Skip to content

Merge main into releases/v4 #3782

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
henrymercer merged 10 commits into from
Mar 27, 2026
Merged

Merge main into releases/v4 #3782

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
22eba96
Bump node-forge from 1.3.3 to 1.4.0
dependabot[bot] Mar 27, 2026
36791d8
Rebuild
github-actions[bot] Mar 27, 2026
7c51060
Update changelog and version after v4.35.0
github-actions[bot] Mar 27, 2026
24448c9
Rebuild
github-actions[bot] Mar 27, 2026
45ceeea
Merge pull request #3777 from github/mergeback/v4.35.0-to-main-b8bb9f28
henrymercer Mar 27, 2026
ea5f719
Merge pull request #3775 from github/dependabot/npm_and_yarn/node-for…
mbg Mar 27, 2026
2437b20
Update minimum git version for overlay to 2.36.0
henrymercer Mar 27, 2026
65d2efa
Add changelog note
henrymercer Mar 27, 2026
d6d1743
Merge pull request #3781 from github/henrymercer/update-git-minimum-v…
henrymercer Mar 27, 2026
c5ffd06
Update changelog for v4.35.1
github-actions[bot] Mar 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th

## [UNRELEASED]

No user facing changes.
- Fix incorrect minimum required Git version for [improved incremental analysis](https://github.com/github/roadmap/issues/1158): it should have been 2.36.0, not 2.11.0. [#3781](https://github.com/github/codeql-action/pull/3781)

Copilot AI Mar 27, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The 4.35.1 changelog entry is missing the node-forge dependency security update (PR #3775). Since this release bumps node-forge to 1.4.0 to address multiple high-severity issues, it should be captured as a user-facing change (at least as a security/dependency update) in the 4.35.1 section.

Suggested change
- Fix incorrect minimum required Git version for [improved incremental analysis](https://github.com/github/roadmap/issues/1158): it should have been 2.36.0, not 2.11.0. [#3781](https://github.com/github/codeql-action/pull/3781)
- Fix incorrect minimum required Git version for [improved incremental analysis](https://github.com/github/roadmap/issues/1158): it should have been 2.36.0, not 2.11.0. [#3781](https://github.com/github/codeql-action/pull/3781)
- Updated the `node-forge` dependency to version 1.4.0 to address multiple high-severity security issues. [#3775](https://github.com/github/codeql-action/pull/3775)

Copilot uses AI. Check for mistakes.

## 4.35.0 - 27 Mar 2026

Expand Down
2 changes: 1 addition & 1 deletion lib/init-action.js
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 6 additions & 6 deletions src/git-utils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,11 +14,11 @@ import {
import { ConfigurationError, getRequiredEnvParam } from "./util";

/**
* Minimum Git version required for overlay analysis. The
* `git ls-files --recurse-submodules` option, which is used by
* `getFileOidsUnderPath`, was introduced in Git 2.11.0.
* Minimum Git version required for overlay analysis. Support for using the `git ls-files
* --recurse-submodules` option with `--stage` was added in Git 2.36.0. For more information, see
* `getFileOidsUnderPath`.
*/
export const GIT_MINIMUM_VERSION_FOR_OVERLAY = "2.11.0";
export const GIT_MINIMUM_VERSION_FOR_OVERLAY = "2.36.0";

/**
* Git version information
Expand Down Expand Up @@ -261,8 +261,8 @@ export const getFileOidsUnderPath = async function (
// Without the --full-name flag, the path is relative to the current working
// directory of the git command, which is basePath.
//
// We use --stage rather than --format here because --stage has been available since Git 2.11.0,
// while --format was only introduced in Git 2.38.0, which would limit overlay rollout.
// We use --stage rather than --format here because --stage has been available since Git 2.36.0,
// while --format was only introduced in Git 2.38.0.
const stdout = await runGitCommand(
basePath,
["ls-files", "--recurse-submodules", "--stage"],
Expand Down
Loading