From 73aad0eaa9df172668665a150d17b8bc5a650c20 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 13:47:43 +0000
Subject: [PATCH 1/4] Update changelog for v4.37.2

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f1a24768d4..70c4a7694f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
 
-## [UNRELEASED]
+## 4.37.2 - 21 Jul 2026
 
 No user facing changes.
 

From e0faed839190caa67a5cd42f1cc16246028ca3df Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Tue, 21 Jul 2026 15:06:15 +0100
Subject: [PATCH 2/4] Add a couple of change notes

---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 70c4a7694f..3694675753 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,8 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 ## 4.37.2 - 21 Jul 2026
 
-No user facing changes.
+- The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://github.com/github/codeql-action/pull/4023)
+- The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://github.com/github/codeql-action/pull/4007)
 
 ## 4.37.1 - 16 Jul 2026
 

From d6217b9b8c14166e4851db94c11155d03bd13c07 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 14:26:50 +0000
Subject: [PATCH 3/4] Update changelog and version after v4.37.2

---
 CHANGELOG.md      | 4 ++++
 package-lock.json | 4 ++--
 package.json      | 2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3694675753..79389b0d99 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
 
+## [UNRELEASED]
+
+No user facing changes.
+
 ## 4.37.2 - 21 Jul 2026
 
 - The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://github.com/github/codeql-action/pull/4023)
diff --git a/package-lock.json b/package-lock.json
index ab54e3d91a..d08a05a351 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "4.37.2",
+  "version": "4.37.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "4.37.2",
+      "version": "4.37.3",
       "license": "MIT",
       "workspaces": [
         "pr-checks"
diff --git a/package.json b/package.json
index f0a99f0dd3..5a2103c244 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "4.37.2",
+  "version": "4.37.3",
   "private": true,
   "description": "CodeQL action",
   "scripts": {

From 526ab84f9858816d9cf5f7b9df4dd5e2235f0eba Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 14:27:05 +0000
Subject: [PATCH 4/4] Rebuild

---
 lib/entry-points.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/entry-points.js b/lib/entry-points.js
index af413630eb..70a95fded0 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -145331,7 +145331,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) {
   return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME);
 }
 function getActionVersion() {
-  return "4.37.2";
+  return "4.37.3";
 }
 function getWorkflowEventName(env = getEnv()) {
   return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */);