chore(deps): update github/codeql-action action to v4 by renovate[bot] · Pull Request #128 · classicvalues/nextjs-flask

renovate · 2025-10-07T16:30:30Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Type	Change	Package file	References
github/codeql-action	major	action	`v2` → `v4`	.github/workflows/xanitizer.yml	source
github/codeql-action	major	action	`v2.20.2` → `v4.38.1`	.github/workflows/scorecards.yml	source

Release Notes

github/codeql-action (github/codeql-action)

`v4.38.1`

Compare Source

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

`v4.38.0`

Compare Source

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
Update default CodeQL bundle version to 2.27.0. #4129

`v4.37.9`

Compare Source

Update default CodeQL bundle version to 2.26.4. #4106

`v4.37.8`

Compare Source

No user facing changes.

`v4.37.7`

Compare Source

Update default CodeQL bundle version to 2.26.3. #4085

`v4.37.6`

Compare Source

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

`v4.37.5`

Compare Source

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

`v4.37.4`

Compare Source

`v4.37.3`

Compare Source

No user facing changes.

`v4.37.2`

Compare Source

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

`v4.37.1`

Compare Source

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
Update default CodeQL bundle version to 2.26.1. #4019

`v4.37.0`

Compare Source

Update default CodeQL bundle version to 2.26.0. #3995
In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

`v4.36.3`

Compare Source

No user facing changes.

`v4.36.2`

Compare Source

Cache CodeQL CLI version information across Actions steps. #3943
Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
Update default CodeQL bundle version to 2.25.6. #3948

`v4.36.1`

Compare Source

No user facing changes.

`v4.36.0`

Compare Source

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
Add support for SHA-256 Git object IDs. #3893
Update default CodeQL bundle version to 2.25.5. #3926

`v4.35.5`

Compare Source

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

`v4.35.4`

Compare Source

Update default CodeQL bundle version to 2.25.4. #3881

`v4.35.3`

Compare Source

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
Update default CodeQL bundle version to 2.25.3. #3865

`v4.35.2`

Compare Source

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794
Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807
Update default CodeQL bundle version to 2.25.2. #3823

`v4.35.1`

Compare Source

Fix incorrect minimum required Git version for improved incremental analysis: it should have been 2.36.0, not 2.11.0. #3781

`v4.35.0`

Compare Source

Reduced the minimum Git version required for improved incremental analysis from 2.38.0 to 2.11.0. #3767
Update default CodeQL bundle version to 2.25.1. #3773

`v4.34.1`

Compare Source

Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

`v4.34.0`

Compare Source

Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569
We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584
Update default CodeQL bundle version to 2.25.0. #3585

`v4.33.0`

Compare Source

Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562

To opt out of this change:
- Repositories owned by an organization: Create a custom repository property with the name github-codeql-file-coverage-on-prs and the type "True/false", then set this property to true in the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
- User-owned repositories using default setup: Switch to an advanced setup workflow and set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
- User-owned repositories using advanced setup: Set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #3557
The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as github-codeql-disable-overlay that was previously only available on GitHub.com. #3559
Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #3563
Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #3564
A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. #3570

`v4.32.6`

Compare Source

Update default CodeQL bundle version to 2.24.3. #3548

`v4.32.5`

Compare Source

Repositories owned by an organization can now set up the github-codeql-disable-overlay custom repository property to disable improved incremental analysis for CodeQL. First, create a custom repository property with the name github-codeql-disable-overlay and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to true to disable improved incremental analysis. For more information, see Managing custom properties for repositories in your organization. This feature is not yet available on GitHub Enterprise Server. #3507
Added an experimental change so that when improved incremental analysis fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. #3487
The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. #3515
Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. #3516
Added an experimental change which lowers the minimum disk space requirement for improved incremental analysis, enabling it to run on standard GitHub Actions runners. We expect to roll this change out to everyone in March. #3498
Added an experimental change which allows the start-proxy action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. #3512
The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. #3503, #3504

`v4.32.4`

Compare Source

Update default CodeQL bundle version to 2.24.2. #3493
Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when private package registries are configured. This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. #3473
When the CodeQL Action is run with debugging enabled in Default Setup and private package registries are configured, the "Setup proxy for registries" step will output additional diagnostic information that can be used for troubleshooting. #3486
Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. #3485
Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a nightly CodeQL CLI release instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. #3484

`v4.32.3`

Compare Source

Added experimental support for testing connections to private package registries. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. #3466

`v4.32.2`

Compare Source

Update default CodeQL bundle version to 2.24.1. #3460

`v4.32.1`

Compare Source

A warning is now shown in Default Setup workflow logs if a private package registry is configured using a GitHub Personal Access Token (PAT), but no username is configured. #3422
Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. #3421

`v4.32.0`

Compare Source

Update default CodeQL bundle version to 2.24.0. #3425

`v4.31.11`

Compare Source

When running a Default Setup workflow with Actions debugging enabled, the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. #3409
Improved error handling throughout the CodeQL Action. #3415
Added experimental support for automatically excluding generated files from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. #3318
The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. #3403

`v4.31.10`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.10 - 12 Jan 2026

Update default CodeQL bundle version to 2.23.9. #3393

See the full CHANGELOG.md for more information.

