Skip to content

Bump the github-actions group with 2 updates - #2744

Merged
auto-submit[bot] merged 1 commit into
masterfrom
dependabot/github_actions/github-actions-d181cf987f
Sep 1, 2026
Merged

auto-submit[bot] merged 1 commit into
masterfrom
dependabot/github_actions/github-actions-d181cf987f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 2 updates: dart-lang/setup-dart and github/codeql-action/upload-sarif.

Updates dart-lang/setup-dart from 1.7.2 to 1.8.1

Release notes

Sourced from dart-lang/setup-dart's releases.

v1.8.1

  • Update workflows to pin actions/checkout to a commit SHA.
  • Harden workflow permissions to contents: read.
  • Update publish.yml reusable workflow to reference [email protected] and latest setup-flutter.
  • Bump undici to 6.28.0 and @vercel/ncc to 0.44.1.

v1.8.0

  • Add a problem matcher for dart analyze to automatically create inline annotations on GitHub pull requests.
  • Update publish.yml reusable workflow to reference [email protected] (running on Node 24) (#188[]).
  • Update GitHub Action dependencies (actions/checkout v7).
  • Bump undici to 6.27.0 and update npm dependencies.

#188: dart-lang/setup-dart#188

Changelog

Sourced from dart-lang/setup-dart's changelog.

v1.8.1

  • Update workflows to pin actions/checkout to a commit SHA.
  • Harden workflow permissions to contents: read.
  • Update publish.yml reusable workflow to reference [email protected] and latest setup-flutter.
  • Bump undici to 6.28.0 and @vercel/ncc to 0.44.1.

v1.8.0

  • Add a problem matcher for dart analyze to automatically create inline annotations on GitHub pull requests.
  • Update publish.yml reusable workflow to reference [email protected] (running on Node 24) (#188[]).
  • Update GitHub Action dependencies (actions/checkout v7).
  • Bump undici to 6.27.0 and update npm dependencies.

#188: dart-lang/setup-dart#188

v1.7.2

  • Update Node.js requirement to Node 24.
  • Fix open Dependabot alerts by bumping undici to >=6.24.0.
  • Update GitHub Action dependencies (@actions/core, @actions/exec, @actions/tool-cache, @actions/http-client).
  • Update workflow actions to their latest versions (actions/checkout v6, setup-flutter).

v1.7.1

  • Roll undici dependency to address CVE-2025-22150.
  • Update to the latest npm dependencies.
  • Recompile the action using the new Dart / JavaScript interop.

v1.7.0

v1.6.5

  • Fix zip path handling on Windows 11 (#118[])

#118: dart-lang/setup-dart#118

v1.6.4

  • Rebuild JS code.

v1.6.3

... (truncated)

Commits
  • 6afc89d Pin actions/checkout to a commit SHA and harden workflow permissions (#196)
  • b653b3c Prepare v1.8.1 release (#195)
  • 45165d2 Bump the github-actions group across 1 directory with 2 updates (#194)
  • 9af6bba Pin actions/checkout to a commit SHA in publish.yml (#193)
  • ddca5d2 Bump @​vercel/ncc in the npm-dependencies group across 1 directory (#185)
  • 5c116a3 Bump undici from 6.27.0 to 6.28.0 (#190)
  • 7654d45 chore: prepare v1.8.0 release (#188) (#189)
  • 43c102f Bump actions/checkout from 6 to 7 in the github-actions group (#184)
  • 10b57ef Bump the npm-dependencies group across 1 directory with 2 updates (#179)
  • a73965b Bump undici from 6.24.1 to 6.27.0 (#182)
  • Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.37.4 to 4.37.9

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.9

  • Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

  • Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061
Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

  • Update default CodeQL bundle version to 2.26.0. #3995

... (truncated)

Commits
  • cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
  • 7243f38 Update changelog for v4.37.9
  • 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
  • ecfa6e1 Add changelog note
  • adcdf4a Update default bundle to codeql-bundle-v2.26.4
  • 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
  • 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
  • ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
  • 4605e03 Rebuild
  • 099c869 Update changelog and version after v4.37.8
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 2 updates: [dart-lang/setup-dart](https://github.com/dart-lang/setup-dart) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `dart-lang/setup-dart` from 1.7.2 to 1.8.1
- [Release notes](https://github.com/dart-lang/setup-dart/releases)
- [Changelog](https://github.com/dart-lang/setup-dart/blob/main/CHANGELOG.md)
- [Commits](dart-lang/setup-dart@65eb853...6afc89d)

Updates `github/codeql-action/upload-sarif` from 4.37.4 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@f205ea1...cdf488f)

---
updated-dependencies:
- dependency-name: dart-lang/setup-dart
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added the autosubmit label Sep 1, 2026
@github-actions github-actions Bot added the type-infra A repository infrastructure change or enhancement label Sep 1, 2026
@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

PR Health

Changelog Entry ✔️
Package Changed Files

Changes to files need to be accounted for in their respective changelogs.

This check can be disabled by tagging the PR with skip-changelog-check.

@auto-submit
auto-submit Bot merged commit 8de693e into master Sep 1, 2026
88 checks passed
@auto-submit
auto-submit Bot deleted the dependabot/github_actions/github-actions-d181cf987f branch September 1, 2026 03:54
natebosch pushed a commit that referenced this pull request Sep 2, 2026
Bumps the github-actions group with 2 updates: [dart-lang/setup-dart](https://github.com/dart-lang/setup-dart) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).

Updates `dart-lang/setup-dart` from 1.7.2 to 1.8.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/dart-lang/setup-dart/releases">dart-lang/setup-dart's releases</a>.</em></p>
<blockquote>
<h2>v1.8.1</h2>
<ul>
<li>Update workflows to pin <code>actions/checkout</code> to a commit SHA.</li>
<li>Harden workflow permissions to <code>contents: read</code>.</li>
<li>Update <code>publish.yml</code> reusable workflow to reference <code>[email protected]</code> and latest <code>setup-flutter</code>.</li>
<li>Bump <code>undici</code> to <code>6.28.0</code> and <code>@vercel/ncc</code> to <code>0.44.1</code>.</li>
</ul>
<h2>v1.8.0</h2>
<ul>
<li>Add a problem matcher for <code>dart analyze</code> to automatically create inline annotations on GitHub pull requests.</li>
<li>Update <code>publish.yml</code> reusable workflow to reference <code>[email protected]</code> (running on Node 24) (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/188">#188</a>[]).</li>
<li>Update GitHub Action dependencies (<code>actions/checkout</code> v7).</li>
<li>Bump <code>undici</code> to <code>6.27.0</code> and update npm dependencies.</li>
</ul>
<p><a href="https://redirect.github.com/dart-lang/setup-dart/issues/188">#188</a>: <a href="https://redirect.github.com/dart-lang/setup-dart/issues/188">dart-lang/setup-dart#188</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/dart-lang/setup-dart/blob/main/CHANGELOG.md">dart-lang/setup-dart's changelog</a>.</em></p>
<blockquote>
<h2>v1.8.1</h2>
<ul>
<li>Update workflows to pin <code>actions/checkout</code> to a commit SHA.</li>
<li>Harden workflow permissions to <code>contents: read</code>.</li>
<li>Update <code>publish.yml</code> reusable workflow to reference <code>[email protected]</code> and latest <code>setup-flutter</code>.</li>
<li>Bump <code>undici</code> to <code>6.28.0</code> and <code>@vercel/ncc</code> to <code>0.44.1</code>.</li>
</ul>
<h2>v1.8.0</h2>
<ul>
<li>Add a problem matcher for <code>dart analyze</code> to automatically create inline annotations on GitHub pull requests.</li>
<li>Update <code>publish.yml</code> reusable workflow to reference <code>[email protected]</code> (running on Node 24) (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/188">#188</a>[]).</li>
<li>Update GitHub Action dependencies (<code>actions/checkout</code> v7).</li>
<li>Bump <code>undici</code> to <code>6.27.0</code> and update npm dependencies.</li>
</ul>
<p><a href="https://redirect.github.com/dart-lang/setup-dart/issues/188">#188</a>: <a href="https://redirect.github.com/dart-lang/setup-dart/issues/188">dart-lang/setup-dart#188</a></p>
<h2>v1.7.2</h2>
<ul>
<li>Update Node.js requirement to Node 24.</li>
<li>Fix open Dependabot alerts by bumping <code>undici</code> to <code>&gt;=6.24.0</code>.</li>
<li>Update GitHub Action dependencies (<code>@actions/core</code>, <code>@actions/exec</code>, <code>@actions/tool-cache</code>, <code>@actions/http-client</code>).</li>
<li>Update workflow actions to their latest versions (<code>actions/checkout</code> v6, <code>setup-flutter</code>).</li>
</ul>
<h2>v1.7.1</h2>
<ul>
<li>Roll <code>undici</code> dependency to address <a href="https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975">CVE-2025-22150</a>.</li>
<li>Update to the latest npm dependencies.</li>
<li>Recompile the action using the new Dart / JavaScript interop.</li>
</ul>
<h2>v1.7.0</h2>
<ul>
<li>
<p>Install flutter sdk in publishing step, allowing Flutter packages to be
published (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/68">#68</a>[])</p>
<p><a href="https://redirect.github.com/dart-lang/setup-dart/issues/68">#68</a>: <a href="https://redirect.github.com/dart-lang/setup-dart/issues/68">dart-lang/setup-dart#68</a></p>
</li>
</ul>
<h2>v1.6.5</h2>
<ul>
<li>Fix zip path handling on Windows 11 (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/118">#118</a>[])</li>
</ul>
<p><a href="https://redirect.github.com/dart-lang/setup-dart/issues/118">#118</a>: <a href="https://redirect.github.com/dart-lang/setup-dart/issues/118">dart-lang/setup-dart#118</a></p>
<h2>v1.6.4</h2>
<ul>
<li>Rebuild JS code.</li>
