{"id":119,"name":"ossf/scorecard-action","ecosystem":"actions","repository_url":"https://github.com/ossf/scorecard-action","issues_count":7038,"created_at":"2025-06-06T15:01:32.811Z","updated_at":"2025-06-06T15:01:32.811Z","purl":"pkg:githubactions/ossf/scorecard-action","metadata":{"id":5799835,"name":"ossf/scorecard-action","ecosystem":"actions","description":"Run OSSF Scorecard checks and output results in SARIF format","homepage":"","licenses":"apache-2.0","normalized_licenses":["Apache-2.0"],"repository_url":"https://github.com/ossf/scorecard-action","keywords_array":["github","github-actions","openssf-scorecard","security","supply-chain"],"namespace":"ossf","versions_count":32,"first_release_published_at":"2022-01-04T18:05:49.000Z","latest_release_published_at":"2025-05-30T16:54:20.000Z","latest_release_number":"v2.4.2","last_synced_at":"2025-06-05T18:02:05.439Z","created_at":"2023-01-04T11:37:43.200Z","updated_at":"2025-06-05T18:02:05.447Z","registry_url":"https://github.com/ossf/scorecard-action","install_command":null,"documentation_url":null,"metadata":{"name":"OSSF Scorecard action","description":"Run OSSF Scorecard checks and output results in SARIF format","author":"OSSF - github.com/ossf/scorecard","inputs":{"results_file":{"description":"OUTPUT: Path to file to store results","required":true},"results_format":{"description":"OUTPUT: format of the results [json, sarif]","required":true},"repo_token":{"description":"INPUT: GitHub token with read access","required":false,"default":"${{ github.token }}"},"publish_results":{"description":"INPUT: Publish results","required":false,"default":false},"file_mode":{"description":"INPUT: Method to fetch files from GitHub","required":false,"default":"archive"},"internal_publish_base_url":{"description":"INPUT: Base URL for publishing results. Used for testing.","required":false,"default":"https://api.scorecard.dev"},"internal_default_token":{"description":"INPUT: Default GitHub token. (Internal purpose only, not intended for developers to set. Used for pull requests configured with a PAT).","required":false,"default":"${{ github.token }}"}},"branding":{"icon":"mic","color":"white"},"runs":{"using":"docker","image":"docker://ghcr.io/ossf/scorecard-action:v2.4.2"},"default_branch":"main","path":null},"repo_metadata":{"id":37230744,"uuid":"421101922","full_name":"ossf/scorecard-action","owner":"ossf","description":"Official GitHub Action for OpenSSF Scorecard.","archived":false,"fork":false,"pushed_at":"2025-05-28T19:41:27.000Z","size":7164,"stargazers_count":307,"open_issues_count":27,"forks_count":74,"subscribers_count":19,"default_branch":"main","last_synced_at":"2025-05-28T20:41:27.665Z","etag":null,"topics":["github","github-actions","openssf-scorecard","security","supply-chain"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ossf.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2021-10-25T16:29:31.000Z","updated_at":"2025-05-28T19:41:30.000Z","dependencies_parsed_at":"2023-01-11T17:21:13.727Z","dependency_job_id":"55c15c5b-ceab-48ed-8c3c-50ad282e4009","html_url":"https://github.com/ossf/scorecard-action","commit_stats":{"total_commits":505,"total_committers":25,"mean_commits":20.2,"dds":"0.39603960396039606","last_synced_commit":"6c4912ed9e5f80cfda40164b92753f21f0892cab"},"previous_names":[],"tags_count":31,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ossf","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":257177067,"owners_count":22501689,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"ossf","name":"Open Source Security Foundation (OpenSSF)","uuid":"67707773","kind":"organization","description":"","email":null,"website":"https://openssf.org","location":"San Francisco, CA","twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/67707773?v=4","repositories_count":50,"last_synced_at":"2023-03-03T23:24:13.499Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/ossf","funding_links":[],"total_stars":null,"followers":null,"following":null,"created_at":"2022-11-14T06:30:52.671Z","updated_at":"2023-03-03T23:24:13.502Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ossf","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ossf/repositories"},"tags":[{"name":"v2.4.2","sha":"05b42c624433fc40578a4040d5cf5e36ddca8cde","kind":"tag","published_at":"2025-05-30T16:54:20.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.4.2","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.4.2","dependencies_parsed_at":null,"dependency_job_id":"25a8d376-1fb7-47d1-9a31-2c025f2c6807","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.4.2/manifests"},{"name":"v2.4.1","sha":"f49aabe0b5af0936a0987cfb85d86b75731b0186","kind":"tag","published_at":"2025-02-21T17:04:20.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.4.1","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.4.1","dependencies_parsed_at":"2025-04-12T04:56:16.415Z","dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.4.1/manifests"},{"name":"v2.4.0","sha":"62b2cac7ed8198b15735ed49ab1e5cf35480ba46","kind":"tag","published_at":"2024-07-26T16:36:58.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.4.0","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.4.0","dependencies_parsed_at":"2024-08-01T06:23:19.846Z","dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.4.0/manifests"},{"name":"v2.3.3","sha":"dc50aa9510b46c811795eb24b2f1ba02a914e534","kind":"tag","published_at":"2024-05-09T21:02:43.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.3.3","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.3.3","dependencies_parsed_at":"2024-05-11T04:05:57.157Z","dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.3.3/manifests"},{"name":"v2.3.2","sha":"8ff570017382a0ef795f21f71e519b27a9b5f29e","kind":"tag","published_at":"2024-05-09T20:49:24.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.3.2","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.3.2","dependencies_parsed_at":"2024-05-11T04:05:57.158Z","dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.3.2/manifests"},{"name":"v2.3.1","sha":"0864cf19026789058feabb7e87baa5f140aac736","kind":"tag","published_at":"2023-10-23T19:25:00.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.3.1","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.3.1","dependencies_parsed_at":"2023-10-25T04:08:03.724Z","dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.3.1/manifests"},{"name":"v2.3.0","sha":"483ef80eb98fb506c348f7d62e28055e49fe2398","kind":"tag","published_at":"2023-10-06T20:03:35.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.3.0","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.3.0","dependencies_parsed_at":"2023-10-12T04:19:06.396Z","dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.3.0/manifests"},{"name":"v2.2.0","sha":"08b4669551908b1024bb425080c797723083c031","kind":"tag","published_at":"2023-06-23T20:47:00.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.2.0","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.2.0","dependencies_parsed_at":"2023-06-27T00:23:37.631Z","dependency_job_id":"43b528c4-b594-4a3f-baee-dc565d5be721","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.2.0/manifests"},{"name":"v2.1.3","sha":"80e868c13c90f172d68d1f4501dee99e2479f7af","kind":"tag","published_at":"2023-03-29T20:04:04.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.1.3","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.1.3","dependencies_parsed_at":"2023-06-01T00:18:57.324Z","dependency_job_id":"f0ef78e3-09ad-4152-905a-d45196f25bf0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.1.3/manifests"},{"name":"v2.1.2","sha":"e38b1902ae4f44df626f11ba0734b14fb91f8f86","kind":"tag","published_at":"2022-12-21T23:14:51.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.1.2","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.1.2","dependencies_parsed_at":"2023-06-01T00:18:58.508Z","dependency_job_id":"f6cf4f79-c4e4-4599-aa9a-d396955e5d99","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.1.2/manifests"},{"name":"v2.1.1","sha":"15c10fcf1cf912bd22260bfec67569a359ab87da","kind":"commit","published_at":"2022-12-19T17:54:40.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.1.1","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.1.1","dependencies_parsed_at":"2023-06-01T00:18:57.884Z","dependency_job_id":"b87b2bec-f7bb-4d93-9454-fd342d12eced","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.1.1/manifests"},{"name":"v2.1.0","sha":"937ffa90d79c7d720498178154ad4c7ba1e4ad8c","kind":"commit","published_at":"2022-12-15T02:00:56.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.1.0","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.1.0","dependencies_parsed_at":"2023-06-01T00:18:57.334Z","dependency_job_id":"5fc1a747-16f8-4f74-beaa-6ab0e5cac748","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.1.0/manifests"},{"name":"v2.0.6","sha":"99c53751e09b9529366343771cc321ec74e9bd3d","kind":"tag","published_at":"2022-10-19T00:40:13.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.0.6","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.0.6","dependencies_parsed_at":"2023-05-31T19:02:45.712Z","dependency_job_id":"0688ae5c-790e-4488-9d03-c532ef8b3a52","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.6/manifests"},{"name":"v2.0.5","sha":"ff6221f2348c554e0bdd15d6fb8fd143f7a178a6","kind":"tag","published_at":"2022-10-18T17:42:50.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.0.5","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.0.5","dependencies_parsed_at":"2023-05-31T19:02:47.002Z","dependency_job_id":"ca6d45fe-3882-4b0a-8c17-c6ece59d7420","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.5/manifests"},{"name":"v2.0.4","sha":"e363bfca00e752f91de7b7d2a77340e2e523cb18","kind":"tag","published_at":"2022-09-27T23:20:10.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.0.4","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.0.4","dependencies_parsed_at":"2023-05-31T19:02:48.399Z","dependency_job_id":"381d2738-450c-4c07-8cdc-768c36e95a9a","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.4/manifests"},{"name":"v2.0.3","sha":"865b4092859256271290c77adbd10a43f4779972","kind":"commit","published_at":"2022-09-12T14:43:04.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.0.3","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.0.3","dependencies_parsed_at":"2023-05-31T19:02:49.603Z","dependency_job_id":"1123249c-3f38-479b-8e0f-144c6d9d3310","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.3/manifests"},{"name":"v2.0.2","sha":"68bf5b3327e4fd443d2add8ab122280547b4a16d","kind":"commit","published_at":"2022-09-09T17:28:42.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.0.2","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.0.2","dependencies_parsed_at":"2023-05-31T19:02:50.785Z","dependency_job_id":"86e99edf-801a-459a-99b1-5e03e4843a9c","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.2/manifests"},{"name":"v2.0.1","sha":"f437b3cc043103683806977b725b99217c67bd46","kind":"commit","published_at":"2022-09-09T14:03:11.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.0.1","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.0.1","dependencies_parsed_at":"2023-05-31T19:02:52.081Z","dependency_job_id":"50e15f76-e24e-4c8b-b1a7-1a2583e8217b","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.1/manifests"},{"name":"v2.0.0","sha":"13ec8c77e8a5dae7e0a0d47bde3e3004df15d34f","kind":"tag","published_at":"2022-09-08T14:30:58.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.0.0","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.0.0","dependencies_parsed_at":"2023-05-31T19:02:53.366Z","dependency_job_id":"44b95817-b36b-4a57-8ef3-9abb88af4315","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.0/manifests"},{"name":"v2.0.0-alpha.2","sha":"08dd0cebb088ac0fd6364339b1b3b68b75041ea8","kind":"commit","published_at":"2022-08-18T17:02:19.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.0.0-alpha.2","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.0.0-alpha.2","dependencies_parsed_at":"2023-05-30T18:05:34.424Z","dependency_job_id":"ea7cff79-e497-4c28-94c2-d3000bf1481a","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.0-alpha.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.0-alpha.2/manifests"},{"name":"v2.0.0-alpha.1","sha":"8efe025f70a29a99f45a21ce79da27daec4d8728","kind":"commit","published_at":"2022-08-15T16:40:59.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.0.0-alpha.1","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.0.0-alpha.1","dependencies_parsed_at":"2023-05-30T18:05:35.822Z","dependency_job_id":"4c23bf3c-262f-495e-8681-205b7125f926","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.0-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.0-alpha.1/manifests"},{"name":"v2.0.0-beta.1","sha":"3155d134e59d8f47261b1ae9d143034c69572227","kind":"commit","published_at":"2022-07-21T17:10:46.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v2.0.0-beta.1","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v2.0.0-beta.1","dependencies_parsed_at":"2023-05-30T18:05:37.122Z","dependency_job_id":"b5720f05-79af-4a43-990d-82926d806ce3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v2.0.0-beta.1/manifests"},{"name":"v1.1.2","sha":"ce330fde6b1a5c9c75b417e7efc510b822a35564","kind":"commit","published_at":"2022-06-27T19:17:19.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v1.1.2","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v1.1.2","dependencies_parsed_at":"2023-05-30T18:05:38.850Z","dependency_job_id":"6e8f96b3-abd7-426c-8040-49af6ae53c1e","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v1.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v1.1.2/manifests"},{"name":"v1.1.1","sha":"3e15ea8318eee9b333819ec77a36aca8d39df13e","kind":"commit","published_at":"2022-06-01T03:41:54.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v1.1.1","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v1.1.1","dependencies_parsed_at":"2023-05-30T18:05:40.274Z","dependency_job_id":"00611196-7b6a-4ae5-bb84-398cf33dcd26","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v1.1.1/manifests"},{"name":"v1.1.0","sha":"5c8bc69dc88b65c66584e07611df79d3579b0377","kind":"commit","published_at":"2022-05-24T23:32:59.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v1.1.0","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v1.1.0","dependencies_parsed_at":"2023-05-30T18:05:41.677Z","dependency_job_id":"5d533207-e080-4dcc-bcb5-6d522bb4921e","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v1.1.0/manifests"},{"name":"v1.0.4","sha":"c1aec4ac820532bab364f02a81873c555a0ba3a1","kind":"commit","published_at":"2022-02-15T18:29:48.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v1.0.4","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v1.0.4","dependencies_parsed_at":"2023-05-30T18:05:42.423Z","dependency_job_id":"b44953df-6657-409d-9147-8b82ffe3065e","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v1.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v1.0.4/manifests"},{"name":"v1.0.3","sha":"b614d455ee90608b5e36e3299cd50d457eb37d5f","kind":"commit","published_at":"2022-01-31T20:15:24.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v1.0.3","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v1.0.3","dependencies_parsed_at":"2023-05-30T18:05:42.859Z","dependency_job_id":"eb378ad0-06e2-4c30-8806-2bef97d64f48","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v1.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v1.0.3/manifests"},{"name":"v1.0.2","sha":"c8416b0b2bf627c349ca92fc8e3de51a64b005cf","kind":"commit","published_at":"2022-01-24T16:20:10.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v1.0.2","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v1.0.2","dependencies_parsed_at":"2023-05-30T18:05:43.249Z","dependency_job_id":"92ce55c2-f4e6-4084-adc5-4b56a34b22d2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v1.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v1.0.2/manifests"},{"name":"v1.0.1","sha":"e3e75cf2ffbf9364bbff86cdbdf52b23176fe492","kind":"commit","published_at":"2022-01-14T21:37:32.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v1.0.1","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v1.0.1","dependencies_parsed_at":"2023-05-30T18:05:43.638Z","dependency_job_id":"c5051175-39ac-4eb0-a0c0-f47719dc3730","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v1.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v1.0.1/manifests"},{"name":"v1.0.0","sha":"005020cb6a7f4d6d23450b2957d8e5e77983a6d4","kind":"commit","published_at":"2022-01-13T21:22:52.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v1.0.0","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v1.0.0","dependencies_parsed_at":"2023-05-30T18:05:44.045Z","dependency_job_id":"032e9111-9bbd-45d1-afae-dc7fa3398429","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v1.0.0/manifests"},{"name":"v0.0.2","sha":"5f4e3145c8e85f00681e145122bfe721eb0d69a7","kind":"commit","published_at":"2022-01-06T20:37:46.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v0.0.2","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v0.0.2","dependencies_parsed_at":"2023-05-30T18:05:44.544Z","dependency_job_id":"4954aa16-4f0a-4e34-9a73-f5b1ca8f0a68","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v0.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v0.0.2/manifests"},{"name":"v0.0.1","sha":"175f59783fa96e44dd6fa96619ab7bdacab56b5c","kind":"commit","published_at":"2022-01-04T18:05:49.000Z","download_url":"https://codeload.github.com/ossf/scorecard-action/tar.gz/v0.0.1","html_url":"https://github.com/ossf/scorecard-action/releases/tag/v0.0.1","dependencies_parsed_at":"2023-05-30T18:05:44.957Z","dependency_job_id":"153391cb-4779-47c6-b252-5df3c0141e3b","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v0.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ossf%2Fscorecard-action/tags/v0.0.1/manifests"}]},"repo_metadata_updated_at":"2025-05-31T12:32:07.770Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":6465,"rankings":{"downloads":null,"dependent_repos_count":0.23451117097131993,"dependent_packages_count":0.0,"stargazers_count":1.2961495800982412,"forks_count":1.080652828394866,"docker_downloads_count":0.34225954682300747,"average":0.590714625257487},"purl":"pkg:githubactions/ossf/scorecard-action","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/actions/ossf/scorecard-action","docker_dependents_count":6,"docker_downloads_count":32274335,"usage_url":"https://repos.ecosyste.ms/usage/actions/ossf/scorecard-action","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/actions/ossf/scorecard-action/dependencies","status":null,"funding_links":[],"critical":null,"versions_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/ossf%2Fscorecard-action/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/ossf%2Fscorecard-action/version_numbers","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/ossf%2Fscorecard-action/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/ossf%2Fscorecard-action/related_packages","maintainers":[],"registry":{"name":"github actions","url":"https://github.com/marketplace/actions/","ecosystem":"actions","default":true,"packages_count":31615,"maintainers_count":0,"namespaces_count":19962,"keywords_count":6709,"github":"actions","metadata":{"funded_packages_count":2985},"icon_url":"https://github.com/actions.png","created_at":"2023-01-03T17:16:39.185Z","updated_at":"2025-06-06T06:00:12.453Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/namespaces"}},"unique_repositories_count":3825,"unique_repositories_count_past_30_days":85,"recent_issues":[{"uuid":"5993069573","node_id":"PR_kwDOPBmB5s8AAAABKMJpLw","number":2091,"state":"open","title":"ci(deps): bump the github-actions group across 1 directory with 7 updates","user":"dependabot[bot]","labels":["dependencies"],"assignees":["KaifAhmad1"],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-23T06:27:33.000Z","updated_at":"2026-10-23T06:29:55.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci(deps): bump","group_name":"github-actions","update_count":7,"packages":[{"name":"github/codeql-action/init","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/autobuild","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"pypa/gh-action-pypi-publish","old_version":"1.14.2","new_version":"1.14.3","repository_url":"https://github.com/pypa/gh-action-pypi-publish"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"actions/download-artifact","old_version":"8.0.1","new_version":"8.0.2","repository_url":"https://github.com/actions/download-artifact"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 7 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.2` | `1.14.3` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` |\n\n\nUpdates `github/codeql-action/init` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.1 - 21 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/autobuild` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/autobuild's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/autobuild's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.1 - 21 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.1 - 21 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.1 - 21 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pypa/gh-action-pypi-publish` from 1.14.2 to 1.14.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/releases\"\u003epypa/gh-action-pypi-publish's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.14.3\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!important]\n🚨 This release includes fixes for \u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-5xjx-3w67-w9x9\"\u003eGHSA-5xjx-3w67-w9x9\u003c/a\u003e patched up by \u003ca href=\"https://github.com/sethmlarson\"\u003e\u003ccode\u003e@​sethmlarson\u003c/code\u003e\u003c/a\u003e\u003ca href=\"https://github.com/sponsors/sethmlarson\"\u003e💰\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pypa/gh-action-pypi-publish/issues/427\"\u003e#427\u003c/a\u003e and in other places across the ecosystem.\u003c/p\u003e\n\u003cp\u003eAdditional ecosystem and related mitigations beyond you might want to watch out for:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576\"\u003ehttps://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://emudhra.we-have-a-problem.com\"\u003ehttps://emudhra.we-have-a-problem.com\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003ch2\u003e🛠️ Security Tightening\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/webknjaz\"\u003e\u003ccode\u003e@​webknjaz\u003c/code\u003e\u003c/a\u003e\u003ca href=\"https://github.com/sponsors/webknjaz\"\u003e💰\u003c/a\u003e made sure the dependency tree within the action runtime uses hash-checking from now on via \u003ca href=\"https://redirect.github.com/pypa/gh-action-pypi-publish/pull/420\"\u003epypa/gh-action-pypi-publish#420\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e🪞 Full Diff\u003c/strong\u003e: \u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.2...v1.14.3\"\u003ehttps://github.com/pypa/gh-action-pypi-publish/compare/v1.14.2...v1.14.3\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e🧔‍♂️ Release Manager:\u003c/strong\u003e \u003ca href=\"https://github.com/sponsors/webknjaz\"\u003e\u003ccode\u003e@​webknjaz\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://stand-with-ukraine.pp.ua\"\u003e🇺🇦\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e💬 Discuss\u003c/strong\u003e \u003ca href=\"https://bsky.app/profile/webknjaz.me/post/3mydcjweyak2f\"\u003eon Bluesky 🦋\u003c/a\u003e, \u003ca href=\"https://mastodon.social/@webknjaz/117474743338290807\"\u003eon Mastodon 🐘\u003c/a\u003e and \u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/discussions/429\"\u003eon GitHub\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/sponsors/webknjaz\"\u003e\u003cimg src=\"https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors\u0026amp;logoColor=%23EA4AAA\u0026amp;label=Sponsor\u0026amp;color=2a313c\" alt=\"GH Sponsors badge\" /\u003e\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/commit/7245906fb61fa33a13554f9d5fb856fe61758086\"\u003e\u003ccode\u003e7245906\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pypa/gh-action-pypi-publish/issues/427\"\u003e#427\u003c/a\u003e from sethmlarson/certifi-sigstore\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/commit/331eccb0e13a5c1124ed9f414a079ef2bef1095f\"\u003e\u003ccode\u003e331eccb\u003c/code\u003e\u003c/a\u003e Upgrade certifi and sigstore\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/commit/f68fee44f9faa979857cda34894b750df5f571ca\"\u003e\u003ccode\u003ef68fee4\u003c/code\u003e\u003c/a\u003e 💰 Sync the FUNDING config\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/commit/c0d6f8e4af2ad8247a7da213b199ea78dac8395e\"\u003e\u003ccode\u003ec0d6f8e\u003c/code\u003e\u003c/a\u003e Merge branch 'integrity/runtime/deptree' into unstable/v1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/commit/909009990f9cf7e7c6a64e602638cf9e91af47f8\"\u003e\u003ccode\u003e9090099\u003c/code\u003e\u003c/a\u003e 🧪 Make smoke test deps hash-pinned in CI\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/commit/34e40c24acd7b4a9150956d646c8c7ba667a14f3\"\u003e\u003ccode\u003e34e40c2\u003c/code\u003e\u003c/a\u003e 📌 Bump pip-tools managed transitive deptrees\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/commit/e800ed547ac29cbc9324311809e2f36fe82148f9\"\u003e\u003ccode\u003ee800ed5\u003c/code\u003e\u003c/a\u003e 👷 Enable hash-checking in the runtime deptree 🔗\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/commit/dd8c5f4f1f65ddf01533969008446145facc7b02\"\u003e\u003ccode\u003edd8c5f4\u003c/code\u003e\u003c/a\u003e 🔧 Make pip-tools config available in container\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/compare/dc37677b2e1c63e2034f94d8a5b11f265b73ba33...7245906fb61fa33a13554f9d5fb856fe61758086\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/download-artifact` from 8.0.1 to 8.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/download-artifact/releases\"\u003eactions/download-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev8.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the readme by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/473\"\u003eactions/download-artifact#473\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare download-artifact v8.0.2 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/493\"\u003eactions/download-artifact#493\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\"\u003ehttps://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003e\u003ccode\u003e9000827\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/493\"\u003e#493\u003c/a\u003e from actions/tunc-d-prepare-download-v8-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/e455989ae00f5bdd4054f05d3e972c6bf8a62dc5\"\u003e\u003ccode\u003ee455989\u003c/code\u003e\u003c/a\u003e Prepare download-artifact v8.0.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/a00b90c4a2f01d73a8c89552caabca6ea3b43137\"\u003e\u003ccode\u003ea00b90c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/492\"\u003e#492\u003c/a\u003e from actions/tunc-d-download-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/29bb7ce6af5345aeab5bb4774ce7249ee3ccc27f\"\u003e\u003ccode\u003e29bb7ce\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/484a0b528fb4d7bd804637ccb632e47a0e638317\"\u003e\u003ccode\u003e484a0b5\u003c/code\u003e\u003c/a\u003e Update the readme (\u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/473\"\u003e#473\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/semantica-agi/semantica/pull/2091","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/semantica-agi%2Fsemantica/issues/2091","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2091/packages"},{"uuid":"5973519285","node_id":"PR_kwDOTSmvBc8AAAABJ8mEGQ","number":29,"state":"open","title":"ci: bump ossf/scorecard-action from 2.4.4 to 2.5.0","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":["HetCreep"],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-22T05:15:39.000Z","updated_at":"2026-10-22T05:16:23.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci","packages":[{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ossf/scorecard-action\u0026package-manager=github_actions\u0026previous-version=2.4.4\u0026new-version=2.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/TheColliery/CoalLedger/pull/29","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/TheColliery%2FCoalLedger/issues/29","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/29/packages"},{"uuid":"5972305113","node_id":"PR_kwDORhB7rc8AAAABJ7o6RQ","number":237,"state":"open","title":"ci(deps)(deps): bump the github-actions group across 1 directory with 10 updates","user":"dependabot[bot]","labels":["ci"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-22T03:07:34.000Z","updated_at":"2026-10-22T03:07:38.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci(deps)(deps): bump","group_name":"github-actions","update_count":10,"packages":[{"name":"jamescrowley321/blind-peer-review","old_version":"3.10.0","new_version":"3.11.0","repository_url":"https://github.com/jamescrowley321/blind-peer-review"},{"name":"anthropics/claude-code-action","old_version":"1.0.230","new_version":"1.0.254","repository_url":"https://github.com/anthropics/claude-code-action"},{"name":"github/codeql-action/init","old_version":"4.38.1","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.38.1","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml","old_version":"2.6.0","new_version":"2.7.0","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml","old_version":"2.6.0","new_version":"2.7.0","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"anchore/sbom-action/download-syft","old_version":"0.24.2","new_version":"0.24.3","repository_url":"https://github.com/anchore/sbom-action"},{"name":"goreleaser/goreleaser-action","old_version":"7.2.3","new_version":"7.3.0","repository_url":"https://github.com/goreleaser/goreleaser-action"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.1","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 10 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [jamescrowley321/blind-peer-review](https://github.com/jamescrowley321/blind-peer-review) | `3.10.0` | `3.11.0` |\n| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.230` | `1.0.254` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.1` | `4.39.0` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.1` | `4.39.0` |\n| [google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml](https://github.com/google/osv-scanner-action) | `2.6.0` | `2.7.0` |\n| [google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml](https://github.com/google/osv-scanner-action) | `2.6.0` | `2.7.0` |\n| [anchore/sbom-action/download-syft](https://github.com/anchore/sbom-action) | `0.24.2` | `0.24.3` |\n| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `7.2.3` | `7.3.0` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.1` | `4.39.0` |\n\n\nUpdates `jamescrowley321/blind-peer-review` from 3.10.0 to 3.11.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/releases\"\u003ejamescrowley321/blind-peer-review's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.11.0\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/compare/v3.10.0...v3.11.0\"\u003e3.11.0\u003c/a\u003e (2026-10-20)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ecorpus:\u003c/strong\u003e Jev off-surface finding detector and worksheet phase (\u003ca href=\"https://redirect.github.com/jamescrowley321/blind-peer-review/issues/174\"\u003e#174\u003c/a\u003e) (\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/49a74d6cca7f677101c7da9d1aa26eeac7ddbbd9\"\u003e49a74d6\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/blob/main/CHANGELOG.md\"\u003ejamescrowley321/blind-peer-review's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cp\u003eAll notable changes to this project are documented here. Format loosely follows\n\u003ca href=\"https://keepachangelog.com\"\u003eKeep a Changelog\u003c/a\u003e; this project uses semantic\nversion tags (\u003ccode\u003ev1\u003c/code\u003e, \u003ccode\u003ev1.0.0\u003c/code\u003e, …), and consumers pin \u003ccode\u003e@v1\u003c/code\u003e (it tracks the latest\n\u003ccode\u003ev1.x.x\u003c/code\u003e).\u003c/p\u003e\n\u003cp\u003eReleases are automated with \u003ca href=\"https://github.com/googleapis/release-please\"\u003erelease-please\u003c/a\u003e:\neach \u003ccode\u003e## [x.y.z]\u003c/code\u003e section below is drafted from the Conventional Commits since the\nprevious release and can be curated in the release PR before it is merged. See\n\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/blob/main/CONTRIBUTING.md#cutting-a-release\"\u003eCONTRIBUTING.md\u003c/a\u003e for the flow. \u003ccode\u003e[1.4.1]\u003c/code\u003e and\nthe older sections below it predate the automation and were written by hand.\u003c/p\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/compare/v3.11.0...v3.12.0\"\u003e3.12.0\u003c/a\u003e (2026-10-21)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ecorpus:\u003c/strong\u003e diffstat-only state, combined rule and time split for the lens gate (\u003ca href=\"https://redirect.github.com/jamescrowley321/blind-peer-review/issues/177\"\u003e#177\u003c/a\u003e) (\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/d6d4ff37057a24aa77d8f2d8413cdbedaa48252c\"\u003ed6d4ff3\u003c/a\u003e), closes \u003ca href=\"https://redirect.github.com/jamescrowley321/blind-peer-review/issues/169\"\u003e#169\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/compare/v3.10.0...v3.11.0\"\u003e3.11.0\u003c/a\u003e (2026-10-20)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ecorpus:\u003c/strong\u003e Jev off-surface finding detector and worksheet phase (\u003ca href=\"https://redirect.github.com/jamescrowley321/blind-peer-review/issues/174\"\u003e#174\u003c/a\u003e) (\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/49a74d6cca7f677101c7da9d1aa26eeac7ddbbd9\"\u003e49a74d6\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/compare/v3.9.0...v3.10.0\"\u003e3.10.0\u003c/a\u003e (2026-10-20)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ecorpus:\u003c/strong\u003e measure Jev as a pre-gate for the conditional lenses (\u003ca href=\"https://redirect.github.com/jamescrowley321/blind-peer-review/issues/168\"\u003e#168\u003c/a\u003e) (\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/5d4ea59ef3524136fb00d41fba0ad24398276a0e\"\u003e5d4ea59\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eremove remaining references to a private downstream repository (\u003ca href=\"https://redirect.github.com/jamescrowley321/blind-peer-review/issues/167\"\u003e#167\u003c/a\u003e) (\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/d4a6aaa8bd0f70e64cf2f72fb372d9c74f32f8e5\"\u003ed4a6aaa\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/compare/v3.8.0...v3.9.0\"\u003e3.9.0\u003c/a\u003e (2026-10-17)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eplugin:\u003c/strong\u003e configurable reviewer instead of auto-dispatching to codex (\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/3c56238474b650acae9ab17cbc37edcd8e14edd2\"\u003e3c56238\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/compare/v3.7.0...v3.8.0\"\u003e3.8.0\u003c/a\u003e (2026-10-17)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/2a7dcc81367ade043575b017baf604bbee0714e3\"\u003e\u003ccode\u003e2a7dcc8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/jamescrowley321/blind-peer-review/issues/176\"\u003e#176\u003c/a\u003e from jamescrowley321/release-please--branches--main--...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/8322e97f387befa81d8370d2a81c62383b734f23\"\u003e\u003ccode\u003e8322e97\u003c/code\u003e\u003c/a\u003e chore(main): release 3.11.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/49a74d6cca7f677101c7da9d1aa26eeac7ddbbd9\"\u003e\u003ccode\u003e49a74d6\u003c/code\u003e\u003c/a\u003e feat(corpus): Jev off-surface finding detector and worksheet phase (\u003ca href=\"https://redirect.github.com/jamescrowley321/blind-peer-review/issues/174\"\u003e#174\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/compare/439e22c6dcfdaefc6c1713d9f5b3d259ee38cf19...2a7dcc81367ade043575b017baf604bbee0714e3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `anthropics/claude-code-action` from 1.0.230 to 1.0.254\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/anthropics/claude-code-action/releases\"\u003eanthropics/claude-code-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.0.254\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.253...v1.0.254\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.253...v1.0.254\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.253\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.252...v1.0.253\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.252...v1.0.253\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.252\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.251...v1.0.252\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.251...v1.0.252\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.251\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.250...v1.0.251\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.250...v1.0.251\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.250\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.249...v1.0.250\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.249...v1.0.250\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.249\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.248...v1.0.249\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.248...v1.0.249\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.248\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.247...v1.0.248\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.247...v1.0.248\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.247\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.246...v1.0.247\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.246...v1.0.247\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.246\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.245...v1.0.246\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.245...v1.0.246\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.245\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.244...v1.0.245\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.244...v1.0.245\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.244\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.243...v1.0.244\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.243...v1.0.244\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.243\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.242...v1.0.243\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.242...v1.0.243\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.242\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.241...v1.0.242\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.241...v1.0.242\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.241\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.240...v1.0.241\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.240...v1.0.241\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.240\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.239...v1.0.240\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.239...v1.0.240\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.239\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.238...v1.0.239\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.238...v1.0.239\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.238\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c\"\u003e\u003ccode\u003edb77d4d\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.304 and Agent SDK to 0.3.304\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/5eb090f3c3afd701a0672cd32981197ca27688f6\"\u003e\u003ccode\u003e5eb090f\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.303 and Agent SDK to 0.3.303\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/f27be6b65a4652f08a2ba3cff79114829b588967\"\u003e\u003ccode\u003ef27be6b\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.302 and Agent SDK to 0.3.302\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/374f254f5efaf968abfe15d399fd90972e8138b9\"\u003e\u003ccode\u003e374f254\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.301 and Agent SDK to 0.3.301\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/a26b07d8c778b0c43f64618e5fd29fd0f8af72e8\"\u003e\u003ccode\u003ea26b07d\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.300 and Agent SDK to 0.3.300\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/34968b5981d5d170904281aa3df6f3c0d4a28855\"\u003e\u003ccode\u003e34968b5\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.299 and Agent SDK to 0.3.299\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/1d6de8cb0c237e7c15e9e1bdf973826ebae490cc\"\u003e\u003ccode\u003e1d6de8c\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.296 and Agent SDK to 0.3.296\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/2dca132ff0e0c4094ce6048b422c6915a071210b\"\u003e\u003ccode\u003e2dca132\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.295 and Agent SDK to 0.3.295\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/38c80c1a32cdbc0c6f34042464a0669d89363dde\"\u003e\u003ccode\u003e38c80c1\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.294 and Agent SDK to 0.3.294\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/6fed3ca145920b639991cb756090506e1bcaf515\"\u003e\u003ccode\u003e6fed3ca\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.293 and Agent SDK to 0.3.293\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/4036a180cf690f49529f5d8c79c998855287f590...db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from 4.38.1 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.1 - 21 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.38.1 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.1 - 21 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml` from 2.6.0 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.7.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate github/codeql-action action to v4.38.0 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/143\"\u003egoogle/osv-scanner-action#143\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate to v2.7.0 by \u003ca href=\"https://github.com/michaelkedar\"\u003e\u003ccode\u003e@​michaelkedar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/146\"\u003egoogle/osv-scanner-action#146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.6.0...v2.7.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.6.0...v2.7.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b1d267aea5211fa648d9d442fa64b90dbdcbdd36\"\u003e\u003ccode\u003eb1d267a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/146\"\u003e#146\u003c/a\u003e from google/update-to-v2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/2b1cfc6d0e3941f549908be1c5671b5d7625ebc0\"\u003e\u003ccode\u003e2b1cfc6\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.7.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/ef6dfdf01765802d5a8dbc3c39852a6128b00af0\"\u003e\u003ccode\u003eef6dfdf\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.7.0 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0a65f82af05cd58cf587827b0bb0489548c18346\"\u003e\u003ccode\u003e0a65f82\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.7.0 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8ac9e5ce44cc7178e0e04229a91bdcc003166e57\"\u003e\u003ccode\u003e8ac9e5c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/143\"\u003e#143\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3b06fbb744e4192b7d47b4f2584715a21ef88b92\"\u003e\u003ccode\u003e3b06fbb\u003c/code\u003e\u003c/a\u003e Update github/codeql-action action to v4.38.0\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/a345acffa64b0eaede81a3d9aae6141214d9c8fc...b1d267aea5211fa648d9d442fa64b90dbdcbdd36\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml` from 2.6.0 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.7.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate github/codeql-action action to v4.38.0 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/143\"\u003egoogle/osv-scanner-action#143\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate to v2.7.0 by \u003ca href=\"https://github.com/michaelkedar\"\u003e\u003ccode\u003e@​michaelkedar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/146\"\u003egoogle/osv-scanner-action#146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.6.0...v2.7.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.6.0...v2.7.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b1d267aea5211fa648d9d442fa64b90dbdcbdd36\"\u003e\u003ccode\u003eb1d267a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/146\"\u003e#146\u003c/a\u003e from google/update-to-v2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/2b1cfc6d0e3941f549908be1c5671b5d7625ebc0\"\u003e\u003ccode\u003e2b1cfc6\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.7.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/ef6dfdf01765802d5a8dbc3c39852a6128b00af0\"\u003e\u003ccode\u003eef6dfdf\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.7.0 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0a65f82af05cd58cf587827b0bb0489548c18346\"\u003e\u003ccode\u003e0a65f82\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.7.0 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8ac9e5ce44cc7178e0e04229a91bdcc003166e57\"\u003e\u003ccode\u003e8ac9e5c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/143\"\u003e#143\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3b06fbb744e4192b7d47b4f2584715a21ef88b92\"\u003e\u003ccode\u003e3b06fbb\u003c/code\u003e\u003c/a\u003e Update github/codeql-action action to v4.38.0\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/a345acffa64b0eaede81a3d9aae6141214d9c8fc...b1d267aea5211fa648d9d442fa64b90dbdcbdd36\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `anchore/sbom-action/download-syft` from 0.24.2 to 0.24.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/anchore/sbom-action/releases\"\u003eanchore/sbom-action/download-syft's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.24.3\u003c/h2\u003e\n\u003ch3\u003eAdded Features\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebump type-fest from 5.9.0 to 5.10.0 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/742\"\u003e#742\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.5.1 to 26.6.1 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/741\"\u003e#741\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.4.1 to 26.5.1 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/737\"\u003e#737\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump typescript-eslint from 8.69.0 to 8.70.0 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/736\"\u003e#736\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump type-fest from 5.8.0 to 5.9.0 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/732\"\u003e#732\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump eslint from 10.9.1 to 10.10.0 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/733\"\u003e#733\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump typescript-eslint from 8.68.0 to 8.69.0 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/730\"\u003e#730\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.2.0 to 26.4.0 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/727\"\u003e#727\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump typescript-eslint from 8.67.0 to 8.68.0 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/726\"\u003e#726\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebump github.com/anchore/go-make from 0.8.0 to 0.8.1 in /.make [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/738\"\u003e#738\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump anchore/go-make/.github/actions/setup from 0.8.0 to 0.8.1 in /.github/actions/bootstrap [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/740\"\u003e#740\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/739\"\u003e#739\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/734\"\u003e#734\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.4.0 to 26.4.1 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/731\"\u003e#731\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump tsx from 4.23.12 to 4.23.13 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/729\"\u003e#729\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump eslint from 10.9.0 to 10.9.1 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/728\"\u003e#728\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump \u003ccode\u003e@​humanfs/node\u003c/code\u003e from 0.16.7 to 0.16.8 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/725\"\u003e#725\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/anchore/sbom-action/compare/v0.24.2...v0.24.3\"\u003e(Full Changelog)\u003c/a\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c\"\u003e\u003ccode\u003e66cbf4b\u003c/code\u003e\u003c/a\u003e chore(deps): update Syft to latest release (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/735\"\u003e#735\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/6b31fa7e2d592e47d95d2a5e0520a7352d47ead5\"\u003e\u003ccode\u003e6b31fa7\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump type-fest from 5.9.0 to 5.10.0 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/742\"\u003e#742\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/85bda362f4d1f0e150007087d1a8502d53c04bc7\"\u003e\u003ccode\u003e85bda36\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.5.1 to 26.6.1 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/741\"\u003e#741\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/7b97c1e9edff006647d6c63074267132e3fdabce\"\u003e\u003ccode\u003e7b97c1e\u003c/code\u003e\u003c/a\u003e chore(deps): bump github.com/anchore/go-make in /.make (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/738\"\u003e#738\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/891b0559c3f25512e4b4d41d919a03f31740f56f\"\u003e\u003ccode\u003e891b055\u003c/code\u003e\u003c/a\u003e chore(deps): bump anchore/go-make/.github/actions/setup (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/740\"\u003e#740\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/f73cf48625e2e98521eebea287189abc22f22f55\"\u003e\u003ccode\u003ef73cf48\u003c/code\u003e\u003c/a\u003e chore(deps): bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/739\"\u003e#739\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/13576db7e6212e069d9f3c86313c1411e99a9a14\"\u003e\u003ccode\u003e13576db\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.4.1 to 26.5.1 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/737\"\u003e#737\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/924e83ba5bfad61e1b64b874f0ca919c75b8c575\"\u003e\u003ccode\u003e924e83b\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump typescript-eslint from 8.69.0 to 8.70.0 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/736\"\u003e#736\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/274555f23948494da9248b45cbd44ad133002e12\"\u003e\u003ccode\u003e274555f\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump type-fest from 5.8.0 to 5.9.0 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/732\"\u003e#732\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/48fb5380da7b84fcdf5e6527059a37816c4d24cb\"\u003e\u003ccode\u003e48fb538\u003c/code\u003e\u003c/a\u003e chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/734\"\u003e#734\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/anchore/sbom-action/compare/3ad7283483fc7af8ff2b4ea19663c2d5ca935e26...66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `goreleaser/goreleaser-action` from 7.2.3 to 7.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/goreleaser/goreleaser-action/releases\"\u003egoreleaser/goreleaser-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/570\"\u003egoreleaser/goreleaser-action#570\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/571\"\u003egoreleaser/goreleaser-action#571\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/575\"\u003egoreleaser/goreleaser-action#575\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/574\"\u003egoreleaser/goreleaser-action#574\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump undici from 6.27.0 to 6.28.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/576\"\u003egoreleaser/goreleaser-action#576\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump js-yaml from 5.2.2 to 5.2.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/573\"\u003egoreleaser/goreleaser-action#573\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump js-yaml from 5.2.3 to 5.4.1 in the npm group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/578\"\u003egoreleaser/goreleaser-action#578\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: reuse the goreleaser binary from the runner tool cache by \u003ca href=\"https://github.com/caarlos0\"\u003e\u003ccode\u003e@​caarlos0\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/577\"\u003egoreleaser/goreleaser-action#577\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 in the actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/581\"\u003egoreleaser/goreleaser-action#581\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump undici from 6.28.0 to 6.29.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/579\"\u003egoreleaser/goreleaser-action#579\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/580\"\u003egoreleaser/goreleaser-action#580\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/v7.2.3...v7.3.0\"\u003ehttps://github.com/goreleaser/goreleaser-action/compare/v7.2.3...v7.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/a4f02ab5355a589de60d917a659ce617ed19b3de\"\u003e\u003ccode\u003ea4f02ab\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/e27eb7769180b733cf28959f093582ddda91972e\"\u003e\u003ccode\u003ee27eb77\u003c/code\u003e\u003c/a\u003e chore(deps): bump the npm group with 2 updates (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/580\"\u003e#580\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/f5b4e31ee483102e19b17e532f024e8aee22d4fe\"\u003e\u003ccode\u003ef5b4e31\u003c/code\u003e\u003c/a\u003e chore(deps): bump undici from 6.28.0 to 6.29.0 (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/579\"\u003e#579\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/2d42c26fe04ca60644a41f10407c30998bc2f770\"\u003e\u003ccode\u003e2d42c26\u003c/code\u003e\u003c/a\u003e ci(deps): bump codecov/codecov-action (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/581\"\u003e#581\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/73cd4ffe39ceae11aafd47343ff35e8be087f14c\"\u003e\u003ccode\u003e73cd4ff\u003c/code\u003e\u003c/a\u003e feat: reuse the goreleaser binary from the runner tool cache (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/577\"\u003e#577\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/97a960754774e271e3eb4f389fe9b73400f2158c\"\u003e\u003ccode\u003e97a9607\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/689e48f9ac97190a2d170ebe29f3aed1a694464b\"\u003e\u003ccode\u003e689e48f\u003c/code\u003e\u003c/a\u003e chore(deps): bump js-yaml from 5.2.3 to 5.4.1 in the npm group (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/578\"\u003e#578\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/7e6b514c508941c26e8772ba9b920d0677e2160e\"\u003e\u003ccode\u003e7e6b514\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/4ec11830b6b44bb4bef0db5ddd7e04844da5519e\"\u003e\u003ccode\u003e4ec1183\u003c/code\u003e\u003c/a\u003e chore(deps): bump js-yaml from 5.2.2 to 5.2.3 (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/573\"\u003e#573\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/59060fdcfdbbfd4c87d837ab2c489d635c18f843\"\u003e\u003ccode\u003e59060fd\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/f06c13b6b1a9625abc9e6e439d9c05a8f2190e94...a4f02ab5355a589de60d917a659ce617ed19b3de\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.1 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.1 - 21 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub ...\n\n_Description has been truncated_","html_url":"https://github.com/jamescrowley321/terraform-provider-descope/pull/237","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/jamescrowley321%2Fterraform-provider-descope/issues/237","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/237/packages"},{"uuid":"5969948842","node_id":"PR_kwDOVS0OUc8AAAABJ5yW5A","number":2,"state":"open","title":"ci(deps): Bump the actions group with 4 updates","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-21T23:05:19.000Z","updated_at":"2026-10-21T23:05:22.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci(deps): Bump","group_name":"actions","update_count":4,"packages":[{"name":"actions/upload-artifact","old_version":"7.0.1","new_version":"7.0.2","repository_url":"https://github.com/actions/upload-artifact"},{"name":"actions/download-artifact","old_version":"8.0.1","new_version":"8.0.2","repository_url":"https://github.com/actions/download-artifact"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.2","new_version":"4.38.3","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the actions group with 4 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact), [actions/download-artifact](https://github.com/actions/download-artifact), [ossf/scorecard-action](https://github.com/ossf/scorecard-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).\n\nUpdates `actions/upload-artifact` from 7.0.1 to 7.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdates \u003ccode\u003e@​actions/artifact\u003c/code\u003e to v6.3.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/821\"\u003eactions/upload-artifact#821\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\"\u003ehttps://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003e\u003ccode\u003ecf430e0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/822\"\u003e#822\u003c/a\u003e from actions/tunc-d-prepare-upload-v7-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469\"\u003e\u003ccode\u003ec2acded\u003c/code\u003e\u003c/a\u003e chore: prepare v7.0.2 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a\"\u003e\u003ccode\u003e4687c1b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/821\"\u003e#821\u003c/a\u003e from actions/tunc-d-upload-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719\"\u003e\u003ccode\u003e8cbe1be\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/download-artifact` from 8.0.1 to 8.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/download-artifact/releases\"\u003eactions/download-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev8.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the readme by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/473\"\u003eactions/download-artifact#473\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare download-artifact v8.0.2 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/493\"\u003eactions/download-artifact#493\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\"\u003ehttps://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003e\u003ccode\u003e9000827\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/493\"\u003e#493\u003c/a\u003e from actions/tunc-d-prepare-download-v8-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/e455989ae00f5bdd4054f05d3e972c6bf8a62dc5\"\u003e\u003ccode\u003ee455989\u003c/code\u003e\u003c/a\u003e Prepare download-artifact v8.0.