Merge main into releases/v4#3782
Merged
henrymercer merged 10 commits intoreleases/v4from Mar 27, 2026
Merged
Conversation
Bumps [node-forge](https://github.com/digitalbazaar/forge) from 1.3.3 to 1.4.0. - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@v1.3.3...v1.4.0) --- updated-dependencies: - dependency-name: node-forge dependency-version: 1.4.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Mergeback v4.35.0 refs/heads/releases/v4 into main
…ge-1.4.0 Bump node-forge from 1.3.3 to 1.4.0
…ersion Update minimum Git version for overlay to 2.36.0
henrymercer
approved these changes
Mar 27, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Release-branch merge bringing recent main changes into releases/v4, including the 4.35.1 version bump and dependency/overlay-related updates.
Changes:
- Bump action version to 4.35.1 and update the CHANGELOG for the release.
- Update the minimum Git version required for overlay/improved incremental analysis to 2.36.0.
- Bump node-forge to 1.4.0 (security fixes) and update lockfile; regenerate distribution files in
lib/.
Reviewed changes
Copilot reviewed 15 out of 16 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/git-utils.ts | Updates overlay minimum Git version constant and related comments. |
| package.json | Bumps package version to 4.35.1 and updates node-forge dependency. |
| package-lock.json | Locks updated package version and node-forge 1.4.0 metadata. |
| CHANGELOG.md | Adds 4.35.1 release notes entry. |
| lib/upload-sarif-action.js | Generated distribution update (version string). |
| lib/upload-sarif-action-post.js | Generated distribution update (version string). |
| lib/upload-lib.js | Generated distribution update (version string). |
| lib/start-proxy-action.js | Generated distribution update (node-forge changes + version string). |
| lib/start-proxy-action-post.js | Generated distribution update (version string). |
| lib/setup-codeql-action.js | Generated distribution update (version string). |
| lib/resolve-environment-action.js | Generated distribution update (version string). |
| lib/init-action.js | Generated distribution update (version string + min Git version constant). |
| lib/init-action-post.js | Generated distribution update (version string). |
| lib/autobuild-action.js | Generated distribution update (version string). |
| lib/analyze-action.js | Generated distribution update (version string). |
| lib/analyze-action-post.js | Generated distribution update (version string). |
|
|
||
| ## 4.35.0 - 27 Mar 2026 | ||
|
|
||
| - Reduced the minimum Git version required for [improved incremental analysis](https://github.com/github/roadmap/issues/1158) from 2.38.0 to 2.11.0. [#3767](https://github.com/github/codeql-action/pull/3767) |
There was a problem hiding this comment.
The 4.35.0 entry still states the minimum Git version for improved incremental analysis was reduced to 2.11.0, but this PR indicates the correct minimum is 2.36.0. Consider correcting the 4.35.0 release note (or otherwise preventing readers from being misled) rather than only adding a 4.35.1 correction entry.
Suggested change
| - Reduced the minimum Git version required for [improved incremental analysis](https://github.com/github/roadmap/issues/1158) from 2.38.0 to 2.11.0. [#3767](https://github.com/github/codeql-action/pull/3767) | |
| - Reduced the minimum Git version required for [improved incremental analysis](https://github.com/github/roadmap/issues/1158) from 2.38.0 to 2.36.0. [#3767](https://github.com/github/codeql-action/pull/3767) |
|
|
||
| ## 4.35.1 - 27 Mar 2026 | ||
|
|
||
| - Fix incorrect minimum required Git version for [improved incremental analysis](https://github.com/github/roadmap/issues/1158): it should have been 2.36.0, not 2.11.0. [#3781](https://github.com/github/codeql-action/pull/3781) |
There was a problem hiding this comment.
The 4.35.1 changelog entry is missing the node-forge dependency security update (PR #3775). Since this release bumps node-forge to 1.4.0 to address multiple high-severity issues, it should be captured as a user-facing change (at least as a security/dependency update) in the 4.35.1 section.
Suggested change
| - Fix incorrect minimum required Git version for [improved incremental analysis](https://github.com/github/roadmap/issues/1158): it should have been 2.36.0, not 2.11.0. [#3781](https://github.com/github/codeql-action/pull/3781) | |
| - Fix incorrect minimum required Git version for [improved incremental analysis](https://github.com/github/roadmap/issues/1158): it should have been 2.36.0, not 2.11.0. [#3781](https://github.com/github/codeql-action/pull/3781) | |
| - Updated the `node-forge` dependency to version 1.4.0 to address multiple high-severity security issues. [#3775](https://github.com/github/codeql-action/pull/3775) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merging d6d1743 into
releases/v4.Conductor for this PR is @henrymercer.
Contains the following pull requests:
Please do the following:
releases/v4branch.Create a merge commitis selected rather thanSquash and mergeorRebase and merge.