From d6217b9b8c14166e4851db94c11155d03bd13c07 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 21 Jul 2026 14:26:50 +0000 Subject: [PATCH 1/4] Update changelog and version after v4.37.2 --- CHANGELOG.md | 4 ++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3694675753..79389b0d99 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. +## [UNRELEASED] + +No user facing changes. + ## 4.37.2 - 21 Jul 2026 - The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://github.com/github/codeql-action/pull/4023) diff --git a/package-lock.json b/package-lock.json index ab54e3d91a..d08a05a351 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codeql", - "version": "4.37.2", + "version": "4.37.3", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codeql", - "version": "4.37.2", + "version": "4.37.3", "license": "MIT", "workspaces": [ "pr-checks" diff --git a/package.json b/package.json index f0a99f0dd3..5a2103c244 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "4.37.2", + "version": "4.37.3", "private": true, "description": "CodeQL action", "scripts": { From 526ab84f9858816d9cf5f7b9df4dd5e2235f0eba Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 21 Jul 2026 14:27:05 +0000 Subject: [PATCH 2/4] Rebuild --- lib/entry-points.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index af413630eb..70a95fded0 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145331,7 +145331,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) { return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME); } function getActionVersion() { - return "4.37.2"; + return "4.37.3"; } function getWorkflowEventName(env = getEnv()) { return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */); From 3b5ee58597653d9cc6785f3f1277f796d81f3646 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 05:55:30 +0100 Subject: [PATCH 3/4] Use default `request` options instead of `undefined` --- lib/entry-points.js | 126 ++++++++++++++++++++++---------------------- src/api-client.ts | 4 +- 2 files changed, 66 insertions(+), 64 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 70a95fded0..b7db317324 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -22066,12 +22066,12 @@ function isPlainObject(value) { const Ctor = Object.prototype.hasOwnProperty.call(proto, "constructor") && proto.constructor; return typeof Ctor === "function" && Ctor instanceof Ctor && Function.prototype.call(Ctor) === Function.prototype.call(value); } -function mergeDeep(defaults2, options) { - const result = Object.assign({}, defaults2); +function mergeDeep(defaults3, options) { + const result = Object.assign({}, defaults3); Object.keys(options).forEach((key) => { if (isPlainObject(options[key])) { - if (!(key in defaults2)) Object.assign(result, { [key]: options[key] }); - else result[key] = mergeDeep(defaults2[key], options[key]); + if (!(key in defaults3)) Object.assign(result, { [key]: options[key] }); + else result[key] = mergeDeep(defaults3[key], options[key]); } else { Object.assign(result, { [key]: options[key] }); } @@ -22086,7 +22086,7 @@ function removeUndefinedProperties(obj) { } return obj; } -function merge(defaults2, route, options) { +function merge(defaults3, route, options) { if (typeof route === "string") { let [method, url2] = route.split(" "); options = Object.assign(url2 ? { method, url: url2 } : { url: method }, options); @@ -22096,10 +22096,10 @@ function merge(defaults2, route, options) { options.headers = lowercaseKeys(options.headers); removeUndefinedProperties(options); removeUndefinedProperties(options.headers); - const mergedOptions = mergeDeep(defaults2 || {}, options); + const mergedOptions = mergeDeep(defaults3 || {}, options); if (options.url === "/graphql") { - if (defaults2 && defaults2.mediaType.previews?.length) { - mergedOptions.mediaType.previews = defaults2.mediaType.previews.filter( + if (defaults3 && defaults3.mediaType.previews?.length) { + mergedOptions.mediaType.previews = defaults3.mediaType.previews.filter( (preview) => !mergedOptions.mediaType.previews.includes(preview) ).concat(mergedOptions.mediaType.previews); } @@ -22332,8 +22332,8 @@ function parse(options) { options.request ? { request: options.request } : null ); } -function endpointWithDefaults(defaults2, route, options) { - return parse(merge(defaults2, route, options)); +function endpointWithDefaults(defaults3, route, options) { + return parse(merge(defaults3, route, options)); } function withDefaults(oldDefaults, newDefaults) { const DEFAULTS2 = merge(oldDefaults, newDefaults); @@ -22932,21 +22932,21 @@ var init_dist_src2 = __esm({ userAgentTrail = `octokit-core.js/${VERSION4} ${getUserAgent()}`; Octokit = class { static VERSION = VERSION4; - static defaults(defaults2) { + static defaults(defaults3) { const OctokitWithDefaults = class extends this { constructor(...args) { const options = args[0] || {}; - if (typeof defaults2 === "function") { - super(defaults2(options)); + if (typeof defaults3 === "function") { + super(defaults3(options)); return; } super( Object.assign( {}, - defaults2, + defaults3, options, - options.userAgent && defaults2.userAgent ? { - userAgent: `${options.userAgent} ${defaults2.userAgent}` + options.userAgent && defaults3.userAgent ? { + userAgent: `${options.userAgent} ${defaults3.userAgent}` } : null ) ); @@ -25358,8 +25358,8 @@ function endpointsToMethods(octokit) { } return newMethods; } -function decorate(octokit, scope, methodName, defaults2, decorations) { - const requestWithDefaults = octokit.request.defaults(defaults2); +function decorate(octokit, scope, methodName, defaults3, decorations) { + const requestWithDefaults = octokit.request.defaults(defaults3); function withDecorations(...args) { let options = requestWithDefaults.endpoint.merge(...args); if (decorations.mapToData) { @@ -25406,14 +25406,14 @@ var init_endpoints_to_methods = __esm({ endpointMethodsMap = /* @__PURE__ */ new Map(); for (const [scope, endpoints] of Object.entries(endpoints_default)) { for (const [methodName, endpoint2] of Object.entries(endpoints)) { - const [route, defaults2, decorations] = endpoint2; + const [route, defaults3, decorations] = endpoint2; const [method, url2] = route.split(/ /); const endpointDefaults = Object.assign( { method, url: url2 }, - defaults2 + defaults3 ); if (!endpointMethodsMap.has(scope)) { endpointMethodsMap.set(scope, /* @__PURE__ */ new Map()); @@ -28044,19 +28044,19 @@ var require_light = __commonJS({ function getCjsExportFromNamespace(n) { return n && n["default"] || n; } - var load2 = function(received, defaults2, onto = {}) { + var load2 = function(received, defaults3, onto = {}) { var k, ref, v; - for (k in defaults2) { - v = defaults2[k]; + for (k in defaults3) { + v = defaults3[k]; onto[k] = (ref = received[k]) != null ? ref : v; } return onto; }; - var overwrite = function(received, defaults2, onto = {}) { + var overwrite = function(received, defaults3, onto = {}) { var k, v; for (k in received) { v = received[k]; - if (defaults2[k] !== void 0) { + if (defaults3[k] !== void 0) { onto[k] = v; } } @@ -31426,13 +31426,13 @@ var require_minimatch = __commonJS({ m.Minimatch = function Minimatch3(pattern, options) { return new orig.Minimatch(pattern, ext2(def, options)); }; - m.Minimatch.defaults = function defaults2(options) { + m.Minimatch.defaults = function defaults3(options) { return orig.defaults(ext2(def, options)).Minimatch; }; m.filter = function filter3(pattern, options) { return orig.filter(pattern, ext2(def, options)); }; - m.defaults = function defaults2(options) { + m.defaults = function defaults3(options) { return orig.defaults(ext2(def, options)); }; m.makeRe = function makeRe3(pattern, options) { @@ -63705,13 +63705,13 @@ var require_storageClient = __commonJS({ if (!options) { options = {}; } - const defaults2 = { + const defaults3 = { requestContentType: "application/json; charset=utf-8" }; const packageDetails = `azsdk-js-azure-storage-blob/12.29.1`; const userAgentPrefix = options.userAgentOptions && options.userAgentOptions.userAgentPrefix ? `${options.userAgentOptions.userAgentPrefix} ${packageDetails}` : `${packageDetails}`; const optionsWithDefaults = { - ...defaults2, + ...defaults3, ...options, userAgentOptions: { userAgentPrefix @@ -79052,28 +79052,28 @@ var require_rpc_options = __commonJS({ Object.defineProperty(exports2, "__esModule", { value: true }); exports2.mergeRpcOptions = void 0; var runtime_1 = require_commonjs16(); - function mergeRpcOptions(defaults2, options) { + function mergeRpcOptions(defaults3, options) { if (!options) - return defaults2; + return defaults3; let o = {}; - copy(defaults2, o); + copy(defaults3, o); copy(options, o); for (let key of Object.keys(options)) { let val = options[key]; switch (key) { case "jsonOptions": - o.jsonOptions = runtime_1.mergeJsonOptions(defaults2.jsonOptions, o.jsonOptions); + o.jsonOptions = runtime_1.mergeJsonOptions(defaults3.jsonOptions, o.jsonOptions); break; case "binaryOptions": - o.binaryOptions = runtime_1.mergeBinaryOptions(defaults2.binaryOptions, o.binaryOptions); + o.binaryOptions = runtime_1.mergeBinaryOptions(defaults3.binaryOptions, o.binaryOptions); break; case "meta": o.meta = {}; - copy(defaults2.meta, o.meta); + copy(defaults3.meta, o.meta); copy(options.meta, o.meta); break; case "interceptors": - o.interceptors = defaults2.interceptors ? defaults2.interceptors.concat(val) : val.concat(); + o.interceptors = defaults3.interceptors ? defaults3.interceptors.concat(val) : val.concat(); break; } } @@ -95369,7 +95369,7 @@ var require_defaults = __commonJS({ var keysIn = require_keysIn(); var objectProto = Object.prototype; var hasOwnProperty = objectProto.hasOwnProperty; - var defaults2 = baseRest(function(object2, sources) { + var defaults3 = baseRest(function(object2, sources) { object2 = Object(object2); var index2 = -1; var length = sources.length; @@ -95392,7 +95392,7 @@ var require_defaults = __commonJS({ } return object2; }); - module2.exports = defaults2; + module2.exports = defaults3; } }); @@ -105815,7 +105815,7 @@ var require_archiver_utils = __commonJS({ var isStream2 = require_is_stream(); var lazystream = require_lazystream(); var normalizePath4 = require_normalize_path(); - var defaults2 = require_defaults(); + var defaults3 = require_defaults(); var Stream = require("stream").Stream; var PassThrough3 = require_ours().PassThrough; var utils = module2.exports = {}; @@ -105852,7 +105852,7 @@ var require_archiver_utils = __commonJS({ utils.defaults = function(object2, source, guard) { var args = arguments; args[0] = args[0] || {}; - return defaults2(...args); + return defaults3(...args); }; utils.isStream = function(source) { return isStream2(source); @@ -111751,14 +111751,14 @@ var require_dist_node2 = __commonJS({ const Ctor = Object.prototype.hasOwnProperty.call(proto, "constructor") && proto.constructor; return typeof Ctor === "function" && Ctor instanceof Ctor && Function.prototype.call(Ctor) === Function.prototype.call(value); } - function mergeDeep2(defaults2, options) { - const result = Object.assign({}, defaults2); + function mergeDeep2(defaults3, options) { + const result = Object.assign({}, defaults3); Object.keys(options).forEach((key) => { if (isPlainObject4(options[key])) { - if (!(key in defaults2)) + if (!(key in defaults3)) Object.assign(result, { [key]: options[key] }); else - result[key] = mergeDeep2(defaults2[key], options[key]); + result[key] = mergeDeep2(defaults3[key], options[key]); } else { Object.assign(result, { [key]: options[key] }); } @@ -111773,7 +111773,7 @@ var require_dist_node2 = __commonJS({ } return obj; } - function merge2(defaults2, route, options) { + function merge2(defaults3, route, options) { if (typeof route === "string") { let [method, url2] = route.split(" "); options = Object.assign(url2 ? { method, url: url2 } : { url: method }, options); @@ -111783,10 +111783,10 @@ var require_dist_node2 = __commonJS({ options.headers = lowercaseKeys2(options.headers); removeUndefinedProperties2(options); removeUndefinedProperties2(options.headers); - const mergedOptions = mergeDeep2(defaults2 || {}, options); + const mergedOptions = mergeDeep2(defaults3 || {}, options); if (options.url === "/graphql") { - if (defaults2 && defaults2.mediaType.previews?.length) { - mergedOptions.mediaType.previews = defaults2.mediaType.previews.filter( + if (defaults3 && defaults3.mediaType.previews?.length) { + mergedOptions.mediaType.previews = defaults3.mediaType.previews.filter( (preview) => !mergedOptions.mediaType.previews.includes(preview) ).concat(mergedOptions.mediaType.previews); } @@ -112020,8 +112020,8 @@ var require_dist_node2 = __commonJS({ options.request ? { request: options.request } : null ); } - function endpointWithDefaults2(defaults2, route, options) { - return