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/a00b90c4a2f01d73a8c89552caabca6ea3b43137\"\u003e\u003ccode\u003ea00b90c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/492\"\u003e#492\u003c/a\u003e from actions/tunc-d-download-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/29bb7ce6af5345aeab5bb4774ce7249ee3ccc27f\"\u003e\u003ccode\u003e29bb7ce\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/484a0b528fb4d7bd804637ccb632e47a0e638317\"\u003e\u003ccode\u003e484a0b5\u003c/code\u003e\u003c/a\u003e Update the readme (\u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/473\"\u003e#473\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.1 - 21 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003e\u003ccode\u003e24c5418\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4214\"\u003e#4214\u003c/a\u003e from github/update-v4.38.3-e0b52dbdc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8\"\u003e\u003ccode\u003e69e87c5\u003c/code\u003e\u003c/a\u003e Add changelog note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa\"\u003e\u003ccode\u003e23b6828\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b\"\u003e\u003ccode\u003ee0b52db\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4210\"\u003e#4210\u003c/a\u003e from github/henrymercer/pin-python-for-older-clis-in-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc\"\u003e\u003ccode\u003e6b99698\u003c/code\u003e\u003c/a\u003e Pin Python 3.13.15 for older CLI versions in multi-language check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8\"\u003e\u003ccode\u003e63d3d63\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4203\"\u003e#4203\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe\"\u003e\u003ccode\u003e7377a10\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524\"\u003e\u003ccode\u003ec1a30cd\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974\"\u003e\u003ccode\u003ed208ec7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4200\"\u003e#4200\u003c/a\u003e from github/mbg/esm/migrate-pr-checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845\"\u003e\u003ccode\u003ea71b0c6\u003c/code\u003e\u003c/a\u003e Replace \u003ccode\u003e__dirname\u003c/code\u003e in \u003ccode\u003esync.ts\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/luminare-dev/lumen-mail/pull/2","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/luminare-dev%2Flumen-mail/issues/2","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2/packages"},{"uuid":"5968037330","node_id":"PR_kwDOPXS5wc8AAAABJ4QqqQ","number":3678,"state":"closed","title":"chore(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0","user":"dependabot[bot]","labels":["ci","dependencies"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":"2026-10-22T05:17:55.000Z","author_association":null,"state_reason":null,"created_at":"2026-10-21T20:30:55.000Z","updated_at":"2026-10-22T05:17:55.000Z","time_to_close":31620,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps)","packages":[{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n","html_url":"https://github.com/abhigyanpatwari/GitNexus/pull/3678","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/abhigyanpatwari%2FGitNexus/issues/3678","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/3678/packages"},{"uuid":"5948361304","node_id":"PR_kwDOVRUQIs8AAAABJoe-SA","number":5,"state":"closed","title":"chore(deps): bump the github-actions group across 1 directory with 8 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":"2026-10-21T01:34:55.000Z","author_association":null,"state_reason":null,"created_at":"2026-10-20T19:38:52.000Z","updated_at":"2026-10-21T01:34:58.000Z","time_to_close":21363,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"github-actions","update_count":8,"packages":[{"name":"actions/checkout","old_version":"6.1.0","new_version":"7.0.1","repository_url":"https://github.com/actions/checkout"},{"name":"actions/setup-python","old_version":"6.3.0","new_version":"7.0.0","repository_url":"https://github.com/actions/setup-python"},{"name":"actions/upload-artifact","old_version":"6.0.0","new_version":"7.0.2","repository_url":"https://github.com/actions/upload-artifact"},{"name":"github/codeql-action/init","old_version":"4.38.2","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.38.2","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"SignPath/github-action-submit-signing-request","old_version":"2.3","new_version":"3.0","repository_url":"https://github.com/signpath/github-action-submit-signing-request"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.2","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 8 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `6.1.0` | `7.0.1` |\n| [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` |\n| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6.0.0` | `7.0.2` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.39.0` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.39.0` |\n| [SignPath/github-action-submit-signing-request](https://github.com/signpath/github-action-submit-signing-request) | `2.3` | `3.0` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.39.0` |\n\n\nUpdates `actions/checkout` from 6.1.0 to 7.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/releases\"\u003eactions/checkout's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eskip running unsafe pr check if input is default by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2518\"\u003eactions/checkout#2518\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003etrim only ascii whitespace for branch by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2521\"\u003eactions/checkout#2521\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eescape values passed to --unset by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2530\"\u003eactions/checkout#2530\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v7...v7.0.1\"\u003ehttps://github.com/actions/checkout/compare/v7...v7.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eblock checking out fork pr for pull_request_target and workflow_run by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2458\"\u003eactions/checkout#2458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.1 to 3.4.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2460\"\u003eactions/checkout#2460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.2.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2461\"\u003eactions/checkout#2461\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e and \u003ccode\u003e@​actions/tool-cache\u003c/code\u003e and Remove uuid by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2459\"\u003eactions/checkout#2459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade module to esm and update dependencies by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2463\"\u003eactions/checkout#2463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2462\"\u003eactions/checkout#2462\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003egetting ready for checkout v7 release by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2464\"\u003eactions/checkout#2464\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate error wording by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2467\"\u003eactions/checkout#2467\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.3...v7.0.0\"\u003ehttps://github.com/actions/checkout/compare/v6.0.3...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003ev7.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSkip running unsafe pr check if input is default by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2518\"\u003eactions/checkout#2518\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eTrim only ascii whitespace for branch by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2521\"\u003eactions/checkout#2521\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEscape values passed to --unset by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2530\"\u003eactions/checkout#2530\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock checking out fork PR for pull_request_target and workflow_run by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca href=\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca href=\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca href=\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca href=\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment variables by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca href=\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1\"\u003e\u003ccode\u003e3d3c42e\u003c/code\u003e\u003c/a\u003e prep v7.0.1 release (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2531\"\u003e#2531\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07\"\u003e\u003ccode\u003e2880268\u003c/code\u003e\u003c/a\u003e escape values passed to --unset (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2530\"\u003e#2530\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1\"\u003e\u003ccode\u003e12cd223\u003c/code\u003e\u003c/a\u003e trim only ascii whitespace for branch (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2521\"\u003e#2521\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541\"\u003e\u003ccode\u003e62661c4\u003c/code\u003e\u003c/a\u003e skip running unsafe pr check if input is default (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2518\"\u003e#2518\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f\"\u003e\u003ccode\u003ee8d4307\u003c/code\u003e\u003c/a\u003e Bump the minor-actions-dependencies group with 2 updates (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2499\"\u003e#2499\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87\"\u003e\u003ccode\u003e631c942\u003c/code\u003e\u003c/a\u003e eslint 9 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2474\"\u003e#2474\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e\"\u003e\u003ccode\u003e4f1f4ae\u003c/code\u003e\u003c/a\u003e Bump actions/upload-artifact from 4 to 7 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2476\"\u003e#2476\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92\"\u003e\u003ccode\u003eba09753\u003c/code\u003e\u003c/a\u003e Bump actions/checkout from 6 to 7 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2488\"\u003e#2488\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22\"\u003e\u003ccode\u003eb9e0990\u003c/code\u003e\u003c/a\u003e Bump docker/login-action from 3.3.0 to 4.2.0 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2479\"\u003e#2479\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2\"\u003e\u003ccode\u003ee8cb398\u003c/code\u003e\u003c/a\u003e Bump docker/build-push-action from 6.5.0 to 7.2.0 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2478\"\u003e#2478\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/checkout/compare/d23441a48e516b6c34aea4fa41551a30e30af803...3d3c42e5aac5ba805825da76410c181273ba90b1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/setup-python` from 6.3.0 to 7.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/setup-python/releases\"\u003eactions/setup-python's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate to ESM and upgrade dependencies by \u003ca href=\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1330\"\u003eactions/setup-python#1330\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin SHA commits and update docs with latest versions by \u003ca href=\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e@​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1338\"\u003eactions/setup-python#1338\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove the pip-install input by \u003ca href=\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1336\"\u003eactions/setup-python#1336\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fix\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix to Classify stderr warning messages as warnings instead of errors in annotations by \u003ca href=\"https://github.com/lmvysakh\"\u003e\u003ccode\u003e@​lmvysakh\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1335\"\u003eactions/setup-python#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eValidate and retry manifest fetch to prevent silent failures by \u003ca href=\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1332\"\u003eactions/setup-python#1332\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency Upgrade\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump certifi from 2020.6.20 to 2024.7.4 in /\u003cstrong\u003etests\u003c/strong\u003e/data by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1328\"\u003eactions/setup-python#1328\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove EOL Python versions and Bumps numpy text fixture by \u003ca href=\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e@​priya-kinthali\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1333\"\u003eactions/setup-python#1333\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1337\"\u003eactions/setup-python#1337\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lmvysakh\"\u003e\u003ccode\u003e@​lmvysakh\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1335\"\u003eactions/setup-python#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1337\"\u003eactions/setup-python#1337\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-python/compare/v6...v7.0.0\"\u003ehttps://github.com/actions/setup-python/compare/v6...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-python/commit/5fda3b95a4ea91299a34e894583c3862153e4b97\"\u003e\u003ccode\u003e5fda3b9\u003c/code\u003e\u003c/a\u003e Pin SHA commits and update docs with latest versions (\u003ca href=\"https://redirect.github.com/actions/setup-python/issues/1338\"\u003e#1338\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-python/commit/4ab7e95f05e168b4356aebde89dd84f59c283d8e\"\u003e\u003ccode\u003e4ab7e95\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/setup-python/issues/1337\"\u003e#1337\u003c/a\u003e from actions/philip-gai/bump-actions-cache-6-2-0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-python/commit/0f3a009f475dbea83c0371cd85d099690fee8c5c\"\u003e\u003ccode\u003e0f3a009\u003c/code\u003e\u003c/a\u003e Remove the pip-install input (\u003ca href=\"https://redirect.github.com/actions/setup-python/issues/1336\"\u003e#1336\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-python/commit/f8cf4291c8b8e273ddd26e569454615c7315d932\"\u003e\u003ccode\u003ef8cf429\u003c/code\u003e\u003c/a\u003e Migrate to ESM and upgrade dependencies (\u003ca href=\"https://redirect.github.com/actions/setup-python/issues/1330\"\u003e#1330\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-python/commit/54baeea5b34417d10a7479663a23cca53ea209b5\"\u003e\u003ccode\u003e54baeea\u003c/code\u003e\u003c/a\u003e Validate and retry manifest fetch to prevent silent failures (\u003ca href=\"https://redirect.github.com/actions/setup-python/issues/1332\"\u003e#1332\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-python/commit/c7092773a316760f4ecfe498e4af668a4dafeac5\"\u003e\u003ccode\u003ec709277\u003c/code\u003e\u003c/a\u003e Annotation code fix (\u003ca href=\"https://redirect.github.com/actions/setup-python/issues/1335\"\u003e#1335\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-python/commit/6849080452e69b330395e8a6d23cf90f56d76a1a\"\u003e\u003ccode\u003e6849080\u003c/code\u003e\u003c/a\u003e remove EOL Python versions and Bumps numpy text fixture (\u003ca href=\"https://redirect.github.com/actions/setup-python/issues/1333\"\u003e#1333\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-python/commit/0903b469fbf4441aadfe4f4b249dc5b1fba3a73e\"\u003e\u003ccode\u003e0903b46\u003c/code\u003e\u003c/a\u003e Bump certifi from 2020.6.20 to 2024.7.4 in /\u003cstrong\u003etests\u003c/strong\u003e/data (\u003ca href=\"https://redirect.github.com/actions/setup-python/issues/1328\"\u003e#1328\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/setup-python/compare/ece7cb06caefa5fff74198d8649806c4678c61a1...5fda3b95a4ea91299a34e894583c3862153e4b97\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-artifact` from 6.0.0 to 7.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdates \u003ccode\u003e@​actions/artifact\u003c/code\u003e to v6.3.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/821\"\u003eactions/upload-artifact#821\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\"\u003ehttps://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the readme with direct upload details by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/795\"\u003eactions/upload-artifact#795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReadme: bump all the example versions to v7 by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/796\"\u003eactions/upload-artifact#796\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eInclude changes in typespec/ts-http-runtime 0.3.5 by \u003ca href=\"https://github.com/yacaovsnc\"\u003e\u003ccode\u003e@​yacaovsnc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/797\"\u003eactions/upload-artifact#797\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v7...v7.0.1\"\u003ehttps://github.com/actions/upload-artifact/compare/v7...v7.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003ev7 What's new\u003c/h2\u003e\n\u003ch3\u003eDirect Uploads\u003c/h3\u003e\n\u003cp\u003eAdds support for uploading single files directly (unzipped). Callers can set the new \u003ccode\u003earchive\u003c/code\u003e parameter to \u003ccode\u003efalse\u003c/code\u003e to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The \u003ccode\u003ename\u003c/code\u003e parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.\u003c/p\u003e\n\u003ch3\u003eESM\u003c/h3\u003e\n\u003cp\u003eTo support new versions of the \u003ccode\u003e@actions/*\u003c/code\u003e packages, we've upgraded the package to ESM.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd proxy integration test by \u003ca href=\"https://github.com/Link\"\u003e\u003ccode\u003e@​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/754\"\u003eactions/upload-artifact#754\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade the module to ESM and bump dependencies by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/762\"\u003eactions/upload-artifact#762\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport direct file uploads by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/764\"\u003eactions/upload-artifact#764\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Link\"\u003e\u003ccode\u003e@​Link\u003c/code\u003e\u003c/a\u003e- made their first contribution in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/754\"\u003eactions/upload-artifact#754\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v6...v7.0.0\"\u003ehttps://github.com/actions/upload-artifact/compare/v6...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003e\u003ccode\u003ecf430e0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/822\"\u003e#822\u003c/a\u003e from actions/tunc-d-prepare-upload-v7-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469\"\u003e\u003ccode\u003ec2acded\u003c/code\u003e\u003c/a\u003e chore: prepare v7.0.2 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a\"\u003e\u003ccode\u003e4687c1b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/821\"\u003e#821\u003c/a\u003e from actions/tunc-d-upload-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719\"\u003e\u003ccode\u003e8cbe1be\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a\"\u003e\u003ccode\u003e043fb46\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/797\"\u003e#797\u003c/a\u003e from actions/yacaovsnc/update-dependency\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/634250c1388765ea7ed0f053e636f1f399000b94\"\u003e\u003ccode\u003e634250c\u003c/code\u003e\u003c/a\u003e Include changes in typespec/ts-http-runtime 0.3.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/e454baaac2be505c9450e11b8f3215c6fc023ce8\"\u003e\u003ccode\u003ee454baa\u003c/code\u003e\u003c/a\u003e Readme: bump all the example versions to v7 (\u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/796\"\u003e#796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/74fad66b98a6d799dc004d3353ccd0e6f6b2530e\"\u003e\u003ccode\u003e74fad66\u003c/code\u003e\u003c/a\u003e Update the readme with direct upload details (\u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/795\"\u003e#795\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f\"\u003e\u003ccode\u003ebbbca2d\u003c/code\u003e\u003c/a\u003e Support direct file uploads (\u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/764\"\u003e#764\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/589182c5a4cec8920b8c1bce3e2fab1c97a02296\"\u003e\u003ccode\u003e589182c\u003c/code\u003e\u003c/a\u003e Upgrade the module to ESM and bump dependencies (\u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/762\"\u003e#762\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/upload-artifact/compare/v6...cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from 4.38.2 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.38.2 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `SignPath/github-action-submit-signing-request` from 2.3 to 3.0\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SignPath/github-action-submit-signing-request/commit/f6d04783b4569d051e0c80105fe66e82819d0092\"\u003e\u003ccode\u003ef6d0478\u003c/code\u003e\u003c/a\u003e Build from - 7336bb524a08c99aa48ba5065b00095eb2b0e09e. Original commit messag...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SignPath/github-action-submit-signing-request/commit/ef0ce19416782bc2e1b2deea3ca79c5446cc3b78\"\u003e\u003ccode\u003eef0ce19\u003c/code\u003e\u003c/a\u003e Build from - 8ff04a5c1f8d21d18e1eb1fc41b698b425a83654. Original commit messag...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SignPath/github-action-submit-signing-request/commit/a790881fc89970675894221b0be3bb12a87eb391\"\u003e\u003ccode\u003ea790881\u003c/code\u003e\u003c/a\u003e Build from - 9c89d7e4aa8c240d6deba49c8e4f52910fd41288. Original commit messag...\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/signpath/github-action-submit-signing-request/compare/c92b958760219087e01f8d67a1669ed57afe2627...f6d04783b4569d051e0c80105fe66e82819d0092\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.2 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/iss...\n\n_Description has been truncated_","html_url":"https://github.com/ryouka0731/KeepingYouAwakeForWin/pull/5","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/ryouka0731%2FKeepingYouAwakeForWin/issues/5","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/5/packages"},{"uuid":"5920992754","node_id":"PR_kwDOM7wBS88AAAABJSp4RQ","number":125,"state":"open","title":"chore(deps): bump ossf/scorecard-action from 55891bbd73f2425e97637d96e306fc9d491d0b21 to 2d1146689b8cda280b9bc96326124645441f03bc","user":"dependabot[bot]","labels":["dependencies"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T09:06:39.000Z","updated_at":"2026-10-19T09:06:45.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps)","packages":[{"name":"ossf/scorecard-action","old_version":"55891bbd73f2425e97637d96e306fc9d491d0b21","new_version":"2d1146689b8cda280b9bc96326124645441f03bc","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 55891bbd73f2425e97637d96e306fc9d491d0b21 to 2d1146689b8cda280b9bc96326124645441f03bc.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/RELEASE.md\"\u003eossf/scorecard-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleasing the scorecard GitHub Action\u003c/h1\u003e\n\u003cp\u003eThis is a draft document to describe the release process for the scorecard\nGitHub Action.\u003c/p\u003e\n\u003cp\u003e(If there are improvements you'd like to see, please comment on the\n\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/33\"\u003etracking issue\u003c/a\u003e or issue a\npull request to discuss.)\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#tracking\"\u003eTracking\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#preparing-the-release\"\u003ePreparing the release\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#validate-the-action\"\u003eValidate the Action\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#update-the-scorecard-action-version\"\u003eUpdate the scorecard-action version\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#drafting-release-notes\"\u003eDrafting release notes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#release\"\u003eRelease\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#create-a-tag\"\u003eCreate a tag\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#create-a-github-release\"\u003eCreate a GitHub release\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#update-the-starter-workflow\"\u003eUpdate the starter workflow\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#announce\"\u003eAnnounce\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eTracking\u003c/h2\u003e\n\u003cp\u003eAs the first task, a Release Manager should open a tracking issue for the\nrelease.\u003c/p\u003e\n\u003cp\u003eWe don't currently have a template for releasing, but the following\n\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/97\"\u003eissue\u003c/a\u003e is a good example\nto draw inspiration from.\u003c/p\u003e\n\u003cp\u003eWe're not striving for perfection with the template, but the tracking issue\nwill serve as a reference point to aggregate feedback, so try your best to be\nas descriptive as possible.\u003c/p\u003e\n\u003ch2\u003ePreparing the release\u003c/h2\u003e\n\u003cp\u003eThis section covers changes that need to be issued as a pull request and should\nbe merged before releasing the scorecard GitHub Action.\u003c/p\u003e\n\u003ch3\u003eValidate the Action\u003c/h3\u003e\n\u003cp\u003eThe \u003ca href=\"https://github.com/ossf/scorecard-action/actions/workflows/postsubmits.yml\"\u003epostsubmits.yml\u003c/a\u003e\nworkflow runs on every push to \u003ccode\u003emain\u003c/code\u003e and weekly. It builds and pushes the\n\u003ccode\u003eghcr.io/ossf/scorecard-action:latest\u003c/code\u003e image, then runs Scorecard on this\nrepository with that image, uploading the SARIF and publishing the results.\u003c/p\u003e\n\u003cp\u003eConfirm that the \u003ccode\u003epostsubmits.yml\u003c/code\u003e run for the commit you plan to release\nsucceeded, including the Scorecard analysis job (no\n\u003ccode\u003eerror sending scorecard results\u003c/code\u003e line in its log). If there isn't one, run the\nworkflow manually.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/55891bbd73f2425e97637d96e306fc9d491d0b21...2d1146689b8cda280b9bc96326124645441f03bc\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/sebastienrousseau/metadata-gen/pull/125","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/sebastienrousseau%2Fmetadata-gen/issues/125","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/125/packages"},{"uuid":"5920281867","node_id":"PR_kwDOShNO_s8AAAABJSFhOg","number":101,"state":"closed","title":"build(deps): bump the actions group with 4 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":"2026-10-19T08:20:02.000Z","author_association":null,"state_reason":null,"created_at":"2026-10-19T08:13:54.000Z","updated_at":"2026-10-19T08:20:04.000Z","time_to_close":368,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"build(deps): bump","group_name":"actions","update_count":4,"packages":[{"name":"github/codeql-action/init","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action), [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) and [ossf/scorecard-action](https://github.com/ossf/scorecard-action).\n\nUpdates `github/codeql-action/init` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/hyperpolymath/llm-grace/pull/101","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/hyperpolymath%2Fllm-grace/issues/101","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/101/packages"},{"uuid":"5919903397","node_id":"PR_kwDOEANpXs8AAAABJRyT8Q","number":809,"state":"closed","title":"chore(deps): bump the minor-actions-dependencies group with 2 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-10-19T07:48:16.000Z","author_association":null,"state_reason":null,"created_at":"2026-10-19T07:44:06.000Z","updated_at":"2026-10-19T07:48:18.000Z","time_to_close":250,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"minor-actions-dependencies","update_count":2,"packages":[{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the minor-actions-dependencies group with 2 updates: [ossf/scorecard-action](https://github.com/ossf/scorecard-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/albertms10/music_notes/pull/809","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/albertms10%2Fmusic_notes/issues/809","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/809/packages"},{"uuid":"5919834333","node_id":"PR_kwDOSak_J88AAAABJRu11Q","number":258,"state":"open","title":"chore(deps): bump the github-actions group across 1 directory with 6 updates","user":"dependabot[bot]","labels":["area:tooling","dependencies","security","type:maintenance"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T07:38:15.000Z","updated_at":"2026-10-19T07:38:24.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"github-actions","update_count":6,"packages":[{"name":"actions/setup-node","old_version":"7.0.0","new_version":"7.1.0","repository_url":"https://github.com/actions/setup-node"},{"name":"actions/upload-artifact","old_version":"7.0.1","new_version":"7.0.2","repository_url":"https://github.com/actions/upload-artifact"},{"name":"github/codeql-action/init","old_version":"4.37.9","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.37.9","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.37.9","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 6 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` |\n| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.9` | `4.39.0` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.9` | `4.39.0` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.9` | `4.39.0` |\n\n\nUpdates `actions/setup-node` from 7.0.0 to 7.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/setup-node/releases\"\u003eactions/setup-node's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for mise.toml file by \u003ca href=\"https://github.com/gperdomor\"\u003e\u003ccode\u003e@​gperdomor\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1421\"\u003eactions/setup-node#1421\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport absolute paths in node-version-file by \u003ca href=\"https://github.com/v-mahabaleshwars\"\u003e\u003ccode\u003e@​v-mahabaleshwars\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1633\"\u003eactions/setup-node#1633\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug fixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Node version validation and manifest fetch retry by \u003ca href=\"https://github.com/v-jitenderpalsingh\"\u003e\u003ccode\u003e@​v-jitenderpalsingh\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1580\"\u003eactions/setup-node#1580\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation updates:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eREADME.md: bump actions/checkout to latest version 7 by \u003ca href=\"https://github.com/deining\"\u003e\u003ccode\u003e@​deining\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1578\"\u003eactions/setup-node#1578\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by \u003ca href=\"https://github.com/v-gowridurgad\"\u003e\u003ccode\u003e@​v-gowridurgad\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1593\"\u003eactions/setup-node#1593\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed cache recommendation syntax by \u003ca href=\"https://github.com/SubJunk\"\u003e\u003ccode\u003e@​SubJunk\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1603\"\u003eactions/setup-node#1603\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency updates:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate workflow pins and migrate Node matrices to modern versions by \u003ca href=\"https://github.com/v-HarithaVattikuti\"\u003e\u003ccode\u003e@​v-HarithaVattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1583\"\u003eactions/setup-node#1583\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1584\"\u003eactions/setup-node#1584\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin \u003ccode\u003e@​types/node\u003c/code\u003e to v24 by \u003ca href=\"https://github.com/v-priyagupta108\"\u003e\u003ccode\u003e@​v-priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1585\"\u003eactions/setup-node#1585\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOverride brace-expansion to 5.0.8 by \u003ca href=\"https://github.com/v-priyagupta108\"\u003e\u003ccode\u003e@​v-priyagupta108\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1599\"\u003eactions/setup-node#1599\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  actions/checkout from 7.0.0 to 7.0.1 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1598\"\u003eactions/setup-node#1598\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  prettier from 3.8.4 to 3.9.6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1590\"\u003eactions/setup-node#1590\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  \u003ccode\u003e@​vercel/ncc\u003c/code\u003e from 0.44.0 to 0.45.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1610\"\u003eactions/setup-node#1610\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  pnpm/action-setup from 6.0.9 to 6.0.10 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1602\"\u003eactions/setup-node#1602\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  baseline-browser-mapping from 2.10.38 to 2.11.22 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1629\"\u003eactions/setup-node#1629\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​types/semver\u003c/code\u003e from 7.7.1 to 7.8.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1616\"\u003eactions/setup-node#1616\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e from 8.62.0 to 8.70.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1615\"\u003eactions/setup-node#1615\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade pnpm/action-setup from 6.0.10 to 6.1.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1631\"\u003eactions/setup-node#1631\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade jest-each from 30.4.1 to 30.5.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1636\"\u003eactions/setup-node#1636\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade eslint-plugin-n from 18.1.0 to 18.3.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1638\"\u003eactions/setup-node#1638\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependencies and add license files by \u003ca href=\"https://github.com/v-HarithaVattikuti\"\u003e\u003ccode\u003e@​v-HarithaVattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1642\"\u003eactions/setup-node#1642\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1635\"\u003eactions/setup-node#1635\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/v-jitenderpalsingh\"\u003e\u003ccode\u003e@​v-jitenderpalsingh\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1580\"\u003eactions/setup-node#1580\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1584\"\u003eactions/setup-node#1584\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gperdomor\"\u003e\u003ccode\u003e@​gperdomor\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1421\"\u003eactions/setup-node#1421\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SubJunk\"\u003e\u003ccode\u003e@​SubJunk\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1603\"\u003eactions/setup-node#1603\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-node/compare/v7.0.0...v7.1.0\"\u003ehttps://github.com/actions/setup-node/compare/v7.0.0...v7.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/949feb2413d6458794dcd2491c4babbbce0c15c1\"\u003e\u003ccode\u003e949feb2\u003c/code\u003e\u003c/a\u003e Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1635\"\u003e#1635\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/7207c4f1189c7ee83ddf20c7c68bd1af6fdd751c\"\u003e\u003ccode\u003e7207c4f\u003c/code\u003e\u003c/a\u003e chore: update dependencies and add license files (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1642\"\u003e#1642\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/54337e0d02de9202d0948aaff36ad556375497b9\"\u003e\u003ccode\u003e54337e0\u003c/code\u003e\u003c/a\u003e Bump eslint-plugin-n from 18.1.0 to 18.3.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1638\"\u003e#1638\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/fb54fa8c14c63410cc752f0ae3b7b3ca6af161fc\"\u003e\u003ccode\u003efb54fa8\u003c/code\u003e\u003c/a\u003e Bump jest-each from 30.4.1 to 30.5.2 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1636\"\u003e#1636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/7f84f1d52d0c56afb45c62fee31a93b843cea4d6\"\u003e\u003ccode\u003e7f84f1d\u003c/code\u003e\u003c/a\u003e Bump pnpm/action-setup from 6.0.10 to 6.1.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1631\"\u003e#1631\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/0c54c7b07420dcba69a7d832587f55ebdf771c9e\"\u003e\u003ccode\u003e0c54c7b\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e from 8.62.0 to 8.70.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1615\"\u003e#1615\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/a8294190049a9c296f01b9a432aff41dd83d8284\"\u003e\u003ccode\u003ea829419\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​types/semver\u003c/code\u003e from 7.7.1 to 7.8.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1616\"\u003e#1616\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/680d1e489b82f1243de15bc7665c0007e3c9a860\"\u003e\u003ccode\u003e680d1e4\u003c/code\u003e\u003c/a\u003e Support absolute paths in node-version-file (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1633\"\u003e#1633\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/db0fb3a98ed314b69026b6e8c9be26a7e2fe65a8\"\u003e\u003ccode\u003edb0fb3a\u003c/code\u003e\u003c/a\u003e Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1629\"\u003e#1629\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/94196ee1d15439c1b6651cd87ef14e88ec435966\"\u003e\u003ccode\u003e94196ee\u003c/code\u003e\u003c/a\u003e Bump pnpm/action-setup from 6.0.9 to 6.0.10 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1602\"\u003e#1602\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-artifact` from 7.0.1 to 7.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdates \u003ccode\u003e@​actions/artifact\u003c/code\u003e to v6.3.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/821\"\u003eactions/upload-artifact#821\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\"\u003ehttps://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003e\u003ccode\u003ecf430e0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/822\"\u003e#822\u003c/a\u003e from actions/tunc-d-prepare-upload-v7-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469\"\u003e\u003ccode\u003ec2acded\u003c/code\u003e\u003c/a\u003e chore: prepare v7.0.2 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a\"\u003e\u003ccode\u003e4687c1b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/821\"\u003e#821\u003c/a\u003e from actions/tunc-d-upload-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719\"\u003e\u003ccode\u003e8cbe1be\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from 4.37.9 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.37.9 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.37.9 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/LMLiam/Casino-Warehouse/pull/258","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/LMLiam%2FCasino-Warehouse/issues/258","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/258/packages"},{"uuid":"5919719372","node_id":"PR_kwDOQhWFBM8AAAABJRpDJg","number":75,"state":"open","title":"chore(deps): bump the actions group across 1 directory with 5 updates","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T07:28:38.000Z","updated_at":"2026-10-19T07:28:42.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"actions","update_count":5,"packages":[{"name":"helm/chart-testing-action","old_version":"2.8.0","new_version":"2.9.0","repository_url":"https://github.com/helm/chart-testing-action"},{"name":"actions/upload-artifact","old_version":"7.0.1","new_version":"7.0.2","repository_url":"https://github.com/actions/upload-artifact"},{"name":"dorny/test-reporter","old_version":"3.0.0","new_version":"3.2.0","repository_url":"https://github.com/dorny/test-reporter"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.37.9","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the actions group with 5 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [helm/chart-testing-action](https://github.com/helm/chart-testing-action) | `2.8.0` | `2.9.0` |\n| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |\n| [dorny/test-reporter](https://github.com/dorny/test-reporter) | `3.0.0` | `3.2.0` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.9` | `4.39.0` |\n\n\nUpdates `helm/chart-testing-action` from 2.8.0 to 2.9.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/helm/chart-testing-action/releases\"\u003ehelm/chart-testing-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.9.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: \u003ccode\u003euv_version\u003c/code\u003e to pin \u003ccode\u003euv\u003c/code\u003e by \u003ca href=\"https://github.com/jmelahman\"\u003e\u003ccode\u003e@​jmelahman\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/194\"\u003ehelm/chart-testing-action#194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the actions group across 1 directory with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/199\"\u003ehelm/chart-testing-action#199\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix typo in permissions section of README by \u003ca href=\"https://github.com/MrLuje\"\u003e\u003ccode\u003e@​MrLuje\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/187\"\u003ehelm/chart-testing-action#187\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: remove outdated defaults from action.yml by \u003ca href=\"https://github.com/pmalek\"\u003e\u003ccode\u003e@​pmalek\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/197\"\u003ehelm/chart-testing-action#197\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 5.0.0 to 6.0.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/200\"\u003ehelm/chart-testing-action#200\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump sigstore/cosign-installer from 4.0.0 to 4.1.1 in the actions group across 1 directory by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/207\"\u003ehelm/chart-testing-action#207\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add github_token input for setup-uv action by \u003ca href=\"https://github.com/fty4\"\u003e\u003ccode\u003e@​fty4\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/204\"\u003ehelm/chart-testing-action#204\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the actions group across 1 directory with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/221\"\u003ehelm/chart-testing-action#221\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 6.0.2 to 7.0.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/217\"\u003ehelm/chart-testing-action#217\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump azure/setup-helm from 4.3.1 to 5.0.1 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/216\"\u003ehelm/chart-testing-action#216\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump astral-sh/setup-uv from 7.3.0 to 10.1.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/223\"\u003ehelm/chart-testing-action#223\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 7.0.0 to 7.0.1 in the actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/222\"\u003ehelm/chart-testing-action#222\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/setup-python from 6.2.0 to 7.0.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/224\"\u003ehelm/chart-testing-action#224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: report a clear error when chart-testing blob verification fails by \u003ca href=\"https://github.com/somaz94\"\u003e\u003ccode\u003e@​somaz94\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/210\"\u003ehelm/chart-testing-action#210\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: do not let a stale cache directory suppress signature verification by \u003ca href=\"https://github.com/cpanato\"\u003e\u003ccode\u003e@​cpanato\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/228\"\u003ehelm/chart-testing-action#228\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: pass version inputs via env to prevent expression injection by \u003ca href=\"https://github.com/cpanato\"\u003e\u003ccode\u003e@​cpanato\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/225\"\u003ehelm/chart-testing-action#225\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: add concurrency group and rename workflow to .yaml by \u003ca href=\"https://github.com/cpanato\"\u003e\u003ccode\u003e@​cpanato\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/227\"\u003ehelm/chart-testing-action#227\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: harden test-action workflow permissions and pin kind-action by \u003ca href=\"https://github.com/cpanato\"\u003e\u003ccode\u003e@​cpanato\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/226\"\u003ehelm/chart-testing-action#226\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/229\"\u003ehelm/chart-testing-action#229\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add lint_config input for custom yamllint rules by \u003ca href=\"https://github.com/Bisman-Singh\"\u003e\u003ccode\u003e@​Bisman-Singh\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/208\"\u003ehelm/chart-testing-action#208\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: document testing charts with CRDs by \u003ca href=\"https://github.com/SyedAsadRazaDevops\"\u003e\u003ccode\u003e@​SyedAsadRazaDevops\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/211\"\u003ehelm/chart-testing-action#211\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erun test-action workflow on push by \u003ca href=\"https://github.com/adoroszlai\"\u003e\u003ccode\u003e@​adoroszlai\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/212\"\u003ehelm/chart-testing-action#212\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: add Helm security policy by \u003ca href=\"https://github.com/cpanato\"\u003e\u003ccode\u003e@​cpanato\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/231\"\u003ehelm/chart-testing-action#231\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add option to disable blob verification by \u003ca href=\"https://github.com/fty4\"\u003e\u003ccode\u003e@​fty4\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/205\"\u003ehelm/chart-testing-action#205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: update chart-testing to v3.15.0 and add stale workflow by \u003ca href=\"https://github.com/cpanato\"\u003e\u003ccode\u003e@​cpanato\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/230\"\u003ehelm/chart-testing-action#230\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump helm/kind-action from 1.15.0 to 1.15.1 in the actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/232\"\u003ehelm/chart-testing-action#232\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jmelahman\"\u003e\u003ccode\u003e@​jmelahman\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/194\"\u003ehelm/chart-testing-action#194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MrLuje\"\u003e\u003ccode\u003e@​MrLuje\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/187\"\u003ehelm/chart-testing-action#187\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pmalek\"\u003e\u003ccode\u003e@​pmalek\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/197\"\u003ehelm/chart-testing-action#197\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/somaz94\"\u003e\u003ccode\u003e@​somaz94\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/210\"\u003ehelm/chart-testing-action#210\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Bisman-Singh\"\u003e\u003ccode\u003e@​Bisman-Singh\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/208\"\u003ehelm/chart-testing-action#208\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SyedAsadRazaDevops\"\u003e\u003ccode\u003e@​SyedAsadRazaDevops\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/211\"\u003ehelm/chart-testing-action#211\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/adoroszlai\"\u003e\u003ccode\u003e@​adoroszlai\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/212\"\u003ehelm/chart-testing-action#212\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/helm/chart-testing-action/compare/v2.8.0...v2.9.0\"\u003ehttps://github.com/helm/chart-testing-action/compare/v2.8.0...v2.9.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/720270857a28afd41e2426521a7801db09e9b510\"\u003e\u003ccode\u003e7202708\u003c/code\u003e\u003c/a\u003e chore(deps): bump helm/kind-action (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/232\"\u003e#232\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/e0d1bffb66ff462eae4c44324c93ba60e0763adf\"\u003e\u003ccode\u003ee0d1bff\u003c/code\u003e\u003c/a\u003e chore: update chart-testing to v3.15.0 and add stale workflow (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/230\"\u003e#230\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/2d601b3d6fb1811ad1a0480edf4b0dcaf2190aa2\"\u003e\u003ccode\u003e2d601b3\u003c/code\u003e\u003c/a\u003e feat: add option to disable blob verification (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/205\"\u003e#205\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/4b9e8ccd8d870c94667aec5e4ef54cc49934cd85\"\u003e\u003ccode\u003e4b9e8cc\u003c/code\u003e\u003c/a\u003e docs: add Helm security policy (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/231\"\u003e#231\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/bd218c7c4310ef8db9044990904e83df20fd531c\"\u003e\u003ccode\u003ebd218c7\u003c/code\u003e\u003c/a\u003e run test-action on push (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/212\"\u003e#212\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/67af79847b7c402a72dbdf2c3e6de58f7cf419ca\"\u003e\u003ccode\u003e67af798\u003c/code\u003e\u003c/a\u003e docs: document testing charts with CRDs (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/211\"\u003e#211\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/05d54e3c5a2b2a918816e737212dfecd32d30d40\"\u003e\u003ccode\u003e05d54e3\u003c/code\u003e\u003c/a\u003e feat: add lint_config input for custom yamllint rules (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/208\"\u003e#208\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/45557e3b936dc26f6136cc60c523cecf92b89513\"\u003e\u003ccode\u003e45557e3\u003c/code\u003e\u003c/a\u003e Bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the actions group (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/229\"\u003e#229\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/f3ef15d8179cc3d72028604dfbf96178583a50a2\"\u003e\u003ccode\u003ef3ef15d\u003c/code\u003e\u003c/a\u003e chore: harden test-action workflow permissions and pin kind-action (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/226\"\u003e#226\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/a9ff2fad6544850f07502c12733a4f3d08d3a974\"\u003e\u003ccode\u003ea9ff2fa\u003c/code\u003e\u003c/a\u003e chore: add concurrency group and rename workflow to .yaml (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/227\"\u003e#227\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/helm/chart-testing-action/compare/6ec842c01de15ebb84c8627d2744a0c2f2755c9f...720270857a28afd41e2426521a7801db09e9b510\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-artifact` from 7.0.1 to 7.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdates \u003ccode\u003e@​actions/artifact\u003c/code\u003e to v6.3.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/821\"\u003eactions/upload-artifact#821\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\"\u003ehttps://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003e\u003ccode\u003ecf430e0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/822\"\u003e#822\u003c/a\u003e from actions/tunc-d-prepare-upload-v7-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469\"\u003e\u003ccode\u003ec2acded\u003c/code\u003e\u003c/a\u003e chore: prepare v7.0.2 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a\"\u003e\u003ccode\u003e4687c1b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/821\"\u003e#821\u003c/a\u003e from actions/tunc-d-upload-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719\"\u003e\u003ccode\u003e8cbe1be\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `dorny/test-reporter` from 3.0.0 to 3.2.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/dorny/test-reporter/blob/main/CHANGELOG.md\"\u003edorny/test-reporter's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003e3.2.0\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix: \u003ccode\u003edotnet-trx\u003c/code\u003e reports unmapped test outcomes and aborted test runs as failures \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/825\"\u003edorny/test-reporter#825\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix: report test cases from nested \u003c!-- raw HTML omitted --\u003e elements in \u003ccode\u003ejava-junit\u003c/code\u003e reporter \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/840\"\u003edorny/test-reporter#840\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.1.0\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003elist-files\u003c/code\u003e input to control test report file listing \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/773\"\u003edorny/test-reporter#773\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003esummary_file\u003c/code\u003e output with the path to the generated summary in Markdown format \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/772\"\u003edorny/test-reporter#772\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Unreal Engine JSON reporter support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve PHPUnit exception types when the failure body does not contain a typed line.\u003c/li\u003e\n\u003cli\u003eParse Jest JUnit failures that provide failure attributes without a failure body.\u003c/li\u003e\n\u003cli\u003eEscape pipe characters in Markdown table cells.\u003c/li\u003e\n\u003cli\u003eDecode report files before parsing and handle byte-order marks correctly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaintenance and security\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate dependencies and rebuild the distribution to include security fixes and current tooling.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFeature: Use NodeJS 24 LTS as default runtime \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/738\"\u003edorny/test-reporter#738\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFeature: Add \u003ccode\u003eslug-prefix\u003c/code\u003e output for link anchors \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/731\"\u003edorny/test-reporter#731\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFeature: Report \u003ccode\u003ejest-junit\u003c/code\u003e testsuite errors as failures \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/155\"\u003edorny/test-reporter#155\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSecurity: Update dependencies to fix reported security vulnerabilities\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix: For \u003ccode\u003eworkflow_run\u003c/code\u003e events, resolve the commit of the check run from related pull request head commits first (matching \u003ccode\u003eworkflow_run.head_branch\u003c/code\u003e, then first PR), and fall back to \u003ccode\u003eworkflow_run.head_sha\u003c/code\u003e for non-PR runs \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/673\"\u003edorny/test-reporter#673\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eChange: The \u003ccode\u003etest-reporter\u003c/code\u003e action will listed all artifacts associated with the build run \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/693\"\u003edorny/test-reporter#693\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMaintenance: Upgrade to ESLint v9 \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/629\"\u003edorny/test-reporter#629\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.5.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFeature: Add Nette Tester support with \u003ccode\u003etester-junit\u003c/code\u003e reporter \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/707\"\u003edorny/test-reporter#707\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMaintenance: Bump actions/upload-artifact from 5 to 6 \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/695\"\u003edorny/test-reporter#695\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.4.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFeature: Add PHPUnit support with JUnit XML dialect parser \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/422\"\u003edorny/test-reporter#422\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFeature: Add JUnit XML sample files and tests for validation \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/701\"\u003edorny/test-reporter#701\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix: Refactor deprecated \u003ccode\u003eString.substr()\u003c/code\u003e function to use \u003ccode\u003eString.substring()\u003c/code\u003e \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/704\"\u003edorny/test-reporter#704\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFeature: Add Python support with \u003ccode\u003epython-xunit\u003c/code\u003e reporter (pytest) \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/643\"\u003edorny/test-reporter#643\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFeature: Add pytest traceback parsing and \u003ccode\u003edirectory-mapping\u003c/code\u003e option \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/238\"\u003edorny/test-reporter#238\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePerformance: Update sax.js to fix large XML file parsing \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/681\"\u003edorny/test-reporter#681\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/d1b5dff021aa968b288b02285a8bf47471c5928a\"\u003e\u003ccode\u003ed1b5dff\u003c/code\u003e\u003c/a\u003e test-reporter release v3.2.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/aa2d703c08ef79f4a13b6b944885e757cc2bd687\"\u003e\u003ccode\u003eaa2d703\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/dorny/test-reporter/issues/840\"\u003e#840\u003c/a\u003e from keith-lueneburg/fix/junit-nested-testsuites\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/be1e6af3b6f0247ca8523d52c4fa56c21fd907b3\"\u003e\u003ccode\u003ebe1e6af\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/dorny/test-reporter/issues/842\"\u003e#842\u003c/a\u003e from dorny/dependabot/npm_and_yarn/reports/jest/multi...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/79718dcaaae3b6e11f621a35ac9a127a4c0256d2\"\u003e\u003ccode\u003e79718dc\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/dorny/test-reporter/issues/825\"\u003e#825\u003c/a\u003e from CTWalk/fix/dotnet-trx-unmapped-outcomes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/98640f9fdf91478704a357b87dfdf292d624c7eb\"\u003e\u003ccode\u003e98640f9\u003c/code\u003e\u003c/a\u003e fix(dotnet-trx): treat a Warning run outcome as a clean run\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/186413b9aad57244ef29ed807432d8d821af062b\"\u003e\u003ccode\u003e186413b\u003c/code\u003e\u003c/a\u003e fix(dotnet-trx): report unmapped outcomes and aborted runs as failures\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/c5f7127dc95ed3cba6cc223314416a5a50dc23f1\"\u003e\u003ccode\u003ec5f7127\u003c/code\u003e\u003c/a\u003e chore(deps): bump brace-expansion in /reports/jest\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/53f83686b9756940da8bb936cea68050c38f1026\"\u003e\u003ccode\u003e53f8368\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/dorny/test-reporter/issues/841\"\u003e#841\u003c/a\u003e from dorny/dependabot/npm_and_yarn/typescript-eslint/...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/edc93d264fc36765b2d24974cca43b6dc66cd023\"\u003e\u003ccode\u003eedc93d2\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e from 8.70.1 to 8.71.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/1896380dca5565b7f5bbe81238b8716dc2a49bc4\"\u003e\u003ccode\u003e1896380\u003c/code\u003e\u003c/a\u003e Rebuild the \u003ccode\u003edist/index.js\u003c/code\u003e file\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/dorny/test-reporter/compare/a43b3a5f7366b97d083190328d2c652e1a8b6aa2...d1b5dff021aa968b288b02285a8bf47471c5928a\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.37.9 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/redevops-io/ingress-nginx/pull/75","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/redevops-io%2Fingress-nginx/issues/75","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/75/packages"},{"uuid":"5919150654","node_id":"PR_kwDOSA9Zas8AAAABJRLr7w","number":65,"state":"open","title":"ci: bump ossf/scorecard-action from 2.4.4 to 2.5.0","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T06:43:01.000Z","updated_at":"2026-10-19T06:43:04.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci","packages":[{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ossf/scorecard-action\u0026package-manager=github_actions\u0026previous-version=2.4.4\u0026new-version=2.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/markcassidyconsulting/ordercloud-python/pull/65","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/markcassidyconsulting%2Fordercloud-python/issues/65","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/65/packages"},{"uuid":"5918012990","node_id":"PR_kwDOOZYHO88AAAABJQRpqg","number":2882,"state":"open","title":"chore(deps): Bump the all-minors group across 1 directory with 3 updates","user":"dependabot[bot]","labels":["github-actions","github_actions","ai-copilot"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T04:50:24.000Z","updated_at":"2026-10-19T04:53:53.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): Bump","group_name":"all-minors","update_count":3,"packages":[{"name":"github/gh-aw/actions/setup-cli","old_version":"0.89.21","new_version":"0.91.3","repository_url":"https://github.com/github/gh-aw"},{"name":"google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml","old_version":"2.6.0","new_version":"2.7.0","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the all-minors group with 3 updates in the / directory: [github/gh-aw/actions/setup-cli](https://github.com/github/gh-aw), [google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml](https://github.com/google/osv-scanner-action) and [ossf/scorecard-action](https://github.com/ossf/scorecard-action).\n\nUpdates `github/gh-aw/actions/setup-cli` from 0.89.21 to 0.91.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/gh-aw/releases\"\u003egithub/gh-aw/actions/setup-cli's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.91.2\u003c/h2\u003e\n\u003ch2\u003e🌟 Release Highlights\u003c/h2\u003e\n\u003cp\u003eThis release deepens observability with richer unified agent sessions, and hardens security around secret masking, post-steps, and package scanning.\u003c/p\u003e\n\u003ch3\u003e✨ What's New\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eRicher unified agent sessions\u003c/strong\u003e: sessions now include split prompts, GitHub API rate limits, and daily AIC decisions, with estimated credits clearly distinguished from recorded usage.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDynamic workflow smoke coverage\u003c/strong\u003e: new smoke tests for dynamic workflows (including Claude) and opt-in engine defaults.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eWildcard GitHub App repositories\u003c/strong\u003e are now allowed explicitly in strict mode.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e🐛 Bug Fixes \u0026amp; Improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e: post-steps can no longer create issues directly or access safe-outputs; package resource scanning is file-aware; artifact redaction covers regex-shaped MCP gateway masks; non-writable files are prepared for custom secret masking.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eEngines\u003c/strong\u003e: Pi codemode compatibility and reasoning configuration fixed; Codex code-mode exec disabled for GitHub inference; pinned Node.js versions honored in detection and evals jobs.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReliability\u003c/strong\u003e: transient issue-listing failures are retried when publishing essential issues; Copilot session summary fallbacks fixed.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReporting\u003c/strong\u003e: engine conversation reports are cleaner with collapsed streamed messages; structured data in safe-output issues is collapsed.\u003c/li\u003e\n\u003cli\u003eMCP gateway updated to v0.4.29.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cblockquote\u003e\n\u003cp\u003eGenerated by \u003ca href=\"https://github.com/github/gh-aw/actions/runs/37504185059\"\u003e🚀 Release\u003c/a\u003e · copilot · auto · 15.1 AIC · ⊞ 11.6K\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003chr /\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e[docs] docs: unbloat sharing-workflows.md by \u003ca href=\"https://github.com/github-actions\"\u003e\u003ccode\u003e@​github-actions\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/65973\"\u003egithub/gh-aw#65973\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix Copilot session summary source fallbacks by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/65979\"\u003egithub/gh-aw#65979\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump source-map-js from 1.2.1 to 1.2.2 in /eslint-factory in the npm_and_yarn group across 1 directory by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/65980\"\u003egithub/gh-aw#65980\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the npm_and_yarn group across 1 directory with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/65983\"\u003egithub/gh-aw#65983\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the npm_and_yarn group across 1 directory with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/65981\"\u003egithub/gh-aw#65981\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[community] Update community contributions in README by \u003ca href=\"https://github.com/github-actions\"\u003e\u003ccode\u003e@​github-actions\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/65994\"\u003egithub/gh-aw#65994\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eInclude split prompts in the unified agent session by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66011\"\u003egithub/gh-aw#66011\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: collapse structured data in safe-output issues by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66025\"\u003egithub/gh-aw#66025\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMake package resource security scanning file-aware by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/65961\"\u003egithub/gh-aw#65961\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eHonor pinned Node.js versions in detection and evals jobs by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66040\"\u003egithub/gh-aw#66040\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCover regex-shaped MCP gateway masks in artifact redaction by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66041\"\u003egithub/gh-aw#66041\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eInclude GitHub API rate limits in unified agent sessions by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66047\"\u003egithub/gh-aw#66047\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[spec-enforcer] Enforce specifications for ctxutil, envutil, errorutil by \u003ca href=\"https://github.com/github-actions\"\u003e\u003ccode\u003e@​github-actions\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66106\"\u003egithub/gh-aw#66106\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix engine conversation reports and collapse streamed messages by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66048\"\u003egithub/gh-aw#66048\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDistinguish estimated credits from recorded daily AIC usage by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66043\"\u003egithub/gh-aw#66043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAllow explicit wildcard GitHub App repositories in strict mode by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66039\"\u003egithub/gh-aw#66039\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[WIP] Fix compiled lock files and zizmor pedantic audit issues by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66042\"\u003egithub/gh-aw#66042\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[spec-extractor] Update package specifications for agentdrain, cli, console, constants by \u003ca href=\"https://github.com/github-actions\"\u003e\u003ccode\u003e@​github-actions\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66085\"\u003egithub/gh-aw#66085\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump golang.org/x/tools from 0.50.0 to 0.51.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66087\"\u003egithub/gh-aw#66087\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump prettier from 3.9.8 to 3.9.9 in /actions/setup/js by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66088\"\u003egithub/gh-aw#66088\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRetry transient issue-listing failures in essential issue publishing by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66123\"\u003egithub/gh-aw#66123\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRefresh workflow pins and bundle Dependabot updates by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66124\"\u003egithub/gh-aw#66124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[ci-coach] Fix failing pkg/workflow unit tests (stale goldens and expectations) by \u003ca href=\"https://github.com/github-actions\"\u003e\u003ccode\u003e@​github-actions\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66180\"\u003egithub/gh-aw#66180\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRecord daily AIC decisions in unified sessions by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66126\"\u003egithub/gh-aw#66126\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump starlight-github-alerts from 0.4.0 to 0.5.0 in /docs by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66093\"\u003egithub/gh-aw#66093\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mermaid from 12.0.0 to 12.1.0 in /docs by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66091\"\u003egithub/gh-aw#66091\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/382f4b025fefaa7d6b2492c3608f098340bf6536\"\u003e\u003ccode\u003e382f4b0\u003c/code\u003e\u003c/a\u003e Render failure diagnostics safely with progressive disclosure (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66292\"\u003e#66292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/37c0b1980ec9ce6acbc42681e7e3da736a2b39d9\"\u003e\u003ccode\u003e37c0b19\u003c/code\u003e\u003c/a\u003e Add development compilation and local-first workflow debugging (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66270\"\u003e#66270\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/3fd44f8dc17a5fcdc45f653e7826853456b1839e\"\u003e\u003ccode\u003e3fd44f8\u003c/code\u003e\u003c/a\u003e Separate routing candidates from sub-agent model policy (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66234\"\u003e#66234\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/0d0a4b854ca46614353f8b40b76de3a6724499f8\"\u003e\u003ccode\u003e0d0a4b8\u003c/code\u003e\u003c/a\u003e Resolve post-agent usage paths on ARC/DinD runners (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66223\"\u003e#66223\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/401a4f2df34eaa84aa801b202b58efadfc9acad9\"\u003e\u003ccode\u003e401a4f2\u003c/code\u003e\u003c/a\u003e Bump gh-aw-mcpg to v0.4.29 (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66246\"\u003e#66246\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/02e6afb14c6eebdc278c1cf7a2bbffe2852421fa\"\u003e\u003ccode\u003e02e6afb\u003c/code\u003e\u003c/a\u003e [linter-miner] Add reflect-deepequal-usage linter (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66239\"\u003e#66239\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/7a5aaccea7ee9620214fe4f9f38451f2f9c89512\"\u003e\u003ccode\u003e7a5aacc\u003c/code\u003e\u003c/a\u003e Fix embedded session parser dependencies and post-step CI expectation (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66243\"\u003e#66243\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/9a631f399d77d17a7da4adadaf0760accca2547e\"\u003e\u003ccode\u003e9a631f3\u003c/code\u003e\u003c/a\u003e Fix CI redaction assertion and remove unauthorized CGO coverage upload (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66235\"\u003e#66235\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/ffc93b2f3118eae982d395381bdcd81cf8e1fc67\"\u003e\u003ccode\u003effc93b2\u003c/code\u003e\u003c/a\u003e Add dynamic workflow smoke and opt-in engine defaults (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66195\"\u003e#66195\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/ea26db6a5beb68ae37d97613f3e9c7923d92d515\"\u003e\u003ccode\u003eea26db6\u003c/code\u003e\u003c/a\u003e Add Claude dynamic workflow smoke coverage and unified task events (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66208\"\u003e#66208\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/gh-aw/compare/c35393777e5604a63721d09512263b1383301d4f...382f4b025fefaa7d6b2492c3608f098340bf6536\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml` from 2.6.0 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.7.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate github/codeql-action action to v4.38.0 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/143\"\u003egoogle/osv-scanner-action#143\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate to v2.7.0 by \u003ca href=\"https://github.com/michaelkedar\"\u003e\u003ccode\u003e@​michaelkedar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/146\"\u003egoogle/osv-scanner-action#146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.6.0...v2.7.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.6.0...v2.7.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b1d267aea5211fa648d9d442fa64b90dbdcbdd36\"\u003e\u003ccode\u003eb1d267a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/146\"\u003e#146\u003c/a\u003e from google/update-to-v2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/2b1cfc6d0e3941f549908be1c5671b5d7625ebc0\"\u003e\u003ccode\u003e2b1cfc6\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.7.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/ef6dfdf01765802d5a8dbc3c39852a6128b00af0\"\u003e\u003ccode\u003eef6dfdf\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.7.0 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0a65f82af05cd58cf587827b0bb0489548c18346\"\u003e\u003ccode\u003e0a65f82\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.7.0 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8ac9e5ce44cc7178e0e04229a91bdcc003166e57\"\u003e\u003ccode\u003e8ac9e5c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/143\"\u003e#143\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3b06fbb744e4192b7d47b4f2584715a21ef88b92\"\u003e\u003ccode\u003e3b06fbb\u003c/code\u003e\u003c/a\u003e Update github/codeql-action action to v4.38.0\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/a345acffa64b0eaede81a3d9aae6141214d9c8fc...b1d267aea5211fa648d9d442fa64b90dbdcbdd36\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/intrafind/ihub-apps/pull/2882","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/intrafind%2Fihub-apps/issues/2882","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2882/packages"},{"uuid":"5917920066","node_id":"PR_kwDOR7d3nc8AAAABJQM1hQ","number":9,"state":"open","title":"ci(deps): bump the actions group with 5 updates","user":"dependabot[bot]","labels":["dependencies"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T04:40:54.000Z","updated_at":"2026-10-19T04:41:02.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci(deps): bump","group_name":"actions","update_count":5,"packages":[{"name":"goreleaser/goreleaser-action","old_version":"7.2.3","new_version":"7.3.0","repository_url":"https://github.com/goreleaser/goreleaser-action"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.2","new_version":"4.38.3","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/init","old_version":"4.38.2","new_version":"4.38.3","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.38.2","new_version":"4.38.3","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the actions group with 5 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `7.2.3` | `7.3.0` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |\n\nUpdates `goreleaser/goreleaser-action` from 7.2.3 to 7.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/goreleaser/goreleaser-action/releases\"\u003egoreleaser/goreleaser-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/570\"\u003egoreleaser/goreleaser-action#570\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/571\"\u003egoreleaser/goreleaser-action#571\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/575\"\u003egoreleaser/goreleaser-action#575\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/574\"\u003egoreleaser/goreleaser-action#574\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump undici from 6.27.0 to 6.28.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/576\"\u003egoreleaser/goreleaser-action#576\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump js-yaml from 5.2.2 to 5.2.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/573\"\u003egoreleaser/goreleaser-action#573\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump js-yaml from 5.2.3 to 5.4.1 in the npm group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/578\"\u003egoreleaser/goreleaser-action#578\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: reuse the goreleaser binary from the runner tool cache by \u003ca href=\"https://github.com/caarlos0\"\u003e\u003ccode\u003e@​caarlos0\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/577\"\u003egoreleaser/goreleaser-action#577\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 in the actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/581\"\u003egoreleaser/goreleaser-action#581\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump undici from 6.28.0 to 6.29.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/579\"\u003egoreleaser/goreleaser-action#579\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/580\"\u003egoreleaser/goreleaser-action#580\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/v7.2.3...v7.3.0\"\u003ehttps://github.com/goreleaser/goreleaser-action/compare/v7.2.3...v7.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/a4f02ab5355a589de60d917a659ce617ed19b3de\"\u003e\u003ccode\u003ea4f02ab\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/e27eb7769180b733cf28959f093582ddda91972e\"\u003e\u003ccode\u003ee27eb77\u003c/code\u003e\u003c/a\u003e chore(deps): bump the npm group with 2 updates (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/580\"\u003e#580\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/f5b4e31ee483102e19b17e532f024e8aee22d4fe\"\u003e\u003ccode\u003ef5b4e31\u003c/code\u003e\u003c/a\u003e chore(deps): bump undici from 6.28.0 to 6.29.0 (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/579\"\u003e#579\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/2d42c26fe04ca60644a41f10407c30998bc2f770\"\u003e\u003ccode\u003e2d42c26\u003c/code\u003e\u003c/a\u003e ci(deps): bump codecov/codecov-action (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/581\"\u003e#581\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/73cd4ffe39ceae11aafd47343ff35e8be087f14c\"\u003e\u003ccode\u003e73cd4ff\u003c/code\u003e\u003c/a\u003e feat: reuse the goreleaser binary from the runner tool cache (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/577\"\u003e#577\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/97a960754774e271e3eb4f389fe9b73400f2158c\"\u003e\u003ccode\u003e97a9607\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/689e48f9ac97190a2d170ebe29f3aed1a694464b\"\u003e\u003ccode\u003e689e48f\u003c/code\u003e\u003c/a\u003e chore(deps): bump js-yaml from 5.2.3 to 5.4.1 in the npm group (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/578\"\u003e#578\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/7e6b514c508941c26e8772ba9b920d0677e2160e\"\u003e\u003ccode\u003e7e6b514\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/4ec11830b6b44bb4bef0db5ddd7e04844da5519e\"\u003e\u003ccode\u003e4ec1183\u003c/code\u003e\u003c/a\u003e chore(deps): bump js-yaml from 5.2.2 to 5.2.3 (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/573\"\u003e#573\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/59060fdcfdbbfd4c87d837ab2c489d635c18f843\"\u003e\u003ccode\u003e59060fd\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/f06c13b6b1a9625abc9e6e439d9c05a8f2190e94...a4f02ab5355a589de60d917a659ce617ed19b3de\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003e\u003ccode\u003e24c5418\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4214\"\u003e#4214\u003c/a\u003e from github/update-v4.38.3-e0b52dbdc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8\"\u003e\u003ccode\u003e69e87c5\u003c/code\u003e\u003c/a\u003e Add changelog note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa\"\u003e\u003ccode\u003e23b6828\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b\"\u003e\u003ccode\u003ee0b52db\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4210\"\u003e#4210\u003c/a\u003e from github/henrymercer/pin-python-for-older-clis-in-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc\"\u003e\u003ccode\u003e6b99698\u003c/code\u003e\u003c/a\u003e Pin Python 3.13.15 for older CLI versions in multi-language check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8\"\u003e\u003ccode\u003e63d3d63\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4203\"\u003e#4203\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe\"\u003e\u003ccode\u003e7377a10\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524\"\u003e\u003ccode\u003ec1a30cd\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974\"\u003e\u003ccode\u003ed208ec7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4200\"\u003e#4200\u003c/a\u003e from github/mbg/esm/migrate-pr-checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845\"\u003e\u003ccode\u003ea71b0c6\u003c/code\u003e\u003c/a\u003e Replace \u003ccode\u003e__dirname\u003c/code\u003e in \u003ccode\u003esync.ts\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from 4.38.2 to 4.38.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003e\u003ccode\u003e24c5418\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4214\"\u003e#4214\u003c/a\u003e from github/update-v4.38.3-e0b52dbdc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8\"\u003e\u003ccode\u003e69e87c5\u003c/code\u003e\u003c/a\u003e Add changelog note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa\"\u003e\u003ccode\u003e23b6828\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b\"\u003e\u003ccode\u003ee0b52db\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4210\"\u003e#4210\u003c/a\u003e from github/henrymercer/pin-python-for-older-clis-in-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc\"\u003e\u003ccode\u003e6b99698\u003c/code\u003e\u003c/a\u003e Pin Python 3.13.15 for older CLI versions in multi-language check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8\"\u003e\u003ccode\u003e63d3d63\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4203\"\u003e#4203\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe\"\u003e\u003ccode\u003e7377a10\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524\"\u003e\u003ccode\u003ec1a30cd\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974\"\u003e\u003ccode\u003ed208ec7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4200\"\u003e#4200\u003c/a\u003e from github/mbg/esm/migrate-pr-checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845\"\u003e\u003ccode\u003ea71b0c6\u003c/code\u003e\u003c/a\u003e Replace \u003ccode\u003e__dirname\u003c/code\u003e in \u003ccode\u003esync.ts\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.38.2 to 4.38.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003e\u003ccode\u003e24c5418\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4214\"\u003e#4214\u003c/a\u003e from github/update-v4.38.3-e0b52dbdc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8\"\u003e\u003ccode\u003e69e87c5\u003c/code\u003e\u003c/a\u003e Add changelog note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa\"\u003e\u003ccode\u003e23b6828\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b\"\u003e\u003ccode\u003ee0b52db\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4210\"\u003e#4210\u003c/a\u003e from github/henrymercer/pin-python-for-older-clis-in-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc\"\u003e\u003ccode\u003e6b99698\u003c/code\u003e\u003c/a\u003e Pin Python 3.13.15 for older CLI versions in multi-language check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8\"\u003e\u003ccode\u003e63d3d63\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4203\"\u003e#4203\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe\"\u003e\u003ccode\u003e7377a10\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524\"\u003e\u003ccode\u003ec1a30cd\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974\"\u003e\u003ccode\u003ed208ec7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4200\"\u003e#4200\u003c/a\u003e from github/mbg/esm/migrate-pr-checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845\"\u003e\u003ccode\u003ea71b0c6\u003c/code\u003e\u003c/a\u003e Replace \u003ccode\u003e__dirname\u003c/code\u003e in \u003ccode\u003esync.ts\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/tomkabel/fingerprintproxy/pull/9","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/tomkabel%2Ffingerprintproxy/issues/9","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/9/packages"},{"uuid":"5917785379","node_id":"PR_kwDOPdJtZs8AAAABJQF3bA","number":310,"state":"open","title":"ci(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0","user":"dependabot[bot]","labels":["dependencies"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T04:27:25.000Z","updated_at":"2026-10-19T04:28:10.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci(deps)","packages":[{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ossf/scorecard-action\u0026package-manager=github_actions\u0026previous-version=2.4.4\u0026new-version=2.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/thoser666/Vivid/pull/310","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/thoser666%2FVivid/issues/310","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/310/packages"},{"uuid":"5917411985","node_id":"PR_kwDOUXC9U88AAAABJPyzpA","number":67,"state":"open","title":"chore(deps): bump the github-actions group across 1 directory with 7 updates","user":"dependabot[bot]","labels":["dependencies"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T03:46:21.000Z","updated_at":"2026-10-19T03:51:13.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"github-actions","update_count":7,"packages":[{"name":"MaverickCER/internal-package-contract/.github/workflows/benchmark-pr.yml","old_version":"0.10.0","new_version":"0.11.0","repository_url":"https://github.com/maverickcer/internal-package-contract"},{"name":"actions/setup-node","old_version":"7.0.0","new_version":"7.1.0","repository_url":"https://github.com/actions/setup-node"},{"name":"actions/upload-artifact","old_version":"7.0.1","new_version":"7.0.2","repository_url":"https://github.com/actions/upload-artifact"},{"name":"actions/download-artifact","old_version":"8.0.1","new_version":"8.0.2","repository_url":"https://github.com/actions/download-artifact"},{"name":"MaverickCER/internal-package-contract/.github/workflows/release-npm-changesets.yml","old_version":"0.10.0","new_version":"0.11.0","repository_url":"https://github.com/maverickcer/internal-package-contract"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"MaverickCER/internal-package-contract/.github/workflows/dependency-pin-sync.yml","old_version":"0.10.0","new_version":"0.11.0","repository_url":"https://github.com/maverickcer/internal-package-contract"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 7 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [MaverickCER/internal-package-contract/.github/workflows/benchmark-pr.yml](https://github.com/maverickcer/internal-package-contract) | `0.10.0` | `0.11.0` |\n| [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` |\n| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |\n| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` |\n| [MaverickCER/internal-package-contract/.github/workflows/release-npm-changesets.yml](https://github.com/maverickcer/internal-package-contract) | `0.10.0` | `0.11.0` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [MaverickCER/internal-package-contract/.github/workflows/dependency-pin-sync.yml](https://github.com/maverickcer/internal-package-contract) | `0.10.0` | `0.11.0` |\n\n\nUpdates `MaverickCER/internal-package-contract/.github/workflows/benchmark-pr.yml` from 0.10.0 to 0.11.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/MaverickCER/internal-package-contract/blob/main/CHANGELOG.md\"\u003eMaverickCER/internal-package-contract/.github/workflows/benchmark-pr.yml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003einternal-package-contract\u003c/h1\u003e\n\u003ch2\u003e0.12.0\u003c/h2\u003e\n\u003ch3\u003eMinor Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(adoption): a package that adopts the standard starts in adoption mode, where every failing check is a warning until it is promoted; \u003ccode\u003eadopt\u003c/code\u003e now adds every config, script and template the package lacks\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(skill): \u003ccode\u003eskill [--check]\u003c/code\u003e writes a package's agent skill (\u003ccode\u003eskills/\u0026lt;name\u0026gt;/SKILL.md\u003c/code\u003e within a word budget, and \u003ccode\u003ereferences/api.md\u003c/code\u003e) from \u003ccode\u003epackage.json\u003c/code\u003e, \u003ccode\u003edocs/surface.json\u003c/code\u003e, the API baselines and the few things the author writes in \u003ccode\u003edocs/skill.json\u003c/code\u003e; the optional \u003ccode\u003eAgentSkill\u003c/code\u003e check fails on a stale or invalid skill\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): require every parameter and key of every public function to be benchmarked or accounted for, and measure a second variable on its own (\u003ccode\u003eBenchmarkCoverage\u003c/code\u003e, \u003ccode\u003ecovers\u003c/code\u003e, \u003ccode\u003esweeps\u003c/code\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(contract): build the benchmark page before the checks when the package defines \u003ccode\u003edocs:benchmarks\u003c/code\u003e, so the link check behaves the same locally and in CI\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(report): \u003ccode\u003ereport\u003c/code\u003e writes what a change does to the package as Markdown to paste into a pull request, from git, the changesets, the exception registries, the decision records, the manifest and the contract's last report\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(clean-checkout): the \u003ccode\u003eCleanCheckout\u003c/code\u003e check type-checks only what git tracks (the index, so staged files count), in a temporary copy with this installation's dependencies linked, so a file hidden by \u003ccode\u003e.gitignore\u003c/code\u003e or never added fails on the machine that has it and not only in CI\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: fix(mutation): a mutant that times out is run again alone before it counts, so a stalled machine is not reported as a loop, and the reuse of an earlier run keeps only a run in which every mutant was caught or left out\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(badges): every published figure says what it is. The coverage badge reads \u0026quot;lowest of 4\u0026quot; and \u003ccode\u003ecoverage.json\u003c/code\u003e beside it gives all four measures (lines, statements, functions, branches) with what each counts; the mutation badge says \u0026quot;detected of applicable\u0026quot; and \u003ccode\u003emutation.json\u003c/code\u003e gives the count of each status; the size badge shows the size against its budget, with \u003ccode\u003esize.json\u003c/code\u003e. \u003ccode\u003etool badges\u003c/code\u003e takes \u003ccode\u003e--coverage \u0026lt;file\u0026gt;\u003c/code\u003e and \u003ccode\u003e--no-size\u003c/code\u003e, so a package with its own coverage aggregate uses it instead of keeping a copy of the generator\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): a benchmark run outside CI writes to \u003ccode\u003e.benchmark-local/\u0026lt;suite\u0026gt;/\u003c/code\u003e, which is never committed, and the checks read it in preference to the committed results; only CI's figures are committed and published\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(docs): keep the shared process documents (code of conduct, support, releasing) current in every package, and scaffold them in full\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: Take any check apart and put it back: \u003ccode\u003einternal-package-contract/checks/parts\u003c/code\u003e splits a check into its evidence and its policy (\u003ccode\u003eevidenceOf\u003c/code\u003e, \u003ccode\u003epolicyOf\u003c/code\u003e, \u003ccode\u003ecomposeCheck\u003c/code\u003e, \u003ccode\u003ewithEvidence\u003c/code\u003e, \u003ccode\u003ewithPolicy\u003c/code\u003e, \u003ccode\u003eevidenceOfAll\u003c/code\u003e, \u003ccode\u003epoliciesOfAll\u003c/code\u003e). The evidence scripts (\u003ccode\u003e./scripts/*\u003c/code\u003e) and the shared runtime modules (\u003ccode\u003e./runtime/*\u003c/code\u003e) are now exported directly, and an IPC benchmark suite covers the new exports.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003einternal-package-contract/logs\u003c/code\u003e re-exports repo-contract's \u003ccode\u003eonEvidenceSaveToRepoContractLogs\u003c/code\u003e and \u003ccode\u003eonVerdictPrependRepoContractLogs\u003c/code\u003e (and \u003ccode\u003erepoContractLogs\u003c/code\u003e), so a package that runs its own contract gets the one-log-per-check hooks without installing \u003ccode\u003erepo-contract\u003c/code\u003e. The contract run itself now uses them, and prints a failure as soon as its verdict exists. Needs \u003ccode\u003erepo-contract\u003c/code\u003e 0.11.0 or later.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eenv-cap\u003c/code\u003e and \u003ccode\u003edata-cap\u003c/code\u003e are now dependencies of this package, and every entry point is exported (\u003ccode\u003einternal-package-contract/env-cap\u003c/code\u003e, \u003ccode\u003e/env-cap/build\u003c/code\u003e, \u003ccode\u003e/data-cap\u003c/code\u003e, ...), so a package that uses this one installs neither itself. A new \u003ccode\u003eenv\u003c/code\u003e command documents the credentials and settings a package depends on from \u003ccode\u003eci/env.schema.ts\u003c/code\u003e into \u003ccode\u003edocs/ENVIRONMENT.md\u003c/code\u003e; a new \u003ccode\u003eEnvContract\u003c/code\u003e check warns (never fails) about a credential that is expiring or expired and a document that is out of date; \u003ccode\u003einit\u003c/code\u003e scaffolds the contract, the \u003ccode\u003edocs:env\u003c/code\u003e script and a weekly \u003ccode\u003eenv-rotation.yml\u003c/code\u003e workflow (managed by \u003ccode\u003esync\u003c/code\u003e) that opens one issue when a credential is due; and \u003ccode\u003edoctor\u003c/code\u003e reports it. Nothing in it is required: a package with no contract passes. A missing Socket API key is now a warning in CI as well as locally.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(mutation): \u003ccode\u003emutation [--base \u0026lt;ref\u0026gt;] [file...]\u003c/code\u003e mutation-tests what a change touched, and the source files the changed tests import, as a fast loop while writing: every mutant of those files, never an earlier result, under the package's own concurrency; it is advice, and the full \u003ccode\u003eMutation\u003c/code\u003e check stays the gate\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(mutation): a mutation run over inputs that have not changed in any way is not run again: the evidence of the last clean run for the same hash of every file git does not ignore (and of the Node.js version) is put back for the check to judge, never under CI; \u003ccode\u003eIPC_MUTATION_MEMO=0\u003c/code\u003e runs it regardless\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003eMutation\u003c/code\u003e check also always runs every mutant (\u003ccode\u003e--force\u003c/code\u003e), ignoring any incremental file, so a result carried over from a run made under other conditions can no longer stand in for a cold run.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): remove the per-benchmark regression threshold, and warn when a function's big-O cannot be determined\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(setup): one command to adopt this standard in an existing package or start a new one, with \u003ccode\u003eadopt\u003c/code\u003e, \u003ccode\u003esetup\u003c/code\u003e and a read-only \u003ccode\u003edoctor\u003c/code\u003e that lists what is left\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(tools): run the size, badge, API-report, CommonJS-interop and compiler-isolation helpers from here, add an optional AmbientCapabilities check with \u003ccode\u003eadd check\u003c/code\u003e, and keep more of the files every package shares current\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(env): the standard ships the contract for what it reads from the environment, and \u003ccode\u003eenv\u003c/code\u003e includes it in every package's \u003ccode\u003edocs/ENVIRONMENT.md\u003c/code\u003e; the scaffolded \u003ccode\u003eci/env.schema.ts\u003c/code\u003e no longer repeats it, so the explanation lives in one place and cannot drift\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: fix(git-hygiene): \u003ccode\u003eGitHygiene\u003c/code\u003e fails on an import in tracked source that resolves only to a file git does not track, which is how a \u003ccode\u003e.gitignore\u003c/code\u003e pattern that was too wide hid source from every clean checkout while every local check passed\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(upgrade): \u003ccode\u003eupgrade \u0026lt;tag\u0026gt;\u003c/code\u003e moves a package to a release and updates the pin, workflows, managed files, landing page and benchmark guides in one step\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(verify-consumers): \u003ccode\u003everify-consumers \u0026lt;checkout\u0026gt;...\u003c/code\u003e runs each dependent package's fast offline checks with the standard it has installed and with this one, in throwaway copies, and names every check that got worse; it also says where an install would add its own copy of a package the standard depends on\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePatch Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e49c9641: fix(runtime): recognise a generated file only by a marker that opens a comment, so code or prose that quotes the marker is not taken for one\u003c/li\u003e\n\u003cli\u003e49c9641: fix(tests): tests start without the variables a git hook supplies (the repository, the settings and the author of the commit being checked), so they no longer fail under a hook that passes by hand or run git against the real repository\u003c/li\u003e\n\u003cli\u003e8ac8b1f: The shared \u003ccode\u003eno-node-fs\u003c/code\u003e rule also reports \u003ccode\u003enode:fs\u003c/code\u003e reached through a re-export (\u003ccode\u003eexport ... from\u003c/code\u003e, \u003ccode\u003eexport * from\u003c/code\u003e) or TypeScript's \u003ccode\u003eimport x = require()\u003c/code\u003e, and matches an \u003ccode\u003eallow\u003c/code\u003e pattern written relative to the working directory (\u003ccode\u003esrc/cli/**\u003c/code\u003e) against the absolute path ESLint gives it, on Windows too, and when the working directory is a filesystem root; the matching is the shared \u003ccode\u003eglob\u003c/code\u003e copy's new \u003ccode\u003ematchesAllowList\u003c/code\u003e, so a package's own lint rules can use the same. A benchmark report shows only the first line of a failure's message, with every absolute path in it cut to its file name, so a stack trace and the paths of the machine that ran it stay out of the published page. WRITING-BENCHMARKS.md records the two exceptions suites already use (a per-function \u003ccode\u003etiers\u003c/code\u003e with its \u003ccode\u003etiersReason\u003c/code\u003e, and benchmarking internal source), and the scaffolded and environment-rotation workflows pin the same v7 checkout, setup-node and upload-artifact actions as the rest. This package's own release works again under Changesets 3, which stopped versioning a private package unless \u003ccode\u003eprivatePackages.version\u003c/code\u003e is set: the Version Packages pull request for this release could not be opened without it.\u003c/li\u003e\n\u003cli\u003e49c9641: fix(benchmarks): give each category's package-cost heading its own id, and say in the reading guide that a worse growth class is a third failing gate\u003c/li\u003e\n\u003cli\u003e49c9641: A mistyped command now stops with a suggestion instead of starting the whole contract. \u003ccode\u003eisGeneratedFile\u003c/code\u003e in the shared runtime reads only the first twenty non-empty lines instead of splitting the entire file, so its cost no longer grows with the file; packages pick it up with \u003ccode\u003esync --apply --update\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.11.0\u003c/h2\u003e\n\u003ch3\u003eMinor Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e2410ab9: Bump \u003ccode\u003erepo-contract\u003c/code\u003e to 0.10.0.\u003c/li\u003e\n\u003cli\u003e7291bdd: The \u003ccode\u003etypescript\u003c/code\u003e dependency moves from 5.9 to 6.0. It is the compiler API IPC's own checks load, so consumers resolving it through IPC now get TypeScript 6.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/7240119d1919bcff5520836339ef52f7320004ea\"\u003e\u003ccode\u003e7240119\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/maverickcer/internal-package-contract/issues/72\"\u003e#72\u003c/a\u003e from MaverickCER/changeset-release/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/62b4b36dd398057f574d0dc0e963c11ec1003c06\"\u003e\u003ccode\u003e62b4b36\u003c/code\u003e\u003c/a\u003e chore: version packages\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/7878a47c8b50b40f8a7cc73466558f2656640ab0\"\u003e\u003ccode\u003e7878a47\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/maverickcer/internal-package-contract/issues/70\"\u003e#70\u003c/a\u003e from MaverickCER/stages-0-2-rebuilt\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/8400131d8ea8989b51f6ba2396c854be5aa9e287\"\u003e\u003ccode\u003e8400131\u003c/code\u003e\u003c/a\u003e fix(review): address the open review findings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/aab2b3c34971499d327d293e754c7546f5bb8f30\"\u003e\u003ccode\u003eaab2b3c\u003c/code\u003e\u003c/a\u003e fix(contract): satisfy shellcheck, CRAP, suppression and mutation gates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/9eb86448cf7c30fb376243335ff5225c01614f3c\"\u003e\u003ccode\u003e9eb8644\u003c/code\u003e\u003c/a\u003e test(packed-consumer): start npm through a shell on Windows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/89d7181bf0d7b0c373d944e37236417260d1d1f9\"\u003e\u003ccode\u003e89d7181\u003c/code\u003e\u003c/a\u003e fix(packed-consumer): list the tarball in Node, since external tar breaks on ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/6e53e88b4bb956ea81d79f4725a0dd569a583d67\"\u003e\u003ccode\u003e6e53e88\u003c/code\u003e\u003c/a\u003e feat(release): gate benchmark complexity, packed consumers, managed files and...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/9c8a021bcb93ffcd7be65fd431032471e980d696\"\u003e\u003ccode\u003e9c8a021\u003c/code\u003e\u003c/a\u003e feat(badges): require mutation and Scorecard badges and publish them from sha...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/3eb6ff7ba00cb5b3794356d88f2f2bc00567afd2\"\u003e\u003ccode\u003e3eb6ff7\u003c/code\u003e\u003c/a\u003e feat(readme): add the ReadmeStructure check and an adoption-first scaffold RE...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/maverickcer/internal-package-contract/compare/e13b3de4871e7509cb1969c4067a190e72a8c485...7240119d1919bcff5520836339ef52f7320004ea\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/setup-node` from 7.0.0 to 7.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/setup-node/releases\"\u003eactions/setup-node's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for mise.toml file by \u003ca href=\"https://github.com/gperdomor\"\u003e\u003ccode\u003e@​gperdomor\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1421\"\u003eactions/setup-node#1421\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport absolute paths in node-version-file by \u003ca href=\"https://github.com/v-mahabaleshwars\"\u003e\u003ccode\u003e@​v-mahabaleshwars\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1633\"\u003eactions/setup-node#1633\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug fixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Node version validation and manifest fetch retry by \u003ca href=\"https://github.com/v-jitenderpalsingh\"\u003e\u003ccode\u003e@​v-jitenderpalsingh\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1580\"\u003eactions/setup-node#1580\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation updates:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eREADME.md: bump actions/checkout to latest version 7 by \u003ca href=\"https://github.com/deining\"\u003e\u003ccode\u003e@​deining\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1578\"\u003eactions/setup-node#1578\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by \u003ca href=\"https://github.com/v-gowridurgad\"\u003e\u003ccode\u003e@​v-gowridurgad\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1593\"\u003eactions/setup-node#1593\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed cache recommendation syntax by \u003ca href=\"https://github.com/SubJunk\"\u003e\u003ccode\u003e@​SubJunk\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1603\"\u003eactions/setup-node#1603\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency updates:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate workflow pins and migrate Node matrices to modern versions by \u003ca href=\"https://github.com/v-HarithaVattikuti\"\u003e\u003ccode\u003e@​v-HarithaVattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1583\"\u003eactions/setup-node#1583\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1584\"\u003eactions/setup-node#1584\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin \u003ccode\u003e@​types/node\u003c/code\u003e to v24 by \u003ca href=\"https://github.com/v-priyagupta108\"\u003e\u003ccode\u003e@​v-priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1585\"\u003eactions/setup-node#1585\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOverride brace-expansion to 5.0.8 by \u003ca href=\"https://github.com/v-priyagupta108\"\u003e\u003ccode\u003e@​v-priyagupta108\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1599\"\u003eactions/setup-node#1599\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  actions/checkout from 7.0.0 to 7.0.1 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1598\"\u003eactions/setup-node#1598\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  prettier from 3.8.4 to 3.9.6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1590\"\u003eactions/setup-node#1590\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  \u003ccode\u003e@​vercel/ncc\u003c/code\u003e from 0.44.0 to 0.45.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1610\"\u003eactions/setup-node#1610\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  pnpm/action-setup from 6.0.9 to 6.0.10 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1602\"\u003eactions/setup-node#1602\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  baseline-browser-mapping from 2.10.38 to 2.11.22 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1629\"\u003eactions/setup-node#1629\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​types/semver\u003c/code\u003e from 7.7.1 to 7.8.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1616\"\u003eactions/setup-node#1616\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e from 8.62.0 to 8.70.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1615\"\u003eactions/setup-node#1615\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade pnpm/action-setup from 6.0.10 to 6.1.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1631\"\u003eactions/setup-node#1631\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade jest-each from 30.4.1 to 30.5.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1636\"\u003eactions/setup-node#1636\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade eslint-plugin-n from 18.1.0 to 18.3.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1638\"\u003eactions/setup-node#1638\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependencies and add license files by \u003ca href=\"https://github.com/v-HarithaVattikuti\"\u003e\u003ccode\u003e@​v-HarithaVattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1642\"\u003eactions/setup-node#1642\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1635\"\u003eactions/setup-node#1635\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/v-jitenderpalsingh\"\u003e\u003ccode\u003e@​v-jitenderpalsingh\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1580\"\u003eactions/setup-node#1580\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1584\"\u003eactions/setup-node#1584\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gperdomor\"\u003e\u003ccode\u003e@​gperdomor\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1421\"\u003eactions/setup-node#1421\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SubJunk\"\u003e\u003ccode\u003e@​SubJunk\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1603\"\u003eactions/setup-node#1603\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-node/compare/v7.0.0...v7.1.0\"\u003ehttps://github.com/actions/setup-node/compare/v7.0.0...v7.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/949feb2413d6458794dcd2491c4babbbce0c15c1\"\u003e\u003ccode\u003e949feb2\u003c/code\u003e\u003c/a\u003e Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1635\"\u003e#1635\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/7207c4f1189c7ee83ddf20c7c68bd1af6fdd751c\"\u003e\u003ccode\u003e7207c4f\u003c/code\u003e\u003c/a\u003e chore: update dependencies and add license files (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1642\"\u003e#1642\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/54337e0d02de9202d0948aaff36ad556375497b9\"\u003e\u003ccode\u003e54337e0\u003c/code\u003e\u003c/a\u003e Bump eslint-plugin-n from 18.1.0 to 18.3.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1638\"\u003e#1638\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/fb54fa8c14c63410cc752f0ae3b7b3ca6af161fc\"\u003e\u003ccode\u003efb54fa8\u003c/code\u003e\u003c/a\u003e Bump jest-each from 30.4.1 to 30.5.2 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1636\"\u003e#1636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/7f84f1d52d0c56afb45c62fee31a93b843cea4d6\"\u003e\u003ccode\u003e7f84f1d\u003c/code\u003e\u003c/a\u003e Bump pnpm/action-setup from 6.0.10 to 6.1.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1631\"\u003e#1631\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/0c54c7b07420dcba69a7d832587f55ebdf771c9e\"\u003e\u003ccode\u003e0c54c7b\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e from 8.62.0 to 8.70.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1615\"\u003e#1615\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/a8294190049a9c296f01b9a432aff41dd83d8284\"\u003e\u003ccode\u003ea829419\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​types/semver\u003c/code\u003e from 7.7.1 to 7.8.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1616\"\u003e#1616\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/680d1e489b82f1243de15bc7665c0007e3c9a860\"\u003e\u003ccode\u003e680d1e4\u003c/code\u003e\u003c/a\u003e Support absolute paths in node-version-file (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1633\"\u003e#1633\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/db0fb3a98ed314b69026b6e8c9be26a7e2fe65a8\"\u003e\u003ccode\u003edb0fb3a\u003c/code\u003e\u003c/a\u003e Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1629\"\u003e#1629\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/94196ee1d15439c1b6651cd87ef14e88ec435966\"\u003e\u003ccode\u003e94196ee\u003c/code\u003e\u003c/a\u003e Bump pnpm/action-setup from 6.0.9 to 6.0.10 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1602\"\u003e#1602\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-artifact` from 7.0.1 to 7.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdates \u003ccode\u003e@​actions/artifact\u003c/code\u003e to v6.3.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/821\"\u003eactions/upload-artifact#821\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\"\u003ehttps://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003e\u003ccode\u003ecf430e0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/822\"\u003e#822\u003c/a\u003e from actions/tunc-d-prepare-upload-v7-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469\"\u003e\u003ccode\u003ec2acded\u003c/code\u003e\u003c/a\u003e chore: prepare v7.0.2 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a\"\u003e\u003ccode\u003e4687c1b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/821\"\u003e#821\u003c/a\u003e from actions/tunc-d-upload-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719\"\u003e\u003ccode\u003e8cbe1be\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/download-artifact` from 8.0.1 to 8.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/download-artifact/releases\"\u003eactions/download-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev8.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the readme by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/473\"\u003eactions/download-artifact#473\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare download-artifact v8.0.2 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/493\"\u003eactions/download-artifact#493\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\"\u003ehttps://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003e\u003ccode\u003e9000827\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/493\"\u003e#493\u003c/a\u003e from actions/tunc-d-prepare-download-v8-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/e455989ae00f5bdd4054f05d3e972c6bf8a62dc5\"\u003e\u003ccode\u003ee455989\u003c/code\u003e\u003c/a\u003e Prepare download-artifact v8.0.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/a00b90c4a2f01d73a8c89552caabca6ea3b43137\"\u003e\u003ccode\u003ea00b90c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/492\"\u003e#492\u003c/a\u003e from actions/tunc-d-download-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/29bb7ce6af5345aeab5bb4774ce7249ee3ccc27f\"\u003e\u003ccode\u003e29bb7ce\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/484a0b528fb4d7bd804637ccb632e47a0e638317\"\u003e\u003ccode\u003e484a0b5\u003c/code\u003e\u003c/a\u003e Update the readme (\u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/473\"\u003e#473\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `MaverickCER/internal-package-contract/.github/workflows/release-npm-changesets.yml` from 0.10.0 to 0.11.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/MaverickCER/internal-package-contract/blob/main/CHANGELOG.md\"\u003eMaverickCER/internal-package-contract/.github/workflows/release-npm-changesets.yml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003einternal-package-contract\u003c/h1\u003e\n\u003ch2\u003e0.12.0\u003c/h2\u003e\n\u003ch3\u003eMinor Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(adoption): a package that adopts the standard starts in adoption mode, where every failing check is a warning until it is promoted; \u003ccode\u003eadopt\u003c/code\u003e now adds every config, script and template the package lacks\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(skill): \u003ccode\u003eskill [--check]\u003c/code\u003e writes a package's agent skill (\u003ccode\u003eskills/\u0026lt;name\u0026gt;/SKILL.md\u003c/code\u003e within a word budget, and \u003ccode\u003ereferences/api.md\u003c/code\u003e) from \u003ccode\u003epackage.json\u003c/code\u003e, \u003ccode\u003edocs/surface.json\u003c/code\u003e, the API baselines and the few things the author writes in \u003ccode\u003edocs/skill.json\u003c/code\u003e; the optional \u003ccode\u003eAgentSkill\u003c/code\u003e check fails on a stale or invalid skill\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): require every parameter and key of every public function to be benchmarked or accounted for, and measure a second variable on its own (\u003ccode\u003eBenchmarkCoverage\u003c/code\u003e, \u003ccode\u003ecovers\u003c/code\u003e, \u003ccode\u003esweeps\u003c/code\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(contract): build the benchmark page before the checks when the package defines \u003ccode\u003edocs:benchmarks\u003c/code\u003e, so the link check behaves the same locally and in CI\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(report): \u003ccode\u003ereport\u003c/code\u003e writes what a change does to the package as Markdown to paste into a pull request, from git, the changesets, the exception registries, the decision records, the manifest and the contract's last report\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(clean-checkout): the \u003ccode\u003eCleanCheckout\u003c/code\u003e check type-checks only what git tracks (the index, so staged files count), in a temporary copy with this installation's dependencies linked, so a file hidden by \u003ccode\u003e.gitignore\u003c/code\u003e or never added fails on the machine that has it and not only in CI\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: fix(mutation): a mutant that times out is run again alone before it counts, so a stalled machine is not reported as a loop, and the reuse of an earlier run keeps only a run in which every mutant was caught or left out\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(badges): every published figure says what it is. The coverage badge reads \u0026quot;lowest of 4\u0026quot; and \u003ccode\u003ecoverage.json\u003c/code\u003e beside it gives all four measures (lines, statements, functions, branches) with what each counts; the mutation badge says \u0026quot;detected of applicable\u0026quot; and \u003ccode\u003emutation.json\u003c/code\u003e gives the count of each status; the size badge shows the size against its budget, with \u003ccode\u003esize.json\u003c/code\u003e. \u003ccode\u003etool badges\u003c/code\u003e takes \u003ccode\u003e--coverage \u0026lt;file\u0026gt;\u003c/code\u003e and \u003ccode\u003e--no-size\u003c/code\u003e, so a package with its own coverage aggregate uses it instead of keeping a copy of the generator\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): a benchmark run outside CI writes to \u003ccode\u003e.benchmark-local/\u0026lt;suite\u0026gt;/\u003c/code\u003e, which is never committed, and the checks read it in preference to the committed results; only CI's figures are committed and published\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(docs): keep the shared process documents (code of conduct, support, releasing) current in every package, and scaffold them in full\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: Take any check apart and put it back: \u003ccode\u003einternal-package-contract/checks/parts\u003c/code\u003e splits a check into its evidence and its policy (\u003ccode\u003eevidenceOf\u003c/code\u003e, \u003ccode\u003epolicyOf\u003c/code\u003e, \u003ccode\u003ecomposeCheck\u003c/code\u003e, \u003ccode\u003ewithEvidence\u003c/code\u003e, \u003ccode\u003ewithPolicy\u003c/code\u003e, \u003ccode\u003eevidenceOfAll\u003c/code\u003e, \u003ccode\u003epoliciesOfAll\u003c/code\u003e). The evidence scripts (\u003ccode\u003e./scripts/*\u003c/code\u003e) and the shared runtime modules (\u003ccode\u003e./runtime/*\u003c/code\u003e) are now exported directly, and an IPC benchmark suite covers the new exports.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003einternal-package-contract/logs\u003c/code\u003e re-exports repo-contract's \u003ccode\u003eonEvidenceSaveToRepoContractLogs\u003c/code\u003e and \u003ccode\u003eonVerdictPrependRepoContractLogs\u003c/code\u003e (and \u003ccode\u003erepoContractLogs\u003c/code\u003e), so a package that runs its own contract gets the one-log-per-check hooks without installing \u003ccode\u003erepo-contract\u003c/code\u003e. The contract run itself now uses them, and prints a failure as soon as its verdict exists. Needs \u003ccode\u003erepo-contract\u003c/code\u003e 0.11.0 or later.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eenv-cap\u003c/code\u003e and \u003ccode\u003edata-cap\u003c/code\u003e are now dependencies of this package, and every entry point is exported (\u003ccode\u003einternal-package-contract/env-cap\u003c/code\u003e, \u003ccode\u003e/env-cap/build\u003c/code\u003e, \u003ccode\u003e/data-cap\u003c/code\u003e, ...), so a package that uses this one installs neither itself. A new \u003ccode\u003eenv\u003c/code\u003e command documents the credentials and settings a package depends on from \u003ccode\u003eci/env.schema.ts\u003c/code\u003e into \u003ccode\u003edocs/ENVIRONMENT.md\u003c/code\u003e; a new \u003ccode\u003eEnvContract\u003c/code\u003e check warns (never fails) about a credential that is expiring or expired and a document that is out of date; \u003ccode\u003einit\u003c/code\u003e scaffolds the contract, the \u003ccode\u003edocs:env\u003c/code\u003e script and a weekly \u003ccode\u003eenv-rotation.yml\u003c/code\u003e workflow (managed by \u003ccode\u003esync\u003c/code\u003e) that opens one issue when a credential is due; and \u003ccode\u003edoctor\u003c/code\u003e reports it. Nothing in it is required: a package with no contract passes. A missing Socket API key is now a warning in CI as well as locally.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(mutation): \u003ccode\u003emutation [--base \u0026lt;ref\u0026gt;] [file...]\u003c/code\u003e mutation-tests what a change touched, and the source files the changed tests import, as a fast loop while writing: every mutant of those files, never an earlier result, under the package's own concurrency; it is advice, and the full \u003ccode\u003eMutation\u003c/code\u003e check stays the gate\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(mutation): a mutation run over inputs that have not changed in any way is not run again: the evidence of the last clean run for the same hash of every file git does not ignore (and of the Node.js version) is put back for the check to judge, never under CI; \u003ccode\u003eIPC_MUTATION_MEMO=0\u003c/code\u003e runs it regardless\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003eMutation\u003c/code\u003e check also always runs every mutant (\u003ccode\u003e--force\u003c/code\u003e), ignoring any incremental file, so a result carried over from a run made under other conditions can no longer stand in for a cold run.