Skip to content

Merge main into releases/v4 - #4239

Merged
mbg merged 130 commits into
releases/v4from
update-v4.39.0-d63383a73
Oct 15, 2026
Merged

Merge main into releases/v4#4239
mbg merged 130 commits into
releases/v4from
update-v4.39.0-d63383a73

Conversation

@github-actions

@github-actions github-actions Bot commented Oct 15, 2026 •
edited by mbg
Loading

Copy link
Copy Markdown
Contributor

Merging d63383a into releases/v4.

Conductor for this PR is @mbg.

Contains the following pull requests:

Please do the following:

  • Ensure the CHANGELOG displays the correct version and date.
  • Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
  • Check that there are not any unexpected commits being merged into the releases/v4 branch.
  • Ensure the docs team is aware of any documentation changes that need to be released.
  • Approve running the full set of PR checks if you have not pushed any changes.
  • Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.
  • Merge the mergeback PR that will automatically be created once this PR is merged.
  • Merge all backport PRs to older release branches, that will automatically be created once this PR is merged.

mbg and others added 30 commits September 22, 2026 16:25
@mbg
Refactor: Add determineCheckoutPath function for analyze action
99fe839
@mbg
Persist repository root from init action in CodeQL Action state
5dab0cc
@mbg
Verify persisted repository root path in analyze action
ba615b5
@mbg
Propagate checkoutPath to getRef
54a4349
@mbg
Allow getCheckoutPathInputOrThrow to get root from config
f5716fa
@mbg
Normalise the results of getGitRoot
6fb4a88
@mbg
Add tests for determineCheckoutPath
a876e23
@mbg
Consistently use resolved path
72509a8
@mbg
Merge remote-tracking branch 'origin/main' into mbg/improve-checkout-…
5769ffc 
…path
@mbg
Update git-utils tests
c2215db
@mbg
Allow logging functions to accept string[] directly
909fda1
@mbg
Refactor getCodeQLActionRepository out of setup-codeql
cb7acf5
@mbg
Use ActionState for getCodeQLActionRepository
3f57a00
@mbg
Refactor getCodeQLBundleDownloadURL out of setup-codeql
da07d40
@mbg
Add utility for assertions on sinon stubs with better output by default
35f12de
@mbg
Type the assetKind parameter
a4f9f6f
@mbg
Add getDefaultDotComDownloadURL
de99f0e
@mbg
Use getCodeQLAssetDownloadURL for start-proxy
133ffeb
@mbg
Fix onceWith not asserting the once part
f9a9962
@mario-campos
Hoist core of changenotes.mts assemble into own function
9a9f454
@mario-campos
Transfer change-notes to CHANGELOG.md via update-release-branch.ts
fb4048e
@mario-campos
Trim whitespace of change-notes before insertion
badda69
@mario-campos
Commit change-note deletions
0f6901c
@mario-campos
Use config vars over hardcoded literals
aae22cc
@henrymercer
Bump minimum CodeQL CLI version to 2.20.7
772ffcd 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@henrymercer
Bump version to 4.39.0
05d28f2 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@henrymercer
Stop testing CodeQL versions older than 2.20.7 in PR checks
74aeac9 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@henrymercer
Add CodeQL 2.25.6 to the PR check matrix
17e7897 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@henrymercer
Remove CODEQL_PROXY_* workaround for CLIs older than 2.20.7
b97fbb3 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@henrymercer
Remove Kotlin version limit workaround for CodeQL CLI 2.20.3
10e415a 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
mbg and others added 22 commits October 14, 2026 10:45
@mbg
Merge branch 'main' into dependabot/npm_and_yarn/octokit/plugin-pagin…
a5e9aeb 
…ate-rest-16.0.0
@dependabot
Bump the npm-minor group across 1 directory with 7 updates
efdb69c 
Bumps the npm-minor group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@actions/cache](https://github.com/actions/toolkit/tree/HEAD/packages/cache) | `5.2.0` | `5.3.0` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.16.0` | `1.16.1` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.2` | `5.4.3` |
| [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) | `65.0.1` | `65.2.0` |
| [globals](https://github.com/sindresorhus/globals) | `17.12.0` | `17.13.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.70.1` | `8.71.1` |
| [mdast-util-from-markdown](https://github.com/syntax-tree/mdast-util-from-markdown) | `2.0.3` | `2.1.0` |



Updates `@actions/cache` from 5.2.0 to 5.3.0
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/cache/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/cache)

Updates `follow-redirects` from 1.16.0 to 1.16.1
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.16.0...v1.16.1)

Updates `js-yaml` from 5.4.2 to 5.4.3
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.4.2...5.4.3)

Updates `eslint-plugin-jsdoc` from 65.0.1 to 65.2.0
- [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases)
- [Commits](gajus/eslint-plugin-jsdoc@v65.0.1...v65.2.0)

Updates `globals` from 17.12.0 to 17.13.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.12.0...v17.13.0)

Updates `typescript-eslint` from 8.70.1 to 8.71.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.1/packages/typescript-eslint)

Updates `mdast-util-from-markdown` from 2.0.3 to 2.1.0
- [Release notes](https://github.com/syntax-tree/mdast-util-from-markdown/releases)
- [Commits](syntax-tree/mdast-util-from-markdown@2.0.3...2.1.0)

---
updated-dependencies:
- dependency-name: "@actions/cache"
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: follow-redirects
  dependency-version: 1.16.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: js-yaml
  dependency-version: 5.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: eslint-plugin-jsdoc
  dependency-version: 65.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: globals
  dependency-version: 17.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: typescript-eslint
  dependency-version: 8.71.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: mdast-util-from-markdown
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions
Rebuild
25fe42a
@mbg
Merge branch 'main' into mbg/improve-checkout-path
4f74769
@henrymercer
Merge pull request #4234 from github/dependabot/npm_and_yarn/npm-mino…
85944e0 
…r-2d4d2c9463

Bump the npm-minor group across 1 directory with 7 updates
@henrymercer
Merge pull request #4208 from github/dependabot/npm_and_yarn/octokit/…
2b07ff4 
…plugin-paginate-rest-16.0.0

Bump @octokit/plugin-paginate-rest from 15.0.0 to 16.0.0
@mbg
Merge remote-tracking branch 'origin/main' into mbg/start-proxy/depre…
9da9625 
…cate-fallback
@mbg
Fix typo in log message
71ad3a7
@mbg
Rename proxyBin to proxyDir
962aaad
@mbg
Revert "Allow logging functions to accept string[] directly"
28d5dd9 
This reverts commit 909fda1.
@mbg
Merge pull request #4198 from github/mbg/start-proxy/deprecate-fallback
f5b8e09 
Use `setup-codeql` logic for finding release assets in `start-proxy`
@mbg
Merge pull request #4206 from github/mbg/set-restore-keys
f460dc7 
Include primary cache keys as restore key
@mbg
Merge pull request #4148 from github/mbg/improve-checkout-path
2a3e756 
Validate `checkout_path` input in `analyze` action
@mbg
Add change note for #4148
c98271e
@mbg
Add change note for #4198
c8bd019
@mbg
Add change note for #4206
a897ed5
@mbg
Merge pull request #4236 from github/mbg/add-missing-changenotes
ee07b50 
Add missing change notes for recent PRs
@mbg
Merge pull request #4201 from github/mario-campos/automate-changenote…
57938b8 
…s-assemble

Incorporate change-notes into CHANGELOG.md at release
@mbg
Merge remote-tracking branch 'origin/main' into mbg/start-proxy/repor…
4eabea6 
…t-version
@mbg
Rename path to result in tests
8dec0b9
@mbg
Merge pull request #4233 from github/mbg/start-proxy/report-version
d63383a 
Report release version the proxy is taken from in `start-proxy` telemetry
@github-actions
Update changelog for v4.39.0
4443333
@github-actions
github-actions Bot requested a review from a team as a code owner October 15, 2026 10:34
@github-actions github-actions Bot added the size/XXL May be extremely hard to review label Oct 15, 2026
@mbg
mbg merged commit 6f2ac81 into releases/v4 Oct 15, 2026
232 checks passed
@mbg
mbg deleted the update-v4.39.0-d63383a73 branch October 15, 2026 10:55
@github-actions github-actions Bot mentioned this pull request Oct 15, 2026
Merged
6 tasks done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mbg mbg mbg approved these changes

Assignees

@mbg mbg

Labels

size/XXL May be extremely hard to review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@mbg @mario-campos @henrymercer @navntoft