Merge releases/v4 into releases/v3 - #3590
Merged
oscarsj merged 53 commits intoMar 20, 2026
Merged
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
…nge-absolute-path-conversion * origin/main: (32 commits) Add changelog note Update default bundle to codeql-bundle-v2.24.3 Bump tar from 7.5.7 to 7.5.10 Rebuild Rebuild Bump actions/upload-artifact from 6 to 7 in /.github/workflows Bump actions/download-artifact from 7 to 8 in /.github/workflows Bump the npm-minor group with 2 updates Fix some tests that should be serial Update method naming and JSDoc Rename to `EnabledOverlayConfig` Address review comments Use `Result`s for enablement return types Add disabled by env var disablement reason Rename to `usesDefaultQueriesOnly` Update `NonDefaultQueries` documentation Refactor `getOverlayDatabaseMode` and add new disablement reason Address review comments Add JSDoc Sort `OverlayDisabledReason` enum ...
Mergeback v4.33.0 refs/heads/releases/v4 into main
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.4.1 to 5.5.6. - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.4.1...v5.5.6) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.5.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…rsion * main: (112 commits) Rebuild Update changelog and version after v4.33.0 Add changelog entry for #3570 Bump minor version Update changelog for v4.32.7 Only emit one message with accumulated property names Remove `cache-dependency-path` options as well Remove `package-lock.json` that's no longer needed Add step (in root directory) to install dependencies Add explicit cache dependency paths in `pr-checks.yml` Fix linter errors in `sync-back.test.ts` Fix linter errors in `sync-back.ts` Rename `sync_back` to `sync-back` Fix linter errors in `sync.ts` Add eslint configuration for `pr-checks` Add minimal `Step` type Add `workspaces` to root `package.json` Avoid bundling `package.json` Move `ava` config out of `package.json` Emit warning for unrecognised repo properties with our common prefix ... # Conflicts: # lib/init-action-post.js
…e-path-conversion Move conversion of PR diff-range paths to absolute paths
…-parser-5.5.6 Bump fast-xml-parser from 5.4.1 to 5.5.6
# Conflicts: # lib/start-proxy-action.js
Copy link
Copy Markdown
Contributor
Author
|
Pushed a commit to rebuild the Action. Please mark the PR as ready for review to trigger PR checks. |
Sorry, something went wrong.
Copy link
Copy Markdown
Contributor
There was a problem hiding this comment.
Pull request overview
Merges changes from releases/v4 into releases/v3, bringing the releases/v3 line up to the 3.34.0 release content (including overlay/TRAP caching adjustments, diff-informed analysis path handling changes, dependency bumps, and related test/data updates).
Changes:
- Update diff-informed analysis diff-range handling so JSON diff ranges are relative paths, while the generated extension pack continues to use absolute paths.
- Add/extend overlay analysis feature flags (including C/C++ minimum version) and introduce a feature-flagged behavior to disable TRAP caching when overlay analysis is enabled.
- Bump the default CodeQL bundle to 2.25.0 and update the release changelog/workflows/dependencies accordingly.
Reviewed changes
Copilot reviewed 22 out of 35 changed files in this pull request and generated no comments.
Show a summary per file| File | Description |
|---|---|
| src/upload-lib.ts | Exports and updates diff-range alert filtering to compare against relative SARIF URIs. |
| src/upload-lib.test.ts | Adds unit test coverage for diff-range filtering behavior. |
| src/testing-utils.ts | Extends default Actions env vars used in tests (adds RUNNER_NAME). |
| src/testdata/valid-sarif-diff-filtered.sarif | Adds expected SARIF output after diff-range filtering. |
| src/testdata/pr-diff-range.yml | Adds expected YAML extension-pack output fixture. |
| src/overlay/index.ts | Adds per-language minimum version constant for C/C++ overlay. |
| src/init-action.ts | Removes TRAP caching/env-var logic from init in favor of config-utils handling. |
| src/feature-flags.ts | Adds overlay flags for C/C++ and a feature flag to disable TRAP caching under overlay; reorganizes overlay-related flags. |
| src/diff-informed-analysis-utils.ts | Changes diff ranges to record relative paths instead of absolute paths. |
| src/diff-informed-analysis-utils.test.ts | Updates tests to assert relative diff-range paths. |
| src/defaults.json | Bumps default CLI/bundle versions to 2.25.0 and updates “prior” versions. |
| src/config-utils.ts | Centralizes TRAP caching enablement logic and C/C++ TRAP caching env var setting; conditionally downloads TRAP caches. |
| src/config-utils.test.ts | Adds unit tests for TRAP caching enablement behavior (hosted vs self-hosted, overlay flag gating). |
| src/codeql.ts | Simplifies database cleanup flag usage to always use --cache-cleanup. |
| src/analyze.ts | Moves absolute-path conversion for diff-range extension pack generation into analyze-time pack creation. |
| src/analyze.test.ts | Adds unit test for extension-pack content generation. |
| package.json | Bumps action version to 3.34.0 and updates dev dependency versions. |
| package-lock.json | Updates lockfile for dependency bumps (but currently has a version mismatch vs package.json). |
| lib/upload-lib.js | Generated distribution update corresponding to src changes (not reviewed). |
| lib/defaults.json | Generated distribution update corresponding to src defaults.json (not reviewed). |
| CHANGELOG.md | Adds 3.34.0 entry with user-facing changes and bundle update note. |
| .github/workflows/update-release-branch.yml | Bumps actions/create-github-app-token to v3.0.0. |
| .github/workflows/rollback-release.yml | Bumps actions/create-github-app-token to v3.0.0. |
| .github/workflows/post-release-mergeback.yml | Bumps actions/create-github-app-token to v3.0.0. |
Sorry, something went wrong.
oscarsj
approved these changes
Mar 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merging c6f9311 into releases/v3.
Conductor for this PR is @oscarsj.
Contains the following pull requests:
Please do the following: