Skip to content

Bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.5 in /.github/workflows in the github-actions group across 1 directory - #81287

Merged
desrosj merged 1 commit into
trunkfrom
dependabot/github_actions/dot-github/workflows/github-actions-478b1c0e64
Aug 10, 2026
Merged

Bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.5 in /.github/workflows in the github-actions group across 1 directory#81287
desrosj merged 1 commit into
trunkfrom
dependabot/github_actions/dot-github/workflows/github-actions-478b1c0e64

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 1 update in the /.github/workflows directory: github/codeql-action/upload-sarif.

Updates github/codeql-action/upload-sarif from 4.37.3 to 4.37.5

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.5

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v4.37.4

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051
Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

  • Update default CodeQL bundle version to 2.26.0. #3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

  • Cache CodeQL CLI version information across Actions steps. #3943
  • Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
  • Update default CodeQL bundle version to 2.25.6. #3948

... (truncated)

Commits
  • d1ba80a Merge pull request #4067 from github/update-v4.37.5-1cd4d01d5
  • e74600b Update changelog for v4.37.5
  • 1cd4d01 Merge pull request #4061 from github/henrymercer/turbo-system
  • d2bfc30 Merge pull request #4050 from github/mbg/status/registries
  • 68028fc Merge pull request #4062 from github/sam-robson/migrate-enterprise-release-pat
  • c29563e ci: use federated enterprise release PAT
  • 155e522 Link the PR from the changelog entry
  • 2d3b351 Handle network errors when streaming the CodeQL bundle download
  • 5d3eb98 Merge pull request #4055 from github/dependabot/npm_and_yarn/npm-minor-203262...
  • c5f739b Merge branch 'main' into dependabot/npm_and_yarn/npm-minor-2032624187
  • Additional commits viewable in compare view

@dependabot dependabot Bot added [Type] Build Tooling Issues or PRs related to build tooling GitHub Actions Pull requests that update GitHub Actions code labels Aug 6, 2026
@dependabot
dependabot Bot requested a review from desrosj as a code owner August 6, 2026 13:17
@dependabot dependabot Bot added [Type] Build Tooling Issues or PRs related to build tooling GitHub Actions Pull requests that update GitHub Actions code labels Aug 6, 2026
@github-actions

github-actions Bot commented Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Flaky tests detected in fde4cf7.
Some tests passed with failed attempts. The failures may not be related to this commit but are still reported for visibility. See the documentation for more information.

🔍 Workflow run URL: https://github.com/WordPress/gutenberg/actions/runs/31181903340
📝 Reported tests:

sort patterns in /test/e2e/specs/site-editor/patterns.spec.js, passed after 1 failed attempt. 
Error: apiRequestContext.fetch: socket hang up
Call log:
  - → POST http://localhost:8889/wp-json/wp/v2/blocks
    - user-agent: Playwright/1.62.1 (x64; ubuntu 24.04) node/20.20 CI/1
    - accept: */*
    - accept-encoding: gzip,deflate,br
    - X-WP-Nonce: 897e7431e0
    - content-type: application/json
    - content-length: 133
    - cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_23778236db82f19306f247e20a353a99=admin%7C1786281735%7CA4cKfiLVLMdbTWpbecTXBiPJfkfF0eHELQPd5zBcpb9%7Cde435f3b13aa7af8a1e625fb8ae8c59ca0e2148488076c143472391ec6347ebe; wp-settings-time-1=1786109715

    at RequestUtils.rest (/home/runner/work/gutenberg/gutenberg/packages/e2e-test-utils-playwright/src/request-utils/rest.ts:112:39)
    at RequestUtils.createRecord (/home/runner/work/gutenberg/gutenberg/packages/e2e-test-utils-playwright/src/request-utils/records.ts:20:14)
    at RequestUtils.createBlock (/home/runner/work/gutenberg/gutenberg/packages/e2e-test-utils-playwright/src/request-utils/blocks.ts:54:14)
    at /home/runner/work/gutenberg/gutenberg/test/e2e/specs/site-editor/patterns.spec.js:209:17

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/dot-github/workflows/github-actions-478b1c0e64 branch from cdffa5c to fde4cf7 Compare August 7, 2026 13:16
@dependabot
Bump github/codeql-action/upload-sarif
b16de09 
Bumps the github-actions group with 1 update in the /.github/workflows directory: [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/upload-sarif` from 4.37.3 to 4.37.5
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@e4fba86...d1ba80a)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4 in /.github/workflows in the github-actions group across 1 directory Bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.5 in /.github/workflows in the github-actions group across 1 directory Aug 10, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/dot-github/workflows/github-actions-478b1c0e64 branch from fde4cf7 to b16de09 Compare August 10, 2026 13:20
@github-actions

github-actions Bot commented Aug 10, 2026

Copy link
Copy Markdown

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: desrosj <desrosj@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@desrosj
desrosj merged commit 150c61e into trunk Aug 10, 2026
47 checks passed
@desrosj
desrosj deleted the dependabot/github_actions/dot-github/workflows/github-actions-478b1c0e64 branch August 10, 2026 16:17
@github-actions github-actions Bot added this to the Gutenberg 23.8 milestone Aug 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@desrosj desrosj desrosj approved these changes

Assignees

No one assigned

Labels

GitHub Actions Pull requests that update GitHub Actions code [Type] Build Tooling Issues or PRs related to build tooling

Projects

None yet

Milestone

Gutenberg 23.8

Development

Successfully merging this pull request may close these issues.

1 participant

@desrosj