Merge branch 'main' into redsun82-linux-arm64-support

Author: redsun82

CHANGELOG.md

@@ -6,6 +6,14 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 - The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and download the native `linux-arm64` CodeQL bundle when available. [#4072](https://github.com/github/codeql-action/pull/4072)
 
+## 4.37.8 - 21 Aug 2026
+
+No user facing changes.
+
+## 4.37.7 - 13 Aug 2026
+
+- Update default CodeQL bundle version to [2.26.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3). [#4085](https://github.com/github/codeql-action/pull/4085)
+
 ## 4.37.6 - 04 Aug 2026
 
 - Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://github.com/github/codeql-action/pull/4070)

lib/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.26.2",
-  "cliVersion": "2.26.2",
-  "priorBundleVersion": "codeql-bundle-v2.26.1",
-  "priorCliVersion": "2.26.1"
+  "bundleVersion": "codeql-bundle-v2.26.3",
+  "cliVersion": "2.26.3",
+  "priorBundleVersion": "codeql-bundle-v2.26.2",
+  "priorCliVersion": "2.26.2"
 }

lib/entry-points.js

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "4.37.7",
+  "version": "4.37.9",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
@@ -30,22 +30,22 @@
     "@actions/http-client": "^3.0.0",
     "@actions/io": "^2.0.0",
     "@actions/tool-cache": "^3.0.1",
-    "@octokit/core": "^7.0.6",
+    "@octokit/core": "^7.0.7",
     "@octokit/plugin-paginate-rest": "^14.0.0",
     "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
-    "@octokit/plugin-retry": "^8.1.0",
+    "@octokit/plugin-retry": "^8.1.1",
     "archiver": "^8.0.0",
     "fast-deep-equal": "^3.1.3",
     "follow-redirects": "^1.16.0",
     "get-folder-size": "^5.0.0",
     "https-proxy-agent": "^7.0.6",
-    "js-yaml": "^5.2.2",
+    "js-yaml": "^5.2.3",
     "jsonschema": "1.5.0",
     "long": "^5.3.2",
     "node-forge": "^1.4.0",
     "semver": "^7.8.5",
     "uuid": "^14.0.1",
-    "undici": "^6.24.0"
+    "undici": "^6.28.0"
   },
   "devDependencies": {
     "@ava/typescript": "6.0.0",
@@ -58,22 +58,22 @@
     "@types/node": "^20.19.43",
     "@types/node-forge": "^1.3.14",
     "@types/sarif": "^2.1.7",
-    "@types/semver": "^7.7.1",
+    "@types/semver": "^7.8.0",
     "@types/sinon": "^22.0.0",
     "ava": "^6.4.1",
-    "esbuild": "^0.28.1",
+    "esbuild": "^0.28.2",
     "eslint": "^9.39.5",
     "eslint-import-resolver-typescript": "^4.4.5",
-    "eslint-plugin-github": "^6.1.1",
+    "eslint-plugin-github": "^6.1.2",
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-jsdoc": "^62.9.0",
     "eslint-plugin-no-async-foreach": "^0.1.1",
     "glob": "^13.0.6",
-    "globals": "^17.8.0",
-    "nock": "^14.0.16",
+    "globals": "^17.11.0",
+    "nock": "^14.0.17",
     "sinon": "^22.1.0",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.65.0"
+    "typescript-eslint": "^8.67.0"
   },
   "overrides": {
     "@actions/tool-cache": {
@@ -95,6 +95,6 @@
       "semver": ">=6.3.1"
     },
     "glob": "^13.0.6",
-    "undici": "^6.24.0"
+    "undici": "^6.28.0"
   }
 }

package-lock.json

@@ -4,14 +4,14 @@
   "dependencies": {
     "@actions/core": "^2.0.3",
     "@actions/github": "^8.0.1",
-    "@octokit/core": "^7.0.6",
+    "@octokit/core": "^7.0.7",
     "@octokit/plugin-paginate-rest": ">=9.2.2",
     "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
     "semver": "^7.8.5",
     "yaml": "^2.9.0"
   },
   "devDependencies": {
     "@types/node": "^20.19.43",
-    "tsx": "^4.23.1"
+    "tsx": "^4.23.12"
   }
 }

package.json

@@ -38,7 +38,7 @@ export async function runWrapper() {
         logger,
       );
       if (config !== undefined) {
-        const codeql = await getCodeQL(config.codeQLCmd);
+        const codeql = await getCodeQL(logger, config.codeQLCmd);
         const version = await codeql.getVersion();
         await debugArtifacts.uploadCombinedSarifArtifacts(
           logger,

pr-checks/package.json

@@ -255,7 +255,7 @@ async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
       );
     }
 
-    const codeql = await getCodeQL(config.codeQLCmd);
+    const codeql = await getCodeQL(logger, config.codeQLCmd);
 
     if (hasBadExpectErrorInput()) {
       throw new util.ConfigurationError(

src/analyze-action-post.ts

@@ -1 +1 @@
-{"maximumVersion": "3.22", "minimumVersion": "3.17"}
+{"maximumVersion":"3.23","minimumVersion":"3.17"}

src/analyze-action.ts

@@ -99,7 +99,7 @@ async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
       );
     }
 
-    const codeql = await getCodeQL(config.codeQLCmd);
+    const codeql = await getCodeQL(logger, config.codeQLCmd);
 
     languages = await determineAutobuildLanguages(codeql, config, logger);
     if (languages !== undefined) {