…newlines-1.0.3

Bump trim-off-newlines from 1.0.2 to 1.0.3

Bumps [long](https://github.com/dcodeIO/long.js) from 4.0.0 to 5.2.0.
- [Release notes](https://github.com/dcodeIO/long.js/releases)
- [Commits](dcodeIO/long.js@4.0.0...v5.2.0)

---
updated-dependencies:
- dependency-name: long
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Mergeback v1.0.31 refs/heads/v1 into main

Ensure that all workflows are able to write security events.

Co-authored-by: Andrew Eisenberg <aeisenberg@github.com>

Bump long from 4.0.0 to 5.2.0

Bumps [@ava/typescript](https://github.com/avajs/typescript) from 2.0.0 to 3.0.1.
- [Release notes](https://github.com/avajs/typescript/releases)
- [Commits](avajs/typescript@v2.0.0...v3.0.1)

---
updated-dependencies:
- dependency-name: "@ava/typescript"
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Move a couple of entries for #889 that should have been in the
unreleased section but were inadvertently moved into the 1.0.31
release.

Fix changelog

Fix typo in error message

…cript-3.0.1

Upgrade AVA to v4

We report this information in the `init` status report rather than the
`analyze` status report so we can gather data about timeouts.

Declare the merge base as base for code scanning comparisons

When multiple ML-powered JS packs are in scope (an unsupported
scenario), the status report is "multiple".

Update default CodeQL version to 2.8.0

Some platforms that ingest this status report charge based on the
cardinality of the fields, so here we restrict the version strings we
support to a fixed set.

Also be more explicit about which version strings are reportable in
the code.

…ry-enablement

Report ML-powered query enablement in the `init` status report