gradle/actions
1
0
Fork 0
mirror of https://github.com/gradle/actions.git synced 2026-08-17 11:22:50 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,246 Commits 23 Branches 120 Tags
1fd612575aee4cbb965b15ab6a696deac8f93f34
Commit Graph
2246 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
bot-githubaction 1fd612575a Bump Gradle Wrapper from 9.6.1 to 9.7.0. 
Release notes of Gradle 9.7.0 can be found here:
https://docs.gradle.org/9.7.0/release-notes.html

Signed-off-by: bot-githubaction <bot-githubaction@gradle.com>
 2026-08-07 03:07:10 +00:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		889dc537cf Bump the npm-dependencies group in /sources with 3 updates (#1038) 
Bumps the npm-dependencies group in /sources with 3 updates:
[@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver),
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin)
and [globals](https://github.com/sindresorhus/globals).

Updates `@types/semver` from 7.7.1 to 7.8.0
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver">compare
view</a></li>
</ul>
</details>
<br />

Updates `@typescript-eslint/eslint-plugin` from 8.65.0 to 8.66.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases">@​typescript-eslint/eslint-plugin's
releases</a>.</em></p>
<blockquote>
<h2>v8.66.0</h2>
<h2>8.66.0 (2026-08-03)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>typescript-estree:</strong> handle import.defer() as
ImportExpression (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12609">#12609</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-conversion]
ignore shadowed built-ins (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12590">#12590</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-nullish-coalescing] handle
shadowed Boolean calls (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12591">#12591</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
don't report defaults used by other overloads (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12607">#12607</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters]
check MappedType key remapping (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12588">#12588</a>)</li>
<li><strong>eslint-plugin:</strong> [class-literal-property-style]
preserve type annotations and don't drop decorators (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12617">#12617</a>)</li>
<li><strong>website:</strong> list
<code>onUnsupportedTypeScriptVersion</code> in parser options (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12585">#12585</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit"><code>@​StyleShit</code></a></li>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger"><code>@​kirkwaiblinger</code></a></li>
<li>Steffen Schroeder</li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.66.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md">@​typescript-eslint/eslint-plugin's
changelog</a>.</em></p>
<blockquote>
<h2>8.66.0 (2026-08-03)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [class-literal-property-style]
preserve type annotations and don't drop decorators (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12617">#12617</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters]
check MappedType key remapping (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12588">#12588</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
don't report defaults used by other overloads (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12607">#12607</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-nullish-coalescing] handle
shadowed Boolean calls (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12591">#12591</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-conversion]
ignore shadowed built-ins (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12590">#12590</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit"><code>@​StyleShit</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.66.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/e51b11ba3ab31837762c675f62f0d4dcb1abc4fb"><code>e51b11b</code></a>
chore(release): publish 8.66.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/20cb15e6dbed8f42b7857a75e34f96d231b95449"><code>20cb15e</code></a>
chore(eslint-plugin): split prefer-optional-chain.test.ts in multiple
files (...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/780a8c52d54fcb6420232b2f53974959a9b26dff"><code>780a8c5</code></a>
docs(eslint-plugin): [member-ordering] add lacking commas in default
member t...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/08dd427202e08de304cf172472e3a97de3f382cf"><code>08dd427</code></a>
fix(eslint-plugin): [class-literal-property-style] preserve type
annotations ...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/6be25d3b45f189d0c71018fb4ba7a2c9be4e14de"><code>6be25d3</code></a>
fix(eslint-plugin): [no-unnecessary-type-parameters] check MappedType
key rem...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/8826d0ebf7ff178afb6b0e72bf22d9132e4c83a2"><code>8826d0e</code></a>
fix(eslint-plugin): [no-useless-default-assignment] don't report
defaults use...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/7aecc1c44e60bc4b47402ce63a79587746766d9f"><code>7aecc1c</code></a>
fix(eslint-plugin): [prefer-nullish-coalescing] handle shadowed Boolean
calls...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/5ffa76049a0dd6c73ba9c0a7e8388ab1324f740f"><code>5ffa760</code></a>
fix(eslint-plugin): [no-unnecessary-type-conversion] ignore shadowed
built-in...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/f282f84df6418d405c5fbaa4312bf6c951b34957"><code>f282f84</code></a>
chore(eslint-plugin): fix all
<code>eslint-plugin/require-test-error-positions</code> (#...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/c8cafa4ae9a0b57a64ba23659eba25a01301684a"><code>c8cafa4</code></a>
docs: [unified-signatures] caveats regarding signatures merging (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12581">#12581</a>)</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.66.0/packages/eslint-plugin">compare
view</a></li>
</ul>
</details>
<br />

Updates `globals` from 17.8.0 to 17.9.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sindresorhus/globals/releases">globals's
releases</a>.</em></p>
<blockquote>
<h2>v17.9.0</h2>
<ul>
<li>Update globals (2026-08-01) (<a
href="https://redirect.github.com/sindresorhus/globals/issues/348">#348</a>)
5a958ed</li>
</ul>
<hr />
<p><a
href="https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0">https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sindresorhus/globals/commit/8e7b9358b190d26acca88cc2804707fbcd90a229"><code>8e7b935</code></a>
17.9.0</li>
<li><a
href="https://github.com/sindresorhus/globals/commit/5a958ed06064fb879b64416655109d8eaffd2611"><code>5a958ed</code></a>
Update globals (2026-08-01) (<a
href="https://redirect.github.com/sindresorhus/globals/issues/348">#348</a>)</li>
<li>See full diff in <a
href="https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-06 19:21:58 -06:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		968aeb62d7 Bump the github-actions group across 3 directories with 6 updates (#1039) 
Bumps the github-actions group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [gradle/actions/setup-gradle](https://github.com/gradle/actions) |
`6.2.0` | `6.3.0` |
| [github/codeql-action/init](https://github.com/github/codeql-action) |
`4.37.4` | `4.37.5` |
|
[github/codeql-action/analyze](https://github.com/github/codeql-action)
| `4.37.4` | `4.37.5` |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.6.0`
| `5.7.0` |
| [gradle/actions/wrapper-validation](https://github.com/gradle/actions)
| `6.2.0` | `6.3.0` |

Bumps the github-actions group with 1 update in the
/.github/actions/build-dist directory:
[actions/setup-node](https://github.com/actions/setup-node).
Bumps the github-actions group with 1 update in the
/.github/actions/init-integ-test directory:
[actions/setup-java](https://github.com/actions/setup-java).

Updates `gradle/actions/setup-gradle` from 6.2.0 to 6.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gradle/actions/releases">gradle/actions/setup-gradle's
releases</a>.</em></p>
<blockquote>
<h2>v6.3.0</h2>
<h2>Highlights</h2>
<h3>Enhanced Caching: Windows fixes and a cache-protocol bump</h3>
<p>This release updates <code>gradle-actions-caching</code> to
<strong>v1.0.0</strong> (up from v0.7.0), which fixes two significant
caching defects, both most visible on Windows:</p>
<ul>
<li>
<p><strong>Cache entries failed to store at all on Windows.</strong>.
Every entry failed
with <code>Path Validation Error: Path(s) specified in the action for
caching do(es) not exist</code>, even though the Gradle User Home was
fully intact. Nothing was stored, so
every downstream job ran against an empty Gradle User Home. The cause
was a nested,
unpatched copy of <code>@actions/glob</code> combined with a silently
swallowed <code>require()</code> in
the bundle, which left Windows path separators unnormalized.</p>
</li>
<li>
<p><strong>Cache cleanup deleted instrumented jars that were in
use.</strong> A bug in key
hashing for paths shorter than 64 characters made cleanup judge freshly
created
<code>caches/jars-9</code> entries as unused and remove them, so the
<code>instrumented-jars</code> entry
was never saved and every job re-instrumented its classpaths.</p>
<p>Also included: cache entry names are now consistent between the save
and restore
reports — restore previously fell back to showing the raw glob pattern
(e.g.
<code>/home/runner/.gradle/caches/modules-*/files-*/*/*/*/*/</code>)
instead of <code>dependencies</code>.</p>
</li>
</ul>
<blockquote>
<p>[!IMPORTANT]
<strong>Existing cache entries are invalidated by this release.</strong>
The cache protocol
version was bumped to <code>v2</code>, so the first run after upgrading
will be a cache miss
and will repopulate the cache. No configuration changes are
required.</p>
</blockquote>
<h3>Basic caching warns instead of failing silently</h3>
<p>The basic (open-source) caching provider now emits a warning and
reports
<code>(Entry not saved: save failed)</code> in the Job Summary when a
cache save fails, rather
than reporting success (<a
href="https://redirect.github.com/gradle/actions/issues/1028">#1028</a>).</p>
<h3>Dependency submission works with Isolated Projects</h3>
<p><code>dependency-submission</code> now disables Isolated Projects via
a promoted property, so
dependency graph generation works on builds that enable it (<a
href="https://redirect.github.com/gradle/actions/issues/1025">#1025</a>).
Thanks to <a
href="https://github.com/reinsch82"><code>@​reinsch82</code></a> for the
contribution.</p>
<h3>Updated defaults</h3>
<ul>
<li>Injected Develocity Gradle plugin: <strong>4.4.2 →
4.5.0</strong></li>
<li>36 new known-good wrapper checksums added for
<code>wrapper-validation</code></li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Render configuration-cache status in the caching Job Summary by <a
href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/989">gradle/actions#989</a></li>
<li>Update gradle-actions-caching library to v0.8.0 by <a
href="https://github.com/bot-githubaction"><code>@​bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/993">gradle/actions#993</a></li>
<li>Support experimental project-entry caching (configuration-cache +
build-logic) by <a
href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/994">gradle/actions#994</a></li>
<li>Update gradle-actions-caching library to v0.9.0 by <a
href="https://github.com/bot-githubaction"><code>@​bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/996">gradle/actions#996</a></li>
<li>Disable Isolated Projects via promoted property in
dependency-submission by <a
href="https://github.com/reinsch82"><code>@​reinsch82</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/1025">gradle/actions#1025</a></li>
<li>Add Windows coverage for caching via a new smoke-test suite by <a
href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/1027">gradle/actions#1027</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gradle/actions/commit/9c971963bec38e04b3d30dcc455b5382be2fdbfb"><code>9c97196</code></a>
Bump the github-actions group across 2 directories with 9 updates (<a
href="https://redirect.github.com/gradle/actions/issues/1024">#1024</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/760e4a476b57fc6216ff816bbd682e14f43f66ee"><code>760e4a4</code></a>
Bump the npm-dependencies group across 1 directory with 2 updates (<a
href="https://redirect.github.com/gradle/actions/issues/1037">#1037</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/73e4c4222be7ce7f3685c9277a9e698ea3a28534"><code>73e4c42</code></a>
Update gradle-actions-caching library to v1.0.0 (<a
href="https://redirect.github.com/gradle/actions/issues/1029">#1029</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/a9d14388b4a819d9b607d85c115000e421e46eec"><code>a9d1438</code></a>
Add dependabot ignore rules for TypeScript 7.x and
<code>@​types/node</code> 25.x/26.x</li>
<li><a
href="https://github.com/gradle/actions/commit/68f37005d75fc0fdb3e66cc267d1f007b3de27d1"><code>68f3700</code></a>
[bot] Update dist directory</li>
<li><a
href="https://github.com/gradle/actions/commit/5971332a8f9f37459fbe710cc8b2ec8f125cdf54"><code>5971332</code></a>
Bump Gradle Wrapper to 9.6.1, wrapper checksums, and Develocity plugin
to 4.5...</li>
<li><a
href="https://github.com/gradle/actions/commit/b5bc804016a397046a67d7f83089c374ff4af6a7"><code>b5bc804</code></a>
[bot] Update dist directory</li>
<li><a
href="https://github.com/gradle/actions/commit/dcbab4e9198b2315584afbb3d582bdaa2a7aee42"><code>dcbab4e</code></a>
Bump npm-dependencies group with TypeScript 6.0.3,
<code>@​types/node</code> 24.x, and secu...</li>
<li><a
href="https://github.com/gradle/actions/commit/ca8d95717f747a46ed048a911f0e8a348829aef1"><code>ca8d957</code></a>
Move non-smoke restore-gradle-home tests back to the integ-test suite
(<a
href="https://redirect.github.com/gradle/actions/issues/1032">#1032</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/4318659b28d9d152a98ad848b621397f3e386420"><code>4318659</code></a>
[bot] Update dist directory</li>
<li>Additional commits viewable in <a
href="https://github.com/gradle/actions/compare/3f131e8634966bd73d06cc69884922b02e6faf92...9c971963bec38e04b3d30dcc455b5382be2fdbfb">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/init` from 4.37.4 to 4.37.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/init's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.5</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a>
from github/update-v4.37.5-1cd4d01d5</li>
<li><a
href="https://github.com/github/codeql-action/commit/e74600b0d945db9734eb044f95cd43f34b773451"><code>e74600b</code></a>
Update changelog for v4.37.5</li>
<li><a
href="https://github.com/github/codeql-action/commit/1cd4d01d58f636bbdbffbfd3c121b3446d07e9f3"><code>1cd4d01</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4061">#4061</a>
from github/henrymercer/turbo-system</li>
<li><a
href="https://github.com/github/codeql-action/commit/d2bfc30bc3373a3ec945dc3f93bc8b8f07fa16b9"><code>d2bfc30</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4050">#4050</a>
from github/mbg/status/registries</li>
<li><a
href="https://github.com/github/codeql-action/commit/68028fcb1605f3cdd37e4e1845c3f78af017a3ea"><code>68028fc</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4062">#4062</a>
from github/sam-robson/migrate-enterprise-release-pat</li>
<li><a
href="https://github.com/github/codeql-action/commit/c29563eeaafbc75499c7bb0d74bf77b3506c1cbd"><code>c29563e</code></a>
ci: use federated enterprise release PAT</li>
<li><a
href="https://github.com/github/codeql-action/commit/155e5229973b426bd1ae2f83bb1bf42417fa2a8f"><code>155e522</code></a>
Link the PR from the changelog entry</li>
<li><a
href="https://github.com/github/codeql-action/commit/2d3b351ea6452a9b21346f8d64567e5b833924de"><code>2d3b351</code></a>
Handle network errors when streaming the CodeQL bundle download</li>
<li><a
href="https://github.com/github/codeql-action/commit/5d3eb98e4a780bfe1a53f57fbdc278ea5da1274b"><code>5d3eb98</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4055">#4055</a>
from github/dependabot/npm_and_yarn/npm-minor-203262...</li>
<li><a
href="https://github.com/github/codeql-action/commit/c5f739bd6460e096aaf40962517e46a846b8b6b1"><code>c5f739b</code></a>
Merge branch 'main' into
dependabot/npm_and_yarn/npm-minor-2032624187</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...d1ba80a13dd99fba24a470575428917156a28b43">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/analyze` from 4.37.4 to 4.37.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.5</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a>
from github/update-v4.37.5-1cd4d01d5</li>
<li><a
href="https://github.com/github/codeql-action/commit/e74600b0d945db9734eb044f95cd43f34b773451"><code>e74600b</code></a>
Update changelog for v4.37.5</li>
<li><a
href="https://github.com/github/codeql-action/commit/1cd4d01d58f636bbdbffbfd3c121b3446d07e9f3"><code>1cd4d01</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4061">#4061</a>
from github/henrymercer/turbo-system</li>
<li><a
href="https://github.com/github/codeql-action/commit/d2bfc30bc3373a3ec945dc3f93bc8b8f07fa16b9"><code>d2bfc30</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4050">#4050</a>
from github/mbg/status/registries</li>
<li><a
href="https://github.com/github/codeql-action/commit/68028fcb1605f3cdd37e4e1845c3f78af017a3ea"><code>68028fc</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4062">#4062</a>
from github/sam-robson/migrate-enterprise-release-pat</li>
<li><a
href="https://github.com/github/codeql-action/commit/c29563eeaafbc75499c7bb0d74bf77b3506c1cbd"><code>c29563e</code></a>
ci: use federated enterprise release PAT</li>
<li><a
href="https://github.com/github/codeql-action/commit/155e5229973b426bd1ae2f83bb1bf42417fa2a8f"><code>155e522</code></a>
Link the PR from the changelog entry</li>
<li><a
href="https://github.com/github/codeql-action/commit/2d3b351ea6452a9b21346f8d64567e5b833924de"><code>2d3b351</code></a>
Handle network errors when streaming the CodeQL bundle download</li>
<li><a
href="https://github.com/github/codeql-action/commit/5d3eb98e4a780bfe1a53f57fbdc278ea5da1274b"><code>5d3eb98</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4055">#4055</a>
from github/dependabot/npm_and_yarn/npm-minor-203262...</li>
<li><a
href="https://github.com/github/codeql-action/commit/c5f739bd6460e096aaf40962517e46a846b8b6b1"><code>c5f739b</code></a>
Merge branch 'main' into
dependabot/npm_and_yarn/npm-minor-2032624187</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...d1ba80a13dd99fba24a470575428917156a28b43">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/setup-java` from 5.6.0 to 5.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-java/releases">actions/setup-java's
releases</a>.</em></p>
<blockquote>
<h2>v5.7.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix npm audit failures on releases/v5 by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1154">actions/setup-java#1154</a></li>
<li>Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1151">#1151</a>:
Fix missing wrapper cache distributions by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1153">actions/setup-java#1153</a></li>
<li>Deprecate legacy Adopt distributions in v5 by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1186">actions/setup-java#1186</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-java/compare/v5.6.0...v5.7.0">https://github.com/actions/setup-java/compare/v5.6.0...v5.7.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-java/commit/b6effb05e454b25005698d916606bdc6ffcbf961"><code>b6effb0</code></a>
Deprecate legacy Adopt distributions in v5 (<a
href="https://redirect.github.com/actions/setup-java/issues/1186">#1186</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/e498d2a66a953492f322542257b22125c989b422"><code>e498d2a</code></a>
Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1151">#1151</a>:
Fix missing wrapper cache distributions (<a
href="https://redirect.github.com/actions/setup-java/issues/1153">#1153</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/6a3384db745932178632d0e22b2bd28cad1678e6"><code>6a3384d</code></a>
Fix npm audit failures on releases/v5 (<a
href="https://redirect.github.com/actions/setup-java/issues/1154">#1154</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-java/compare/03ad4de0992f5dab5e18fcb136590ce7c4a0ac95...b6effb05e454b25005698d916606bdc6ffcbf961">compare
view</a></li>
</ul>
</details>
<br />

Updates `gradle/actions/wrapper-validation` from 6.2.0 to 6.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gradle/actions/releases">gradle/actions/wrapper-validation's
releases</a>.</em></p>
<blockquote>
<h2>v6.3.0</h2>
<h2>Highlights</h2>
<h3>Enhanced Caching: Windows fixes and a cache-protocol bump</h3>
<p>This release updates <code>gradle-actions-caching</code> to
<strong>v1.0.0</strong> (up from v0.7.0), which fixes two significant
caching defects, both most visible on Windows:</p>
<ul>
<li>
<p><strong>Cache entries failed to store at all on Windows.</strong>.
Every entry failed
with <code>Path Validation Error: Path(s) specified in the action for
caching do(es) not exist</code>, even though the Gradle User Home was
fully intact. Nothing was stored, so
every downstream job ran against an empty Gradle User Home. The cause
was a nested,
unpatched copy of <code>@actions/glob</code> combined with a silently
swallowed <code>require()</code> in
the bundle, which left Windows path separators unnormalized.</p>
</li>
<li>
<p><strong>Cache cleanup deleted instrumented jars that were in
use.</strong> A bug in key
hashing for paths shorter than 64 characters made cleanup judge freshly
created
<code>caches/jars-9</code> entries as unused and remove them, so the
<code>instrumented-jars</code> entry
was never saved and every job re-instrumented its classpaths.</p>
<p>Also included: cache entry names are now consistent between the save
and restore
reports — restore previously fell back to showing the raw glob pattern
(e.g.
<code>/home/runner/.gradle/caches/modules-*/files-*/*/*/*/*/</code>)
instead of <code>dependencies</code>.</p>
</li>
</ul>
<blockquote>
<p>[!IMPORTANT]
<strong>Existing cache entries are invalidated by this release.</strong>
The cache protocol
version was bumped to <code>v2</code>, so the first run after upgrading
will be a cache miss
and will repopulate the cache. No configuration changes are
required.</p>
</blockquote>
<h3>Basic caching warns instead of failing silently</h3>
<p>The basic (open-source) caching provider now emits a warning and
reports
<code>(Entry not saved: save failed)</code> in the Job Summary when a
cache save fails, rather
than reporting success (<a
href="https://redirect.github.com/gradle/actions/issues/1028">#1028</a>).</p>
<h3>Dependency submission works with Isolated Projects</h3>
<p><code>dependency-submission</code> now disables Isolated Projects via
a promoted property, so
dependency graph generation works on builds that enable it (<a
href="https://redirect.github.com/gradle/actions/issues/1025">#1025</a>).
Thanks to <a
href="https://github.com/reinsch82"><code>@​reinsch82</code></a> for the
contribution.</p>
<h3>Updated defaults</h3>
<ul>
<li>Injected Develocity Gradle plugin: <strong>4.4.2 →
4.5.0</strong></li>
<li>36 new known-good wrapper checksums added for
<code>wrapper-validation</code></li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Render configuration-cache status in the caching Job Summary by <a
href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/989">gradle/actions#989</a></li>
<li>Update gradle-actions-caching library to v0.8.0 by <a
href="https://github.com/bot-githubaction"><code>@​bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/993">gradle/actions#993</a></li>
<li>Support experimental project-entry caching (configuration-cache +
build-logic) by <a
href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/994">gradle/actions#994</a></li>
<li>Update gradle-actions-caching library to v0.9.0 by <a
href="https://github.com/bot-githubaction"><code>@​bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/996">gradle/actions#996</a></li>
<li>Disable Isolated Projects via promoted property in
dependency-submission by <a
href="https://github.com/reinsch82"><code>@​reinsch82</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/1025">gradle/actions#1025</a></li>
<li>Add Windows coverage for caching via a new smoke-test suite by <a
href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/1027">gradle/actions#1027</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gradle/actions/commit/9c971963bec38e04b3d30dcc455b5382be2fdbfb"><code>9c97196</code></a>
Bump the github-actions group across 2 directories with 9 updates (<a
href="https://redirect.github.com/gradle/actions/issues/1024">#1024</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/760e4a476b57fc6216ff816bbd682e14f43f66ee"><code>760e4a4</code></a>
Bump the npm-dependencies group across 1 directory with 2 updates (<a
href="https://redirect.github.com/gradle/actions/issues/1037">#1037</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/73e4c4222be7ce7f3685c9277a9e698ea3a28534"><code>73e4c42</code></a>
Update gradle-actions-caching library to v1.0.0 (<a
href="https://redirect.github.com/gradle/actions/issues/1029">#1029</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/a9d14388b4a819d9b607d85c115000e421e46eec"><code>a9d1438</code></a>
Add dependabot ignore rules for TypeScript 7.x and
<code>@​types/node</code> 25.x/26.x</li>
<li><a
href="https://github.com/gradle/actions/commit/68f37005d75fc0fdb3e66cc267d1f007b3de27d1"><code>68f3700</code></a>
[bot] Update dist directory</li>
<li><a
href="https://github.com/gradle/actions/commit/5971332a8f9f37459fbe710cc8b2ec8f125cdf54"><code>5971332</code></a>
Bump Gradle Wrapper to 9.6.1, wrapper checksums, and Develocity plugin
to 4.5...</li>
<li><a
href="https://github.com/gradle/actions/commit/b5bc804016a397046a67d7f83089c374ff4af6a7"><code>b5bc804</code></a>
[bot] Update dist directory</li>
<li><a
href="https://github.com/gradle/actions/commit/dcbab4e9198b2315584afbb3d582bdaa2a7aee42"><code>dcbab4e</code></a>
Bump npm-dependencies group with TypeScript 6.0.3,
<code>@​types/node</code> 24.x, and secu...</li>
<li><a
href="https://github.com/gradle/actions/commit/ca8d95717f747a46ed048a911f0e8a348829aef1"><code>ca8d957</code></a>
Move non-smoke restore-gradle-home tests back to the integ-test suite
(<a
href="https://redirect.github.com/gradle/actions/issues/1032">#1032</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/4318659b28d9d152a98ad848b621397f3e386420"><code>4318659</code></a>
[bot] Update dist directory</li>
<li>Additional commits viewable in <a
href="https://github.com/gradle/actions/compare/3f131e8634966bd73d06cc69884922b02e6faf92...9c971963bec38e04b3d30dcc455b5382be2fdbfb">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/setup-node` from 6.4.0 to 7.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-node/releases">actions/setup-node's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements:</h3>
<ul>
<li>Add cache-primary-key and cache-matched-key as outputs by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in
<a
href="https://redirect.github.com/actions/setup-node/pull/1577">actions/setup-node#1577</a></li>
<li>Migrate to ESM and upgrade dependencies by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in
<a
href="https://redirect.github.com/actions/setup-node/pull/1574">actions/setup-node#1574</a></li>
</ul>
<h3>Bug fixes:</h3>
<ul>
<li>Remove dummy NODE_AUTH_TOKEN export by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in
<a
href="https://redirect.github.com/actions/setup-node/pull/1558">actions/setup-node#1558</a></li>
<li>Only use <code>mirrorToken</code> in <code>getManifest</code> if
it's provided by <a
href="https://github.com/deiga"><code>@​deiga</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1548">actions/setup-node#1548</a></li>
</ul>
<h3>Documentation updates:</h3>
<ul>
<li>Add documentation for publishing to npm with Trusted Publisher
(OIDC) by <a
href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1536">actions/setup-node#1536</a></li>
<li>docs: Update restore-only cache documentation by <a
href="https://github.com/priya-kinthali"><code>@​priya-kinthali</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1550">actions/setup-node#1550</a></li>
<li>docs: Update caching recommendations to mitigate cache poisoning
risks by <a
href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1567">actions/setup-node#1567</a></li>
</ul>
<h3>Dependency update:</h3>
<ul>
<li>Upgrade <code>@​actions/cache</code> to 5.1.0, log cache write
denied by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1569">actions/setup-node#1569</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1536">actions/setup-node#1536</a></li>
<li><a href="https://github.com/deiga"><code>@​deiga</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1548">actions/setup-node#1548</a></li>
<li><a href="https://github.com/jasongin"><code>@​jasongin</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1569">actions/setup-node#1569</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-node/compare/v6...v7.0.0">https://github.com/actions/setup-node/compare/v6...v7.0.0</a></p>
<h2>v6.5.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update <code>@​actions/cache</code> to 5.1.0 and add security
overrides for undici and fast-xml-parser by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1579">actions/setup-node#1579</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0">https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-node/commit/820762786026740c76f36085b0efc47a31fe5020"><code>8207627</code></a>
Migrate to ESM and upgrade dependencies (<a
href="https://redirect.github.com/actions/setup-node/issues/1574">#1574</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/04be95cf3511ea51ebf9f224ddfb99cc7ab87cd4"><code>04be95c</code></a>
Add cache-primary-key and cache-matched-key as outputs (<a
href="https://redirect.github.com/actions/setup-node/issues/1577">#1577</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/7c2c68d20d402ed6a201ada70a81341941093140"><code>7c2c68d</code></a>
docs: Update caching recommendations to mitigate cache poisoning risks
(<a
href="https://redirect.github.com/actions/setup-node/issues/1567">#1567</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/6a61c0375d66246de94630495909f12cf8dac84d"><code>6a61c03</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/setup-node/issues/1569">#1569</a>
from jasongin/update-actions-cache-5.1.0</li>
<li><a
href="https://github.com/actions/setup-node/commit/30eb73b41ded577900c1ebf968ef95cdf8f7434f"><code>30eb73b</code></a>
Resolve high-severity audit issues</li>
<li><a
href="https://github.com/actions/setup-node/commit/4e1a87a501d0302f99e30e2748568adcb388d09f"><code>4e1a87a</code></a>
Update dist</li>
<li><a
href="https://github.com/actions/setup-node/commit/360237f0c01778d0c17291f75c56d6feae4f7574"><code>360237f</code></a>
Strict equality</li>
<li><a
href="https://github.com/actions/setup-node/commit/4f8aac5beb2f0854bc79651567a18c67eb0b9de3"><code>4f8aac5</code></a>
Bump <code>@​actions/cache</code> to 5.1.0, log cache write denied</li>
<li><a
href="https://github.com/actions/setup-node/commit/f4a67bbeca970f103397d3d2b9462cf787cd2980"><code>f4a67bb</code></a>
Only use <code>mirrorToken</code> in <code>getManifest</code> if it's
provided (<a
href="https://redirect.github.com/actions/setup-node/issues/1548">#1548</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/0355742c943ddb13ca8a6b700f824231caa91e75"><code>0355742</code></a>
Remove dummy NODE_AUTH_TOKEN export (<a
href="https://redirect.github.com/actions/setup-node/issues/1558">#1558</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/setup-java` from 5.6.0 to 5.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-java/releases">actions/setup-java's
releases</a>.</em></p>
<blockquote>
<h2>v5.7.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix npm audit failures on releases/v5 by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1154">actions/setup-java#1154</a></li>
<li>Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1151">#1151</a>:
Fix missing wrapper cache distributions by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1153">actions/setup-java#1153</a></li>
<li>Deprecate legacy Adopt distributions in v5 by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1186">actions/setup-java#1186</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-java/compare/v5.6.0...v5.7.0">https://github.com/actions/setup-java/compare/v5.6.0...v5.7.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-java/commit/b6effb05e454b25005698d916606bdc6ffcbf961"><code>b6effb0</code></a>
Deprecate legacy Adopt distributions in v5 (<a
href="https://redirect.github.com/actions/setup-java/issues/1186">#1186</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/e498d2a66a953492f322542257b22125c989b422"><code>e498d2a</code></a>
Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1151">#1151</a>:
Fix missing wrapper cache distributions (<a
href="https://redirect.github.com/actions/setup-java/issues/1153">#1153</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/6a3384db745932178632d0e22b2bd28cad1678e6"><code>6a3384d</code></a>
Fix npm audit failures on releases/v5 (<a
href="https://redirect.github.com/actions/setup-java/issues/1154">#1154</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-java/compare/03ad4de0992f5dab5e18fcb136590ce7c4a0ac95...b6effb05e454b25005698d916606bdc6ffcbf961">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-06 19:21:45 -06:00
Daz DeBoerandClaude Opus 5 b7d46eb472 Document immutable releases in the release process 
Release immutability is now enabled for this repository, so a published
release permanently locks its Git tag to a commit, and deleting the
release does not free the tag name for reuse.

Reorder the steps so the signed tag is created and pushed before the
release is drafted, and have the draft select that existing tag. Letting
GitHub create the tag at publish time produces an unsigned, lightweight
tag pointing at whatever main resolves to at that moment - both of which
immutability then makes permanent.

Also record that the v6 major tag must never have a release attached:
immutability locks only tags that have a release of their own, which is
what keeps the conventional major-tag force-push legal.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-02 13:54:30 -06:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		9c971963be Bump the github-actions group across 2 directories with 9 updates (#1024) 
Bumps the github-actions group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.3` |
`7.0.1` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0`
| `7.0.0` |
| [gradle/actions/setup-gradle](https://github.com/gradle/actions) |
`6.1.0` | `6.2.0` |
| [github/codeql-action/init](https://github.com/github/codeql-action) |
`4.36.2` | `4.37.4` |
|
[github/codeql-action/analyze](https://github.com/github/codeql-action)
| `4.36.2` | `4.37.4` |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.2.0`
| `5.6.0` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) |
`2.4.3` | `2.4.4` |
|
[stefanzweifel/git-auto-commit-action](https://github.com/stefanzweifel/git-auto-commit-action)
| `7.1.0` | `7.2.0` |
| [gradle/actions/wrapper-validation](https://github.com/gradle/actions)
| `6.1.0` | `6.2.0` |

Bumps the github-actions group with 1 update in the
/.github/actions/init-integ-test directory:
[actions/setup-java](https://github.com/actions/setup-java).

Updates `actions/checkout` from 6.0.3 to 7.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>escape values passed to --unset by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>block checking out fork pr for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the
minor-actions-dependencies group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and
<code>@​actions/tool-cache</code> and Remove uuid by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
<li>getting ready for checkout v7 release by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li>
<li>update error wording by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li><strong>[BREAKING]</strong> backport
<code>allow-unsafe-pr-checkout</code> to v6 by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2500">actions/checkout#2500</a></li>
<li>backport fixes to releases-v6 by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2527">actions/checkout#2527</a></li>
</ul>
<p><a
href="https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/">https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/</a>
for more details about this breaking change</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.3...v6.1.0">https://github.com/actions/checkout/compare/v6.0.3...v6.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.1</h2>
<ul>
<li>Skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>Trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>Escape values passed to --unset by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1"><code>3d3c42e</code></a>
prep v7.0.1 release (<a
href="https://redirect.github.com/actions/checkout/issues/2531">#2531</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07"><code>2880268</code></a>
escape values passed to --unset (<a
href="https://redirect.github.com/actions/checkout/issues/2530">#2530</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1"><code>12cd223</code></a>
trim only ascii whitespace for branch (<a
href="https://redirect.github.com/actions/checkout/issues/2521">#2521</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541"><code>62661c4</code></a>
skip running unsafe pr check if input is default (<a
href="https://redirect.github.com/actions/checkout/issues/2518">#2518</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f"><code>e8d4307</code></a>
Bump the minor-actions-dependencies group with 2 updates (<a
href="https://redirect.github.com/actions/checkout/issues/2499">#2499</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87"><code>631c942</code></a>
eslint 9 (<a
href="https://redirect.github.com/actions/checkout/issues/2474">#2474</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e"><code>4f1f4ae</code></a>
Bump actions/upload-artifact from 4 to 7 (<a
href="https://redirect.github.com/actions/checkout/issues/2476">#2476</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92"><code>ba09753</code></a>
Bump actions/checkout from 6 to 7 (<a
href="https://redirect.github.com/actions/checkout/issues/2488">#2488</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22"><code>b9e0990</code></a>
Bump docker/login-action from 3.3.0 to 4.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2479">#2479</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2"><code>e8cb398</code></a>
Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2478">#2478</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...3d3c42e5aac5ba805825da76410c181273ba90b1">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/setup-node` from 6.4.0 to 7.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-node/releases">actions/setup-node's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements:</h3>
<ul>
<li>Add cache-primary-key and cache-matched-key as outputs by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in
<a
href="https://redirect.github.com/actions/setup-node/pull/1577">actions/setup-node#1577</a></li>
<li>Migrate to ESM and upgrade dependencies by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in
<a
href="https://redirect.github.com/actions/setup-node/pull/1574">actions/setup-node#1574</a></li>
</ul>
<h3>Bug fixes:</h3>
<ul>
<li>Remove dummy NODE_AUTH_TOKEN export by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in
<a
href="https://redirect.github.com/actions/setup-node/pull/1558">actions/setup-node#1558</a></li>
<li>Only use <code>mirrorToken</code> in <code>getManifest</code> if
it's provided by <a
href="https://github.com/deiga"><code>@​deiga</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1548">actions/setup-node#1548</a></li>
</ul>
<h3>Documentation updates:</h3>
<ul>
<li>Add documentation for publishing to npm with Trusted Publisher
(OIDC) by <a
href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1536">actions/setup-node#1536</a></li>
<li>docs: Update restore-only cache documentation by <a
href="https://github.com/priya-kinthali"><code>@​priya-kinthali</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1550">actions/setup-node#1550</a></li>
<li>docs: Update caching recommendations to mitigate cache poisoning
risks by <a
href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1567">actions/setup-node#1567</a></li>
</ul>
<h3>Dependency update:</h3>
<ul>
<li>Upgrade <code>@​actions/cache</code> to 5.1.0, log cache write
denied by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1569">actions/setup-node#1569</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1536">actions/setup-node#1536</a></li>
<li><a href="https://github.com/deiga"><code>@​deiga</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1548">actions/setup-node#1548</a></li>
<li><a href="https://github.com/jasongin"><code>@​jasongin</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1569">actions/setup-node#1569</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-node/compare/v6...v7.0.0">https://github.com/actions/setup-node/compare/v6...v7.0.0</a></p>
<h2>v6.5.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update <code>@​actions/cache</code> to 5.1.0 and add security
overrides for undici and fast-xml-parser by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1579">actions/setup-node#1579</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0">https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-node/commit/820762786026740c76f36085b0efc47a31fe5020"><code>8207627</code></a>
Migrate to ESM and upgrade dependencies (<a
href="https://redirect.github.com/actions/setup-node/issues/1574">#1574</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/04be95cf3511ea51ebf9f224ddfb99cc7ab87cd4"><code>04be95c</code></a>
Add cache-primary-key and cache-matched-key as outputs (<a
href="https://redirect.github.com/actions/setup-node/issues/1577">#1577</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/7c2c68d20d402ed6a201ada70a81341941093140"><code>7c2c68d</code></a>
docs: Update caching recommendations to mitigate cache poisoning risks
(<a
href="https://redirect.github.com/actions/setup-node/issues/1567">#1567</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/6a61c0375d66246de94630495909f12cf8dac84d"><code>6a61c03</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/setup-node/issues/1569">#1569</a>
from jasongin/update-actions-cache-5.1.0</li>
<li><a
href="https://github.com/actions/setup-node/commit/30eb73b41ded577900c1ebf968ef95cdf8f7434f"><code>30eb73b</code></a>
Resolve high-severity audit issues</li>
<li><a
href="https://github.com/actions/setup-node/commit/4e1a87a501d0302f99e30e2748568adcb388d09f"><code>4e1a87a</code></a>
Update dist</li>
<li><a
href="https://github.com/actions/setup-node/commit/360237f0c01778d0c17291f75c56d6feae4f7574"><code>360237f</code></a>
Strict equality</li>
<li><a
href="https://github.com/actions/setup-node/commit/4f8aac5beb2f0854bc79651567a18c67eb0b9de3"><code>4f8aac5</code></a>
Bump <code>@​actions/cache</code> to 5.1.0, log cache write denied</li>
<li><a
href="https://github.com/actions/setup-node/commit/f4a67bbeca970f103397d3d2b9462cf787cd2980"><code>f4a67bb</code></a>
Only use <code>mirrorToken</code> in <code>getManifest</code> if it's
provided (<a
href="https://redirect.github.com/actions/setup-node/issues/1548">#1548</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/0355742c943ddb13ca8a6b700f824231caa91e75"><code>0355742</code></a>
Remove dummy NODE_AUTH_TOKEN export (<a
href="https://redirect.github.com/actions/setup-node/issues/1558">#1558</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020">compare
view</a></li>
</ul>
</details>
<br />

Updates `gradle/actions/setup-gradle` from 6.1.0 to 6.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gradle/actions/releases">gradle/actions/setup-gradle's
releases</a>.</em></p>
<blockquote>
<h2>v6.2.0</h2>
<h2>Highlights</h2>
<p>This release brings significant behaviour improvements to
<strong>Enhanced caching</strong>, improvements to the generated Job
Summary, and a number of correctness and security fixes.</p>
<ol>
<li><strong>Improved cache-cleanup mechanism.</strong> Cleanup of stale
files from the Gradle User Home is now faster, and no longer depends on
Gradle or a JVM. It works by inspecting the local file state directly,
removing the Gradle invocation from the post-build step.</li>
<li><strong>More granular, more stable caching.</strong> The local build
cache is stored as a separate cache entry, so it can be restored and
invalidated independently of the main Gradle User Home entry. Transient
Gradle housekeeping files are excluded from the cache, reducing its size
and improving stability.</li>
<li><strong>Hide obsolete Job summaries in PR commments</strong>: When a
new Job summary comment is added to a PR, previous outdated Job
summaries are now hidden.</li>
<li><strong>Improved caching report in the job summary.</strong> The
cache report now uses a single, consistent layout across all cache
states and providers. Provider information is integrated directly into
the report, and per-entry details are available in an expandable
section. (<a
href="https://redirect.github.com/gradle/actions/issues/985">#985</a>)</li>
<li><strong>Correctness and security fixes.</strong> A unique cache key
is now used per run attempt, so re-runs no longer collide; the job
summary shows the cache key string rather than an internal id; and
bundled dependencies have been updated, including a ReDoS fix and a
fast-xml CVE fix.</li>
</ol>
<h2>What's Changed</h2>
<ul>
<li>Remove unnecessary dependency overrides by <a
href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/981">gradle/actions#981</a></li>
<li>Scope CI-integ-test concurrency groups per-branch by <a
href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/983">gradle/actions#983</a></li>
<li>Improve typings by <a
href="https://github.com/Vampire"><code>@​Vampire</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/938">gradle/actions#938</a></li>
<li>Hide obsolete Job summaries by <a
href="https://github.com/SimonMarquis"><code>@​SimonMarquis</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/902">gradle/actions#902</a></li>
<li>CI: add requireable aggregate/no-op checks for branch protection by
<a href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/984">gradle/actions#984</a></li>
<li>Redesign the caching Job Summary by <a
href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/985">gradle/actions#985</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Vampire"><code>@​Vampire</code></a> made
their first contribution in <a
href="https://redirect.github.com/gradle/actions/pull/938">gradle/actions#938</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/gradle/actions/compare/v6.1.1...v6.2.0">https://github.com/gradle/actions/compare/v6.1.1...v6.2.0</a></p>
<h2>v6.1.1</h2>
<p>This release updates various dependency versions, resolving several
reported security vulnerabilities.
No functional changes are included</p>
<h2>What's Changed</h2>
<ul>
<li>Bump Gradle Wrapper from 9.4.1 to 9.5.1 in
/sources/test/init-scripts by <a
href="https://github.com/bot-githubaction"><code>@​bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/961">gradle/actions#961</a></li>
<li>Bump Gradle Wrapper from 9.4.1 to 9.5.1 in
/.github/workflow-samples/gradle-plugin by <a
href="https://github.com/bot-githubaction"><code>@​bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/962">gradle/actions#962</a></li>
<li>Bump Gradle Wrapper from 9.4.1 to 9.5.1 in
/.github/workflow-samples/groovy-dsl by <a
href="https://github.com/bot-githubaction"><code>@​bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/963">gradle/actions#963</a></li>
<li>Bump Gradle Wrapper from 9.4.1 to 9.5.1 in
/.github/workflow-samples/java-toolchain by <a
href="https://github.com/bot-githubaction"><code>@​bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/964">gradle/actions#964</a></li>
<li>Bump Gradle Wrapper from 9.4.1 to 9.5.1 in
/.github/workflow-samples/kotlin-dsl by <a
href="https://github.com/bot-githubaction"><code>@​bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/965">gradle/actions#965</a></li>
<li>Update known wrapper checksums by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/937">gradle/actions#937</a></li>
<li>Bump the github-actions group across 2 directories with 8 updates by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/976">gradle/actions#976</a></li>
<li>Bump the npm-dependencies group across 1 directory with 14 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/970">gradle/actions#970</a></li>
<li>Bump references to Develocity Gradle plugin from 4.4.0 to 4.4.2 by
<a
href="https://github.com/bot-githubaction"><code>@​bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/973">gradle/actions#973</a></li>
<li>Bump the npm-dependencies group in /sources with 5 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/977">gradle/actions#977</a></li>
<li>Update <code>@​actions/cache</code> and
<code>@​actions/artifact</code>, stop ignoring them in Dependabot by <a
href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/978">gradle/actions#978</a></li>
<li>Resolve npm security vulnerabilities via dependency overrides by <a
href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/980">gradle/actions#980</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/gradle/actions/compare/v6.1.0...v6.1.1">https://github.com/gradle/actions/compare/v6.1.0...v6.1.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gradle/actions/commit/3f131e8634966bd73d06cc69884922b02e6faf92"><code>3f131e8</code></a>
[bot] Update dist directory</li>
<li><a
href="https://github.com/gradle/actions/commit/97715a29bc75b4c8eeea944dee111d567bb582b5"><code>97715a2</code></a>
Redesign the caching Job Summary (<a
href="https://redirect.github.com/gradle/actions/issues/985">#985</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/8b6cdb5f580ff6b19af985e0fa90cd86daf1d3e1"><code>8b6cdb5</code></a>
CI: add requireable aggregate/no-op checks for branch protection (<a
href="https://redirect.github.com/gradle/actions/issues/984">#984</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/5852e0e5d82ffa89e04ed56eb37c14028a1ce459"><code>5852e0e</code></a>
[bot] Update dist directory</li>
<li><a
href="https://github.com/gradle/actions/commit/318eed703815f0482a7498a267b758f78fe7bcb9"><code>318eed7</code></a>
Hide obsolete Job summaries (<a
href="https://redirect.github.com/gradle/actions/issues/902">#902</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/a7406612929c8997f724ceab900ed029936e3bf5"><code>a740661</code></a>
Improve typings (<a
href="https://redirect.github.com/gradle/actions/issues/938">#938</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/7ae0d0208cc8604463cd30cf64c54d08ac84d13f"><code>7ae0d02</code></a>
Update gradle-actions-caching library to v0.6.0 (<a
href="https://redirect.github.com/gradle/actions/issues/982">#982</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/e473973a5b07be6339cc6d3cf458bb1b30eb9b08"><code>e473973</code></a>
Scope CI-integ-test concurrency groups per-branch</li>
<li><a
href="https://github.com/gradle/actions/commit/35a4a3f355e0599a8af664843f0d1a683e5b2230"><code>35a4a3f</code></a>
Queue up integ-test runs</li>
<li><a
href="https://github.com/gradle/actions/commit/b6eebf33f1e928997bb7ff32e39933e3c015ccff"><code>b6eebf3</code></a>
[bot] Update dist directory</li>
<li>Additional commits viewable in <a
href="https://github.com/gradle/actions/compare/50e97c2cd7a37755bbfafc9c5b7cafaece252f6e...3f131e8634966bd73d06cc69884922b02e6faf92">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/init` from 4.36.2 to 4.37.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/init's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.4</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>v4.37.3</h2>
<p>No user facing changes.</p>
<h2>v4.37.2</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>v4.37.1</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>v4.37.0</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>v4.36.3</h2>
<p>No user facing changes.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.0 - 22 May 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.19.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/f205ea1c3313d32999d8d6a48b4f6530d4437b38"><code>f205ea1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4053">#4053</a>
from github/update-v4.37.4-9130ce0f7</li>
<li><a
href="https://github.com/github/codeql-action/commit/e40d079dd9dd4a5c74f625cecd83867c8208aa71"><code>e40d079</code></a>
Update changelog for v4.37.4</li>
<li><a
href="https://github.com/github/codeql-action/commit/9130ce0f733a0d17b9e1b9692c2af19be6c69dda"><code>9130ce0</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4051">#4051</a>
from github/update-bundle/codeql-bundle-v2.26.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/c62d82468641dca0f8df108ab73e2a8407ac9cf7"><code>c62d824</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/da0c1901011e62af9c02aae8bf5b8885b11f7741"><code>da0c190</code></a>
Update default bundle to codeql-bundle-v2.26.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/18420e3271f74589575af831a523c833acda327f"><code>18420e3</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4043">#4043</a>
from github/mbg/ts/changelog</li>
<li><a
href="https://github.com/github/codeql-action/commit/7e8d8970f03ec5a78ab372fc0778e8e4194111a5"><code>7e8d897</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4046">#4046</a>
from github/mbg/repo-prop/code-quality</li>
<li><a
href="https://github.com/github/codeql-action/commit/2d4c474c2ca5ea2965b9e53fabb7b67b0100016c"><code>2d4c474</code></a>
Log <code>!analysisKindSupported</code> case</li>
<li><a
href="https://github.com/github/codeql-action/commit/98c05a17d327d7c4055fca83114434ab56baacf6"><code>98c05a1</code></a>
Fix argument validation in <code>rollback-changelog.ts</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/8289a49271cbb335d374e7e2e7a50c1576be0afe"><code>8289a49</code></a>
Ignore repository property for unsupported analysis kinds</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...f205ea1c3313d32999d8d6a48b4f6530d4437b38">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/analyze` from 4.36.2 to 4.37.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.4</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>v4.37.3</h2>
<p>No user facing changes.</p>
<h2>v4.37.2</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>v4.37.1</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>v4.37.0</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>v4.36.3</h2>
<p>No user facing changes.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.0 - 22 May 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.19.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/f205ea1c3313d32999d8d6a48b4f6530d4437b38"><code>f205ea1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4053">#4053</a>
from github/update-v4.37.4-9130ce0f7</li>
<li><a
href="https://github.com/github/codeql-action/commit/e40d079dd9dd4a5c74f625cecd83867c8208aa71"><code>e40d079</code></a>
Update changelog for v4.37.4</li>
<li><a
href="https://github.com/github/codeql-action/commit/9130ce0f733a0d17b9e1b9692c2af19be6c69dda"><code>9130ce0</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4051">#4051</a>
from github/update-bundle/codeql-bundle-v2.26.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/c62d82468641dca0f8df108ab73e2a8407ac9cf7"><code>c62d824</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/da0c1901011e62af9c02aae8bf5b8885b11f7741"><code>da0c190</code></a>
Update default bundle to codeql-bundle-v2.26.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/18420e3271f74589575af831a523c833acda327f"><code>18420e3</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4043">#4043</a>
from github/mbg/ts/changelog</li>
<li><a
href="https://github.com/github/codeql-action/commit/7e8d8970f03ec5a78ab372fc0778e8e4194111a5"><code>7e8d897</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4046">#4046</a>
from github/mbg/repo-prop/code-quality</li>
<li><a
href="https://github.com/github/codeql-action/commit/2d4c474c2ca5ea2965b9e53fabb7b67b0100016c"><code>2d4c474</code></a>
Log <code>!analysisKindSupported</code> case</li>
<li><a
href="https://github.com/github/codeql-action/commit/98c05a17d327d7c4055fca83114434ab56baacf6"><code>98c05a1</code></a>
Fix argument validation in <code>rollback-changelog.ts</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/8289a49271cbb335d374e7e2e7a50c1576be0afe"><code>8289a49</code></a>
Ignore repository property for unsupported analysis kinds</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...f205ea1c3313d32999d8d6a48b4f6530d4437b38">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/setup-java` from 5.2.0 to 5.6.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-java/releases">actions/setup-java's
releases</a>.</em></p>
<blockquote>
<h2>v5.6.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Backport to v5: Add Maven compiler problem matcher for javac
diagnostics by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1087">actions/setup-java#1087</a></li>
<li>feat: expose cache-primary-key output (<a
href="https://redirect.github.com/actions/setup-java/issues/597">#597</a>)
[v5 backport] by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1089">actions/setup-java#1089</a></li>
<li>dist: Cover Tencent Kona JDK 25 (<a
href="https://redirect.github.com/actions/setup-java/issues/1108">#1108</a>)
[v5 backport] by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1110">actions/setup-java#1110</a></li>
<li>Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1111">#1111</a>:
Preserve Maven toolchains across repeated setup-java runs (<a
href="https://redirect.github.com/actions/setup-java/issues/1099">#1099</a>)
by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1113">actions/setup-java#1113</a></li>
<li>Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1097">#1097</a>/<a
href="https://redirect.github.com/actions/setup-java/issues/1098">#1098</a>
to v5: cache Maven and Gradle wrapper distributions separately by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1122">actions/setup-java#1122</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-java/compare/v5...v5.6.0">https://github.com/actions/setup-java/compare/v5...v5.6.0</a></p>
<h2>v5.5.0</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: enforce pre-PR validation (aggregate scripts, git hooks, PR
checklist) by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1061">actions/setup-java#1061</a></li>
<li>Bump github/codeql-action from 3 to 4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/setup-java/pull/1069">actions/setup-java#1069</a></li>
<li>Bump actions/checkout from 6 to 7 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/setup-java/pull/1068">actions/setup-java#1068</a></li>
<li>Bump actions/setup-python from 5 to 6 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/setup-java/pull/1067">actions/setup-java#1067</a></li>
<li>Bump <code>@​typescript-eslint/parser</code> from 8.61.1 to 8.62.0
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/setup-java/pull/1062">actions/setup-java#1062</a></li>
<li>feat: Add verify-signature plumbing and Temurin+Microsoft
verification support by <a
href="https://github.com/johnoliver"><code>@​johnoliver</code></a> in <a
href="https://redirect.github.com/actions/setup-java/pull/1060">actions/setup-java#1060</a></li>
<li>Updated jetbrains test: https.request() now catches errors. This
fixes leaking tests as well by <a
href="https://github.com/jmjaffe37"><code>@​jmjaffe37</code></a> in <a
href="https://redirect.github.com/actions/setup-java/pull/1070">actions/setup-java#1070</a></li>
<li>Fix arm64 e2e workflow tests mislabeled as x64 by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1073">actions/setup-java#1073</a></li>
<li>feat: suppress Maven transfer progress via MAVEN_ARGS by default
(add show-download-progress input) by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1053">actions/setup-java#1053</a></li>
<li>feat: Disable interactiveMode in generated Maven settings.xml by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1052">actions/setup-java#1052</a></li>
<li>Bump prettier from 3.6.2 to 3.9.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/setup-java/pull/1066">actions/setup-java#1066</a></li>
<li>chore(deps-dev): bump eslint-plugin-jest from 29.0.1 to 29.15.4 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/setup-java/pull/1074">actions/setup-java#1074</a></li>
<li>fix: Maven Toolchains grows unexpectedly by <a
href="https://github.com/Okeanos"><code>@​Okeanos</code></a> in <a
href="https://redirect.github.com/actions/setup-java/pull/534">actions/setup-java#534</a></li>
<li>dist: Support Tencent Kona JDK by <a
href="https://github.com/johnshajiang"><code>@​johnshajiang</code></a>
in <a
href="https://redirect.github.com/actions/setup-java/pull/672">actions/setup-java#672</a></li>
<li>feat: Add set-default option by <a
href="https://github.com/gsmet"><code>@​gsmet</code></a> in <a
href="https://redirect.github.com/actions/setup-java/pull/1017">actions/setup-java#1017</a></li>
<li>docs: document problem matcher (and how to disable it), Maven
Wrapper caching, and generated interactiveMode by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1075">actions/setup-java#1075</a></li>
<li>feat: Add distribution detection support to .sdkmanrc file by <a
href="https://github.com/lukaszgyg"><code>@​lukaszgyg</code></a> in <a
href="https://redirect.github.com/actions/setup-java/pull/975">actions/setup-java#975</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/jmjaffe37"><code>@​jmjaffe37</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-java/pull/1070">actions/setup-java#1070</a></li>
<li><a href="https://github.com/gsmet"><code>@​gsmet</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-java/pull/1017">actions/setup-java#1017</a></li>
<li><a href="https://github.com/lukaszgyg"><code>@​lukaszgyg</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-java/pull/975">actions/setup-java#975</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-java/compare/v5...v5.5.0">https://github.com/actions/setup-java/compare/v5...v5.5.0</a></p>
<h2>v5.4.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​typescript-eslint/parser</code> from 8.48.0 to 8.61.1
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/setup-java/pull/1021">actions/setup-java#1021</a></li>
<li>Fix codeql workflow permissions by <a
href="https://github.com/jsoref"><code>@​jsoref</code></a> in <a
href="https://redirect.github.com/actions/setup-java/pull/993">actions/setup-java#993</a></li>
<li>fix CodeQL permissions by <a
href="https://github.com/gdams"><code>@​gdams</code></a> in <a
href="https://redirect.github.com/actions/setup-java/pull/1025">actions/setup-java#1025</a></li>
<li>fix: reject non-semver candidate versions in isVersionSatisfies by
<a href="https://github.com/sproctor"><code>@​sproctor</code></a> in <a
href="https://redirect.github.com/actions/setup-java/pull/1009">actions/setup-java#1009</a></li>
<li>Bump <code>@​actions/cache</code> to 5.1.0, handle cache write
denied by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/setup-java/pull/1026">actions/setup-java#1026</a></li>
<li>Add Maven Wrapper cache feature by <a
href="https://github.com/mahabaleshwars"><code>@​mahabaleshwars</code></a>
in <a
href="https://redirect.github.com/actions/setup-java/pull/1027">actions/setup-java#1027</a></li>
<li>Spelling by <a
href="https://github.com/jsoref"><code>@​jsoref</code></a> in <a
href="https://redirect.github.com/actions/setup-java/pull/713">actions/setup-java#713</a></li>
<li>add link to advanced configuration for JetBrains by <a
href="https://github.com/robstoll"><code>@​robstoll</code></a> in <a
href="https://redirect.github.com/actions/setup-java/pull/850">actions/setup-java#850</a></li>
<li>docs(action): fix missing required or default fields by <a
href="https://github.com/kranthipoturaju"><code>@​kranthipoturaju</code></a>
in <a
href="https://redirect.github.com/actions/setup-java/pull/1007">actions/setup-java#1007</a></li>
<li>feat: add microsoft openjdk 17.0.18 by <a
href="https://github.com/al-kau"><code>@​al-kau</code></a> in <a
href="https://redirect.github.com/actions/setup-java/pull/1002">actions/setup-java#1002</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-java/commit/03ad4de0992f5dab5e18fcb136590ce7c4a0ac95"><code>03ad4de</code></a>
Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1097">#1097</a>/<a
href="https://redirect.github.com/actions/setup-java/issues/1098">#1098</a>:
cache Maven and Gradle wrapper distributions separately...</li>
<li><a
href="https://github.com/actions/setup-java/commit/d229d2e858d9137cc0b3f118fa5184b9f0a44ac4"><code>d229d2e</code></a>
Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1111">#1111</a>:
Preserve Maven toolchains across repeated setup-java runs (<a
href="https://redirect.github.com/actions/setup-java/issues/1">#1</a>...</li>
<li><a href="https://github.com...

_Description has been truncated_

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
v6 v6.3.0 		2026-08-01 21:16:33 -06:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		760e4a476b Bump the npm-dependencies group across 1 directory with 2 updates (#1037) 
Bumps the npm-dependencies group with 2 updates in the /sources
directory: [eslint](https://github.com/eslint/eslint) and
[globals](https://github.com/sindresorhus/globals).

Updates `eslint` from 10.7.0 to 10.8.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.8.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/2fee9bb7416116cbed4d8c8100b1ae713b6356a1"><code>2fee9bb</code></a>
feat: export <code>ConfigObject</code> from <code>eslint/config</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/21082">#21082</a>)
(sethamus)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/6b8d2f7589b8a7c8b91b8ca2a2ef6d46178760d8"><code>6b8d2f7</code></a>
fix: escape reserved characters in rule id in <code>html</code>
formatter (<a
href="https://redirect.github.com/eslint/eslint/issues/21129">#21129</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/90910715011211a20d011d807d398a7005127f35"><code>9091071</code></a>
fix: prevent <code>no-unreachable-loop</code> crash when all loop types
are ignored (<a
href="https://redirect.github.com/eslint/eslint/issues/21116">#21116</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/e23fafe8d4b15355adef6cdebef414c3a2019454"><code>e23fafe</code></a>
fix: prefer-object-spread add semicolon when adding parenthesis (<a
href="https://redirect.github.com/eslint/eslint/issues/21081">#21081</a>)
(synthex-byte)</li>
<li><a
href="https://github.com/eslint/eslint/commit/20b5ad052360a443786a202e94624a3f81846511"><code>20b5ad0</code></a>
fix: quadratic-time regex in <code>prefer-template</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21096">#21096</a>)
(Milos Djermanovic)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8b6f6c0b33411f34485512456d94f221daf7321f"><code>8b6f6c0</code></a>
fix: apply ignore configs to computed methods in class-methods-use-this
(<a
href="https://redirect.github.com/eslint/eslint/issues/21094">#21094</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b2c608c014a396800a24a89343265d0616bee2d8"><code>b2c608c</code></a>
fix: NewExpression with parenthesized callee in
<code>preserve-caught-error</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21083">#21083</a>)
(Francesco Trotta)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/6ddf8587e5cfeeb7328332601bb76d98b8a198ea"><code>6ddf858</code></a>
docs: fix broken Specify Parser Options anchor link (<a
href="https://redirect.github.com/eslint/eslint/issues/21106">#21106</a>)
(Minsu)</li>
<li><a
href="https://github.com/eslint/eslint/commit/784dfbe98f0222426fd200153a5ce2e5624151f0"><code>784dfbe</code></a>
docs: Clarify <code>no-eq-null</code> description (<a
href="https://redirect.github.com/eslint/eslint/issues/21120">#21120</a>)
(Park Harin)</li>
<li><a
href="https://github.com/eslint/eslint/commit/7ec733a3ba5acb053a73ac656030a3879aa48fda"><code>7ec733a</code></a>
docs: Fix typos and grammar in glossary (<a
href="https://redirect.github.com/eslint/eslint/issues/21095">#21095</a>)
(Marry (Subin Yang))</li>
<li><a
href="https://github.com/eslint/eslint/commit/92bb13f13065db72d62454b9830d3ae52db15c76"><code>92bb13f</code></a>
docs: replace quake link (<a
href="https://redirect.github.com/eslint/eslint/issues/21108">#21108</a>)
(Jung Hyeon Jun)</li>
<li><a
href="https://github.com/eslint/eslint/commit/68eb4a57572409dbdcfeb3bc5c92ddbba46bc770"><code>68eb4a5</code></a>
docs: fix broken Specify Globals anchor links in rule pages (<a
href="https://redirect.github.com/eslint/eslint/issues/21103">#21103</a>)
(Minsu)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d28f697e0d32d7446c825fd89c362db028450134"><code>d28f697</code></a>
docs: replace Code Climate CLI links with Qlty CLI links (<a
href="https://redirect.github.com/eslint/eslint/issues/21099">#21099</a>)
(Jung Hyeon Jun)</li>
<li><a
href="https://github.com/eslint/eslint/commit/eccc68d42564e46bc9020d19ec52d2988f3b7bfa"><code>eccc68d</code></a>
docs: correct --suppressions-location option description (<a
href="https://redirect.github.com/eslint/eslint/issues/21093">#21093</a>)
(Ga eun Lee)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c5963f74bfa82a5b7ccc0607dcdcc695b8c97a31"><code>c5963f7</code></a>
docs: Update README (GitHub Actions Bot)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4fbf46d140120ae838db08cbe49544c985956490"><code>4fbf46d</code></a>
test: pin <code>webpack</code> version to 5.108.4 (<a
href="https://redirect.github.com/eslint/eslint/issues/21137">#21137</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/2d063e224e9bb0ccb0a28c120f7e380a8d62f320"><code>2d063e2</code></a>
chore: update HTTP URLs to HTTPS in JSDoc and comments (<a
href="https://redirect.github.com/eslint/eslint/issues/21101">#21101</a>)
(Bo Hyun Kim)</li>
<li><a
href="https://github.com/eslint/eslint/commit/eccbe7bc9257a6c99880468e452c8dfafbf47f74"><code>eccbe7b</code></a>
test: add error locations to <code>no-class-assign</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21123">#21123</a>)
(devoil)</li>
<li><a
href="https://github.com/eslint/eslint/commit/e7d1e4373bf626f8da76d62ce024c28928bc99bc"><code>e7d1e43</code></a>
ci: bump actions/setup-go from 6 to 7 (<a
href="https://redirect.github.com/eslint/eslint/issues/21118">#21118</a>)
(dependabot[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/e9d66d0cde1a7752c29dee53ab7b62632835a87a"><code>e9d66d0</code></a>
ci: bump actions/setup-node from 6 to 7 (<a
href="https://redirect.github.com/eslint/eslint/issues/21119">#21119</a>)
(dependabot[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/ee225b60c26f0cc5f4d71641888a5bd2ec5626d6"><code>ee225b6</code></a>
test: Add error location details to <code>no-eq-null</code> rule (<a
href="https://redirect.github.com/eslint/eslint/issues/21117">#21117</a>)
(Park Harin)</li>
<li><a
href="https://github.com/eslint/eslint/commit/044a627fa3e28ee1410d515acc5378eb4b49f8ba"><code>044a627</code></a>
chore: update minimatch to ^10.2.5 (<a
href="https://redirect.github.com/eslint/eslint/issues/21107">#21107</a>)
(김채영)</li>
<li><a
href="https://github.com/eslint/eslint/commit/fb09aa8ff09730d3ccf68859e065f99666b52466"><code>fb09aa8</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21115">#21115</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5abd878740fe417fd8a910cac3741f2a0317b365"><code>5abd878</code></a>
test: add error locations to <code>no-proto</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21114">#21114</a>)
(Gihyeon Jeong / 정기현)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9715887ec94a5ff936447d7b680d039fbe2f0541"><code>9715887</code></a>
test: Add error location details to <code>no-div-regex</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21110">#21110</a>)
(Park Harin)</li>
<li><a
href="https://github.com/eslint/eslint/commit/a746ec6ea4a2249b1eb3f512264da5f4d5f7c886"><code>a746ec6</code></a>
test: add error locations to <code>no-new-wrappers</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21109">#21109</a>)
(Gihyeon Jeong / 정기현)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8dde64570e240f3ef8af873d59a752db6d8519aa"><code>8dde645</code></a>
test: add error locations to <code>no-ex-assign</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21102">#21102</a>)
(devoil)</li>
<li><a
href="https://github.com/eslint/eslint/commit/13ab0ec447650c079d8a5e5d67222f79e69c741e"><code>13ab0ec</code></a>
test: add error locations to <code>no-label-var</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21098">#21098</a>)
(Gihyeon Jeong / 정기현)</li>
<li><a
href="https://github.com/eslint/eslint/commit/a99906ffb8342dde03336b5c6372b5658f21d5f2"><code>a99906f</code></a>
test: Add error location details to <code>no-delete-var</code> rule (<a
href="https://redirect.github.com/eslint/eslint/issues/21105">#21105</a>)
(Park Harin)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c47e8dc9bbfba797430db45ae08cb6f7392cfc9d"><code>c47e8dc</code></a>
chore: add missing backticks to <code>languages/js/index.js</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21104">#21104</a>)
(beeen)</li>
<li><a
href="https://github.com/eslint/eslint/commit/0174428dd7543d118cf67a823b98dd97032fe68c"><code>0174428</code></a>
chore: add missing backticks to <code>translate-cli-options.js</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/21097">#21097</a>)
(dongkyu lee)</li>
<li><a
href="https://github.com/eslint/eslint/commit/3d36589a4917326500f0707bb41745160f387d00"><code>3d36589</code></a>
chore: add missing backticks to <code>serialization.js</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21091">#21091</a>)
(이규환)</li>
<li><a
href="https://github.com/eslint/eslint/commit/dcc9312c1081931de0fe1b555fbb6aa82fe696b9"><code>dcc9312</code></a>
test: add error locations to <code>eqeqeq</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21090">#21090</a>)
(Ga eun Lee)</li>
<li><a
href="https://github.com/eslint/eslint/commit/2710b182472cd1a95e4aff6186cb2c4fbadb4ee0"><code>2710b18</code></a>
ci: Add explicit permissions to rebuild-docs-sites workflow (<a
href="https://redirect.github.com/eslint/eslint/issues/21089">#21089</a>)
(Marry (Subin Yang))</li>
<li><a
href="https://github.com/eslint/eslint/commit/5d2f8663ee60701e9036b0b0933a12efd9d93269"><code>5d2f866</code></a>
chore: update dependency prettier to v3.9.5 (<a
href="https://redirect.github.com/eslint/eslint/issues/21086">#21086</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/d584e31098f262563b97dc5d5f23a63a187879a0"><code>d584e31</code></a>
chore: fix failing ecosystem test for <code>eslint-plugin-unicorn</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/21084">#21084</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/bf3eda049bd690f1e9a5a0c4520a6329b3e4ec85"><code>bf3eda0</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21079">#21079</a>)
(ESLint Bot)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/749dfed106f44d77bf3af2402ebfae20cdbf59ee"><code>749dfed</code></a>
10.8.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/4bd0d75b22ffd44809a92659f113c972c5be0770"><code>4bd0d75</code></a>
Build: changelog update for 10.8.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/4fbf46d140120ae838db08cbe49544c985956490"><code>4fbf46d</code></a>
test: pin <code>webpack</code> version to 5.108.4 (<a
href="https://redirect.github.com/eslint/eslint/issues/21137">#21137</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6ddf8587e5cfeeb7328332601bb76d98b8a198ea"><code>6ddf858</code></a>
docs: fix broken Specify Parser Options anchor link (<a
href="https://redirect.github.com/eslint/eslint/issues/21106">#21106</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/784dfbe98f0222426fd200153a5ce2e5624151f0"><code>784dfbe</code></a>
docs: Clarify <code>no-eq-null</code> description (<a
href="https://redirect.github.com/eslint/eslint/issues/21120">#21120</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6b8d2f7589b8a7c8b91b8ca2a2ef6d46178760d8"><code>6b8d2f7</code></a>
fix: escape reserved characters in rule id in <code>html</code>
formatter (<a
href="https://redirect.github.com/eslint/eslint/issues/21129">#21129</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/2d063e224e9bb0ccb0a28c120f7e380a8d62f320"><code>2d063e2</code></a>
chore: update HTTP URLs to HTTPS in JSDoc and comments (<a
href="https://redirect.github.com/eslint/eslint/issues/21101">#21101</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/eccbe7bc9257a6c99880468e452c8dfafbf47f74"><code>eccbe7b</code></a>
test: add error locations to <code>no-class-assign</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21123">#21123</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/2fee9bb7416116cbed4d8c8100b1ae713b6356a1"><code>2fee9bb</code></a>
feat: export <code>ConfigObject</code> from <code>eslint/config</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/21082">#21082</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/e7d1e4373bf626f8da76d62ce024c28928bc99bc"><code>e7d1e43</code></a>
ci: bump actions/setup-go from 6 to 7 (<a
href="https://redirect.github.com/eslint/eslint/issues/21118">#21118</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.7.0...v10.8.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `globals` from 17.7.0 to 17.8.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sindresorhus/globals/releases">globals's
releases</a>.</em></p>
<blockquote>
<h2>v17.8.0</h2>
<ul>
<li>Update globals (2026-07-01) (<a
href="https://redirect.github.com/sindresorhus/globals/issues/347">#347</a>)
7394811</li>
</ul>
<hr />
<p><a
href="https://github.com/sindresorhus/globals/compare/v17.7.0...v17.8.0">https://github.com/sindresorhus/globals/compare/v17.7.0...v17.8.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sindresorhus/globals/commit/36c76590583fc1f31d755525862eda1793a7d661"><code>36c7659</code></a>
17.8.0</li>
<li><a
href="https://github.com/sindresorhus/globals/commit/739481186ed54482e29845eff0bc44803c35fde8"><code>7394811</code></a>
Update globals (2026-07-01) (<a
href="https://redirect.github.com/sindresorhus/globals/issues/347">#347</a>)</li>
<li>See full diff in <a
href="https://github.com/sindresorhus/globals/compare/v17.7.0...v17.8.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 21:03:01 -06:00
Bot GithubactionandGitHub 73e4c4222b Update gradle-actions-caching library to v1.0.0 (#1029) 
Updates to the latest gradle-actions-caching library.
 2026-08-01 20:57:35 -06:00
Daz DeBoerandClaude Opus 5 a9d14388b4 Add dependabot ignore rules for TypeScript 7.x and @types/node 25.x/26.x 
Previously handled via `@dependabot ignore` issue comments, which don't
provide enough control. Declaring the rules in the config makes them
explicit and reviewable.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-01 20:55:01 -06:00
bot-githubaction 68f37005d7 [bot] Update dist directory 2026-08-02 02:30:10 +00:00
Daz DeBoerGitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Claude Opus 5bot-githubaction
 		5971332a8f Bump Gradle Wrapper to 9.6.1, wrapper checksums, and Develocity plugin to 4.5.0 (#1034) 
Consolidates seven open bot PRs into three commits.

## 1. Bump Gradle Wrapper from 9.5.1 to 9.6.1

Combines **#1008, #1009, #1010, #1011, #1012** into a single commit.
Each of those PRs bumped the wrapper in one directory; this covers all
five (15 files):

- `sources/test/init-scripts`
- `.github/workflow-samples/gradle-plugin`
- `.github/workflow-samples/groovy-dsl`
- `.github/workflow-samples/java-toolchain`
- `.github/workflow-samples/kotlin-dsl`

Each location gets the same `distributionUrl` → `gradle-9.6.1-bin.zip`
and `distributionSha256Sum` update, plus the regenerated `gradlew` /
`gradlew.bat` scripts.

## 2. Update known wrapper checksums

**#990**, unchanged, as its own commit. Adds 36 checksum entries to
`sources/src/wrapper-validation/wrapper-checksums.json`, **including the
9.6.1 checksums** — which is what lets the wrapper bump above pass
`CI-validate-wrappers`. These two are worth landing together.

## 3. Bump Develocity Gradle plugin from 4.4.2 to 4.5.0

**#1015**, unchanged, as its own commit. Updates the plugin reference
across workflow samples, init-script tests, docs, and the injected
default in `sources/src/develocity/build-scan.ts`:

```diff
-maybeExportVariable('DEVELOCITY_INJECTION_DEVELOCITY_PLUGIN_VERSION', '4.4.2')
+maybeExportVariable('DEVELOCITY_INJECTION_DEVELOCITY_PLUGIN_VERSION', '4.5.0')
```

Since this touches `sources/src`, the bundled `dist/` will change when
the update-dist bot runs.

## Verification

All three cherry-picks applied without conflicts. On the combined
branch:

- `./build` — clean
- `npm run check` (prettier + eslint) — clean
- `npm test` — 373 tests, 15 suites, all passing

Original bot authorship is preserved on all three commits.

## Superseded PRs

Once this merges, these can be closed: #1008, #1009, #1010, #1011,
#1012, #990, #1015.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: bot-githubaction <bot-githubaction@gradle.com>
 2026-08-01 20:29:23 -06:00
bot-githubaction b5bc804016 [bot] Update dist directory 2026-08-02 02:28:50 +00:00
Daz DeBoerGitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Claude Opus 5
 		dcbab4e919 Bump npm-dependencies group with TypeScript 6.0.3, @types/node 24.x, and security fixes (#1033) 
Supersedes #1023.

## 1. Adjust dependabot's TypeScript choices

Dependabot's group bump included two changes that we don't want to take
as-is:

- **typescript**: `5.9.3` → `7.0.2`. Pinned to **6.0.3** instead.
- **@types/node**: `25.9.2` → `26.1.1`. Downgraded to the latest 24.x
(**24.13.3**), matching the Node 24 runtime the actions target.

All other updates from #1023 are kept unchanged (`@actions/cache` 6.2.0,
`semver` 7.8.5, `@typescript-eslint/eslint-plugin` 8.65.0, `esbuild`
0.28.1, `eslint` 10.7.0, `globals` 17.7.0, `prettier` 3.9.6, `ts-jest`
29.4.12), and the branch is rebased onto current `main`.

The prettier 3.9.6 bump reformats two union types in
`sources/src/cache-service.ts`; that reformatting is included so `npm
run check` passes.

## 2. Clear 5 open security advisories

`npm audit` reported 4 high and 1 low severity advisory. All are fixable
with **semver-compatible transitive updates** — `npm audit fix` clears
them without `--force`, and `package.json` is untouched.

**Production** (bundled into `dist/`, so they ship in the actions):

| Package | Before | After | Via |
| --- | --- | --- | --- |
| `undici` | 6.24.1 | 6.28.0 | `@actions/github`, `@actions/http-client`
|
| `undici` | 7.24.5 | 7.29.0 | `cheerio` |
| `brace-expansion` | 5.0.6 | 5.0.9 | `@actions/glob` → `minimatch` |
| `brace-expansion` | 2.0.3 | 2.1.4 | `@actions/artifact` → `archiver` |

**Dev only:** `shell-quote` 1.8.4 → 1.10.0 (`npm-run-all`), `js-yaml`
3.14.2 → 3.15.1 (`ts-jest`), `@babel/core` 7.28.0 → 7.29.x (`ts-jest`,
low severity).

These were outstanding because the lockfile pins transitive resolutions
while `.github/dependabot.yml` only bumps direct dependencies. Because
`undici` and `brace-expansion` are production dependencies, the bundled
`dist/` output will change when the update-dist bot runs.

## 3. Downgrade nock to 14.0.17

**nock 15.0.0 was published by mistake.** The registry marks it
deprecated:

> v15.0.0 was released accidentally and is unstable. Please use v14.x
until v15 is officially ready.

nock's `latest` dist-tag still points at 14.0.17 for exactly this
reason, and 15.x remains a beta line (`beta` = `15.0.0-beta.14`).
Dependabot picked up 15.0.0 in an earlier group bump simply because it
is the highest published version. This moves us to 14.0.17, pulling
`@mswjs/interceptors` 0.39.8 → 0.41.9 and adding `propagate` 2.0.1.

Dependabot will likely re-propose nock 15.0.0 on its next weekly run,
since no ignore rule was added.

## 4. Delete unused `sources/.nvmrc`

The file pinned Node `v16`, contradicting `package.json` engines
(`>=24.0.0`), the esbuild `node24` target, and `.tool-versions` (`nodejs
24.3.0`). Nothing reads it — no workflow uses `node-version-file` and
there are no other references in the repo. Stale since 5e522253.

## 5. Run CI workflows on Node 24

`ci-check-and-unit-test.yml`, `ci-update-dist.yml`, and
`update-checksums-file.yml` pinned `node-version: 20`, so `npm
clean-install` was emitting `EBADENGINE` warnings for the root package
against its own `engines: >=24.0.0`. All three now use Node 24, matching
`.github/actions/build-dist/action.yml`.

Worth noting: `ci-update-dist.yml` built `dist/` on Node 20 in its
inline steps while `build-dist/action.yml` built it on Node 24, so the
committed distribution could previously be produced under either
version.

## Verification

- `./build` — clean
- `npm run check` (prettier + eslint) — clean
- `npm test` — 373 tests, 15 suites, all passing
- `npm audit` — **found 0 vulnerabilities** (was 4 high, 1 low)
- `npx tsc --noEmit` — one pre-existing error in
`@octokit/request-error` types (`Cannot find name 'ErrorOptions'`),
identical on `main` with TypeScript 5.9.3, so not a regression. `tsc` is
not part of the build or CI.

A clean regeneration of `package-lock.json` from `package.json` was also
evaluated. It likewise yields 0 vulnerabilities and 373 passing tests,
but churns 80 transitive packages including the `@azure/core-*` /
`@azure/storage-blob` stack used by `@actions/cache`. Since it offers no
security benefit over the current lockfile, it was not adopted.

### Known-failing checks (pre-existing on `main`)

The three `smoke-tests / restore-gradle-home / … (windows-latest)` jobs
fail with `Build was not cached: unexpected execution of test task`. The
identical three jobs fail on `main` in run
[30723964208](https://github.com/gradle/actions/actions/runs/30723964208),
on the very commit this branch is based on, so they are not caused by
these changes.

## Not included

`npm outdated` also shows `eslint` 10.7.0 → 10.8.0 and `globals` 17.7.0
→ 17.8.0. Both are dev-only and dependabot's weekly npm group run will
propose them.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-01 20:28:09 -06:00
Daz DeBoerGitHubClaude Opus 5
 		ca8d95717f Move non-smoke restore-gradle-home tests back to the integ-test suite (#1032) 
Partial revert of the extraction in #1027. The caching smoke test should
answer one question quickly — does a seeded cache let a later build run
`--offline`? Everything else is integration-level.

Replaces #1031 and #1030, squashed into a single commit.

## Layout

`smoke-test-restore-gradle-home.yml` — two jobs:

| job | purpose |
|---|---|
| `restore-gradle-home-seed-build` | seed the cache |
| `restore-gradle-home-dependencies-cache` | verify the restored cache
allows `--offline` |

`integ-test-restore-gradle-home.yml` — restored, wired back into
`suite-integ-test-caching`:

| job | purpose |
|---|---|
| `restore-gradle-home-seed-build` | seed the cache (duplicated, see
below) |
| `restore-gradle-home-build-cache` | local build-cache restored |
| `restore-gradle-home-no-extracted-cache-entries-restored` | build
works with cache entries skipped |
| `restore-gradle-home-pre-existing-gradle-home` | pre-existing GUH
overwritten by restore |

This file is identical to the pre-#1027 original except for the
`dependencies-cache` job, which the smoke test now owns. All four jobs
keep the `runner-os` matrix.

## Notes

**The seed job is duplicated, with distinct cache keys.** The smoke
suite uses `smoke-test-restore-gradle-home-*`; the integ suite keeps
`restore-gradle-home-*`. This matters: `smoke-tests` and
`caching-integ-tests` run concurrently in `ci-integ-test.yml`, so
sharing a key would have both suites racing to write the same entry.

**Distinct workflow `name:`.** The smoke workflow is `Smoke test restore
Gradle Home`, so the two don't appear identically in the Actions UI.

**One thing to be aware of for the future:**
`restore-gradle-home-pre-existing-gradle-home` cannot pass on Windows.
Pre-creating `~/.gradle` is what stops `setup-gradle` relocating the
Gradle User Home to `D:\a\.gradle`, so the job looks for a cache entry
rooted at a different path than the seed build saved and never matches
it. The caching integ suite runs ubuntu-only, so this is not a problem
today — but adding Windows to that suite would surface it.

## Verification

All workflow YAML parses, and every local `uses:` reference resolves —
no dangling paths after the rename and re-add.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-01 20:18:37 -06:00
bot-githubaction 4318659b28 [bot] Update dist directory 2026-08-01 23:45:55 +00:00
Daz DeBoerGitHubClaude Opus 5
 		79b19cd50f Fix basic caching smoke test on Windows, and warn on save failure (#1028) 
Follow-up to #1027, which added Windows coverage for the caching smoke
tests. `basic-cache-verify-build` failed on Windows for a reason
unrelated to #1013.

## Root cause

The Windows seed job **never uploaded a cache entry, but reported that
it did**. `gh cache list` showed no `setup-java-Windows-*` entry at all,
despite the job logging `Basic caching saved entry with key:
setup-java-Windows-x64-gradle-594edf…`. The keys were never the problem
— seed and verify requested the identical key.

The seed build leaves a Gradle daemon running, holding the `*.lock`
files in the Gradle User Home. On Windows those locks are mandatory, so
`tar` cannot read them:

```
/usr/bin/tar: ../../.gradle/caches/modules-2/modules-2.lock: Read error at byte 0,
              while reading 38 bytes: Device or resource busy
/usr/bin/tar: Exiting with failure status due to previous errors
```

38 bytes is exactly Gradle's lock-file header — the region the daemon
holds via `FileChannel.lock()`. On Linux the lock is advisory and tar
reads straight through, which is why this only ever failed on Windows.

`cache.saveCache()` catches the tar failure, logs it, and returns `-1`
rather than throwing. `BasicCacheService.save()` ignored the return
value, so the seed job went green and the failure surfaced only later —
as a plugin resolution error in the verify job, pointing nowhere near
caching.

## Changes

**1. Warn when the save fails.** Check the returned `cacheId` and, when
it is `-1`, emit a warning and report `(Entry not saved: save failed)`
in the job summary. Caching failures still do not fail the build.

**2. Run the seed build with `--no-daemon`.** Daemon management for
enhanced caching lives in the `gradle-actions-caching` library; basic
caching leaves it to the workflow, so the smoke test now ensures no
daemon is holding locks when the post-action save runs.

## Not related to #1013

The enhanced provider fails differently on Windows — every entry dies at
path validation, before tar runs (`Path Validation Error: Path(s)
specified in the action for caching do(es) not exist`). Same symptom,
different mechanism; that one is unchanged here and is still expected to
be red.

## Verification

`npm run check` and `npm test` pass locally (373 tests). The real check
is this PR's Windows run: `basic-cache-seed-build` and
`basic-cache-verify-build` should both be green on `windows-latest`,
while the `restore-gradle-home-*` Windows jobs stay red pending the
#1013 fix.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-01 17:45:05 -06:00
Daz DeBoerGitHubClaude Opus 5
 		9d31058114 Add Windows coverage for caching via a new smoke-test suite (#1027) 
## Why

Issue #1013 revealed that caching was **never storing content on
Windows**. Nothing caught it because the integ-tests lost their multi-OS
matrices: these workflows used to default to `'["ubuntu-latest",
"windows-latest", "macos-latest"]'`, narrowed to ubuntu-only in bcd07e66
/ d74ee73e (Aug 2024). The Windows code path has been dark ever since.

## What

Extract the two cheapest caching tests — `restore-gradle-home` and
`basic-cache-provider` — into a new `suite-smoke-test-caching` workflow,
and run that suite on both `ubuntu-latest` and `windows-latest`.

Both tests seed a cache in one job and then verify it in a dependent job
with an `--offline` build, so a cache that stores nothing fails the
verify job rather than passing silently.

- Rename `integ-test-{restore-gradle-home,basic-cache-provider}` →
`smoke-test-*` and drop them from `suite-integ-test-caching`
- Add the new suite to both `CI-integ-test` and `CI-integ-test-full`,
each with its own concurrency group matching the sibling suites
- Include `smoke-tests` in the `integ-test-success` aggregate gate
- Ignore the generated `task-configured.txt` marker in
`workflow-samples`
- Drop a dead `needs.determine-suite` guard on the `build-distribution`
step — `CI-integ-test` has no such job, so it always evaluated to true

The suite runs on Windows in PR CI (not just `CI-integ-test-full`)
specifically so the failure is visible on this PR and the fix can be
verified the same way.

## Expected result

This PR is expected to be **red on Windows**.
`restore-gradle-home-dependencies-cache` and `basic-cache-verify-build`
should fail with dependency-resolution errors under `--offline` — that
is the bug from #1013 being caught. The ubuntu legs should stay green.

Cross-OS cache keys are safe: both providers include `RUNNER_OS` in the
key (`sources/src/cache-service-basic.ts:146`), so the matrix legs don't
collide.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-01 17:15:42 -06:00
bot-githubaction 0088877924 [bot] Update dist directory 2026-07-31 19:09:45 +00:00
Reinhold DegenfellnerandGitHub ff4dbcd5fa Disable Isolated Projects via promoted property in dependency-submission (#1025) 
## Problem

The `dependency-submission` action disables Isolated Projects for the
dependency-resolution build by passing
`-Dorg.gradle.unsafe.isolated-projects=false`.

Recent Gradle versions have promoted the property to
`org.gradle.isolated-projects`. A build that enables IP via the promoted
property (e.g. `gradle/gradle`, see [this failing
run](https://github.com/gradle/gradle/actions/runs/30357651750/job/90269499556?pr=38402))
is no longer disabled by the unsafe spelling, so the build runs with IP
enabled and fails:

```
Error resolving plugin [id: 'gradlebuild.build-environment']
> Project ':build-logic-settings' cannot access 'Project.tasks' functionality on subprojects via 'allprojects'
```

(`ForceDependencyResolutionPlugin` is not IP-compatible.)

## Fix

Pass both spellings of the property. `-D` system properties that Gradle
does not recognize are silently ignored, so this is safe for all
supported Gradle versions — the action already passes the unsafe
spelling to pre-IP Gradle versions without issue.
 2026-07-31 13:08:52 -06:00
Daz DeBoerandGitHub 6550634d3e Use the latest dependency graph plugin 2026-07-04 21:16:38 -06:00
Bot GithubactionandGitHub b128da9bf0 Update gradle-actions-caching library to v0.9.0 (#996) 
## What's Changed

> [!IMPORTANT]
> **Cache invalidation:** The cache protocol version has been bumped to `v2`, invalidating all cache entries written by earlier releases. The first build after upgrading will not find existing caches and will repopulate them from scratch.

### Improvements
* **Consistent cache-entry names in reports** — every extracted cache entry now has a single, unique name reported identically on both restore and save. Previously the restore report could show a raw glob pattern (e.g. `caches/modules-*/files-*/*/*/*/*/`) instead of a friendly name like `dependencies`. Bundled entries are named by artifact type, per-file entries by their Gradle-User-Home-relative path, and per-project entries by `project-<rootProjectName>`.
prerelease/config-cache-support 		2026-06-16 19:59:10 +00:00
bot-githubaction ee7ea9a078 [bot] Update dist directory 2026-06-16 18:15:16 +00:00
Daz DeBoerGitHubClaude Opus 4.8
 		9c445f57df Support experimental project-entry caching (configuration-cache + build-logic) (#994) 
Pass develocityAccessToken and develocityServerUrl the
`gradle-actions-caching`: required to support project-entry caching
(build-logic + configuration-cache), which has experimental support in
'gradle-actions-cache@v0.8.0. This support is not yet released and will
be available as a restricted trial.

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-16 18:14:19 +00:00
Bot GithubactionandGitHub bbaaec0da2 Update gradle-actions-caching library to v0.8.0 (#993) 
Updates to the latest gradle-actions-caching library, bringing experimental support for caching of project content.
 2026-06-16 18:07:10 +00:00
bot-githubaction 54d3208a40 [bot] Update dist directory 2026-06-13 01:52:50 +00:00
Daz DeBoerGitHubClaude Opus 4.8
 		e993c93d71 Render configuration-cache status in the caching Job Summary (#989) 
Render the configuration-cache restore-state in the caching Job Summary,
driven by the new `CacheReport.configurationCache` field produced by the
`gradle-actions-caching` provider.

## What's here

- `cache-service.ts`: add a `ConfigurationCacheStatus` type
(`not-active` / `restored` / `not-restored` / `restore-incomplete`) and
an optional `configurationCache` field on `CacheReport`.
- `caching-report.ts`: a `CONFIG_CACHE_COPY` map and a prominent status
line in `renderCachingReport`, beside the cleanup line. The `not-active`
case links to the `#cache-encryption-key` docs.

## Cross-repo dependency

The field is populated by gradle/actions-caching PR #75 ("Restore
configuration-cache support for simple builds"). This rendering compiles
independently (it uses this repo's own `CacheReport` type) and renders
nothing until the vendored `gradle-actions-caching` bundle is refreshed
from that branch — so this should land with/after the vendor refresh.

## Verification

`npm run check` clean; full Jest suite (366 tests) passes, including 3
new rendering tests.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-12 19:51:57 -06:00
bot-githubaction 3f131e8634 [bot] Update dist directory v6.2.0 2026-06-12 15:22:42 +00:00
Daz DeBoerGitHubBot GithubactionClaude Opus 4.8
 		97715a29bc Redesign the caching Job Summary (#985) 
Redesigns the caching section of the Job Summary into a single,
consistent layout across every cache provider and state, and integrates
the provider message into the report rather than appending it
disconnected at the bottom.

## Motivation

The caching report was produced by three divergent code paths (NoOp /
basic / enhanced), each rendering its own markdown:

- **Explicitly disabled** → a one-line message, no expand, no provider
note.
- **Enhanced** (incl. skipped-due-to-existing-home) → a full `<details>`
block.
- **Basic** → a one-line message with **no** expandable details at all.

The Enhanced/Basic provider note floated at the very bottom,
disconnected from the report.

## What changed

`save()` now returns structured `CacheReport` data instead of
pre-rendered HTML, and a single renderer (`caching-report.ts`) produces
one unified layout for all variants:

- **Section heading**: `#### <icon> Gradle Caching — <Provider>
(<status>)`
- **Status line** explaining what the cache did
- **Integrated provider note** woven in under the heading — now shown
**unconditionally** (no longer gated on license acceptance)
- **Expandable cache-entry details** when there are entries — basic
caching now gets this too

The two disabled variants (explicitly disabled, and skipped due to a
pre-existing Gradle User Home) render as **compact callouts with no
expandable section**.

### Main repo
- `caching-report.ts` (new): central renderer + all framing copy + entry
table/`<pre>` helpers.
- `cache-service.ts`: `CacheReport` / `CacheEntryReport` / status types;
`save()` returns `CacheReport`.
- `cache-service-loader.ts`: `NoOp` returns a report;
`LicenseWarningCacheService` removed; new `getProviderNote()`.
- `cache-service-basic.ts`: builds a `CacheReport`.
- `job-summary.ts` / `setup-gradle.ts`: thread `CacheReport` +
`ProviderNote`.
- `configuration.ts`: remove now-unused `isCacheLicenseAccepted()`.

### Vendored library
The structured contract requires **gradle-actions-caching v0.7.0**
(gradle/actions-caching#74). This PR updates the vendored library to
that release — the official `Update gradle-actions-caching library to
v0.7.0` vendor commit is included here, so merging this PR ships the
redesign together with the library it depends on.

## Testing

- Both repos build; prettier + eslint clean.
- `gradle/actions`: 363/363 Jest tests pass, including new
`caching-report.test.ts` covering every variant.
- `gradle-actions-caching`: 74/74 pass under JDK 17.
- Rendered markdown verified for all five variants (enhanced/basic
enabled & read-only, disabled, skipped).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Bot Githubaction <bot-githubaction@gradle.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-12 15:21:52 +00:00
Daz DeBoerGitHubClaude Opus 4.8
 		8b6cdb5f58 CI: add requireable aggregate/no-op checks for branch protection (#984) 
Prepares CI so a small, stable set of **required status checks** can be
enabled (which in turn unlocks auto-merge), instead of having to list
every fanned-out matrix job. GitHub required checks match by exact name
— no wildcards — so this reduces the surface to a handful of high-level
checks.

## Changes

- **`ci-integ-test.yml`**: add an aggregate gate job
`integ-test-success` that `needs:` all four top-level jobs (the three
suite jobs each wrap a reusable workflow that fans out into many nested
checks) and fails if any did not succeed. `if: always()` ensures it
reports even when a dependency fails. This collapses dozens of nested
integ-test checks into a single requireable check.

- **`ci-init-script-check.yml`**: remove the workflow-level
`pull_request.paths` filter so the workflow runs on every PR and always
reports a status check (previously it was absent on most PRs, which
would deadlock a required check). Relevant-change detection moves into
the job via `tj-actions/changed-files` (same pinned action already used
by `ci-check-no-dist-update.yml`). On a PR the Java/Gradle/test steps
run only when init-script files changed; otherwise the job is a fast
no-op that still succeeds. Push and `workflow_dispatch` runs execute
fully as before.

## Suggested required-check set (all run on every PR, none can deadlock)

- `CI-check-and-unit-test / check-format-and-unit-test`
- `ci-validate-typings.yml / validate-typings`
- `CI-validate-wrappers / validation`
- `CI-codeql / Analyze (javascript-typescript)`
- `CI-integ-test / integ-test-success`
- `CI-init-script-check / test-init-scripts`

`ci-check-no-dist-update` is intentionally **omitted** — it only runs on
`dist/**` edits and is designed to fail, so it shouldn't be a required
gate.

> Confirm the exact check names from the list GitHub shows after this
branch runs once.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 11:04:23 -06:00
bot-githubaction 5852e0e5d8 [bot] Update dist directory 2026-06-10 16:15:39 +00:00
Simon MarquisGitHubDaz DeBoerClaude Opus 4.8
 		318eed7038 Hide obsolete Job summaries (#902) 
- Injects a `<!-- gradle-job-summary: ${jobCorrelator} -->` marker on
each job summary
- Lists 100 last comments: unfortunately there is no API to specifically
filter for comments, and checking the last 100 comments (the limit) is
usually enough and does not require iterating over pages
- Mutate comments having this expected marker

I tried to add some tests, but I'm not familiar enough to setup a
complete test suite with proper mocking of GitHub/Octokit with jest.

I could potentially extract the `prComment` creation to check for the
marker presence, let me know.

Note: it seems like there is currently an issue on mutating comments as
`OUTDATED` through graphql. Although it does not work as expected
(flagging as OUTDATED) the comments are still minimized, which is what
we want.
- https://github.com/orgs/community/discussions/19865

Implements #176

---------

Co-authored-by: Daz DeBoer <daz@gradle.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 10:14:48 -06:00
Björn KautlerandGitHub a740661292 Improve typings (#938) 
This PR adds a missing enum value, and makes strings that are actually
delimited lists those lists, so that you for example in the generated
Kotlin bindings can simply do
```kotlin
additionalArguments = listOf(
    "--info",
    "--stacktrace",
    "--show-version"
)
```
instead of needing to do
```kotlin
additionalArguments = listOf(
    "--info",
    "--stacktrace",
    "--show-version"
).joinToString(" ")
```
or writing it all in one line as one string.

This is also how the typings for older versions are in the typing
catalog.

Theoretically, this is a breaking changes as the typings define the API
surface of the action and from the typings bindings are generated. I'll
leave it up to you how you handle it regarding version increase or when
to merge.
 2026-06-10 08:54:56 -06:00
Bot GithubactionandGitHub 7ae0d0208c Update gradle-actions-caching library to v0.6.0 (#982) 
Updates to the latest gradle-actions-caching library.
 2026-06-10 08:51:32 -06:00
Daz DeBoerandClaude Opus 4.8 e473973a5b Scope CI-integ-test concurrency groups per-branch 
The concurrency groups used fixed names spanning all branches, so a push
to main could cancel a pending PR run (and vice versa), leaving PRs not
fully tested.

Append ${{ github.ref }} to each group so runs only supersede pending
runs on the same branch, while different branches run in parallel. Also
drop the `queue: max` key, which is not a valid GitHub Actions
concurrency option and was ignored.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 07:33:01 -07:00
Daz DeBoerandGitHub 35a4a3f355 Queue up integ-test runs 2026-06-10 08:24:34 -06:00
bot-githubaction b6eebf33f1 [bot] Update dist directory 2026-06-10 14:15:10 +00:00
Daz DeBoerGitHubClaude Opus 4.8
 		9901393644 Remove unnecessary dependency overrides (#981) 
Removes all `overrides` from `sources/package.json`. Two commits, each
independently verified:

## 1. Remove redundant security overrides

The `shell-quote`, `fast-xml-parser`, `fast-xml-builder` and `eslint >
brace-expansion` overrides added in #980 are **no-ops**: npm's natural
resolution already lands on the exact same patched versions, so they
upgrade nothing. The vulnerabilities were actually resolved by
regenerating the lockfile, not by the overrides.

## 2. Remove obsolete Octokit/Azure overrides

`@azure/logger`, `@octokit/request`, `@octokit/request-error` and
`@octokit/plugin-paginate-rest` were point-in-time pins added to
force-upgrade then-vulnerable transitive deps (5d947f45, #601). The
parent packages (`@actions/github`, `@actions/artifact`) have since
advanced and now resolve **newer, non-vulnerable** versions naturally —
so the overrides only pinned stale versions:

| Package | Pinned (override) | Natural |
|---|---|---|
| `@octokit/request` | 8.4.1 | 10.0.10 |
| `@octokit/request-error` | 5.1.1 | 7.1.0 |
| `@octokit/plugin-paginate-rest` | 9.2.2 | 14.0.0 |
| `@azure/logger` | 1.1.4 | 1.3.0 |

## Verification

- `npm audit` → **0 vulnerabilities**
- `./build` → passes
- `npm test` → **352/352 passing**

### Note on a flaky test
While testing I saw the `wrapper-validation` test *"fetches wrapper jar
checksums for snapshots"* intermittently fail (1–2 failures, then pass
on retry). It is a **pre-existing flaky network test** — it makes ~175
live calls to Gradle services and sits right at its 60s timeout. Its
code path imports neither Octokit nor Azure (`src/wrapper-validation/`
uses only `@actions/http-client`/`nock`/`cheerio`), so it is unrelated
to these overrides; the `nock`/`@mswjs/interceptors`/`undici` versions
are identical before and after.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 08:14:07 -06:00
Daz DeBoerandGitHub 20ce680c89 Update RELEASING.md 2026-06-09 19:55:28 -06:00
bot-githubaction 5e2ebd065d [bot] Update dist directory v6.1.1 2026-06-10 01:07:29 +00:00
Daz DeBoerGitHubClaude Opus 4.8
 		9e2c1cc01d Resolve npm security vulnerabilities via dependency overrides (#980) 
## What

Adds `overrides` to `sources/package.json` to force patched versions of
transitively-pulled packages flagged by Dependabot, plus one moderate
issue surfaced by `npm audit`:

| Package | Severity | Patched to | Pulled in via |
|---|---|---|---|
| `shell-quote` | Critical | 1.8.4 | `npm-run-all` |
| `fast-xml-builder` | High | 1.2.0 | `@actions/artifact` →
`@azure/storage-blob` → `@azure/core-xml` → `fast-xml-parser` |
| `fast-xml-parser` | Medium | 5.8.0 | `@actions/artifact` →
`@azure/storage-blob` → `@azure/core-xml` |
| `brace-expansion` | Moderate | 5.0.6 | `eslint` |

## Notes

- All four are **transitive** dependencies, so they're pinned via the
existing `overrides` block rather than direct version bumps.
- The patched versions satisfy the parents' declared ranges (e.g.
`@azure/core-xml` requires `fast-xml-parser ^5.0.7`; `fast-xml-parser`
5.8.0 requires `fast-xml-builder ^1.2.0`), so nothing is
force-downgraded or broken.
- `brace-expansion` is **scoped under `eslint`** rather than a blanket
override — most copies in the tree were already on the patched 5.0.6,
and only `eslint`'s was stuck at the vulnerable 5.0.5. A global override
would have forced unrelated 1.x/2.x copies up a major version.

## Verification

- `npm audit` → **0 vulnerabilities**
- `npm ci` → clean install, 0 vulnerabilities
- `npm test` → **352 passed, 14 suites**

The root `dist/` directory is intentionally left for the CI workflow to
update.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-09 19:06:38 -06:00
bot-githubaction 657f690528 [bot] Update dist directory 2026-06-10 00:10:45 +00:00
Daz DeBoerGitHubClaude Opus 4.8
 		9d6bacde37 Update @actions/cache and @actions/artifact, stop ignoring them in Dependabot (#978) 
## What

- Bumps `@actions/cache` 6.0.0 → 6.0.1
- Bumps `@actions/artifact` 6.1.0 → 6.2.1
- Removes the Dependabot `ignore` rules for both so they're maintained
automatically going forward

## Why

Both deps were excluded from Dependabot's automatic updates:
`*actions/cache*` was fully ignored, and `*actions/artifact*` had
major/minor bumps ignored. Neither restriction is necessary.

The `cache` ignore existed out of concern for keeping versions aligned
with the vendored `gradle-actions-caching` library. That alignment isn't
required:

- The vendored bundle (`sources/vendor/gradle-actions-caching/index.js`)
**inlines** its own (patched) `@actions/cache` and exposes a type-clean
API (`restore`/`save`) that never leaks `@actions/cache` types across
the boundary.
- This repo's own direct `@actions/cache` usage is a **separate,
unpatched copy** consumed via the stock string-returning API
(`cache-service-basic.ts`, `provision.ts`), with no
`patch-package`/`postinstall` in this repo.

So there's no cross-repo sync requirement — these can be updated like
any other dependency.

## Verification

- `npm install --package-lock-only` regenerated the lockfile (resolves
cache 6.0.1, artifact 6.2.1)
- `./build` passes clean

The root `dist/` directory is intentionally left for the CI workflow to
update.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-09 18:10:02 -06:00
bot-githubaction 79f6b196a7 [bot] Update dist directory 2026-06-09 18:59:33 +00:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		6781648d2b Bump the npm-dependencies group in /sources with 5 updates (#977) 
Bumps the npm-dependencies group in /sources with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [semver](https://github.com/npm/node-semver) | `7.8.1` | `7.8.3` |
|
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
| `25.9.1` | `25.9.2` |
|
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin)
| `8.59.4` | `8.61.0` |
| [eslint](https://github.com/eslint/eslint) | `10.4.0` | `10.4.1` |
| [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.8.4` |

Updates `semver` from 7.8.1 to 7.8.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/npm/node-semver/releases">semver's
releases</a>.</em></p>
<blockquote>
<h2>v7.8.3</h2>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.8.2...v7.8.3">7.8.3</a>
(2026-06-08)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/046da7f527cc72a482b5dea8cb59392be65bf186"><code>046da7f</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/872">#872</a>
align caret includePrerelease lower bounds (<a
href="https://redirect.github.com/npm/node-semver/issues/872">#872</a>)
(<a
href="https://github.com/wayyoungboy"><code>@​wayyoungboy</code></a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/3485ddadb2ca0d0691392ee5ce620072e1b1e040"><code>3485dda</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/866">#866</a>
bump <code>@​npmcli/eslint-config</code> from 6.0.1 to 7.0.0 (<a
href="https://redirect.github.com/npm/node-semver/issues/866">#866</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
</ul>
<h2>v7.8.2</h2>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.8.1...v7.8.2">7.8.2</a>
(2026-06-04)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/bea6028694a75e840f48b288ac019e9644cfe6e8"><code>bea6028</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/870">#870</a>
increment dotted prerelease identifiers (<a
href="https://redirect.github.com/npm/node-semver/issues/870">#870</a>)
(<a href="https://github.com/liuzemei"><code>@​liuzemei</code></a>, <a
href="https://github.com/SheldonNeo"><code>@​SheldonNeo</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/npm/node-semver/blob/main/CHANGELOG.md">semver's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.8.2...v7.8.3">7.8.3</a>
(2026-06-08)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/046da7f527cc72a482b5dea8cb59392be65bf186"><code>046da7f</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/872">#872</a>
align caret includePrerelease lower bounds (<a
href="https://redirect.github.com/npm/node-semver/issues/872">#872</a>)
(<a
href="https://github.com/wayyoungboy"><code>@​wayyoungboy</code></a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/3485ddadb2ca0d0691392ee5ce620072e1b1e040"><code>3485dda</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/866">#866</a>
bump <code>@​npmcli/eslint-config</code> from 6.0.1 to 7.0.0 (<a
href="https://redirect.github.com/npm/node-semver/issues/866">#866</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
</ul>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.8.1...v7.8.2">7.8.2</a>
(2026-06-04)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/bea6028694a75e840f48b288ac019e9644cfe6e8"><code>bea6028</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/870">#870</a>
increment dotted prerelease identifiers (<a
href="https://redirect.github.com/npm/node-semver/issues/870">#870</a>)
(<a href="https://github.com/liuzemei"><code>@​liuzemei</code></a>, <a
href="https://github.com/SheldonNeo"><code>@​SheldonNeo</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/6b77aa84a648a4b54ea32a21e6db60ebd54d5040"><code>6b77aa8</code></a>
chore: release 7.8.3 (<a
href="https://redirect.github.com/npm/node-semver/issues/873">#873</a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/3485ddadb2ca0d0691392ee5ce620072e1b1e040"><code>3485dda</code></a>
chore: bump <code>@​npmcli/eslint-config</code> from 6.0.1 to 7.0.0 (<a
href="https://redirect.github.com/npm/node-semver/issues/866">#866</a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/046da7f527cc72a482b5dea8cb59392be65bf186"><code>046da7f</code></a>
fix: align caret includePrerelease lower bounds (<a
href="https://redirect.github.com/npm/node-semver/issues/872">#872</a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/efafcf8d029faa3d1ab74b5ec98d620112af859d"><code>efafcf8</code></a>
chore: release 7.8.2 (<a
href="https://redirect.github.com/npm/node-semver/issues/871">#871</a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/bea6028694a75e840f48b288ac019e9644cfe6e8"><code>bea6028</code></a>
fix: increment dotted prerelease identifiers (<a
href="https://redirect.github.com/npm/node-semver/issues/870">#870</a>)</li>
<li>See full diff in <a
href="https://github.com/npm/node-semver/compare/v7.8.1...v7.8.3">compare
view</a></li>
</ul>
</details>
<br />

Updates `@types/node` from 25.9.1 to 25.9.2
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />

Updates `@typescript-eslint/eslint-plugin` from 8.59.4 to 8.61.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases">@​typescript-eslint/eslint-plugin's
releases</a>.</em></p>
<blockquote>
<h2>v8.61.0</h2>
<h2>8.61.0 (2026-06-08)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>ast-spec:</strong> change type of
<code>UnaryExpression.prefix</code> to always <code>true</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12372">#12372</a>)</li>
<li><strong>ast-spec:</strong> tighten types of
<code>ArrowFunction</code>, <code>YieldExpression</code>,
<code>TSTypePredicate</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12373">#12373</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>rule-schema-to-typescript-types:</strong> respect ECMAScript
line terminators (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12374">#12374</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger"><code>@​kirkwaiblinger</code></a></li>
<li>lumir</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.61.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
<h2>v8.60.1</h2>
<h2>8.60.1 (2026-06-01)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> respect ECMAScript line terminators
in ts-comment rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12352">#12352</a>)</li>
<li><strong>eslint-plugin:</strong> [no-shadow] correct rule to match
ESLint v10 handling (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12182">#12182</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>lumir</li>
<li>Nevette Bailey <a
href="https://github.com/nevette-bailey"><code>@​nevette-bailey</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.60.1">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
<h2>v8.60.0</h2>
<h2>8.60.0 (2026-05-25)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>rule-tester:</strong> added updates of RuleTester from
upstream (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12291">#12291</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li>playground TS version selector is not working (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12326">#12326</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12325">#12325</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md">@​typescript-eslint/eslint-plugin's
changelog</a>.</em></p>
<blockquote>
<h2>8.61.0 (2026-06-08)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>ast-spec:</strong> change type of
<code>UnaryExpression.prefix</code> to always <code>true</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12372">#12372</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger"><code>@​kirkwaiblinger</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.61.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
<h2>8.60.1 (2026-06-01)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-shadow] correct rule to match
ESLint v10 handling (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12182">#12182</a>)</li>
<li><strong>eslint-plugin:</strong> respect ECMAScript line terminators
in ts-comment rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12352">#12352</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>lumir</li>
<li>Nevette Bailey <a
href="https://github.com/nevette-bailey"><code>@​nevette-bailey</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.60.1">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
<h2>8.60.0 (2026-05-25)</h2>
<p>This was a version bump only for eslint-plugin to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.60.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/16a5b247affc32af21b695cf96dfd75d7ded50a3"><code>16a5b24</code></a>
chore(release): publish 8.61.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/ef1fd28c68b10da2e5b56823da8491f10f2c2b97"><code>ef1fd28</code></a>
feat(ast-spec): change type of <code>UnaryExpression.prefix</code> to
always <code>true</code> (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12">#12</a>...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/4f84a697aedc436559c3ae09b5b357d98b448d68"><code>4f84a69</code></a>
chore(release): publish 8.60.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/598af564db50593277ba46c7fdea3648e4425391"><code>598af56</code></a>
docs(eslint-plugin): clarify no-redeclare type-value collision not
covered by...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/1849b530c254fb4f89d7270160f3a998e4acd964"><code>1849b53</code></a>
chore: typecheck using tsgo (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12139">#12139</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/5341d59dd3c21fc4e2bf3bce55cf35d8f84e5216"><code>5341d59</code></a>
chore: fix lint issues (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12369">#12369</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/f525814f01766487ab34a54d56de20ea5c4fb576"><code>f525814</code></a>
fix(eslint-plugin): [no-shadow] correct rule to match ESLint v10
handling (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/1">#1</a>...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/2df540cd8bbeb3e2c56d516912f69bf63c1e9450"><code>2df540c</code></a>
chore(eslint-plugin): defer type checks to improve rules performance (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12296">#12296</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/1ab4284789b36cf482a4d9924719162a02d54243"><code>1ab4284</code></a>
fix(eslint-plugin): respect ECMAScript line terminators in ts-comment
rules (...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/2f49df599b2db5f2937caf975d3c63e5cdeb0ea1"><code>2f49df5</code></a>
docs: update references to <code>@stylistic/eslint-plugin</code> rules
in documentation ...</li>
<li>Additional commits viewable in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.61.0/packages/eslint-plugin">compare
view</a></li>
</ul>
</details>
<br />

Updates `eslint` from 10.4.0 to 10.4.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.4.1</h2>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/e557467db7496220eebcbe2ac5ea6d38c12bb1ec"><code>e557467</code></a>
fix: update <code>@eslint/plugin-kit</code> version to 0.7.2 (<a
href="https://redirect.github.com/eslint/eslint/issues/20930">#20930</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d4ce898796ca22c3b96aa70d3014cb85f4bac1cd"><code>d4ce898</code></a>
fix: propagate failures from delegated commands (<a
href="https://redirect.github.com/eslint/eslint/issues/20917">#20917</a>)
(Minh Vu)</li>
<li><a
href="https://github.com/eslint/eslint/commit/f4f3507460bc016b5be979c05d2969793f570cbf"><code>f4f3507</code></a>
fix: prefer-arrow-callback invalid autofix with newline after
<code>async</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20916">#20916</a>)
(kuldeep kumar)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c5bc78b37e08b9054a11f0cc2d81808bb24acb85"><code>c5bc78b</code></a>
fix: false positive for reference in <code>finally</code> block (<a
href="https://redirect.github.com/eslint/eslint/issues/20655">#20655</a>)
(Tanuj Kanti)</li>
<li><a
href="https://github.com/eslint/eslint/commit/27538c01f5df4e9306f6f4ba867b2dd6307fae59"><code>27538c0</code></a>
fix: add missing CodePath and CodePathSegment types (<a
href="https://redirect.github.com/eslint/eslint/issues/20853">#20853</a>)
(Pixel998)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/61b0add61ffc52665562be7bb96f526690a78b30"><code>61b0add</code></a>
docs: remove deprecated rule from related rules of
<code>max-params</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20921">#20921</a>)
(Tanuj Kanti)</li>
<li><a
href="https://github.com/eslint/eslint/commit/305d5b91aeac24d36fde42f75625a8f183d4ce43"><code>305d5b9</code></a>
docs: remove deprecated rules from related rules section (<a
href="https://redirect.github.com/eslint/eslint/issues/20911">#20911</a>)
(Tanuj Kanti)</li>
<li><a
href="https://github.com/eslint/eslint/commit/49b0202d01918b8061720d586dffd7c68047090c"><code>49b0202</code></a>
docs: fix <code>display: none</code> of ad (<a
href="https://redirect.github.com/eslint/eslint/issues/20901">#20901</a>)
(Tanuj Kanti)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9067f9492ec998afc5b4f057a477ecf6ebd45e44"><code>9067f94</code></a>
docs: switch build to Node.js 24 (<a
href="https://redirect.github.com/eslint/eslint/issues/20893">#20893</a>)
(Milos Djermanovic)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c91b0417e3420c76807ce1fa2aea76e2de87ab86"><code>c91b041</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/e349265cb37f3ebc837e178e48a725bb782bd870"><code>e349265</code></a>
docs: clarify semver strings in rule deprecation objects (<a
href="https://redirect.github.com/eslint/eslint/issues/20885">#20885</a>)
(Milos Djermanovic)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/b0e466b6ab47bfc7de43d8de0c315d8ee83aa584"><code>b0e466b</code></a>
test: add <code>data</code> property to invalid tests cases for rules
(<a
href="https://redirect.github.com/eslint/eslint/issues/20924">#20924</a>)
(Tanuj Kanti)</li>
<li><a
href="https://github.com/eslint/eslint/commit/f78838bc4c86d487e1bcc7cede260c4467721c46"><code>f78838b</code></a>
test: add CodePath type coverage (<a
href="https://redirect.github.com/eslint/eslint/issues/20904">#20904</a>)
(Pixel998)</li>
<li><a
href="https://github.com/eslint/eslint/commit/1daa4bd734b79a62e317d0394394a6b38cff49f9"><code>1daa4bd</code></a>
chore: update <code>eslint-plugin-eslint-comments</code> test data to
latest commit (<a
href="https://redirect.github.com/eslint/eslint/issues/20922">#20922</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/002942ce988ea28b78e0a2f3b074081e638b552c"><code>002942c</code></a>
ci: declare contents:read on update-readme workflow (<a
href="https://redirect.github.com/eslint/eslint/issues/20919">#20919</a>)
(Arpit Jain)</li>
<li><a
href="https://github.com/eslint/eslint/commit/64bca24e7bed35bc3c864fc625cb2d89eca87d5b"><code>64bca24</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/20912">#20912</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6d7c832950d5e92499d88e504080661f888f8f56"><code>6d7c832</code></a>
chore: ignore fflate updates in renovate (<a
href="https://redirect.github.com/eslint/eslint/issues/20908">#20908</a>)
(Pixel998)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b2c86382164d87c6203b78d52068cd6a2a6ffe30"><code>b2c8638</code></a>
ci: bump pnpm/action-setup from 6.0.7 to 6.0.8 (<a
href="https://redirect.github.com/eslint/eslint/issues/20889">#20889</a>)
(dependabot[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/a9b8d7f74c50211701cfc49710fa541fd91b2aa5"><code>a9b8d7f</code></a>
chore: increase maxBuffer for ecosystem tests (<a
href="https://redirect.github.com/eslint/eslint/issues/20881">#20881</a>)
(sethamus)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b702ead5e1ed7cb9f28238a454797662efb37396"><code>b702ead</code></a>
chore: update ecosystem update PR settings (<a
href="https://redirect.github.com/eslint/eslint/issues/20884">#20884</a>)
(Pixel998)</li>
<li><a
href="https://github.com/eslint/eslint/commit/507f60e9a78c9a902bc8759f066ae17a1ea6cd81"><code>507f60e</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/20882">#20882</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/92f5c5bb6bf3a5d167c8ee53a430833410295c6d"><code>92f5c5b</code></a>
test: add unit test for message-count (<a
href="https://redirect.github.com/eslint/eslint/issues/20878">#20878</a>)
(kuldeep kumar)</li>
<li><a
href="https://github.com/eslint/eslint/commit/df321080af5758b1fa25e4b9a40e26135642dd6e"><code>df32108</code></a>
chore: add <code>@​eslint/markdown</code> and typescript-eslint
ecosystem tests (<a
href="https://redirect.github.com/eslint/eslint/issues/20837">#20837</a>)
(sethamus)</li>
<li><a
href="https://github.com/eslint/eslint/commit/327f91d36aa49f2a50ded931d841a16374fd875f"><code>327f91d</code></a>
chore: use includeIgnoreFile internally (<a
href="https://redirect.github.com/eslint/eslint/issues/20876">#20876</a>)
(Kirk Waiblinger)</li>
<li><a
href="https://github.com/eslint/eslint/commit/f0dc4bd893fb3a9f44e4ddc3ad7063ffb0beacd3"><code>f0dc4bd</code></a>
chore: pin fflate@0.8.2 (<a
href="https://redirect.github.com/eslint/eslint/issues/20877">#20877</a>)
(Milos Djermanovic)</li>
<li><a
href="https://github.com/eslint/eslint/commit/0f4bd257a67a082b756de746d9e0c4842ab764ca"><code>0f4bd25</code></a>
ci: run Discord alert for ecosystem test failures (<a
href="https://redirect.github.com/eslint/eslint/issues/20873">#20873</a>)
(Copilot)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4a3d15a99c452c4db2fd56b577fa7597e98ab0c2"><code>4a3d15a</code></a>
10.4.1</li>
<li><a
href="https://github.com/eslint/eslint/commit/43e7e2bdc5c6cacc535446b7d23c10f780384ba8"><code>43e7e2b</code></a>
Build: changelog update for 10.4.1</li>
<li><a
href="https://github.com/eslint/eslint/commit/e557467db7496220eebcbe2ac5ea6d38c12bb1ec"><code>e557467</code></a>
fix: update <code>@eslint/plugin-kit</code> version to 0.7.2 (<a
href="https://redirect.github.com/eslint/eslint/issues/20930">#20930</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b0e466b6ab47bfc7de43d8de0c315d8ee83aa584"><code>b0e466b</code></a>
test: add <code>data</code> property to invalid tests cases for rules
(<a
href="https://redirect.github.com/eslint/eslint/issues/20924">#20924</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d4ce898796ca22c3b96aa70d3014cb85f4bac1cd"><code>d4ce898</code></a>
fix: propagate failures from delegated commands (<a
href="https://redirect.github.com/eslint/eslint/issues/20917">#20917</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/f4f3507460bc016b5be979c05d2969793f570cbf"><code>f4f3507</code></a>
fix: prefer-arrow-callback invalid autofix with newline after
<code>async</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20916">#20916</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/f78838bc4c86d487e1bcc7cede260c4467721c46"><code>f78838b</code></a>
test: add CodePath type coverage (<a
href="https://redirect.github.com/eslint/eslint/issues/20904">#20904</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/61b0add61ffc52665562be7bb96f526690a78b30"><code>61b0add</code></a>
docs: remove deprecated rule from related rules of
<code>max-params</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20921">#20921</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/1daa4bd734b79a62e317d0394394a6b38cff49f9"><code>1daa4bd</code></a>
chore: update <code>eslint-plugin-eslint-comments</code> test data to
latest commit (<a
href="https://redirect.github.com/eslint/eslint/issues/20">#20</a>...</li>
<li><a
href="https://github.com/eslint/eslint/commit/002942ce988ea28b78e0a2f3b074081e638b552c"><code>002942c</code></a>
ci: declare contents:read on update-readme workflow (<a
href="https://redirect.github.com/eslint/eslint/issues/20919">#20919</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.4.0...v10.4.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `prettier` from 3.8.3 to 3.8.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/releases">prettier's
releases</a>.</em></p>
<blockquote>
<h2>3.8.4</h2>
<ul>
<li>Markdown: Fix blank lines between list items and nested sub-lists
being removed in Markdown/MDX (<a
href="https://redirect.github.com/prettier/prettier/pull/17746">prettier/prettier#17746</a>
by <a
href="https://github.com/byplayer"><code>@​byplayer</code></a>)</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.8.4/CHANGELOG.md#384">Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md">prettier's
changelog</a>.</em></p>
<blockquote>
<h1>3.8.4</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.8.3...3.8.4">diff</a></p>
<h4>Markdown: Fix blank lines between list items and nested sub-lists
being removed in Markdown/MDX (<a
href="https://redirect.github.com/prettier/prettier/pull/17746">#17746</a>
by <a
href="https://github.com/byplayer"><code>@​byplayer</code></a>)</h4>
<p>Prettier was removing blank lines between list items and their nested
sub-lists, converting loose lists into tight lists and changing their
semantic meaning.</p>
<!-- raw HTML omitted -->
<pre lang="markdown"><code>&lt;!-- Input --&gt;
- a
<ul>
<li>
<p>b</p>
</li>
<li>
<p>c</p>
<ul>
<li>d</li>
</ul>
</li>
</ul>
<p>&lt;!-- Prettier 3.8.3 --&gt;</p>
<ul>
<li>a
<ul>
<li>b</li>
</ul>
</li>
<li>c
<ul>
<li>d</li>
</ul>
</li>
</ul>
<p>&lt;!-- Prettier 3.8.4 --&gt;</p>
<ul>
<li>
<p>a</p>
<ul>
<li>b</li>
</ul>
</li>
<li>
<p>c</p>
<ul>
<li>d<br />
</code></pre></li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prettier/prettier/commit/1c6ba5539141552e0e8e22d401ea620d8fdff468"><code>1c6ba55</code></a>
Release 3.8.4</li>
<li><a
href="https://github.com/prettier/prettier/commit/4a673dc9b59ddf7296bbab9822093d2971da84a8"><code>4a673dc</code></a>
Fix blank lines between list items and nested sub-lists being removed in
Mark...</li>
<li><a
href="https://github.com/prettier/prettier/commit/074aaedbb052a288e89d15eb0a4214de37a08866"><code>074aaed</code></a>
Replace <code>main</code> branch in changelog link with tags (<a
href="https://redirect.github.com/prettier/prettier/issues/19054">#19054</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/c22a003ae97917c5043e8685b4fdff0f93e978f9"><code>c22a003</code></a>
Bump Prettier dependency to 3.8.3</li>
<li><a
href="https://github.com/prettier/prettier/commit/07bad1f04536e9799927007baf466e67151576f0"><code>07bad1f</code></a>
Clean changelog_unreleased</li>
<li>See full diff in <a
href="https://github.com/prettier/prettier/compare/3.8.3...3.8.4">compare
view</a></li>
</ul>
</details>
<br />

<details>
<summary>Most Recent Ignore Conditions Applied to This Pull
Request</summary>

| Dependency Name | Ignore Conditions |
| --- | --- |
| @types/node | [>= 22.a, < 23] |
</details>


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-09 12:58:37 -06:00
bot-githubaction a3b40d2308 [bot] Update dist directory 2026-06-09 18:25:58 +00:00
Bot GithubactionandGitHub f37016fb25 Bump references to Develocity Gradle plugin from 4.4.0 to 4.4.2 (#973) 
This PR bumps references to Develocity Gradle plugin from 4.4.0 to
4.4.2.
 2026-06-09 12:25:09 -06:00
bot-githubaction 2afdab2a02 [bot] Update dist directory 2026-06-09 09:50:27 +00:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Jérôme Prinet
 		1046ffaf33 Bump the npm-dependencies group across 1 directory with 14 updates (#970) 
Bumps the npm-dependencies group with 14 updates in the /sources
directory:

| Package | From | To |
| --- | --- | --- |
|
[@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core)
| `3.0.0` | `3.0.1` |
|
[@actions/github](https://github.com/actions/toolkit/tree/HEAD/packages/github)
| `9.0.0` | `9.1.1` |
|
[@actions/glob](https://github.com/actions/toolkit/tree/HEAD/packages/glob)
| `0.6.1` | `0.7.0` |
|
[@actions/http-client](https://github.com/actions/toolkit/tree/HEAD/packages/http-client)
| `4.0.0` | `4.0.1` |
| [semver](https://github.com/npm/node-semver) | `7.7.4` | `7.8.1` |
| [which](https://github.com/npm/node-which) | `6.0.1` | `7.0.0` |
|
[@jest/globals](https://github.com/jestjs/jest/tree/HEAD/packages/jest-globals)
| `30.3.0` | `30.4.1` |
|
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
| `25.5.0` | `25.9.1` |
|
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin)
| `8.58.0` | `8.59.4` |
| [eslint](https://github.com/eslint/eslint) | `10.1.0` | `10.4.0` |
| [globals](https://github.com/sindresorhus/globals) | `17.4.0` |
`17.6.0` |
| [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) |
`30.3.0` | `30.4.2` |
| [prettier](https://github.com/prettier/prettier) | `3.8.1` | `3.8.3` |
| [ts-jest](https://github.com/kulshekhar/ts-jest) | `29.4.9` |
`29.4.11` |


Updates `@actions/core` from 3.0.0 to 3.0.1
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md">@​actions/core's
changelog</a>.</em></p>
<blockquote>
<h2>3.0.1</h2>
<ul>
<li>Bump <code>undici</code> from <code>6.23.0</code> to
<code>6.24.1</code> <a
href="https://redirect.github.com/actions/toolkit/pull/2348">#2348</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/actions/toolkit/commits/HEAD/packages/core">compare
view</a></li>
</ul>
</details>
<br />

Updates `@actions/github` from 9.0.0 to 9.1.1
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md">@​actions/github's
changelog</a>.</em></p>
<blockquote>
<h3>9.1.1</h3>
<ul>
<li>Bump <code>undici</code> from <code>6.23.0</code> to
<code>6.24.0</code> <a
href="https://redirect.github.com/actions/toolkit/pull/2346">#2346</a></li>
</ul>
<h3>9.1.0</h3>
<ul>
<li>Append <code>actions_orchestration_id</code> to user-agent when the
<code>ACTIONS_ORCHESTRATION_ID</code> environment variable is set <a
href="https://redirect.github.com/actions/toolkit/pull/2364">#2364</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/actions/toolkit/commits/HEAD/packages/github">compare
view</a></li>
</ul>
</details>
<br />

Updates `@actions/glob` from 0.6.1 to 0.7.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/toolkit/blob/main/packages/glob/RELEASES.md">@​actions/glob's
changelog</a>.</em></p>
<blockquote>
<h2>0.7.0</h2>
<ul>
<li>Bump <code>minimatch</code> from <code>^3.0.4</code> to
<code>^10.2.5</code> <a
href="https://redirect.github.com/actions/toolkit/pull/2355">#2355</a></li>
<li>Bump <code>undici</code> from <code>6.23.0</code> to
<code>6.24.0</code> <a
href="https://redirect.github.com/actions/toolkit/pull/2345">#2345</a></li>
<li>Bump <code>brace-expansion</code> in <code>/packages/glob</code> <a
href="https://redirect.github.com/actions/toolkit/pull/2369">#2369</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/actions/toolkit/commits/HEAD/packages/glob">compare
view</a></li>
</ul>
</details>
<br />

Updates `@actions/http-client` from 4.0.0 to 4.0.1
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/toolkit/blob/main/packages/http-client/RELEASES.md">@​actions/http-client's
changelog</a>.</em></p>
<blockquote>
<h2>4.0.1</h2>
<ul>
<li>Bump <code>undici</code> from <code>6.23.0</code> to
<code>6.24.0</code> <a
href="https://redirect.github.com/actions/toolkit/pull/2347">#2347</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/actions/toolkit/commits/HEAD/packages/http-client">compare
view</a></li>
</ul>
</details>
<br />

Updates `semver` from 7.7.4 to 7.8.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/npm/node-semver/releases">semver's
releases</a>.</em></p>
<blockquote>
<h2>v7.8.1</h2>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.8.0...v7.8.1">7.8.1</a>
(2026-05-21)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/17aa702d91166472b197a2ea768f085083bee2e4"><code>17aa702</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/869">#869</a>
strip build metadata before comparator trimming (<a
href="https://redirect.github.com/npm/node-semver/issues/869">#869</a>)
(<a
href="https://github.com/owlstronaut"><code>@​owlstronaut</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/5f3ca133e040210b6ea80c350a1d61d9da02e722"><code>5f3ca13</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/867">#867</a>
handle prerelease bounds in subset (<a
href="https://redirect.github.com/npm/node-semver/issues/867">#867</a>)
(<a
href="https://github.com/puneetdixit200"><code>@​puneetdixit200</code></a>,
Puneet Dixit)</li>
</ul>
<h2>v7.8.0</h2>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.7.4...v7.8.0">7.8.0</a>
(2026-05-08)</h2>
<h3>Features</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/0d0a0a2582fb1486bc6cd255ba18819c441ed149"><code>0d0a0a2</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/855">#855</a>
Add <code>truncate</code> function (<a
href="https://redirect.github.com/npm/node-semver/issues/855">#855</a>)
(<a href="https://github.com/pjohnmeyer"><code>@​pjohnmeyer</code></a>,
<a
href="https://github.com/owlstronaut"><code>@​owlstronaut</code></a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/3905343045dc293c3694d5e46170b1bb1fb5cf58"><code>3905343</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/859">#859</a>
Warn when defaulting to --inc=patch in CLI (<a
href="https://github.com/pjohnmeyer"><code>@​pjohnmeyer</code></a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/c368af612e521767e960419e6388c5129c857984"><code>c368af6</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/853">#853</a>
fix typos in documentation (<a
href="https://redirect.github.com/npm/node-semver/issues/853">#853</a>)
(<a
href="https://github.com/ankitkumar572005"><code>@​ankitkumar572005</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/37776c31e2f3448fd852c975888e37b03efe9afe"><code>37776c3</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/846">#846</a>
fix BNF grammar to distinguish prerelease from build identifiers (<a
href="https://redirect.github.com/npm/node-semver/issues/846">#846</a>)
(<a href="https://github.com/abhu85"><code>@​abhu85</code></a>, <a
href="https://github.com/claude"><code>@​claude</code></a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/9542e09ebcd89e916777d35eba868061dad9ed7d"><code>9542e09</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/860">#860</a>
template-oss-apply (<a
href="https://github.com/owlstronaut"><code>@​owlstronaut</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/937bc2cd8721db14745c9be123078c44e77a86ef"><code>937bc2c</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/860">#860</a>
<code>template-oss-apply@5.0.0</code> (<a
href="https://github.com/owlstronaut"><code>@​owlstronaut</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/6946fefa57bd5e191871a4738b28ca673e003527"><code>6946fef</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/852">#852</a>
bump <code>@​npmcli/template-oss</code> from 4.29.0 to 4.30.0 (<a
href="https://redirect.github.com/npm/node-semver/issues/852">#852</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot],
<a
href="https://github.com/npm-cli-bot"><code>@​npm-cli-bot</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/npm/node-semver/blob/main/CHANGELOG.md">semver's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.8.0...v7.8.1">7.8.1</a>
(2026-05-21)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/17aa702d91166472b197a2ea768f085083bee2e4"><code>17aa702</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/869">#869</a>
strip build metadata before comparator trimming (<a
href="https://redirect.github.com/npm/node-semver/issues/869">#869</a>)
(<a
href="https://github.com/owlstronaut"><code>@​owlstronaut</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/5f3ca133e040210b6ea80c350a1d61d9da02e722"><code>5f3ca13</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/867">#867</a>
handle prerelease bounds in subset (<a
href="https://redirect.github.com/npm/node-semver/issues/867">#867</a>)
(<a
href="https://github.com/puneetdixit200"><code>@​puneetdixit200</code></a>,
Puneet Dixit)</li>
</ul>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.7.4...v7.8.0">7.8.0</a>
(2026-05-08)</h2>
<h3>Features</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/0d0a0a2582fb1486bc6cd255ba18819c441ed149"><code>0d0a0a2</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/855">#855</a>
Add <code>truncate</code> function (<a
href="https://redirect.github.com/npm/node-semver/issues/855">#855</a>)
(<a href="https://github.com/pjohnmeyer"><code>@​pjohnmeyer</code></a>,
<a
href="https://github.com/owlstronaut"><code>@​owlstronaut</code></a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/3905343045dc293c3694d5e46170b1bb1fb5cf58"><code>3905343</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/859">#859</a>
Warn when defaulting to --inc=patch in CLI (<a
href="https://github.com/pjohnmeyer"><code>@​pjohnmeyer</code></a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/c368af612e521767e960419e6388c5129c857984"><code>c368af6</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/853">#853</a>
fix typos in documentation (<a
href="https://redirect.github.com/npm/node-semver/issues/853">#853</a>)
(<a
href="https://github.com/ankitkumar572005"><code>@​ankitkumar572005</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/37776c31e2f3448fd852c975888e37b03efe9afe"><code>37776c3</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/846">#846</a>
fix BNF grammar to distinguish prerelease from build identifiers (<a
href="https://redirect.github.com/npm/node-semver/issues/846">#846</a>)
(<a href="https://github.com/abhu85"><code>@​abhu85</code></a>, <a
href="https://github.com/claude"><code>@​claude</code></a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/9542e09ebcd89e916777d35eba868061dad9ed7d"><code>9542e09</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/860">#860</a>
template-oss-apply (<a
href="https://github.com/owlstronaut"><code>@​owlstronaut</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/937bc2cd8721db14745c9be123078c44e77a86ef"><code>937bc2c</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/860">#860</a>
<code>template-oss-apply@5.0.0</code> (<a
href="https://github.com/owlstronaut"><code>@​owlstronaut</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/6946fefa57bd5e191871a4738b28ca673e003527"><code>6946fef</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/852">#852</a>
bump <code>@​npmcli/template-oss</code> from 4.29.0 to 4.30.0 (<a
href="https://redirect.github.com/npm/node-semver/issues/852">#852</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot],
<a
href="https://github.com/npm-cli-bot"><code>@​npm-cli-bot</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/76416081a8413383cf6e24c82cafa438bd076d41"><code>7641608</code></a>
chore: release 7.8.1 (<a
href="https://redirect.github.com/npm/node-semver/issues/868">#868</a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/17aa702d91166472b197a2ea768f085083bee2e4"><code>17aa702</code></a>
fix: strip build metadata before comparator trimming (<a
href="https://redirect.github.com/npm/node-semver/issues/869">#869</a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/5f3ca133e040210b6ea80c350a1d61d9da02e722"><code>5f3ca13</code></a>
fix: handle prerelease bounds in subset (<a
href="https://redirect.github.com/npm/node-semver/issues/867">#867</a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/efa4be6096c1f9b77d9d27d6132f6220c43b4e31"><code>efa4be6</code></a>
chore: release 7.8.0 (<a
href="https://redirect.github.com/npm/node-semver/issues/847">#847</a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/9542e09ebcd89e916777d35eba868061dad9ed7d"><code>9542e09</code></a>
chore: template-oss-apply</li>
<li><a
href="https://github.com/npm/node-semver/commit/937bc2cd8721db14745c9be123078c44e77a86ef"><code>937bc2c</code></a>
chore: template-oss-apply@5.0.0</li>
<li><a
href="https://github.com/npm/node-semver/commit/3905343045dc293c3694d5e46170b1bb1fb5cf58"><code>3905343</code></a>
fix: Warn when defaulting to --inc=patch in CLI</li>
<li><a
href="https://github.com/npm/node-semver/commit/0d0a0a2582fb1486bc6cd255ba18819c441ed149"><code>0d0a0a2</code></a>
feat: Add <code>truncate</code> function (<a
href="https://redirect.github.com/npm/node-semver/issues/855">#855</a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/c368af612e521767e960419e6388c5129c857984"><code>c368af6</code></a>
docs: fix typos in documentation (<a
href="https://redirect.github.com/npm/node-semver/issues/853">#853</a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/6946fefa57bd5e191871a4738b28ca673e003527"><code>6946fef</code></a>
chore: bump <code>@​npmcli/template-oss</code> from 4.29.0 to 4.30.0 (<a
href="https://redirect.github.com/npm/node-semver/issues/852">#852</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/npm/node-semver/compare/v7.7.4...v7.8.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `which` from 6.0.1 to 7.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/npm/node-which/releases">which's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2><a
href="https://github.com/npm/node-which/compare/v6.0.1...v7.0.0">7.0.0</a>
(2026-05-08)</h2>
<h3>⚠️ BREAKING CHANGES</h3>
<ul>
<li><code>which</code> now supports node <code>^22.22.2 || ^24.15.0 ||
&gt;=26.0.0</code></li>
<li>template-oss-apply</li>
</ul>
<h3>Features</h3>
<ul>
<li><a
href="https://github.com/npm/node-which/commit/471d90ba5f4c8af8e9d8c8604d57b1128255bfb8"><code>471d90b</code></a>
<a href="https://redirect.github.com/npm/node-which/pull/176">#176</a>
bump to new node engine range (<a
href="https://github.com/owlstronaut"><code>@​owlstronaut</code></a>)</li>
<li><a
href="https://github.com/npm/node-which/commit/8aac36f904ed4ba17e269763e0267167ac6a729d"><code>8aac36f</code></a>
<a href="https://redirect.github.com/npm/node-which/pull/176">#176</a>
template-oss-apply (<a
href="https://github.com/owlstronaut"><code>@​owlstronaut</code></a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><a
href="https://github.com/npm/node-which/commit/9bdf0037cb47aaa7f89eb7ae0372d7f90b8557d3"><code>9bdf003</code></a>
<a href="https://redirect.github.com/npm/node-which/pull/176">#176</a>
template-oss-apply (<a
href="https://github.com/owlstronaut"><code>@​owlstronaut</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/npm/node-which/blob/main/CHANGELOG.md">which's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/npm/node-which/compare/v6.0.1...v7.0.0">7.0.0</a>
(2026-05-08)</h2>
<h3>⚠️ BREAKING CHANGES</h3>
<ul>
<li><code>which</code> now supports node <code>^22.22.2 || ^24.15.0 ||
&gt;=26.0.0</code></li>
<li>template-oss-apply</li>
</ul>
<h3>Features</h3>
<ul>
<li><a
href="https://github.com/npm/node-which/commit/471d90ba5f4c8af8e9d8c8604d57b1128255bfb8"><code>471d90b</code></a>
<a href="https://redirect.github.com/npm/node-which/pull/176">#176</a>
bump to new node engine range (<a
href="https://github.com/owlstronaut"><code>@​owlstronaut</code></a>)</li>
<li><a
href="https://github.com/npm/node-which/commit/8aac36f904ed4ba17e269763e0267167ac6a729d"><code>8aac36f</code></a>
<a href="https://redirect.github.com/npm/node-which/pull/176">#176</a>
template-oss-apply (<a
href="https://github.com/owlstronaut"><code>@​owlstronaut</code></a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><a
href="https://github.com/npm/node-which/commit/9bdf0037cb47aaa7f89eb7ae0372d7f90b8557d3"><code>9bdf003</code></a>
<a href="https://redirect.github.com/npm/node-which/pull/176">#176</a>
template-oss-apply (<a
href="https://github.com/owlstronaut"><code>@​owlstronaut</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/npm/node-which/commit/297db11d58eebe01551ae0875a127a89ee63d2cb"><code>297db11</code></a>
chore: release 7.0.0 (<a
href="https://redirect.github.com/npm/node-which/issues/177">#177</a>)</li>
<li><a
href="https://github.com/npm/node-which/commit/9bdf0037cb47aaa7f89eb7ae0372d7f90b8557d3"><code>9bdf003</code></a>
chore: template-oss-apply</li>
<li><a
href="https://github.com/npm/node-which/commit/471d90ba5f4c8af8e9d8c8604d57b1128255bfb8"><code>471d90b</code></a>
feat!: bump to new node engine range</li>
<li><a
href="https://github.com/npm/node-which/commit/8aac36f904ed4ba17e269763e0267167ac6a729d"><code>8aac36f</code></a>
feat!: template-oss-apply</li>
<li><a
href="https://github.com/npm/node-which/commit/482490851357b9c22da31dc4b06736dcac180344"><code>4824908</code></a>
deps &amp; engine update</li>
<li>See full diff in <a
href="https://github.com/npm/node-which/compare/v6.0.1...v7.0.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@jest/globals` from 30.3.0 to 30.4.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jestjs/jest/releases">@​jest/globals's
releases</a>.</em></p>
<blockquote>
<h2>v30.4.1</h2>
<h2>Features</h2>
<ul>
<li><code>[jest-config, jest-core, jest-runner, jest-schemas,
jest-types]</code> Allow custom runner configuration options via tuple
format <code>['runner-path', {options}]</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16141">#16141</a>)</li>
</ul>
<h2>Fixes</h2>
<ul>
<li><code>[jest-runtime]</code> Align CJS-from-ESM default export with
Node: <code>module.exports</code> is always the ESM default,
<code>__esModule</code> unwrapping is no longer applied (<a
href="https://redirect.github.com/jestjs/jest/pull/16143">#16143</a>)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jestjs/jest/compare/v30.4.0...v30.4.1">https://github.com/jestjs/jest/compare/v30.4.0...v30.4.1</a></p>
<h2>v30.4.0</h2>
<p>Big release! 😀</p>
<p>Main feature is a rewrite of our custom runtime in preparation for
stabilisation of native support of ESM. As part of that work
<code>require(esm)</code> module is now supported on Node 24.9+ (still
requires <code>--experimental-vm-modules</code> like before).</p>
<p>In addition we now support fake timers for the recently released
<code>Temporal</code> API in Node v26.</p>
<p>React 19 is also supported properly in <code>pretty-format</code>,
meaning snapshots of React components now work like they should.</p>
<p>Due to all the changes, there might be regressions that snuck in.
Please report them!</p>
<p>Full list of changes below</p>
<h2>Features</h2>
<ul>
<li><code>[babel-jest]</code> Support collecting coverage from
<code>.mts</code>, <code>.cts</code> (and other) files (<a
href="https://redirect.github.com/jestjs/jest/pull/15994">#15994</a>)</li>
<li><code>[jest-circus, jest-cli, jest-config, jest-core, jest-jasmine2,
jest-types]</code> Add <code>--collect-tests</code> flag to discover and
list tests without executing them (<a
href="https://redirect.github.com/jestjs/jest/pull/16006">#16006</a>)</li>
<li><code>[jest-config, jest-runner, jest-worker]</code> Add
<code>workerGracefulExitTimeout</code> config option to control how long
workers are given to exit before being force-killed (<a
href="https://redirect.github.com/jestjs/jest/pull/15984">#15984</a>)</li>
<li><code>[jest-config]</code> Add support for
<code>jest.config.mts</code> as a valid configuration file (<a
href="https://redirect.github.com/jestjs/jest/pull/16005">#16005</a>)</li>
<li><code>[jest-config, jest-core, jest-reporters, jest-runner]</code>
<code>verbose</code> and <code>silent</code> can now be set per-project;
the project-level value overrides the global value for that project's
tests (<a
href="https://redirect.github.com/jestjs/jest/pull/16133">#16133</a>)</li>
<li><code>[@jest/fake-timers]</code> Accept
<code>Temporal.Duration</code> in
<code>jest.advanceTimersByTime()</code> and
<code>jest.advanceTimersByTimeAsync()</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16128">#16128</a>)</li>
<li><code>[@jest/fake-timers]</code> Accept
<code>Temporal.Instant</code> and <code>Temporal.ZonedDateTime</code> in
<code>jest.setSystemTime()</code> and <code>useFakeTimers({now})</code>
(<a
href="https://redirect.github.com/jestjs/jest/pull/16128">#16128</a>)</li>
<li><code>[@jest/fake-timers]</code> Support faking
<code>Temporal.Now.*</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16131">#16131</a>)</li>
<li><code>[jest-mock]</code> Add <code>clearMocksOnScope(scope)</code>
on <code>ModuleMocker</code> for clearing every mock function exposed on
a scope object (<a
href="https://redirect.github.com/jestjs/jest/pull/16088">#16088</a>)</li>
<li><code>[jest-resolve]</code> Add <code>canResolveSync()</code> on
<code>Resolver</code> so callers can detect when a user-configured
resolver only exports an <code>async</code> hook (<a
href="https://redirect.github.com/jestjs/jest/pull/16064">#16064</a>)</li>
<li><code>[jest-runtime]</code> Use synchronous <code>evaluate()</code>
for ES modules without top-level <code>await</code> on Node versions
that support it (v24.9+), and prefer the synchronous transform path when
a sync transformer is configured (<a
href="https://redirect.github.com/jestjs/jest/pull/16062">#16062</a>)</li>
<li><code>[jest-runtime]</code> Support <code>require()</code> of ES
modules on Node v24.9+ (<a
href="https://redirect.github.com/jestjs/jest/pull/16074">#16074</a>)</li>
<li><code>[jest-runtime]</code> Validate TC39 import attributes
(<code>with { type: 'json' }</code>) on ESM imports (<a
href="https://redirect.github.com/jestjs/jest/pull/16127">#16127</a>)</li>
<li><code>[@jest/transform]</code> Add
<code>canTransformSync(filename)</code> on
<code>ScriptTransformer</code> so callers can pick the sync vs async
transform path (<a
href="https://redirect.github.com/jestjs/jest/pull/16062">#16062</a>)</li>
<li><code>[jest-util]</code> Add <code>isError</code> helper (<a
href="https://redirect.github.com/jestjs/jest/pull/16076">#16076</a>)</li>
<li><code>[pretty-format]</code> Support React 19 (<a
href="https://redirect.github.com/jestjs/jest/pull/16123">#16123</a>)</li>
</ul>
<h2>Fixes</h2>
<ul>
<li><code>[expect-utils]</code> Fix <code>toStrictEqual</code> failing
on <code>structuredClone</code> results due to cross-realm constructor
mismatch (<a
href="https://redirect.github.com/jestjs/jest/pull/15959">#15959</a>)</li>
<li><code>[@jest/expect-utils]</code> Prevent
<code>toMatchObject</code>/subset matching from throwing when
encountering exotic iterables (<a
href="https://redirect.github.com/jestjs/jest/pull/15952">#15952</a>)</li>
<li><code>[fake-timers]</code> Convert <code>Date</code> to milliseconds
before passing to <code>@sinonjs/fake-timers</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16029">#16029</a>)</li>
<li><code>[jest]</code> Export <code>GlobalConfig</code> and
<code>ProjectConfig</code> TypeScript types (<a
href="https://redirect.github.com/jestjs/jest/pull/16132">#16132</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jestjs/jest/blob/main/CHANGELOG.md">@​jest/globals's
changelog</a>.</em></p>
<blockquote>
<h2>30.4.1</h2>
<h3>Features</h3>
<ul>
<li><code>[jest-config, jest-core, jest-runner, jest-schemas,
jest-types]</code> Allow custom runner configuration options via tuple
format <code>['runner-path', {options}]</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16141">#16141</a>)</li>
</ul>
<h3>Fixes</h3>
<ul>
<li><code>[jest-runtime]</code> Align CJS-from-ESM default export with
Node: <code>module.exports</code> is always the ESM default,
<code>__esModule</code> unwrapping is no longer applied (<a
href="https://redirect.github.com/jestjs/jest/pull/16143">#16143</a>)</li>
</ul>
<h2>30.4.0</h2>
<h3>Features</h3>
<ul>
<li><code>[babel-jest]</code> Support collecting coverage from
<code>.mts</code>, <code>.cts</code> (and other) files (<a
href="https://redirect.github.com/jestjs/jest/pull/15994">#15994</a>)</li>
<li><code>[jest-circus, jest-cli, jest-config, jest-core, jest-jasmine2,
jest-types]</code> Add <code>--collect-tests</code> flag to discover and
list tests without executing them (<a
href="https://redirect.github.com/jestjs/jest/pull/16006">#16006</a>)</li>
<li><code>[jest-config, jest-runner, jest-worker]</code> Add
<code>workerGracefulExitTimeout</code> config option to control how long
workers are given to exit before being force-killed (<a
href="https://redirect.github.com/jestjs/jest/pull/15984">#15984</a>)</li>
<li><code>[jest-config]</code> Add support for
<code>jest.config.mts</code> as a valid configuration file (<a
href="https://redirect.github.com/jestjs/jest/pull/16005">#16005</a>)</li>
<li><code>[jest-config, jest-core, jest-reporters, jest-runner]</code>
<code>verbose</code> and <code>silent</code> can now be set per-project;
the project-level value overrides the global value for that project's
tests (<a
href="https://redirect.github.com/jestjs/jest/pull/16133">#16133</a>)</li>
<li><code>[@jest/fake-timers]</code> Accept
<code>Temporal.Duration</code> in
<code>jest.advanceTimersByTime()</code> and
<code>jest.advanceTimersByTimeAsync()</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16128">#16128</a>)</li>
<li><code>[@jest/fake-timers]</code> Accept
<code>Temporal.Instant</code> and <code>Temporal.ZonedDateTime</code> in
<code>jest.setSystemTime()</code> and <code>useFakeTimers({now})</code>
(<a
href="https://redirect.github.com/jestjs/jest/pull/16128">#16128</a>)</li>
<li><code>[@jest/fake-timers]</code> Support faking
<code>Temporal.Now.*</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16131">#16131</a>)</li>
<li><code>[jest-mock]</code> Add <code>clearMocksOnScope(scope)</code>
on <code>ModuleMocker</code> for clearing every mock function exposed on
a scope object (<a
href="https://redirect.github.com/jestjs/jest/pull/16088">#16088</a>)</li>
<li><code>[jest-resolve]</code> Add <code>canResolveSync()</code> on
<code>Resolver</code> so callers can detect when a user-configured
resolver only exports an <code>async</code> hook (<a
href="https://redirect.github.com/jestjs/jest/pull/16064">#16064</a>)</li>
<li><code>[jest-runtime]</code> Use synchronous <code>evaluate()</code>
for ES modules without top-level <code>await</code> on Node versions
that support it (v24.9+), and prefer the synchronous transform path when
a sync transformer is configured (<a
href="https://redirect.github.com/jestjs/jest/pull/16062">#16062</a>)</li>
<li><code>[jest-runtime]</code> Support <code>require()</code> of ES
modules on Node v24.9+ (<a
href="https://redirect.github.com/jestjs/jest/pull/16074">#16074</a>)</li>
<li><code>[jest-runtime]</code> Validate TC39 import attributes
(<code>with { type: 'json' }</code>) on ESM imports (<a
href="https://redirect.github.com/jestjs/jest/pull/16127">#16127</a>)</li>
<li><code>[@jest/transform]</code> Add
<code>canTransformSync(filename)</code> on
<code>ScriptTransformer</code> so callers can pick the sync vs async
transform path (<a
href="https://redirect.github.com/jestjs/jest/pull/16062">#16062</a>)</li>
<li><code>[jest-util]</code> Add <code>isError</code> helper (<a
href="https://redirect.github.com/jestjs/jest/pull/16076">#16076</a>)</li>
<li><code>[pretty-format]</code> Support React 19 (<a
href="https://redirect.github.com/jestjs/jest/pull/16123">#16123</a>)</li>
</ul>
<h3>Fixes</h3>
<ul>
<li><code>[expect-utils]</code> Fix <code>toStrictEqual</code> failing
on <code>structuredClone</code> results due to cross-realm constructor
mismatch (<a
href="https://redirect.github.com/jestjs/jest/pull/15959">#15959</a>)</li>
<li><code>[@jest/expect-utils]</code> Prevent
<code>toMatchObject</code>/subset matching from throwing when
encountering exotic iterables (<a
href="https://redirect.github.com/jestjs/jest/pull/15952">#15952</a>)</li>
<li><code>[fake-timers]</code> Convert <code>Date</code> to milliseconds
before passing to <code>@sinonjs/fake-timers</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16029">#16029</a>)</li>
<li><code>[jest]</code> Export <code>GlobalConfig</code> and
<code>ProjectConfig</code> TypeScript types (<a
href="https://redirect.github.com/jestjs/jest/pull/16132">#16132</a>)</li>
<li><code>[jest-circus]</code> Prevent crash when
<code>asyncError</code> is undefined for non-Error throws (<a
href="https://redirect.github.com/jestjs/jest/pull/16003">#16003</a>)</li>
<li><code>[jest-circus, jest-jasmine2]</code> Include
<code>Error.cause</code> in JSON <code>failureMessages</code> output (<a
href="https://redirect.github.com/jestjs/jest/pull/15967">#15967</a>)</li>
<li><code>[jest-config]</code> Fix preset path resolution on Windows
when the preset uses subpath <code>exports</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/15961">#15961</a>)</li>
<li><code>[jest-config]</code> Allow <code>collectCoverage</code> and
<code>coverageProvider</code> in project config without a validation
warning (<a
href="https://redirect.github.com/jestjs/jest/pull/16132">#16132</a>)</li>
<li><code>[jest-config]</code> Project config validator now emits
&quot;is not supported in an individual project configuration&quot;
instead of &quot;probably a typing mistake&quot; for known global-only
options (<a
href="https://redirect.github.com/jestjs/jest/pull/16132">#16132</a>)</li>
<li><code>[jest-environment-node]</code> Fix
<code>--localstorage-file</code> warning on Node 25+ (<a
href="https://redirect.github.com/jestjs/jest/pull/16086">#16086</a>)</li>
<li><code>[jest-reporters]</code> Apply global coverage threshold to
unmatched pattern files in addition to glob/path thresholds (<a
href="https://redirect.github.com/jestjs/jest/pull/16137">#16137</a>)</li>
<li><code>[jest-reporters, jest-runner, jest-runtime,
jest-transform]</code> Fix coverage report not showing correct code
coverage when using <code>projects</code> config option (<a
href="https://redirect.github.com/jestjs/jest/pull/16140">#16140</a>)</li>
<li><code>[jest-runtime]</code> Resolve <code>expect</code> and
<code>@jest/expect</code> from the internal module registry so test-file
imports share the same <code>JestAssertionError</code> as the global
<code>expect</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16130">#16130</a>)</li>
<li><code>[jest-runtime]</code> Improve CJS-from-ESM interop:
<code>__esModule</code>/Babel default unwrap, broader named-export
coverage, and shared CJS singleton across importers (<a
href="https://redirect.github.com/jestjs/jest/pull/16050">#16050</a>)</li>
<li><code>[jest-runtime]</code> Load <code>.js</code> files with ESM
syntax but no <code>&quot;type&quot;:&quot;module&quot;</code> marker as
native ESM (<a
href="https://redirect.github.com/jestjs/jest/pull/16050">#16050</a>)</li>
<li><code>[jest-runtime]</code> Extend the
<code>.js</code>-with-ESM-syntax fallback to <code>require()</code> on
Node v24.9+ - falls back to <code>require(esm)</code> when the CJS
parser rejects ESM syntax (<a
href="https://redirect.github.com/jestjs/jest/pull/16078">#16078</a>)</li>
<li><code>[jest-runtime]</code> Fix deadlocks and double-evaluation in
concurrent ESM and wasm imports (<a
href="https://redirect.github.com/jestjs/jest/pull/16050">#16050</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jestjs/jest/commit/b3b4a09ed3005369dacc7466d1d2122797283785"><code>b3b4a09</code></a>
v30.4.1</li>
<li><a
href="https://github.com/jestjs/jest/commit/5cbb21e0b3037edb42e503ec1a1ce80efad40c20"><code>5cbb21e</code></a>
v30.4.0</li>
<li>See full diff in <a
href="https://github.com/jestjs/jest/commits/v30.4.1/packages/jest-globals">compare
view</a></li>
</ul>
</details>
<br />

Updates `@types/node` from 25.5.0 to 25.9.1
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />

Updates `@typescript-eslint/eslint-plugin` from 8.58.0 to 8.59.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases">@​typescript-eslint/eslint-plugin's
releases</a>.</em></p>
<blockquote>
<h2>v8.59.4</h2>
<h2>8.59.4 (2026-05-18)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-floating-promises] stack
overflow when using recursive types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12294">#12294</a>)</li>
<li><strong>project-service:</strong> throw error cause in
<code>getParsedConfigFileFromTSServer</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12321">#12321</a>)</li>
<li><strong>typescript-eslint:</strong> export Compatible* types from
typescript-eslint to resolve pnpm TS error (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12340">#12340</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit"><code>@​StyleShit</code></a></li>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger"><code>@​kirkwaiblinger</code></a></li>
<li>lumir</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.59.4">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
<h2>v8.59.3</h2>
<h2>8.59.3 (2026-05-11)</h2>
<p>This was a version bump only, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.59.3">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
<h2>v8.59.2</h2>
<h2>8.59.2 (2026-05-04)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-unsafe-type-assertion] handle
crash on recursive template literal types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12150">#12150</a>)</li>
<li><strong>eslint-plugin:</strong> [no-deprecated] object destructuring
values should be treated as declarations (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12292">#12292</a>)</li>
<li><strong>rule-tester:</strong> add TypeScript as a peer dependency
(<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12288">#12288</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Dariusz Czajkowski</li>
<li>Dima Barabash</li>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger"><code>@​kirkwaiblinger</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.59.2">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
<h2>v8.59.1</h2>
<h2>8.59.1 (2026-04-27)</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md">@​typescript-eslint/eslint-plugin's
changelog</a>.</em></p>
<blockquote>
<h2>8.59.4 (2026-05-18)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-floating-promises] stack
overflow when using recursive types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12294">#12294</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit"><code>@​StyleShit</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.59.4">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
<h2>8.59.3 (2026-05-11)</h2>
<p>This was a version bump only for eslint-plugin to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.59.3">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
<h2>8.59.2 (2026-05-04)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-deprecated] object destructuring
values should be treated as declarations (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12292">#12292</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unsafe-type-assertion] handle
crash on recursive template literal types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12150">#12150</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Dima Barabash</li>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger"><code>@​kirkwaiblinger</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.59.2">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
<h2>8.59.1 (2026-04-27)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] treat
void as nullish in no-unnecessary-condition (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12241">#12241</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-arguments]
handle instantiation expressions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12220">#12220</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
avoid false positive in logical assignment assertions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12278">#12278</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
preserve phantom type arguments in generic inference (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12269">#12269</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
preserve index signatures in undefined unions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12257">#12257</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion] fix
crash &quot;TypeError: checker.getTypeArguments is not a function&quot;
(<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12246">#12246</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/ca6ca1431b6d18235297a7e29feb5d98f012dff2"><code>ca6ca14</code></a>
chore(release): publish 8.59.4</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/4302433ae6bf93d4ddc35264ad1b951254758566"><code>4302433</code></a>
fix(eslint-plugin): [no-floating-promises] stack overflow when using
recursiv...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/10b79f1ba8e98610a3af85152a1b3b406f91e633"><code>10b79f1</code></a>
chore(deps): update dependency eslint to v10.4.0 (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12339">#12339</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/2a6765d9628dc776f8127c96f088bb807c0bcab2"><code>2a6765d</code></a>
chore: clenaup <code>getAwaitedType</code> from
<code>typescript.d.ts</code> (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12302">#12302</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/48e13c0261e3cb1bf4f4dfaa462cdb3a56ef7383"><code>48e13c0</code></a>
chore(release): publish 8.59.3</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/e26dc8003ababf078aad4df17765ee4cea30644c"><code>e26dc80</code></a>
docs: update stale links to latest (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12313">#12313</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/44f9625336841a8ee3eb01a9e02e49b1d7b12648"><code>44f9625</code></a>
chore(deps): update vitest monorepo to v4.1.5 (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12307">#12307</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/2ec35f1760aade4df4c631d76d78c7ed5e136333"><code>2ec35f1</code></a>
chore(release): publish 8.59.2</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/ec3ef25390f7daf5a9ff33a60282bdbbb49ab0f3"><code>ec3ef25</code></a>
test: make no-useless-empty-export tests fully static (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12260">#12260</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/60d0a513870d833617374ff8ea256d86ca3cbbbb"><code>60d0a51</code></a>
chore(eslint-plugin): switch auto-generated test cases to hand-written
in no-...</li>
<li>Additional commits viewable in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.59.4/packages/eslint-plugin">compare
view</a></li>
</ul>
</details>
<br />

Updates `eslint` from 10.1.0 to 10.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.4.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/1a45ec596af1dd5f880e6874cb8f24dafb6a7ecf"><code>1a45ec5</code></a>
feat: check sequence expressions in <code>for-direction</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20701">#20701</a>)
(kuldeep kumar)</li>
<li><a
href="https://github.com/eslint/eslint/commit/450040bd89b989b3531824c6be45feb5fe3d936b"><code>450040b</code></a>
feat: add <code>includeIgnoreFile()</code> to <code>eslint/config</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/20735">#20735</a>)
(Kirk Waiblinger)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/544c0c3da589166ad8e5d634f35d3d06701c57be"><code>544c0c3</code></a>
fix: escape code path DOT labels in debug output (<a
href="https://redirect.github.com/eslint/eslint/issues/20866">#20866</a>)
(Pixel998)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6799431203f2579632d0870f98ba132067f4040c"><code>6799431</code></a>
fix: update dependency <code>@​eslint/config-helpers</code> to ^0.6.0
(<a
href="https://redirect.github.com/eslint/eslint/issues/20850">#20850</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/f078fef5005dceb14fc162aab7c7200e027688dd"><code>f078fef</code></a>
fix: handle non-array deprecated rule replacements (<a
href="https://redirect.github.com/eslint/eslint/issues/20825">#20825</a>)
(xbinaryx)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/7e52a7151fb92eec0e0f67fe4e5ddbd1ccce796f"><code>7e52a71</code></a>
docs: add mention of <code>@eslint-react/eslint-plugin</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20869">#20869</a>)
(Pavel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/db3468ba746407d7f286f18f7ea9db6df0e3bc08"><code>db3468b</code></a>
docs: tweak wording around ambiguous CJS-vs-ESM config (<a
href="https://redirect.github.com/eslint/eslint/issues/20865">#20865</a>)
(Kirk Waiblinger)</li>
<li><a
href="https://github.com/eslint/eslint/commit/90846643ec6e97d447ae0d831fabe6d17b0a998a"><code>9084664</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9cc73875046e3c4b8313644cbb1e99e26b36bd3f"><code>9cc7387</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/3d7b5484407403817aa9071a394d336d8ea96eb5"><code>3d7b548</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/191ec3c0a3f94ce0f110df761f0b2b8949011ccb"><code>191ec3c</code></a>
docs: Update README (GitHub Actions Bot)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/6616856f28fa514a30f87b5539fc100d739a94bf"><code>6616856</code></a>
chore: upgrade knip to v6 (<a
href="https://redirect.github.com/eslint/eslint/issues/20875">#20875</a>)
(Pixel998)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d13b084a3ad02f926e9addaa35fc383759ea5554"><code>d13b084</code></a>
ci: ensure auto-created PRs run CI (<a
href="https://redirect.github.com/eslint/eslint/issues/20860">#20860</a>)
(lumir)</li>
<li><a
href="https://github.com/eslint/eslint/commit/e71c7af86dce9acc1d18cb12d2184309f6841594"><code>e71c7af</code></a>
ci: bump pnpm/action-setup from 6.0.5 to 6.0.7 (<a
href="https://redirect.github.com/eslint/eslint/issues/20862">#20862</a>)
(dependabot[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/d84393dea170f54191fd20c8268b52c81c0ccd99"><code>d84393d</code></a>
test: add unit tests for SuppressionsService.applySuppressions() (<a
href="https://redirect.github.com/eslint/eslint/issues/20863">#20863</a>)
(kuldeep kumar)</li>
<li><a
href="https://github.com/eslint/eslint/commit/24db8cb8e6f07fba667121777a15b1785486be94"><code>24db8cb</code></a>
test: add tests for SuppressionsService.save() (<a
href="https://redirect.github.com/eslint/eslint/issues/20802">#20802</a>)
(kuldeep kumar)</li>
<li><a
href="https://github.com/eslint/eslint/commit/2ef0549cac4a9537e4c3a26b9f3edd4c99476bf6"><code>2ef0549</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/20857">#20857</a>)
(github-actions[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/a4297918d264d229a06cd96051ef9b91c7b86732"><code>a429791</code></a>
ci: remove <code>eslint-webpack-plugin</code> types integration test (<a
href="https://redirect.github.com/eslint/eslint/issues/20668">#20668</a>)
(Milos Djermanovic)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9e37386aa7f2ce220b2ef74a6afbac5f6b3527c5"><code>9e37386</code></a>
chore: replace <code>recast</code> with range approach in
code-sample-minimizer (<a
href="https://redirect.github.com/eslint/eslint/issues/20682">#20682</a>)
(Copilot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/0dd1f9ffc9a07704d46e2a4c8d4ccc0d0908b0c0"><code>0dd1f9f</code></a>
test: disable warning for
<code>vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20845">#20845</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9da3c7bc92d9579f8db19ecb56e718538d09db2b"><code>9da3c7b</code></a>
refactor: remove deprecated <code>meta.language</code> and migrate
<code>meta.dialects</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20716">#20716</a>)
(Pixel998)</li>
<li><a
href="https://github.com/eslint/eslint/commit/2099ed12a0a74c3d7f0808514362af2499b4fe2b"><code>2099ed1</code></a>
refactor: add <code>meta.defaultOptions</code> to more rules, enable
linting (<a
href="https://redirect.github.com/eslint/eslint/issues/20800">#20800</a>)
(xbinaryx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/f1dfbc9ca57196de7092e1888cc99427bd6fe06e"><code>f1dfbc9</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/20836">#20836</a>)
(github-actions[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/c75941390c14728806cd4baef4f6072f6de78318"><code>c759413</code></a>
ci: bump pnpm/action-setup from 6.0.3 to 6.0.5 (<a
href="https://redirect.github.com/eslint/eslint/issues/20843">#20843</a>)
(dependabot[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/5b817d6fdc9ae2c35b528dc662b2eca8f40f64aa"><code>5b817d6</code></a>
test: add unit tests for lib/shared/ast-utils (<a
href="https://redirect.github.com/eslint/eslint/issues/20838">#20838</a>)
(kuldeep kumar)</li>
<li><a
href="https://github.com/eslint/eslint/commit/1c13ae3934c198c494e5958fa3a68b33244ff06a"><code>1c13ae3</code></a>
test: add unit tests for lib/shared/severity (<a
href="https://redirect.github.com/eslint/eslint/issues/20835">#20835</a>)
(kuldeep kumar)</li>
</ul>
<h2>v10.3.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/379571a975f2b24d88037b9de2e72ec61d004130"><code>379571a</code></a>
feat: add suggestions for no-unused-private-class-members (<a
href="https://redirect.github.com/eslint/eslint/issues/20773">#20773</a>)
(sethamus)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/b6ae5cf07b9b51802367539cb24b245b61eaa37c"><code>b6ae5cf</code></a>
fix: handle unavailable require cache (<a
href="https://redirect.github.com/eslint/eslint/issues/20812">#20812</a>)
(Simon Podlipsky)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6fb3685bcbe9a6f72fd7dfb9129686b6fb96b0bd"><code>6fb3685</code></a>
fix: rule suggestions cause continuation in class body (<a
href="https://redirect.github.com/eslint/eslint/issues/20787">#20787</a>)
(Milos Djermanovic)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/32cc7ab4ec653ce89da92deb5c40a9f4fc707fe5"><code>32cc7ab</code></a>
docs: fix typos in docs and comments (<a
href="https://redirect.github.com/eslint/eslint/issues/20809">#20809</a>)
(Tanuj Kanti)</li>
<li><a
href="https://github.com/eslint/eslint/commit/7f479376a2fa463d823ab762db6bb37ce8d2ee8f"><code>7f47937</code></a>
docs: Update README (GitHub Actions Bot)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/d32235ec19ceea211fa86452afa383ca05f5c2f9"><code>d32235e</code></a>
ci: use pnpm in <code>eslint-flat-config-utils</code> type integration
test (<a
href="https://redirect.github.com/eslint/eslint/issues/20826">#20826</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/3ffb14ea517de750ed1181579ef844af342e4096"><code>3ffb14e</code></a>
chore: clean up typos in comments and JSDoc (<a
href="https://redirect.github.com/eslint/eslint/issues/20821">#20821</a>)
(Pixel998)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/452c4010c07dc2e36fe6ec6a8c48298878e86887"><code>452c401</code></a>
10.4.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/b6417e8b55c9525070d6e168b485ce6ff21688ed"><code>b6417e8</code></a>
Build: changelog update for 10.4.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/6616856f28fa514a30f87b5539fc100d739a94bf"><code>6616856</code></a>
chore: upgrade knip to v6 (<a
href="https://redirect.github.com/eslint/eslint/issues/20875">#20875</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d13b084a3ad02f926e9addaa35fc383759ea5554"><code>d13b084</code></a>
ci: ensure auto-created PRs run CI (<a
href="https://redirect.github.com/eslint/eslint/issues/20860">#20860</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/7e52a7151fb92eec0e0f67fe4e5ddbd1ccce796f"><code>7e52a71</code></a>
docs: add mention of <code>@eslint-react/eslint-plugin</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20869">#20869</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/e71c7af86dce9acc1d18cb12d2184309f6841594"><code>e71c7af</code></a>
ci: bump pnpm/action-setup from 6.0.5 to 6.0.7 (<a
href="https://redirect.github.com/eslint/eslint/issues/20862">#20862</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/544c0c3da589166ad8e5d634f35d3d06701c57be"><code>544c0c3</code></a>
fix: escape code path DOT labels in debug output (<a
href="https://redirect.github.com/eslint/eslint/issues/20866">#20866</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/db3468ba746407d7f286f18f7ea9db6df0e3bc08"><code>db3468b</code></a>
docs: tweak wording around ambiguous CJS-vs-ESM config (<a
href="https://redirect.github.com/eslint/eslint/issues/20865">#20865</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d84393dea170f54191fd20c8268b52c81c0ccd99"><code>d84393d</code></a>
test: add unit tests for SuppressionsService.applySuppressions() (<a
href="https://redirect.github.com/eslint/eslint/issues/20863">#20863</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/90846643ec6e97d447ae0d831fabe6d17b0a998a"><code>9084664</code></a>
docs: Update README</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.1.0...v10.4.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `globals` from 17.4.0 to 17.6.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sindresorhus/globals/releases">globals's
releases</a>.</em></p>
<blockquote>
<h2>v17.6.0</h2>
<ul>
<li>Update globals (2026-05-01) (<a
href="https://redirect.github.com/sindresorhus/globals/issues/343">#343</a>)
00a4dd9</li>
</ul>
<hr />
<p><a
href="https://github.com/sindresorhus/globals/compare/v17.5.0...v17.6.0">https://github.com/sindresorhus/globals/compare/v17.5.0...v17.6.0</a></p>
<h2>v17.5.0</h2>
<ul>
<li>Update globals (2026-04-12) (<a
href="https://redirect.github.com/sindresorhus/globals/issues/342">#342</a>)
5d84602</li>
</ul>
<hr />
<p><a
href="https://github.com/sindresorhus/globals/compare/v17.4.0...v17.5.0">https://github.com/sindresorhus/globals/compare/v17.4.0...v17.5.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sindresorhus/globals/commit/6b15870f1c08b60b5b57afe45a703d9ed0be39bc"><code>6b15870</code></a>
17.6.0</li>
<li><a
href="https://github.com/sindresorhus/globals/commit/00a4dd9821830a9b044798120e86b1bb1a54648d"><code>00a4dd9</code></a>
Update globals (2026-05-01) (<a
href="https://redirect.github.com/sindresorhus/globals/issues/343">#343</a>)</li>
<li><a
href="https://github.com/sindresorhus/globals/commit/b8170c8e1d648291b613c5b39a69652c796fa36c"><code>b8170c8</code></a>
17.5.0</li>
<li><a
href="https://github.com/sindresorhus/globals/commit/5d846029679832931f38ced6381cc95bcb9abd80"><code>5d84602</code></a>
Update globals (2026-04-12) (<a
href="https://redirect.github.com/sindresorhus/globals/issues/342">#342</a>)</li>
<li><a
href="https://github.com/sindresorhus/globals/commit/1b727e5f4cc39121b8e77b9f27574a8ca27391fc"><code>1b727e5</code></a>
Fix build script for ES globals (<a
href="https://redirect.github.com/sindresorhus/globals/issues/341">#341</a>)</li>
<li>See full diff in <a
href="https://github.com/sindresorhus/globals/compare/v17.4.0...v17.6.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `jest` from 30.3.0 to 30.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jestjs/jest/releases">jest's
releases</a>.</em></p>
<blockquote>
<h2>v30.4.2</h2>
<h1>Fixes</h1>
<ul>
<li><code>[jest-runtime]</code> Fix named imports from CJS modules whose
<code>module.exports</code> is a function with own-property exports (<a
href="https://redirect.github.com/jestjs/jest/pull/16150">#16150</a>)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jestjs/jest/compare/v30.4.1...v30.4.2">https://github.com/jestjs/jest/compare/v30.4.1...v30.4.2</a></p>
<h2>v30.4.1</h2>
<h2>Features</h2>
<ul>
<li><code>[jest-config, jest-core, jest-runner, jest-schemas,
jest-types]</code> Allow custom runner configuration options via tuple
format <code>['runner-path', {options}]</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16141">#16141</a>)</li>
</ul>
<h2>Fixes</h2>
<ul>
<li><code>[jest-runtime]</code> Align CJS-from-ESM default export with
Node: <code>module.exports</code> is always the ESM default,
<code>__esModule</code> unwrapping is no longer applied (<a
href="https://redirect.github.com/jestjs/jest/pull/16143">#16143</a>)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jestjs/jest/compare/v30.4.0...v30.4.1">https://github.com/jestjs/jest/compare/v30.4.0...v30.4.1</a></p>
<h2>v30.4.0</h2>
<p>Big release! 😀</p>
<p>Main feature is a rewrite of our custom runtime in preparation for
stabilisation of native support of ESM. As part of that work
<code>require(esm)</code> module is now supported on Node 24.9+ (still
requires <code>--experimental-vm-modules</code> like before).</p>
<p>In addition we now support fake timers for the recently released
<code>Temporal</code> API in Node v26.</p>
<p>React 19 is also supported properly in <code>pretty-format</code>,
meaning snapshots of React components now work like they should.</p>
<p>Due to all the changes, there might be regressions that snuck in.
Please report them!</p>
<p>Full list of changes below</p>
<h2>Features</h2>
<ul>
<li><code>[babel-jest]</code> Support collecting coverage from
<code>.mts</code>, <code>.cts</code> (and other) files (<a
href="https://redirect.github.com/jestjs/jest/pull/15994">#15994</a>)</li>
<li><code>[jest-circus, jest-cli, jest-config, jest-core, jest-jasmine2,
jest-types]</code> Add <code>--collect-tests</code> flag to discover and
list tests without executing them (<a
href="https://redirect.github.com/jestjs/jest/pull/16006">#16006</a>)</li>
<li><code>[jest-config, jest-runner, jest-worker]</code> Add
<code>workerGracefulExitTimeout</code> config option to control how long
workers are given to exit before being force-killed (<a
href="https://redirect.github.com/jestjs/jest/pull/15984">#15984</a>)</li>
<li><code>[jest-config]</code> Add support for
<code>jest.config.mts</code> as a valid configuration file (<a
href="https://redirect.github.com/jestjs/jest/pull/16005">#16005</a>)</li>
<li><code>[jest-config, jest-core, jest-reporters, jest-runner]</code>
<code>verbose</code> and <code>silent</code> can now be set per-project;
the project-level value overrides the global value for that project's
tests (<a
href="https://redirect.github.com/jestjs/jest/pull/16133">#16133</a>)</li>
<li><code>[@jest/fake-timers]</code> Accept
<code>Temporal.Duration</code> in
<code>jest.advanceTimersByTime()</code> and
<code>jest.advanceTimersByTimeAsync()</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16128">#16128</a>)</li>
<li><code>[@jest/fake-timers]</code> Accept
<code>Temporal.Instant</code> and <code>Temporal.ZonedDateTime</code> in
<code>jest.setSystemTime()</code> and <code>useFakeTimers({now})</code>
(<a
href="https://redirect.github.com/jestjs/jest/pull/16128">#16128</a>)</li>
<li><code>[@jest/fake-timers]</code> Support faking
<code>Temporal.Now.*</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16131">#16131</a>)</li>
<li><code>[jest-mock]</code> Add <code>clearMocksOnScope(scope)</code>
on <code>ModuleMocker</code> for clearing every mock function exposed on
a scope object (<a
href="https://redirect.github.com/jestjs/jest/pull/16088">#16088</a>)</li>
<li><code>[jest-resolve]</code> Add <code>canResolveSync()</code> on
<code>Resolver</code> so callers can detect when a user-configured
resolver only exports an <code>async</code> hook (<a
href="https://redirect.github.com/jestjs/jest/pull/16064">#16064</a>)</li>
<li><code>[jest-runtime]</code> Use synchronous <code>evaluate()</code>
for ES modules without top-level <code>await</code> on Node versions
that support it (v24.9+), and prefer the synchronous transform path when
a sync transformer is configured (<a
href="https://redirect.github.com/jestjs/jest/pull/16062">#16062</a>)</li>
<li><code>[jest-runtime]</code> Support <code>require()</code> of ES
modules on Node v24.9+ (<a
href="https://redirect.github.com/jestjs/jest/pull/16074">#16074</a>)</li>
<li><code>[jest-runtime]</code> Validate TC39 import attributes
(<code>with { type: 'json' }</code>) on ESM imports (<a
href="https://redirect.github.com/jestjs/jest/pull/16127">#16127</a>)</li>
<li><code>[@jest/transform]</code> Add
<code>canTransformSync(filename)</code> on
<code>ScriptTransformer</code> so callers can pick the sync vs async
transform path (<a
href="https://redirect.github.com/jestjs/jest/pull/16062">#16062</a>)</li>
<li><code>[jest-util]</code> Add <code>isError</code> helper (<a
href="https://redirect.github.com/jestjs/jest/pull/16076">#16076</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jestjs/jest/blob/main/CHANGELOG.md">jest's
changelog</a>.</em></p>
<blockquote>
<h2>30.4.2</h2>
<h3>Fixes</h3>
<ul>
<li><code>[jest-runtime]</code> Fix named imports from CJS modules whose
<code>module.exports</code> is a function with own-property exports (<a
href="https://redirect.github.com/jestjs/jest/pull/16150">#16150</a>)</li>
</ul>
<h2>30.4.1</h2>
<h3>Features</h3>
<ul>
<li><code>[jest-config, jest-core, jest-runner, jest-schemas,
jest-types]</code> Allow custom runner configuration options via tuple
format <code>['runner-path', {options}]</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16141">#16141</a>)</li>
</ul>
<h3>Fixes</h3>
<ul>
<li><code>[jest-runtime]</code> Align CJS-from-ESM default export with
Node: <code>module.exports</code> is always the ESM default,
<code>__esModule</code> unwrapping is no longer applied (<a
href="https://redirect.github.com/jestjs/jest/pull/16143">#16143</a>)</li>
</ul>
<h2>30.4.0</h2>
<h3>Features</h3>
<ul>
<li><code>[babel-jest]</code> Support collecting coverage from
<code>.mts</code>, <code>.cts</code> (and other) files (<a
href="https://redirect.github.com/jestjs/jest/pull/15994">#15994</a>)</li>
<li><code>[jest-circus, jest-cli, jest-config, jest-core, jest-jasmine2,
jest-types]</code> Add <code>--collect-tests</code> flag to discover and
list tests without executing them (<a
href="https://redirect.github.com/jestjs/jest/pull/16006">#16006</a>)</li>
<li><code>[jest-config, jest-runner, jest-worker]</code> Add
<code>workerGracefulExitTimeout</code> config option to control how long
workers are given to exit before being force-killed (<a
href="https://redirect.github.com/jestjs/jest/pull/15984">#15984</a>)</li>
<li><code>[jest-config]</code> Add support for
<code>jest.config.mts</code> as a valid configuration file (<a
href="https://redirect.github.com/jestjs/jest/pull/16005">#16005</a>)</li>
<li><code>[jest-config, jest-core, jest-reporters, jest-runner]</code>
<code>verbose</code> and <code>silent</code> can now be set per-project;
t...

_Description has been truncated_

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jérôme Prinet <jprinet@gradle.com>
 2026-06-09 11:49:38 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Jérôme Prinet
 		8499b50242 Bump the github-actions group across 2 directories with 8 updates (#976) 
Bumps the github-actions group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.2` |
`6.0.3` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.3.0`
| `6.4.0` |
| [gradle/actions](https://github.com/gradle/actions) | `6.0.1` |
`6.1.0` |
|
[tj-actions/changed-files](https://github.com/tj-actions/changed-files)
| `47.0.5` | `47.0.6` |
| [github/codeql-action](https://github.com/github/codeql-action) |
`4.35.1` | `4.36.2` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact)
| `7.0.0` | `7.0.1` |
| [actions/github-script](https://github.com/actions/github-script) |
`8.0.0` | `9.0.0` |
|
[peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request)
| `8.1.0` | `8.1.1` |

Bumps the github-actions group with 2 updates in the
/.github/actions/build-dist directory:
[actions/setup-node](https://github.com/actions/setup-node) and
[actions/upload-artifact](https://github.com/actions/upload-artifact).

Updates `actions/checkout` from 6.0.2 to 6.0.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update changelog by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>Update changelog for v6.0.3 by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yaananth"><code>@​yaananth</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<h2>v4.2.0</h2>
<ul>
<li>Add Ref and Commit outputs by <a
href="https://github.com/lucacome"><code>@​lucacome</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li>
<li>Dependency updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>- <a
href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>,
<a
href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li>
</ul>
<h2>v4.1.7</h2>
<ul>
<li>Bump the minor-npm-dependencies group across 1 directory with 4
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li>
<li>Bump actions/checkout from 3 to 4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li>
<li>Check out other refs/* by commit by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a>
Update changelog for v6.0.3 (<a
href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/1cce3390c2bfda521930d01229c073c7ff920824"><code>1cce339</code></a>
Fix checkout init for SHA-256 repositories (<a
href="https://redirect.github.com/actions/checkout/issues/2439">#2439</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/900f2210b1d28bbbd0bd22d17926b9e224e8f231"><code>900f221</code></a>
fix: expand merge commit SHA regex and add SHA-256 test cases (<a
href="https://redirect.github.com/actions/checkout/issues/2414">#2414</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/0c366fd6a839edf440554fa01a7085ccba70ac98"><code>0c366fd</code></a>
Update changelog (<a
href="https://redirect.github.com/actions/checkout/issues/2357">#2357</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/setup-node` from 6.3.0 to 6.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-node/releases">actions/setup-node's
releases</a>.</em></p>
<blockquote>
<h2>v6.4.0</h2>
<h2>What's Changed</h2>
<h3>Dependency updates:</h3>
<ul>
<li>Upgrade <a
href="https://github.com/actions"><code>@​actions</code></a>
dependencies by <a
href="https://github.com/Copilot"><code>@​Copilot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li>
<li>Update Node.js versions in versions.yml and bump package to v6.4.0
by <a
href="https://github.com/priya-kinthali"><code>@​priya-kinthali</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1533">actions/setup-node#1533</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Copilot"><code>@​Copilot</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-node/compare/v6...v6.4.0">https://github.com/actions/setup-node/compare/v6...v6.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-node/commit/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e"><code>48b55a0</code></a>
Update Node.js versions in versions.yml and bump package to v6.4.0 (<a
href="https://redirect.github.com/actions/setup-node/issues/1533">#1533</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/ab72c7e7eba0eaa11f8cab0f5679243900c2cac9"><code>ab72c7e</code></a>
Upgrade <a href="https://github.com/actions"><code>@​actions</code></a>
dependencies (<a
href="https://redirect.github.com/actions/setup-node/issues/1525">#1525</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-node/compare/53b83947a5a98c8d113130e565377fae1a50d02f...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e">compare
view</a></li>
</ul>
</details>
<br />

Updates `gradle/actions` from 6.0.1 to 6.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gradle/actions/releases">gradle/actions's
releases</a>.</em></p>
<blockquote>
<h2>v6.1.0</h2>
<h2>New: Basic Cache Provider</h2>
<p>A new MIT-licensed <strong>Basic Caching</strong> provider is now
available as an alternative to the proprietary <strong>Enhanced
Caching</strong> provided by <code>gradle-actions-caching</code>. Choose
Basic Caching by setting <code>cache-provider: basic</code> on
<code>setup-gradle</code> or <code>dependency-submission</code>
actions.</p>
<ul>
<li>Built on <code>@actions/cache</code> -- fully open source</li>
<li>Caches <code>~/.gradle/caches</code> and
<code>~/.gradle/wrapper</code> directories</li>
<li>Cache key derived from build files (<code>*.gradle*</code>,
<code>gradle-wrapper.properties</code>, etc.)</li>
<li>Clean cache on build file changes (no restore keys, preventing stale
entry accumulation)</li>
</ul>
<p><strong>Limitations vs Enhanced Caching:</strong> No cache cleanup,
no deduplication of cached content, cached content is fixed unless build
files change.</p>
<h2>Revamped Licensing &amp; Distribution Documentation</h2>
<ul>
<li>New <strong>DISTRIBUTION.md</strong> documents the licensing of each
component (particularly Basic Caching vs Enhanced Caching)</li>
<li>Simplified licensing notices in README, docs, and runtime log
output</li>
<li>Clear usage tiers: Enhanced Caching is free for public repos and in
Free Preview for private repos</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Use a unique cache entry for wrapper-validation test by <a
href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/921">gradle/actions#921</a></li>
<li>Update Dependencies by <a
href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/922">gradle/actions#922</a></li>
<li>Update dependencies and resolve npm vulnerabilities by <a
href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/933">gradle/actions#933</a></li>
<li>Add open-source 'basic' cache provider and revamp licensing
documentation by <a
href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/930">gradle/actions#930</a></li>
<li>Restructure caching documentation for basic and enhanced providers
by <a href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/934">gradle/actions#934</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/gradle/actions/compare/v6.0.1...v6.1.0">https://github.com/gradle/actions/compare/v6.0.1...v6.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gradle/actions/commit/50e97c2cd7a37755bbfafc9c5b7cafaece252f6e"><code>50e97c2</code></a>
Link to docs for caching providers</li>
<li><a
href="https://github.com/gradle/actions/commit/f2e6298504c4b1f20294637059e1d0d89422409a"><code>f2e6298</code></a>
Restructure caching documentation for basic and enhanced providers (<a
href="https://redirect.github.com/gradle/actions/issues/934">#934</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/b294b1e2dbcf270bfe835590dedbbc7e2024618c"><code>b294b1e</code></a>
Really fix integ-test-full</li>
<li><a
href="https://github.com/gradle/actions/commit/83d3189aae3332f1b2235b42d8804258f2348213"><code>83d3189</code></a>
Revise license details for gradle-actions-caching</li>
<li><a
href="https://github.com/gradle/actions/commit/1d5db06d2662829845876553d61cf3df3cf997d1"><code>1d5db06</code></a>
Update license link for gradle-actions-caching component</li>
<li><a
href="https://github.com/gradle/actions/commit/1c809615505fae9768e2610dc6dbecdc3a796443"><code>1c80961</code></a>
Fix license link for Enhanced Caching component</li>
<li><a
href="https://github.com/gradle/actions/commit/9e99920b14b9dc5a9bf8c72e94ba47ebf5bbaee6"><code>9e99920</code></a>
Fix integ-test-full workflow</li>
<li><a
href="https://github.com/gradle/actions/commit/bb8aaaf9d56f25afd4a90925425facf294f31fcf"><code>bb8aaaf</code></a>
Fix workflow permissions</li>
<li><a
href="https://github.com/gradle/actions/commit/f5dfb43fc8c99c758ebf2324d102118e5faf6cb6"><code>f5dfb43</code></a>
[bot] Update dist directory</li>
<li><a
href="https://github.com/gradle/actions/commit/ff9ae24c39252301b448088d2c7d9f0a2d8066dd"><code>ff9ae24</code></a>
Add open-source 'basic' cache provider and revamp licensing
documentation (<a
href="https://redirect.github.com/gradle/actions/issues/930">#930</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/gradle/actions/compare/39e147cb9de83bb9910b8ef8bd7fff0ee20fcd6f...50e97c2cd7a37755bbfafc9c5b7cafaece252f6e">compare
view</a></li>
</ul>
</details>
<br />