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): remove the per-benchmark regression threshold, and warn when a function's big-O cannot be determined\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(setup): one command to adopt this standard in an existing package or start a new one, with \u003ccode\u003eadopt\u003c/code\u003e, \u003ccode\u003esetup\u003c/code\u003e and a read-only \u003ccode\u003edoctor\u003c/code\u003e that lists what is left\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(tools): run the size, badge, API-report, CommonJS-interop and compiler-isolation helpers from here, add an optional AmbientCapabilities check with \u003ccode\u003eadd check\u003c/code\u003e, and keep more of the files every package shares current\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(env): the standard ships the contract for what it reads from the environment, and \u003ccode\u003eenv\u003c/code\u003e includes it in every package's \u003ccode\u003edocs/ENVIRONMENT.md\u003c/code\u003e; the scaffolded \u003ccode\u003eci/env.schema.ts\u003c/code\u003e no longer repeats it, so the explanation lives in one place and cannot drift\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: fix(git-hygiene): \u003ccode\u003eGitHygiene\u003c/code\u003e fails on an import in tracked source that resolves only to a file git does not track, which is how a \u003ccode\u003e.gitignore\u003c/code\u003e pattern that was too wide hid source from every clean checkout while every local check passed\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(upgrade): \u003ccode\u003eupgrade \u0026lt;tag\u0026gt;\u003c/code\u003e moves a package to a release and updates the pin, workflows, managed files, landing page and benchmark guides in one step\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(verify-consumers): \u003ccode\u003everify-consumers \u0026lt;checkout\u0026gt;...\u003c/code\u003e runs each dependent package's fast offline checks with the standard it has installed and with this one, in throwaway copies, and names every check that got worse; it also says where an install would add its own copy of a package the standard depends on\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePatch Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e49c9641: fix(runtime): recognise a generated file only by a marker that opens a comment, so code or prose that quotes the marker is not taken for one\u003c/li\u003e\n\u003cli\u003e49c9641: fix(tests): tests start without the variables a git hook supplies (the repository, the settings and the author of the commit being checked), so they no longer fail under a hook that passes by hand or run git against the real repository\u003c/li\u003e\n\u003cli\u003e8ac8b1f: The shared \u003ccode\u003eno-node-fs\u003c/code\u003e rule also reports \u003ccode\u003enode:fs\u003c/code\u003e reached through a re-export (\u003ccode\u003eexport ... from\u003c/code\u003e, \u003ccode\u003eexport * from\u003c/code\u003e) or TypeScript's \u003ccode\u003eimport x = require()\u003c/code\u003e, and matches an \u003ccode\u003eallow\u003c/code\u003e pattern written relative to the working directory (\u003ccode\u003esrc/cli/**\u003c/code\u003e) against the absolute path ESLint gives it, on Windows too, and when the working directory is a filesystem root; the matching is the shared \u003ccode\u003eglob\u003c/code\u003e copy's new \u003ccode\u003ematchesAllowList\u003c/code\u003e, so a package's own lint rules can use the same. A benchmark report shows only the first line of a failure's message, with every absolute path in it cut to its file name, so a stack trace and the paths of the machine that ran it stay out of the published page. WRITING-BENCHMARKS.md records the two exceptions suites already use (a per-function \u003ccode\u003etiers\u003c/code\u003e with its \u003ccode\u003etiersReason\u003c/code\u003e, and benchmarking internal source), and the scaffolded and environment-rotation workflows pin the same v7 checkout, setup-node and upload-artifact actions as the rest. This package's own release works again under Changesets 3, which stopped versioning a private package unless \u003ccode\u003eprivatePackages.version\u003c/code\u003e is set: the Version Packages pull request for this release could not be opened without it.\u003c/li\u003e\n\u003cli\u003e49c9641: fix(benchmarks): give each category's package-cost heading its own id, and say in the reading guide that a worse growth class is a third failing gate\u003c/li\u003e\n\u003cli\u003e49c9641: A mistyped command now stops with a suggestion instead of starting the whole contract. \u003ccode\u003eisGeneratedFile\u003c/code\u003e in the shared runtime reads only the first twenty non-empty lines instead of splitting the entire file, so its cost no longer grows with the file; packages pick it up with \u003ccode\u003esync --apply --update\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.11.0\u003c/h2\u003e\n\u003ch3\u003eMinor Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e2410ab9: Bump \u003ccode\u003erepo-contract\u003c/code\u003e to 0.10.0.\u003c/li\u003e\n\u003cli\u003e7291bdd: The \u003ccode\u003etypescript\u003c/code\u003e dependency moves from 5.9 to 6.0. It is the compiler API IPC's own checks load, so consumers resolving it through IPC now get TypeScript 6.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/7240119d1919bcff5520836339ef52f7320004ea\"\u003e\u003ccode\u003e7240119\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/maverickcer/internal-package-contract/issues/72\"\u003e#72\u003c/a\u003e from MaverickCER/changeset-release/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/62b4b36dd398057f574d0dc0e963c11ec1003c06\"\u003e\u003ccode\u003e62b4b36\u003c/code\u003e\u003c/a\u003e chore: version packages\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/7878a47c8b50b40f8a7cc73466558f2656640ab0\"\u003e\u003ccode\u003e7878a47\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/maverickcer/internal-package-contract/issues/70\"\u003e#70\u003c/a\u003e from MaverickCER/stages-0-2-rebuilt\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/8400131d8ea8989b51f6ba2396c854be5aa9e287\"\u003e\u003ccode\u003e8400131\u003c/code\u003e\u003c/a\u003e fix(review): address the open review findings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/aab2b3c34971499d327d293e754c7546f5bb8f30\"\u003e\u003ccode\u003eaab2b3c\u003c/code\u003e\u003c/a\u003e fix(contract): satisfy shellcheck, CRAP, suppression and mutation gates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/9eb86448cf7c30fb376243335ff5225c01614f3c\"\u003e\u003ccode\u003e9eb8644\u003c/code\u003e\u003c/a\u003e test(packed-consumer): start npm through a shell on Windows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/89d7181bf0d7b0c373d944e37236417260d1d1f9\"\u003e\u003ccode\u003e89d7181\u003c/code\u003e\u003c/a\u003e fix(packed-consumer): list the tarball in Node, since external tar breaks on ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/6e53e88b4bb956ea81d79f4725a0dd569a583d67\"\u003e\u003ccode\u003e6e53e88\u003c/code\u003e\u003c/a\u003e feat(release): gate benchmark complexity, packed consumers, managed files and...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/9c8a021bcb93ffcd7be65fd431032471e980d696\"\u003e\u003ccode\u003e9c8a021\u003c/code\u003e\u003c/a\u003e feat(badges): require mutation and Scorecard badges and publish them from sha...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/3eb6ff7ba00cb5b3794356d88f2f2bc00567afd2\"\u003e\u003ccode\u003e3eb6ff7\u003c/code\u003e\u003c/a\u003e feat(readme): add the ReadmeStructure check and an adoption-first scaffold RE...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/maverickcer/internal-package-contract/compare/e13b3de4871e7509cb1969c4067a190e72a8c485...7240119d1919bcff5520836339ef52f7320004ea\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `MaverickCER/internal-package-contract/.github/workflows/dependency-pin-sync.yml` from 0.10.0 to 0.11.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/MaverickCER/internal-package-contract/blob/main/CHANGELOG.md\"\u003eMaverickCER/internal-package-contract/.github/workflows/dependency-pin-sync.yml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003einternal-package-contract\u003c/h1\u003e\n\u003ch2\u003e0.12.0\u003c/h2\u003e\n\u003ch3\u003eMinor Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(adoption): a package that adopts the standard starts in adoption mode, where every failing check is a warning until it is promoted; \u003ccode\u003eadopt\u003c/code\u003e now adds every config, script and template the package lacks\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(skill): \u003ccode\u003eskill [--check]\u003c/code\u003e writes a package's agent skill (\u003ccode\u003eskills/\u0026lt;name\u0026gt;/SKILL.md\u003c/code\u003e within a word budget, and \u003ccode\u003ereferences/api.md\u003c/code\u003e) from \u003ccode\u003epackage.json\u003c/code\u003e, \u003ccode\u003edocs/surface.json\u003c/code\u003e, the API baselines and the few things the author writes in \u003ccode\u003edocs/skill.json\u003c/code\u003e; the optional \u003ccode\u003eAgentSkill\u003c/code\u003e check fails on a stale or invalid skill\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): require every parameter and key of every public function to be benchmarked or accounted for, and measure a second variable on its own (\u003ccode\u003eBenchmarkCoverage\u003c/code\u003e, \u003ccode\u003ecovers\u003c/code\u003e, \u003ccode\u003esweeps\u003c/code\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(contract): build the benchmark page before the checks when the package defines \u003ccode\u003edocs:benchmarks\u003c/code\u003e, so the link check behaves the same locally and in CI\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(report): \u003ccode\u003ereport\u003c/code\u003e writes what a change does to the package as Markdown to paste into a pull request, from git, the changesets, the exception registries, the decision records, the manifest and the contract's last report\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(clean-checkout): the \u003ccode\u003eCleanCheckout\u003c/code\u003e check type-checks only what git tracks (the index, so staged files count), in a temporary copy with this installation's dependencies linked, so a file hidden by \u003ccode\u003e.gitignore\u003c/code\u003e or never added fails on the machine that has it and not only in CI\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: fix(mutation): a mutant that times out is run again alone before it counts, so a stalled machine is not reported as a loop, and the reuse of an earlier run keeps only a run in which every mutant was caught or left out\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(badges): every published figure says what it is. The coverage badge reads \u0026quot;lowest of 4\u0026quot; and \u003ccode\u003ecoverage.json\u003c/code\u003e beside it gives all four measures (lines, statements, functions, branches) with what each counts; the mutation badge says \u0026quot;detected of applicable\u0026quot; and \u003ccode\u003emutation.json\u003c/code\u003e gives the count of each status; the size badge shows the size against its budget, with \u003ccode\u003esize.json\u003c/code\u003e. \u003ccode\u003etool badges\u003c/code\u003e takes \u003ccode\u003e--coverage \u0026lt;file\u0026gt;\u003c/code\u003e and \u003ccode\u003e--no-size\u003c/code\u003e, so a package with its own coverage aggregate uses it instead of keeping a copy of the generator\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): a benchmark run outside CI writes to \u003ccode\u003e.benchmark-local/\u0026lt;suite\u0026gt;/\u003c/code\u003e, which is never committed, and the checks read it in preference to the committed results; only CI's figures are committed and published\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(docs): keep the shared process documents (code of conduct, support, releasing) current in every package, and scaffold them in full\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: Take any check apart and put it back: \u003ccode\u003einternal-package-contract/checks/parts\u003c/code\u003e splits a check into its evidence and its policy (\u003ccode\u003eevidenceOf\u003c/code\u003e, \u003ccode\u003epolicyOf\u003c/code\u003e, \u003ccode\u003ecomposeCheck\u003c/code\u003e, \u003ccode\u003ewithEvidence\u003c/code\u003e, \u003ccode\u003ewithPolicy\u003c/code\u003e, \u003ccode\u003eevidenceOfAll\u003c/code\u003e, \u003ccode\u003epoliciesOfAll\u003c/code\u003e). The evidence scripts (\u003ccode\u003e./scripts/*\u003c/code\u003e) and the shared runtime modules (\u003ccode\u003e./runtime/*\u003c/code\u003e) are now exported directly, and an IPC benchmark suite covers the new exports.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003einternal-package-contract/logs\u003c/code\u003e re-exports repo-contract's \u003ccode\u003eonEvidenceSaveToRepoContractLogs\u003c/code\u003e and \u003ccode\u003eonVerdictPrependRepoContractLogs\u003c/code\u003e (and \u003ccode\u003erepoContractLogs\u003c/code\u003e), so a package that runs its own contract gets the one-log-per-check hooks without installing \u003ccode\u003erepo-contract\u003c/code\u003e. The contract run itself now uses them, and prints a failure as soon as its verdict exists. Needs \u003ccode\u003erepo-contract\u003c/code\u003e 0.11.0 or later.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eenv-cap\u003c/code\u003e and \u003ccode\u003edata-cap\u003c/code\u003e are now dependencies of this package, and every entry point is exported (\u003ccode\u003einternal-package-contract/env-cap\u003c/code\u003e, \u003ccode\u003e/env-cap/build\u003c/code\u003e, \u003ccode\u003e/data-cap\u003c/code\u003e, ...), so a package that uses this one installs neither itself. A new \u003ccode\u003eenv\u003c/code\u003e command documents the credentials and settings a package depends on from \u003ccode\u003eci/env.schema.ts\u003c/code\u003e into \u003ccode\u003edocs/ENVIRONMENT.md\u003c/code\u003e; a new \u003ccode\u003eEnvContract\u003c/code\u003e check warns (never fails) about a credential that is expiring or expired and a document that is out of date; \u003ccode\u003einit\u003c/code\u003e scaffolds the contract, the \u003ccode\u003edocs:env\u003c/code\u003e script and a weekly \u003ccode\u003eenv-rotation.yml\u003c/code\u003e workflow (managed by \u003ccode\u003esync\u003c/code\u003e) that opens one issue when a credential is due; and \u003ccode\u003edoctor\u003c/code\u003e reports it. Nothing in it is required: a package with no contract passes. A missing Socket API key is now a warning in CI as well as locally.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(mutation): \u003ccode\u003emutation [--base \u0026lt;ref\u0026gt;] [file...]\u003c/code\u003e mutation-tests what a change touched, and the source files the changed tests import, as a fast loop while writing: every mutant of those files, never an earlier result, under the package's own concurrency; it is advice, and the full \u003ccode\u003eMutation\u003c/code\u003e check stays the gate\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(mutation): a mutation run over inputs that have not changed in any way is not run again: the evidence of the last clean run for the same hash of every file git does not ignore (and of the Node.js version) is put back for the check to judge, never under CI; \u003ccode\u003eIPC_MUTATION_MEMO=0\u003c/code\u003e runs it regardless\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003eMutation\u003c/code\u003e check also always runs every mutant (\u003ccode\u003e--force\u003c/code\u003e), ignoring any incremental file, so a result carried over from a run made under other conditions can no longer stand in for a cold run.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): remove the per-benchmark regression threshold, and warn when a function's big-O cannot be determined\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(setup): one command to adopt this standard in an existing package or start a new one, with \u003ccode\u003eadopt\u003c/code\u003e, \u003ccode\u003esetup\u003c/code\u003e and a read-only \u003ccode\u003edoctor\u003c/code\u003e that lists what is left\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(tools): run the size, badge, API-report, CommonJS-interop and compiler-isolation helpers from here, add an optional AmbientCapabilities check with \u003ccode\u003eadd check\u003c/code\u003e, and keep more of the files every package shares current\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(env): the standard ships the contract for what it reads from the environment, and \u003ccode\u003eenv\u003c/code\u003e includes it in every package's \u003ccode\u003edocs/ENVIRONMENT.md\u003c/code\u003e; the scaffolded \u003ccode\u003eci/env.schema.ts\u003c/code\u003e no longer repeats it, so the explanation lives in one place and cannot drift\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: fix(git-hygiene): \u003ccode\u003eGitHygiene\u003c/code\u003e fails on an import in tracked source that resolves only to a file git does not track, which is how a \u003ccode\u003e.gitignore\u003c/code\u003e pattern that was too wide hid source from every clean checkout while every local check passed\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(upgrade): \u003ccode\u003eupgrade \u0026lt;tag\u0026gt;\u003c/code\u003e moves a package to a release and updates the pin, workflows, managed files, landing page and benchmark guides in one step\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(verify-consumers): \u003ccode\u003everify-consumers \u0026lt;checkout\u0026gt;...\u003c/code\u003e runs each dependent package's fast offline checks with the standard it has installed and with this one, in throwaway copies, and names every check that got worse; it also says where an install would add its own copy of a package the standard depends on\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePatch Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e49c9641: fix(runtime): recognise a generated file only by a marker that opens a comment, so code or prose that quotes the marker is not taken for one\u003c/li\u003e\n\u003cli\u003e49c9641: fix(tests): tests start without the variables a git hook supplies (the repository, the settings and the author of the commit being checked), so they no longer fail under a hook that passes by hand or run git against the real repository\u003c/li\u003e\n\u003cli\u003e8ac8b1f: The shared \u003ccode\u003eno-node-fs\u003c/code\u003e rule also reports \u003ccode\u003enode:fs\u003c/code\u003e reached through a re-export (\u003ccode\u003eexport ... from\u003c/code\u003e, \u003ccode\u003eexport * from\u003c/code\u003e) or TypeScript's \u003ccode\u003eimport x = require()\u003c/code\u003e, and matches an \u003ccode\u003eallow\u003c/code\u003e pattern written relative to the working directory (\u003ccode\u003esrc/cli/**\u003c/code\u003e) against the absolute path ESLint gives it, on Windows too, and when the working directory is a filesystem root; the matching is the shared \u003ccode\u003eglob\u003c/code\u003e copy's new \u003ccode\u003ematchesAllowList\u003c/code\u003e, so a package's own lint rules can use the same. A benchmark report shows only the first line of a failure's message, with every absolute path in it cut to its file name, so a stack trace and the paths of the machine that ran it stay out of the published page. WRITING-BENCHMARKS.md records the two exceptions suites already use (a per-function \u003ccode\u003etiers\u003c/code\u003e with its \u003ccode\u003etiersReason\u003c/code\u003e, and benchmarking internal source), and the scaffolded and environment-rotation workflows pin the same v7 checkout, setup-node and upload-artifact actions as the rest. This package's own release works again under Changesets 3, which stopped versioning a private package unless \u003ccode\u003eprivatePackages.version\u003c/code\u003e is set: the Version Packages pull request for this release could not be opened without it.\u003c/li\u003e\n\u003cli\u003e49c9641: fix(benchmarks): give each category's package-cost heading its own id, and say in the reading guide that a worse growth class is a third failing gate\u003c/li\u003e\n\u003cli\u003e49c9641: A mistyped command now stops with a suggestion instead of starting the whole contract. \u003ccode\u003eisGeneratedFile\u003c/code\u003e in the shared runtime reads only the first twenty non-empty lines instead of splitting the entire file, so its cost no longer grows with the file; packages pick it up with \u003ccode\u003esync --apply --update\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.11.0\u003c/h2\u003e\n\u003ch3\u003eMinor Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e2410ab9: Bump \u003ccode\u003erepo-contract\u003c/code\u003e to 0.10.0.\u003c/li\u003e\n\u003cli\u003e7291bdd: The \u003ccode\u003etypescript\u003c/code\u003e dependency moves from 5.9 to 6.0. It is the compiler API IPC's own checks load, so consumers resolving it through IPC now get TypeScript 6.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/7240119d1919bcff5520836339ef52f7320004ea\"\u003e\u003ccode\u003e7240119\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/maverickcer/internal-package-contract/issues/72\"\u003e#72\u003c/a\u003e from MaverickCER/changeset-release/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/62b4b36dd398057f574d0dc0e963c11ec1003c06\"\u003e\u003ccode\u003e62b4b36\u003c/code\u003e\u003c/a\u003e chore: version packages\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/7878a47c8b50b40f8a7cc73466558f2656640ab0\"\u003e\u003ccode\u003e7878a47\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/maverickcer/internal-package-contract/issues/70\"\u003e#70\u003c/a\u003e from MaverickCER/stages-0-2-rebuilt\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/8400131d8ea8989b51f6ba2396c854be5aa9e287\"\u003e\u003ccode\u003e8400131\u003c/code\u003e\u003c/a\u003e fix(review): address the open review findings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/aab2b3c34971499d327d293e754c7546f5bb8f30\"\u003e\u003ccode\u003eaab2b3c\u003c/code\u003e\u003c/a\u003e fix(contract): satisfy shellcheck, CRAP, suppression and mutation gates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/9eb86448cf7c30fb376243335ff5225c01614f3c\"\u003e\u003ccode\u003e9eb8644\u003c/code\u003e\u003c/a\u003e test(packed-consumer): start npm through a shell on Windows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/89d7181bf0d7b0c373d944e37236417260d1d1f9\"\u003e\u003ccode\u003e89d7181\u003c/code\u003e\u003c/a\u003e fix(packed-consumer): list the tarball in Node, since external tar breaks on ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/6e53e88b4bb956ea81d79f4725a0dd569a583d67\"\u003e\u003ccode\u003e6e53e88\u003c/code\u003e\u003c/a\u003e feat(release): gate benchmark complexity, packed consumers, managed files and...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/9c8a021bcb93ffcd7be65fd431032471e980d696\"\u003e\u003ccode\u003e9c8a021\u003c/code\u003e\u003c/a\u003e feat(badges): require mutation and Scorecard badges and publish them from sha...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/3eb6ff7ba00cb5b3794356d88f2f2bc00567afd2\"\u003e\u003ccode\u003e3eb6ff7\u003c/code\u003e\u003c/a\u003e feat(readme): add the ReadmeStructure check and an adoption-first scaffold RE...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/maverickcer/internal-package-contract/compare/e13b3de4871e7509cb1969c4067a190e72a8c485...7240119d1919bcff5520836339ef52f7320004ea\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/MaverickCER/env-cap/pull/67","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/MaverickCER%2Fenv-cap/issues/67","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/67/packages"},{"uuid":"5917372984","node_id":"PR_kwDOTwfI388AAAABJPw2Qg","number":299,"state":"open","title":"👷 ci(deps): Bump the github-actions-minor-patch group with 9 updates","user":"dependabot[bot]","labels":["ci","dependencies"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T03:41:47.000Z","updated_at":"2026-10-19T03:42:07.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"👷 ci(deps): Bump","group_name":"github-actions-minor-patch","update_count":9,"packages":[{"name":"step-security/harden-runner","old_version":"2.22.0","new_version":"2.22.1","repository_url":"https://github.com/step-security/harden-runner"},{"name":"astral-sh/setup-uv","old_version":"10.2.0","new_version":"10.3.0","repository_url":"https://github.com/astral-sh/setup-uv"},{"name":"actions/upload-artifact","old_version":"7.0.1","new_version":"7.0.2","repository_url":"https://github.com/actions/upload-artifact"},{"name":"actions/download-artifact","old_version":"8.0.1","new_version":"8.0.2","repository_url":"https://github.com/actions/download-artifact"},{"name":"github/codeql-action/init","old_version":"4.38.2","new_version":"4.38.3","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/autobuild","old_version":"4.38.2","new_version":"4.38.3","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.38.2","new_version":"4.38.3","repository_url":"https://github.com/github/codeql-action"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.2","new_version":"4.38.3","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions-minor-patch group with 9 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.22.0` | `2.22.1` |\n| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.2.0` | `10.3.0` |\n| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |\n| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |\n| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |\n\nUpdates `step-security/harden-runner` from 2.22.0 to 2.22.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/step-security/harden-runner/releases\"\u003estep-security/harden-runner's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.22.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed security rules not initializing on GHES self-hosted runners\u003c/li\u003e\n\u003cli\u003eFixed GHES connectivity in block mode by implicitly allowing the GHES hostname\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.22.0...v2.22.1\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.22.0...v2.22.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ccd8616d44fd3846e67624a50d5aad6d37bf2d25\"\u003e\u003ccode\u003eccd8616\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/704\"\u003e#704\u003c/a\u003e from h0x0er/jatin/ghes-endp\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/037ccfd0b8acd0743d7ce4b3e53f67dc16f831b9\"\u003e\u003ccode\u003e037ccfd\u003c/code\u003e\u003c/a\u003e implicitly add ghes endpoint in allowList\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/e7438c7b4d9fde75004beb1805ca407c067d5340\"\u003e\u003ccode\u003ee7438c7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/703\"\u003e#703\u003c/a\u003e from h0x0er/jatin/ghes-codebuild-fixes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/afb0b33c8978810916155d52997450fe76eea40a\"\u003e\u003ccode\u003eafb0b33\u003c/code\u003e\u003c/a\u003e fixes for armour rules not getting initialised\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/step-security/harden-runner/compare/351661ca32ac09a36dc5ee2d536e3128f2a3c8ed...ccd8616d44fd3846e67624a50d5aad6d37bf2d25\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `astral-sh/setup-uv` from 10.2.0 to 10.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/astral-sh/setup-uv/releases\"\u003eastral-sh/setup-uv's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev10.3.0 🌈 Add Python architecture selection\u003c/h2\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cp\u003eThis release adds the \u003ccode\u003epython-arch\u003c/code\u003e input to select a Python architecture independently of the Python version. With \u003ccode\u003euv\u003c/code\u003e 0.13.0 or later, set \u003ccode\u003epython-arch: x86_64\u003c/code\u003e to use x64 Python on Windows ARM64 runners.\u003c/p\u003e\n\u003cp\u003eIt also includes embedded checksums for \u003ccode\u003euv\u003c/code\u003e releases through 0.13.0.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUse macOS 15 runners for tests \u003ca href=\"https://github.com/charliermarsh\"\u003e\u003ccode\u003e@​charliermarsh\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1081\"\u003e#1081\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🚀 Enhancements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003epython-arch\u003c/code\u003e support \u003ca href=\"https://github.com/zanieb\"\u003e\u003ccode\u003e@​zanieb\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1079\"\u003e#1079\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🧰 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore: update known checksums for 0.13.0 @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1089\"\u003e#1089\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.24 @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1084\"\u003e#1084\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.23 @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1082\"\u003e#1082\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.22 @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1080\"\u003e#1080\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.21 @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1078\"\u003e#1078\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.20 @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1076\"\u003e#1076\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.19 @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1068\"\u003e#1068\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.18 @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1065\"\u003e#1065\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⬆️ Dependency updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 @\u003ca href=\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1077\"\u003e#1077\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/1c37ad07a6a961277cf70c0d37d6f313000f5884\"\u003e\u003ccode\u003e1c37ad0\u003c/code\u003e\u003c/a\u003e chore: update known checksums for 0.13.0 (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1089\"\u003e#1089\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/b3c9b5fc56ebc90760c43b1ac9552c0d1705d3ca\"\u003e\u003ccode\u003eb3c9b5f\u003c/code\u003e\u003c/a\u003e chore: update known checksums for 0.12.24 (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1084\"\u003e#1084\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/b06acff4b6a41bdd9cdac56507ead0bd7734e757\"\u003e\u003ccode\u003eb06acff\u003c/code\u003e\u003c/a\u003e Add \u003ccode\u003epython-arch\u003c/code\u003e support (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1079\"\u003e#1079\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/c84232ca4fde9b022e20a930bfbbecd386b56fdf\"\u003e\u003ccode\u003ec84232c\u003c/code\u003e\u003c/a\u003e chore: update known checksums for 0.12.23 (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1082\"\u003e#1082\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/51fdd265d38a27ffcbca0da885510bc6fcc0ff55\"\u003e\u003ccode\u003e51fdd26\u003c/code\u003e\u003c/a\u003e Use macOS 15 runners for tests (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1081\"\u003e#1081\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/a96208bed1fb5efb8da349c9bcc6cc58af9e7d74\"\u003e\u003ccode\u003ea96208b\u003c/code\u003e\u003c/a\u003e chore: update known checksums for 0.12.22 (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1080\"\u003e#1080\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/0e3884b860e20d3f4d5daa2347130beb51ccde47\"\u003e\u003ccode\u003e0e3884b\u003c/code\u003e\u003c/a\u003e chore: update known checksums for 0.12.21 (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1078\"\u003e#1078\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/bcf05803b55ef01a5ec6368521ee1b42f97bc438\"\u003e\u003ccode\u003ebcf0580\u003c/code\u003e\u003c/a\u003e chore: update known checksums for 0.12.20 (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1076\"\u003e#1076\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/b92a892142bde7280cd163c2abff341413314f9f\"\u003e\u003ccode\u003eb92a892\u003c/code\u003e\u003c/a\u003e chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1077\"\u003e#1077\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/227a0f6bea25cde3444f52decccf4a18de6635f4\"\u003e\u003ccode\u003e227a0f6\u003c/code\u003e\u003c/a\u003e chore: update known checksums for 0.12.19 (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1068\"\u003e#1068\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/astral-sh/setup-uv/compare/c18668ad3cf93ea998bef934396af7bb5c839dc7...1c37ad07a6a961277cf70c0d37d6f313000f5884\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-artifact` from 7.0.1 to 7.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdates \u003ccode\u003e@​actions/artifact\u003c/code\u003e to v6.3.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/821\"\u003eactions/upload-artifact#821\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\"\u003ehttps://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003e\u003ccode\u003ecf430e0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/822\"\u003e#822\u003c/a\u003e from actions/tunc-d-prepare-upload-v7-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469\"\u003e\u003ccode\u003ec2acded\u003c/code\u003e\u003c/a\u003e chore: prepare v7.0.2 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a\"\u003e\u003ccode\u003e4687c1b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/821\"\u003e#821\u003c/a\u003e from actions/tunc-d-upload-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719\"\u003e\u003ccode\u003e8cbe1be\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/download-artifact` from 8.0.1 to 8.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/download-artifact/releases\"\u003eactions/download-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev8.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the readme by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/473\"\u003eactions/download-artifact#473\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare download-artifact v8.0.2 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/493\"\u003eactions/download-artifact#493\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\"\u003ehttps://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003e\u003ccode\u003e9000827\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/493\"\u003e#493\u003c/a\u003e from actions/tunc-d-prepare-download-v8-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/e455989ae00f5bdd4054f05d3e972c6bf8a62dc5\"\u003e\u003ccode\u003ee455989\u003c/code\u003e\u003c/a\u003e Prepare download-artifact v8.0.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/a00b90c4a2f01d73a8c89552caabca6ea3b43137\"\u003e\u003ccode\u003ea00b90c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/492\"\u003e#492\u003c/a\u003e from actions/tunc-d-download-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/29bb7ce6af5345aeab5bb4774ce7249ee3ccc27f\"\u003e\u003ccode\u003e29bb7ce\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/484a0b528fb4d7bd804637ccb632e47a0e638317\"\u003e\u003ccode\u003e484a0b5\u003c/code\u003e\u003c/a\u003e Update the readme (\u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/473\"\u003e#473\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from 4.38.2 to 4.38.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003e\u003ccode\u003e24c5418\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4214\"\u003e#4214\u003c/a\u003e from github/update-v4.38.3-e0b52dbdc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8\"\u003e\u003ccode\u003e69e87c5\u003c/code\u003e\u003c/a\u003e Add changelog note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa\"\u003e\u003ccode\u003e23b6828\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b\"\u003e\u003ccode\u003ee0b52db\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4210\"\u003e#4210\u003c/a\u003e from github/henrymercer/pin-python-for-older-clis-in-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc\"\u003e\u003ccode\u003e6b99698\u003c/code\u003e\u003c/a\u003e Pin Python 3.13.15 for older CLI versions in multi-language check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8\"\u003e\u003ccode\u003e63d3d63\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4203\"\u003e#4203\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe\"\u003e\u003ccode\u003e7377a10\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524\"\u003e\u003ccode\u003ec1a30cd\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974\"\u003e\u003ccode\u003ed208ec7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4200\"\u003e#4200\u003c/a\u003e from github/mbg/esm/migrate-pr-checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845\"\u003e\u003ccode\u003ea71b0c6\u003c/code\u003e\u003c/a\u003e Replace \u003ccode\u003e__dirname\u003c/code\u003e in \u003ccode\u003esync.ts\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/autobuild` from 4.38.2 to 4.38.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/autobuild's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/autobuild's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003e\u003ccode\u003e24c5418\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4214\"\u003e#4214\u003c/a\u003e from github/update-v4.38.3-e0b52dbdc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8\"\u003e\u003ccode\u003e69e87c5\u003c/code\u003e\u003c/a\u003e Add changelog note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa\"\u003e\u003ccode\u003e23b6828\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b\"\u003e\u003ccode\u003ee0b52db\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4210\"\u003e#4210\u003c/a\u003e from github/henrymercer/pin-python-for-older-clis-in-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc\"\u003e\u003ccode\u003e6b99698\u003c/code\u003e\u003c/a\u003e Pin Python 3.13.15 for older CLI versions in multi-language check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8\"\u003e\u003ccode\u003e63d3d63\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4203\"\u003e#4203\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe\"\u003e\u003ccode\u003e7377a10\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524\"\u003e\u003ccode\u003ec1a30cd\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974\"\u003e\u003ccode\u003ed208ec7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4200\"\u003e#4200\u003c/a\u003e from github/mbg/esm/migrate-pr-checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845\"\u003e\u003ccode\u003ea71b0c6\u003c/code\u003e\u003c/a\u003e Replace \u003ccode\u003e__dirname\u003c/code\u003e in \u003ccode\u003esync.ts\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.38.2 to 4.38.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003e\u003ccode\u003e24c5418\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4214\"\u003e#4214\u003c/a\u003e from github/update-v4.38.3-e0b52dbdc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8\"\u003e\u003ccode\u003e69e87c5\u003c/code\u003e\u003c/a\u003e Add changelog note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa\"\u003e\u003ccode\u003e23b6828\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b\"\u003e\u003ccode\u003ee0b52db\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4210\"\u003e#4210\u003c/a\u003e from github/henrymercer/pin-python-for-older-clis-in-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc\"\u003e\u003ccode\u003e6b99698\u003c/code\u003e\u003c/a\u003e Pin Python 3.13.15 for older CLI versions in multi-language check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8\"\u003e\u003ccode\u003e63d3d63\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4203\"\u003e#4203\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe\"\u003e\u003ccode\u003e7377a10\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524\"\u003e\u003ccode\u003ec1a30cd\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974\"\u003e\u003ccode\u003ed208ec7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4200\"\u003e#4200\u003c/a\u003e from github/mbg/esm/migrate-pr-checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845\"\u003e\u003ccode\u003ea71b0c6\u003c/code\u003e\u003c/a\u003e Replace \u003ccode\u003e__dirname\u003c/code\u003e in \u003ccode\u003esync.ts\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003e\u003ccode\u003e24c5418\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4214\"\u003e#4214\u003c/a\u003e from github/update-v4.38.3-e0b52dbdc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8\"\u003e\u003ccode\u003e69e87c5\u003c/code\u003e\u003c/a\u003e Add changelog note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa\"\u003e\u003ccode\u003e23b6828\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b\"\u003e\u003ccode\u003ee0b52db\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4210\"\u003e#4210\u003c/a\u003e from github/henrymercer/pin-python-for-older-clis-in-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc\"\u003e\u003ccode\u003e6b99698\u003c/code\u003e\u003c/a\u003e Pin Python 3.13.15 for older CLI versions in multi-language check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8\"\u003e\u003ccode\u003e63d3d63\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4203\"\u003e#4203\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe\"\u003e\u003ccode\u003e7377a10\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524\"\u003e\u003ccode\u003ec1a30cd\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974\"\u003e\u003ccode\u003ed208ec7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4200\"\u003e#4200\u003c/a\u003e from github/mbg/esm/migrate-pr-checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845\"\u003e\u003ccode\u003ea71b0c6\u003c/code\u003e\u003c/a\u003e Replace \u003ccode\u003e__dirname\u003c/code\u003e in \u003ccode\u003esync.ts\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e\n\n\u003c!-- This is an auto-generated description by cubic. --\u003e\n---\n## Summary by cubic\nBumps nine GitHub Actions across all workflows to their latest patch or minor releases.\n\n**Dependencies**\n- `astral-sh/setup-uv` v10.3.0 adds a `python-arch` input; no workflow changes needed since nothing uses it.\n- `ossf/scorecard-action` v2.5.0 moves to Scorecard v5.6.0.\n- `actions/upload-artifact` and `actions/download-artifact` add retries on HTTP 429 rate limiting.\n- `github/codeql-action` v4.38.3 updates the default bundle and warns that CodeQL ≤ 2.21.2 will soon be unsupported.\n- `step-security/harden-runner` v2.22.1 fixes GHES self-hosted runner setup.\n\n\u003csup\u003eWritten for commit 6159840c40a9d4564c53931cf4d72db5ac07c059. Summary will update on new commits.\u003c/sup\u003e\n\n\u003ca href=\"https://cubic.dev/pr/morzecrew/bloomery/pull/299?utm_source=github\" target=\"_blank\" rel=\"noopener noreferrer\" data-no-image-dialog=\"true\"\u003e\u003cpicture\u003e\u003csource media=\"(prefers-color-scheme: dark)\" srcset=\"https://www.cubic.dev/buttons/review-in-cubic-dark.svg\"\u003e\u003csource media=\"(prefers-color-scheme: light)\" srcset=\"https://www.cubic.dev/buttons/review-in-cubic-light.svg\"\u003e\u003cimg alt=\"View guided diff\" src=\"https://www.cubic.dev/buttons/review-in-cubic-light.svg\"\u003e\u003c/picture\u003e\u003c/a\u003e \u003ca href=\"https://www.cubic.dev/action/auto-fix/pr/morzecrew/bloomery/299?returnTo=https%3A%2F%2Fgithub.com%2Fmorzecrew%2Fbloomery%2Fpull%2F299\u0026source=description\" target=\"_blank\" rel=\"noopener noreferrer\" data-no-image-dialog=\"true\"\u003e\u003cpicture\u003e\u003csource media=\"(prefers-color-scheme: dark)\" srcset=\"https://www.cubic.dev/buttons/turn-on-auto-fix-dark.svg\"\u003e\u003csource media=\"(prefers-color-scheme: light)\" srcset=\"https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg\"\u003e\u003cimg alt=\"Turn on auto-fix\" src=\"https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg\"\u003e\u003c/picture\u003e\u003c/a\u003e\n\n\u003c!-- End of auto-generated description by cubic. --\u003e\n\n","html_url":"https://github.com/morzecrew/bloomery/pull/299","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/morzecrew%2Fbloomery/issues/299","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/299/packages"},{"uuid":"5917246373","node_id":"PR_kwDOBzS60s8AAAABJPqg4w","number":30285,"state":"open","title":"chore(deps): bump the github-actions group with 9 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T03:26:32.000Z","updated_at":"2026-10-19T03:27:01.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"github-actions","update_count":9,"packages":[{"name":"actions/create-github-app-token","old_version":"3.2.0","new_version":"3.3.0","repository_url":"https://github.com/actions/create-github-app-token"},{"name":"actions/download-artifact","old_version":"8.0.1","new_version":"8.0.2","repository_url":"https://github.com/actions/download-artifact"},{"name":"github/codeql-action/init","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/autobuild","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"goreleaser/goreleaser-action","old_version":"7.2.3","new_version":"7.3.0","repository_url":"https://github.com/goreleaser/goreleaser-action"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"zizmorcore/zizmor-action","old_version":"0.6.4","new_version":"0.7.1","repository_url":"https://github.com/zizmorcore/zizmor-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 9 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.2.0` | `3.3.0` |\n| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `7.2.3` | `7.3.0` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.6.4` | `0.7.1` |\n\nUpdates `actions/create-github-app-token` from 3.2.0 to 3.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/create-github-app-token/releases\"\u003eactions/create-github-app-token's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.3.0\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/compare/v3.2.0...v3.3.0\"\u003e3.3.0\u003c/a\u003e (2026-10-12)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eupdate permission inputs (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/399\"\u003e#399\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/a47236f79f79fcbc3532af49fe3a5ded89529b6e\"\u003ea47236f\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003edeps:\u003c/strong\u003e bump nested undici from 6.24.0 to 6.29.0 (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/403\"\u003e#403\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/12461a3a794e67c032f1eff5bb95ece9427eb4fb\"\u003e12461a3\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003edeps:\u003c/strong\u003e bump the production-dependencies group across 1 directory with 3 updates (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/395\"\u003e#395\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/a69c19ddfdf8e1ab093900e0064524ce9309c807\"\u003ea69c19d\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md\"\u003eactions/create-github-app-token's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/compare/v3.2.0...v3.3.0\"\u003e3.3.0\u003c/a\u003e (2026-10-12)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eupdate permission inputs (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/399\"\u003e#399\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/a47236f79f79fcbc3532af49fe3a5ded89529b6e\"\u003ea47236f\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003edeps:\u003c/strong\u003e bump nested undici from 6.24.0 to 6.29.0 (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/403\"\u003e#403\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/12461a3a794e67c032f1eff5bb95ece9427eb4fb\"\u003e12461a3\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003edeps:\u003c/strong\u003e bump the production-dependencies group across 1 directory with 3 updates (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/395\"\u003e#395\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/a69c19ddfdf8e1ab093900e0064524ce9309c807\"\u003ea69c19d\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/compare/v3.1.1...v3.2.0\"\u003e3.2.0\u003c/a\u003e (2026-05-12)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eadd support for enterprise-level GitHub Apps (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/263\"\u003e#263\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/952a2a7073df6bfa5f49bc469ec895b6ec1acea4\"\u003e952a2a7\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003esupport full repository names in \u003ccode\u003erepositories\u003c/code\u003e input (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/372\"\u003e#372\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/85eb8dd41472213aed25d1a126460e0069138ab6\"\u003e85eb8dd\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003edeps:\u003c/strong\u003e bump \u003ccode\u003e@​actions/core\u003c/code\u003e from 3.0.0 to 3.0.1 in the production-dependencies group (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/364\"\u003e#364\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/43e5c345bfd4d4f3ecea019ad0042001a09dd857\"\u003e43e5c34\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003evalidate private-key input (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/376\"\u003e#376\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/f24bbd89643991c0de27ae823c01791b2c6bafdd\"\u003ef24bbd8\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/64ab729a6294000f5aa4a4bc0b73d1f32bc45510\"\u003e\u003ccode\u003e64ab729\u003c/code\u003e\u003c/a\u003e chore(main): release 3.3.0 (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/402\"\u003e#402\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/f3a828e4b91180d3a46ac1f4b43fa8384b0dea07\"\u003e\u003ccode\u003ef3a828e\u003c/code\u003e\u003c/a\u003e ci: create signed dist commits in release workflow (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/404\"\u003e#404\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/655017ffa7c6b0c6e4210729fa6bce35cacd8ca0\"\u003e\u003ccode\u003e655017f\u003c/code\u003e\u003c/a\u003e docs: clarify when owner grants access to all repositories (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/378\"\u003e#378\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/12461a3a794e67c032f1eff5bb95ece9427eb4fb\"\u003e\u003ccode\u003e12461a3\u003c/code\u003e\u003c/a\u003e fix(deps): bump nested undici from 6.24.0 to 6.29.0 (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/403\"\u003e#403\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/a47236f79f79fcbc3532af49fe3a5ded89529b6e\"\u003e\u003ccode\u003ea47236f\u003c/code\u003e\u003c/a\u003e feat: update permission inputs (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/399\"\u003e#399\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/a69c19ddfdf8e1ab093900e0064524ce9309c807\"\u003e\u003ccode\u003ea69c19d\u003c/code\u003e\u003c/a\u003e fix(deps): bump the production-dependencies group across 1 directory with 3 u...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/d5cb7ae41d64331820d88810a4878e0942ec992a\"\u003e\u003ccode\u003ed5cb7ae\u003c/code\u003e\u003c/a\u003e build(deps): bump actions/checkout from 6 to 7 (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/384\"\u003e#384\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/575da866bd0a42d7f234a8645831d55573252b09\"\u003e\u003ccode\u003e575da86\u003c/code\u003e\u003c/a\u003e build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/e85f677b44da0d1f08115ce52cdfd8fd2c69874a\"\u003e\u003ccode\u003ee85f677\u003c/code\u003e\u003c/a\u003e test: omit stack traces from snapshots (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/401\"\u003e#401\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/9419396df4d5672241cfb593dadc19758e54a204\"\u003e\u003ccode\u003e9419396\u003c/code\u003e\u003c/a\u003e build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/400\"\u003e#400\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/create-github-app-token/compare/bcd2ba49218906704ab6c1aa796996da409d3eb1...64ab729a6294000f5aa4a4bc0b73d1f32bc45510\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/download-artifact` from 8.0.1 to 8.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/download-artifact/releases\"\u003eactions/download-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev8.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the readme by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/473\"\u003eactions/download-artifact#473\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare download-artifact v8.0.2 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/493\"\u003eactions/download-artifact#493\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\"\u003ehttps://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003e\u003ccode\u003e9000827\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/493\"\u003e#493\u003c/a\u003e from actions/tunc-d-prepare-download-v8-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/e455989ae00f5bdd4054f05d3e972c6bf8a62dc5\"\u003e\u003ccode\u003ee455989\u003c/code\u003e\u003c/a\u003e Prepare download-artifact v8.0.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/a00b90c4a2f01d73a8c89552caabca6ea3b43137\"\u003e\u003ccode\u003ea00b90c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/492\"\u003e#492\u003c/a\u003e from actions/tunc-d-download-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/29bb7ce6af5345aeab5bb4774ce7249ee3ccc27f\"\u003e\u003ccode\u003e29bb7ce\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/484a0b528fb4d7bd804637ccb632e47a0e638317\"\u003e\u003ccode\u003e484a0b5\u003c/code\u003e\u003c/a\u003e Update the readme (\u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/473\"\u003e#473\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/download-artifact/compare/v8.0.1...9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/autobuild` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/autobuild's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/autobuild's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `goreleaser/goreleaser-action` from 7.2.3 to 7.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/goreleaser/goreleaser-action/releases\"\u003egoreleaser/goreleaser-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/570\"\u003egoreleaser/goreleaser-action#570\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/571\"\u003egoreleaser/goreleaser-action#571\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/575\"\u003egoreleaser/goreleaser-action#575\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/574\"\u003egoreleaser/goreleaser-action#574\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump undici from 6.27.0 to 6.28.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/576\"\u003egoreleaser/goreleaser-action#576\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump js-yaml from 5.2.2 to 5.2.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/573\"\u003egoreleaser/goreleaser-action#573\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump js-yaml from 5.2.3 to 5.4.1 in the npm group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/578\"\u003egoreleaser/goreleaser-action#578\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: reuse the goreleaser binary from the runner tool cache by \u003ca href=\"https://github.com/caarlos0\"\u003e\u003ccode\u003e@​caarlos0\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/577\"\u003egoreleaser/goreleaser-action#577\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 in the actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/581\"\u003egoreleaser/goreleaser-action#581\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump undici from 6.28.0 to 6.29.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/579\"\u003egoreleaser/goreleaser-action#579\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/580\"\u003egoreleaser/goreleaser-action#580\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/v7.2.3...v7.3.0\"\u003ehttps://github.com/goreleaser/goreleaser-action/compare/v7.2.3...v7.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/a4f02ab5355a589de60d917a659ce617ed19b3de\"\u003e\u003ccode\u003ea4f02ab\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/e27eb7769180b733cf28959f093582ddda91972e\"\u003e\u003ccode\u003ee27eb77\u003c/code\u003e\u003c/a\u003e chore(deps): bump the npm group with 2 updates (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/580\"\u003e#580\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/f5b4e31ee483102e19b17e532f024e8aee22d4fe\"\u003e\u003ccode\u003ef5b4e31\u003c/code\u003e\u003c/a\u003e chore(deps): bump undici from 6.28.0 to 6.29.0 (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/579\"\u003e#579\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/2d42c26fe04ca60644a41f10407c30998bc2f770\"\u003e\u003ccode\u003e2d42c26\u003c/code\u003e\u003c/a\u003e ci(deps): bump codecov/codecov-action (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/581\"\u003e#581\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/73cd4ffe39ceae11aafd47343ff35e8be087f14c\"\u003e\u003ccode\u003e73cd4ff\u003c/code\u003e\u003c/a\u003e feat: reuse the goreleaser binary from the runner tool cache (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/577\"\u003e#577\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/97a960754774e271e3eb4f389fe9b73400f2158c\"\u003e\u003ccode\u003e97a9607\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/689e48f9ac97190a2d170ebe29f3aed1a694464b\"\u003e\u003ccode\u003e689e48f\u003c/code\u003e\u003c/a\u003e chore(deps): bump js-yaml from 5.2.3 to 5.4.1 in the npm group (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/578\"\u003e#578\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/7e6b514c508941c26e8772ba9b920d0677e2160e\"\u003e\u003ccode\u003e7e6b514\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/4ec11830b6b44bb4bef0db5ddd7e04844da5519e\"\u003e\u003ccode\u003e4ec1183\u003c/code\u003e\u003c/a\u003e chore(deps): bump js-yaml from 5.2.2 to 5.2.3 (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/573\"\u003e#573\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/59060fdcfdbbfd4c87d837ab2c489d635c18f843\"\u003e\u003ccode\u003e59060fd\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/f06c13b6b1a9625abc9e6e439d9c05a8f2190e94...a4f02ab5355a589de60d917a659ce617ed19b3de\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `zizmorcore/zizmor-action` from 0.6.4 to 0.7.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/zizmorcore/zizmor-action/releases\"\u003ezizmorcore/zizmor-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.7.1\u003c/h2\u003e\n\u003ch1\u003ezizmor changes\u003c/h1\u003e\n\u003ch2\u003eBug Fixes 🐛🔗\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eaction changes\u003c/h1\u003e\n\u003cp\u003eThe default version of zizmor is now 1.31.1.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSync zizmor versions by \u003ca href=\"https://github.com/github-actions\"\u003e\u003ccode\u003e@​github-actions\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zizmorcore/zizmor-action/pull/178\"\u003ezizmorcore/zizmor-action#178\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/zizmorcore/zizmor-action/compare/v0.7.0...v0.7.1\"\u003ehttps://github.com/zizmorcore/zizmor-action/compare/v0.7.0...v0.7.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev0.7.0\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/sponsors/woodruffw/\"\u003eSponsorship is appreciated!\u003c/a\u003e\u003c/p\u003e\n\u003ch1\u003ezizmor notes\u003c/h1\u003e\n\u003ch2\u003eEnhancements 🌱\u003ca href=\"https://docs.zizmor.sh/release-notes/#enhancements\"\u003e🔗\u003c/a\u003e\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe \u003ca href=\"https://docs.zizmor.sh/audits/#typosquat-uses\"\u003etyposquat-uses\u003c/a\u003e audit now supports pre-commit config inputs (\u003ca href=\"https://redirect.github.com/zizmorcore/zizmor...\n\n_Description has been truncated_","html_url":"https://github.com/argoproj/argo-cd/pull/30285","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/argoproj%2Fargo-cd/issues/30285","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/30285/packages"},{"uuid":"5917110992","node_id":"PR_kwDOPgHq288AAAABJPjn9w","number":149,"state":"open","title":"ci(deps): bump the actions group with 6 updates","user":"dependabot[bot]","labels":["dependencies","github-actions"],"assignees":[],"locked":false,"comments_count":4,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T03:11:22.000Z","updated_at":"2026-10-19T03:16:28.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci(deps): bump","group_name":"actions","update_count":6,"packages":[{"name":"dtolnay/rust-toolchain","old_version":"e2a55d2ffb04f378e9626c28d38b36d230d1e12f","new_version":"683b588c487a69d01f6c6ddf40f036ff682cc2c8","repository_url":"https://github.com/dtolnay/rust-toolchain"},{"name":"taiki-e/install-action","old_version":"2.87.27","new_version":"2.87.29","repository_url":"https://github.com/taiki-e/install-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/init","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the actions group with 6 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) | `e2a55d2ffb04f378e9626c28d38b36d230d1e12f` | `683b588c487a69d01f6c6ddf40f036ff682cc2c8` |\n| [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.87.27` | `2.87.29` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n\nUpdates `dtolnay/rust-toolchain` from e2a55d2ffb04f378e9626c28d38b36d230d1e12f to 683b588c487a69d01f6c6ddf40f036ff682cc2c8\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dtolnay/rust-toolchain/commit/683b588c487a69d01f6c6ddf40f036ff682cc2c8\"\u003e\u003ccode\u003e683b588\u003c/code\u003e\u003c/a\u003e Add 1.99.1 patch release\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/dtolnay/rust-toolchain/compare/e2a55d2ffb04f378e9626c28d38b36d230d1e12f...683b588c487a69d01f6c6ddf40f036ff682cc2c8\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `taiki-e/install-action` from 2.87.27 to 2.87.29\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/taiki-e/install-action/releases\"\u003etaiki-e/install-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.87.29\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ezizmor@latest\u003c/code\u003e to 1.31.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasmtime@latest\u003c/code\u003e to 49.0.3.