parse2(merge2(defaults2, route, options)); + function endpointWithDefaults2(defaults3, route, options) { + return parse2(merge2(defaults3, route, options)); } function withDefaults4(oldDefaults, newDefaults) { const DEFAULTS22 = merge2(oldDefaults, newDefaults); @@ -112695,21 +112695,21 @@ var require_dist_node8 = __commonJS({ static { this.VERSION = VERSION8; } - static defaults(defaults2) { + static defaults(defaults3) { const OctokitWithDefaults = class extends this { constructor(...args) { const options = args[0] || {}; - if (typeof defaults2 === "function") { - super(defaults2(options)); + if (typeof defaults3 === "function") { + super(defaults3(options)); return; } super( Object.assign( {}, - defaults2, + defaults3, options, - options.userAgent && defaults2.userAgent ? { - userAgent: `${options.userAgent} ${defaults2.userAgent}` + options.userAgent && defaults3.userAgent ? { + userAgent: `${options.userAgent} ${defaults3.userAgent}` } : null ) ); @@ -114825,14 +114825,14 @@ var require_dist_node9 = __commonJS({ var endpointMethodsMap2 = /* @__PURE__ */ new Map(); for (const [scope, endpoints] of Object.entries(endpoints_default2)) { for (const [methodName, endpoint2] of Object.entries(endpoints)) { - const [route, defaults2, decorations] = endpoint2; + const [route, defaults3, decorations] = endpoint2; const [method, url2] = route.split(/ /); const endpointDefaults = Object.assign( { method, url: url2 }, - defaults2 + defaults3 ); if (!endpointMethodsMap2.has(scope)) { endpointMethodsMap2.set(scope, /* @__PURE__ */ new Map()); @@ -114902,8 +114902,8 @@ var require_dist_node9 = __commonJS({ } return newMethods; } - function decorate2(octokit, scope, methodName, defaults2, decorations) { - const requestWithDefaults = octokit.request.defaults(defaults2); + function decorate2(octokit, scope, methodName, defaults3, decorations) { + const requestWithDefaults = octokit.request.defaults(defaults3); function withDecorations(...args) { let options = requestWithDefaults.endpoint.merge(...args); if (decorations.mapToData) { @@ -145797,7 +145797,7 @@ function makeProxyRequestOptions(dispatcher) { function createApiClientWithDetails(apiDetails, { allowExternal = false, proxy = void 0 } = {}) { const auth2 = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth; const retryingOctokit = githubUtils.GitHub.plugin(retry); - const requestOptions = proxy === void 0 ? void 0 : makeProxyRequestOptions(proxy); + const requestOptions = proxy === void 0 ? githubUtils.defaults.request : makeProxyRequestOptions(proxy); return new retryingOctokit( githubUtils.getOctokitOptions(auth2, { baseUrl: apiDetails.apiURL, @@ -156409,7 +156409,7 @@ var twoStarNoDot = "(?:(?!(?:\\/|^)\\.).)*?"; var filter = (pattern, options = {}) => (p) => minimatch(p, pattern, options); minimatch.filter = filter; var ext = (a, b = {}) => Object.assign({}, a, b); -var defaults = (def) => { +var defaults2 = (def) => { if (!def || typeof def !== "object" || !Object.keys(def).length) { return minimatch; } @@ -156445,7 +156445,7 @@ var defaults = (def) => { GLOBSTAR }); }; -minimatch.defaults = defaults; +minimatch.defaults = defaults2; var braceExpand = (pattern, options = {}) => { assertValidPattern(pattern); if (options.nobrace || !/\{(?:(?!\{).)*\}/.test(pattern)) { diff --git a/src/api-client.ts b/src/api-client.ts index 85141e482a..7c63b5a6fe 100644 --- a/src/api-client.ts +++ b/src/api-client.ts @@ -137,7 +137,9 @@ function createApiClientWithDetails( (allowExternal && apiDetails.externalRepoAuth) || apiDetails.auth; const retryingOctokit = githubUtils.GitHub.plugin(retry.retry); const requestOptions = - proxy === undefined ? undefined : makeProxyRequestOptions(proxy); + proxy === undefined + ? githubUtils.defaults.request + : makeProxyRequestOptions(proxy); return new retryingOctokit( githubUtils.getOctokitOptions(auth, { baseUrl: apiDetails.apiURL, From fb50ab5d62a274adf3ef3e22cfe750ae87a0ede7 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 05:17:19 +0000 Subject: [PATCH 4/4] Update changelog for v4.37.3 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 79389b0d99..af737811ff 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. -## [UNRELEASED] +## 4.37.3 - 22 Jul 2026 No user facing changes.