#3712 chore(deps): bump the actions group with 6 updates Pull request opened by dependabot[bot] Bumps the actions group with 6 updates: | Package | From | To | | ----------------------------------------------------------------------------- | ------ | ------ | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | 8.3.1 | 8.3.2 | | [github/codeql-action/init](https://github.com/github/codeql-action) | 4.36.3 | 4.37.0 | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | 4.36.3 | 4.37.0 | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | 4.36.3 | 4.37.0 | | [CodSpeedHQ/action](https://github.com/codspeedhq/action) | 4.18.2 | 4.18.5 | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | 3.0.1 | 3.0.2 | Updates

astral-sh/setup-uv

from 8.3.1 to 8.3.2 Commits • `11f9893` chore: roll up Dependabot updates (#948) • `f798556` docs: update version references to v8.3.1 (#946) • `e80544d` chore: update known checksums for 0.11.28 (#947) • See full diff in compare view Updates

github/codeql-action/init

from 4.36.3 to 4.37.0 Release notes Sourced from github/codeql-action/init's releases.

v4.37.0

• Update default CodeQL bundle version to 2.26.0. #3995

• In addition to the existing input format, the

config-file

input for the

codeql-action/init

step will soon support a new

[owner/]repo[@ref][:path]

format. All components except the repository name are optional. If omitted,

owner

defaults to the same owner as the repository the analysis is running for,

ref

to

main

, and

path

to

.github/codeql-action.yaml

. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

Changelog Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.1 - 16 Jul 2026

• _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995

• In addition to the existing input format, the

config-file

input for the

codeql-action/init

step will soon support a new

[owner/]repo[@ref][:path]

format. All components except the repository name are optional. If omitted,

owner

defaults to the same owner as the repository the analysis is running for,

ref

to

main

, and

path

to

.github/codeql-action.yaml

. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943

• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• _Breaking change_: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

• Add support for SHA-256 Git object IDs. #3893

• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

• If multiple inputs are provided for the GitHub-internal

analysis-kinds

input, only

code-scanning

will be enabled. The

analysis-kinds

input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

... (truncated) Commits • `99df26d` Merge pull request #3996 from github/update-v4.37.0-c7c896d71 • `31c2707` Add changenote for #3973 • … meltano/sdk