Update default CodeQL bundle version to 2.17.1. #2247
Workflows running on macos-latest using CodeQL CLI versions before v2.15.1 will need to either upgrade their CLI version to v2.15.1 or newer, or change the platform to an Intel MacOS runner, such as macos-12. ARM machines with SIP disabled, including the newest macos-latest image, are unsupported for CLI versions before 2.15.1. #2261
3.25.2 - 22 Apr 2024
No user facing changes.
3.25.1 - 17 Apr 2024
We are rolling out a feature in April/May 2024 that improves the reliability and performance of analyzing code when analyzing a compiled language with the autobuildbuild mode. #2235
Fix a bug where the init Action would fail if --overwrite was specified in CODEQL_ACTION_EXTRA_OPTIONS. #2245
3.25.0 - 15 Apr 2024
The deprecated feature for extracting dependencies for a Python analysis has been removed. #2224
As a result, the following inputs and environment variables are now ignored:
The setup-python-dependencies input to the init Action
The CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION environment variable
We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0.
Automatically overwrite an existing database if found on the filesystem. #2229
Bump the minimum CodeQL bundle version to 2.12.6. #2232
A more relevant log message and a diagnostic are now emitted when the file program is not installed on a Linux runner, but is required for Go tracing to succeed. #2234
3.24.10 - 05 Apr 2024
Update default CodeQL bundle version to 2.17.0. #2219
Add a deprecation warning for customers using CodeQL version 2.12.5 and earlier. These versions of CodeQL were discontinued on 26 March 2024 alongside GitHub Enterprise Server 3.8, and will be unsupported by CodeQL Action versions 3.25.0 and later and versions 2.25.0 and later. #2220
If you are using one of these versions, please update to CodeQL CLI version 2.12.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.
Alternatively, if you want to continue using a version of the CodeQL CLI between 2.11.6 and 2.12.5, you can replace github/codeql-action/*@v3 by github/codeql-action/*@v3.24.10 and github/codeql-action/*@v2 by github/codeql-action/*@v2.24.10 in your code scanning workflow to ensure you continue using this version of the CodeQL Action.
Commits
d39d31e Merge pull request #2262 from github/update-v3.25.3-ac2f82a1f
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Bumps the github-actions group with 7 updates:
4.1.2
4.1.4
4.3.1
4.3.3
4.1.4
4.1.7
4.1.1
4.3.1
3.24.9
3.25.3
6.0.2
6.0.5
1.1.1
1.1.2
Updates
actions/checkout
from 4.1.2 to 4.1.4Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
Commits
0ad4b8f
Prep Release v4.1.4 (#1704)43045ae
Disableextensions.worktreeConfig
when disablingsparse-checkout
(#1692)37b0821
Bump the minor-actions-dependencies group with 2 updates (#1693)9839dc1
Add dependabot config (#1688)9b4c13b
Bump word-wrap from 1.2.3 to 1.2.5 (#1643)1d96c77
Add SSH user parameter (#1685)cd7d8d6
Check git version before attempting to disablesparse-checkout
(#1656)8410ad0
Updateactions/checkout
version inupdate-main-version.yml
(#1650)Updates
actions/upload-artifact
from 4.3.1 to 4.3.3Release notes
Sourced from actions/upload-artifact's releases.
Commits
6546280
updating package versionc004fb4
Merge branch 'main' into eggyhead/use-artifact-v2.1.690aba49
updating toolkit artifact dependency to 2.1.6b06cde3
Merge pull request #563 from actions/eggyhead/release-4.3.21746f4a
Revert "updating to release 4.3.2"31685d0
updating to release 4.3.218bf333
Merge pull request #562 from actions/eggyhead/update-artifact-v215dac413b
update package lock versionbb3b4a3
updating package version3e3da83
updating artifact and core dependenciesUpdates
actions/download-artifact
from 4.1.4 to 4.1.7Release notes
Sourced from actions/download-artifact's releases.
Commits
65a9edc
Merge pull request #325 from bethanyj28/mainfdd1595
licensedc13dba1
update@actions/artifact
dependency0daa75e
Merge pull request #324 from actions/eggyhead/use-artifact-v2.1.69c19ed7
Merge branch 'main' into eggyhead/use-artifact-v2.1.63d3ea87
updating license89af5db
updating artifact package v2.1.6b4aefff
Merge pull request #323 from actions/eggyhead/update-artifact-v2158caf195
package lock updated7a2ec4
updating package versionUpdates
codecov/codecov-action
from 4.1.1 to 4.3.1Release notes
Sourced from codecov/codecov-action's releases.
Commits
6020e12
chore(release): 4.3.1.5a299d1
fix: bypass token checks for forks and OIDC (#1404)dad251d
docs: main branch (#1396)e8bbe5f
docs: Type Annotations (#1397)a6fd87f
build(deps-dev): bump@typescript-eslint/parser
from 7.7.1 to 7.8.0 (#1401)76c8cd6
build(deps-dev): bump@typescript-eslint/eslint-plugin
from 7.7.1 to 7.8.0 (#...1290bdd
style: Node Packages (#1394)951ef79
build(deps): bump github/codeql-action from 3.25.1 to 3.25.3 (#1391)bb71c1b
build(deps): bump actions/checkout from 4.1.3 to 4.1.4 (#1392)acc5d43
build(deps): bump actions/upload-artifact from 4.3.2 to 4.3.3 (#1393)Updates
github/codeql-action
from 3.24.9 to 3.25.3Changelog
Sourced from github/codeql-action's changelog.
Commits
d39d31e
Merge pull request #2262 from github/update-v3.25.3-ac2f82a1fa727825
Move changenote to most recent section1efa859
Update changelog for v3.25.3ac2f82a
Log warning if SIP is disabled and CLI version is < 2.15.1 (#2261)0ad7791
Merge pull request #2247 from github/update-bundle/codeql-bundle-v2.17.179d9ee7
Merge branch 'main' into update-bundle/codeql-bundle-v2.17.1dbf2b17
Merge pull request #2255 from github/mergeback/v3.25.2-to-main-8f596b4aff6a3c4
Update checked-in dependencies619dc0c
Update changelog and version after v3.25.28f596b4
Merge pull request #2254 from github/update-v3.25.2-4909c1ffbUpdates
peter-evans/create-pull-request
from 6.0.2 to 6.0.5Release notes
Sourced from peter-evans/create-pull-request's releases.
Commits
6d6857d
fix: update proxy support to follow octokit change to fetch api (#2867)9153d83
perf: limit the fetch depth of pr branch (#2857)c55203c
fix: drop unnecessary fetch with unshallow on push-to-fork (#2849)6ce4eca
build(deps-dev): bump@types/node
from 18.19.28 to 18.19.31 (#2842)36ef0ed
build(deps-dev): bump@types/node
from 18.19.26 to 18.19.28 (#2836)8500972
build(deps-dev): bump@types/node
from 18.19.25 to 18.19.26 (#2831)bda5ade
build(deps-dev): bump@types/node
from 18.19.23 to 18.19.25 (#2826)Updates
dsaltares/fetch-gh-release-asset
from 1.1.1 to 1.1.2Release notes
Sourced from dsaltares/fetch-gh-release-asset's releases.
Commits
aa2ab12
fix: 61 - upgrade to node 20 (#63)cdaf216
feat: support unauthenticated requests (#59)5d24fa7
chore: remove support noticeDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show