`v4.31.9`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.9 - 16 Dec 2025

No user facing changes.

See the full CHANGELOG.md for more information.

`v4.31.8`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.8 - 11 Dec 2025

Update default CodeQL bundle version to 2.23.8. #3354

See the full CHANGELOG.md for more information.

`v4.31.7`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.7 - 05 Dec 2025

Update default CodeQL bundle version to 2.23.7. #3343

See the full CHANGELOG.md for more information.

`v4.31.6`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.6 - 01 Dec 2025

No user facing changes.

See the full CHANGELOG.md for more information.

`v4.31.5`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.5 - 24 Nov 2025

Update default CodeQL bundle version to 2.23.6. #3321

See the full CHANGELOG.md for more information.

`v4.31.4`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.4 - 18 Nov 2025

No user facing changes.

See the full CHANGELOG.md for more information.

`v4.31.3`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.3 - 13 Nov 2025

CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see Upcoming deprecation of CodeQL Action v3.
Update default CodeQL bundle version to 2.23.5. #3288

See the full CHANGELOG.md for more information.

`v4.31.2`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.2 - 30 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

`v4.31.1`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.1 - 30 Oct 2025

The add-snippets input has been removed from the analyze action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.

See the full CHANGELOG.md for more information.

`v4.31.0`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.0 - 24 Oct 2025

Bump minimum CodeQL bundle version to 2.17.6. #3223
When SARIF files are uploaded by the analyze or upload-sarif actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the upload-sarif action. For analyze, this may affect Advanced Setup for CodeQL users who specify a value other than always for the upload input. #3222

See the full CHANGELOG.md for more information.

`v4.30.9`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.9 - 17 Oct 2025

Update default CodeQL bundle version to 2.23.3. #3205
Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

See the full CHANGELOG.md for more information.

`v4.30.8`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.8 - 10 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

`v4.30.7`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.7 - 06 Oct 2025

[v4+ only] The CodeQL Action now runs on Node.js v24. #3169

See the full CHANGELOG.md for more information.

`v4`

Compare Source

`v3.38.1`

Compare Source

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

`v3.38.0`

Compare Source

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
Update default CodeQL bundle version to 2.27.0. #4129

`v3.37.9`

Compare Source

Update default CodeQL bundle version to 2.26.4. #4106

`v3.37.8`

Compare Source

No user facing changes.

`v3.37.7`

Compare Source

Update default CodeQL bundle version to 2.26.3. #4085

`v3.37.6`

Compare Source

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

`v3.37.5`

Compare Source

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

`v3.37.4`

Compare Source

This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
Update default CodeQL bundle version to 2.26.2. #4051

`v3.37.3`

Compare Source

No user facing changes.

`v3.37.2`

Compare Source

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

`v3.37.1`

Compare Source

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
Update default CodeQL bundle version to 2.26.1. #4019

`v3.37.0`

Compare Source

`v3.36.3`

Compare Source

No user facing changes.

`v3.36.2`

Compare Source

Cache CodeQL CLI version information across Actions steps. #3943
Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
Update default CodeQL bundle version to 2.25.6. #3948

`v3.36.1`

Compare Source

No user facing changes.

`v3.36.0`

Compare Source

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
Add support for SHA-256 Git object IDs. #3893
Update default CodeQL bundle version to 2.25.5. #3926

`v3.35.5`

Compare Source

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

`v3.35.4`

Compare Source

Update default CodeQL bundle version to 2.25.4. #3881

`v3.35.3`

Compare Source

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
Update default CodeQL bundle version to 2.25.3. #3865

`v3.35.2`

Compare Source

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794
Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807
Update default CodeQL bundle version to 2.25.2. #3823

`v3.35.1`

Compare Source

Fix incorrect minimum required Git version for improved incremental analysis: it should have been 2.36.0, not 2.11.0. #3781

`v3.35.0`

Compare Source

Reduced the minimum Git version required for improved incremental analysis from 2.38.0 to 2.11.0. #3767
Update default CodeQL bundle version to 2.25.1. #3773

`v3.34.1`

Compare Source

Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

`v3.34.0`

Compare Source

Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569
We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584
Update default CodeQL bundle version to 2.25.0. #3585

