[UPDATE] (deps): Bump github/codeql-action from 4.30.8 to 4.31.0 in /.github/workflows #490

dependabot · 2025-10-28T01:18:53Z

Bumps github/codeql-action from 4.30.8 to 4.31.0.

Release notes

Sourced from github/codeql-action's releases.

v4.31.0

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.0 - 24 Oct 2025

Bump minimum CodeQL bundle version to 2.17.6. #3223

When SARIF files are uploaded by the analyze or upload-sarif actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the upload-sarif action. For analyze, this may affect Advanced Setup for CodeQL users who specify a value other than always for the upload input. #3222

See the full CHANGELOG.md for more information.

v4.30.9

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.9 - 17 Oct 2025

Update default CodeQL bundle version to 2.23.3. #3205

Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.31.0 - 24 Oct 2025

Bump minimum CodeQL bundle version to 2.17.6. #3223

When SARIF files are uploaded by the analyze or upload-sarif actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the upload-sarif action. For analyze, this may affect Advanced Setup for CodeQL users who specify a value other than always for the upload input. #3222

4.30.9 - 17 Oct 2025

Update default CodeQL bundle version to 2.23.3. #3205

Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

4.30.8 - 10 Oct 2025

No user facing changes.

4.30.7 - 06 Oct 2025

[v4+ only] The CodeQL Action now runs on Node.js v24. #3169

3.30.6 - 02 Oct 2025

Update default CodeQL bundle version to 2.23.2. #3168

3.30.5 - 26 Sep 2025

We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #3160

3.30.4 - 25 Sep 2025

We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the codeql-action/init step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the codeql-action/init step. #3099 and #3100

We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. #3107

You can now run the latest CodeQL nightly bundle by passing tools: nightly to the init action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. #3130

Update default CodeQL bundle version to 2.23.1. #3118

3.30.3 - 10 Sep 2025

No user facing changes.

3.30.2 - 09 Sep 2025

Fixed a bug which could cause language autodetection to fail. #3084

Experimental: The quality-queries input that was added in 3.29.2 as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a new analysis-kinds input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time. #3064

... (truncated)

Commits

4e94bd1 Merge pull request #3235 from github/update-v4.31.0-1d36546c1
8f11182 Update changelog for v4.31.0
1d36546 Merge pull request #3234 from github/mbg/changelog/post-processing
08ada26 Add changelog entry for post-processing change
b843cbe Merge pull request #3233 from github/mbg/getOptionalEnvVar
1ecd563 Use getOptionalEnvVar in writePostProcessedFiles
e576807 Merge pull request #3223 from github/henrymercer/bump-minimum
ad35676 Add getOptionalEnvVar function
d75645b Merge pull request #3222 from github/mbg/upload-lib/post-process
710606c Check that outputPath is non-empty
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.30.8 to 4.31.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@f443b60...4e94bd1) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.31.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

coderabbitai · 2025-10-28T01:19:08Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

deepsource-io · 2025-10-28T01:19:09Z

Here's the code health analysis summary for commits d7be67e..56aaa06. View details on DeepSource ↗.

Analysis Summary

Analyzer	Status	Summary	Link
Python	✅ Success		View Check ↗
Test coverage	✅ Success		View Check ↗

Code Coverage Report

Metric	Aggregate	Python
Branch Coverage	96.2%	96.2%
Composite Coverage	97.5%	97.5%
Line Coverage	97.6%	97.6%

💡 If you’re a repository administrator, you can configure the quality gates from the settings.

sonarqubecloud · 2025-10-28T01:19:31Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

codecov · 2025-10-28T01:23:28Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

reactive-firewall

👍 LGTM;

☑️ Specifically, the version bump is approved!

dependabot bot assigned reactive-firewall Oct 28, 2025

dependabot bot added this to the Code Style Technical Debt milestone Oct 28, 2025

dependabot bot added CI Continuous Integration Tooling Configs Improvements or additions to configuration Duplicate This issue or pull request already exists GitHub Anything Meta Testing Something can be verified labels Oct 28, 2025

github-project-automation bot added this to Multicast Project Oct 28, 2025

github-project-automation bot moved this to To do in Multicast Project Oct 28, 2025

dependabot bot temporarily deployed to Experimenting October 28, 2025 01:18 Inactive

dependabot bot mentioned this pull request Oct 28, 2025

[UPDATE] (deps): Bump github/codeql-action from 4.30.8 to 4.30.9 in /.github/workflows #487

Closed

github-actions bot added the Linter Any linter tool or setting file enhancements label Oct 28, 2025

dependabot bot temporarily deployed to Experimenting October 28, 2025 01:19 Inactive

dependabot bot temporarily deployed to Experimenting October 28, 2025 01:20 Inactive

reactive-firewall moved this from To do to In progress in Multicast Project Oct 30, 2025

reactive-firewall approved these changes Oct 30, 2025

View reviewed changes

github-project-automation bot moved this from In progress to Resolved in Multicast Project Oct 30, 2025

reactive-firewall merged commit d22cdfe into master Oct 30, 2025
49 of 50 checks passed

github-project-automation bot moved this from Resolved to Done in Multicast Project Oct 30, 2025

dependabot bot deleted the dependabot/github_actions/dot-github/workflows/master/github/codeql-action-4.31.0 branch October 30, 2025 22:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[UPDATE] (deps): Bump github/codeql-action from 4.30.8 to 4.31.0 in /.github/workflows #490

[UPDATE] (deps): Bump github/codeql-action from 4.30.8 to 4.31.0 in /.github/workflows #490

dependabot bot commented on behalf of github Oct 28, 2025

Uh oh!

coderabbitai bot commented Oct 28, 2025

Review skipped

Uh oh!

deepsource-io bot commented Oct 28, 2025 •

edited

Loading

Analysis Summary

Code Coverage Report

Uh oh!

sonarqubecloud bot commented Oct 28, 2025

Uh oh!

codecov bot commented Oct 28, 2025

Uh oh!

reactive-firewall left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

[UPDATE] (deps): Bump github/codeql-action from 4.30.8 to 4.31.0 in /.github/workflows #490

[UPDATE] (deps): Bump github/codeql-action from 4.30.8 to 4.31.0 in /.github/workflows #490

Conversation

dependabot bot commented on behalf of github Oct 28, 2025

v4.31.0

CodeQL Action Changelog

4.31.0 - 24 Oct 2025

v4.30.9

CodeQL Action Changelog

4.30.9 - 17 Oct 2025

CodeQL Action Changelog

[UNRELEASED]

4.31.0 - 24 Oct 2025

4.30.9 - 17 Oct 2025

4.30.8 - 10 Oct 2025

4.30.7 - 06 Oct 2025

3.30.6 - 02 Oct 2025

3.30.5 - 26 Sep 2025

3.30.4 - 25 Sep 2025

3.30.3 - 10 Sep 2025

3.30.2 - 09 Sep 2025

Uh oh!

coderabbitai bot commented Oct 28, 2025

Review skipped

Uh oh!

deepsource-io bot commented Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Analysis Summary

Code Coverage Report

Uh oh!

sonarqubecloud bot commented Oct 28, 2025

Quality Gate passed

Uh oh!

codecov bot commented Oct 28, 2025

Codecov Report

Uh oh!

reactive-firewall left a comment

Choose a reason for hiding this comment

👍 LGTM;

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

deepsource-io bot commented Oct 28, 2025 •

edited

Loading