js b/lib/upload-sarif-action-post.js index 5fb0b0d77d..05450fa648 100644 --- a/lib/upload-sarif-action-post.js +++ b/lib/upload-sarif-action-post.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.6", + version: "4.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/upload-sarif-action.js b/lib/upload-sarif-action.js index 09f6f8d53e..ba2c9118cf 100644 --- a/lib/upload-sarif-action.js +++ b/lib/upload-sarif-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.6", + version: "4.31.7", private: true, description: "CodeQL action", scripts: { From 43224eb34e6efd92aee9cf38e9f97e15518511be Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 1 Dec 2025 18:30:33 +0000 Subject: [PATCH 03/12] Bump @eslint/eslintrc from 3.3.1 to 3.3.3 in the npm-minor group Bumps the npm-minor group with 1 update: [@eslint/eslintrc](https://github.com/eslint/eslintrc). Updates `@eslint/eslintrc` from 3.3.1 to 3.3.3 - [Release notes](https://github.com/eslint/eslintrc/releases) - [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslintrc/compare/v3.3.1...eslintrc-v3.3.3) --- updated-dependencies: - dependency-name: "@eslint/eslintrc" dependency-version: 3.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] --- package-lock.json | 11 ++++++----- package.json | 2 +- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index c7cd50c880..8cc15a5f5c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -35,7 +35,7 @@ "devDependencies": { "@ava/typescript": "6.0.0", "@eslint/compat": "^2.0.0", - "@eslint/eslintrc": "^3.3.1", + "@eslint/eslintrc": "^3.3.3", "@eslint/js": "^9.39.1", "@microsoft/eslint-formatter-sarif": "^3.1.0", "@octokit/types": "^16.0.0", @@ -1449,10 +1449,11 @@ } }, "node_modules/@eslint/eslintrc": { - "version": "3.3.1", - "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.1.tgz", - "integrity": "sha512-gtF186CXhIl1p4pJNGZw8Yc6RlshoePRvE0X91oPGb3vZ8pM3qOS9W9NGPat9LziaBV7XrJWGylNQXkGcnM3IQ==", + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.3.tgz", + "integrity": "sha512-Kr+LPIUVKz2qkx1HAMH8q1q6azbqBAsXJUxBl/ODDuVPX45Z9DfwB8tPjTi6nNZ8BuM3nbJxC5zCAg5elnBUTQ==", "dev": true, + "license": "MIT", "dependencies": { "ajv": "^6.12.4", "debug": "^4.3.2", @@ -1460,7 +1461,7 @@ "globals": "^14.0.0", "ignore": "^5.2.0", "import-fresh": "^3.2.1", - "js-yaml": "^4.1.0", + "js-yaml": "^4.1.1", "minimatch": "^3.1.2", "strip-json-comments": "^3.1.1" }, diff --git a/package.json b/package.json index 60eb70ed7e..32ea9facb1 100644 --- a/package.json +++ b/package.json @@ -50,7 +50,7 @@ "devDependencies": { "@ava/typescript": "6.0.0", "@eslint/compat": "^2.0.0", - "@eslint/eslintrc": "^3.3.1", + "@eslint/eslintrc": "^3.3.3", "@eslint/js": "^9.39.1", "@microsoft/eslint-formatter-sarif": "^3.1.0", "@octokit/types": "^16.0.0", From ce27e95f791dfda287706648ff69d9226c4526c2 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 1 Dec 2025 18:32:19 +0000 Subject: [PATCH 04/12] Rebuild --- lib/analyze-action-post.js | 2 +- lib/analyze-action.js | 2 +- lib/autobuild-action.js | 2 +- lib/init-action-post.js | 2 +- lib/init-action.js | 2 +- lib/resolve-environment-action.js | 2 +- lib/setup-codeql-action.js | 2 +- lib/start-proxy-action-post.js | 2 +- lib/start-proxy-action.js | 2 +- lib/upload-lib.js | 2 +- lib/upload-sarif-action-post.js | 2 +- lib/upload-sarif-action.js | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/lib/analyze-action-post.js b/lib/analyze-action-post.js index b4ee3c8d5b..88d0665c53 100644 --- a/lib/analyze-action-post.js +++ b/lib/analyze-action-post.js @@ -27677,7 +27677,7 @@ var require_package = __commonJS({ devDependencies: { "@ava/typescript": "6.0.0", "@eslint/compat": "^2.0.0", - "@eslint/eslintrc": "^3.3.1", + "@eslint/eslintrc": "^3.3.3", "@eslint/js": "^9.39.1", "@microsoft/eslint-formatter-sarif": "^3.1.0", "@octokit/types": "^16.0.0", diff --git a/lib/analyze-action.js b/lib/analyze-action.js index 1ba7f39e93..129b7b56fa 100644 --- a/lib/analyze-action.js +++ b/lib/analyze-action.js @@ -27677,7 +27677,7 @@ var require_package = __commonJS({ devDependencies: { "@ava/typescript": "6.0.0", "@eslint/compat": "^2.0.0", - "@eslint/eslintrc": "^3.3.1", + "@eslint/eslintrc": "^3.3.3", "@eslint/js": "^9.39.1", "@microsoft/eslint-formatter-sarif": "^3.1.0", "@octokit/types": "^16.0.0", diff --git a/lib/autobuild-action.js b/lib/autobuild-action.js index 10b30f64d5..7f856290fe 100644 --- a/lib/autobuild-action.js +++ b/lib/autobuild-action.js @@ -27677,7 +27677,7 @@ var require_package = __commonJS({ devDependencies: { "@ava/typescript": "6.0.0", "@eslint/compat": "^2.0.0", - "@eslint/eslintrc": "^3.3.1", + "@eslint/eslintrc": "^3.3.3", "@eslint/js": "^9.39.1", "@microsoft/eslint-formatter-sarif": "^3.1.0", "@octokit/types": "^16.0.0", diff --git a/lib/init-action-post.js b/lib/init-action-post.js index b6a4215af5..88c0ecbc7b 100644 --- a/lib/init-action-post.js +++ b/lib/init-action-post.js @@ -27677,7 +27677,7 @@ var require_package = __commonJS({ devDependencies: { "@ava/typescript": "6.0.0", "@eslint/compat": "^2.0.0", - "@eslint/eslintrc": "^3.3.1", + "@eslint/eslintrc": "^3.3.3", "@eslint/js": "^9.39.1", "@microsoft/eslint-formatter-sarif": "^3.1.0", "@octokit/types": "^16.0.0", diff --git a/lib/init-action.js b/lib/init-action.js index 8f5b7f8871..fa23150d9e 100644 --- a/lib/init-action.js +++ b/lib/init-action.js @@ -27677,7 +27677,7 @@ var require_package = __commonJS({ devDependencies: { "@ava/typescript": "6.0.0", "@eslint/compat": "^2.0.0", - "@eslint/eslintrc": "^3.3.1", + "@eslint/eslintrc": "^3.3.3", "@eslint/js": "^9.39.1", "@microsoft/eslint-formatter-sarif": "^3.1.0", "@octokit/types": "^16.0.0", diff --git a/lib/resolve-environment-action.js b/lib/resolve-environment-action.js index 6e159d31a4..95681d88aa 100644 --- a/lib/resolve-environment-action.js +++ b/lib/resolve-environment-action.js @@ -27677,7 +27677,7 @@ var require_package = __commonJS({ devDependencies: { "@ava/typescript": "6.0.0", "@eslint/compat": "^2.0.0", - "@eslint/eslintrc": "^3.3.1", + "@eslint/eslintrc": "^3.3.3", "@eslint/js": "^9.39.1", "@microsoft/eslint-formatter-sarif": "^3.1.0", "@octokit/types": "^16.0.0", diff --git a/lib/setup-codeql-action.js b/lib/setup-codeql-action.js index 74b84a122f..e8c5332995 100644 --- a/lib/setup-codeql-action.js +++ b/lib/setup-codeql-action.js @@ -27677,7 +27677,7 @@ var require_package = __commonJS({ devDependencies: { "@ava/typescript": "6.0.0", "@eslint/compat": "^2.0.0", - "@eslint/eslintrc": "^3.3.1", + "@eslint/eslintrc": "^3.3.3", "@eslint/js": "^9.39.1", "@microsoft/eslint-formatter-sarif": "^3.1.0", "@octokit/types": "^16.0.0", diff --git a/lib/start-proxy-action-post.js b/lib/start-proxy-action-post.js index d4e01eebae..ac38fef38e 100644 --- a/lib/start-proxy-action-post.js +++ b/lib/start-proxy-action-post.js @@ -27677,7 +27677,7 @@ var require_package = __commonJS({ devDependencies: { "@ava/typescript": "6.0.0", "@eslint/compat": "^2.0.0", - "@eslint/eslintrc": "^3.3.1", + "@eslint/eslintrc": "^3.3.3", "@eslint/js": "^9.39.1", "@microsoft/eslint-formatter-sarif": "^3.1.0", "@octokit/types": "^16.0.0", diff --git a/lib/start-proxy-action.js b/lib/start-proxy-action.js index e129f29d40..4c3262559f 100644 --- a/lib/start-proxy-action.js +++ b/lib/start-proxy-action.js @@ -47371,7 +47371,7 @@ var require_package = __commonJS({ devDependencies: { "@ava/typescript": "6.0.0", "@eslint/compat": "^2.0.0", - "@eslint/eslintrc": "^3.3.1", + "@eslint/eslintrc": "^3.3.3", "@eslint/js": "^9.39.1", "@microsoft/eslint-formatter-sarif": "^3.1.0", "@octokit/types": "^16.0.0", diff --git a/lib/upload-lib.js b/lib/upload-lib.js index 4f3f1fa46b..1fc9f8f082 100644 --- a/lib/upload-lib.js +++ b/lib/upload-lib.js @@ -28974,7 +28974,7 @@ var require_package = __commonJS({ devDependencies: { "@ava/typescript": "6.0.0", "@eslint/compat": "^2.0.0", - "@eslint/eslintrc": "^3.3.1", + "@eslint/eslintrc": "^3.3.3", "@eslint/js": "^9.39.1", "@microsoft/eslint-formatter-sarif": "^3.1.0", "@octokit/types": "^16.0.0", diff --git a/lib/upload-sarif-action-post.js b/lib/upload-sarif-action-post.js index 05450fa648..ab66301a4b 100644 --- a/lib/upload-sarif-action-post.js +++ b/lib/upload-sarif-action-post.js @@ -27677,7 +27677,7 @@ var require_package = __commonJS({ devDependencies: { "@ava/typescript": "6.0.0", "@eslint/compat": "^2.0.0", - "@eslint/eslintrc": "^3.3.1", + "@eslint/eslintrc": "^3.3.3", "@eslint/js": "^9.39.1", "@microsoft/eslint-formatter-sarif": "^3.1.0", "@octokit/types": "^16.0.0", diff --git a/lib/upload-sarif-action.js b/lib/upload-sarif-action.js index ba2c9118cf..3bdcaf23e9 100644 --- a/lib/upload-sarif-action.js +++ b/lib/upload-sarif-action.js @@ -27677,7 +27677,7 @@ var require_package = __commonJS({ devDependencies: { "@ava/typescript": "6.0.0", "@eslint/compat": "^2.0.0", - "@eslint/eslintrc": "^3.3.1", + "@eslint/eslintrc": "^3.3.3", "@eslint/js": "^9.39.1", "@microsoft/eslint-formatter-sarif": "^3.1.0", "@octokit/types": "^16.0.0", From d61a6fa793c84c98e08555552b4b9c6374665d24 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 3 Dec 2025 12:05:17 +0000 Subject: [PATCH 05/12] Update CLI config test to account for overlay db changes on PRs --- .github/workflows/codescanning-config-cli.yml | 22 ++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codescanning-config-cli.yml b/.github/workflows/codescanning-config-cli.yml index 3c97239d5d..2f4b67cc1f 100644 --- a/.github/workflows/codescanning-config-cli.yml +++ b/.github/workflows/codescanning-config-cli.yml @@ -70,13 +70,33 @@ jobs: with: version: ${{ matrix.version }} - - name: Empty file + # On PRs, overlay analysis may change the config that is passed to the CLI. + # Therefore, we have two variants of the following test, one for PRs and one for other events. + - name: Empty file (non-PR) + if: github.event_name != 'pull_request' uses: ./../action/.github/actions/check-codescanning-config with: expected-config-file-contents: "{}" languages: javascript tools: ${{ steps.prepare-test.outputs.tools-url }} + - name: Empty file (PR) + if: github.event_name == 'pull_request' + uses: ./../action/.github/actions/check-codescanning-config + with: + expected-config-file-contents: | + { + "query-filters": [ + { + "exclude": { + "tags": "exclude-from-incremental" + } + } + ] + } + languages: javascript + tools: ${{ steps.prepare-test.outputs.tools-url }} + - name: Packs from input if: success() || failure() uses: ./../action/.github/actions/check-codescanning-config From ac34c1383489d3ac7641a26c5fbbf8ec5112f4fc Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 5 Dec 2025 13:39:45 +0000 Subject: [PATCH 06/12] Update default bundle to codeql-bundle-v2.23.7 --- lib/analyze-action.js | 4 ++-- lib/autobuild-action.js | 4 ++-- lib/defaults.json | 8 ++++---- lib/init-action-post.js | 4 ++-- lib/init-action.js | 4 ++-- lib/setup-codeql-action.js | 4 ++-- lib/start-proxy-action.js | 4 ++-- lib/upload-lib.js | 4 ++-- lib/upload-sarif-action.js | 4 ++-- src/defaults.json | 8 ++++---- 10 files changed, 24 insertions(+), 24 deletions(-) diff --git a/lib/analyze-action.js b/lib/analyze-action.js index 129b7b56fa..95d689b058 100644 --- a/lib/analyze-action.js +++ b/lib/analyze-action.js @@ -88211,8 +88211,8 @@ var path4 = __toESM(require("path")); var semver4 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.23.6"; -var cliVersion = "2.23.6"; +var bundleVersion = "codeql-bundle-v2.23.7"; +var cliVersion = "2.23.7"; // src/overlay-database-utils.ts var fs3 = __toESM(require("fs")); diff --git a/lib/autobuild-action.js b/lib/autobuild-action.js index 7f856290fe..58ebe893fe 100644 --- a/lib/autobuild-action.js +++ b/lib/autobuild-action.js @@ -83701,8 +83701,8 @@ var path3 = __toESM(require("path")); var semver4 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.23.6"; -var cliVersion = "2.23.6"; +var bundleVersion = "codeql-bundle-v2.23.7"; +var cliVersion = "2.23.7"; // src/overlay-database-utils.ts var fs2 = __toESM(require("fs")); diff --git a/lib/defaults.json b/lib/defaults.json index 835b6a33b4..04929fab3e 100644 --- a/lib/defaults.json +++ b/lib/defaults.json @@ -1,6 +1,6 @@ { - "bundleVersion": "codeql-bundle-v2.23.6", - "cliVersion": "2.23.6", - "priorBundleVersion": "codeql-bundle-v2.23.5", - "priorCliVersion": "2.23.5" + "bundleVersion": "codeql-bundle-v2.23.7", + "cliVersion": "2.23.7", + "priorBundleVersion": "codeql-bundle-v2.23.6", + "priorCliVersion": "2.23.6" } diff --git a/lib/init-action-post.js b/lib/init-action-post.js index 88c0ecbc7b..1dc7861144 100644 --- a/lib/init-action-post.js +++ b/lib/init-action-post.js @@ -123084,8 +123084,8 @@ var path4 = __toESM(require("path")); var semver4 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.23.6"; -var cliVersion = "2.23.6"; +var bundleVersion = "codeql-bundle-v2.23.7"; +var cliVersion = "2.23.7"; // src/overlay-database-utils.ts var fs3 = __toESM(require("fs")); diff --git a/lib/init-action.js b/lib/init-action.js index fa23150d9e..94cb71839a 100644 --- a/lib/init-action.js +++ b/lib/init-action.js @@ -85635,8 +85635,8 @@ var path5 = __toESM(require("path")); var semver4 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.23.6"; -var cliVersion = "2.23.6"; +var bundleVersion = "codeql-bundle-v2.23.7"; +var cliVersion = "2.23.7"; // src/overlay-database-utils.ts var fs3 = __toESM(require("fs")); diff --git a/lib/setup-codeql-action.js b/lib/setup-codeql-action.js index e8c5332995..757a371df9 100644 --- a/lib/setup-codeql-action.js +++ b/lib/setup-codeql-action.js @@ -83589,8 +83589,8 @@ var path4 = __toESM(require("path")); var semver3 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.23.6"; -var cliVersion = "2.23.6"; +var bundleVersion = "codeql-bundle-v2.23.7"; +var cliVersion = "2.23.7"; // src/overlay-database-utils.ts var fs3 = __toESM(require("fs")); diff --git a/lib/start-proxy-action.js b/lib/start-proxy-action.js index 4c3262559f..7d282a3d29 100644 --- a/lib/start-proxy-action.js +++ b/lib/start-proxy-action.js @@ -99720,8 +99720,8 @@ function getActionsLogger() { var core7 = __toESM(require_core()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.23.6"; -var cliVersion = "2.23.6"; +var bundleVersion = "codeql-bundle-v2.23.7"; +var cliVersion = "2.23.7"; // src/languages.ts var KnownLanguage = /* @__PURE__ */ ((KnownLanguage2) => { diff --git a/lib/upload-lib.js b/lib/upload-lib.js index 1fc9f8f082..421bf23ebc 100644 --- a/lib/upload-lib.js +++ b/lib/upload-lib.js @@ -86724,8 +86724,8 @@ var path4 = __toESM(require("path")); var semver4 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.23.6"; -var cliVersion = "2.23.6"; +var bundleVersion = "codeql-bundle-v2.23.7"; +var cliVersion = "2.23.7"; // src/overlay-database-utils.ts var fs3 = __toESM(require("fs")); diff --git a/lib/upload-sarif-action.js b/lib/upload-sarif-action.js index 3bdcaf23e9..d0f6b08e23 100644 --- a/lib/upload-sarif-action.js +++ b/lib/upload-sarif-action.js @@ -86505,8 +86505,8 @@ var path4 = __toESM(require("path")); var semver3 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.23.6"; -var cliVersion = "2.23.6"; +var bundleVersion = "codeql-bundle-v2.23.7"; +var cliVersion = "2.23.7"; // src/overlay-database-utils.ts var fs3 = __toESM(require("fs")); diff --git a/src/defaults.json b/src/defaults.json index 835b6a33b4..04929fab3e 100644 --- a/src/defaults.json +++ b/src/defaults.json @@ -1,6 +1,6 @@ { - "bundleVersion": "codeql-bundle-v2.23.6", - "cliVersion": "2.23.6", - "priorBundleVersion": "codeql-bundle-v2.23.5", - "priorCliVersion": "2.23.5" + "bundleVersion": "codeql-bundle-v2.23.7", + "cliVersion": "2.23.7", + "priorBundleVersion": "codeql-bundle-v2.23.6", + "priorCliVersion": "2.23.6" } From a2c01e776e434421d4f8cba239abb06ec9713e92 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 5 Dec 2025 13:39:53 +0000 Subject: [PATCH 07/12] Add changelog note --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e305995c25..e9c101e1a5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th ## [UNRELEASED] -No user facing changes. +- Update default CodeQL bundle version to 2.23.7. [#3343](https://github.com/github/codeql-action/pull/3343) ## 4.31.6 - 01 Dec 2025 From f4ebe95061f10e93e9d301f51ed59c37fc67acde Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 5 Dec 2025 15:18:53 +0000 Subject: [PATCH 08/12] Update changelog for v4.31.7 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e9c101e1a5..bd5fb920f6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. -## [UNRELEASED] +## 4.31.7 - 05 Dec 2025 - Update default CodeQL bundle version to 2.23.7. [#3343](https://github.com/github/codeql-action/pull/3343) From 66d7f51a106d7a19c20daf2776dc3bdf1c38e818 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 5 Dec 2025 17:21:18 +0000 Subject: [PATCH 09/12] Revert "Update version and changelog for v3.31.6" This reverts commit dbf6819ebd5d23c6127cd3e65d4bb836b9fc3cb4. --- CHANGELOG.md | 29 ++++++++++++++++++----------- package.json | 2 +- 2 files changed, 19 insertions(+), 12 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 231ecb7a3d..5fe221f689 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,48 +2,48 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. -## 3.31.6 - 01 Dec 2025 +## 4.31.6 - 01 Dec 2025 No user facing changes. -## 3.31.5 - 24 Nov 2025 +## 4.31.5 - 24 Nov 2025 - Update default CodeQL bundle version to 2.23.6. [#3321](https://github.com/github/codeql-action/pull/3321) -## 3.31.4 - 18 Nov 2025 +## 4.31.4 - 18 Nov 2025 No user facing changes. -## 3.31.3 - 13 Nov 2025 +## 4.31.3 - 13 Nov 2025 - CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see [Upcoming deprecation of CodeQL Action v3](https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/). - Update default CodeQL bundle version to 2.23.5. [#3288](https://github.com/github/codeql-action/pull/3288) -## 3.31.2 - 30 Oct 2025 +## 4.31.2 - 30 Oct 2025 No user facing changes. -## 3.31.1 - 30 Oct 2025 +## 4.31.1 - 30 Oct 2025 - The `add-snippets` input has been removed from the `analyze` action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced. -## 3.31.0 - 24 Oct 2025 +## 4.31.0 - 24 Oct 2025 - Bump minimum CodeQL bundle version to 2.17.6. [#3223](https://github.com/github/codeql-action/pull/3223) - When SARIF files are uploaded by the `analyze` or `upload-sarif` actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the `upload-sarif` action. For `analyze`, this may affect Advanced Setup for CodeQL users who specify a value other than `always` for the `upload` input. [#3222](https://github.com/github/codeql-action/pull/3222) -## 3.30.9 - 17 Oct 2025 +## 4.30.9 - 17 Oct 2025 - Update default CodeQL bundle version to 2.23.3. [#3205](https://github.com/github/codeql-action/pull/3205) - Experimental: A new `setup-codeql` action has been added which is similar to `init`, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. [#3204](https://github.com/github/codeql-action/pull/3204) -## 3.30.8 - 10 Oct 2025 +## 4.30.8 - 10 Oct 2025 No user facing changes. -## 3.30.7 - 06 Oct 2025 +## 4.30.7 - 06 Oct 2025 -No user facing changes. +- [v4+ only] The CodeQL Action now runs on Node.js v24. [#3169](https://github.com/github/codeql-action/pull/3169) ## 3.30.6 - 02 Oct 2025 @@ -279,13 +279,17 @@ No user facing changes. ## 3.26.12 - 07 Oct 2024 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.14.5 and earlier. These versions of CodeQL were discontinued on 24 September 2024 alongside GitHub Enterprise Server 3.10, and will be unsupported by CodeQL Action versions 3.27.0 and later and versions 2.27.0 and later. [#2520](https://github.com/github/codeql-action/pull/2520) + - If you are using one of these versions, please update to CodeQL CLI version 2.14.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version. + - Alternatively, if you want to continue using a version of the CodeQL CLI between 2.13.5 and 2.14.5, you can replace `github/codeql-action/*@v3` by `github/codeql-action/*@v3.26.11` and `github/codeql-action/*@v2` by `github/codeql-action/*@v2.26.11` in your code scanning workflow to ensure you continue using this version of the CodeQL Action. ## 3.26.11 - 03 Oct 2024 - _Upcoming breaking change_: Add support for using `actions/download-artifact@v4` to programmatically consume CodeQL Action debug artifacts. + Starting November 30, 2024, GitHub.com customers will [no longer be able to use `actions/download-artifact@v3`](https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/). Therefore, to avoid breakage, customers who programmatically download the CodeQL Action debug artifacts should set the `CODEQL_ACTION_ARTIFACT_V4_UPGRADE` environment variable to `true` and bump `actions/download-artifact@v3` to `actions/download-artifact@v4` in their workflows. The CodeQL Action will enable this behavior by default in early November and workflows that have not yet bumped `actions/download-artifact@v3` to `actions/download-artifact@v4` will begin failing then. + This change is currently unavailable for GitHub Enterprise Server customers, as `actions/upload-artifact@v4` and `actions/download-artifact@v4` are not yet compatible with GHES. - Update default CodeQL bundle version to 2.19.1. [#2519](https://github.com/github/codeql-action/pull/2519) @@ -408,9 +412,12 @@ No user facing changes. ## 3.25.0 - 15 Apr 2024 - The deprecated feature for extracting dependencies for a Python analysis has been removed. [#2224](https://github.com/github/codeql-action/pull/2224) + As a result, the following inputs and environment variables are now ignored: + - The `setup-python-dependencies` input to the `init` Action - The `CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION` environment variable + We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0. - Automatically overwrite an existing database if found on the filesystem. [#2229](https://github.com/github/codeql-action/pull/2229) - Bump the minimum CodeQL bundle version to 2.12.6. [#2232](https://github.com/github/codeql-action/pull/2232) diff --git a/package.json b/package.json index e379ea04fe..14f1e770e6 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "3.31.6", + "version": "4.31.6", "private": true, "description": "CodeQL action", "scripts": { From c2e4b7785f0f23e58b06c645c5242cfcc5207ec7 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 5 Dec 2025 17:21:18 +0000 Subject: [PATCH 10/12] Revert "Rebuild" This reverts commit 89cb79a131a8a6dde4d0c5c300de8f62bc7fa7e7. --- lib/analyze-action-post.js | 2 +- lib/analyze-action.js | 2 +- lib/autobuild-action.js | 2 +- lib/init-action-post.js | 2 +- lib/init-action.js | 2 +- lib/resolve-environment-action.js | 2 +- lib/setup-codeql-action.js | 2 +- lib/start-proxy-action-post.js | 2 +- lib/start-proxy-action.js | 2 +- lib/upload-lib.js | 2 +- lib/upload-sarif-action-post.js | 2 +- lib/upload-sarif-action.js | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/lib/analyze-action-post.js b/lib/analyze-action-post.js index 9a172a87d7..2dd4d601dd 100644 --- a/lib/analyze-action-post.js +++ b/lib/analyze-action-post.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.31.6", + version: "4.31.6", private: true, description: "CodeQL action", scripts: { diff --git a/lib/analyze-action.js b/lib/analyze-action.js index d18b762275..1ee89a8320 100644 --- a/lib/analyze-action.js +++ b/lib/analyze-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.31.6", + version: "4.31.6", private: true, description: "CodeQL action", scripts: { diff --git a/lib/autobuild-action.js b/lib/autobuild-action.js index 77be381954..520a42f6a9 100644 --- a/lib/autobuild-action.js +++ b/lib/autobuild-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.31.6", + version: "4.31.6", private: true, description: "CodeQL action", scripts: { diff --git a/lib/init-action-post.js b/lib/init-action-post.js index 015acae08f..841e2eaabc 100644 --- a/lib/init-action-post.js +++ b/lib/init-action-post.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.31.6", + version: "4.31.6", private: true, description: "CodeQL action", scripts: { diff --git a/lib/init-action.js b/lib/init-action.js index 1a47cf98c0..05ee04747a 100644 --- a/lib/init-action.js +++ b/lib/init-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.31.6", + version: "4.31.6", private: true, description: "CodeQL action", scripts: { diff --git a/lib/resolve-environment-action.js b/lib/resolve-environment-action.js index ec4372d02f..4eee8e6ca3 100644 --- a/lib/resolve-environment-action.js +++ b/lib/resolve-environment-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.31.6", + version: "4.31.6", private: true, description: "CodeQL action", scripts: { diff --git a/lib/setup-codeql-action.js b/lib/setup-codeql-action.js index 132d9cb777..019d53e311 100644 --- a/lib/setup-codeql-action.js +++ b/lib/setup-codeql-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.31.6", + version: "4.31.6", private: true, description: "CodeQL action", scripts: { diff --git a/lib/start-proxy-action-post.js b/lib/start-proxy-action-post.js index 8c859ea91c..95c4a1ffd5 100644 --- a/lib/start-proxy-action-post.js +++ b/lib/start-proxy-action-post.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.31.6", + version: "4.31.6", private: true, description: "CodeQL action", scripts: { diff --git a/lib/start-proxy-action.js b/lib/start-proxy-action.js index ce7fbb168f..271c38e7ec 100644 --- a/lib/start-proxy-action.js +++ b/lib/start-proxy-action.js @@ -47321,7 +47321,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.31.6", + version: "4.31.6", private: true, description: "CodeQL action", scripts: { diff --git a/lib/upload-lib.js b/lib/upload-lib.js index d9ad883bfa..5c04f54973 100644 --- a/lib/upload-lib.js +++ b/lib/upload-lib.js @@ -28924,7 +28924,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.31.6", + version: "4.31.6", private: true, description: "CodeQL action", scripts: { diff --git a/lib/upload-sarif-action-post.js b/lib/upload-sarif-action-post.js index 69fbcd0142..5fb0b0d77d 100644 --- a/lib/upload-sarif-action-post.js +++ b/lib/upload-sarif-action-post.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.31.6", + version: "4.31.6", private: true, description: "CodeQL action", scripts: { diff --git a/lib/upload-sarif-action.js b/lib/upload-sarif-action.js index 921a7f41ba..09f6f8d53e 100644 --- a/lib/upload-sarif-action.js +++ b/lib/upload-sarif-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.31.6", + version: "4.31.6", private: true, description: "CodeQL action", scripts: { From 793f7006bb3c6eeffc198e247d501ec4e76593bb Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 5 Dec 2025 17:21:20 +0000 Subject: [PATCH 11/12] Update version and changelog for v3.31.7 --- CHANGELOG.md | 31 ++++++++++++------------------- package.json | 2 +- 2 files changed, 13 insertions(+), 20 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bd5fb920f6..c42359f6ad 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,52 +2,52 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. -## 4.31.7 - 05 Dec 2025 +## 3.31.7 - 05 Dec 2025 - Update default CodeQL bundle version to 2.23.7. [#3343](https://github.com/github/codeql-action/pull/3343) -## 4.31.6 - 01 Dec 2025 +## 3.31.6 - 01 Dec 2025 No user facing changes. -## 4.31.5 - 24 Nov 2025 +## 3.31.5 - 24 Nov 2025 - Update default CodeQL bundle version to 2.23.6. [#3321](https://github.com/github/codeql-action/pull/3321) -## 4.31.4 - 18 Nov 2025 +## 3.31.4 - 18 Nov 2025 No user facing changes. -## 4.31.3 - 13 Nov 2025 +## 3.31.3 - 13 Nov 2025 - CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see [Upcoming deprecation of CodeQL Action v3](https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/). - Update default CodeQL bundle version to 2.23.5. [#3288](https://github.com/github/codeql-action/pull/3288) -## 4.31.2 - 30 Oct 2025 +## 3.31.2 - 30 Oct 2025 No user facing changes. -## 4.31.1 - 30 Oct 2025 +## 3.31.1 - 30 Oct 2025 - The `add-snippets` input has been removed from the `analyze` action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced. -## 4.31.0 - 24 Oct 2025 +## 3.31.0 - 24 Oct 2025 - Bump minimum CodeQL bundle version to 2.17.6. [#3223](https://github.com/github/codeql-action/pull/3223) - When SARIF files are uploaded by the `analyze` or `upload-sarif` actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the `upload-sarif` action. For `analyze`, this may affect Advanced Setup for CodeQL users who specify a value other than `always` for the `upload` input. [#3222](https://github.com/github/codeql-action/pull/3222) -## 4.30.9 - 17 Oct 2025 +## 3.30.9 - 17 Oct 2025 - Update default CodeQL bundle version to 2.23.3. [#3205](https://github.com/github/codeql-action/pull/3205) - Experimental: A new `setup-codeql` action has been added which is similar to `init`, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. [#3204](https://github.com/github/codeql-action/pull/3204) -## 4.30.8 - 10 Oct 2025 +## 3.30.8 - 10 Oct 2025 No user facing changes. -## 4.30.7 - 06 Oct 2025 +## 3.30.7 - 06 Oct 2025 -- [v4+ only] The CodeQL Action now runs on Node.js v24. [#3169](https://github.com/github/codeql-action/pull/3169) +No user facing changes. ## 3.30.6 - 02 Oct 2025 @@ -283,17 +283,13 @@ No user facing changes. ## 3.26.12 - 07 Oct 2024 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.14.5 and earlier. These versions of CodeQL were discontinued on 24 September 2024 alongside GitHub Enterprise Server 3.10, and will be unsupported by CodeQL Action versions 3.27.0 and later and versions 2.27.0 and later. [#2520](https://github.com/github/codeql-action/pull/2520) - - If you are using one of these versions, please update to CodeQL CLI version 2.14.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version. - - Alternatively, if you want to continue using a version of the CodeQL CLI between 2.13.5 and 2.14.5, you can replace `github/codeql-action/*@v3` by `github/codeql-action/*@v3.26.11` and `github/codeql-action/*@v2` by `github/codeql-action/*@v2.26.11` in your code scanning workflow to ensure you continue using this version of the CodeQL Action. ## 3.26.11 - 03 Oct 2024 - _Upcoming breaking change_: Add support for using `actions/download-artifact@v4` to programmatically consume CodeQL Action debug artifacts. - Starting November 30, 2024, GitHub.com customers will [no longer be able to use `actions/download-artifact@v3`](https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/). Therefore, to avoid breakage, customers who programmatically download the CodeQL Action debug artifacts should set the `CODEQL_ACTION_ARTIFACT_V4_UPGRADE` environment variable to `true` and bump `actions/download-artifact@v3` to `actions/download-artifact@v4` in their workflows. The CodeQL Action will enable this behavior by default in early November and workflows that have not yet bumped `actions/download-artifact@v3` to `actions/download-artifact@v4` will begin failing then. - This change is currently unavailable for GitHub Enterprise Server customers, as `actions/upload-artifact@v4` and `actions/download-artifact@v4` are not yet compatible with GHES. - Update default CodeQL bundle version to 2.19.1. [#2519](https://github.com/github/codeql-action/pull/2519) @@ -416,12 +412,9 @@ No user facing changes. ## 3.25.0 - 15 Apr 2024 - The deprecated feature for extracting dependencies for a Python analysis has been removed. [#2224](https://github.com/github/codeql-action/pull/2224) - As a result, the following inputs and environment variables are now ignored: - - The `setup-python-dependencies` input to the `init` Action - The `CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION` environment variable - We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0. - Automatically overwrite an existing database if found on the filesystem. [#2229](https://github.com/github/codeql-action/pull/2229) - Bump the minimum CodeQL bundle version to 2.12.6. [#2232](https://github.com/github/codeql-action/pull/2232) diff --git a/package.json b/package.json index 32ea9facb1..b523622324 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "4.31.7", + "version": "3.31.7", "private": true, "description": "CodeQL action", "scripts": { From 817dbfb39b59fdd720cf48a800d33a21ed4ed3a2 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 5 Dec 2025 20:45:51 +0000 Subject: [PATCH 12/12] Rebuild --- lib/analyze-action-post.js | 2 +- lib/analyze-action.js | 2 +- lib/autobuild-action.js | 2 +- lib/init-action-post.js | 2 +- lib/init-action.js | 2 +- lib/resolve-environment-action.js | 2 +- lib/setup-codeql-action.js | 2 +- lib/start-proxy-action-post.js | 2 +- lib/start-proxy-action.js | 2 +- lib/upload-lib.js | 2 +- lib/upload-sarif-action-post.js | 2 +- lib/upload-sarif-action.js | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/lib/analyze-action-post.js b/lib/analyze-action-post.js index 88d0665c53..54ee7cf670 100644 --- a/lib/analyze-action-post.js +++ b/lib/analyze-action-post.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.7", + version: "3.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/analyze-action.js b/lib/analyze-action.js index 95d689b058..376e49aae4 100644 --- a/lib/analyze-action.js +++ b/lib/analyze-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.7", + version: "3.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/autobuild-action.js b/lib/autobuild-action.js index 58ebe893fe..7ae64e64c2 100644 --- a/lib/autobuild-action.js +++ b/lib/autobuild-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.7", + version: "3.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/init-action-post.js b/lib/init-action-post.js index 1dc7861144..4e850acb3d 100644 --- a/lib/init-action-post.js +++ b/lib/init-action-post.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.7", + version: "3.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/init-action.js b/lib/init-action.js index 94cb71839a..04809ab6dd 100644 --- a/lib/init-action.js +++ b/lib/init-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.7", + version: "3.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/resolve-environment-action.js b/lib/resolve-environment-action.js index 95681d88aa..ce4216b8c2 100644 --- a/lib/resolve-environment-action.js +++ b/lib/resolve-environment-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.7", + version: "3.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/setup-codeql-action.js b/lib/setup-codeql-action.js index 757a371df9..bbd253732a 100644 --- a/lib/setup-codeql-action.js +++ b/lib/setup-codeql-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.7", + version: "3.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/start-proxy-action-post.js b/lib/start-proxy-action-post.js index ac38fef38e..2f08800528 100644 --- a/lib/start-proxy-action-post.js +++ b/lib/start-proxy-action-post.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.7", + version: "3.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/start-proxy-action.js b/lib/start-proxy-action.js index 7d282a3d29..cc727363e9 100644 --- a/lib/start-proxy-action.js +++ b/lib/start-proxy-action.js @@ -47321,7 +47321,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.7", + version: "3.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/upload-lib.js b/lib/upload-lib.js index 421bf23ebc..8f403a7b1e 100644 --- a/lib/upload-lib.js +++ b/lib/upload-lib.js @@ -28924,7 +28924,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.7", + version: "3.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/upload-sarif-action-post.js b/lib/upload-sarif-action-post.js index ab66301a4b..7788767628 100644 --- a/lib/upload-sarif-action-post.js +++ b/lib/upload-sarif-action-post.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.7", + version: "3.31.7", private: true, description: "CodeQL action", scripts: { diff --git a/lib/upload-sarif-action.js b/lib/upload-sarif-action.js index d0f6b08e23..aefec4ba5d 100644 --- a/lib/upload-sarif-action.js +++ b/lib/upload-sarif-action.js @@ -27627,7 +27627,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "4.31.7", + version: "3.31.7", private: true, description: "CodeQL action", scripts: {