`v3.33.0`

Compare Source

Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve anal

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot added dependency-update major labels Oct 7, 2025

renovate Bot had a problem deploying to production October 7, 2025 16:30 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from f8eaa71 to 9d87cec Compare October 10, 2025 23:49

renovate Bot had a problem deploying to production October 10, 2025 23:49 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 9d87cec to 3c43e5d Compare October 18, 2025 02:09

renovate Bot had a problem deploying to production October 18, 2025 02:10 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 3c43e5d to 7f18e50 Compare October 25, 2025 23:17

renovate Bot had a problem deploying to production October 25, 2025 23:17 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 7f18e50 to e720e98 Compare November 2, 2025 11:37

renovate Bot had a problem deploying to production November 2, 2025 11:37 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from e720e98 to 9018fd2 Compare November 15, 2025 08:20

renovate Bot had a problem deploying to production November 15, 2025 08:20 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 9018fd2 to 19b0d50 Compare November 19, 2025 00:30

renovate Bot had a problem deploying to production November 19, 2025 00:30 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 19b0d50 to 9de10e8 Compare November 24, 2025 13:48

renovate Bot had a problem deploying to production November 24, 2025 13:48 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 9de10e8 to 7805b5f Compare December 1, 2025 23:11

renovate Bot had a problem deploying to production December 1, 2025 23:11 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 7805b5f to fc8a706 Compare December 6, 2025 11:55

renovate Bot had a problem deploying to production December 6, 2025 11:55 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from fc8a706 to f19842a Compare December 12, 2025 11:06

renovate Bot had a problem deploying to production December 12, 2025 11:06 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from f19842a to 60978c8 Compare December 17, 2025 02:39

renovate Bot had a problem deploying to production December 17, 2025 02:39 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 60978c8 to 8801d53 Compare January 12, 2026 18:14

renovate Bot had a problem deploying to production January 12, 2026 18:14 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 8801d53 to 7586693 Compare January 23, 2026 20:28

renovate Bot had a problem deploying to production January 23, 2026 20:28 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 7586693 to 602abca Compare January 26, 2026 21:49

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 27c81fa to 960d41e Compare March 8, 2026 07:08

renovate Bot had a problem deploying to production March 8, 2026 07:08 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 960d41e to 76d7113 Compare March 16, 2026 10:39

renovate Bot had a problem deploying to production March 16, 2026 10:39 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 76d7113 to 8873da9 Compare March 31, 2026 10:43

renovate Bot had a problem deploying to production March 31, 2026 10:43 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 8873da9 to 63ea7fe Compare April 19, 2026 06:08

renovate Bot had a problem deploying to production April 19, 2026 06:08 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 63ea7fe to 8f3be91 Compare May 2, 2026 07:40

renovate Bot had a problem deploying to production May 2, 2026 07:40 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 8f3be91 to 94ee2a3 Compare May 7, 2026 17:06

renovate Bot had a problem deploying to production May 7, 2026 17:06 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 94ee2a3 to e65e107 Compare May 17, 2026 07:39

renovate Bot had a problem deploying to production May 17, 2026 07:39 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from e65e107 to 75c0639 Compare May 22, 2026 13:08

renovate Bot had a problem deploying to production May 22, 2026 13:08 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 75c0639 to 11ddd25 Compare June 7, 2026 08:08

renovate Bot had a problem deploying to production June 7, 2026 08:08 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 11ddd25 to 3b1305d Compare July 4, 2026 00:13

renovate Bot had a problem deploying to production July 4, 2026 00:13 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 3b1305d to 92b7693 Compare July 8, 2026 12:45

renovate Bot had a problem deploying to production July 8, 2026 12:45 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 92b7693 to 4df9b7c Compare July 18, 2026 04:11

renovate Bot had a problem deploying to production July 18, 2026 04:11 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 4df9b7c to 351ac4e Compare July 25, 2026 19:09

renovate Bot had a problem deploying to production July 25, 2026 19:09 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 351ac4e to 15921bb Compare August 1, 2026 06:48

renovate Bot had a problem deploying to production August 1, 2026 06:48 Failure

renovate Bot force-pushed the renovate/github-codeql-action-4.x branch from 15921bb to 9641f90 Compare August 3, 2026 13:11

chore(deps): update github/codeql-action action to v4

3b8a8e7

Navigation Menu

chore(deps): update github/codeql-action action to v4 - #128

chore(deps): update github/codeql-action action to v4#128
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/github-codeql-action-4.x

renovate Bot commented Oct 7, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

CodeQL Action Changelog

4.31.10 - 12 Jan 2026

CodeQL Action Changelog

4.31.9 - 16 Dec 2025

CodeQL Action Changelog

4.31.8 - 11 Dec 2025

CodeQL Action Changelog

4.31.7 - 05 Dec 2025

CodeQL Action Changelog

4.31.6 - 01 Dec 2025

CodeQL Action Changelog

4.31.5 - 24 Nov 2025

CodeQL Action Changelog

4.31.4 - 18 Nov 2025

CodeQL Action Changelog

4.31.3 - 13 Nov 2025

CodeQL Action Changelog

4.31.2 - 30 Oct 2025

CodeQL Action Changelog

4.31.1 - 30 Oct 2025

CodeQL Action Changelog

4.31.0 - 24 Oct 2025

CodeQL Action Changelog

4.30.9 - 17 Oct 2025

CodeQL Action Changelog

4.30.8 - 10 Oct 2025

CodeQL Action Changelog

4.30.7 - 06 Oct 2025

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Oct 7, 2025 •

edited

Loading