Update default CodeQL bundle version to 2.17.1. #2247
Workflows running on macos-latest using CodeQL CLI versions before v2.15.1 will need to either upgrade their CLI version to v2.15.1 or newer, or change the platform to an Intel MacOS runner, such as macos-12. ARM machines with SIP disabled, including the newest macos-latest image, are unsupported for CLI versions before 2.15.1. #2261
3.25.2 - 22 Apr 2024
No user facing changes.
Commits
d39d31e Merge pull request #2262 from github/update-v3.25.3-ac2f82a1f
This patch release fixes a bug in both dependency-submission and setup-gradle (#196 introduced in v3.3.1), which resulted in
"No dependency-graph files found to submit" when using the download-and-submit function.
A number of other minor issues have also been addressed:
What's Changed
[dependency-submission] Fix bug finding dependency-graph files with 'download-and-submit' (#199)
[dependency-submission] Use Gradle logger instead of println in dependency graph init script (#191 from @aleksandrserbin)
[dependency-submission] Retain and log full stacktrace for dependency submission errors (#192)
[setup-gradle] Improve build scan badge readability with long task names (#200 from @gabrielfeo)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Bumps the prod-github-actions group with 4 updates: actions/checkout, github/codeql-action, gradle/actions and actions/upload-artifact.
Updates
actions/checkout
from 4.1.3 to 4.1.4Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
Commits
0ad4b8f
Prep Release v4.1.4 (#1704)43045ae
Disableextensions.worktreeConfig
when disablingsparse-checkout
(#1692)37b0821
Bump the minor-actions-dependencies group with 2 updates (#1693)9839dc1
Add dependabot config (#1688)9b4c13b
Bump word-wrap from 1.2.3 to 1.2.5 (#1643)Updates
github/codeql-action
from 3.25.1 to 3.25.3Changelog
Sourced from github/codeql-action's changelog.
Commits
d39d31e
Merge pull request #2262 from github/update-v3.25.3-ac2f82a1fa727825
Move changenote to most recent section1efa859
Update changelog for v3.25.3ac2f82a
Log warning if SIP is disabled and CLI version is < 2.15.1 (#2261)0ad7791
Merge pull request #2247 from github/update-bundle/codeql-bundle-v2.17.179d9ee7
Merge branch 'main' into update-bundle/codeql-bundle-v2.17.1dbf2b17
Merge pull request #2255 from github/mergeback/v3.25.2-to-main-8f596b4aff6a3c4
Update checked-in dependencies619dc0c
Update changelog and version after v3.25.28f596b4
Merge pull request #2254 from github/update-v3.25.2-4909c1ffbUpdates
gradle/actions
from 3.3.1 to 3.3.2Release notes
Sourced from gradle/actions's releases.
Commits
db19848
[bot] Update dist directory941b289
Avoid running Gradle 3.5.1 on MacOS where Java 8 is not availablebce7dac
Improve build scan badge readability with long tasks (#200)11eaed9
Avoid Java 8 since it is not available on MacOS runnerscd62d9c
Improve job summary readability with long tasksa54fb6a
Add tests on current job-summary behavioref36f81
Fix typo in build shell script18998bc
[bot] Update dist directorya772c14
Avoid updating real dependency graph in tests7763d71
Set the report dir for download-and-submitUpdates
actions/upload-artifact
from 4.3.2 to 4.3.3Release notes
Sourced from actions/upload-artifact's releases.
Commits
6546280
updating package versionc004fb4
Merge branch 'main' into eggyhead/use-artifact-v2.1.690aba49
updating toolkit artifact dependency to 2.1.6b06cde3
Merge pull request #563 from actions/eggyhead/release-4.3.2Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show