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasm-tools@latest\u003c/code\u003e to 1.262.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.13.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etrivy@latest\u003c/code\u003e to 0.76.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etombi@latest\u003c/code\u003e to 1.8.4.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003erelease-plz@latest\u003c/code\u003e to 0.3.172.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003eosv-scanner@latest\u003c/code\u003e to 2.7.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.10.11.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emdbook-d2@latest\u003c/code\u003e to 0.3.9.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ekingfisher@latest\u003c/code\u003e to 2.13.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ekache@latest\u003c/code\u003e to 1.2.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ejust@latest\u003c/code\u003e to 1.59.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003edprint@latest\u003c/code\u003e to 0.63.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-crap@latest\u003c/code\u003e to 0.8.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ebpf-linker@latest\u003c/code\u003e to 0.12.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.87.28\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003edprint@latest\u003c/code\u003e to 0.62.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003evacuum@latest\u003c/code\u003e to 0.33.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.13.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etombi@latest\u003c/code\u003e to 1.8.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003erelease-plz@latest\u003c/code\u003e to 0.3.171.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003erclone@latest\u003c/code\u003e to 1.75.2.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.10.7.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-binstall@latest\u003c/code\u003e to 1.25.3.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md\"\u003etaiki-e/install-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cp\u003eAll notable changes to this project will be documented in this file.\u003c/p\u003e\n\u003cp\u003eThis project adheres to \u003ca href=\"https://semver.org\"\u003eSemantic Versioning\u003c/a\u003e.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e[Unreleased]\u003c/h2\u003e\n\u003ch2\u003e[2.87.29] - 2026-10-16\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ezizmor@latest\u003c/code\u003e to 1.31.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasmtime@latest\u003c/code\u003e to 49.0.3.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasm-tools@latest\u003c/code\u003e to 1.262.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.13.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etrivy@latest\u003c/code\u003e to 0.76.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etombi@latest\u003c/code\u003e to 1.8.4.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003erelease-plz@latest\u003c/code\u003e to 0.3.172.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003eosv-scanner@latest\u003c/code\u003e to 2.7.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.10.11.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emdbook-d2@latest\u003c/code\u003e to 0.3.9.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ekingfisher@latest\u003c/code\u003e to 2.13.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ekache@latest\u003c/code\u003e to 1.2.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ejust@latest\u003c/code\u003e to 1.59.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003edprint@latest\u003c/code\u003e to 0.63.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-crap@latest\u003c/code\u003e to 0.8.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ebpf-linker@latest\u003c/code\u003e to 0.12.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[2.87.28] - 2026-10-12\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003edprint@latest\u003c/code\u003e to 0.62.0.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/8cca0918f8471c33515202b73f56ab27f2bed283\"\u003e\u003ccode\u003e8cca091\u003c/code\u003e\u003c/a\u003e Release 2.87.29\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/fc26824601b40bd3b26712c48942016e2b2d12f6\"\u003e\u003ccode\u003efc26824\u003c/code\u003e\u003c/a\u003e Update wasmtime manifest\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/5018b2ebebbb2657068e91071ea73d9a53a44f2d\"\u003e\u003ccode\u003e5018b2e\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003ezizmor@latest\u003c/code\u003e to 1.31.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/d0e52041f440d731eae552c575c81c4cccd601c8\"\u003e\u003ccode\u003ed0e5204\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003ewasmtime@latest\u003c/code\u003e to 49.0.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/517774f2ae949bb5d89258edba4466e75f1a33be\"\u003e\u003ccode\u003e517774f\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003ewasm-tools@latest\u003c/code\u003e to 1.262.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/4bc69b1c8214eb6efb50b217dfb04ae04d8af1f5\"\u003e\u003ccode\u003e4bc69b1\u003c/code\u003e\u003c/a\u003e Update vacuum manifest\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/0470a3f16345a16a36a8b4b51fd72f0de5cc6b5b\"\u003e\u003ccode\u003e0470a3f\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003euv@latest\u003c/code\u003e to 0.13.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/7a2b747eb5f89f888d956c73464777912a182a35\"\u003e\u003ccode\u003e7a2b747\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003etrivy@latest\u003c/code\u003e to 0.76.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/7efb5337f67975eb612c46a52d9c7790a5829f97\"\u003e\u003ccode\u003e7efb533\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003etombi@latest\u003c/code\u003e to 1.8.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/e5d37d6fd4d56d59f3bdc428d4138afa60276954\"\u003e\u003ccode\u003ee5d37d6\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003erelease-plz@latest\u003c/code\u003e to 0.3.172\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/taiki-e/install-action/compare/ab6895351a88b908e96a4697860d4ffea5e57dbe...8cca0918f8471c33515202b73f56ab27f2bed283\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/ThreatFlux/openai_rust_sdk/pull/149","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/ThreatFlux%2Fopenai_rust_sdk/issues/149","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/149/packages"},{"uuid":"5917052533","node_id":"PR_kwDOPX_v8s8AAAABJPgqCQ","number":267,"state":"open","title":"chore(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T03:04:40.000Z","updated_at":"2026-10-19T03:05:56.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps)","packages":[{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ossf/scorecard-action\u0026package-manager=github_actions\u0026previous-version=2.4.4\u0026new-version=2.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/macalinao/grill/pull/267","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/macalinao%2Fgrill/issues/267","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/267/packages"}],"issue_packages":[{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-23T06:27:33.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5993069573","node_id":"PR_kwDOPBmB5s8AAAABKMJpLw","number":2091,"state":"open","title":"ci(deps): bump the github-actions group across 1 directory with 7 updates","user":"dependabot[bot]","labels":["dependencies"],"assignees":["KaifAhmad1"],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-23T06:27:33.000Z","updated_at":"2026-10-23T06:29:55.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci(deps): bump","group_name":"github-actions","update_count":7,"packages":[{"name":"github/codeql-action/init","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/autobuild","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"pypa/gh-action-pypi-publish","old_version":"1.14.2","new_version":"1.14.3","repository_url":"https://github.com/pypa/gh-action-pypi-publish"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"actions/download-artifact","old_version":"8.0.1","new_version":"8.0.2","repository_url":"https://github.com/actions/download-artifact"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 7 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.2` | `1.14.3` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` |\n\n\nUpdates `github/codeql-action/init` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.1 - 21 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/autobuild` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/autobuild's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/autobuild's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.1 - 21 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.1 - 21 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.1 - 21 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pypa/gh-action-pypi-publish` from 1.14.2 to 1.14.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/releases\"\u003epypa/gh-action-pypi-publish's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.14.3\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!important]\n🚨 This release includes fixes for \u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-5xjx-3w67-w9x9\"\u003eGHSA-5xjx-3w67-w9x9\u003c/a\u003e patched up by \u003ca href=\"https://github.com/sethmlarson\"\u003e\u003ccode\u003e@​sethmlarson\u003c/code\u003e\u003c/a\u003e\u003ca href=\"https://github.com/sponsors/sethmlarson\"\u003e💰\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pypa/gh-action-pypi-publish/issues/427\"\u003e#427\u003c/a\u003e and in other places across the ecosystem.\u003c/p\u003e\n\u003cp\u003eAdditional ecosystem and related mitigations beyond you might want to watch out for:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576\"\u003ehttps://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://emudhra.we-have-a-problem.com\"\u003ehttps://emudhra.we-have-a-problem.com\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003ch2\u003e🛠️ Security Tightening\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/webknjaz\"\u003e\u003ccode\u003e@​webknjaz\u003c/code\u003e\u003c/a\u003e\u003ca href=\"https://github.com/sponsors/webknjaz\"\u003e💰\u003c/a\u003e made sure the dependency tree within the action runtime uses hash-checking from now on via \u003ca href=\"https://redirect.github.com/pypa/gh-action-pypi-publish/pull/420\"\u003epypa/gh-action-pypi-publish#420\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e🪞 Full Diff\u003c/strong\u003e: \u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.2...v1.14.3\"\u003ehttps://github.com/pypa/gh-action-pypi-publish/compare/v1.14.2...v1.14.3\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e🧔‍♂️ Release Manager:\u003c/strong\u003e \u003ca href=\"https://github.com/sponsors/webknjaz\"\u003e\u003ccode\u003e@​webknjaz\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://stand-with-ukraine.pp.ua\"\u003e🇺🇦\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e💬 Discuss\u003c/strong\u003e \u003ca href=\"https://bsky.app/profile/webknjaz.me/post/3mydcjweyak2f\"\u003eon Bluesky 🦋\u003c/a\u003e, \u003ca href=\"https://mastodon.social/@webknjaz/117474743338290807\"\u003eon Mastodon 🐘\u003c/a\u003e and \u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/discussions/429\"\u003eon GitHub\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/sponsors/webknjaz\"\u003e\u003cimg src=\"https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors\u0026amp;logoColor=%23EA4AAA\u0026amp;label=Sponsor\u0026amp;color=2a313c\" alt=\"GH Sponsors badge\" /\u003e\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/commit/7245906fb61fa33a13554f9d5fb856fe61758086\"\u003e\u003ccode\u003e7245906\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pypa/gh-action-pypi-publish/issues/427\"\u003e#427\u003c/a\u003e from sethmlarson/certifi-sigstore\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/commit/331eccb0e13a5c1124ed9f414a079ef2bef1095f\"\u003e\u003ccode\u003e331eccb\u003c/code\u003e\u003c/a\u003e Upgrade certifi and sigstore\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/commit/f68fee44f9faa979857cda34894b750df5f571ca\"\u003e\u003ccode\u003ef68fee4\u003c/code\u003e\u003c/a\u003e 💰 Sync the FUNDING config\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/commit/c0d6f8e4af2ad8247a7da213b199ea78dac8395e\"\u003e\u003ccode\u003ec0d6f8e\u003c/code\u003e\u003c/a\u003e Merge branch 'integrity/runtime/deptree' into unstable/v1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/commit/909009990f9cf7e7c6a64e602638cf9e91af47f8\"\u003e\u003ccode\u003e9090099\u003c/code\u003e\u003c/a\u003e 🧪 Make smoke test deps hash-pinned in CI\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/commit/34e40c24acd7b4a9150956d646c8c7ba667a14f3\"\u003e\u003ccode\u003e34e40c2\u003c/code\u003e\u003c/a\u003e 📌 Bump pip-tools managed transitive deptrees\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/commit/e800ed547ac29cbc9324311809e2f36fe82148f9\"\u003e\u003ccode\u003ee800ed5\u003c/code\u003e\u003c/a\u003e 👷 Enable hash-checking in the runtime deptree 🔗\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/commit/dd8c5f4f1f65ddf01533969008446145facc7b02\"\u003e\u003ccode\u003edd8c5f4\u003c/code\u003e\u003c/a\u003e 🔧 Make pip-tools config available in container\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/pypa/gh-action-pypi-publish/compare/dc37677b2e1c63e2034f94d8a5b11f265b73ba33...7245906fb61fa33a13554f9d5fb856fe61758086\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/download-artifact` from 8.0.1 to 8.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/download-artifact/releases\"\u003eactions/download-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev8.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the readme by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/473\"\u003eactions/download-artifact#473\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare download-artifact v8.0.2 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/493\"\u003eactions/download-artifact#493\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\"\u003ehttps://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003e\u003ccode\u003e9000827\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/493\"\u003e#493\u003c/a\u003e from actions/tunc-d-prepare-download-v8-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/e455989ae00f5bdd4054f05d3e972c6bf8a62dc5\"\u003e\u003ccode\u003ee455989\u003c/code\u003e\u003c/a\u003e Prepare download-artifact v8.0.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/a00b90c4a2f01d73a8c89552caabca6ea3b43137\"\u003e\u003ccode\u003ea00b90c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/492\"\u003e#492\u003c/a\u003e from actions/tunc-d-download-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/29bb7ce6af5345aeab5bb4774ce7249ee3ccc27f\"\u003e\u003ccode\u003e29bb7ce\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/484a0b528fb4d7bd804637ccb632e47a0e638317\"\u003e\u003ccode\u003e484a0b5\u003c/code\u003e\u003c/a\u003e Update the readme (\u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/473\"\u003e#473\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/semantica-agi/semantica/pull/2091","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/semantica-agi%2Fsemantica/issues/2091","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2091/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-22T05:15:39.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5973519285","node_id":"PR_kwDOTSmvBc8AAAABJ8mEGQ","number":29,"state":"open","title":"ci: bump ossf/scorecard-action from 2.4.4 to 2.5.0","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":["HetCreep"],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-22T05:15:39.000Z","updated_at":"2026-10-22T05:16:23.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci","packages":[{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ossf/scorecard-action\u0026package-manager=github_actions\u0026previous-version=2.4.4\u0026new-version=2.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/TheColliery/CoalLedger/pull/29","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/TheColliery%2FCoalLedger/issues/29","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/29/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-22T03:07:34.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5972305113","node_id":"PR_kwDORhB7rc8AAAABJ7o6RQ","number":237,"state":"open","title":"ci(deps)(deps): bump the github-actions group across 1 directory with 10 updates","user":"dependabot[bot]","labels":["ci"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-22T03:07:34.000Z","updated_at":"2026-10-22T03:07:38.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci(deps)(deps): bump","group_name":"github-actions","update_count":10,"packages":[{"name":"jamescrowley321/blind-peer-review","old_version":"3.10.0","new_version":"3.11.0","repository_url":"https://github.com/jamescrowley321/blind-peer-review"},{"name":"anthropics/claude-code-action","old_version":"1.0.230","new_version":"1.0.254","repository_url":"https://github.com/anthropics/claude-code-action"},{"name":"github/codeql-action/init","old_version":"4.38.1","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.38.1","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml","old_version":"2.6.0","new_version":"2.7.0","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml","old_version":"2.6.0","new_version":"2.7.0","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"anchore/sbom-action/download-syft","old_version":"0.24.2","new_version":"0.24.3","repository_url":"https://github.com/anchore/sbom-action"},{"name":"goreleaser/goreleaser-action","old_version":"7.2.3","new_version":"7.3.0","repository_url":"https://github.com/goreleaser/goreleaser-action"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.1","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 10 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [jamescrowley321/blind-peer-review](https://github.com/jamescrowley321/blind-peer-review) | `3.10.0` | `3.11.0` |\n| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.230` | `1.0.254` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.1` | `4.39.0` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.1` | `4.39.0` |\n| [google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml](https://github.com/google/osv-scanner-action) | `2.6.0` | `2.7.0` |\n| [google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml](https://github.com/google/osv-scanner-action) | `2.6.0` | `2.7.0` |\n| [anchore/sbom-action/download-syft](https://github.com/anchore/sbom-action) | `0.24.2` | `0.24.3` |\n| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `7.2.3` | `7.3.0` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.1` | `4.39.0` |\n\n\nUpdates `jamescrowley321/blind-peer-review` from 3.10.0 to 3.11.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/releases\"\u003ejamescrowley321/blind-peer-review's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.11.0\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/compare/v3.10.0...v3.11.0\"\u003e3.11.0\u003c/a\u003e (2026-10-20)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ecorpus:\u003c/strong\u003e Jev off-surface finding detector and worksheet phase (\u003ca href=\"https://redirect.github.com/jamescrowley321/blind-peer-review/issues/174\"\u003e#174\u003c/a\u003e) (\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/49a74d6cca7f677101c7da9d1aa26eeac7ddbbd9\"\u003e49a74d6\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/blob/main/CHANGELOG.md\"\u003ejamescrowley321/blind-peer-review's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cp\u003eAll notable changes to this project are documented here. Format loosely follows\n\u003ca href=\"https://keepachangelog.com\"\u003eKeep a Changelog\u003c/a\u003e; this project uses semantic\nversion tags (\u003ccode\u003ev1\u003c/code\u003e, \u003ccode\u003ev1.0.0\u003c/code\u003e, …), and consumers pin \u003ccode\u003e@v1\u003c/code\u003e (it tracks the latest\n\u003ccode\u003ev1.x.x\u003c/code\u003e).\u003c/p\u003e\n\u003cp\u003eReleases are automated with \u003ca href=\"https://github.com/googleapis/release-please\"\u003erelease-please\u003c/a\u003e:\neach \u003ccode\u003e## [x.y.z]\u003c/code\u003e section below is drafted from the Conventional Commits since the\nprevious release and can be curated in the release PR before it is merged. See\n\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/blob/main/CONTRIBUTING.md#cutting-a-release\"\u003eCONTRIBUTING.md\u003c/a\u003e for the flow. \u003ccode\u003e[1.4.1]\u003c/code\u003e and\nthe older sections below it predate the automation and were written by hand.\u003c/p\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/compare/v3.11.0...v3.12.0\"\u003e3.12.0\u003c/a\u003e (2026-10-21)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ecorpus:\u003c/strong\u003e diffstat-only state, combined rule and time split for the lens gate (\u003ca href=\"https://redirect.github.com/jamescrowley321/blind-peer-review/issues/177\"\u003e#177\u003c/a\u003e) (\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/d6d4ff37057a24aa77d8f2d8413cdbedaa48252c\"\u003ed6d4ff3\u003c/a\u003e), closes \u003ca href=\"https://redirect.github.com/jamescrowley321/blind-peer-review/issues/169\"\u003e#169\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/compare/v3.10.0...v3.11.0\"\u003e3.11.0\u003c/a\u003e (2026-10-20)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ecorpus:\u003c/strong\u003e Jev off-surface finding detector and worksheet phase (\u003ca href=\"https://redirect.github.com/jamescrowley321/blind-peer-review/issues/174\"\u003e#174\u003c/a\u003e) (\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/49a74d6cca7f677101c7da9d1aa26eeac7ddbbd9\"\u003e49a74d6\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/compare/v3.9.0...v3.10.0\"\u003e3.10.0\u003c/a\u003e (2026-10-20)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ecorpus:\u003c/strong\u003e measure Jev as a pre-gate for the conditional lenses (\u003ca href=\"https://redirect.github.com/jamescrowley321/blind-peer-review/issues/168\"\u003e#168\u003c/a\u003e) (\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/5d4ea59ef3524136fb00d41fba0ad24398276a0e\"\u003e5d4ea59\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eremove remaining references to a private downstream repository (\u003ca href=\"https://redirect.github.com/jamescrowley321/blind-peer-review/issues/167\"\u003e#167\u003c/a\u003e) (\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/d4a6aaa8bd0f70e64cf2f72fb372d9c74f32f8e5\"\u003ed4a6aaa\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/compare/v3.8.0...v3.9.0\"\u003e3.9.0\u003c/a\u003e (2026-10-17)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eplugin:\u003c/strong\u003e configurable reviewer instead of auto-dispatching to codex (\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/3c56238474b650acae9ab17cbc37edcd8e14edd2\"\u003e3c56238\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/compare/v3.7.0...v3.8.0\"\u003e3.8.0\u003c/a\u003e (2026-10-17)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/2a7dcc81367ade043575b017baf604bbee0714e3\"\u003e\u003ccode\u003e2a7dcc8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/jamescrowley321/blind-peer-review/issues/176\"\u003e#176\u003c/a\u003e from jamescrowley321/release-please--branches--main--...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/8322e97f387befa81d8370d2a81c62383b734f23\"\u003e\u003ccode\u003e8322e97\u003c/code\u003e\u003c/a\u003e chore(main): release 3.11.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/commit/49a74d6cca7f677101c7da9d1aa26eeac7ddbbd9\"\u003e\u003ccode\u003e49a74d6\u003c/code\u003e\u003c/a\u003e feat(corpus): Jev off-surface finding detector and worksheet phase (\u003ca href=\"https://redirect.github.com/jamescrowley321/blind-peer-review/issues/174\"\u003e#174\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/jamescrowley321/blind-peer-review/compare/439e22c6dcfdaefc6c1713d9f5b3d259ee38cf19...2a7dcc81367ade043575b017baf604bbee0714e3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `anthropics/claude-code-action` from 1.0.230 to 1.0.254\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/anthropics/claude-code-action/releases\"\u003eanthropics/claude-code-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.0.254\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.253...v1.0.254\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.253...v1.0.254\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.253\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.252...v1.0.253\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.252...v1.0.253\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.252\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.251...v1.0.252\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.251...v1.0.252\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.251\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.250...v1.0.251\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.250...v1.0.251\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.250\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.249...v1.0.250\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.249...v1.0.250\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.249\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.248...v1.0.249\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.248...v1.0.249\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.248\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.247...v1.0.248\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.247...v1.0.248\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.247\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.246...v1.0.247\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.246...v1.0.247\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.246\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.245...v1.0.246\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.245...v1.0.246\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.245\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.244...v1.0.245\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.244...v1.0.245\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.244\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.243...v1.0.244\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.243...v1.0.244\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.243\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.242...v1.0.243\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.242...v1.0.243\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.242\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.241...v1.0.242\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.241...v1.0.242\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.241\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.240...v1.0.241\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.240...v1.0.241\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.240\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.239...v1.0.240\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.239...v1.0.240\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.239\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/v1.0.238...v1.0.239\"\u003ehttps://github.com/anthropics/claude-code-action/compare/v1.0.238...v1.0.239\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.0.238\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c\"\u003e\u003ccode\u003edb77d4d\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.304 and Agent SDK to 0.3.304\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/5eb090f3c3afd701a0672cd32981197ca27688f6\"\u003e\u003ccode\u003e5eb090f\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.303 and Agent SDK to 0.3.303\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/f27be6b65a4652f08a2ba3cff79114829b588967\"\u003e\u003ccode\u003ef27be6b\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.302 and Agent SDK to 0.3.302\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/374f254f5efaf968abfe15d399fd90972e8138b9\"\u003e\u003ccode\u003e374f254\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.301 and Agent SDK to 0.3.301\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/a26b07d8c778b0c43f64618e5fd29fd0f8af72e8\"\u003e\u003ccode\u003ea26b07d\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.300 and Agent SDK to 0.3.300\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/34968b5981d5d170904281aa3df6f3c0d4a28855\"\u003e\u003ccode\u003e34968b5\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.299 and Agent SDK to 0.3.299\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/1d6de8cb0c237e7c15e9e1bdf973826ebae490cc\"\u003e\u003ccode\u003e1d6de8c\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.296 and Agent SDK to 0.3.296\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/2dca132ff0e0c4094ce6048b422c6915a071210b\"\u003e\u003ccode\u003e2dca132\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.295 and Agent SDK to 0.3.295\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/38c80c1a32cdbc0c6f34042464a0669d89363dde\"\u003e\u003ccode\u003e38c80c1\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.294 and Agent SDK to 0.3.294\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anthropics/claude-code-action/commit/6fed3ca145920b639991cb756090506e1bcaf515\"\u003e\u003ccode\u003e6fed3ca\u003c/code\u003e\u003c/a\u003e chore: bump Claude Code to 2.1.293 and Agent SDK to 0.3.293\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/anthropics/claude-code-action/compare/4036a180cf690f49529f5d8c79c998855287f590...db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from 4.38.1 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.1 - 21 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.38.1 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.1 - 21 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml` from 2.6.0 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.7.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate github/codeql-action action to v4.38.0 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/143\"\u003egoogle/osv-scanner-action#143\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate to v2.7.0 by \u003ca href=\"https://github.com/michaelkedar\"\u003e\u003ccode\u003e@​michaelkedar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/146\"\u003egoogle/osv-scanner-action#146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.6.0...v2.7.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.6.0...v2.7.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b1d267aea5211fa648d9d442fa64b90dbdcbdd36\"\u003e\u003ccode\u003eb1d267a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/146\"\u003e#146\u003c/a\u003e from google/update-to-v2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/2b1cfc6d0e3941f549908be1c5671b5d7625ebc0\"\u003e\u003ccode\u003e2b1cfc6\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.7.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/ef6dfdf01765802d5a8dbc3c39852a6128b00af0\"\u003e\u003ccode\u003eef6dfdf\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.7.0 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0a65f82af05cd58cf587827b0bb0489548c18346\"\u003e\u003ccode\u003e0a65f82\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.7.0 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8ac9e5ce44cc7178e0e04229a91bdcc003166e57\"\u003e\u003ccode\u003e8ac9e5c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/143\"\u003e#143\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3b06fbb744e4192b7d47b4f2584715a21ef88b92\"\u003e\u003ccode\u003e3b06fbb\u003c/code\u003e\u003c/a\u003e Update github/codeql-action action to v4.38.0\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/a345acffa64b0eaede81a3d9aae6141214d9c8fc...b1d267aea5211fa648d9d442fa64b90dbdcbdd36\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml` from 2.6.0 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.7.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate github/codeql-action action to v4.38.0 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/143\"\u003egoogle/osv-scanner-action#143\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate to v2.7.0 by \u003ca href=\"https://github.com/michaelkedar\"\u003e\u003ccode\u003e@​michaelkedar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/146\"\u003egoogle/osv-scanner-action#146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.6.0...v2.7.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.6.0...v2.7.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b1d267aea5211fa648d9d442fa64b90dbdcbdd36\"\u003e\u003ccode\u003eb1d267a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/146\"\u003e#146\u003c/a\u003e from google/update-to-v2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/2b1cfc6d0e3941f549908be1c5671b5d7625ebc0\"\u003e\u003ccode\u003e2b1cfc6\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.7.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/ef6dfdf01765802d5a8dbc3c39852a6128b00af0\"\u003e\u003ccode\u003eef6dfdf\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.7.0 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0a65f82af05cd58cf587827b0bb0489548c18346\"\u003e\u003ccode\u003e0a65f82\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.7.0 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8ac9e5ce44cc7178e0e04229a91bdcc003166e57\"\u003e\u003ccode\u003e8ac9e5c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/143\"\u003e#143\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3b06fbb744e4192b7d47b4f2584715a21ef88b92\"\u003e\u003ccode\u003e3b06fbb\u003c/code\u003e\u003c/a\u003e Update github/codeql-action action to v4.38.0\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/a345acffa64b0eaede81a3d9aae6141214d9c8fc...b1d267aea5211fa648d9d442fa64b90dbdcbdd36\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `anchore/sbom-action/download-syft` from 0.24.2 to 0.24.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/anchore/sbom-action/releases\"\u003eanchore/sbom-action/download-syft's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.24.3\u003c/h2\u003e\n\u003ch3\u003eAdded Features\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebump type-fest from 5.9.0 to 5.10.0 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/742\"\u003e#742\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.5.1 to 26.6.1 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/741\"\u003e#741\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.4.1 to 26.5.1 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/737\"\u003e#737\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump typescript-eslint from 8.69.0 to 8.70.0 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/736\"\u003e#736\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump type-fest from 5.8.0 to 5.9.0 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/732\"\u003e#732\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump eslint from 10.9.1 to 10.10.0 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/733\"\u003e#733\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump typescript-eslint from 8.68.0 to 8.69.0 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/730\"\u003e#730\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.2.0 to 26.4.0 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/727\"\u003e#727\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump typescript-eslint from 8.67.0 to 8.68.0 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/726\"\u003e#726\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebump github.com/anchore/go-make from 0.8.0 to 0.8.1 in /.make [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/738\"\u003e#738\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump anchore/go-make/.github/actions/setup from 0.8.0 to 0.8.1 in /.github/actions/bootstrap [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/740\"\u003e#740\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/739\"\u003e#739\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/734\"\u003e#734\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.4.0 to 26.4.1 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/731\"\u003e#731\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump tsx from 4.23.12 to 4.23.13 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/729\"\u003e#729\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump eslint from 10.9.0 to 10.9.1 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/728\"\u003e#728\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003ebump \u003ccode\u003e@​humanfs/node\u003c/code\u003e from 0.16.7 to 0.16.8 [PR \u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/725\"\u003e#725\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/anchore/sbom-action/compare/v0.24.2...v0.24.3\"\u003e(Full Changelog)\u003c/a\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c\"\u003e\u003ccode\u003e66cbf4b\u003c/code\u003e\u003c/a\u003e chore(deps): update Syft to latest release (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/735\"\u003e#735\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/6b31fa7e2d592e47d95d2a5e0520a7352d47ead5\"\u003e\u003ccode\u003e6b31fa7\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump type-fest from 5.9.0 to 5.10.0 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/742\"\u003e#742\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/85bda362f4d1f0e150007087d1a8502d53c04bc7\"\u003e\u003ccode\u003e85bda36\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.5.1 to 26.6.1 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/741\"\u003e#741\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/7b97c1e9edff006647d6c63074267132e3fdabce\"\u003e\u003ccode\u003e7b97c1e\u003c/code\u003e\u003c/a\u003e chore(deps): bump github.com/anchore/go-make in /.make (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/738\"\u003e#738\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/891b0559c3f25512e4b4d41d919a03f31740f56f\"\u003e\u003ccode\u003e891b055\u003c/code\u003e\u003c/a\u003e chore(deps): bump anchore/go-make/.github/actions/setup (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/740\"\u003e#740\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/f73cf48625e2e98521eebea287189abc22f22f55\"\u003e\u003ccode\u003ef73cf48\u003c/code\u003e\u003c/a\u003e chore(deps): bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/739\"\u003e#739\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/13576db7e6212e069d9f3c86313c1411e99a9a14\"\u003e\u003ccode\u003e13576db\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.4.1 to 26.5.1 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/737\"\u003e#737\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/924e83ba5bfad61e1b64b874f0ca919c75b8c575\"\u003e\u003ccode\u003e924e83b\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump typescript-eslint from 8.69.0 to 8.70.0 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/736\"\u003e#736\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/274555f23948494da9248b45cbd44ad133002e12\"\u003e\u003ccode\u003e274555f\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump type-fest from 5.8.0 to 5.9.0 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/732\"\u003e#732\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/48fb5380da7b84fcdf5e6527059a37816c4d24cb\"\u003e\u003ccode\u003e48fb538\u003c/code\u003e\u003c/a\u003e chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/734\"\u003e#734\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/anchore/sbom-action/compare/3ad7283483fc7af8ff2b4ea19663c2d5ca935e26...66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `goreleaser/goreleaser-action` from 7.2.3 to 7.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/goreleaser/goreleaser-action/releases\"\u003egoreleaser/goreleaser-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/570\"\u003egoreleaser/goreleaser-action#570\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/571\"\u003egoreleaser/goreleaser-action#571\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/575\"\u003egoreleaser/goreleaser-action#575\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/574\"\u003egoreleaser/goreleaser-action#574\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump undici from 6.27.0 to 6.28.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/576\"\u003egoreleaser/goreleaser-action#576\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump js-yaml from 5.2.2 to 5.2.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/573\"\u003egoreleaser/goreleaser-action#573\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump js-yaml from 5.2.3 to 5.4.1 in the npm group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/578\"\u003egoreleaser/goreleaser-action#578\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: reuse the goreleaser binary from the runner tool cache by \u003ca href=\"https://github.com/caarlos0\"\u003e\u003ccode\u003e@​caarlos0\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/577\"\u003egoreleaser/goreleaser-action#577\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 in the actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/581\"\u003egoreleaser/goreleaser-action#581\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump undici from 6.28.0 to 6.29.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/579\"\u003egoreleaser/goreleaser-action#579\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/580\"\u003egoreleaser/goreleaser-action#580\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/v7.2.3...v7.3.0\"\u003ehttps://github.com/goreleaser/goreleaser-action/compare/v7.2.3...v7.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/a4f02ab5355a589de60d917a659ce617ed19b3de\"\u003e\u003ccode\u003ea4f02ab\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/e27eb7769180b733cf28959f093582ddda91972e\"\u003e\u003ccode\u003ee27eb77\u003c/code\u003e\u003c/a\u003e chore(deps): bump the npm group with 2 updates (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/580\"\u003e#580\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/f5b4e31ee483102e19b17e532f024e8aee22d4fe\"\u003e\u003ccode\u003ef5b4e31\u003c/code\u003e\u003c/a\u003e chore(deps): bump undici from 6.28.0 to 6.29.0 (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/579\"\u003e#579\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/2d42c26fe04ca60644a41f10407c30998bc2f770\"\u003e\u003ccode\u003e2d42c26\u003c/code\u003e\u003c/a\u003e ci(deps): bump codecov/codecov-action (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/581\"\u003e#581\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/73cd4ffe39ceae11aafd47343ff35e8be087f14c\"\u003e\u003ccode\u003e73cd4ff\u003c/code\u003e\u003c/a\u003e feat: reuse the goreleaser binary from the runner tool cache (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/577\"\u003e#577\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/97a960754774e271e3eb4f389fe9b73400f2158c\"\u003e\u003ccode\u003e97a9607\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/689e48f9ac97190a2d170ebe29f3aed1a694464b\"\u003e\u003ccode\u003e689e48f\u003c/code\u003e\u003c/a\u003e chore(deps): bump js-yaml from 5.2.3 to 5.4.1 in the npm group (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/578\"\u003e#578\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/7e6b514c508941c26e8772ba9b920d0677e2160e\"\u003e\u003ccode\u003e7e6b514\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/4ec11830b6b44bb4bef0db5ddd7e04844da5519e\"\u003e\u003ccode\u003e4ec1183\u003c/code\u003e\u003c/a\u003e chore(deps): bump js-yaml from 5.2.2 to 5.2.3 (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/573\"\u003e#573\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/59060fdcfdbbfd4c87d837ab2c489d635c18f843\"\u003e\u003ccode\u003e59060fd\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/f06c13b6b1a9625abc9e6e439d9c05a8f2190e94...a4f02ab5355a589de60d917a659ce617ed19b3de\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.1 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.1 - 21 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub ...\n\n_Description has been truncated_","html_url":"https://github.com/jamescrowley321/terraform-provider-descope/pull/237","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/jamescrowley321%2Fterraform-provider-descope/issues/237","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/237/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-21T23:05:19.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5969948842","node_id":"PR_kwDOVS0OUc8AAAABJ5yW5A","number":2,"state":"open","title":"ci(deps): Bump the actions group with 4 updates","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-21T23:05:19.000Z","updated_at":"2026-10-21T23:05:22.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci(deps): Bump","group_name":"actions","update_count":4,"packages":[{"name":"actions/upload-artifact","old_version":"7.0.1","new_version":"7.0.2","repository_url":"https://github.com/actions/upload-artifact"},{"name":"actions/download-artifact","old_version":"8.0.1","new_version":"8.0.2","repository_url":"https://github.com/actions/download-artifact"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.2","new_version":"4.38.3","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the actions group with 4 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact), [actions/download-artifact](https://github.com/actions/download-artifact), [ossf/scorecard-action](https://github.com/ossf/scorecard-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).\n\nUpdates `actions/upload-artifact` from 7.0.1 to 7.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdates \u003ccode\u003e@​actions/artifact\u003c/code\u003e to v6.3.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/821\"\u003eactions/upload-artifact#821\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\"\u003ehttps://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003e\u003ccode\u003ecf430e0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/822\"\u003e#822\u003c/a\u003e from actions/tunc-d-prepare-upload-v7-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469\"\u003e\u003ccode\u003ec2acded\u003c/code\u003e\u003c/a\u003e chore: prepare v7.0.2 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a\"\u003e\u003ccode\u003e4687c1b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/821\"\u003e#821\u003c/a\u003e from actions/tunc-d-upload-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719\"\u003e\u003ccode\u003e8cbe1be\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/download-artifact` from 8.0.1 to 8.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/download-artifact/releases\"\u003eactions/download-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev8.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the readme by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/473\"\u003eactions/download-artifact#473\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare download-artifact v8.0.2 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/493\"\u003eactions/download-artifact#493\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\"\u003ehttps://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003e\u003ccode\u003e9000827\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/493\"\u003e#493\u003c/a\u003e from actions/tunc-d-prepare-download-v8-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/e455989ae00f5bdd4054f05d3e972c6bf8a62dc5\"\u003e\u003ccode\u003ee455989\u003c/code\u003e\u003c/a\u003e Prepare download-artifact v8.0.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/a00b90c4a2f01d73a8c89552caabca6ea3b43137\"\u003e\u003ccode\u003ea00b90c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/492\"\u003e#492\u003c/a\u003e from actions/tunc-d-download-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/29bb7ce6af5345aeab5bb4774ce7249ee3ccc27f\"\u003e\u003ccode\u003e29bb7ce\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/484a0b528fb4d7bd804637ccb632e47a0e638317\"\u003e\u003ccode\u003e484a0b5\u003c/code\u003e\u003c/a\u003e Update the readme (\u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/473\"\u003e#473\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.1 - 21 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003e\u003ccode\u003e24c5418\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4214\"\u003e#4214\u003c/a\u003e from github/update-v4.38.3-e0b52dbdc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8\"\u003e\u003ccode\u003e69e87c5\u003c/code\u003e\u003c/a\u003e Add changelog note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa\"\u003e\u003ccode\u003e23b6828\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b\"\u003e\u003ccode\u003ee0b52db\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4210\"\u003e#4210\u003c/a\u003e from github/henrymercer/pin-python-for-older-clis-in-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc\"\u003e\u003ccode\u003e6b99698\u003c/code\u003e\u003c/a\u003e Pin Python 3.13.15 for older CLI versions in multi-language check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8\"\u003e\u003ccode\u003e63d3d63\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4203\"\u003e#4203\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe\"\u003e\u003ccode\u003e7377a10\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524\"\u003e\u003ccode\u003ec1a30cd\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974\"\u003e\u003ccode\u003ed208ec7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4200\"\u003e#4200\u003c/a\u003e from github/mbg/esm/migrate-pr-checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845\"\u003e\u003ccode\u003ea71b0c6\u003c/code\u003e\u003c/a\u003e Replace \u003ccode\u003e__dirname\u003c/code\u003e in \u003ccode\u003esync.ts\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/luminare-dev/lumen-mail/pull/2","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/luminare-dev%2Flumen-mail/issues/2","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-21T20:30:55.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5968037330","node_id":"PR_kwDOPXS5wc8AAAABJ4QqqQ","number":3678,"state":"closed","title":"chore(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0","user":"dependabot[bot]","labels":["ci","dependencies"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":"2026-10-22T05:17:55.000Z","author_association":null,"state_reason":null,"created_at":"2026-10-21T20:30:55.000Z","updated_at":"2026-10-22T05:17:55.000Z","time_to_close":31620,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps)","packages":[{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n","html_url":"https://github.com/abhigyanpatwari/GitNexus/pull/3678","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/abhigyanpatwari%2FGitNexus/issues/3678","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/3678/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-20T19:38:52.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5948361304","node_id":"PR_kwDOVRUQIs8AAAABJoe-SA","number":5,"state":"closed","title":"chore(deps): bump the github-actions group across 1 directory with 8 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":"2026-10-21T01:34:55.000Z","author_association":null,"state_reason":null,"created_at":"2026-10-20T19:38:52.000Z","updated_at":"2026-10-21T01:34:58.000Z","time_to_close":21363,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"github-actions","update_count":8,"packages":[{"name":"actions/checkout","old_version":"6.1.0","new_version":"7.0.1","repository_url":"https://github.com/actions/checkout"},{"name":"actions/setup-python","old_version":"6.3.0","new_version":"7.0.0","repository_url":"https://github.com/actions/setup-python"},{"name":"actions/upload-artifact","old_version":"6.0.0","new_version":"7.0.2","repository_url":"https://github.com/actions/upload-artifact"},{"name":"github/codeql-action/init","old_version":"4.38.2","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.38.2","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"SignPath/github-action-submit-signing-request","old_version":"2.3","new_version":"3.0","repository_url":"https://github.com/signpath/github-action-submit-signing-request"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.2","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 8 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `6.1.0` | `7.0.1` |\n| [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` |\n| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6.0.0` | `7.0.2` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.39.0` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.39.0` |\n| [SignPath/github-action-submit-signing-request](https://github.com/signpath/github-action-submit-signing-request) | `2.3` | `3.0` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.39.0` |\n\n\nUpdates `actions/checkout` from 6.1.0 to 7.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/releases\"\u003eactions/checkout's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eskip running unsafe pr check if input is default by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2518\"\u003eactions/checkout#2518\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003etrim only ascii whitespace for branch by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2521\"\u003eactions/checkout#2521\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eescape values passed to --unset by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2530\"\u003eactions/checkout#2530\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v7...v7.0.1\"\u003ehttps://github.com/actions/checkout/compare/v7...v7.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eblock checking out fork pr for pull_request_target and workflow_run by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2458\"\u003eactions/checkout#2458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.1 to 3.4.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2460\"\u003eactions/checkout#2460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.2.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2461\"\u003eactions/checkout#2461\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e and \u003ccode\u003e@​actions/tool-cache\u003c/code\u003e and Remove uuid by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2459\"\u003eactions/checkout#2459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade module to esm and update dependencies by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2463\"\u003eactions/checkout#2463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2462\"\u003eactions/checkout#2462\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003egetting ready for checkout v7 release by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2464\"\u003eactions/checkout#2464\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate error wording by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2467\"\u003eactions/checkout#2467\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.3...v7.0.0\"\u003ehttps://github.com/actions/checkout/compare/v6.0.3...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003ev7.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSkip running unsafe pr check if input is default by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2518\"\u003eactions/checkout#2518\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eTrim only ascii whitespace for branch by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2521\"\u003eactions/checkout#2521\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEscape values passed to --unset by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2530\"\u003eactions/checkout#2530\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock checking out fork PR for pull_request_target and workflow_run by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca href=\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca href=\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca href=\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca href=\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment variables by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca href=\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1\"\u003e\u003ccode\u003e3d3c42e\u003c/code\u003e\u003c/a\u003e prep v7.0.1 release (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2531\"\u003e#2531\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07\"\u003e\u003ccode\u003e2880268\u003c/code\u003e\u003c/a\u003e escape values passed to --unset (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2530\"\u003e#2530\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1\"\u003e\u003ccode\u003e12cd223\u003c/code\u003e\u003c/a\u003e trim only ascii whitespace for branch (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2521\"\u003e#2521\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541\"\u003e\u003ccode\u003e62661c4\u003c/code\u003e\u003c/a\u003e skip running unsafe pr check if input is default (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2518\"\u003e#2518\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f\"\u003e\u003ccode\u003ee8d4307\u003c/code\u003e\u003c/a\u003e Bump the minor-actions-dependencies group with 2 updates (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2499\"\u003e#2499\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87\"\u003e\u003ccode\u003e631c942\u003c/code\u003e\u003c/a\u003e eslint 9 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2474\"\u003e#2474\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e\"\u003e\u003ccode\u003e4f1f4ae\u003c/code\u003e\u003c/a\u003e Bump actions/upload-artifact from 4 to 7 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2476\"\u003e#2476\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92\"\u003e\u003ccode\u003eba09753\u003c/code\u003e\u003c/a\u003e Bump actions/checkout from 6 to 7 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2488\"\u003e#2488\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22\"\u003e\u003ccode\u003eb9e0990\u003c/code\u003e\u003c/a\u003e Bump docker/login-action from 3.3.0 to 4.2.0 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2479\"\u003e#2479\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2\"\u003e\u003ccode\u003ee8cb398\u003c/code\u003e\u003c/a\u003e Bump docker/build-push-action from 6.5.0 to 7.2.0 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2478\"\u003e#2478\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/checkout/compare/d23441a48e516b6c34aea4fa41551a30e30af803...3d3c42e5aac5ba805825da76410c181273ba90b1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/setup-python` from 6.3.0 to 7.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/setup-python/releases\"\u003eactions/setup-python's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate to ESM and upgrade dependencies by \u003ca href=\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1330\"\u003eactions/setup-python#1330\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin SHA commits and update docs with latest versions by \u003ca href=\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e@​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1338\"\u003eactions/setup-python#1338\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove the pip-install input by \u003ca href=\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1336\"\u003eactions/setup-python#1336\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fix\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix to Classify stderr warning messages as warnings instead of errors in annotations by \u003ca href=\"https://github.com/lmvysakh\"\u003e\u003ccode\u003e@​lmvysakh\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1335\"\u003eactions/setup-python#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eValidate and retry manifest fetch to prevent silent failures by \u003ca href=\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1332\"\u003eactions/setup-python#1332\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency Upgrade\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump certifi from 2020.6.20 to 2024.7.4 in /\u003cstrong\u003etests\u003c/strong\u003e/data by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1328\"\u003eactions/setup-python#1328\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove EOL Python versions and Bumps numpy text fixture by \u003ca href=\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e@​priya-kinthali\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1333\"\u003eactions/setup-python#1333\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1337\"\u003eactions/setup-python#1337\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lmvysakh\"\u003e\u003ccode\u003e@​lmvysakh\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1335\"\u003eactions/setup-python#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-python/pull/1337\"\u003eactions/setup-python#1337\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-python/compare/v6...v7.0.0\"\u003ehttps://github.com/actions/setup-python/compare/v6...