</ul>
<h2>v1.6.3</h2>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/dart-lang/setup-dart/commit/6afc89df92d6eb3834022f73cd65adc8cdfcb92d"><code>6afc89d</code></a> Pin actions/checkout to a commit SHA and harden workflow permissions (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/196">#196</a>)</li>
<li><a href="https://github.com/dart-lang/setup-dart/commit/b653b3cfefb8a28264680eac1d50028789184290"><code>b653b3c</code></a> Prepare v1.8.1 release (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/195">#195</a>)</li>
<li><a href="https://github.com/dart-lang/setup-dart/commit/45165d2ee1360cec3b96db808cfed1ac276dd71a"><code>45165d2</code></a> Bump the github-actions group across 1 directory with 2 updates (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/194">#194</a>)</li>
<li><a href="https://github.com/dart-lang/setup-dart/commit/9af6bba6fc903c8d3427e54f6bef88b1cb519a77"><code>9af6bba</code></a> Pin actions/checkout to a commit SHA in publish.yml (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/193">#193</a>)</li>
<li><a href="https://github.com/dart-lang/setup-dart/commit/ddca5d2081d05961010a263feb54fba5a01e4fb8"><code>ddca5d2</code></a> Bump <code>@​vercel/ncc</code> in the npm-dependencies group across 1 directory (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/185">#185</a>)</li>
<li><a href="https://github.com/dart-lang/setup-dart/commit/5c116a34f6a4c3b222192b56c5440d03fc813d96"><code>5c116a3</code></a> Bump undici from 6.27.0 to 6.28.0 (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/190">#190</a>)</li>
<li><a href="https://github.com/dart-lang/setup-dart/commit/7654d458321ee25acccccfdb86cd48bd95768ff1"><code>7654d45</code></a> chore: prepare v1.8.0 release (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/188">#188</a>) (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/189">#189</a>)</li>
<li><a href="https://github.com/dart-lang/setup-dart/commit/43c102f4dc9b9829c862401f0b64c7c9184eab4e"><code>43c102f</code></a> Bump actions/checkout from 6 to 7 in the github-actions group (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/184">#184</a>)</li>
<li><a href="https://github.com/dart-lang/setup-dart/commit/10b57efefac07722403c8b9c95fa68bb09276def"><code>10b57ef</code></a> Bump the npm-dependencies group across 1 directory with 2 updates (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/179">#179</a>)</li>
<li><a href="https://github.com/dart-lang/setup-dart/commit/a73965b3c99b30eb092908ce56c429eff91f9634"><code>a73965b</code></a> Bump undici from 6.24.1 to 6.27.0 (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/182">#182</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/dart-lang/setup-dart/compare/65eb853c7ba17dde3be364c3d2858773e7144260...6afc89df92d6eb3834022f73cd65adc8cdfcb92d">compare view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/upload-sarif` from 4.37.4 to 4.37.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's releases</a>.</em></p>
<blockquote>
<h2>v4.37.9</h2>
<ul>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>v4.37.8</h2>
<p>No user facing changes.</p>
<h2>v4.37.7</h2>
<ul>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>v4.37.6</h2>
<ul>
<li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>v4.37.5</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
</ul>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938"><code>cdf488f</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4107">#4107</a> from github/update-v4.37.9-920ba7cd1</li>
<li><a href="https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306"><code>7243f38</code></a> Update changelog for v4.37.9</li>
<li><a href="https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e"><code>920ba7c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4106">#4106</a> from github/update-bundle/codeql-bundle-v2.26.4</li>
<li><a href="https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2"><code>ecfa6e1</code></a> Add changelog note</li>
<li><a href="https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1"><code>adcdf4a</code></a> Update default bundle to codeql-bundle-v2.26.4</li>
<li><a href="https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e"><code>486fec2</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4099">#4099</a> from github/update-supported-enterprise-server-versions</li>
<li><a href="https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76"><code>134624c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4101">#4101</a> from github/dependabot/npm_and_yarn/npm-minor-457d82...</li>
<li><a href="https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c"><code>ff43db8</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4103">#4103</a> from github/mergeback/v4.37.8-to-main-db488dde</li>
<li><a href="https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816"><code>4605e03</code></a> Rebuild</li>
<li><a href="https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d"><code>099c869</code></a> Update changelog and version after v4.37.8</li>
<li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...cdf488f595d80d6e07e03d4674febd5ab45fa938">compare view</a></li>
</ul>
</details>
<br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions

</details>
copybara-service Bot pushed a commit to dart-lang/sdk that referenced this pull request Sep 4, 2026
Revisions updated by `dart tools/rev_sdk_deps.dart test`.

test (https://github.com/dart-lang/test/compare/55b186d..18ef597):
  18ef5978  Fri Sep 4 10:13:39 2026 -0700  Nate Bosch  Add support for collapsed error messages (dart-lang/test#2651)
  6783445c  Wed Sep 2 16:46:04 2026 -0700  Nate Bosch  Prepare to publish (dart-lang/test#2737)
  8de693e1  Tue Sep 1 03:54:15 2026 +0000  dependabot[bot]  Bump the github-actions group with 2 updates (dart-lang/test#2744)
  575e4dad  Mon Aug 31 17:01:46 2026 -0700  Nate Bosch  Fix deadlock waiting on serverSocket (dart-lang/test#2740)
  bd9acf32  Thu Aug 27 22:53:54 2026 -0700  Nate Bosch  Unskip a test on windows (dart-lang/test#2741)
  b575eda9  Thu Aug 27 17:16:16 2026 -0700  Nate Bosch  Remove redundant tag (dart-lang/test#2738)
  d21b06cb  Thu Aug 27 16:38:17 2026 -0700  dependabot[bot]  Bump the github-actions group across 1 directory with 5 updates (dart-lang/test#2709)
  773bc56c  Thu Aug 27 16:11:00 2026 -0700  Nate Bosch  Use read permissions in test_descriptor and test_process workflows (dart-lang/test#2736)
  73e85f1b  Wed Aug 26 06:36:41 2026 +0700  herdiyanitdev  Precompiled browser tests: stop serving files from outside the precompiled root (dart-lang/test#2724)
  bbe8f9bf  Tue Aug 18 09:02:24 2026 -0700  Kevin Moore  Export TestFailure from package:test_api/scaffolding.dart (dart-lang/test#2723)

TAG=agy
CONV=e6fd1c32-ded3-443f-83e5-2e15b4ffaccb
[email protected]

Change-Id: Iabc67d46c413470f0d2e5341e719d4edf702a94b
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/546020
Commit-Queue: Nate Bosch <[email protected]>
Auto-Submit: Nate Bosch <[email protected]>
Reviewed-by: Kevin Moore <[email protected]>
Commit-Queue: Kevin Moore <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

autosubmit type-infra A repository infrastructure change or enhancement

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant