Merge main into releases/v4#3905
Merged
Merged
Conversation
…is is unavailable
Bumps the npm-minor group with 4 updates in the / directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [eslint](https://github.com/eslint/eslint), [typescript](https://github.com/microsoft/TypeScript) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint). Updates `@types/node` from 20.19.9 to 20.19.39 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` from 9.39.2 to 9.39.4 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.2...v9.39.4) Updates `typescript` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v6.0.2...v6.0.3) Updates `typescript-eslint` from 8.58.2 to 8.59.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.59.1/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 20.19.39 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: eslint dependency-version: 9.39.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: typescript dependency-version: 6.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: typescript-eslint dependency-version: 8.59.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Do not run `bundle-metadata.ts` as part of `npm run build`
Tests: Run slow `scanArtifactsForTokens` test in CI only by default
Co-authored-by: Michael B. Gale <mbg@github.com>
…llback * origin/main: (40 commits) Bump the npm-minor group across 1 directory with 3 updates Bump actions/create-github-app-token Nit: Tweak JSDoc for `getRawLanguagesNoAutodetect` Enable only `code-scanning` Use overlay-aware version for code scanning exclusively Add changelog entry Rebuild Bump five transitive dependencies Throw error if multiple analysis kinds are specified Bump fast-xml-builder from 1.1.5 to 1.2.0 Improve tests Improve error message Remove dead code Remove `makeOverlayMatchFeatures` indirection Add JSDoc for `getRawLanguagesNoAutodetect` Enable overlay-aware version selection in `setup-codeql` Minor: Introduce constant to avoid duplication Improve changelog note Rebuild Update changelog and version after v4.35.4 ... # Conflicts: # lib/init-action.js # src/diff-informed-analysis-utils.test.ts
…tifacts Minify test debug artifacts
Fall back to non-overlay analysis when diff-informed analysis is unavailable
Reduce duplication across JS bundles by creating one bundle with smaller entry point wrappers
mbg
approved these changes
May 15, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This release PR merges recent main changes into releases/v4, preparing version 4.35.5. The changelog and package version are consistent with the release date of 15 May 2026.
Changes:
- Adds 4.35.5 changelog entries for bundle-size reduction, incremental analysis fallback behavior, internal
analysis-kindshandling, and overlay-aware CLI selection. - Bumps package version to
4.35.5and updates build/dependency metadata. - Includes generated bundle entry-point restructuring and related source/test updates from already-reviewed PRs.
Show a summary per file
| File | Description |
|---|---|
CHANGELOG.md |
Adds the 4.35.5 release notes and date. |
package.json |
Bumps package version and updates build/dependency declarations. |
package-lock.json |
Reflects version and dependency updates. |
build.mjs |
Updates bundling to use shared entry points and generated stubs. |
src/action-entry.js.tpl |
Adds template for generated action entry stubs. |
src/entry-wrapper.js.tpl |
Adds template for shared entry-point wrappers. |
autobuild/action.yml |
Points action metadata at new entry stub. |
analyze/action.yml |
Points action metadata at new entry stubs. |
init/action.yml |
Points action metadata at new entry stubs. |
resolve-environment/action.yml |
Points action metadata at new entry stub. |
setup-codeql/action.yml |
Adds setup inputs and points at new entry stub. |
start-proxy/action.yml |
Points action metadata at new entry stubs. |
upload-sarif/action.yml |
Points action metadata at new entry stubs. |
.github/workflows/codescanning-config-cli.yml |
Adjusts code scanning config test workflow expectations. |
.github/workflows/post-release-mergeback.yml |
Updates GitHub App token action version. |
.github/workflows/rollback-release.yml |
Updates GitHub App token action version. |
.github/workflows/update-release-branch.yml |
Updates GitHub App token action version. |
pr-checks/package.json |
Updates pr-check dependency versions. |
src/analyses.ts |
Restricts multiple analysis kinds outside test mode. |
src/analyses.test.ts |
Updates analysis-kind tests. |
src/analyze-action.ts |
Exports runWrapper for new entry-point structure. |
src/analyze-action-env.test.ts |
Calls exported analyze wrapper in tests. |
src/analyze-action-input.test.ts |
Calls exported analyze wrapper in tests. |
src/analyze-action-post.ts |
Exports post-action wrapper. |
src/artifact-scanner.ts |
Adds Windows guard for archive scanning. |
src/artifact-scanner.test.ts |
Skips unsupported archive test on Windows. |
src/autobuild-action.ts |
Exports action wrapper. |
src/codeql.ts |
Passes overlay-aware CLI selection inputs through setup. |
src/codeql.test.ts |
Updates tests for default CLI version shape. |
src/config-utils.ts |
Moves diff-informed preparation into config initialization. |
src/config-utils.test.ts |
Adds incremental analysis fallback tests. |
src/debug-artifacts.ts |
Removes unnecessary type assertion. |
src/diff-informed-analysis-utils.ts |
Adds diff range preparation helper. |
src/diff-informed-analysis-utils.test.ts |
Updates and adds diff-informed analysis tests. |
src/feature-flags.ts |
Adds feature flags and multi-version default CLI handling. |
src/feature-flags.test.ts |
Updates feature flag tests for enabled CLI versions. |
src/init.ts |
Passes CLI selection inputs into CodeQL setup. |
src/init-action.ts |
Uses new analysis-kind and diff-informed setup flow. |
src/init-action-post.ts |
Exports post-action wrapper. |
src/init-action-post-helper.test.ts |
Removes unnecessary type assertion. |
src/overlay/caching.ts |
Deduplicates resolved overlay cache languages. |
src/overlay/caching.test.ts |
Adds overlay cache language deduplication test. |
src/overlay/diagnostics.ts |
Adds overlay fallback disabled reason. |
src/resolve-environment-action.ts |
Exports action wrapper. |
src/setup-codeql.ts |
Adds overlay-aware default CLI version resolution. |
src/setup-codeql.test.ts |
Adds overlay-aware CLI selection tests. |
src/setup-codeql-action.ts |
Passes language and analysis-kind inputs to setup. |
src/start-proxy.ts |
Uses enabled default CLI version list. |
src/start-proxy.test.ts |
Updates proxy CLI version feature stub. |
src/start-proxy-action.ts |
Exports action wrapper. |
src/start-proxy-action-post.ts |
Exports post-action wrapper. |
src/testing-utils.ts |
Updates test helpers for default CLI version shape. |
src/upload-lib.ts |
Uses enabled default CLI versions for upload SARIF CLI setup. |
src/upload-sarif-action.ts |
Exports action wrapper. |
src/upload-sarif-action-post.ts |
Exports post-action wrapper. |
src/upload-sarif.test.ts |
Removes unnecessary type assertion. |
src/workflow.test.ts |
Removes unnecessary type assertion. |
lib/*.js |
Generated JavaScript outputs for the TypeScript/source changes. |
Copilot's findings
- Files reviewed: 56/81 changed files
- Comments generated: 0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merging d4b4855 into
releases/v4.Conductor for this PR is @mbg.
Contains the following pull requests:
scanArtifactsForTokenstest in CI only by default #3874 (@henrymercer)bundle-metadata.tsas part ofnpm run build#3884 (@mbg)code-scanningif multiple analysis kinds are specified #3892 (@mbg)Please do the following:
releases/v4branch.Create a merge commitis selected rather thanSquash and mergeorRebase and merge.