Skip to content

chore(deps): bump github/codeql-action/analyze from 4.38.0 to 4.38.2 - #758

Merged
SunSi12138 merged 55 commits into
devfrom
dependabot/github_actions/github/codeql-action/analyze-4.38.2
Oct 9, 2026
Merged

chore(deps): bump github/codeql-action/analyze from 4.38.0 to 4.38.2#758
SunSi12138 merged 55 commits into
devfrom
dependabot/github_actions/github/codeql-action/analyze-4.38.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps github/codeql-action/analyze from 4.38.0 to 4.38.2.

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.2

  • Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146
Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.2 - 24 Sept 2026

  • Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

... (truncated)

Commits
  • 2892aa5 Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f
  • 8ad03a3 Trigger workflows
  • 98af865 Update changelog for v4.38.2
  • a6ef2c9 Merge pull request #4156 from github/mario-campos/fix-validate-cmd
  • 1ef28a1 Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...
  • 26cb08b Merge pull request #4163 from github/mbg/fix-getCommitOid-stubs
  • f035ce3 Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...
  • 5e4e255 Rebuild
  • b13f5f4 Bump ruby/setup-ruby
  • c87fe57 Rebuild
  • Additional commits viewable in compare view

dependabot Bot and others added 30 commits August 9, 2026 18:13
@dependabot
Bump the testing group with 1 update
c80c271 
Bumps TUnit from 1.63.0 to 1.64.6

---
updated-dependencies:
- dependency-name: TUnit
  dependency-version: 1.64.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: testing
...

Signed-off-by: dependabot[bot] <support@github.com>
@SunSi12138
Merge pull request #96 from SunSi12138/dependabot/nuget/testing-41a5c…
d820396 
…bf2f9

Bump the testing group with 1 update
@dependabot sunsi
chore(deps): bump github/codeql-action/init from 4.37.4 to 4.37.6
3e695be 
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.4 to 4.37.6.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@f205ea1...5595cca)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
sunsi
chore(ci): pair CodeQL actions at 4.37.6
dbf4b33
@SunSi12138
Merge pull request #97 from SunSi12138/dependabot/github_actions/gith…
2f83637 
…ub/codeql-action/init-4.37.6

Bump github/codeql-action from 4.37.4 to 4.37.6
@dependabot
Bump Microsoft.Extensions.DependencyInjection and 6 others
c1b8405 
Bumps Microsoft.Extensions.DependencyInjection from 10.0.10 to 10.0.11
Bumps Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.10 to 10.0.11
Bumps Microsoft.Extensions.Diagnostics.HealthChecks from 10.0.10 to 10.0.11
Bumps Microsoft.Extensions.Hosting from 10.0.10 to 10.0.11
Bumps Microsoft.Extensions.Logging to 10.0.11
Bumps Microsoft.Extensions.Logging.Abstractions from 10.0.10 to 10.0.11
Bumps Microsoft.Extensions.Logging.Console from 10.0.10 to 10.0.11

---
updated-dependencies:
- dependency-name: Microsoft.Extensions.DependencyInjection
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: microsoft-extensions
- dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: microsoft-extensions
- dependency-name: Microsoft.Extensions.Diagnostics.HealthChecks
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: microsoft-extensions
- dependency-name: Microsoft.Extensions.Hosting
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: microsoft-extensions
- dependency-name: Microsoft.Extensions.Logging
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: microsoft-extensions
- dependency-name: Microsoft.Extensions.Logging
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: microsoft-extensions
- dependency-name: Microsoft.Extensions.Logging.Abstractions
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: microsoft-extensions
- dependency-name: Microsoft.Extensions.Logging.Console
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: microsoft-extensions
...

Signed-off-by: dependabot[bot] <support@github.com>
@SunSi12138
Merge pull request #389 from SunSi12138/dependabot/nuget/demo/DemoBas…
15d6f56 
…e/microsoft-extensions-9b6f1c2dce

Bump Microsoft.Extensions.DependencyInjection and 6 others
@SunSi12138
chore: bump version to 1.1.2
76877f7
@SunSi12138
Merge pull request #390 from SunSi12138/release/1.1.2
63d710d 
chore: release 1.1.2
@dependabot
Bump the testing group with 1 update
6b50c7b 
Bumps TUnit from 1.64.6 to 1.65.68

---
updated-dependencies:
- dependency-name: TUnit
  dependency-version: 1.65.68
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: testing
...

Signed-off-by: dependabot[bot] <support@github.com>
@SunSi12138
Merge pull request #468 from SunSi12138/dependabot/nuget/testing-dff2…
56c0bcb 
…cc221a

Bump the testing group with 1 update
@dependabot
chore(deps): bump github/codeql-action/analyze from 4.37.6 to 4.37.9
d825c34 
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.6 to 4.37.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@5595cca...cdf488f)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@SunSi12138
Merge pull request #469 from SunSi12138/dependabot/github_actions/git…
ae6fe8b 
…hub/codeql-action/analyze-4.37.9

chore(deps): bump github/codeql-action/analyze from 4.37.6 to 4.37.9
@dependabot
chore(deps): bump github/codeql-action/init from 4.37.6 to 4.37.9
f62aaf7 
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.6 to 4.37.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@5595cca...cdf488f)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@SunSi12138
Merge pull request #470 from SunSi12138/dependabot/github_actions/git…
1d7928a 
…hub/codeql-action/init-4.37.9

chore(deps): bump github/codeql-action/init from 4.37.6 to 4.37.9
@SunSi12138
chore(deps): bump Microsoft.CodeAnalysis.CSharp from 5.6.0 to 5.9.0
a6a0829
@SunSi12138
Merge pull request #467 from SunSi12138/dependabot/nuget/roslyn-0c453…
21ed74f 
…febc3

Bump Microsoft.CodeAnalysis.CSharp from 5.6.0 to 5.9.0
@dependabot
Bump the roslyn group with 2 updates
b08a76e 
Bumps Microsoft.CodeAnalysis.Analyzers from 5.6.0 to 5.9.0
Bumps Microsoft.CodeAnalysis.CSharp from 5.0.0 to 5.9.0

---
updated-dependencies:
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: roslyn
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: roslyn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump the testing group with 1 update
91ce1df 
Bumps TUnit from 1.65.68 to 1.66.16

---
updated-dependencies:
- dependency-name: TUnit
  dependency-version: 1.66.16
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: testing
...

Signed-off-by: dependabot[bot] <support@github.com>
@SunSi12138
Decouple client lifecycle from remote readiness
5c3574b 
Introduce independent local lifecycle, readiness, and cluster state domains for single- and multi-cluster clients. Start hosted clients without blocking on remote availability, supervise initial connectivity recovery, preserve legacy explicit connection semantics, keep runtime Add/Replace candidates in the new child lifecycle, and prevent compatibility connection failures from tearing down an already-running coordinator.

Fixes #644
@SunSi12138
Merge pull request #647 from SunSi12138/issue-644-client-lifecycle-re…
9ba50b9 
…adiness

Decouple client lifecycle from remote readiness
@SunSi12138
Split server start, wait, and stop lifecycle
b3b372a 
Replace public RunAsync with explicit StartAsync, WaitForShutdownAsync, and StopAsync ownership. Move accept/runtime supervision into SharpLinkServer, keep per-connection cleanup failures local including heartbeat-timeout cleanup, simplify Generic Host lifetime bridging, migrate repository callers, and document terminal failure semantics.

Fixes #646
@SunSi12138
Merge pull request #648 from SunSi12138/issue-646-server-lifecycle
8183ac2 
Split server start/wait/stop lifecycle
@SunSi12138
Revert "Merge pull request #648 from SunSi12138/issue-646-server-life…
952c2de 
…cycle"

This reverts commit 8183ac2, restoring the first-parent tree at 9ba50b9.
@SunSi12138
Revert "Merge pull request #647 from SunSi12138/issue-644-client-life…
ed62ff6 
…cycle-readiness"

This reverts commit 9ba50b9, restoring the pre-accident main tree at 21ed74f.
@SunSi12138
Merge pull request #657 from SunSi12138/fix/revert-accidental-main-20…
c1faa7e 
…26-09-10

Revert accidental main merges from 2026-09-10
@SunSi12138
Merge pull request #566 from SunSi12138/dependabot/nuget/roslyn-66d02…
0ba70fc 
…e3670

Bump the roslyn group with 2 updates
@SunSi12138
Merge branch 'main' into dependabot/nuget/testing-9871165df4
bcdf918
@SunSi12138
Merge pull request #567 from SunSi12138/dependabot/nuget/testing-9871…
7b128b5 
…165df4

Bump the testing group with 1 update
@SunSi12138
Merge dev into the 2.0 main release candidate
d6b33a3
@SunSi12138
Merge pull request #690 from SunSi12138/release/2.0.0-final
ac36ba4 
Release: merge the reviewed 2.0.0 dev content into main
@SunSi12138
chore: sync dev CI stability fixes onto main baseline
bc5ac5f 
Bring the reviewed #698 and #699 dev tree onto the current main history without changing version metadata, tags, or release state.
@SunSi12138
chore: refresh main sync with Browser codec evidence policy
e9cb0b1 
Advance the main synchronization branch to the current dev tree after #701. Keep the known unsupported Browser auto-layout variance as retained evidence without making it a release blocker.
@SunSi12138
chore: refresh main sync with Browser evidence validator follow-up
572b385 
Advance the main synchronization branch to the current dev tree after #702.
@SunSi12138
chore: refresh main sync with Browser CoreCLR evidence
5d05e13 
Advance the main synchronization branch to the current dev tree after #703 and #704.
@SunSi12138
chore: refresh main sync with deterministic Browser runtime identity
38d5f67 
Advance the main synchronization branch to the current dev tree after #705.
@SunSi12138
Merge pull request #700 from SunSi12138/sync/dev-main-20260918-ci-sta…
e46d26b 
…bility

chore: sync reviewed CI stability fixes into main
@SunSi12138
Merge pull request #708 from SunSi12138/dev
8cbcffa 
docs(codec): sync CoreCLR-first compatibility contract
@SunSi12138
Merge pull request #709 from SunSi12138/dev
28fd9f4 
chore(deps): promote Dependabot updates to main
@SunSi12138
Merge pull request #712 from SunSi12138/dev
f41bb79 
chore(release): promote 2.0.1 preparation to main
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 27, 2026
@SunSi12138
Merge pull request #765 from SunSi12138/dev
1205704 
chore(release): promote 2.0.2 preparation to main
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github/codeql-action/analyze-4.38.2 branch from 83475c7 to d996cc3 Compare October 2, 2026 05:18
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github/codeql-action/analyze-4.38.2 branch from d996cc3 to cd3e942 Compare October 3, 2026 04:28
sunsi and others added 3 commits October 3, 2026 13:24
sunsi
chore(release): 收口正式矩阵容量与十分钟发布稳定性验收
27c41dd
@SunSi12138
Merge pull request #777 from SunSi12138/release/2.0.3-ten-minute-vali…
497fab4 
…dation

chore(release): 收口矩阵容量与十分钟发布稳定性验收
@dependabot
chore(deps): bump github/codeql-action/analyze from 4.38.0 to 4.38.2
7194c50 
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.38.0 to 4.38.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@b96794f...2892aa5)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github/codeql-action/analyze-4.38.2 branch from cd3e942 to 7194c50 Compare October 3, 2026 05:43
@SunSi12138
SunSi12138 changed the base branch from main to dev October 9, 2026 02:52
@SunSi12138
SunSi12138 merged commit 667baa7 into dev Oct 9, 2026
54 of 55 checks passed
@SunSi12138
SunSi12138 deleted the dependabot/github_actions/github/codeql-action/analyze-4.38.2 branch October 9, 2026 02:56
SunSi12138 pushed a commit that referenced this pull request Oct 9, 2026
@dependabot
chore(deps): bump CodeQL init to 4.38.2 (#759)
1219d71 
Complete the paired CodeQL 4.38.2 update with #758. Updated this branch from dev and verified PR Fast run 37877032117 and CodeQL run 37877032068 both passed on bc97c67. Only the init action pin differs from current dev.
@SunSi12138 SunSi12138 mentioned this pull request Oct 9, 2026
Merged
SunSi12138 added a commit that referenced this pull request Oct 9, 2026
@SunSi12138
chore(deps): promote CodeQL and TUnit updates from dev (#789)
f266296 
Promote only dependency updates #758, #759, and #788 after sequential protected dev merges. CodeQL init/analyze 4.38.2 and TUnit 1.72.16; three changed lines across two files. Integration tree a19b407 equals dev a14e212.

Release Gate 37878056212 passed on c615570: 48 successful jobs, only tag-only publish-nuget skipped. Windows/Linux/macOS each ran Unit 1882, Generator 269, Load 77, Integration 453 with zero failures or skipped tests. Fast, CodeQL, package smoke and padding-security checks passed. No tag or NuGet publication.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@SunSi12138