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-python/commit/5fda3b95a4ea91299a34e894583c3862153e4b97\"\u003e\u003ccode\u003e5fda3b9\u003c/code\u003e\u003c/a\u003e Pin SHA commits and update docs with latest versions (\u003ca href=\"https://redirect.github.com/actions/setup-python/issues/1338\"\u003e#1338\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-python/commit/4ab7e95f05e168b4356aebde89dd84f59c283d8e\"\u003e\u003ccode\u003e4ab7e95\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/setup-python/issues/1337\"\u003e#1337\u003c/a\u003e from actions/philip-gai/bump-actions-cache-6-2-0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-python/commit/0f3a009f475dbea83c0371cd85d099690fee8c5c\"\u003e\u003ccode\u003e0f3a009\u003c/code\u003e\u003c/a\u003e Remove the pip-install input (\u003ca href=\"https://redirect.github.com/actions/setup-python/issues/1336\"\u003e#1336\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-python/commit/f8cf4291c8b8e273ddd26e569454615c7315d932\"\u003e\u003ccode\u003ef8cf429\u003c/code\u003e\u003c/a\u003e Migrate to ESM and upgrade dependencies (\u003ca href=\"https://redirect.github.com/actions/setup-python/issues/1330\"\u003e#1330\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-python/commit/54baeea5b34417d10a7479663a23cca53ea209b5\"\u003e\u003ccode\u003e54baeea\u003c/code\u003e\u003c/a\u003e Validate and retry manifest fetch to prevent silent failures (\u003ca href=\"https://redirect.github.com/actions/setup-python/issues/1332\"\u003e#1332\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-python/commit/c7092773a316760f4ecfe498e4af668a4dafeac5\"\u003e\u003ccode\u003ec709277\u003c/code\u003e\u003c/a\u003e Annotation code fix (\u003ca href=\"https://redirect.github.com/actions/setup-python/issues/1335\"\u003e#1335\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-python/commit/6849080452e69b330395e8a6d23cf90f56d76a1a\"\u003e\u003ccode\u003e6849080\u003c/code\u003e\u003c/a\u003e remove EOL Python versions and Bumps numpy text fixture (\u003ca href=\"https://redirect.github.com/actions/setup-python/issues/1333\"\u003e#1333\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-python/commit/0903b469fbf4441aadfe4f4b249dc5b1fba3a73e\"\u003e\u003ccode\u003e0903b46\u003c/code\u003e\u003c/a\u003e Bump certifi from 2020.6.20 to 2024.7.4 in /\u003cstrong\u003etests\u003c/strong\u003e/data (\u003ca href=\"https://redirect.github.com/actions/setup-python/issues/1328\"\u003e#1328\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/setup-python/compare/ece7cb06caefa5fff74198d8649806c4678c61a1...5fda3b95a4ea91299a34e894583c3862153e4b97\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-artifact` from 6.0.0 to 7.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdates \u003ccode\u003e@​actions/artifact\u003c/code\u003e to v6.3.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/821\"\u003eactions/upload-artifact#821\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\"\u003ehttps://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the readme with direct upload details by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/795\"\u003eactions/upload-artifact#795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReadme: bump all the example versions to v7 by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/796\"\u003eactions/upload-artifact#796\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eInclude changes in typespec/ts-http-runtime 0.3.5 by \u003ca href=\"https://github.com/yacaovsnc\"\u003e\u003ccode\u003e@​yacaovsnc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/797\"\u003eactions/upload-artifact#797\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v7...v7.0.1\"\u003ehttps://github.com/actions/upload-artifact/compare/v7...v7.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003ev7 What's new\u003c/h2\u003e\n\u003ch3\u003eDirect Uploads\u003c/h3\u003e\n\u003cp\u003eAdds support for uploading single files directly (unzipped). Callers can set the new \u003ccode\u003earchive\u003c/code\u003e parameter to \u003ccode\u003efalse\u003c/code\u003e to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The \u003ccode\u003ename\u003c/code\u003e parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.\u003c/p\u003e\n\u003ch3\u003eESM\u003c/h3\u003e\n\u003cp\u003eTo support new versions of the \u003ccode\u003e@actions/*\u003c/code\u003e packages, we've upgraded the package to ESM.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd proxy integration test by \u003ca href=\"https://github.com/Link\"\u003e\u003ccode\u003e@​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/754\"\u003eactions/upload-artifact#754\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade the module to ESM and bump dependencies by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/762\"\u003eactions/upload-artifact#762\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport direct file uploads by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/764\"\u003eactions/upload-artifact#764\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Link\"\u003e\u003ccode\u003e@​Link\u003c/code\u003e\u003c/a\u003e- made their first contribution in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/754\"\u003eactions/upload-artifact#754\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v6...v7.0.0\"\u003ehttps://github.com/actions/upload-artifact/compare/v6...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003e\u003ccode\u003ecf430e0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/822\"\u003e#822\u003c/a\u003e from actions/tunc-d-prepare-upload-v7-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469\"\u003e\u003ccode\u003ec2acded\u003c/code\u003e\u003c/a\u003e chore: prepare v7.0.2 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a\"\u003e\u003ccode\u003e4687c1b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/821\"\u003e#821\u003c/a\u003e from actions/tunc-d-upload-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719\"\u003e\u003ccode\u003e8cbe1be\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a\"\u003e\u003ccode\u003e043fb46\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/797\"\u003e#797\u003c/a\u003e from actions/yacaovsnc/update-dependency\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/634250c1388765ea7ed0f053e636f1f399000b94\"\u003e\u003ccode\u003e634250c\u003c/code\u003e\u003c/a\u003e Include changes in typespec/ts-http-runtime 0.3.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/e454baaac2be505c9450e11b8f3215c6fc023ce8\"\u003e\u003ccode\u003ee454baa\u003c/code\u003e\u003c/a\u003e Readme: bump all the example versions to v7 (\u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/796\"\u003e#796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/74fad66b98a6d799dc004d3353ccd0e6f6b2530e\"\u003e\u003ccode\u003e74fad66\u003c/code\u003e\u003c/a\u003e Update the readme with direct upload details (\u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/795\"\u003e#795\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f\"\u003e\u003ccode\u003ebbbca2d\u003c/code\u003e\u003c/a\u003e Support direct file uploads (\u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/764\"\u003e#764\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/589182c5a4cec8920b8c1bce3e2fab1c97a02296\"\u003e\u003ccode\u003e589182c\u003c/code\u003e\u003c/a\u003e Upgrade the module to ESM and bump dependencies (\u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/762\"\u003e#762\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/upload-artifact/compare/v6...cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from 4.38.2 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.38.2 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `SignPath/github-action-submit-signing-request` from 2.3 to 3.0\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SignPath/github-action-submit-signing-request/commit/f6d04783b4569d051e0c80105fe66e82819d0092\"\u003e\u003ccode\u003ef6d0478\u003c/code\u003e\u003c/a\u003e Build from - 7336bb524a08c99aa48ba5065b00095eb2b0e09e. Original commit messag...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SignPath/github-action-submit-signing-request/commit/ef0ce19416782bc2e1b2deea3ca79c5446cc3b78\"\u003e\u003ccode\u003eef0ce19\u003c/code\u003e\u003c/a\u003e Build from - 8ff04a5c1f8d21d18e1eb1fc41b698b425a83654. Original commit messag...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SignPath/github-action-submit-signing-request/commit/a790881fc89970675894221b0be3bb12a87eb391\"\u003e\u003ccode\u003ea790881\u003c/code\u003e\u003c/a\u003e Build from - 9c89d7e4aa8c240d6deba49c8e4f52910fd41288. Original commit messag...\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/signpath/github-action-submit-signing-request/compare/c92b958760219087e01f8d67a1669ed57afe2627...f6d04783b4569d051e0c80105fe66e82819d0092\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.2 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/iss...\n\n_Description has been truncated_","html_url":"https://github.com/ryouka0731/KeepingYouAwakeForWin/pull/5","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/ryouka0731%2FKeepingYouAwakeForWin/issues/5","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/5/packages"}},{"old_version":"55891bbd73f2425e97637d96e306fc9d491d0b21","new_version":"2d1146689b8cda280b9bc96326124645441f03bc","update_type":null,"path":null,"pr_created_at":"2026-10-19T09:06:39.000Z","version_change":"55891bbd73f2425e97637d96e306fc9d491d0b21 → 2d1146689b8cda280b9bc96326124645441f03bc","issue":{"uuid":"5920992754","node_id":"PR_kwDOM7wBS88AAAABJSp4RQ","number":125,"state":"open","title":"chore(deps): bump ossf/scorecard-action from 55891bbd73f2425e97637d96e306fc9d491d0b21 to 2d1146689b8cda280b9bc96326124645441f03bc","user":"dependabot[bot]","labels":["dependencies"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T09:06:39.000Z","updated_at":"2026-10-19T09:06:45.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps)","packages":[{"name":"ossf/scorecard-action","old_version":"55891bbd73f2425e97637d96e306fc9d491d0b21","new_version":"2d1146689b8cda280b9bc96326124645441f03bc","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 55891bbd73f2425e97637d96e306fc9d491d0b21 to 2d1146689b8cda280b9bc96326124645441f03bc.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/RELEASE.md\"\u003eossf/scorecard-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleasing the scorecard GitHub Action\u003c/h1\u003e\n\u003cp\u003eThis is a draft document to describe the release process for the scorecard\nGitHub Action.\u003c/p\u003e\n\u003cp\u003e(If there are improvements you'd like to see, please comment on the\n\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/33\"\u003etracking issue\u003c/a\u003e or issue a\npull request to discuss.)\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#tracking\"\u003eTracking\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#preparing-the-release\"\u003ePreparing the release\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#validate-the-action\"\u003eValidate the Action\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#update-the-scorecard-action-version\"\u003eUpdate the scorecard-action version\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#drafting-release-notes\"\u003eDrafting release notes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#release\"\u003eRelease\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#create-a-tag\"\u003eCreate a tag\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#create-a-github-release\"\u003eCreate a GitHub release\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#update-the-starter-workflow\"\u003eUpdate the starter workflow\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#announce\"\u003eAnnounce\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eTracking\u003c/h2\u003e\n\u003cp\u003eAs the first task, a Release Manager should open a tracking issue for the\nrelease.\u003c/p\u003e\n\u003cp\u003eWe don't currently have a template for releasing, but the following\n\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/97\"\u003eissue\u003c/a\u003e is a good example\nto draw inspiration from.\u003c/p\u003e\n\u003cp\u003eWe're not striving for perfection with the template, but the tracking issue\nwill serve as a reference point to aggregate feedback, so try your best to be\nas descriptive as possible.\u003c/p\u003e\n\u003ch2\u003ePreparing the release\u003c/h2\u003e\n\u003cp\u003eThis section covers changes that need to be issued as a pull request and should\nbe merged before releasing the scorecard GitHub Action.\u003c/p\u003e\n\u003ch3\u003eValidate the Action\u003c/h3\u003e\n\u003cp\u003eThe \u003ca href=\"https://github.com/ossf/scorecard-action/actions/workflows/postsubmits.yml\"\u003epostsubmits.yml\u003c/a\u003e\nworkflow runs on every push to \u003ccode\u003emain\u003c/code\u003e and weekly. It builds and pushes the\n\u003ccode\u003eghcr.io/ossf/scorecard-action:latest\u003c/code\u003e image, then runs Scorecard on this\nrepository with that image, uploading the SARIF and publishing the results.\u003c/p\u003e\n\u003cp\u003eConfirm that the \u003ccode\u003epostsubmits.yml\u003c/code\u003e run for the commit you plan to release\nsucceeded, including the Scorecard analysis job (no\n\u003ccode\u003eerror sending scorecard results\u003c/code\u003e line in its log). If there isn't one, run the\nworkflow manually.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/55891bbd73f2425e97637d96e306fc9d491d0b21...2d1146689b8cda280b9bc96326124645441f03bc\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/sebastienrousseau/metadata-gen/pull/125","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/sebastienrousseau%2Fmetadata-gen/issues/125","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/125/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-19T08:13:54.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5920281867","node_id":"PR_kwDOShNO_s8AAAABJSFhOg","number":101,"state":"closed","title":"build(deps): bump the actions group with 4 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":"2026-10-19T08:20:02.000Z","author_association":null,"state_reason":null,"created_at":"2026-10-19T08:13:54.000Z","updated_at":"2026-10-19T08:20:04.000Z","time_to_close":368,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"build(deps): bump","group_name":"actions","update_count":4,"packages":[{"name":"github/codeql-action/init","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action), [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) and [ossf/scorecard-action](https://github.com/ossf/scorecard-action).\n\nUpdates `github/codeql-action/init` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/hyperpolymath/llm-grace/pull/101","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/hyperpolymath%2Fllm-grace/issues/101","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/101/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-19T07:44:06.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5919903397","node_id":"PR_kwDOEANpXs8AAAABJRyT8Q","number":809,"state":"closed","title":"chore(deps): bump the minor-actions-dependencies group with 2 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-10-19T07:48:16.000Z","author_association":null,"state_reason":null,"created_at":"2026-10-19T07:44:06.000Z","updated_at":"2026-10-19T07:48:18.000Z","time_to_close":250,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"minor-actions-dependencies","update_count":2,"packages":[{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the minor-actions-dependencies group with 2 updates: [ossf/scorecard-action](https://github.com/ossf/scorecard-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/albertms10/music_notes/pull/809","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/albertms10%2Fmusic_notes/issues/809","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/809/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-19T07:38:15.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5919834333","node_id":"PR_kwDOSak_J88AAAABJRu11Q","number":258,"state":"open","title":"chore(deps): bump the github-actions group across 1 directory with 6 updates","user":"dependabot[bot]","labels":["area:tooling","dependencies","security","type:maintenance"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T07:38:15.000Z","updated_at":"2026-10-19T07:38:24.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"github-actions","update_count":6,"packages":[{"name":"actions/setup-node","old_version":"7.0.0","new_version":"7.1.0","repository_url":"https://github.com/actions/setup-node"},{"name":"actions/upload-artifact","old_version":"7.0.1","new_version":"7.0.2","repository_url":"https://github.com/actions/upload-artifact"},{"name":"github/codeql-action/init","old_version":"4.37.9","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.37.9","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.37.9","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 6 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` |\n| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.9` | `4.39.0` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.9` | `4.39.0` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.9` | `4.39.0` |\n\n\nUpdates `actions/setup-node` from 7.0.0 to 7.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/setup-node/releases\"\u003eactions/setup-node's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for mise.toml file by \u003ca href=\"https://github.com/gperdomor\"\u003e\u003ccode\u003e@​gperdomor\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1421\"\u003eactions/setup-node#1421\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport absolute paths in node-version-file by \u003ca href=\"https://github.com/v-mahabaleshwars\"\u003e\u003ccode\u003e@​v-mahabaleshwars\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1633\"\u003eactions/setup-node#1633\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug fixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Node version validation and manifest fetch retry by \u003ca href=\"https://github.com/v-jitenderpalsingh\"\u003e\u003ccode\u003e@​v-jitenderpalsingh\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1580\"\u003eactions/setup-node#1580\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation updates:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eREADME.md: bump actions/checkout to latest version 7 by \u003ca href=\"https://github.com/deining\"\u003e\u003ccode\u003e@​deining\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1578\"\u003eactions/setup-node#1578\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by \u003ca href=\"https://github.com/v-gowridurgad\"\u003e\u003ccode\u003e@​v-gowridurgad\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1593\"\u003eactions/setup-node#1593\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed cache recommendation syntax by \u003ca href=\"https://github.com/SubJunk\"\u003e\u003ccode\u003e@​SubJunk\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1603\"\u003eactions/setup-node#1603\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency updates:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate workflow pins and migrate Node matrices to modern versions by \u003ca href=\"https://github.com/v-HarithaVattikuti\"\u003e\u003ccode\u003e@​v-HarithaVattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1583\"\u003eactions/setup-node#1583\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1584\"\u003eactions/setup-node#1584\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin \u003ccode\u003e@​types/node\u003c/code\u003e to v24 by \u003ca href=\"https://github.com/v-priyagupta108\"\u003e\u003ccode\u003e@​v-priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1585\"\u003eactions/setup-node#1585\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOverride brace-expansion to 5.0.8 by \u003ca href=\"https://github.com/v-priyagupta108\"\u003e\u003ccode\u003e@​v-priyagupta108\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1599\"\u003eactions/setup-node#1599\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  actions/checkout from 7.0.0 to 7.0.1 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1598\"\u003eactions/setup-node#1598\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  prettier from 3.8.4 to 3.9.6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1590\"\u003eactions/setup-node#1590\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  \u003ccode\u003e@​vercel/ncc\u003c/code\u003e from 0.44.0 to 0.45.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1610\"\u003eactions/setup-node#1610\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  pnpm/action-setup from 6.0.9 to 6.0.10 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1602\"\u003eactions/setup-node#1602\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  baseline-browser-mapping from 2.10.38 to 2.11.22 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1629\"\u003eactions/setup-node#1629\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​types/semver\u003c/code\u003e from 7.7.1 to 7.8.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1616\"\u003eactions/setup-node#1616\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e from 8.62.0 to 8.70.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1615\"\u003eactions/setup-node#1615\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade pnpm/action-setup from 6.0.10 to 6.1.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1631\"\u003eactions/setup-node#1631\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade jest-each from 30.4.1 to 30.5.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1636\"\u003eactions/setup-node#1636\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade eslint-plugin-n from 18.1.0 to 18.3.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1638\"\u003eactions/setup-node#1638\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependencies and add license files by \u003ca href=\"https://github.com/v-HarithaVattikuti\"\u003e\u003ccode\u003e@​v-HarithaVattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1642\"\u003eactions/setup-node#1642\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1635\"\u003eactions/setup-node#1635\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/v-jitenderpalsingh\"\u003e\u003ccode\u003e@​v-jitenderpalsingh\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1580\"\u003eactions/setup-node#1580\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1584\"\u003eactions/setup-node#1584\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gperdomor\"\u003e\u003ccode\u003e@​gperdomor\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1421\"\u003eactions/setup-node#1421\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SubJunk\"\u003e\u003ccode\u003e@​SubJunk\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1603\"\u003eactions/setup-node#1603\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-node/compare/v7.0.0...v7.1.0\"\u003ehttps://github.com/actions/setup-node/compare/v7.0.0...v7.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/949feb2413d6458794dcd2491c4babbbce0c15c1\"\u003e\u003ccode\u003e949feb2\u003c/code\u003e\u003c/a\u003e Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1635\"\u003e#1635\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/7207c4f1189c7ee83ddf20c7c68bd1af6fdd751c\"\u003e\u003ccode\u003e7207c4f\u003c/code\u003e\u003c/a\u003e chore: update dependencies and add license files (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1642\"\u003e#1642\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/54337e0d02de9202d0948aaff36ad556375497b9\"\u003e\u003ccode\u003e54337e0\u003c/code\u003e\u003c/a\u003e Bump eslint-plugin-n from 18.1.0 to 18.3.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1638\"\u003e#1638\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/fb54fa8c14c63410cc752f0ae3b7b3ca6af161fc\"\u003e\u003ccode\u003efb54fa8\u003c/code\u003e\u003c/a\u003e Bump jest-each from 30.4.1 to 30.5.2 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1636\"\u003e#1636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/7f84f1d52d0c56afb45c62fee31a93b843cea4d6\"\u003e\u003ccode\u003e7f84f1d\u003c/code\u003e\u003c/a\u003e Bump pnpm/action-setup from 6.0.10 to 6.1.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1631\"\u003e#1631\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/0c54c7b07420dcba69a7d832587f55ebdf771c9e\"\u003e\u003ccode\u003e0c54c7b\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e from 8.62.0 to 8.70.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1615\"\u003e#1615\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/a8294190049a9c296f01b9a432aff41dd83d8284\"\u003e\u003ccode\u003ea829419\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​types/semver\u003c/code\u003e from 7.7.1 to 7.8.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1616\"\u003e#1616\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/680d1e489b82f1243de15bc7665c0007e3c9a860\"\u003e\u003ccode\u003e680d1e4\u003c/code\u003e\u003c/a\u003e Support absolute paths in node-version-file (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1633\"\u003e#1633\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/db0fb3a98ed314b69026b6e8c9be26a7e2fe65a8\"\u003e\u003ccode\u003edb0fb3a\u003c/code\u003e\u003c/a\u003e Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1629\"\u003e#1629\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/94196ee1d15439c1b6651cd87ef14e88ec435966\"\u003e\u003ccode\u003e94196ee\u003c/code\u003e\u003c/a\u003e Bump pnpm/action-setup from 6.0.9 to 6.0.10 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1602\"\u003e#1602\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-artifact` from 7.0.1 to 7.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdates \u003ccode\u003e@​actions/artifact\u003c/code\u003e to v6.3.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/821\"\u003eactions/upload-artifact#821\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\"\u003ehttps://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003e\u003ccode\u003ecf430e0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/822\"\u003e#822\u003c/a\u003e from actions/tunc-d-prepare-upload-v7-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469\"\u003e\u003ccode\u003ec2acded\u003c/code\u003e\u003c/a\u003e chore: prepare v7.0.2 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a\"\u003e\u003ccode\u003e4687c1b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/821\"\u003e#821\u003c/a\u003e from actions/tunc-d-upload-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719\"\u003e\u003ccode\u003e8cbe1be\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from 4.37.9 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.37.9 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.37.9 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/LMLiam/Casino-Warehouse/pull/258","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/LMLiam%2FCasino-Warehouse/issues/258","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/258/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-19T07:28:38.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5919719372","node_id":"PR_kwDOQhWFBM8AAAABJRpDJg","number":75,"state":"open","title":"chore(deps): bump the actions group across 1 directory with 5 updates","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T07:28:38.000Z","updated_at":"2026-10-19T07:28:42.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"actions","update_count":5,"packages":[{"name":"helm/chart-testing-action","old_version":"2.8.0","new_version":"2.9.0","repository_url":"https://github.com/helm/chart-testing-action"},{"name":"actions/upload-artifact","old_version":"7.0.1","new_version":"7.0.2","repository_url":"https://github.com/actions/upload-artifact"},{"name":"dorny/test-reporter","old_version":"3.0.0","new_version":"3.2.0","repository_url":"https://github.com/dorny/test-reporter"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.37.9","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the actions group with 5 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [helm/chart-testing-action](https://github.com/helm/chart-testing-action) | `2.8.0` | `2.9.0` |\n| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |\n| [dorny/test-reporter](https://github.com/dorny/test-reporter) | `3.0.0` | `3.2.0` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.9` | `4.39.0` |\n\n\nUpdates `helm/chart-testing-action` from 2.8.0 to 2.9.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/helm/chart-testing-action/releases\"\u003ehelm/chart-testing-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.9.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: \u003ccode\u003euv_version\u003c/code\u003e to pin \u003ccode\u003euv\u003c/code\u003e by \u003ca href=\"https://github.com/jmelahman\"\u003e\u003ccode\u003e@​jmelahman\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/194\"\u003ehelm/chart-testing-action#194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the actions group across 1 directory with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/199\"\u003ehelm/chart-testing-action#199\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix typo in permissions section of README by \u003ca href=\"https://github.com/MrLuje\"\u003e\u003ccode\u003e@​MrLuje\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/187\"\u003ehelm/chart-testing-action#187\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: remove outdated defaults from action.yml by \u003ca href=\"https://github.com/pmalek\"\u003e\u003ccode\u003e@​pmalek\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/197\"\u003ehelm/chart-testing-action#197\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 5.0.0 to 6.0.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/200\"\u003ehelm/chart-testing-action#200\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump sigstore/cosign-installer from 4.0.0 to 4.1.1 in the actions group across 1 directory by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/207\"\u003ehelm/chart-testing-action#207\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add github_token input for setup-uv action by \u003ca href=\"https://github.com/fty4\"\u003e\u003ccode\u003e@​fty4\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/204\"\u003ehelm/chart-testing-action#204\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the actions group across 1 directory with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/221\"\u003ehelm/chart-testing-action#221\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 6.0.2 to 7.0.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/217\"\u003ehelm/chart-testing-action#217\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump azure/setup-helm from 4.3.1 to 5.0.1 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/216\"\u003ehelm/chart-testing-action#216\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump astral-sh/setup-uv from 7.3.0 to 10.1.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/223\"\u003ehelm/chart-testing-action#223\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 7.0.0 to 7.0.1 in the actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/222\"\u003ehelm/chart-testing-action#222\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/setup-python from 6.2.0 to 7.0.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/224\"\u003ehelm/chart-testing-action#224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: report a clear error when chart-testing blob verification fails by \u003ca href=\"https://github.com/somaz94\"\u003e\u003ccode\u003e@​somaz94\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/210\"\u003ehelm/chart-testing-action#210\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: do not let a stale cache directory suppress signature verification by \u003ca href=\"https://github.com/cpanato\"\u003e\u003ccode\u003e@​cpanato\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/228\"\u003ehelm/chart-testing-action#228\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: pass version inputs via env to prevent expression injection by \u003ca href=\"https://github.com/cpanato\"\u003e\u003ccode\u003e@​cpanato\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/225\"\u003ehelm/chart-testing-action#225\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: add concurrency group and rename workflow to .yaml by \u003ca href=\"https://github.com/cpanato\"\u003e\u003ccode\u003e@​cpanato\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/227\"\u003ehelm/chart-testing-action#227\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: harden test-action workflow permissions and pin kind-action by \u003ca href=\"https://github.com/cpanato\"\u003e\u003ccode\u003e@​cpanato\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/226\"\u003ehelm/chart-testing-action#226\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/229\"\u003ehelm/chart-testing-action#229\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add lint_config input for custom yamllint rules by \u003ca href=\"https://github.com/Bisman-Singh\"\u003e\u003ccode\u003e@​Bisman-Singh\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/208\"\u003ehelm/chart-testing-action#208\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: document testing charts with CRDs by \u003ca href=\"https://github.com/SyedAsadRazaDevops\"\u003e\u003ccode\u003e@​SyedAsadRazaDevops\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/211\"\u003ehelm/chart-testing-action#211\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erun test-action workflow on push by \u003ca href=\"https://github.com/adoroszlai\"\u003e\u003ccode\u003e@​adoroszlai\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/212\"\u003ehelm/chart-testing-action#212\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: add Helm security policy by \u003ca href=\"https://github.com/cpanato\"\u003e\u003ccode\u003e@​cpanato\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/231\"\u003ehelm/chart-testing-action#231\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add option to disable blob verification by \u003ca href=\"https://github.com/fty4\"\u003e\u003ccode\u003e@​fty4\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/205\"\u003ehelm/chart-testing-action#205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: update chart-testing to v3.15.0 and add stale workflow by \u003ca href=\"https://github.com/cpanato\"\u003e\u003ccode\u003e@​cpanato\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/230\"\u003ehelm/chart-testing-action#230\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump helm/kind-action from 1.15.0 to 1.15.1 in the actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/232\"\u003ehelm/chart-testing-action#232\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jmelahman\"\u003e\u003ccode\u003e@​jmelahman\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/194\"\u003ehelm/chart-testing-action#194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MrLuje\"\u003e\u003ccode\u003e@​MrLuje\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/187\"\u003ehelm/chart-testing-action#187\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pmalek\"\u003e\u003ccode\u003e@​pmalek\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/197\"\u003ehelm/chart-testing-action#197\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/somaz94\"\u003e\u003ccode\u003e@​somaz94\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/210\"\u003ehelm/chart-testing-action#210\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Bisman-Singh\"\u003e\u003ccode\u003e@​Bisman-Singh\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/208\"\u003ehelm/chart-testing-action#208\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SyedAsadRazaDevops\"\u003e\u003ccode\u003e@​SyedAsadRazaDevops\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/211\"\u003ehelm/chart-testing-action#211\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/adoroszlai\"\u003e\u003ccode\u003e@​adoroszlai\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/helm/chart-testing-action/pull/212\"\u003ehelm/chart-testing-action#212\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/helm/chart-testing-action/compare/v2.8.0...v2.9.0\"\u003ehttps://github.com/helm/chart-testing-action/compare/v2.8.0...v2.9.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/720270857a28afd41e2426521a7801db09e9b510\"\u003e\u003ccode\u003e7202708\u003c/code\u003e\u003c/a\u003e chore(deps): bump helm/kind-action (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/232\"\u003e#232\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/e0d1bffb66ff462eae4c44324c93ba60e0763adf\"\u003e\u003ccode\u003ee0d1bff\u003c/code\u003e\u003c/a\u003e chore: update chart-testing to v3.15.0 and add stale workflow (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/230\"\u003e#230\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/2d601b3d6fb1811ad1a0480edf4b0dcaf2190aa2\"\u003e\u003ccode\u003e2d601b3\u003c/code\u003e\u003c/a\u003e feat: add option to disable blob verification (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/205\"\u003e#205\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/4b9e8ccd8d870c94667aec5e4ef54cc49934cd85\"\u003e\u003ccode\u003e4b9e8cc\u003c/code\u003e\u003c/a\u003e docs: add Helm security policy (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/231\"\u003e#231\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/bd218c7c4310ef8db9044990904e83df20fd531c\"\u003e\u003ccode\u003ebd218c7\u003c/code\u003e\u003c/a\u003e run test-action on push (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/212\"\u003e#212\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/67af79847b7c402a72dbdf2c3e6de58f7cf419ca\"\u003e\u003ccode\u003e67af798\u003c/code\u003e\u003c/a\u003e docs: document testing charts with CRDs (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/211\"\u003e#211\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/05d54e3c5a2b2a918816e737212dfecd32d30d40\"\u003e\u003ccode\u003e05d54e3\u003c/code\u003e\u003c/a\u003e feat: add lint_config input for custom yamllint rules (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/208\"\u003e#208\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/45557e3b936dc26f6136cc60c523cecf92b89513\"\u003e\u003ccode\u003e45557e3\u003c/code\u003e\u003c/a\u003e Bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the actions group (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/229\"\u003e#229\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/f3ef15d8179cc3d72028604dfbf96178583a50a2\"\u003e\u003ccode\u003ef3ef15d\u003c/code\u003e\u003c/a\u003e chore: harden test-action workflow permissions and pin kind-action (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/226\"\u003e#226\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/helm/chart-testing-action/commit/a9ff2fad6544850f07502c12733a4f3d08d3a974\"\u003e\u003ccode\u003ea9ff2fa\u003c/code\u003e\u003c/a\u003e chore: add concurrency group and rename workflow to .yaml (\u003ca href=\"https://redirect.github.com/helm/chart-testing-action/issues/227\"\u003e#227\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/helm/chart-testing-action/compare/6ec842c01de15ebb84c8627d2744a0c2f2755c9f...720270857a28afd41e2426521a7801db09e9b510\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-artifact` from 7.0.1 to 7.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdates \u003ccode\u003e@​actions/artifact\u003c/code\u003e to v6.3.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/821\"\u003eactions/upload-artifact#821\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\"\u003ehttps://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003e\u003ccode\u003ecf430e0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/822\"\u003e#822\u003c/a\u003e from actions/tunc-d-prepare-upload-v7-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469\"\u003e\u003ccode\u003ec2acded\u003c/code\u003e\u003c/a\u003e chore: prepare v7.0.2 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a\"\u003e\u003ccode\u003e4687c1b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/821\"\u003e#821\u003c/a\u003e from actions/tunc-d-upload-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719\"\u003e\u003ccode\u003e8cbe1be\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `dorny/test-reporter` from 3.0.0 to 3.2.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/dorny/test-reporter/blob/main/CHANGELOG.md\"\u003edorny/test-reporter's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003e3.2.0\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix: \u003ccode\u003edotnet-trx\u003c/code\u003e reports unmapped test outcomes and aborted test runs as failures \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/825\"\u003edorny/test-reporter#825\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix: report test cases from nested \u003c!-- raw HTML omitted --\u003e elements in \u003ccode\u003ejava-junit\u003c/code\u003e reporter \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/840\"\u003edorny/test-reporter#840\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.1.0\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003elist-files\u003c/code\u003e input to control test report file listing \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/773\"\u003edorny/test-reporter#773\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003esummary_file\u003c/code\u003e output with the path to the generated summary in Markdown format \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/772\"\u003edorny/test-reporter#772\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Unreal Engine JSON reporter support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve PHPUnit exception types when the failure body does not contain a typed line.\u003c/li\u003e\n\u003cli\u003eParse Jest JUnit failures that provide failure attributes without a failure body.\u003c/li\u003e\n\u003cli\u003eEscape pipe characters in Markdown table cells.\u003c/li\u003e\n\u003cli\u003eDecode report files before parsing and handle byte-order marks correctly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaintenance and security\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate dependencies and rebuild the distribution to include security fixes and current tooling.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFeature: Use NodeJS 24 LTS as default runtime \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/738\"\u003edorny/test-reporter#738\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFeature: Add \u003ccode\u003eslug-prefix\u003c/code\u003e output for link anchors \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/731\"\u003edorny/test-reporter#731\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFeature: Report \u003ccode\u003ejest-junit\u003c/code\u003e testsuite errors as failures \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/155\"\u003edorny/test-reporter#155\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSecurity: Update dependencies to fix reported security vulnerabilities\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix: For \u003ccode\u003eworkflow_run\u003c/code\u003e events, resolve the commit of the check run from related pull request head commits first (matching \u003ccode\u003eworkflow_run.head_branch\u003c/code\u003e, then first PR), and fall back to \u003ccode\u003eworkflow_run.head_sha\u003c/code\u003e for non-PR runs \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/673\"\u003edorny/test-reporter#673\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eChange: The \u003ccode\u003etest-reporter\u003c/code\u003e action will listed all artifacts associated with the build run \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/693\"\u003edorny/test-reporter#693\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMaintenance: Upgrade to ESLint v9 \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/629\"\u003edorny/test-reporter#629\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.5.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFeature: Add Nette Tester support with \u003ccode\u003etester-junit\u003c/code\u003e reporter \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/707\"\u003edorny/test-reporter#707\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMaintenance: Bump actions/upload-artifact from 5 to 6 \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/695\"\u003edorny/test-reporter#695\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.4.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFeature: Add PHPUnit support with JUnit XML dialect parser \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/422\"\u003edorny/test-reporter#422\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFeature: Add JUnit XML sample files and tests for validation \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/701\"\u003edorny/test-reporter#701\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix: Refactor deprecated \u003ccode\u003eString.substr()\u003c/code\u003e function to use \u003ccode\u003eString.substring()\u003c/code\u003e \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/704\"\u003edorny/test-reporter#704\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFeature: Add Python support with \u003ccode\u003epython-xunit\u003c/code\u003e reporter (pytest) \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/643\"\u003edorny/test-reporter#643\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFeature: Add pytest traceback parsing and \u003ccode\u003edirectory-mapping\u003c/code\u003e option \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/238\"\u003edorny/test-reporter#238\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePerformance: Update sax.js to fix large XML file parsing \u003ca href=\"https://redirect.github.com/dorny/test-reporter/pull/681\"\u003edorny/test-reporter#681\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/d1b5dff021aa968b288b02285a8bf47471c5928a\"\u003e\u003ccode\u003ed1b5dff\u003c/code\u003e\u003c/a\u003e test-reporter release v3.2.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/aa2d703c08ef79f4a13b6b944885e757cc2bd687\"\u003e\u003ccode\u003eaa2d703\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/dorny/test-reporter/issues/840\"\u003e#840\u003c/a\u003e from keith-lueneburg/fix/junit-nested-testsuites\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/be1e6af3b6f0247ca8523d52c4fa56c21fd907b3\"\u003e\u003ccode\u003ebe1e6af\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/dorny/test-reporter/issues/842\"\u003e#842\u003c/a\u003e from dorny/dependabot/npm_and_yarn/reports/jest/multi...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/79718dcaaae3b6e11f621a35ac9a127a4c0256d2\"\u003e\u003ccode\u003e79718dc\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/dorny/test-reporter/issues/825\"\u003e#825\u003c/a\u003e from CTWalk/fix/dotnet-trx-unmapped-outcomes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/98640f9fdf91478704a357b87dfdf292d624c7eb\"\u003e\u003ccode\u003e98640f9\u003c/code\u003e\u003c/a\u003e fix(dotnet-trx): treat a Warning run outcome as a clean run\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/186413b9aad57244ef29ed807432d8d821af062b\"\u003e\u003ccode\u003e186413b\u003c/code\u003e\u003c/a\u003e fix(dotnet-trx): report unmapped outcomes and aborted runs as failures\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/c5f7127dc95ed3cba6cc223314416a5a50dc23f1\"\u003e\u003ccode\u003ec5f7127\u003c/code\u003e\u003c/a\u003e chore(deps): bump brace-expansion in /reports/jest\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/53f83686b9756940da8bb936cea68050c38f1026\"\u003e\u003ccode\u003e53f8368\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/dorny/test-reporter/issues/841\"\u003e#841\u003c/a\u003e from dorny/dependabot/npm_and_yarn/typescript-eslint/...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/edc93d264fc36765b2d24974cca43b6dc66cd023\"\u003e\u003ccode\u003eedc93d2\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e from 8.70.1 to 8.71.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dorny/test-reporter/commit/1896380dca5565b7f5bbe81238b8716dc2a49bc4\"\u003e\u003ccode\u003e1896380\u003c/code\u003e\u003c/a\u003e Rebuild the \u003ccode\u003edist/index.js\u003c/code\u003e file\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/dorny/test-reporter/compare/a43b3a5f7366b97d083190328d2c652e1a8b6aa2...d1b5dff021aa968b288b02285a8bf47471c5928a\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.37.9 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/redevops-io/ingress-nginx/pull/75","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/redevops-io%2Fingress-nginx/issues/75","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/75/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-19T06:43:01.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5919150654","node_id":"PR_kwDOSA9Zas8AAAABJRLr7w","number":65,"state":"open","title":"ci: bump ossf/scorecard-action from 2.4.4 to 2.5.0","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T06:43:01.000Z","updated_at":"2026-10-19T06:43:04.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci","packages":[{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ossf/scorecard-action\u0026package-manager=github_actions\u0026previous-version=2.4.4\u0026new-version=2.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/markcassidyconsulting/ordercloud-python/pull/65","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/markcassidyconsulting%2Fordercloud-python/issues/65","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/65/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-19T04:50:24.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5918012990","node_id":"PR_kwDOOZYHO88AAAABJQRpqg","number":2882,"state":"open","title":"chore(deps): Bump the all-minors group across 1 directory with 3 updates","user":"dependabot[bot]","labels":["github-actions","github_actions","ai-copilot"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T04:50:24.000Z","updated_at":"2026-10-19T04:53:53.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): Bump","group_name":"all-minors","update_count":3,"packages":[{"name":"github/gh-aw/actions/setup-cli","old_version":"0.89.21","new_version":"0.91.3","repository_url":"https://github.com/github/gh-aw"},{"name":"google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml","old_version":"2.6.0","new_version":"2.7.0","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the all-minors group with 3 updates in the / directory: [github/gh-aw/actions/setup-cli](https://github.com/github/gh-aw), [google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml](https://github.com/google/osv-scanner-action) and [ossf/scorecard-action](https://github.com/ossf/scorecard-action).\n\nUpdates `github/gh-aw/actions/setup-cli` from 0.89.21 to 0.91.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/gh-aw/releases\"\u003egithub/gh-aw/actions/setup-cli's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.91.2\u003c/h2\u003e\n\u003ch2\u003e🌟 Release Highlights\u003c/h2\u003e\n\u003cp\u003eThis release deepens observability with richer unified agent sessions, and hardens security around secret masking, post-steps, and package scanning.\u003c/p\u003e\n\u003ch3\u003e✨ What's New\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eRicher unified agent sessions\u003c/strong\u003e: sessions now include split prompts, GitHub API rate limits, and daily AIC decisions, with estimated credits clearly distinguished from recorded usage.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDynamic workflow smoke coverage\u003c/strong\u003e: new smoke tests for dynamic workflows (including Claude) and opt-in engine defaults.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eWildcard GitHub App repositories\u003c/strong\u003e are now allowed explicitly in strict mode.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e🐛 Bug Fixes \u0026amp; Improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e: post-steps can no longer create issues directly or access safe-outputs; package resource scanning is file-aware; artifact redaction covers regex-shaped MCP gateway masks; non-writable files are prepared for custom secret masking.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eEngines\u003c/strong\u003e: Pi codemode compatibility and reasoning configuration fixed; Codex code-mode exec disabled for GitHub inference; pinned Node.js versions honored in detection and evals jobs.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReliability\u003c/strong\u003e: transient issue-listing failures are retried when publishing essential issues; Copilot session summary fallbacks fixed.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReporting\u003c/strong\u003e: engine conversation reports are cleaner with collapsed streamed messages; structured data in safe-output issues is collapsed.\u003c/li\u003e\n\u003cli\u003eMCP gateway updated to v0.4.29.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cblockquote\u003e\n\u003cp\u003eGenerated by \u003ca href=\"https://github.com/github/gh-aw/actions/runs/37504185059\"\u003e🚀 Release\u003c/a\u003e · copilot · auto · 15.1 AIC · ⊞ 11.6K\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003chr /\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e[docs] docs: unbloat sharing-workflows.md by \u003ca href=\"https://github.com/github-actions\"\u003e\u003ccode\u003e@​github-actions\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/65973\"\u003egithub/gh-aw#65973\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix Copilot session summary source fallbacks by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/65979\"\u003egithub/gh-aw#65979\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump source-map-js from 1.2.1 to 1.2.2 in /eslint-factory in the npm_and_yarn group across 1 directory by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/65980\"\u003egithub/gh-aw#65980\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the npm_and_yarn group across 1 directory with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/65983\"\u003egithub/gh-aw#65983\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the npm_and_yarn group across 1 directory with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/65981\"\u003egithub/gh-aw#65981\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[community] Update community contributions in README by \u003ca href=\"https://github.com/github-actions\"\u003e\u003ccode\u003e@​github-actions\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/65994\"\u003egithub/gh-aw#65994\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eInclude split prompts in the unified agent session by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66011\"\u003egithub/gh-aw#66011\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: collapse structured data in safe-output issues by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66025\"\u003egithub/gh-aw#66025\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMake package resource security scanning file-aware by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/65961\"\u003egithub/gh-aw#65961\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eHonor pinned Node.js versions in detection and evals jobs by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66040\"\u003egithub/gh-aw#66040\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCover regex-shaped MCP gateway masks in artifact redaction by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66041\"\u003egithub/gh-aw#66041\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eInclude GitHub API rate limits in unified agent sessions by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66047\"\u003egithub/gh-aw#66047\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[spec-enforcer] Enforce specifications for ctxutil, envutil, errorutil by \u003ca href=\"https://github.com/github-actions\"\u003e\u003ccode\u003e@​github-actions\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66106\"\u003egithub/gh-aw#66106\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix engine conversation reports and collapse streamed messages by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66048\"\u003egithub/gh-aw#66048\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDistinguish estimated credits from recorded daily AIC usage by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66043\"\u003egithub/gh-aw#66043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAllow explicit wildcard GitHub App repositories in strict mode by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66039\"\u003egithub/gh-aw#66039\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[WIP] Fix compiled lock files and zizmor pedantic audit issues by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66042\"\u003egithub/gh-aw#66042\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[spec-extractor] Update package specifications for agentdrain, cli, console, constants by \u003ca href=\"https://github.com/github-actions\"\u003e\u003ccode\u003e@​github-actions\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66085\"\u003egithub/gh-aw#66085\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump golang.org/x/tools from 0.50.0 to 0.51.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66087\"\u003egithub/gh-aw#66087\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump prettier from 3.9.8 to 3.9.9 in /actions/setup/js by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66088\"\u003egithub/gh-aw#66088\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRetry transient issue-listing failures in essential issue publishing by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66123\"\u003egithub/gh-aw#66123\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRefresh workflow pins and bundle Dependabot updates by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66124\"\u003egithub/gh-aw#66124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[ci-coach] Fix failing pkg/workflow unit tests (stale goldens and expectations) by \u003ca href=\"https://github.com/github-actions\"\u003e\u003ccode\u003e@​github-actions\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66180\"\u003egithub/gh-aw#66180\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRecord daily AIC decisions in unified sessions by \u003ca href=\"https://github.com/pelikhan\"\u003e\u003ccode\u003e@​pelikhan\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66126\"\u003egithub/gh-aw#66126\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump starlight-github-alerts from 0.4.0 to 0.5.0 in /docs by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66093\"\u003egithub/gh-aw#66093\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mermaid from 12.0.0 to 12.1.0 in /docs by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/github/gh-aw/pull/66091\"\u003egithub/gh-aw#66091\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/382f4b025fefaa7d6b2492c3608f098340bf6536\"\u003e\u003ccode\u003e382f4b0\u003c/code\u003e\u003c/a\u003e Render failure diagnostics safely with progressive disclosure (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66292\"\u003e#66292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/37c0b1980ec9ce6acbc42681e7e3da736a2b39d9\"\u003e\u003ccode\u003e37c0b19\u003c/code\u003e\u003c/a\u003e Add development compilation and local-first workflow debugging (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66270\"\u003e#66270\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/3fd44f8dc17a5fcdc45f653e7826853456b1839e\"\u003e\u003ccode\u003e3fd44f8\u003c/code\u003e\u003c/a\u003e Separate routing candidates from sub-agent model policy (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66234\"\u003e#66234\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/0d0a4b854ca46614353f8b40b76de3a6724499f8\"\u003e\u003ccode\u003e0d0a4b8\u003c/code\u003e\u003c/a\u003e Resolve post-agent usage paths on ARC/DinD runners (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66223\"\u003e#66223\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/401a4f2df34eaa84aa801b202b58efadfc9acad9\"\u003e\u003ccode\u003e401a4f2\u003c/code\u003e\u003c/a\u003e Bump gh-aw-mcpg to v0.4.29 (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66246\"\u003e#66246\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/02e6afb14c6eebdc278c1cf7a2bbffe2852421fa\"\u003e\u003ccode\u003e02e6afb\u003c/code\u003e\u003c/a\u003e [linter-miner] Add reflect-deepequal-usage linter (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66239\"\u003e#66239\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/7a5aaccea7ee9620214fe4f9f38451f2f9c89512\"\u003e\u003ccode\u003e7a5aacc\u003c/code\u003e\u003c/a\u003e Fix embedded session parser dependencies and post-step CI expectation (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66243\"\u003e#66243\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/9a631f399d77d17a7da4adadaf0760accca2547e\"\u003e\u003ccode\u003e9a631f3\u003c/code\u003e\u003c/a\u003e Fix CI redaction assertion and remove unauthorized CGO coverage upload (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66235\"\u003e#66235\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/ffc93b2f3118eae982d395381bdcd81cf8e1fc67\"\u003e\u003ccode\u003effc93b2\u003c/code\u003e\u003c/a\u003e Add dynamic workflow smoke and opt-in engine defaults (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66195\"\u003e#66195\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/gh-aw/commit/ea26db6a5beb68ae37d97613f3e9c7923d92d515\"\u003e\u003ccode\u003eea26db6\u003c/code\u003e\u003c/a\u003e Add Claude dynamic workflow smoke coverage and unified task events (\u003ca href=\"https://redirect.github.com/github/gh-aw/issues/66208\"\u003e#66208\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/gh-aw/compare/c35393777e5604a63721d09512263b1383301d4f...382f4b025fefaa7d6b2492c3608f098340bf6536\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml` from 2.6.0 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.7.