#3421 chore(deps): bump the actions group with 2 updates Pull request opened by dependabot[bot] Bumps the actions group with 2 updates: github/codeql-action and actions/attest-build-provenance. Updates

github/codeql-action

from 4.31.8 to 4.31.9 Release notes Sourced from github/codeql-action's releases.

## v4.31.9

# CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

## 4.31.9 - 16 Dec 2025

No user facing changes.

See the full CHANGELOG.md for more information.

Changelog Sourced from github/codeql-action's changelog.

# CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

## [UNRELEASED]

No user facing changes.

## 4.31.9 - 16 Dec 2025

No user facing changes.

## 4.31.8 - 11 Dec 2025

• Update default CodeQL bundle version to 2.23.8. #3354

## 4.31.7 - 05 Dec 2025

• Update default CodeQL bundle version to 2.23.7. #3343

## 4.31.6 - 01 Dec 2025

No user facing changes.

## 4.31.5 - 24 Nov 2025

• Update default CodeQL bundle version to 2.23.6. #3321

## 4.31.4 - 18 Nov 2025

No user facing changes.

## 4.31.3 - 13 Nov 2025

• CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see Upcoming deprecation of CodeQL Action v3.

• Update default CodeQL bundle version to 2.23.5. #3288

## 4.31.2 - 30 Oct 2025

No user facing changes.

## 4.31.1 - 30 Oct 2025

• The

add-snippets

input has been removed from the

analyze

action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.

## 4.31.0 - 24 Oct 2025

• Bump minimum CodeQL bundle version to 2.17.6. #3223

• When SARIF files are uploaded by the

analyze

or

upload-sarif

actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the

upload-sarif

action. For

analyze

, this may affect Advanced Setup for CodeQL users who specify a value other than

always

for the

upload

input. #3222

... (truncated) Commits • `5d4e8d1` Merge pull request #3371 from github/update-v4.31.9-998798e34 • `1dc115f` Update changelog for v4.31.9 • `998798e` Merge pull request #3352 from github/nickrolfe/jar-min-ff-cleanup • `5eb7519` Merge pull request #3358 from github/henrymercer/database-upload-telemetry • `d29eddb` Extract version number to constant • `e962687` Merge branch 'main' into henrymercer/database-upload-telemetry • `19c7f96` Rename

isOverlayBase

• `ae5de9a` Use

getErrorMessage

in log too • `0cb8633` Prefer

performance.now()

• `c07cc0d` Merge pull request #3351 from github/henrymercer/ghec-dr-determine-tools-vers... • Additional commits viewable in compare view Updates

actions/attest-build-provenance

from 3.0.0 to 3.1.0 Release notes Sourced from actions/attest-build-provenance's releases.

## v3.1.0

## What's Changed

• Prepare v3 release by `@​bdehamer` in actions/attest-build-provenance#697

• Bump js-yaml from 3.14.1 to 3.14.2 by `@​dependabot`[bot] in actions/attest-build-provenance#749

• Bump tar from 7.5.1 to 7.5.2 by `@​dependabot`[bot] in actions/attest-build-provenance#753

• Bump glob from 10.4.5 to 10.5.0 by `@​dependabot`[bot] in actions/attest-build-provenance#754

• Bump

@​types/node

from 24.10.1 to 25.0.2 by `@​dependabot`[bot] in actions/attest-build-provenance#774

• Bump

@​actions/attest

from 1.6.0 to 2.0.0 by `@​dependabot`[bot] in actions/attest-build-provenance#736

• Bump

@​actions/attest

from 2.0.0 to 2.1.0 by `@​dependabot`[bot] in actions/attest-build-provenance#775

• Add support for creating artifact metadata storage records by `@​malancas` in actions/attest-build-provenance#779

## New Contributors

• `@​malancas` made their first contribution in actions/attest-build-provenance#779

Full Changelog: actions/attest-build-provenance@v3...v3.1.0

Commits • `00014ed` Add support for creating artifact metadata storage records (#779) • <https://github.com/actions/attest-build-provenance/commit/8835c60c52cafa… meltano/sdk