Updates `tj-actions/changed-files` from 47.0.5 to 47.0.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tj-actions/changed-files/releases">tj-actions/changed-files's
releases</a>.</em></p>
<blockquote>
<h2>v47.0.6</h2>
<h2>What's Changed</h2>
<ul>
<li>Upgraded to v47.0.5 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2816">tj-actions/changed-files#2816</a></li>
<li>Updated README.md by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2817">tj-actions/changed-files#2817</a></li>
<li>chore(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2818">tj-actions/changed-files#2818</a></li>
<li>chore(deps-dev): bump <code>@​types/node</code> from 25.3.3 to
25.3.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2820">tj-actions/changed-files#2820</a></li>
<li>chore(deps): bump github/codeql-action from 4.32.5 to 4.32.6 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2819">tj-actions/changed-files#2819</a></li>
<li>chore(deps-dev): bump <code>@​types/node</code> from 25.3.5 to
25.5.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2825">tj-actions/changed-files#2825</a></li>
<li>chore(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2824">tj-actions/changed-files#2824</a></li>
<li>chore(deps): bump github/codeql-action from 4.32.6 to 4.35.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2834">tj-actions/changed-files#2834</a></li>
<li>chore(deps-dev): bump eslint-plugin-jest from 29.15.0 to 29.15.1 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2831">tj-actions/changed-files#2831</a></li>
<li>chore(deps): bump yaml from 2.8.2 to 2.8.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2830">tj-actions/changed-files#2830</a></li>
<li>chore(deps): bump nrwl/nx-set-shas from 4.4.0 to 5.0.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2829">tj-actions/changed-files#2829</a></li>
<li>chore(deps-dev): bump jest from 30.2.0 to 30.3.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2822">tj-actions/changed-files#2822</a></li>
<li>chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2849">tj-actions/changed-files#2849</a></li>
<li>chore(deps-dev): bump prettier from 3.8.1 to 3.8.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2848">tj-actions/changed-files#2848</a></li>
<li>chore(deps-dev): bump <code>@​types/node</code> from 25.5.0 to
25.6.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2846">tj-actions/changed-files#2846</a></li>
<li>chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2844">tj-actions/changed-files#2844</a></li>
<li>chore(deps): bump peter-evans/create-pull-request from 8.1.0 to
8.1.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2843">tj-actions/changed-files#2843</a></li>
<li>chore(deps): bump lodash from 4.17.23 to 4.18.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2837">tj-actions/changed-files#2837</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tj-actions/changed-files/compare/v47.0.5...v47.0.6">https://github.com/tj-actions/changed-files/compare/v47.0.5...v47.0.6</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tj-actions/changed-files/blob/main/HISTORY.md">tj-actions/changed-files's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h1><a
href="https://github.com/tj-actions/changed-files/compare/v47.0.5...v47.0.6">47.0.6</a>
- (2026-04-18)</h1>
<h2><!-- raw HTML omitted -->🔄 Update</h2>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2817">#2817</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
&lt;41898282+github-actions[bot]<a
href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt;
Co-authored-by: Tonye Jack <a
href="mailto:jtonye@ymail.com">jtonye@ymail.com</a> (<a
href="https://github.com/tj-actions/changed-files/commit/c23d52ba6ff8c67273c61e097615eafe88cb8650">c23d52b</a>)
- (github-actions[bot])</p>
<h2><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h2>
<ul>
<li><strong>deps:</strong> Bump lodash from 4.17.23 to 4.18.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2837">#2837</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/9426d40962ed5378910ee2e21d5f8c6fcbf2dd96">9426d40</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump peter-evans/create-pull-request from
8.1.0 to 8.1.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2843">#2843</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/32de080616d8c84d89622770d26b0857f4ce8b49">32de080</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/upload-artifact from 7.0.0 to
7.0.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2844">#2844</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/2487d125c6ecf3457228762d50599297a8c80310">2487d12</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@​types/node</code> from
25.5.0 to 25.6.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2846">#2846</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/cef85a3eab76d9db9f294de4915d6a31b1dcbfda">cef85a3</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump prettier from 3.8.1 to 3.8.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2848">#2848</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/7b082dee30a6f42592f70940c0f0a26a72af452c">7b082de</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 4.35.1 to
4.35.2 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2849">#2849</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/07224cab5986b4ce28c5080f4a804e5573422714">07224ca</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump jest from 30.2.0 to 30.3.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2822">#2822</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/2bb135777322059ee3a3c9239999b159ff49febc">2bb1357</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump nrwl/nx-set-shas from 4.4.0 to 5.0.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2829">#2829</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/cc98117d3993777f3babaccc496514b4a65652a9">cc98117</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump yaml from 2.8.2 to 2.8.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2830">#2830</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/786e4213eac60d6e2b4492135b46644269fac3db">786e421</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump eslint-plugin-jest from 29.15.0 to
29.15.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2831">#2831</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/726b41bbed783a50de97829de6d977cd665831f7">726b41b</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 4.32.6 to
4.35.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2834">#2834</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/2c3585e584822ed39e27c6c471225dde37991778">2c3585e</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/download-artifact from 8.0.0 to
8.0.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2824">#2824</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/3d37a7ff08a7ce64b4cab9669eac39b0709cdac9">3d37a7f</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@​types/node</code> from
25.3.5 to 25.5.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2825">#2825</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/445b0eb32849cdd5b22a390bf0568af00ed4ca34">445b0eb</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 4.32.5 to
4.32.6 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2819">#2819</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/4f892cd56345d721bac7139000c4b4a22c8f138f">4f892cd</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@​types/node</code> from
25.3.3 to 25.3.5 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2820">#2820</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/611865116d9f223a0ca640071aec29292c81978f">6118651</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/setup-node from 6.2.0 to 6.3.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2818">#2818</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/e517d7a5ca34a5d08bbe5c949e59381bd6d7cce2">e517d7a</a>)
- (dependabot[bot])</li>
</ul>
<h2><!-- raw HTML omitted -->⬆️ Upgrades</h2>
<ul>
<li>Upgraded to v47.0.5 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2816">#2816</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
&lt;41898282+github-actions[bot]<a
href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt;
Co-authored-by: Tonye Jack <a
href="mailto:jtonye@ymail.com">jtonye@ymail.com</a> (<a
href="https://github.com/tj-actions/changed-files/commit/4750530ff4e020eafc769c56c2fa8376ca8ad8e9">4750530</a>)
- (github-actions[bot])</p>
<h1><a
href="https://github.com/tj-actions/changed-files/compare/v47.0.4...v47.0.5">47.0.5</a>
- (2026-03-03)</h1>
<h2><!-- raw HTML omitted -->🔄 Update</h2>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2805">#2805</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
&lt;41898282+github-actions[bot]<a
href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt;
(<a
href="https://github.com/tj-actions/changed-files/commit/35dace0375d89e25e78db5f0a44127b61f4e5c20">35dace0</a>)
- (github-actions[bot])</p>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2803">#2803</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
&lt;41898282+github-actions[bot]<a
href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt;
Co-authored-by: Tonye Jack <a
href="mailto:jtonye@ymail.com">jtonye@ymail.com</a> (<a
href="https://github.com/tj-actions/changed-files/commit/9ee99eb5bda5d6a67fedcd50ecd24fb10add2f41">9ee99eb</a>)
- (github-actions[bot])</p>
<h2><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tj-actions/changed-files/commit/9426d40962ed5378910ee2e21d5f8c6fcbf2dd96"><code>9426d40</code></a>
chore(deps): bump lodash from 4.17.23 to 4.18.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2837">#2837</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/32de080616d8c84d89622770d26b0857f4ce8b49"><code>32de080</code></a>
chore(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2843">#2843</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/2487d125c6ecf3457228762d50599297a8c80310"><code>2487d12</code></a>
chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2844">#2844</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/cef85a3eab76d9db9f294de4915d6a31b1dcbfda"><code>cef85a3</code></a>
chore(deps-dev): bump <code>@​types/node</code> from 25.5.0 to 25.6.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2846">#2846</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/7b082dee30a6f42592f70940c0f0a26a72af452c"><code>7b082de</code></a>
chore(deps-dev): bump prettier from 3.8.1 to 3.8.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2848">#2848</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/07224cab5986b4ce28c5080f4a804e5573422714"><code>07224ca</code></a>
chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2849">#2849</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/2bb135777322059ee3a3c9239999b159ff49febc"><code>2bb1357</code></a>
chore(deps-dev): bump jest from 30.2.0 to 30.3.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2822">#2822</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/cc98117d3993777f3babaccc496514b4a65652a9"><code>cc98117</code></a>
chore(deps): bump nrwl/nx-set-shas from 4.4.0 to 5.0.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2829">#2829</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/786e4213eac60d6e2b4492135b46644269fac3db"><code>786e421</code></a>
chore(deps): bump yaml from 2.8.2 to 2.8.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2830">#2830</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/726b41bbed783a50de97829de6d977cd665831f7"><code>726b41b</code></a>
chore(deps-dev): bump eslint-plugin-jest from 29.15.0 to 29.15.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2831">#2831</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/tj-actions/changed-files/compare/22103cc46bda19c2b464ffe86db46df6922fd323...9426d40962ed5378910ee2e21d5f8c6fcbf2dd96">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action` from 4.35.1 to 4.36.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.36.2</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>v4.36.1</h2>
<p>No user facing changes.</p>
<h2>v4.36.0</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.19.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li>
</ul>
<h2>v4.35.5</h2>
<ul>
<li>We have improved how the JavaScript bundles for the CodeQL Action
are generated to avoid duplication across bundles and reduce the size of
the repository by around 70%. This should have no effect on the runtime
behaviour of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li>
<li>For performance and accuracy reasons, <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> will now only be enabled on a pull request when
diff-informed analysis is also enabled for that run. If diff-informed
analysis is unavailable (for example, because the PR diff ranges could
not be computed), the action will fall back to a full analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li>
<li>If multiple inputs are provided for the GitHub-internal
<code>analysis-kinds</code> input, only <code>code-scanning</code> will
be enabled. The <code>analysis-kinds</code> input is experimental, for
GitHub-internal use only, and may change without notice at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li>
<li>Added an experimental change which, when running a Code Scanning
analysis for a PR with <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> enabled, prefers CodeQL CLI versions that have
a cached overlay-base database for the configured languages. This speeds
up analysis for a repository when there is not yet a cached overlay-base
database for the latest CLI version. We expect to roll this change out
to everyone in May. <a
href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li>
</ul>
<h2>v4.35.4</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>v4.35.3</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.19.3 and earlier. These versions of
CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise
Server 3.15, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li>
<li>Configurations for private registries that use Cloudsmith or GCP
OIDC are now accepted. <a
href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li>
<li>Best-effort connection tests for private registries now use
<code>GET</code> requests instead of <code>HEAD</code> for better
compatibility with various registry implementations. For NuGet feeds,
the test is now always performed against the service index. <a
href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li>
<li>Fixed a bug where two diagnostics produced within the same
millisecond could overwrite each other on disk, causing one of them to
be lost. <a
href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li>
</ul>
<h2>v4.35.2</h2>
<ul>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable is deprecated and will be removed in May 2026. If you are
affected by this, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li>
<li>The Git version 2.36.0 requirement for improved incremental analysis
now only applies to repositories that contain submodules. <a
href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li>
<li>Python analysis on GHES no longer extracts the standard library,
relying instead on models of the standard library. This should result in
significantly faster extraction and analysis times, while the effect on
alerts should be minimal. <a
href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li>
<li>Fixed a bug in the validation of OIDC configurations for private
registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.0 - 22 May 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.19.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li>
</ul>
<h2>4.35.5 - 15 May 2026</h2>
<ul>
<li>We have improved how the JavaScript bundles for the CodeQL Action
are generated to avoid duplication across bundles and reduce the size of
the repository by around 70%. This should have no effect on the runtime
behaviour of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li>
<li>For performance and accuracy reasons, <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> will now only be enabled on a pull request when
diff-informed analysis is also enabled for that run. If diff-informed
analysis is unavailable (for example, because the PR diff ranges could
not be computed), the action will fall back to a full analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li>
<li>If multiple inputs are provided for the GitHub-internal
<code>analysis-kinds</code> input, only <code>code-scanning</code> will
be enabled. The <code>analysis-kinds</code> input is experimental, for
GitHub-internal use only, and may change without notice at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li>
<li>Added an experimental change which, when running a Code Scanning
analysis for a PR with <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> enabled, prefers CodeQL CLI versions that have
a cached overlay-base database for the configured languages. This speeds
up analysis for a repository when there is not yet a cached overlay-base
database for the latest CLI version. We expect to roll this change out
to everyone in May. <a
href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li>
</ul>
<h2>4.35.4 - 07 May 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>4.35.3 - 01 May 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.19.3 and earlier. These versions of
CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise
Server 3.15, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li>
<li>Configurations for private registries that use Cloudsmith or GCP
OIDC are now accepted. <a
href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li>
<li>Best-effort connection tests for private registries now use
<code>GET</code> requests instead of <code>HEAD</code> for better
compatibility with various registry implementations. For NuGet feeds,
the test is now always performed against the service index. <a
href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li>
<li>Fixed a bug where two diagnostics produced within the same
millisecond could overwrite each other on disk, causing one of them to
be lost. <a
href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li>
</ul>
<h2>4.35.2 - 15 Apr 2026</h2>
<ul>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable is deprecated and will be removed in May 2026. If you are
affected by this, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li>
<li>The Git version 2.36.0 requirement for improved incremental analysis
now only applies to repositories that contain submodules. <a
href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li>
<li>Python analysis on GHES no longer extracts the standard library,
relying instead on models of the standard library. This should result in
significantly faster extraction and analysis times, while the effect on
alerts should be minimal. <a
href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li>
<li>Fixed a bug in the validation of OIDC configurations for private
registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/8aad20d150bbac5944a9f9d289da16a4b0d87c1e"><code>8aad20d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3949">#3949</a>
from github/update-v4.36.2-dcb947ce1</li>
<li><a
href="https://github.com/github/codeql-action/commit/f521b08cd8f468ab193ea950a589cb2e9c869c6a"><code>f521b08</code></a>
Add additional changelog notes</li>
<li><a
href="https://github.com/github/codeql-action/commit/8aeff0ffb7b78582ee0d0e6eebb8140684400d08"><code>8aeff0f</code></a>
Update changelog for v4.36.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/dcb947ce15976d40ea82935510b2db4872ec124c"><code>dcb947c</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3948">#3948</a>
from github/update-bundle/codeql-bundle-v2.25.6</li>
<li><a
href="https://github.com/github/codeql-action/commit/c251bcefa178f7780f62f150002acffe3d07fde9"><code>c251bce</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/62953c18b35f59e28351d2f1e806925aef8b1e3c"><code>62953c1</code></a>
Update default bundle to codeql-bundle-v2.25.6</li>
<li><a
href="https://github.com/github/codeql-action/commit/423b570baf1976cd7a3daeba5d6e9f9b76432f37"><code>423b570</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3946">#3946</a>
from github/dependabot/npm_and_yarn/npm-minor-5d507a...</li>
<li><a
href="https://github.com/github/codeql-action/commit/c35d1b164463ee62a100735382aaaa525c5d3496"><code>c35d1b1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3947">#3947</a>
from github/dependabot/github_actions/dot-github/wor...</li>
<li><a
href="https://github.com/github/codeql-action/commit/cb1a588b02755b176e7b9d033ed4b69312f0e1bd"><code>cb1a588</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3937">#3937</a>
from github/robertbrignull/waitForProcessing_backoff</li>
<li><a
href="https://github.com/github/codeql-action/commit/ba47406412c54532b5b4fcfbaf877c9e2382b206"><code>ba47406</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3943">#3943</a>
from github/henrymercer/cache-cli-version-info</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/c10b8064de6f491fea524254123dbe5e09572f13...8aad20d150bbac5944a9f9d289da16a4b0d87c1e">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Update the readme with direct upload details by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/795">actions/upload-artifact#795</a></li>
<li>Readme: bump all the example versions to v7 by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/796">actions/upload-artifact#796</a></li>
<li>Include changes in typespec/ts-http-runtime 0.3.5 by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/797">actions/upload-artifact#797</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v7...v7.0.1">https://github.com/actions/upload-artifact/compare/v7...v7.0.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"><code>043fb46</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/797">#797</a>
from actions/yacaovsnc/update-dependency</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/634250c1388765ea7ed0f053e636f1f399000b94"><code>634250c</code></a>
Include changes in typespec/ts-http-runtime 0.3.5</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/e454baaac2be505c9450e11b8f3215c6fc023ce8"><code>e454baa</code></a>
Readme: bump all the example versions to v7 (<a
href="https://redirect.github.com/actions/upload-artifact/issues/796">#796</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/74fad66b98a6d799dc004d3353ccd0e6f6b2530e"><code>74fad66</code></a>
Update the readme with direct upload details (<a
href="https://redirect.github.com/actions/upload-artifact/issues/795">#795</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/github-script` from 8.0.0 to 9.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/github-script/releases">actions/github-script's
releases</a>.</em></p>
<blockquote>
<h2>v9.0.0</h2>
<p><strong>New features:</strong></p>
<ul>
<li><strong><code>getOctokit</code> factory function</strong> —
Available directly in the script context. Create additional
authenticated Octokit clients with different tokens for multi-token
workflows, GitHub App tokens, and cross-org access. See <a
href="https://github.com/actions/github-script#creating-additional-clients-with-getoctokit">Creating
additional clients with <code>getOctokit</code></a> for details and
examples.</li>
<li><strong>Orchestration ID in user-agent</strong> — The
<code>ACTIONS_ORCHESTRATION_ID</code> environment variable is
automatically appended to the user-agent string for request
tracing.</li>
</ul>
<p><strong>Breaking changes:</strong></p>
<ul>
<li><strong><code>require('@actions/github')</code> no longer works in
scripts.</strong> The upgrade to <code>@actions/github</code> v9
(ESM-only) means <code>require('@actions/github')</code> will fail at
runtime. If you previously used patterns like <code>const { getOctokit }
= require('@actions/github')</code> to create secondary clients, use the
new injected <code>getOctokit</code> function instead — it's available
directly in the script context with no imports needed.</li>
<li><code>getOctokit</code> is now an injected function parameter.
Scripts that declare <code>const getOctokit = ...</code> or <code>let
getOctokit = ...</code> will get a <code>SyntaxError</code> because
JavaScript does not allow <code>const</code>/<code>let</code>
redeclaration of function parameters. Use the injected
<code>getOctokit</code> directly, or use <code>var getOctokit =
...</code> if you need to redeclare it.</li>
<li>If your script accesses other <code>@actions/github</code> internals
beyond the standard <code>github</code>/<code>octokit</code> client, you
may need to update those references for v9 compatibility.</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Add ACTIONS_ORCHESTRATION_ID to user-agent string by <a
href="https://github.com/Copilot"><code>@​Copilot</code></a> in <a
href="https://redirect.github.com/actions/github-script/pull/695">actions/github-script#695</a></li>
<li>ci: use deployment: false for integration test environments by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/github-script/pull/712">actions/github-script#712</a></li>
<li>feat!: add getOctokit to script context, upgrade
<code>@​actions/github</code> v9, <code>@​octokit/core</code> v7, and
related packages by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/github-script/pull/700">actions/github-script#700</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Copilot"><code>@​Copilot</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/github-script/pull/695">actions/github-script#695</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/github-script/compare/v8.0.0...v9.0.0">https://github.com/actions/github-script/compare/v8.0.0...v9.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/github-script/commit/3a2844b7e9c422d3c10d287c895573f7108da1b3"><code>3a2844b</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/github-script/issues/700">#700</a>
from actions/salmanmkc/expose-getoctokit + prepare re...</li>
<li><a
href="https://github.com/actions/github-script/commit/ca10bbdd1a7739de09e99a200c7a59f5d73a4079"><code>ca10bbd</code></a>
fix: use <code>@​octokit/core/</code>types import for v7
compatibility</li>
<li><a
href="https://github.com/actions/github-script/commit/86e48e20ac85c970ed1f96e718fd068173948b7b"><code>86e48e2</code></a>
merge: incorporate main branch changes</li>
<li><a
href="https://github.com/actions/github-script/commit/c1084728b5b935ec4ddc1e4cee877b01797b3ff9"><code>c108472</code></a>
chore: rebuild dist for v9 upgrade and getOctokit factory</li>
<li><a
href="https://github.com/actions/github-script/commit/afff112e4f8b57c718168af75b89ce00bc8d091d"><code>afff112</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/github-script/issues/712">#712</a>
from actions/salmanmkc/deployment-false + fix user-ag...</li>
<li><a
href="https://github.com/actions/github-script/commit/ff8117e5b78c415f814f39ad6998f424fee7b817"><code>ff8117e</code></a>
ci: fix user-agent test to handle orchestration ID</li>
<li><a
href="https://github.com/actions/github-script/commit/81c6b7876079abe10ff715951c9fc7b3e1ab389d"><code>81c6b78</code></a>
ci: use deployment: false to suppress deployment noise from integration
tests</li>
<li><a
href="https://github.com/actions/github-script/commit/3953caf8858d318f37b6cc53a9f5708859b5a7b7"><code>3953caf</code></a>
docs: update README examples from <a
href="https://github.com/v8"><code>@​v8</code></a> to <a
href="https://github.com/v9"><code>@​v9</code></a>, add getOctokit docs
and v9 brea...</li>
<li><a
href="https://github.com/actions/github-script/commit/c17d55b90dcdb3d554d0027a6c180a7adc2daf78"><code>c17d55b</code></a>
ci: add getOctokit integration test job</li>
<li><a
href="https://github.com/actions/github-script/commit/a047196d9a02fe92098771cafbb98c2f1814e408"><code>a047196</code></a>
test: add getOctokit integration tests via callAsyncFunction</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/github-script/compare/ed597411d8f924073f98dfc5c65a23a2325f34cd...3a2844b7e9c422d3c10d287c895573f7108da1b3">compare
view</a></li>
</ul>
</details>
<br />

Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/peter-evans/create-pull-request/releases">peter-evans/create-pull-request's
releases</a>.</em></p>
<blockquote>
<h2>Create Pull Request v8.1.1</h2>
<h2>What's Changed</h2>
<ul>
<li>build(deps-dev): bump the npm group with 2 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4305">peter-evans/create-pull-request#4305</a></li>
<li>build(deps): bump minimatch by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4311">peter-evans/create-pull-request#4311</a></li>
<li>build(deps): bump the github-actions group with 2 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4316">peter-evans/create-pull-request#4316</a></li>
<li>build(deps): bump <code>@​tootallnate/once</code> and
jest-environment-jsdom by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4323">peter-evans/create-pull-request#4323</a></li>
<li>build(deps-dev): bump undici from 6.23.0 to 6.24.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4328">peter-evans/create-pull-request#4328</a></li>
<li>build(deps-dev): bump flatted from 3.3.1 to 3.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4334">peter-evans/create-pull-request#4334</a></li>
<li>build(deps): bump picomatch by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4339">peter-evans/create-pull-request#4339</a></li>
<li>build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4344">peter-evans/create-pull-request#4344</a></li>
<li>build(deps-dev): bump the npm group with 3 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4349">peter-evans/create-pull-request#4349</a></li>
<li>fix: retry post-creation API calls on 422 eventual consistency
errors by <a
href="https://github.com/peter-evans"><code>@​peter-evans</code></a> in
<a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4356">peter-evans/create-pull-request#4356</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/peter-evans/create-pull-request/compare/v8.1.0...v8.1.1">https://github.com/peter-evans/create-pull-request/compare/v8.1.0...v8.1.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/5f6978faf089d4d20b00c7766989d076bb2fc7f1"><code>5f6978f</code></a>
fix: retry post-creation API calls on 422 eventual consistency errors
(<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4356">#4356</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/d32e88dac789dcc7906e7d26f69f24116fa9c97d"><code>d32e88d</code></a>
build(deps-dev): bump the npm group with 3 updates (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4349">#4349</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/8170bccad11c0df62542c04dcaefe36d342dfd39"><code>8170bcc</code></a>
build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4344">#4344</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/00418193b417f888dbf1d993c5c0d31d27fdc7de"><code>0041819</code></a>
build(deps): bump picomatch (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4339">#4339</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/b993918c8536b6d44706130734d5456879762b27"><code>b993918</code></a>
build(deps-dev): bump flatted from 3.3.1 to 3.4.2 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4334">#4334</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/36d7c8468b48f9c2f8f29e260e82f10d4b90d2bd"><code>36d7c84</code></a>
build(deps-dev): bump undici from 6.23.0 to 6.24.0 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4328">#4328</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/a45d1fb447fcaf601166e405fd4f335cde1a8aa8"><code>a45d1fb</code></a>
build(deps): bump <code>@​tootallnate/once</code> and
jest-environment-jsdom (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4323">#4323</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/3499eb61835cc0015c0b786e203d74b1e8f55e43"><code>3499eb6</code></a>
build(deps): bump the github-actions group with 2 updates (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4316">#4316</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/3f3b473b8c148f5a7520efb4d1f9a70eea3d9d1f"><code>3f3b473</code></a>
build(deps): bump minimatch (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4311">#4311</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/6699836a213cf8b28c4f0408a404a6ac79d4458a"><code>6699836</code></a>
build(deps-dev): bump the npm group with 2 updates (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4305">#4305</a>)</li>
<li>See full diff in <a
href="https://github.com/peter-evans/create-pull-request/compare/c0f553fe549906ede9cf27b5156039d195d2ece0...5f6978faf089d4d20b00c7766989d076bb2fc7f1">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/setup-node` from 6.3.0 to 6.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-node/releases">actions/setup-node's
releases</a>.</em></p>
<blockquote>
<h2>v6.4.0</h2>
<h2>What's Changed</h2>
<h3>Dependency updates:</h3>
<ul>
<li>Upgrade <a
href="https://github.com/actions"><code>@​actions</code></a>
dependencies by <a
href="https://github.com/Copilot"><code>@​Copilot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li>
<li>Update Node.js versions in versions.yml and bump package to v6.4.0
by <a
href="https://github.com/priya-kinthali"><code>@​priya-kinthali</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1533">actions/setup-node#1533</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Copilot"><code>@​Copilot</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-node/compare/v6...v6.4.0">https://github.com/actions/setup-node/compare/v6...v6.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-node/commit/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e"><code>48b55a0</code></a>
Update Node.js versions in versions.yml and bump package to v6.4.0 (<a
href="https://redirect.github.com/actions/setup-node/issues/1533">#1533</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/ab72c7e7eba0eaa11f8cab0f5679243900c2cac9"><code>ab72c7e</code></a>
Upgrade <a href="https://github.com/actions"><code>@​actions</code></a>
dependencies (<a
href="https://redirect.github.com/actions/setup-node/issues/1525">#1525</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-node/compare/53b83947a5a98c8d113130e565377fae1a50d02f...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Update the readme with direct upload details by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/795">actions/upload-artifact#795</a></li>
<li>Readme: bump all the example versions to v7 by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/796">actions/upload-artifact#796</a></...

_Description has been truncated_

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jérôme Prinet <jprinet@gradle.com>
 2026-06-09 10:49:31 +02:00
bot-githubaction a16ad4ab25 [bot] Update dist directory 2026-06-09 08:41:22 +00:00
github-actions[bot]GitHubbot-githubaction
 		e9965bd762 Update known wrapper checksums (#937) 
Automatically generated pull request to update the known wrapper
checksums.

In case of conflicts, manually run the workflow from the [Actions
tab](https://github.com/gradle/actions/actions/workflows/update-checksums-file.yml),
the changes will then be force-pushed onto this pull request branch.
Do not manually update the pull request branch; those changes might get
overwritten.

> [!IMPORTANT]  
> GitHub workflows have not been executed for this pull request yet.
Before merging, close and then directly reopen this pull request to
trigger the workflows.

Co-authored-by: bot-githubaction <bot-githubaction@gradle.com>
 2026-06-09 10:40:40 +02:00