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate github/codeql-action action to v4.38.0 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/143\"\u003egoogle/osv-scanner-action#143\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate to v2.7.0 by \u003ca href=\"https://github.com/michaelkedar\"\u003e\u003ccode\u003e@​michaelkedar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/146\"\u003egoogle/osv-scanner-action#146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.6.0...v2.7.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.6.0...v2.7.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b1d267aea5211fa648d9d442fa64b90dbdcbdd36\"\u003e\u003ccode\u003eb1d267a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/146\"\u003e#146\u003c/a\u003e from google/update-to-v2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/2b1cfc6d0e3941f549908be1c5671b5d7625ebc0\"\u003e\u003ccode\u003e2b1cfc6\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.7.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/ef6dfdf01765802d5a8dbc3c39852a6128b00af0\"\u003e\u003ccode\u003eef6dfdf\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.7.0 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0a65f82af05cd58cf587827b0bb0489548c18346\"\u003e\u003ccode\u003e0a65f82\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.7.0 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8ac9e5ce44cc7178e0e04229a91bdcc003166e57\"\u003e\u003ccode\u003e8ac9e5c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/143\"\u003e#143\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3b06fbb744e4192b7d47b4f2584715a21ef88b92\"\u003e\u003ccode\u003e3b06fbb\u003c/code\u003e\u003c/a\u003e Update github/codeql-action action to v4.38.0\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/a345acffa64b0eaede81a3d9aae6141214d9c8fc...b1d267aea5211fa648d9d442fa64b90dbdcbdd36\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/intrafind/ihub-apps/pull/2882","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/intrafind%2Fihub-apps/issues/2882","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2882/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-19T04:40:54.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5917920066","node_id":"PR_kwDOR7d3nc8AAAABJQM1hQ","number":9,"state":"open","title":"ci(deps): bump the actions group with 5 updates","user":"dependabot[bot]","labels":["dependencies"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T04:40:54.000Z","updated_at":"2026-10-19T04:41:02.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci(deps): bump","group_name":"actions","update_count":5,"packages":[{"name":"goreleaser/goreleaser-action","old_version":"7.2.3","new_version":"7.3.0","repository_url":"https://github.com/goreleaser/goreleaser-action"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.2","new_version":"4.38.3","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/init","old_version":"4.38.2","new_version":"4.38.3","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.38.2","new_version":"4.38.3","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the actions group with 5 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `7.2.3` | `7.3.0` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |\n\nUpdates `goreleaser/goreleaser-action` from 7.2.3 to 7.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/goreleaser/goreleaser-action/releases\"\u003egoreleaser/goreleaser-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/570\"\u003egoreleaser/goreleaser-action#570\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/571\"\u003egoreleaser/goreleaser-action#571\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/575\"\u003egoreleaser/goreleaser-action#575\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/574\"\u003egoreleaser/goreleaser-action#574\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump undici from 6.27.0 to 6.28.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/576\"\u003egoreleaser/goreleaser-action#576\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump js-yaml from 5.2.2 to 5.2.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/573\"\u003egoreleaser/goreleaser-action#573\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump js-yaml from 5.2.3 to 5.4.1 in the npm group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/578\"\u003egoreleaser/goreleaser-action#578\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: reuse the goreleaser binary from the runner tool cache by \u003ca href=\"https://github.com/caarlos0\"\u003e\u003ccode\u003e@​caarlos0\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/577\"\u003egoreleaser/goreleaser-action#577\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 in the actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/581\"\u003egoreleaser/goreleaser-action#581\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump undici from 6.28.0 to 6.29.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/579\"\u003egoreleaser/goreleaser-action#579\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/580\"\u003egoreleaser/goreleaser-action#580\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/v7.2.3...v7.3.0\"\u003ehttps://github.com/goreleaser/goreleaser-action/compare/v7.2.3...v7.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/a4f02ab5355a589de60d917a659ce617ed19b3de\"\u003e\u003ccode\u003ea4f02ab\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/e27eb7769180b733cf28959f093582ddda91972e\"\u003e\u003ccode\u003ee27eb77\u003c/code\u003e\u003c/a\u003e chore(deps): bump the npm group with 2 updates (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/580\"\u003e#580\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/f5b4e31ee483102e19b17e532f024e8aee22d4fe\"\u003e\u003ccode\u003ef5b4e31\u003c/code\u003e\u003c/a\u003e chore(deps): bump undici from 6.28.0 to 6.29.0 (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/579\"\u003e#579\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/2d42c26fe04ca60644a41f10407c30998bc2f770\"\u003e\u003ccode\u003e2d42c26\u003c/code\u003e\u003c/a\u003e ci(deps): bump codecov/codecov-action (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/581\"\u003e#581\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/73cd4ffe39ceae11aafd47343ff35e8be087f14c\"\u003e\u003ccode\u003e73cd4ff\u003c/code\u003e\u003c/a\u003e feat: reuse the goreleaser binary from the runner tool cache (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/577\"\u003e#577\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/97a960754774e271e3eb4f389fe9b73400f2158c\"\u003e\u003ccode\u003e97a9607\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/689e48f9ac97190a2d170ebe29f3aed1a694464b\"\u003e\u003ccode\u003e689e48f\u003c/code\u003e\u003c/a\u003e chore(deps): bump js-yaml from 5.2.3 to 5.4.1 in the npm group (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/578\"\u003e#578\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/7e6b514c508941c26e8772ba9b920d0677e2160e\"\u003e\u003ccode\u003e7e6b514\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/4ec11830b6b44bb4bef0db5ddd7e04844da5519e\"\u003e\u003ccode\u003e4ec1183\u003c/code\u003e\u003c/a\u003e chore(deps): bump js-yaml from 5.2.2 to 5.2.3 (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/573\"\u003e#573\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/59060fdcfdbbfd4c87d837ab2c489d635c18f843\"\u003e\u003ccode\u003e59060fd\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/f06c13b6b1a9625abc9e6e439d9c05a8f2190e94...a4f02ab5355a589de60d917a659ce617ed19b3de\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003e\u003ccode\u003e24c5418\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4214\"\u003e#4214\u003c/a\u003e from github/update-v4.38.3-e0b52dbdc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8\"\u003e\u003ccode\u003e69e87c5\u003c/code\u003e\u003c/a\u003e Add changelog note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa\"\u003e\u003ccode\u003e23b6828\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b\"\u003e\u003ccode\u003ee0b52db\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4210\"\u003e#4210\u003c/a\u003e from github/henrymercer/pin-python-for-older-clis-in-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc\"\u003e\u003ccode\u003e6b99698\u003c/code\u003e\u003c/a\u003e Pin Python 3.13.15 for older CLI versions in multi-language check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8\"\u003e\u003ccode\u003e63d3d63\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4203\"\u003e#4203\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe\"\u003e\u003ccode\u003e7377a10\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524\"\u003e\u003ccode\u003ec1a30cd\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974\"\u003e\u003ccode\u003ed208ec7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4200\"\u003e#4200\u003c/a\u003e from github/mbg/esm/migrate-pr-checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845\"\u003e\u003ccode\u003ea71b0c6\u003c/code\u003e\u003c/a\u003e Replace \u003ccode\u003e__dirname\u003c/code\u003e in \u003ccode\u003esync.ts\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from 4.38.2 to 4.38.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003e\u003ccode\u003e24c5418\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4214\"\u003e#4214\u003c/a\u003e from github/update-v4.38.3-e0b52dbdc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8\"\u003e\u003ccode\u003e69e87c5\u003c/code\u003e\u003c/a\u003e Add changelog note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa\"\u003e\u003ccode\u003e23b6828\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b\"\u003e\u003ccode\u003ee0b52db\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4210\"\u003e#4210\u003c/a\u003e from github/henrymercer/pin-python-for-older-clis-in-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc\"\u003e\u003ccode\u003e6b99698\u003c/code\u003e\u003c/a\u003e Pin Python 3.13.15 for older CLI versions in multi-language check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8\"\u003e\u003ccode\u003e63d3d63\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4203\"\u003e#4203\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe\"\u003e\u003ccode\u003e7377a10\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524\"\u003e\u003ccode\u003ec1a30cd\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974\"\u003e\u003ccode\u003ed208ec7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4200\"\u003e#4200\u003c/a\u003e from github/mbg/esm/migrate-pr-checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845\"\u003e\u003ccode\u003ea71b0c6\u003c/code\u003e\u003c/a\u003e Replace \u003ccode\u003e__dirname\u003c/code\u003e in \u003ccode\u003esync.ts\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.38.2 to 4.38.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003e\u003ccode\u003e24c5418\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4214\"\u003e#4214\u003c/a\u003e from github/update-v4.38.3-e0b52dbdc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8\"\u003e\u003ccode\u003e69e87c5\u003c/code\u003e\u003c/a\u003e Add changelog note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa\"\u003e\u003ccode\u003e23b6828\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b\"\u003e\u003ccode\u003ee0b52db\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4210\"\u003e#4210\u003c/a\u003e from github/henrymercer/pin-python-for-older-clis-in-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc\"\u003e\u003ccode\u003e6b99698\u003c/code\u003e\u003c/a\u003e Pin Python 3.13.15 for older CLI versions in multi-language check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8\"\u003e\u003ccode\u003e63d3d63\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4203\"\u003e#4203\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe\"\u003e\u003ccode\u003e7377a10\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524\"\u003e\u003ccode\u003ec1a30cd\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974\"\u003e\u003ccode\u003ed208ec7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4200\"\u003e#4200\u003c/a\u003e from github/mbg/esm/migrate-pr-checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845\"\u003e\u003ccode\u003ea71b0c6\u003c/code\u003e\u003c/a\u003e Replace \u003ccode\u003e__dirname\u003c/code\u003e in \u003ccode\u003esync.ts\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/tomkabel/fingerprintproxy/pull/9","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/tomkabel%2Ffingerprintproxy/issues/9","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/9/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-19T04:27:25.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5917785379","node_id":"PR_kwDOPdJtZs8AAAABJQF3bA","number":310,"state":"open","title":"ci(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0","user":"dependabot[bot]","labels":["dependencies"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T04:27:25.000Z","updated_at":"2026-10-19T04:28:10.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci(deps)","packages":[{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ossf/scorecard-action\u0026package-manager=github_actions\u0026previous-version=2.4.4\u0026new-version=2.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/thoser666/Vivid/pull/310","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/thoser666%2FVivid/issues/310","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/310/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-19T03:46:21.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5917411985","node_id":"PR_kwDOUXC9U88AAAABJPyzpA","number":67,"state":"open","title":"chore(deps): bump the github-actions group across 1 directory with 7 updates","user":"dependabot[bot]","labels":["dependencies"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T03:46:21.000Z","updated_at":"2026-10-19T03:51:13.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"github-actions","update_count":7,"packages":[{"name":"MaverickCER/internal-package-contract/.github/workflows/benchmark-pr.yml","old_version":"0.10.0","new_version":"0.11.0","repository_url":"https://github.com/maverickcer/internal-package-contract"},{"name":"actions/setup-node","old_version":"7.0.0","new_version":"7.1.0","repository_url":"https://github.com/actions/setup-node"},{"name":"actions/upload-artifact","old_version":"7.0.1","new_version":"7.0.2","repository_url":"https://github.com/actions/upload-artifact"},{"name":"actions/download-artifact","old_version":"8.0.1","new_version":"8.0.2","repository_url":"https://github.com/actions/download-artifact"},{"name":"MaverickCER/internal-package-contract/.github/workflows/release-npm-changesets.yml","old_version":"0.10.0","new_version":"0.11.0","repository_url":"https://github.com/maverickcer/internal-package-contract"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"MaverickCER/internal-package-contract/.github/workflows/dependency-pin-sync.yml","old_version":"0.10.0","new_version":"0.11.0","repository_url":"https://github.com/maverickcer/internal-package-contract"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 7 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [MaverickCER/internal-package-contract/.github/workflows/benchmark-pr.yml](https://github.com/maverickcer/internal-package-contract) | `0.10.0` | `0.11.0` |\n| [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` |\n| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |\n| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` |\n| [MaverickCER/internal-package-contract/.github/workflows/release-npm-changesets.yml](https://github.com/maverickcer/internal-package-contract) | `0.10.0` | `0.11.0` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [MaverickCER/internal-package-contract/.github/workflows/dependency-pin-sync.yml](https://github.com/maverickcer/internal-package-contract) | `0.10.0` | `0.11.0` |\n\n\nUpdates `MaverickCER/internal-package-contract/.github/workflows/benchmark-pr.yml` from 0.10.0 to 0.11.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/MaverickCER/internal-package-contract/blob/main/CHANGELOG.md\"\u003eMaverickCER/internal-package-contract/.github/workflows/benchmark-pr.yml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003einternal-package-contract\u003c/h1\u003e\n\u003ch2\u003e0.12.0\u003c/h2\u003e\n\u003ch3\u003eMinor Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(adoption): a package that adopts the standard starts in adoption mode, where every failing check is a warning until it is promoted; \u003ccode\u003eadopt\u003c/code\u003e now adds every config, script and template the package lacks\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(skill): \u003ccode\u003eskill [--check]\u003c/code\u003e writes a package's agent skill (\u003ccode\u003eskills/\u0026lt;name\u0026gt;/SKILL.md\u003c/code\u003e within a word budget, and \u003ccode\u003ereferences/api.md\u003c/code\u003e) from \u003ccode\u003epackage.json\u003c/code\u003e, \u003ccode\u003edocs/surface.json\u003c/code\u003e, the API baselines and the few things the author writes in \u003ccode\u003edocs/skill.json\u003c/code\u003e; the optional \u003ccode\u003eAgentSkill\u003c/code\u003e check fails on a stale or invalid skill\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): require every parameter and key of every public function to be benchmarked or accounted for, and measure a second variable on its own (\u003ccode\u003eBenchmarkCoverage\u003c/code\u003e, \u003ccode\u003ecovers\u003c/code\u003e, \u003ccode\u003esweeps\u003c/code\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(contract): build the benchmark page before the checks when the package defines \u003ccode\u003edocs:benchmarks\u003c/code\u003e, so the link check behaves the same locally and in CI\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(report): \u003ccode\u003ereport\u003c/code\u003e writes what a change does to the package as Markdown to paste into a pull request, from git, the changesets, the exception registries, the decision records, the manifest and the contract's last report\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(clean-checkout): the \u003ccode\u003eCleanCheckout\u003c/code\u003e check type-checks only what git tracks (the index, so staged files count), in a temporary copy with this installation's dependencies linked, so a file hidden by \u003ccode\u003e.gitignore\u003c/code\u003e or never added fails on the machine that has it and not only in CI\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: fix(mutation): a mutant that times out is run again alone before it counts, so a stalled machine is not reported as a loop, and the reuse of an earlier run keeps only a run in which every mutant was caught or left out\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(badges): every published figure says what it is. The coverage badge reads \u0026quot;lowest of 4\u0026quot; and \u003ccode\u003ecoverage.json\u003c/code\u003e beside it gives all four measures (lines, statements, functions, branches) with what each counts; the mutation badge says \u0026quot;detected of applicable\u0026quot; and \u003ccode\u003emutation.json\u003c/code\u003e gives the count of each status; the size badge shows the size against its budget, with \u003ccode\u003esize.json\u003c/code\u003e. \u003ccode\u003etool badges\u003c/code\u003e takes \u003ccode\u003e--coverage \u0026lt;file\u0026gt;\u003c/code\u003e and \u003ccode\u003e--no-size\u003c/code\u003e, so a package with its own coverage aggregate uses it instead of keeping a copy of the generator\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): a benchmark run outside CI writes to \u003ccode\u003e.benchmark-local/\u0026lt;suite\u0026gt;/\u003c/code\u003e, which is never committed, and the checks read it in preference to the committed results; only CI's figures are committed and published\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(docs): keep the shared process documents (code of conduct, support, releasing) current in every package, and scaffold them in full\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: Take any check apart and put it back: \u003ccode\u003einternal-package-contract/checks/parts\u003c/code\u003e splits a check into its evidence and its policy (\u003ccode\u003eevidenceOf\u003c/code\u003e, \u003ccode\u003epolicyOf\u003c/code\u003e, \u003ccode\u003ecomposeCheck\u003c/code\u003e, \u003ccode\u003ewithEvidence\u003c/code\u003e, \u003ccode\u003ewithPolicy\u003c/code\u003e, \u003ccode\u003eevidenceOfAll\u003c/code\u003e, \u003ccode\u003epoliciesOfAll\u003c/code\u003e). The evidence scripts (\u003ccode\u003e./scripts/*\u003c/code\u003e) and the shared runtime modules (\u003ccode\u003e./runtime/*\u003c/code\u003e) are now exported directly, and an IPC benchmark suite covers the new exports.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003einternal-package-contract/logs\u003c/code\u003e re-exports repo-contract's \u003ccode\u003eonEvidenceSaveToRepoContractLogs\u003c/code\u003e and \u003ccode\u003eonVerdictPrependRepoContractLogs\u003c/code\u003e (and \u003ccode\u003erepoContractLogs\u003c/code\u003e), so a package that runs its own contract gets the one-log-per-check hooks without installing \u003ccode\u003erepo-contract\u003c/code\u003e. The contract run itself now uses them, and prints a failure as soon as its verdict exists. Needs \u003ccode\u003erepo-contract\u003c/code\u003e 0.11.0 or later.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eenv-cap\u003c/code\u003e and \u003ccode\u003edata-cap\u003c/code\u003e are now dependencies of this package, and every entry point is exported (\u003ccode\u003einternal-package-contract/env-cap\u003c/code\u003e, \u003ccode\u003e/env-cap/build\u003c/code\u003e, \u003ccode\u003e/data-cap\u003c/code\u003e, ...), so a package that uses this one installs neither itself. A new \u003ccode\u003eenv\u003c/code\u003e command documents the credentials and settings a package depends on from \u003ccode\u003eci/env.schema.ts\u003c/code\u003e into \u003ccode\u003edocs/ENVIRONMENT.md\u003c/code\u003e; a new \u003ccode\u003eEnvContract\u003c/code\u003e check warns (never fails) about a credential that is expiring or expired and a document that is out of date; \u003ccode\u003einit\u003c/code\u003e scaffolds the contract, the \u003ccode\u003edocs:env\u003c/code\u003e script and a weekly \u003ccode\u003eenv-rotation.yml\u003c/code\u003e workflow (managed by \u003ccode\u003esync\u003c/code\u003e) that opens one issue when a credential is due; and \u003ccode\u003edoctor\u003c/code\u003e reports it. Nothing in it is required: a package with no contract passes. A missing Socket API key is now a warning in CI as well as locally.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(mutation): \u003ccode\u003emutation [--base \u0026lt;ref\u0026gt;] [file...]\u003c/code\u003e mutation-tests what a change touched, and the source files the changed tests import, as a fast loop while writing: every mutant of those files, never an earlier result, under the package's own concurrency; it is advice, and the full \u003ccode\u003eMutation\u003c/code\u003e check stays the gate\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(mutation): a mutation run over inputs that have not changed in any way is not run again: the evidence of the last clean run for the same hash of every file git does not ignore (and of the Node.js version) is put back for the check to judge, never under CI; \u003ccode\u003eIPC_MUTATION_MEMO=0\u003c/code\u003e runs it regardless\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003eMutation\u003c/code\u003e check also always runs every mutant (\u003ccode\u003e--force\u003c/code\u003e), ignoring any incremental file, so a result carried over from a run made under other conditions can no longer stand in for a cold run.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): remove the per-benchmark regression threshold, and warn when a function's big-O cannot be determined\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(setup): one command to adopt this standard in an existing package or start a new one, with \u003ccode\u003eadopt\u003c/code\u003e, \u003ccode\u003esetup\u003c/code\u003e and a read-only \u003ccode\u003edoctor\u003c/code\u003e that lists what is left\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(tools): run the size, badge, API-report, CommonJS-interop and compiler-isolation helpers from here, add an optional AmbientCapabilities check with \u003ccode\u003eadd check\u003c/code\u003e, and keep more of the files every package shares current\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(env): the standard ships the contract for what it reads from the environment, and \u003ccode\u003eenv\u003c/code\u003e includes it in every package's \u003ccode\u003edocs/ENVIRONMENT.md\u003c/code\u003e; the scaffolded \u003ccode\u003eci/env.schema.ts\u003c/code\u003e no longer repeats it, so the explanation lives in one place and cannot drift\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: fix(git-hygiene): \u003ccode\u003eGitHygiene\u003c/code\u003e fails on an import in tracked source that resolves only to a file git does not track, which is how a \u003ccode\u003e.gitignore\u003c/code\u003e pattern that was too wide hid source from every clean checkout while every local check passed\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(upgrade): \u003ccode\u003eupgrade \u0026lt;tag\u0026gt;\u003c/code\u003e moves a package to a release and updates the pin, workflows, managed files, landing page and benchmark guides in one step\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(verify-consumers): \u003ccode\u003everify-consumers \u0026lt;checkout\u0026gt;...\u003c/code\u003e runs each dependent package's fast offline checks with the standard it has installed and with this one, in throwaway copies, and names every check that got worse; it also says where an install would add its own copy of a package the standard depends on\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePatch Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e49c9641: fix(runtime): recognise a generated file only by a marker that opens a comment, so code or prose that quotes the marker is not taken for one\u003c/li\u003e\n\u003cli\u003e49c9641: fix(tests): tests start without the variables a git hook supplies (the repository, the settings and the author of the commit being checked), so they no longer fail under a hook that passes by hand or run git against the real repository\u003c/li\u003e\n\u003cli\u003e8ac8b1f: The shared \u003ccode\u003eno-node-fs\u003c/code\u003e rule also reports \u003ccode\u003enode:fs\u003c/code\u003e reached through a re-export (\u003ccode\u003eexport ... from\u003c/code\u003e, \u003ccode\u003eexport * from\u003c/code\u003e) or TypeScript's \u003ccode\u003eimport x = require()\u003c/code\u003e, and matches an \u003ccode\u003eallow\u003c/code\u003e pattern written relative to the working directory (\u003ccode\u003esrc/cli/**\u003c/code\u003e) against the absolute path ESLint gives it, on Windows too, and when the working directory is a filesystem root; the matching is the shared \u003ccode\u003eglob\u003c/code\u003e copy's new \u003ccode\u003ematchesAllowList\u003c/code\u003e, so a package's own lint rules can use the same. A benchmark report shows only the first line of a failure's message, with every absolute path in it cut to its file name, so a stack trace and the paths of the machine that ran it stay out of the published page. WRITING-BENCHMARKS.md records the two exceptions suites already use (a per-function \u003ccode\u003etiers\u003c/code\u003e with its \u003ccode\u003etiersReason\u003c/code\u003e, and benchmarking internal source), and the scaffolded and environment-rotation workflows pin the same v7 checkout, setup-node and upload-artifact actions as the rest. This package's own release works again under Changesets 3, which stopped versioning a private package unless \u003ccode\u003eprivatePackages.version\u003c/code\u003e is set: the Version Packages pull request for this release could not be opened without it.\u003c/li\u003e\n\u003cli\u003e49c9641: fix(benchmarks): give each category's package-cost heading its own id, and say in the reading guide that a worse growth class is a third failing gate\u003c/li\u003e\n\u003cli\u003e49c9641: A mistyped command now stops with a suggestion instead of starting the whole contract. \u003ccode\u003eisGeneratedFile\u003c/code\u003e in the shared runtime reads only the first twenty non-empty lines instead of splitting the entire file, so its cost no longer grows with the file; packages pick it up with \u003ccode\u003esync --apply --update\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.11.0\u003c/h2\u003e\n\u003ch3\u003eMinor Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e2410ab9: Bump \u003ccode\u003erepo-contract\u003c/code\u003e to 0.10.0.\u003c/li\u003e\n\u003cli\u003e7291bdd: The \u003ccode\u003etypescript\u003c/code\u003e dependency moves from 5.9 to 6.0. It is the compiler API IPC's own checks load, so consumers resolving it through IPC now get TypeScript 6.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/7240119d1919bcff5520836339ef52f7320004ea\"\u003e\u003ccode\u003e7240119\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/maverickcer/internal-package-contract/issues/72\"\u003e#72\u003c/a\u003e from MaverickCER/changeset-release/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/62b4b36dd398057f574d0dc0e963c11ec1003c06\"\u003e\u003ccode\u003e62b4b36\u003c/code\u003e\u003c/a\u003e chore: version packages\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/7878a47c8b50b40f8a7cc73466558f2656640ab0\"\u003e\u003ccode\u003e7878a47\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/maverickcer/internal-package-contract/issues/70\"\u003e#70\u003c/a\u003e from MaverickCER/stages-0-2-rebuilt\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/8400131d8ea8989b51f6ba2396c854be5aa9e287\"\u003e\u003ccode\u003e8400131\u003c/code\u003e\u003c/a\u003e fix(review): address the open review findings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/aab2b3c34971499d327d293e754c7546f5bb8f30\"\u003e\u003ccode\u003eaab2b3c\u003c/code\u003e\u003c/a\u003e fix(contract): satisfy shellcheck, CRAP, suppression and mutation gates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/9eb86448cf7c30fb376243335ff5225c01614f3c\"\u003e\u003ccode\u003e9eb8644\u003c/code\u003e\u003c/a\u003e test(packed-consumer): start npm through a shell on Windows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/89d7181bf0d7b0c373d944e37236417260d1d1f9\"\u003e\u003ccode\u003e89d7181\u003c/code\u003e\u003c/a\u003e fix(packed-consumer): list the tarball in Node, since external tar breaks on ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/6e53e88b4bb956ea81d79f4725a0dd569a583d67\"\u003e\u003ccode\u003e6e53e88\u003c/code\u003e\u003c/a\u003e feat(release): gate benchmark complexity, packed consumers, managed files and...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/9c8a021bcb93ffcd7be65fd431032471e980d696\"\u003e\u003ccode\u003e9c8a021\u003c/code\u003e\u003c/a\u003e feat(badges): require mutation and Scorecard badges and publish them from sha...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/3eb6ff7ba00cb5b3794356d88f2f2bc00567afd2\"\u003e\u003ccode\u003e3eb6ff7\u003c/code\u003e\u003c/a\u003e feat(readme): add the ReadmeStructure check and an adoption-first scaffold RE...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/maverickcer/internal-package-contract/compare/e13b3de4871e7509cb1969c4067a190e72a8c485...7240119d1919bcff5520836339ef52f7320004ea\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/setup-node` from 7.0.0 to 7.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/setup-node/releases\"\u003eactions/setup-node's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for mise.toml file by \u003ca href=\"https://github.com/gperdomor\"\u003e\u003ccode\u003e@​gperdomor\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1421\"\u003eactions/setup-node#1421\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport absolute paths in node-version-file by \u003ca href=\"https://github.com/v-mahabaleshwars\"\u003e\u003ccode\u003e@​v-mahabaleshwars\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1633\"\u003eactions/setup-node#1633\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug fixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Node version validation and manifest fetch retry by \u003ca href=\"https://github.com/v-jitenderpalsingh\"\u003e\u003ccode\u003e@​v-jitenderpalsingh\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1580\"\u003eactions/setup-node#1580\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation updates:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eREADME.md: bump actions/checkout to latest version 7 by \u003ca href=\"https://github.com/deining\"\u003e\u003ccode\u003e@​deining\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1578\"\u003eactions/setup-node#1578\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by \u003ca href=\"https://github.com/v-gowridurgad\"\u003e\u003ccode\u003e@​v-gowridurgad\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1593\"\u003eactions/setup-node#1593\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed cache recommendation syntax by \u003ca href=\"https://github.com/SubJunk\"\u003e\u003ccode\u003e@​SubJunk\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1603\"\u003eactions/setup-node#1603\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency updates:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate workflow pins and migrate Node matrices to modern versions by \u003ca href=\"https://github.com/v-HarithaVattikuti\"\u003e\u003ccode\u003e@​v-HarithaVattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1583\"\u003eactions/setup-node#1583\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1584\"\u003eactions/setup-node#1584\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin \u003ccode\u003e@​types/node\u003c/code\u003e to v24 by \u003ca href=\"https://github.com/v-priyagupta108\"\u003e\u003ccode\u003e@​v-priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1585\"\u003eactions/setup-node#1585\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOverride brace-expansion to 5.0.8 by \u003ca href=\"https://github.com/v-priyagupta108\"\u003e\u003ccode\u003e@​v-priyagupta108\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1599\"\u003eactions/setup-node#1599\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  actions/checkout from 7.0.0 to 7.0.1 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1598\"\u003eactions/setup-node#1598\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  prettier from 3.8.4 to 3.9.6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1590\"\u003eactions/setup-node#1590\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  \u003ccode\u003e@​vercel/ncc\u003c/code\u003e from 0.44.0 to 0.45.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1610\"\u003eactions/setup-node#1610\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  pnpm/action-setup from 6.0.9 to 6.0.10 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1602\"\u003eactions/setup-node#1602\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade  baseline-browser-mapping from 2.10.38 to 2.11.22 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1629\"\u003eactions/setup-node#1629\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​types/semver\u003c/code\u003e from 7.7.1 to 7.8.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1616\"\u003eactions/setup-node#1616\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e from 8.62.0 to 8.70.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1615\"\u003eactions/setup-node#1615\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade pnpm/action-setup from 6.0.10 to 6.1.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1631\"\u003eactions/setup-node#1631\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade jest-each from 30.4.1 to 30.5.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1636\"\u003eactions/setup-node#1636\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade eslint-plugin-n from 18.1.0 to 18.3.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1638\"\u003eactions/setup-node#1638\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependencies and add license files by \u003ca href=\"https://github.com/v-HarithaVattikuti\"\u003e\u003ccode\u003e@​v-HarithaVattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1642\"\u003eactions/setup-node#1642\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1635\"\u003eactions/setup-node#1635\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/v-jitenderpalsingh\"\u003e\u003ccode\u003e@​v-jitenderpalsingh\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1580\"\u003eactions/setup-node#1580\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1584\"\u003eactions/setup-node#1584\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gperdomor\"\u003e\u003ccode\u003e@​gperdomor\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1421\"\u003eactions/setup-node#1421\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SubJunk\"\u003e\u003ccode\u003e@​SubJunk\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1603\"\u003eactions/setup-node#1603\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-node/compare/v7.0.0...v7.1.0\"\u003ehttps://github.com/actions/setup-node/compare/v7.0.0...v7.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/949feb2413d6458794dcd2491c4babbbce0c15c1\"\u003e\u003ccode\u003e949feb2\u003c/code\u003e\u003c/a\u003e Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1635\"\u003e#1635\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/7207c4f1189c7ee83ddf20c7c68bd1af6fdd751c\"\u003e\u003ccode\u003e7207c4f\u003c/code\u003e\u003c/a\u003e chore: update dependencies and add license files (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1642\"\u003e#1642\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/54337e0d02de9202d0948aaff36ad556375497b9\"\u003e\u003ccode\u003e54337e0\u003c/code\u003e\u003c/a\u003e Bump eslint-plugin-n from 18.1.0 to 18.3.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1638\"\u003e#1638\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/fb54fa8c14c63410cc752f0ae3b7b3ca6af161fc\"\u003e\u003ccode\u003efb54fa8\u003c/code\u003e\u003c/a\u003e Bump jest-each from 30.4.1 to 30.5.2 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1636\"\u003e#1636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/7f84f1d52d0c56afb45c62fee31a93b843cea4d6\"\u003e\u003ccode\u003e7f84f1d\u003c/code\u003e\u003c/a\u003e Bump pnpm/action-setup from 6.0.10 to 6.1.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1631\"\u003e#1631\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/0c54c7b07420dcba69a7d832587f55ebdf771c9e\"\u003e\u003ccode\u003e0c54c7b\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e from 8.62.0 to 8.70.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1615\"\u003e#1615\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/a8294190049a9c296f01b9a432aff41dd83d8284\"\u003e\u003ccode\u003ea829419\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​types/semver\u003c/code\u003e from 7.7.1 to 7.8.0 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1616\"\u003e#1616\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/680d1e489b82f1243de15bc7665c0007e3c9a860\"\u003e\u003ccode\u003e680d1e4\u003c/code\u003e\u003c/a\u003e Support absolute paths in node-version-file (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1633\"\u003e#1633\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/db0fb3a98ed314b69026b6e8c9be26a7e2fe65a8\"\u003e\u003ccode\u003edb0fb3a\u003c/code\u003e\u003c/a\u003e Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1629\"\u003e#1629\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/94196ee1d15439c1b6651cd87ef14e88ec435966\"\u003e\u003ccode\u003e94196ee\u003c/code\u003e\u003c/a\u003e Bump pnpm/action-setup from 6.0.9 to 6.0.10 (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1602\"\u003e#1602\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-artifact` from 7.0.1 to 7.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdates \u003ccode\u003e@​actions/artifact\u003c/code\u003e to v6.3.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/821\"\u003eactions/upload-artifact#821\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\"\u003ehttps://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003e\u003ccode\u003ecf430e0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/822\"\u003e#822\u003c/a\u003e from actions/tunc-d-prepare-upload-v7-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469\"\u003e\u003ccode\u003ec2acded\u003c/code\u003e\u003c/a\u003e chore: prepare v7.0.2 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a\"\u003e\u003ccode\u003e4687c1b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/821\"\u003e#821\u003c/a\u003e from actions/tunc-d-upload-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719\"\u003e\u003ccode\u003e8cbe1be\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/download-artifact` from 8.0.1 to 8.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/download-artifact/releases\"\u003eactions/download-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev8.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the readme by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/473\"\u003eactions/download-artifact#473\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare download-artifact v8.0.2 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/493\"\u003eactions/download-artifact#493\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\"\u003ehttps://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003e\u003ccode\u003e9000827\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/493\"\u003e#493\u003c/a\u003e from actions/tunc-d-prepare-download-v8-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/e455989ae00f5bdd4054f05d3e972c6bf8a62dc5\"\u003e\u003ccode\u003ee455989\u003c/code\u003e\u003c/a\u003e Prepare download-artifact v8.0.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/a00b90c4a2f01d73a8c89552caabca6ea3b43137\"\u003e\u003ccode\u003ea00b90c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/492\"\u003e#492\u003c/a\u003e from actions/tunc-d-download-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/29bb7ce6af5345aeab5bb4774ce7249ee3ccc27f\"\u003e\u003ccode\u003e29bb7ce\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/484a0b528fb4d7bd804637ccb632e47a0e638317\"\u003e\u003ccode\u003e484a0b5\u003c/code\u003e\u003c/a\u003e Update the readme (\u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/473\"\u003e#473\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `MaverickCER/internal-package-contract/.github/workflows/release-npm-changesets.yml` from 0.10.0 to 0.11.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/MaverickCER/internal-package-contract/blob/main/CHANGELOG.md\"\u003eMaverickCER/internal-package-contract/.github/workflows/release-npm-changesets.yml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003einternal-package-contract\u003c/h1\u003e\n\u003ch2\u003e0.12.0\u003c/h2\u003e\n\u003ch3\u003eMinor Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(adoption): a package that adopts the standard starts in adoption mode, where every failing check is a warning until it is promoted; \u003ccode\u003eadopt\u003c/code\u003e now adds every config, script and template the package lacks\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(skill): \u003ccode\u003eskill [--check]\u003c/code\u003e writes a package's agent skill (\u003ccode\u003eskills/\u0026lt;name\u0026gt;/SKILL.md\u003c/code\u003e within a word budget, and \u003ccode\u003ereferences/api.md\u003c/code\u003e) from \u003ccode\u003epackage.json\u003c/code\u003e, \u003ccode\u003edocs/surface.json\u003c/code\u003e, the API baselines and the few things the author writes in \u003ccode\u003edocs/skill.json\u003c/code\u003e; the optional \u003ccode\u003eAgentSkill\u003c/code\u003e check fails on a stale or invalid skill\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): require every parameter and key of every public function to be benchmarked or accounted for, and measure a second variable on its own (\u003ccode\u003eBenchmarkCoverage\u003c/code\u003e, \u003ccode\u003ecovers\u003c/code\u003e, \u003ccode\u003esweeps\u003c/code\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(contract): build the benchmark page before the checks when the package defines \u003ccode\u003edocs:benchmarks\u003c/code\u003e, so the link check behaves the same locally and in CI\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(report): \u003ccode\u003ereport\u003c/code\u003e writes what a change does to the package as Markdown to paste into a pull request, from git, the changesets, the exception registries, the decision records, the manifest and the contract's last report\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(clean-checkout): the \u003ccode\u003eCleanCheckout\u003c/code\u003e check type-checks only what git tracks (the index, so staged files count), in a temporary copy with this installation's dependencies linked, so a file hidden by \u003ccode\u003e.gitignore\u003c/code\u003e or never added fails on the machine that has it and not only in CI\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: fix(mutation): a mutant that times out is run again alone before it counts, so a stalled machine is not reported as a loop, and the reuse of an earlier run keeps only a run in which every mutant was caught or left out\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(badges): every published figure says what it is. The coverage badge reads \u0026quot;lowest of 4\u0026quot; and \u003ccode\u003ecoverage.json\u003c/code\u003e beside it gives all four measures (lines, statements, functions, branches) with what each counts; the mutation badge says \u0026quot;detected of applicable\u0026quot; and \u003ccode\u003emutation.json\u003c/code\u003e gives the count of each status; the size badge shows the size against its budget, with \u003ccode\u003esize.json\u003c/code\u003e. \u003ccode\u003etool badges\u003c/code\u003e takes \u003ccode\u003e--coverage \u0026lt;file\u0026gt;\u003c/code\u003e and \u003ccode\u003e--no-size\u003c/code\u003e, so a package with its own coverage aggregate uses it instead of keeping a copy of the generator\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): a benchmark run outside CI writes to \u003ccode\u003e.benchmark-local/\u0026lt;suite\u0026gt;/\u003c/code\u003e, which is never committed, and the checks read it in preference to the committed results; only CI's figures are committed and published\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(docs): keep the shared process documents (code of conduct, support, releasing) current in every package, and scaffold them in full\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: Take any check apart and put it back: \u003ccode\u003einternal-package-contract/checks/parts\u003c/code\u003e splits a check into its evidence and its policy (\u003ccode\u003eevidenceOf\u003c/code\u003e, \u003ccode\u003epolicyOf\u003c/code\u003e, \u003ccode\u003ecomposeCheck\u003c/code\u003e, \u003ccode\u003ewithEvidence\u003c/code\u003e, \u003ccode\u003ewithPolicy\u003c/code\u003e, \u003ccode\u003eevidenceOfAll\u003c/code\u003e, \u003ccode\u003epoliciesOfAll\u003c/code\u003e). The evidence scripts (\u003ccode\u003e./scripts/*\u003c/code\u003e) and the shared runtime modules (\u003ccode\u003e./runtime/*\u003c/code\u003e) are now exported directly, and an IPC benchmark suite covers the new exports.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003einternal-package-contract/logs\u003c/code\u003e re-exports repo-contract's \u003ccode\u003eonEvidenceSaveToRepoContractLogs\u003c/code\u003e and \u003ccode\u003eonVerdictPrependRepoContractLogs\u003c/code\u003e (and \u003ccode\u003erepoContractLogs\u003c/code\u003e), so a package that runs its own contract gets the one-log-per-check hooks without installing \u003ccode\u003erepo-contract\u003c/code\u003e. The contract run itself now uses them, and prints a failure as soon as its verdict exists. Needs \u003ccode\u003erepo-contract\u003c/code\u003e 0.11.0 or later.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eenv-cap\u003c/code\u003e and \u003ccode\u003edata-cap\u003c/code\u003e are now dependencies of this package, and every entry point is exported (\u003ccode\u003einternal-package-contract/env-cap\u003c/code\u003e, \u003ccode\u003e/env-cap/build\u003c/code\u003e, \u003ccode\u003e/data-cap\u003c/code\u003e, ...), so a package that uses this one installs neither itself. A new \u003ccode\u003eenv\u003c/code\u003e command documents the credentials and settings a package depends on from \u003ccode\u003eci/env.schema.ts\u003c/code\u003e into \u003ccode\u003edocs/ENVIRONMENT.md\u003c/code\u003e; a new \u003ccode\u003eEnvContract\u003c/code\u003e check warns (never fails) about a credential that is expiring or expired and a document that is out of date; \u003ccode\u003einit\u003c/code\u003e scaffolds the contract, the \u003ccode\u003edocs:env\u003c/code\u003e script and a weekly \u003ccode\u003eenv-rotation.yml\u003c/code\u003e workflow (managed by \u003ccode\u003esync\u003c/code\u003e) that opens one issue when a credential is due; and \u003ccode\u003edoctor\u003c/code\u003e reports it. Nothing in it is required: a package with no contract passes. A missing Socket API key is now a warning in CI as well as locally.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(mutation): \u003ccode\u003emutation [--base \u0026lt;ref\u0026gt;] [file...]\u003c/code\u003e mutation-tests what a change touched, and the source files the changed tests import, as a fast loop while writing: every mutant of those files, never an earlier result, under the package's own concurrency; it is advice, and the full \u003ccode\u003eMutation\u003c/code\u003e check stays the gate\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(mutation): a mutation run over inputs that have not changed in any way is not run again: the evidence of the last clean run for the same hash of every file git does not ignore (and of the Node.js version) is put back for the check to judge, never under CI; \u003ccode\u003eIPC_MUTATION_MEMO=0\u003c/code\u003e runs it regardless\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003eMutation\u003c/code\u003e check also always runs every mutant (\u003ccode\u003e--force\u003c/code\u003e), ignoring any incremental file, so a result carried over from a run made under other conditions can no longer stand in for a cold run.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): remove the per-benchmark regression threshold, and warn when a function's big-O cannot be determined\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(setup): one command to adopt this standard in an existing package or start a new one, with \u003ccode\u003eadopt\u003c/code\u003e, \u003ccode\u003esetup\u003c/code\u003e and a read-only \u003ccode\u003edoctor\u003c/code\u003e that lists what is left\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(tools): run the size, badge, API-report, CommonJS-interop and compiler-isolation helpers from here, add an optional AmbientCapabilities check with \u003ccode\u003eadd check\u003c/code\u003e, and keep more of the files every package shares current\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(env): the standard ships the contract for what it reads from the environment, and \u003ccode\u003eenv\u003c/code\u003e includes it in every package's \u003ccode\u003edocs/ENVIRONMENT.md\u003c/code\u003e; the scaffolded \u003ccode\u003eci/env.schema.ts\u003c/code\u003e no longer repeats it, so the explanation lives in one place and cannot drift\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: fix(git-hygiene): \u003ccode\u003eGitHygiene\u003c/code\u003e fails on an import in tracked source that resolves only to a file git does not track, which is how a \u003ccode\u003e.gitignore\u003c/code\u003e pattern that was too wide hid source from every clean checkout while every local check passed\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(upgrade): \u003ccode\u003eupgrade \u0026lt;tag\u0026gt;\u003c/code\u003e moves a package to a release and updates the pin, workflows, managed files, landing page and benchmark guides in one step\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(verify-consumers): \u003ccode\u003everify-consumers \u0026lt;checkout\u0026gt;...\u003c/code\u003e runs each dependent package's fast offline checks with the standard it has installed and with this one, in throwaway copies, and names every check that got worse; it also says where an install would add its own copy of a package the standard depends on\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePatch Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e49c9641: fix(runtime): recognise a generated file only by a marker that opens a comment, so code or prose that quotes the marker is not taken for one\u003c/li\u003e\n\u003cli\u003e49c9641: fix(tests): tests start without the variables a git hook supplies (the repository, the settings and the author of the commit being checked), so they no longer fail under a hook that passes by hand or run git against the real repository\u003c/li\u003e\n\u003cli\u003e8ac8b1f: The shared \u003ccode\u003eno-node-fs\u003c/code\u003e rule also reports \u003ccode\u003enode:fs\u003c/code\u003e reached through a re-export (\u003ccode\u003eexport ... from\u003c/code\u003e, \u003ccode\u003eexport * from\u003c/code\u003e) or TypeScript's \u003ccode\u003eimport x = require()\u003c/code\u003e, and matches an \u003ccode\u003eallow\u003c/code\u003e pattern written relative to the working directory (\u003ccode\u003esrc/cli/**\u003c/code\u003e) against the absolute path ESLint gives it, on Windows too, and when the working directory is a filesystem root; the matching is the shared \u003ccode\u003eglob\u003c/code\u003e copy's new \u003ccode\u003ematchesAllowList\u003c/code\u003e, so a package's own lint rules can use the same. A benchmark report shows only the first line of a failure's message, with every absolute path in it cut to its file name, so a stack trace and the paths of the machine that ran it stay out of the published page. WRITING-BENCHMARKS.md records the two exceptions suites already use (a per-function \u003ccode\u003etiers\u003c/code\u003e with its \u003ccode\u003etiersReason\u003c/code\u003e, and benchmarking internal source), and the scaffolded and environment-rotation workflows pin the same v7 checkout, setup-node and upload-artifact actions as the rest. This package's own release works again under Changesets 3, which stopped versioning a private package unless \u003ccode\u003eprivatePackages.version\u003c/code\u003e is set: the Version Packages pull request for this release could not be opened without it.\u003c/li\u003e\n\u003cli\u003e49c9641: fix(benchmarks): give each category's package-cost heading its own id, and say in the reading guide that a worse growth class is a third failing gate\u003c/li\u003e\n\u003cli\u003e49c9641: A mistyped command now stops with a suggestion instead of starting the whole contract. \u003ccode\u003eisGeneratedFile\u003c/code\u003e in the shared runtime reads only the first twenty non-empty lines instead of splitting the entire file, so its cost no longer grows with the file; packages pick it up with \u003ccode\u003esync --apply --update\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.11.0\u003c/h2\u003e\n\u003ch3\u003eMinor Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e2410ab9: Bump \u003ccode\u003erepo-contract\u003c/code\u003e to 0.10.0.\u003c/li\u003e\n\u003cli\u003e7291bdd: The \u003ccode\u003etypescript\u003c/code\u003e dependency moves from 5.9 to 6.0. It is the compiler API IPC's own checks load, so consumers resolving it through IPC now get TypeScript 6.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/7240119d1919bcff5520836339ef52f7320004ea\"\u003e\u003ccode\u003e7240119\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/maverickcer/internal-package-contract/issues/72\"\u003e#72\u003c/a\u003e from MaverickCER/changeset-release/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/62b4b36dd398057f574d0dc0e963c11ec1003c06\"\u003e\u003ccode\u003e62b4b36\u003c/code\u003e\u003c/a\u003e chore: version packages\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/7878a47c8b50b40f8a7cc73466558f2656640ab0\"\u003e\u003ccode\u003e7878a47\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/maverickcer/internal-package-contract/issues/70\"\u003e#70\u003c/a\u003e from MaverickCER/stages-0-2-rebuilt\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/8400131d8ea8989b51f6ba2396c854be5aa9e287\"\u003e\u003ccode\u003e8400131\u003c/code\u003e\u003c/a\u003e fix(review): address the open review findings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/aab2b3c34971499d327d293e754c7546f5bb8f30\"\u003e\u003ccode\u003eaab2b3c\u003c/code\u003e\u003c/a\u003e fix(contract): satisfy shellcheck, CRAP, suppression and mutation gates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/9eb86448cf7c30fb376243335ff5225c01614f3c\"\u003e\u003ccode\u003e9eb8644\u003c/code\u003e\u003c/a\u003e test(packed-consumer): start npm through a shell on Windows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/89d7181bf0d7b0c373d944e37236417260d1d1f9\"\u003e\u003ccode\u003e89d7181\u003c/code\u003e\u003c/a\u003e fix(packed-consumer): list the tarball in Node, since external tar breaks on ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/6e53e88b4bb956ea81d79f4725a0dd569a583d67\"\u003e\u003ccode\u003e6e53e88\u003c/code\u003e\u003c/a\u003e feat(release): gate benchmark complexity, packed consumers, managed files and...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/9c8a021bcb93ffcd7be65fd431032471e980d696\"\u003e\u003ccode\u003e9c8a021\u003c/code\u003e\u003c/a\u003e feat(badges): require mutation and Scorecard badges and publish them from sha...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/3eb6ff7ba00cb5b3794356d88f2f2bc00567afd2\"\u003e\u003ccode\u003e3eb6ff7\u003c/code\u003e\u003c/a\u003e feat(readme): add the ReadmeStructure check and an adoption-first scaffold RE...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/maverickcer/internal-package-contract/compare/e13b3de4871e7509cb1969c4067a190e72a8c485...7240119d1919bcff5520836339ef52f7320004ea\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `MaverickCER/internal-package-contract/.github/workflows/dependency-pin-sync.yml` from 0.10.0 to 0.11.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/MaverickCER/internal-package-contract/blob/main/CHANGELOG.md\"\u003eMaverickCER/internal-package-contract/.github/workflows/dependency-pin-sync.yml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003einternal-package-contract\u003c/h1\u003e\n\u003ch2\u003e0.12.0\u003c/h2\u003e\n\u003ch3\u003eMinor Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(adoption): a package that adopts the standard starts in adoption mode, where every failing check is a warning until it is promoted; \u003ccode\u003eadopt\u003c/code\u003e now adds every config, script and template the package lacks\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(skill): \u003ccode\u003eskill [--check]\u003c/code\u003e writes a package's agent skill (\u003ccode\u003eskills/\u0026lt;name\u0026gt;/SKILL.md\u003c/code\u003e within a word budget, and \u003ccode\u003ereferences/api.md\u003c/code\u003e) from \u003ccode\u003epackage.json\u003c/code\u003e, \u003ccode\u003edocs/surface.json\u003c/code\u003e, the API baselines and the few things the author writes in \u003ccode\u003edocs/skill.json\u003c/code\u003e; the optional \u003ccode\u003eAgentSkill\u003c/code\u003e check fails on a stale or invalid skill\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): require every parameter and key of every public function to be benchmarked or accounted for, and measure a second variable on its own (\u003ccode\u003eBenchmarkCoverage\u003c/code\u003e, \u003ccode\u003ecovers\u003c/code\u003e, \u003ccode\u003esweeps\u003c/code\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(contract): build the benchmark page before the checks when the package defines \u003ccode\u003edocs:benchmarks\u003c/code\u003e, so the link check behaves the same locally and in CI\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(report): \u003ccode\u003ereport\u003c/code\u003e writes what a change does to the package as Markdown to paste into a pull request, from git, the changesets, the exception registries, the decision records, the manifest and the contract's last report\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(clean-checkout): the \u003ccode\u003eCleanCheckout\u003c/code\u003e check type-checks only what git tracks (the index, so staged files count), in a temporary copy with this installation's dependencies linked, so a file hidden by \u003ccode\u003e.gitignore\u003c/code\u003e or never added fails on the machine that has it and not only in CI\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: fix(mutation): a mutant that times out is run again alone before it counts, so a stalled machine is not reported as a loop, and the reuse of an earlier run keeps only a run in which every mutant was caught or left out\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(badges): every published figure says what it is. The coverage badge reads \u0026quot;lowest of 4\u0026quot; and \u003ccode\u003ecoverage.json\u003c/code\u003e beside it gives all four measures (lines, statements, functions, branches) with what each counts; the mutation badge says \u0026quot;detected of applicable\u0026quot; and \u003ccode\u003emutation.json\u003c/code\u003e gives the count of each status; the size badge shows the size against its budget, with \u003ccode\u003esize.json\u003c/code\u003e. \u003ccode\u003etool badges\u003c/code\u003e takes \u003ccode\u003e--coverage \u0026lt;file\u0026gt;\u003c/code\u003e and \u003ccode\u003e--no-size\u003c/code\u003e, so a package with its own coverage aggregate uses it instead of keeping a copy of the generator\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): a benchmark run outside CI writes to \u003ccode\u003e.benchmark-local/\u0026lt;suite\u0026gt;/\u003c/code\u003e, which is never committed, and the checks read it in preference to the committed results; only CI's figures are committed and published\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(docs): keep the shared process documents (code of conduct, support, releasing) current in every package, and scaffold them in full\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: Take any check apart and put it back: \u003ccode\u003einternal-package-contract/checks/parts\u003c/code\u003e splits a check into its evidence and its policy (\u003ccode\u003eevidenceOf\u003c/code\u003e, \u003ccode\u003epolicyOf\u003c/code\u003e, \u003ccode\u003ecomposeCheck\u003c/code\u003e, \u003ccode\u003ewithEvidence\u003c/code\u003e, \u003ccode\u003ewithPolicy\u003c/code\u003e, \u003ccode\u003eevidenceOfAll\u003c/code\u003e, \u003ccode\u003epoliciesOfAll\u003c/code\u003e). The evidence scripts (\u003ccode\u003e./scripts/*\u003c/code\u003e) and the shared runtime modules (\u003ccode\u003e./runtime/*\u003c/code\u003e) are now exported directly, and an IPC benchmark suite covers the new exports.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003einternal-package-contract/logs\u003c/code\u003e re-exports repo-contract's \u003ccode\u003eonEvidenceSaveToRepoContractLogs\u003c/code\u003e and \u003ccode\u003eonVerdictPrependRepoContractLogs\u003c/code\u003e (and \u003ccode\u003erepoContractLogs\u003c/code\u003e), so a package that runs its own contract gets the one-log-per-check hooks without installing \u003ccode\u003erepo-contract\u003c/code\u003e. The contract run itself now uses them, and prints a failure as soon as its verdict exists. Needs \u003ccode\u003erepo-contract\u003c/code\u003e 0.11.0 or later.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eenv-cap\u003c/code\u003e and \u003ccode\u003edata-cap\u003c/code\u003e are now dependencies of this package, and every entry point is exported (\u003ccode\u003einternal-package-contract/env-cap\u003c/code\u003e, \u003ccode\u003e/env-cap/build\u003c/code\u003e, \u003ccode\u003e/data-cap\u003c/code\u003e, ...), so a package that uses this one installs neither itself. A new \u003ccode\u003eenv\u003c/code\u003e command documents the credentials and settings a package depends on from \u003ccode\u003eci/env.schema.ts\u003c/code\u003e into \u003ccode\u003edocs/ENVIRONMENT.md\u003c/code\u003e; a new \u003ccode\u003eEnvContract\u003c/code\u003e check warns (never fails) about a credential that is expiring or expired and a document that is out of date; \u003ccode\u003einit\u003c/code\u003e scaffolds the contract, the \u003ccode\u003edocs:env\u003c/code\u003e script and a weekly \u003ccode\u003eenv-rotation.yml\u003c/code\u003e workflow (managed by \u003ccode\u003esync\u003c/code\u003e) that opens one issue when a credential is due; and \u003ccode\u003edoctor\u003c/code\u003e reports it. Nothing in it is required: a package with no contract passes. A missing Socket API key is now a warning in CI as well as locally.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(mutation): \u003ccode\u003emutation [--base \u0026lt;ref\u0026gt;] [file...]\u003c/code\u003e mutation-tests what a change touched, and the source files the changed tests import, as a fast loop while writing: every mutant of those files, never an earlier result, under the package's own concurrency; it is advice, and the full \u003ccode\u003eMutation\u003c/code\u003e check stays the gate\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(mutation): a mutation run over inputs that have not changed in any way is not run again: the evidence of the last clean run for the same hash of every file git does not ignore (and of the Node.js version) is put back for the check to judge, never under CI; \u003ccode\u003eIPC_MUTATION_MEMO=0\u003c/code\u003e runs it regardless\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003eMutation\u003c/code\u003e check also always runs every mutant (\u003ccode\u003e--force\u003c/code\u003e), ignoring any incremental file, so a result carried over from a run made under other conditions can no longer stand in for a cold run.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(benchmark): remove the per-benchmark regression threshold, and warn when a function's big-O cannot be determined\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(setup): one command to adopt this standard in an existing package or start a new one, with \u003ccode\u003eadopt\u003c/code\u003e, \u003ccode\u003esetup\u003c/code\u003e and a read-only \u003ccode\u003edoctor\u003c/code\u003e that lists what is left\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(tools): run the size, badge, API-report, CommonJS-interop and compiler-isolation helpers from here, add an optional AmbientCapabilities check with \u003ccode\u003eadd check\u003c/code\u003e, and keep more of the files every package shares current\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(env): the standard ships the contract for what it reads from the environment, and \u003ccode\u003eenv\u003c/code\u003e includes it in every package's \u003ccode\u003edocs/ENVIRONMENT.md\u003c/code\u003e; the scaffolded \u003ccode\u003eci/env.schema.ts\u003c/code\u003e no longer repeats it, so the explanation lives in one place and cannot drift\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: fix(git-hygiene): \u003ccode\u003eGitHygiene\u003c/code\u003e fails on an import in tracked source that resolves only to a file git does not track, which is how a \u003ccode\u003e.gitignore\u003c/code\u003e pattern that was too wide hid source from every clean checkout while every local check passed\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(upgrade): \u003ccode\u003eupgrade \u0026lt;tag\u0026gt;\u003c/code\u003e moves a package to a release and updates the pin, workflows, managed files, landing page and benchmark guides in one step\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e49c9641: feat(verify-consumers): \u003ccode\u003everify-consumers \u0026lt;checkout\u0026gt;...\u003c/code\u003e runs each dependent package's fast offline checks with the standard it has installed and with this one, in throwaway copies, and names every check that got worse; it also says where an install would add its own copy of a package the standard depends on\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePatch Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e49c9641: fix(runtime): recognise a generated file only by a marker that opens a comment, so code or prose that quotes the marker is not taken for one\u003c/li\u003e\n\u003cli\u003e49c9641: fix(tests): tests start without the variables a git hook supplies (the repository, the settings and the author of the commit being checked), so they no longer fail under a hook that passes by hand or run git against the real repository\u003c/li\u003e\n\u003cli\u003e8ac8b1f: The shared \u003ccode\u003eno-node-fs\u003c/code\u003e rule also reports \u003ccode\u003enode:fs\u003c/code\u003e reached through a re-export (\u003ccode\u003eexport ... from\u003c/code\u003e, \u003ccode\u003eexport * from\u003c/code\u003e) or TypeScript's \u003ccode\u003eimport x = require()\u003c/code\u003e, and matches an \u003ccode\u003eallow\u003c/code\u003e pattern written relative to the working directory (\u003ccode\u003esrc/cli/**\u003c/code\u003e) against the absolute path ESLint gives it, on Windows too, and when the working directory is a filesystem root; the matching is the shared \u003ccode\u003eglob\u003c/code\u003e copy's new \u003ccode\u003ematchesAllowList\u003c/code\u003e, so a package's own lint rules can use the same. A benchmark report shows only the first line of a failure's message, with every absolute path in it cut to its file name, so a stack trace and the paths of the machine that ran it stay out of the published page. WRITING-BENCHMARKS.md records the two exceptions suites already use (a per-function \u003ccode\u003etiers\u003c/code\u003e with its \u003ccode\u003etiersReason\u003c/code\u003e, and benchmarking internal source), and the scaffolded and environment-rotation workflows pin the same v7 checkout, setup-node and upload-artifact actions as the rest. This package's own release works again under Changesets 3, which stopped versioning a private package unless \u003ccode\u003eprivatePackages.version\u003c/code\u003e is set: the Version Packages pull request for this release could not be opened without it.\u003c/li\u003e\n\u003cli\u003e49c9641: fix(benchmarks): give each category's package-cost heading its own id, and say in the reading guide that a worse growth class is a third failing gate\u003c/li\u003e\n\u003cli\u003e49c9641: A mistyped command now stops with a suggestion instead of starting the whole contract. \u003ccode\u003eisGeneratedFile\u003c/code\u003e in the shared runtime reads only the first twenty non-empty lines instead of splitting the entire file, so its cost no longer grows with the file; packages pick it up with \u003ccode\u003esync --apply --update\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.11.0\u003c/h2\u003e\n\u003ch3\u003eMinor Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e2410ab9: Bump \u003ccode\u003erepo-contract\u003c/code\u003e to 0.10.0.\u003c/li\u003e\n\u003cli\u003e7291bdd: The \u003ccode\u003etypescript\u003c/code\u003e dependency moves from 5.9 to 6.0. It is the compiler API IPC's own checks load, so consumers resolving it through IPC now get TypeScript 6.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/7240119d1919bcff5520836339ef52f7320004ea\"\u003e\u003ccode\u003e7240119\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/maverickcer/internal-package-contract/issues/72\"\u003e#72\u003c/a\u003e from MaverickCER/changeset-release/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/62b4b36dd398057f574d0dc0e963c11ec1003c06\"\u003e\u003ccode\u003e62b4b36\u003c/code\u003e\u003c/a\u003e chore: version packages\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/7878a47c8b50b40f8a7cc73466558f2656640ab0\"\u003e\u003ccode\u003e7878a47\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/maverickcer/internal-package-contract/issues/70\"\u003e#70\u003c/a\u003e from MaverickCER/stages-0-2-rebuilt\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/8400131d8ea8989b51f6ba2396c854be5aa9e287\"\u003e\u003ccode\u003e8400131\u003c/code\u003e\u003c/a\u003e fix(review): address the open review findings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/aab2b3c34971499d327d293e754c7546f5bb8f30\"\u003e\u003ccode\u003eaab2b3c\u003c/code\u003e\u003c/a\u003e fix(contract): satisfy shellcheck, CRAP, suppression and mutation gates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/9eb86448cf7c30fb376243335ff5225c01614f3c\"\u003e\u003ccode\u003e9eb8644\u003c/code\u003e\u003c/a\u003e test(packed-consumer): start npm through a shell on Windows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/89d7181bf0d7b0c373d944e37236417260d1d1f9\"\u003e\u003ccode\u003e89d7181\u003c/code\u003e\u003c/a\u003e fix(packed-consumer): list the tarball in Node, since external tar breaks on ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/6e53e88b4bb956ea81d79f4725a0dd569a583d67\"\u003e\u003ccode\u003e6e53e88\u003c/code\u003e\u003c/a\u003e feat(release): gate benchmark complexity, packed consumers, managed files and...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/9c8a021bcb93ffcd7be65fd431032471e980d696\"\u003e\u003ccode\u003e9c8a021\u003c/code\u003e\u003c/a\u003e feat(badges): require mutation and Scorecard badges and publish them from sha...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MaverickCER/internal-package-contract/commit/3eb6ff7ba00cb5b3794356d88f2f2bc00567afd2\"\u003e\u003ccode\u003e3eb6ff7\u003c/code\u003e\u003c/a\u003e feat(readme): add the ReadmeStructure check and an adoption-first scaffold RE...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/maverickcer/internal-package-contract/compare/e13b3de4871e7509cb1969c4067a190e72a8c485...7240119d1919bcff5520836339ef52f7320004ea\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/MaverickCER/env-cap/pull/67","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/MaverickCER%2Fenv-cap/issues/67","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/67/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-19T03:41:47.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5917372984","node_id":"PR_kwDOTwfI388AAAABJPw2Qg","number":299,"state":"open","title":"👷 ci(deps): Bump the github-actions-minor-patch group with 9 updates","user":"dependabot[bot]","labels":["ci","dependencies"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T03:41:47.000Z","updated_at":"2026-10-19T03:42:07.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"👷 ci(deps): Bump","group_name":"github-actions-minor-patch","update_count":9,"packages":[{"name":"step-security/harden-runner","old_version":"2.22.0","new_version":"2.22.1","repository_url":"https://github.com/step-security/harden-runner"},{"name":"astral-sh/setup-uv","old_version":"10.2.0","new_version":"10.3.0","repository_url":"https://github.com/astral-sh/setup-uv"},{"name":"actions/upload-artifact","old_version":"7.0.1","new_version":"7.0.2","repository_url":"https://github.com/actions/upload-artifact"},{"name":"actions/download-artifact","old_version":"8.0.1","new_version":"8.0.2","repository_url":"https://github.com/actions/download-artifact"},{"name":"github/codeql-action/init","old_version":"4.38.2","new_version":"4.38.3","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/autobuild","old_version":"4.38.2","new_version":"4.38.3","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.38.2","new_version":"4.38.3","repository_url":"https://github.com/github/codeql-action"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.2","new_version":"4.38.3","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions-minor-patch group with 9 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.22.0` | `2.22.1` |\n| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.2.0` | `10.3.0` |\n| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |\n| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |\n| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |\n\nUpdates `step-security/harden-runner` from 2.22.0 to 2.22.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/step-security/harden-runner/releases\"\u003estep-security/harden-runner's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.22.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed security rules not initializing on GHES self-hosted runners\u003c/li\u003e\n\u003cli\u003eFixed GHES connectivity in block mode by implicitly allowing the GHES hostname\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.22.0...v2.22.1\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.22.0...v2.22.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ccd8616d44fd3846e67624a50d5aad6d37bf2d25\"\u003e\u003ccode\u003eccd8616\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/704\"\u003e#704\u003c/a\u003e from h0x0er/jatin/ghes-endp\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/037ccfd0b8acd0743d7ce4b3e53f67dc16f831b9\"\u003e\u003ccode\u003e037ccfd\u003c/code\u003e\u003c/a\u003e implicitly add ghes endpoint in allowList\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/e7438c7b4d9fde75004beb1805ca407c067d5340\"\u003e\u003ccode\u003ee7438c7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/703\"\u003e#703\u003c/a\u003e from h0x0er/jatin/ghes-codebuild-fixes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/afb0b33c8978810916155d52997450fe76eea40a\"\u003e\u003ccode\u003eafb0b33\u003c/code\u003e\u003c/a\u003e fixes for armour rules not getting initialised\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/step-security/harden-runner/compare/351661ca32ac09a36dc5ee2d536e3128f2a3c8ed...ccd8616d44fd3846e67624a50d5aad6d37bf2d25\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `astral-sh/setup-uv` from 10.2.0 to 10.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/astral-sh/setup-uv/releases\"\u003eastral-sh/setup-uv's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev10.3.0 🌈 Add Python architecture selection\u003c/h2\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cp\u003eThis release adds the \u003ccode\u003epython-arch\u003c/code\u003e input to select a Python architecture independently of the Python version. With \u003ccode\u003euv\u003c/code\u003e 0.13.0 or later, set \u003ccode\u003epython-arch: x86_64\u003c/code\u003e to use x64 Python on Windows ARM64 runners.\u003c/p\u003e\n\u003cp\u003eIt also includes embedded checksums for \u003ccode\u003euv\u003c/code\u003e releases through 0.13.0.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUse macOS 15 runners for tests \u003ca href=\"https://github.com/charliermarsh\"\u003e\u003ccode\u003e@​charliermarsh\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1081\"\u003e#1081\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🚀 Enhancements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003epython-arch\u003c/code\u003e support \u003ca href=\"https://github.com/zanieb\"\u003e\u003ccode\u003e@​zanieb\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1079\"\u003e#1079\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🧰 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore: update known checksums for 0.13.0 @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1089\"\u003e#1089\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.24 @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1084\"\u003e#1084\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.23 @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1082\"\u003e#1082\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.22 @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1080\"\u003e#1080\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.21 @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1078\"\u003e#1078\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.20 @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1076\"\u003e#1076\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.19 @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1068\"\u003e#1068\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.18 @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1065\"\u003e#1065\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⬆️ Dependency updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 @\u003ca href=\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1077\"\u003e#1077\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/1c37ad07a6a961277cf70c0d37d6f313000f5884\"\u003e\u003ccode\u003e1c37ad0\u003c/code\u003e\u003c/a\u003e chore: update known checksums for 0.13.0 (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1089\"\u003e#1089\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/b3c9b5fc56ebc90760c43b1ac9552c0d1705d3ca\"\u003e\u003ccode\u003eb3c9b5f\u003c/code\u003e\u003c/a\u003e chore: update known checksums for 0.12.24 (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1084\"\u003e#1084\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/b06acff4b6a41bdd9cdac56507ead0bd7734e757\"\u003e\u003ccode\u003eb06acff\u003c/code\u003e\u003c/a\u003e Add \u003ccode\u003epython-arch\u003c/code\u003e support (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1079\"\u003e#1079\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/c84232ca4fde9b022e20a930bfbbecd386b56fdf\"\u003e\u003ccode\u003ec84232c\u003c/code\u003e\u003c/a\u003e chore: update known checksums for 0.12.23 (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1082\"\u003e#1082\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/51fdd265d38a27ffcbca0da885510bc6fcc0ff55\"\u003e\u003ccode\u003e51fdd26\u003c/code\u003e\u003c/a\u003e Use macOS 15 runners for tests (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1081\"\u003e#1081\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/a96208bed1fb5efb8da349c9bcc6cc58af9e7d74\"\u003e\u003ccode\u003ea96208b\u003c/code\u003e\u003c/a\u003e chore: update known checksums for 0.12.22 (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1080\"\u003e#1080\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/0e3884b860e20d3f4d5daa2347130beb51ccde47\"\u003e\u003ccode\u003e0e3884b\u003c/code\u003e\u003c/a\u003e chore: update known checksums for 0.12.21 (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1078\"\u003e#1078\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/bcf05803b55ef01a5ec6368521ee1b42f97bc438\"\u003e\u003ccode\u003ebcf0580\u003c/code\u003e\u003c/a\u003e chore: update known checksums for 0.12.20 (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1076\"\u003e#1076\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/b92a892142bde7280cd163c2abff341413314f9f\"\u003e\u003ccode\u003eb92a892\u003c/code\u003e\u003c/a\u003e chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1077\"\u003e#1077\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/setup-uv/commit/227a0f6bea25cde3444f52decccf4a18de6635f4\"\u003e\u003ccode\u003e227a0f6\u003c/code\u003e\u003c/a\u003e chore: update known checksums for 0.12.19 (\u003ca href=\"https://redirect.github.com/astral-sh/setup-uv/issues/1068\"\u003e#1068\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/astral-sh/setup-uv/compare/c18668ad3cf93ea998bef934396af7bb5c839dc7...1c37ad07a6a961277cf70c0d37d6f313000f5884\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-artifact` from 7.0.1 to 7.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdates \u003ccode\u003e@​actions/artifact\u003c/code\u003e to v6.3.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/821\"\u003eactions/upload-artifact#821\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\"\u003ehttps://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003e\u003ccode\u003ecf430e0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/822\"\u003e#822\u003c/a\u003e from actions/tunc-d-prepare-upload-v7-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469\"\u003e\u003ccode\u003ec2acded\u003c/code\u003e\u003c/a\u003e chore: prepare v7.0.2 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a\"\u003e\u003ccode\u003e4687c1b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/821\"\u003e#821\u003c/a\u003e from actions/tunc-d-upload-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719\"\u003e\u003ccode\u003e8cbe1be\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/download-artifact` from 8.0.1 to 8.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/download-artifact/releases\"\u003eactions/download-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev8.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the readme by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/473\"\u003eactions/download-artifact#473\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare download-artifact v8.0.2 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/493\"\u003eactions/download-artifact#493\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\"\u003ehttps://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003e\u003ccode\u003e9000827\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/493\"\u003e#493\u003c/a\u003e from actions/tunc-d-prepare-download-v8-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/e455989ae00f5bdd4054f05d3e972c6bf8a62dc5\"\u003e\u003ccode\u003ee455989\u003c/code\u003e\u003c/a\u003e Prepare download-artifact v8.0.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/a00b90c4a2f01d73a8c89552caabca6ea3b43137\"\u003e\u003ccode\u003ea00b90c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/492\"\u003e#492\u003c/a\u003e from actions/tunc-d-download-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/29bb7ce6af5345aeab5bb4774ce7249ee3ccc27f\"\u003e\u003ccode\u003e29bb7ce\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/484a0b528fb4d7bd804637ccb632e47a0e638317\"\u003e\u003ccode\u003e484a0b5\u003c/code\u003e\u003c/a\u003e Update the readme (\u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/473\"\u003e#473\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from 4.38.2 to 4.38.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003e\u003ccode\u003e24c5418\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4214\"\u003e#4214\u003c/a\u003e from github/update-v4.38.3-e0b52dbdc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8\"\u003e\u003ccode\u003e69e87c5\u003c/code\u003e\u003c/a\u003e Add changelog note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa\"\u003e\u003ccode\u003e23b6828\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b\"\u003e\u003ccode\u003ee0b52db\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4210\"\u003e#4210\u003c/a\u003e from github/henrymercer/pin-python-for-older-clis-in-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc\"\u003e\u003ccode\u003e6b99698\u003c/code\u003e\u003c/a\u003e Pin Python 3.13.15 for older CLI versions in multi-language check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8\"\u003e\u003ccode\u003e63d3d63\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4203\"\u003e#4203\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe\"\u003e\u003ccode\u003e7377a10\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524\"\u003e\u003ccode\u003ec1a30cd\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974\"\u003e\u003ccode\u003ed208ec7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4200\"\u003e#4200\u003c/a\u003e from github/mbg/esm/migrate-pr-checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845\"\u003e\u003ccode\u003ea71b0c6\u003c/code\u003e\u003c/a\u003e Replace \u003ccode\u003e__dirname\u003c/code\u003e in \u003ccode\u003esync.ts\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/autobuild` from 4.38.2 to 4.38.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/autobuild's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/autobuild's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003e\u003ccode\u003e24c5418\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4214\"\u003e#4214\u003c/a\u003e from github/update-v4.38.3-e0b52dbdc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8\"\u003e\u003ccode\u003e69e87c5\u003c/code\u003e\u003c/a\u003e Add changelog note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa\"\u003e\u003ccode\u003e23b6828\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b\"\u003e\u003ccode\u003ee0b52db\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4210\"\u003e#4210\u003c/a\u003e from github/henrymercer/pin-python-for-older-clis-in-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc\"\u003e\u003ccode\u003e6b99698\u003c/code\u003e\u003c/a\u003e Pin Python 3.13.15 for older CLI versions in multi-language check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8\"\u003e\u003ccode\u003e63d3d63\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4203\"\u003e#4203\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe\"\u003e\u003ccode\u003e7377a10\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524\"\u003e\u003ccode\u003ec1a30cd\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974\"\u003e\u003ccode\u003ed208ec7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4200\"\u003e#4200\u003c/a\u003e from github/mbg/esm/migrate-pr-checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845\"\u003e\u003ccode\u003ea71b0c6\u003c/code\u003e\u003c/a\u003e Replace \u003ccode\u003e__dirname\u003c/code\u003e in \u003ccode\u003esync.ts\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.38.2 to 4.38.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003e\u003ccode\u003e24c5418\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4214\"\u003e#4214\u003c/a\u003e from github/update-v4.38.3-e0b52dbdc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8\"\u003e\u003ccode\u003e69e87c5\u003c/code\u003e\u003c/a\u003e Add changelog note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa\"\u003e\u003ccode\u003e23b6828\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b\"\u003e\u003ccode\u003ee0b52db\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4210\"\u003e#4210\u003c/a\u003e from github/henrymercer/pin-python-for-older-clis-in-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc\"\u003e\u003ccode\u003e6b99698\u003c/code\u003e\u003c/a\u003e Pin Python 3.13.15 for older CLI versions in multi-language check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8\"\u003e\u003ccode\u003e63d3d63\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4203\"\u003e#4203\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe\"\u003e\u003ccode\u003e7377a10\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524\"\u003e\u003ccode\u003ec1a30cd\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974\"\u003e\u003ccode\u003ed208ec7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4200\"\u003e#4200\u003c/a\u003e from github/mbg/esm/migrate-pr-checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845\"\u003e\u003ccode\u003ea71b0c6\u003c/code\u003e\u003c/a\u003e Replace \u003ccode\u003e__dirname\u003c/code\u003e in \u003ccode\u003esync.ts\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003e\u003ccode\u003e24c5418\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4214\"\u003e#4214\u003c/a\u003e from github/update-v4.38.3-e0b52dbdc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8\"\u003e\u003ccode\u003e69e87c5\u003c/code\u003e\u003c/a\u003e Add changelog note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa\"\u003e\u003ccode\u003e23b6828\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b\"\u003e\u003ccode\u003ee0b52db\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4210\"\u003e#4210\u003c/a\u003e from github/henrymercer/pin-python-for-older-clis-in-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc\"\u003e\u003ccode\u003e6b99698\u003c/code\u003e\u003c/a\u003e Pin Python 3.13.15 for older CLI versions in multi-language check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8\"\u003e\u003ccode\u003e63d3d63\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4203\"\u003e#4203\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe\"\u003e\u003ccode\u003e7377a10\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524\"\u003e\u003ccode\u003ec1a30cd\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.27.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974\"\u003e\u003ccode\u003ed208ec7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4200\"\u003e#4200\u003c/a\u003e from github/mbg/esm/migrate-pr-checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845\"\u003e\u003ccode\u003ea71b0c6\u003c/code\u003e\u003c/a\u003e Replace \u003ccode\u003e__dirname\u003c/code\u003e in \u003ccode\u003esync.ts\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e\n\n\u003c!-- This is an auto-generated description by cubic. --\u003e\n---\n## Summary by cubic\nBumps nine GitHub Actions across all workflows to their latest patch or minor releases.\n\n**Dependencies**\n- `astral-sh/setup-uv` v10.3.0 adds a `python-arch` input; no workflow changes needed since nothing uses it.\n- `ossf/scorecard-action` v2.5.0 moves to Scorecard v5.6.0.\n- `actions/upload-artifact` and `actions/download-artifact` add retries on HTTP 429 rate limiting.\n- `github/codeql-action` v4.38.3 updates the default bundle and warns that CodeQL ≤ 2.21.2 will soon be unsupported.\n- `step-security/harden-runner` v2.22.1 fixes GHES self-hosted runner setup.\n\n\u003csup\u003eWritten for commit 6159840c40a9d4564c53931cf4d72db5ac07c059. Summary will update on new commits.\u003c/sup\u003e\n\n\u003ca href=\"https://cubic.dev/pr/morzecrew/bloomery/pull/299?utm_source=github\" target=\"_blank\" rel=\"noopener noreferrer\" data-no-image-dialog=\"true\"\u003e\u003cpicture\u003e\u003csource media=\"(prefers-color-scheme: dark)\" srcset=\"https://www.cubic.dev/buttons/review-in-cubic-dark.svg\"\u003e\u003csource media=\"(prefers-color-scheme: light)\" srcset=\"https://www.cubic.dev/buttons/review-in-cubic-light.svg\"\u003e\u003cimg alt=\"View guided diff\" src=\"https://www.cubic.dev/buttons/review-in-cubic-light.svg\"\u003e\u003c/picture\u003e\u003c/a\u003e \u003ca href=\"https://www.cubic.dev/action/auto-fix/pr/morzecrew/bloomery/299?returnTo=https%3A%2F%2Fgithub.com%2Fmorzecrew%2Fbloomery%2Fpull%2F299\u0026source=description\" target=\"_blank\" rel=\"noopener noreferrer\" data-no-image-dialog=\"true\"\u003e\u003cpicture\u003e\u003csource media=\"(prefers-color-scheme: dark)\" srcset=\"https://www.cubic.dev/buttons/turn-on-auto-fix-dark.svg\"\u003e\u003csource media=\"(prefers-color-scheme: light)\" srcset=\"https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg\"\u003e\u003cimg alt=\"Turn on auto-fix\" src=\"https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg\"\u003e\u003c/picture\u003e\u003c/a\u003e\n\n\u003c!-- End of auto-generated description by cubic. --\u003e\n\n","html_url":"https://github.com/morzecrew/bloomery/pull/299","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/morzecrew%2Fbloomery/issues/299","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/299/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-19T03:26:32.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5917246373","node_id":"PR_kwDOBzS60s8AAAABJPqg4w","number":30285,"state":"open","title":"chore(deps): bump the github-actions group with 9 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T03:26:32.000Z","updated_at":"2026-10-19T03:27:01.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"github-actions","update_count":9,"packages":[{"name":"actions/create-github-app-token","old_version":"3.2.0","new_version":"3.3.0","repository_url":"https://github.com/actions/create-github-app-token"},{"name":"actions/download-artifact","old_version":"8.0.1","new_version":"8.0.2","repository_url":"https://github.com/actions/download-artifact"},{"name":"github/codeql-action/init","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/autobuild","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"goreleaser/goreleaser-action","old_version":"7.2.3","new_version":"7.3.0","repository_url":"https://github.com/goreleaser/goreleaser-action"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"zizmorcore/zizmor-action","old_version":"0.6.4","new_version":"0.7.1","repository_url":"https://github.com/zizmorcore/zizmor-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 9 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.2.0` | `3.3.0` |\n| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `7.2.3` | `7.3.0` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.6.4` | `0.7.1` |\n\nUpdates `actions/create-github-app-token` from 3.2.0 to 3.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/create-github-app-token/releases\"\u003eactions/create-github-app-token's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.3.0\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/compare/v3.2.0...v3.3.0\"\u003e3.3.0\u003c/a\u003e (2026-10-12)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eupdate permission inputs (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/399\"\u003e#399\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/a47236f79f79fcbc3532af49fe3a5ded89529b6e\"\u003ea47236f\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003edeps:\u003c/strong\u003e bump nested undici from 6.24.0 to 6.29.0 (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/403\"\u003e#403\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/12461a3a794e67c032f1eff5bb95ece9427eb4fb\"\u003e12461a3\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003edeps:\u003c/strong\u003e bump the production-dependencies group across 1 directory with 3 updates (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/395\"\u003e#395\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/a69c19ddfdf8e1ab093900e0064524ce9309c807\"\u003ea69c19d\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md\"\u003eactions/create-github-app-token's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/compare/v3.2.0...v3.3.0\"\u003e3.3.0\u003c/a\u003e (2026-10-12)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eupdate permission inputs (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/399\"\u003e#399\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/a47236f79f79fcbc3532af49fe3a5ded89529b6e\"\u003ea47236f\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003edeps:\u003c/strong\u003e bump nested undici from 6.24.0 to 6.29.0 (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/403\"\u003e#403\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/12461a3a794e67c032f1eff5bb95ece9427eb4fb\"\u003e12461a3\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003edeps:\u003c/strong\u003e bump the production-dependencies group across 1 directory with 3 updates (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/395\"\u003e#395\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/a69c19ddfdf8e1ab093900e0064524ce9309c807\"\u003ea69c19d\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/compare/v3.1.1...v3.2.0\"\u003e3.2.0\u003c/a\u003e (2026-05-12)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eadd support for enterprise-level GitHub Apps (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/263\"\u003e#263\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/952a2a7073df6bfa5f49bc469ec895b6ec1acea4\"\u003e952a2a7\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003esupport full repository names in \u003ccode\u003erepositories\u003c/code\u003e input (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/372\"\u003e#372\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/85eb8dd41472213aed25d1a126460e0069138ab6\"\u003e85eb8dd\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003edeps:\u003c/strong\u003e bump \u003ccode\u003e@​actions/core\u003c/code\u003e from 3.0.0 to 3.0.1 in the production-dependencies group (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/364\"\u003e#364\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/43e5c345bfd4d4f3ecea019ad0042001a09dd857\"\u003e43e5c34\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003evalidate private-key input (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/376\"\u003e#376\u003c/a\u003e) (\u003ca href=\"https://github.com/actions/create-github-app-token/commit/f24bbd89643991c0de27ae823c01791b2c6bafdd\"\u003ef24bbd8\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/64ab729a6294000f5aa4a4bc0b73d1f32bc45510\"\u003e\u003ccode\u003e64ab729\u003c/code\u003e\u003c/a\u003e chore(main): release 3.3.0 (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/402\"\u003e#402\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/f3a828e4b91180d3a46ac1f4b43fa8384b0dea07\"\u003e\u003ccode\u003ef3a828e\u003c/code\u003e\u003c/a\u003e ci: create signed dist commits in release workflow (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/404\"\u003e#404\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/655017ffa7c6b0c6e4210729fa6bce35cacd8ca0\"\u003e\u003ccode\u003e655017f\u003c/code\u003e\u003c/a\u003e docs: clarify when owner grants access to all repositories (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/378\"\u003e#378\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/12461a3a794e67c032f1eff5bb95ece9427eb4fb\"\u003e\u003ccode\u003e12461a3\u003c/code\u003e\u003c/a\u003e fix(deps): bump nested undici from 6.24.0 to 6.29.0 (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/403\"\u003e#403\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/a47236f79f79fcbc3532af49fe3a5ded89529b6e\"\u003e\u003ccode\u003ea47236f\u003c/code\u003e\u003c/a\u003e feat: update permission inputs (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/399\"\u003e#399\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/a69c19ddfdf8e1ab093900e0064524ce9309c807\"\u003e\u003ccode\u003ea69c19d\u003c/code\u003e\u003c/a\u003e fix(deps): bump the production-dependencies group across 1 directory with 3 u...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/d5cb7ae41d64331820d88810a4878e0942ec992a\"\u003e\u003ccode\u003ed5cb7ae\u003c/code\u003e\u003c/a\u003e build(deps): bump actions/checkout from 6 to 7 (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/384\"\u003e#384\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/575da866bd0a42d7f234a8645831d55573252b09\"\u003e\u003ccode\u003e575da86\u003c/code\u003e\u003c/a\u003e build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/e85f677b44da0d1f08115ce52cdfd8fd2c69874a\"\u003e\u003ccode\u003ee85f677\u003c/code\u003e\u003c/a\u003e test: omit stack traces from snapshots (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/401\"\u003e#401\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/create-github-app-token/commit/9419396df4d5672241cfb593dadc19758e54a204\"\u003e\u003ccode\u003e9419396\u003c/code\u003e\u003c/a\u003e build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (\u003ca href=\"https://redirect.github.com/actions/create-github-app-token/issues/400\"\u003e#400\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/create-github-app-token/compare/bcd2ba49218906704ab6c1aa796996da409d3eb1...64ab729a6294000f5aa4a4bc0b73d1f32bc45510\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/download-artifact` from 8.0.1 to 8.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/download-artifact/releases\"\u003eactions/download-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev8.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the readme by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/473\"\u003eactions/download-artifact#473\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare download-artifact v8.0.2 by \u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/493\"\u003eactions/download-artifact#493\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\"\u003ehttps://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003e\u003ccode\u003e9000827\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/493\"\u003e#493\u003c/a\u003e from actions/tunc-d-prepare-download-v8-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/e455989ae00f5bdd4054f05d3e972c6bf8a62dc5\"\u003e\u003ccode\u003ee455989\u003c/code\u003e\u003c/a\u003e Prepare download-artifact v8.0.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/a00b90c4a2f01d73a8c89552caabca6ea3b43137\"\u003e\u003ccode\u003ea00b90c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/492\"\u003e#492\u003c/a\u003e from actions/tunc-d-download-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/29bb7ce6af5345aeab5bb4774ce7249ee3ccc27f\"\u003e\u003ccode\u003e29bb7ce\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/download-artifact/commit/484a0b528fb4d7bd804637ccb632e47a0e638317\"\u003e\u003ccode\u003e484a0b5\u003c/code\u003e\u003c/a\u003e Update the readme (\u003ca href=\"https://redirect.github.com/actions/download-artifact/issues/473\"\u003e#473\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/download-artifact/compare/v8.0.1...9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/autobuild` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/autobuild's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/autobuild's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `goreleaser/goreleaser-action` from 7.2.3 to 7.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/goreleaser/goreleaser-action/releases\"\u003egoreleaser/goreleaser-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/570\"\u003egoreleaser/goreleaser-action#570\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/571\"\u003egoreleaser/goreleaser-action#571\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/575\"\u003egoreleaser/goreleaser-action#575\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/574\"\u003egoreleaser/goreleaser-action#574\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump undici from 6.27.0 to 6.28.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/576\"\u003egoreleaser/goreleaser-action#576\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump js-yaml from 5.2.2 to 5.2.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/573\"\u003egoreleaser/goreleaser-action#573\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump js-yaml from 5.2.3 to 5.4.1 in the npm group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/578\"\u003egoreleaser/goreleaser-action#578\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: reuse the goreleaser binary from the runner tool cache by \u003ca href=\"https://github.com/caarlos0\"\u003e\u003ccode\u003e@​caarlos0\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/577\"\u003egoreleaser/goreleaser-action#577\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 in the actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/581\"\u003egoreleaser/goreleaser-action#581\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump undici from 6.28.0 to 6.29.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/579\"\u003egoreleaser/goreleaser-action#579\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/580\"\u003egoreleaser/goreleaser-action#580\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/v7.2.3...v7.3.0\"\u003ehttps://github.com/goreleaser/goreleaser-action/compare/v7.2.3...v7.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/a4f02ab5355a589de60d917a659ce617ed19b3de\"\u003e\u003ccode\u003ea4f02ab\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/e27eb7769180b733cf28959f093582ddda91972e\"\u003e\u003ccode\u003ee27eb77\u003c/code\u003e\u003c/a\u003e chore(deps): bump the npm group with 2 updates (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/580\"\u003e#580\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/f5b4e31ee483102e19b17e532f024e8aee22d4fe\"\u003e\u003ccode\u003ef5b4e31\u003c/code\u003e\u003c/a\u003e chore(deps): bump undici from 6.28.0 to 6.29.0 (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/579\"\u003e#579\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/2d42c26fe04ca60644a41f10407c30998bc2f770\"\u003e\u003ccode\u003e2d42c26\u003c/code\u003e\u003c/a\u003e ci(deps): bump codecov/codecov-action (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/581\"\u003e#581\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/73cd4ffe39ceae11aafd47343ff35e8be087f14c\"\u003e\u003ccode\u003e73cd4ff\u003c/code\u003e\u003c/a\u003e feat: reuse the goreleaser binary from the runner tool cache (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/577\"\u003e#577\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/97a960754774e271e3eb4f389fe9b73400f2158c\"\u003e\u003ccode\u003e97a9607\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/689e48f9ac97190a2d170ebe29f3aed1a694464b\"\u003e\u003ccode\u003e689e48f\u003c/code\u003e\u003c/a\u003e chore(deps): bump js-yaml from 5.2.3 to 5.4.1 in the npm group (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/578\"\u003e#578\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/7e6b514c508941c26e8772ba9b920d0677e2160e\"\u003e\u003ccode\u003e7e6b514\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/4ec11830b6b44bb4bef0db5ddd7e04844da5519e\"\u003e\u003ccode\u003e4ec1183\u003c/code\u003e\u003c/a\u003e chore(deps): bump js-yaml from 5.2.2 to 5.2.3 (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/573\"\u003e#573\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/59060fdcfdbbfd4c87d837ab2c489d635c18f843\"\u003e\u003ccode\u003e59060fd\u003c/code\u003e\u003c/a\u003e chore: update generated files\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/f06c13b6b1a9625abc9e6e439d9c05a8f2190e94...a4f02ab5355a589de60d917a659ce617ed19b3de\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `zizmorcore/zizmor-action` from 0.6.4 to 0.7.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/zizmorcore/zizmor-action/releases\"\u003ezizmorcore/zizmor-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.7.1\u003c/h2\u003e\n\u003ch1\u003ezizmor changes\u003c/h1\u003e\n\u003ch2\u003eBug Fixes 🐛🔗\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eaction changes\u003c/h1\u003e\n\u003cp\u003eThe default version of zizmor is now 1.31.1.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSync zizmor versions by \u003ca href=\"https://github.com/github-actions\"\u003e\u003ccode\u003e@​github-actions\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zizmorcore/zizmor-action/pull/178\"\u003ezizmorcore/zizmor-action#178\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/zizmorcore/zizmor-action/compare/v0.7.0...v0.7.1\"\u003ehttps://github.com/zizmorcore/zizmor-action/compare/v0.7.0...v0.7.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev0.7.0\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/sponsors/woodruffw/\"\u003eSponsorship is appreciated!\u003c/a\u003e\u003c/p\u003e\n\u003ch1\u003ezizmor notes\u003c/h1\u003e\n\u003ch2\u003eEnhancements 🌱\u003ca href=\"https://docs.zizmor.sh/release-notes/#enhancements\"\u003e🔗\u003c/a\u003e\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe \u003ca href=\"https://docs.zizmor.sh/audits/#typosquat-uses\"\u003etyposquat-uses\u003c/a\u003e audit now supports pre-commit config inputs (\u003ca href=\"https://redirect.github.com/zizmorcore/zizmor...\n\n_Description has been truncated_","html_url":"https://github.com/argoproj/argo-cd/pull/30285","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/argoproj%2Fargo-cd/issues/30285","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/30285/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-19T03:11:22.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5917110992","node_id":"PR_kwDOPgHq288AAAABJPjn9w","number":149,"state":"open","title":"ci(deps): bump the actions group with 6 updates","user":"dependabot[bot]","labels":["dependencies","github-actions"],"assignees":[],"locked":false,"comments_count":4,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T03:11:22.000Z","updated_at":"2026-10-19T03:16:28.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci(deps): bump","group_name":"actions","update_count":6,"packages":[{"name":"dtolnay/rust-toolchain","old_version":"e2a55d2ffb04f378e9626c28d38b36d230d1e12f","new_version":"683b588c487a69d01f6c6ddf40f036ff682cc2c8","repository_url":"https://github.com/dtolnay/rust-toolchain"},{"name":"taiki-e/install-action","old_version":"2.87.27","new_version":"2.87.29","repository_url":"https://github.com/taiki-e/install-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/init","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.38.3","new_version":"4.39.0","repository_url":"https://github.com/github/codeql-action"},{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the actions group with 6 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) | `e2a55d2ffb04f378e9626c28d38b36d230d1e12f` | `683b588c487a69d01f6c6ddf40f036ff682cc2c8` |\n| [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.87.27` | `2.87.29` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n\nUpdates `dtolnay/rust-toolchain` from e2a55d2ffb04f378e9626c28d38b36d230d1e12f to 683b588c487a69d01f6c6ddf40f036ff682cc2c8\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/dtolnay/rust-toolchain/commit/683b588c487a69d01f6c6ddf40f036ff682cc2c8\"\u003e\u003ccode\u003e683b588\u003c/code\u003e\u003c/a\u003e Add 1.99.1 patch release\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/dtolnay/rust-toolchain/compare/e2a55d2ffb04f378e9626c28d38b36d230d1e12f...683b588c487a69d01f6c6ddf40f036ff682cc2c8\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `taiki-e/install-action` from 2.87.27 to 2.87.29\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/taiki-e/install-action/releases\"\u003etaiki-e/install-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.87.29\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ezizmor@latest\u003c/code\u003e to 1.31.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasmtime@latest\u003c/code\u003e to 49.0.3.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasm-tools@latest\u003c/code\u003e to 1.262.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.13.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etrivy@latest\u003c/code\u003e to 0.76.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etombi@latest\u003c/code\u003e to 1.8.4.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003erelease-plz@latest\u003c/code\u003e to 0.3.172.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003eosv-scanner@latest\u003c/code\u003e to 2.7.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.10.11.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emdbook-d2@latest\u003c/code\u003e to 0.3.9.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ekingfisher@latest\u003c/code\u003e to 2.13.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ekache@latest\u003c/code\u003e to 1.2.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ejust@latest\u003c/code\u003e to 1.59.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003edprint@latest\u003c/code\u003e to 0.63.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-crap@latest\u003c/code\u003e to 0.8.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ebpf-linker@latest\u003c/code\u003e to 0.12.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.87.28\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003edprint@latest\u003c/code\u003e to 0.62.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003evacuum@latest\u003c/code\u003e to 0.33.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.13.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etombi@latest\u003c/code\u003e to 1.8.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003erelease-plz@latest\u003c/code\u003e to 0.3.171.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003erclone@latest\u003c/code\u003e to 1.75.2.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.10.7.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-binstall@latest\u003c/code\u003e to 1.25.3.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md\"\u003etaiki-e/install-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cp\u003eAll notable changes to this project will be documented in this file.\u003c/p\u003e\n\u003cp\u003eThis project adheres to \u003ca href=\"https://semver.org\"\u003eSemantic Versioning\u003c/a\u003e.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e[Unreleased]\u003c/h2\u003e\n\u003ch2\u003e[2.87.29] - 2026-10-16\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ezizmor@latest\u003c/code\u003e to 1.31.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasmtime@latest\u003c/code\u003e to 49.0.3.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasm-tools@latest\u003c/code\u003e to 1.262.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.13.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etrivy@latest\u003c/code\u003e to 0.76.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etombi@latest\u003c/code\u003e to 1.8.4.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003erelease-plz@latest\u003c/code\u003e to 0.3.172.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003eosv-scanner@latest\u003c/code\u003e to 2.7.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.10.11.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emdbook-d2@latest\u003c/code\u003e to 0.3.9.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ekingfisher@latest\u003c/code\u003e to 2.13.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ekache@latest\u003c/code\u003e to 1.2.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ejust@latest\u003c/code\u003e to 1.59.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003edprint@latest\u003c/code\u003e to 0.63.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-crap@latest\u003c/code\u003e to 0.8.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ebpf-linker@latest\u003c/code\u003e to 0.12.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[2.87.28] - 2026-10-12\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003edprint@latest\u003c/code\u003e to 0.62.0.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/8cca0918f8471c33515202b73f56ab27f2bed283\"\u003e\u003ccode\u003e8cca091\u003c/code\u003e\u003c/a\u003e Release 2.87.29\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/fc26824601b40bd3b26712c48942016e2b2d12f6\"\u003e\u003ccode\u003efc26824\u003c/code\u003e\u003c/a\u003e Update wasmtime manifest\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/5018b2ebebbb2657068e91071ea73d9a53a44f2d\"\u003e\u003ccode\u003e5018b2e\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003ezizmor@latest\u003c/code\u003e to 1.31.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/d0e52041f440d731eae552c575c81c4cccd601c8\"\u003e\u003ccode\u003ed0e5204\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003ewasmtime@latest\u003c/code\u003e to 49.0.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/517774f2ae949bb5d89258edba4466e75f1a33be\"\u003e\u003ccode\u003e517774f\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003ewasm-tools@latest\u003c/code\u003e to 1.262.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/4bc69b1c8214eb6efb50b217dfb04ae04d8af1f5\"\u003e\u003ccode\u003e4bc69b1\u003c/code\u003e\u003c/a\u003e Update vacuum manifest\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/0470a3f16345a16a36a8b4b51fd72f0de5cc6b5b\"\u003e\u003ccode\u003e0470a3f\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003euv@latest\u003c/code\u003e to 0.13.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/7a2b747eb5f89f888d956c73464777912a182a35\"\u003e\u003ccode\u003e7a2b747\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003etrivy@latest\u003c/code\u003e to 0.76.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/7efb5337f67975eb612c46a52d9c7790a5829f97\"\u003e\u003ccode\u003e7efb533\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003etombi@latest\u003c/code\u003e to 1.8.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/taiki-e/install-action/commit/e5d37d6fd4d56d59f3bdc428d4138afa60276954\"\u003e\u003ccode\u003ee5d37d6\u003c/code\u003e\u003c/a\u003e Update \u003ccode\u003erelease-plz@latest\u003c/code\u003e to 0.3.172\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/taiki-e/install-action/compare/ab6895351a88b908e96a4697860d4ffea5e57dbe...8cca0918f8471c33515202b73f56ab27f2bed283\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.38.3 to 4.39.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003e\u003ccode\u003e6f2ac81\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4239\"\u003e#4239\u003c/a\u003e from github/update-v4.39.0-d63383a73\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d\"\u003e\u003ccode\u003eeb1c428\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1\"\u003e\u003ccode\u003e4443333\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a\"\u003e\u003ccode\u003ed63383a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4233\"\u003e#4233\u003c/a\u003e from github/mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022\"\u003e\u003ccode\u003e8dec0b9\u003c/code\u003e\u003c/a\u003e Rename \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003eresult\u003c/code\u003e in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350\"\u003e\u003ccode\u003e4eabea6\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d\"\u003e\u003ccode\u003e57938b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4201\"\u003e#4201\u003c/a\u003e from github/mario-campos/automate-changenotes-assemble\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b\"\u003e\u003ccode\u003eee07b50\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4236\"\u003e#4236\u003c/a\u003e from github/mbg/add-missing-changenotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581\"\u003e\u003ccode\u003ea897ed5\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82\"\u003e\u003ccode\u003ec8bd019\u003c/code\u003e\u003c/a\u003e Add change note for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/ThreatFlux/openai_rust_sdk/pull/149","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/ThreatFlux%2Fopenai_rust_sdk/issues/149","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/149/packages"}},{"old_version":"2.4.4","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-10-19T03:04:40.000Z","version_change":"2.4.4 → 2.5.0","issue":{"uuid":"5917052533","node_id":"PR_kwDOPX_v8s8AAAABJPgqCQ","number":267,"state":"open","title":"chore(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-10-19T03:04:40.000Z","updated_at":"2026-10-19T03:05:56.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps)","packages":[{"name":"ossf/scorecard-action","old_version":"2.4.4","new_version":"2.5.0","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action's container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href=\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ossf/scorecard-action\u0026package-manager=github_actions\u0026previous-version=2.4.4\u0026new-version=2.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/macalinao/grill/pull/267","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/macalinao%2Fgrill/issues/267","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/267/packages"}}]}