Skip to content

[UPDATE] (deps): Bump github/codeql-action from 4.35.4 to 4.36.1 in /.github/workflows#128

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/dot-github/workflows/master/github/codeql-action-4.36.1
Closed

[UPDATE] (deps): Bump github/codeql-action from 4.35.4 to 4.36.1 in /.github/workflows#128
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/dot-github/workflows/master/github/codeql-action-4.36.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 3, 2026

Copy link
Copy Markdown
Contributor

Bumps github/codeql-action from 4.35.4 to 4.36.1.

Release notes

Sourced from github/codeql-action's releases.

v4.36.1

No user facing changes.

v4.36.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
  • Add support for SHA-256 Git object IDs. #3893
  • Update default CodeQL bundle version to 2.25.5. #3926

v4.35.5

  • We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
  • For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
  • If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
  • Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880
Commits
  • 87557b9 Merge pull request #3940 from github/update-v4.36.1-2a1689ed4
  • 9431011 Update changelog for v4.36.1
  • 2a1689e Merge pull request #3939 from github/henrymercer/skip-overlay-revert-when-exp...
  • 5245323 Disable missing diff-ranges fallback when overlay enabled manually
  • d1eb120 Merge pull request #3933 from github/update-supported-enterprise-server-versions
  • 115001b Merge pull request #3934 from github/dependabot/npm_and_yarn/npm-minor-86fb5c...
  • cef2e7a Merge pull request #3925 from github/dependabot/github_actions/dot-github/wor...
  • 5e6adf7 Merge pull request #3936 from github/dependabot/npm_and_yarn/tmp-0.2.7
  • ad170e6 Merge branch 'main' into dependabot/github_actions/dot-github/workflows/actio...
  • 6a37b3a Rebuild
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.36.1.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Commits](github/codeql-action@v4.35.4...v4.36.1)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.36.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added this to the Version 1.1.5 milestone Jun 3, 2026
@dependabot dependabot Bot added Configs Improvements or additions to configuration GitHub Anything Meta Python Repo Anything Project Related Testing Something can be verified Version Update Indicates that the pull request is related to updating the version of a dependency. labels Jun 3, 2026
@deepsource-io

deepsource-io Bot commented Jun 3, 2026

Copy link
Copy Markdown

DeepSource Code Review

We reviewed changes in c22d276...6e0d455 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade   Security  

Reliability  

Complexity  

Hygiene  

Code Review Summary

Analyzer Status Updated (UTC) Details
Python Jun 3, 2026 6:37p.m. Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

@github-actions github-actions Bot added the CI Continuous Integration Tooling label Jun 3, 2026
@sonarqubecloud

sonarqubecloud Bot commented Jun 3, 2026

Copy link
Copy Markdown

@dependabot @github

dependabot Bot commented on behalf of github Jun 9, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #130.

@dependabot dependabot Bot closed this Jun 9, 2026
@dependabot dependabot Bot deleted the dependabot/github_actions/dot-github/workflows/master/github/codeql-action-4.36.1 branch June 9, 2026 00:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CI Continuous Integration Tooling Configs Improvements or additions to configuration GitHub Anything Meta Python Repo Anything Project Related Testing Something can be verified Version Update Indicates that the pull request is related to updating the version of a dependency.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant