chore: Bump the "dependencies" group with 2 updates across multiple ecosystems by dependabot[bot] · Pull Request #14 · OrcaCD/deploy-action

dependabot · 2026-07-21T06:09:40Z

Bumps the dependencies group with 4 updates: oxfmt, oxlint, oxlint-tsgolint and rolldown.

Updates oxfmt from 0.58.0 to 0.59.0

Changelog

[0.59.0] - 2026-07-13

🐛 Bug Fixes

415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#22965) (Boshen)

f88961a oxfmt: Annotate each config option with supported languages (#22953) (leaysgur)

[0.52.0] - 2026-05-26

🚀 Features

16b8058 oxfmt: Support vite-plus/resolveConfig for vite.config.ts (#22454) (leaysgur)

[0.50.0] - 2026-05-15

🐛 Bug Fixes

43b9978 formatter/sort_imports: Treat subpath imports as internal (#22440) (leaysgur)

[0.49.0] - 2026-05-11

🚀 Features

6e8e818 oxfmt: Experimental .svelte support (#21700) (leaysgur)

[0.45.0] - 2026-04-13

🐛 Bug Fixes

50c389b oxfmt: Support .editorconfig quote_type (#20989) (leaysgur)

[0.44.0] - 2026-04-06

🐛 Bug Fixes

dd2df87 npm: Export package.json for oxlint and oxfmt (#20784) (kazuya kawaguchi)

4216380 oxfmt: Support .editorconfig tab_width fallback (#20988) (leaysgur)

... (truncated)

Commits

2d4e8d2 release(apps): oxlint v1.74.0 && oxfmt v0.59.0 (#24454)
415fe1e fix(oxfmt): error on ignorePatterns that cannot match files outside the confi...
See full diff in compare view

Updates oxlint from 1.73.0 to 1.74.0

Release notes

Sourced from oxlint's releases.

oxlint v1.27.0 && oxfmt v0.12.0

Oxlint v1.27.0

🚀 Features

222a8f0 linter/plugins: Implement SourceCode#isSpaceBetween (#15498) (overlookmotel)

2f9735d linter/plugins: Implement context.languageOptions (#15486) (overlookmotel)

bc731ff linter/plugins: Stub out all Context APIs (#15479) (overlookmotel)

5822cb4 linter/plugins: Add extend method to FILE_CONTEXT (#15477) (overlookmotel)

7b1e6f3 apps: Add pure rust binaries and release to github (#15469) (Boshen)

2a89b43 linter: Introduce debug assertions after fixes to assert validity (#15389) (camc314)

ad3c45a editor: Add oxc.path.node option (#15040) (Sysix)

🐛 Bug Fixes

6f3cd77 linter/no-var: Incorrect warning for blocks (#15504) (Hamir Mahal)

6957fb9 linter/plugins: Do not allow access to Context#id in createOnce (#15489) (overlookmotel)

7409630 linter/plugins: Allow access to cwd in createOnce in ESLint interop mode (#15488) (overlookmotel)

732205e parser: Reject using / await using in a switch case / default clause (#15225) (sapphi-red)

a17ca32 linter/plugins: Replace Context class (#15448) (overlookmotel)

ecf2f7b language_server: Fail gracefully when tsgolint executable not found (#15436) (camc314)

3c8d3a7 lang-server: Improve logging in failure case for tsgolint (#15299) (camc314)

ef71410 linter: Use jsx if source type is JS in fix debug assertion (#15434) (camc314)

e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (#15426) (camc314)

6565dbe linter/switch-case-braces: Skip comments when searching for : token (#15425) (camc314)

85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (#15423) (camc314)

fde753e linter/plugins: Block access to context.settings in createOnce (#15394) (overlookmotel)

ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (#15388) (camc314)

dac2a9c linter/no-template-curly-in-string: Remove fixer (#15387) (camc314)

989b8e3 linter/no-var: Only fix to const if the var has an initializer (#15385) (camc314)

cc403f5 linter/plugins: Return empty object for unimplemented parserServices (#15364) (magic-akari)

⚡ Performance

25d577e language_server: Start tools in parallel (#15500) (Sysix)

3c57291 linter/plugins: Optimize loops (#15449) (overlookmotel)

3166233 linter/plugins: Remove Arcs (#15431) (overlookmotel)

9de1322 linter/plugins: Lazily deserialize settings JSON (#15395) (overlookmotel)

3049ec2 linter/plugins: Optimize deepFreezeSettings (#15392) (overlookmotel)

444ebfd linter/plugins: Use single object for parserServices (#15378) (overlookmotel)

📚 Documentation

97d2104 linter: Update comment in lint.rs about default value for tsconfig path (#15530) (Connor Shea)

2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (#15411) (sapphi-red)

a0c5203 linter/import/named: Update "ES7" comment in examples (#15410) (sapphi-red)

3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (#15409) (sapphi-red)

2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (#15408) (sapphi-red)

57f0ce1 linter: Add backquotes where appropriate (#15407) (sapphi-red)

Oxfmt v0.12.0

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.74.0] - 2026-07-13

🚀 Features

0433a83 linter/eslint/no-inner-declarations: Add namespaces option (#24044) (Boshen)

🐛 Bug Fixes

8337835 linter: Error on ignorePatterns that cannot match files aoutside the config directory (#24341) (leaysgur)

2ce5a33 linter: Resolve ignorePatterns relative to the config dir (#24339) (leaysgur)

⚡ Performance

7f80cac linter/vue/prop-name-casing: Precompile ignoreProps regex pattern (#24413) (connorshea)

6272051 linter/typescript/no-require-imports: Compile allow patterns once (#24417) (connorshea)

33805b9 linter/jsdoc/require-param: Compile checkTypesPattern regex once (#24420) (connorshea)

Commits

2d4e8d2 release(apps): oxlint v1.74.0 && oxfmt v0.59.0 (#24454)
7f80cac perf(linter/vue/prop-name-casing): precompile ignoreProps regex pattern (#2...
6272051 perf(linter/typescript/no-require-imports): compile allow patterns once (#24417)
33805b9 perf(linter/jsdoc/require-param): compile checkTypesPattern regex once (#24420)
0433a83 feat(linter/eslint/no-inner-declarations): add namespaces option (#24044)
8337835 fix(linter): error on ignorePatterns that cannot match files aoutside the c...
2ce5a33 fix(linter): resolve ignorePatterns relative to the config dir (#24339)
See full diff in compare view

Updates oxlint-tsgolint from 0.24.0 to 0.25.0

Release notes

Sourced from oxlint-tsgolint's releases.

v0.25.0

What's Changed

chore(deps): update pnpm to v11.9.0 by @renovate[bot] in oxc-project/tsgolint#1043

perf(no-unnecessary-type-parameters): reuse AST-walk visitor closure by @connorshea in oxc-project/tsgolint#1034

perf(strict-void-return): reuse function-body walk visitor closure by @connorshea in oxc-project/tsgolint#1033

chore: update typescript-go submodule by @camc314 in oxc-project/tsgolint#1048

docs: normalize README sponsor section by @Boshen in oxc-project/tsgolint#1050

chore: strip symbols from release binary by @Boshen in oxc-project/tsgolint#1049

chore: add -trimpath to release build by @Boshen in oxc-project/tsgolint#1051

chore(deps): update crate-ci/typos action to v1.48.0 by @renovate[bot] in oxc-project/tsgolint#1052

chore(deps): update github actions by @renovate[bot] in oxc-project/tsgolint#1056

chore(deps): update npm packages by @renovate[bot] in oxc-project/tsgolint#1057

fix(no-deprecated): avoid contextual union property false positives by @camc314 in oxc-project/tsgolint#1059

fix(prefer-optional-chain): preserve negated optional guard by @camc314 in oxc-project/tsgolint#1061

perf(linter): gate reportNodeWithSuggestions on FixSuggestions by @connorshea in oxc-project/tsgolint#1067

fix(switch-exhaustiveness-check): honor default case comment patterns by @camc314 in oxc-project/tsgolint#1070

perf(strict-void-return): skip type queries for never-callable expressions by @connorshea in oxc-project/tsgolint#1068

perf(no-unsafe-argument): skip type queries for never-unsafe arguments by @connorshea in oxc-project/tsgolint#1066

Revert "perf(strict-void-return): skip type queries for never-callable expressions" by @camc314 in oxc-project/tsgolint#1071

chore: update typescript-go submodule by @camc314 in oxc-project/tsgolint#1072

chore(deps): update dependency dprint-json to v0.23.0 by @renovate[bot] in oxc-project/tsgolint#1080

chore(deps): update taiki-e/install-action action to v2.83.0 by @renovate[bot] in oxc-project/tsgolint#1082

chore(deps): update gomod by @renovate[bot] in oxc-project/tsgolint#1081

perf(no-unnecessary-type-arguments): skip signature resolution when node has no type arguments by @connorshea in oxc-project/tsgolint#1064

refactor: miscellaneous code cleanup by @connorshea in oxc-project/tsgolint#1077

refactor: remove dead code from rules by @connorshea in oxc-project/tsgolint#1079

refactor: drop dead isFunction guards built on a bitwise ast.Kind mask by @connorshea in oxc-project/tsgolint#1078

chore: update Node.js to 26.5.0 by @camc314 in oxc-project/tsgolint#1087

fix(no-unnecessary-type-assertion): avoid recursive unknown checks by @camc314 in oxc-project/tsgolint#1086

fix(no-unnecessary-type-assertions): generic array false positive by @camc314 in oxc-project/tsgolint#1045

fix(no-unnecessary-type-assertion): preserve generic write casts by @camc314 in oxc-project/tsgolint#1089

docs: update sponsor section by @Boshen in oxc-project/tsgolint#1090

Full Changelog: oxc-project/tsgolint@v0.24.0...v0.25.0

Commits

1abf9a5 docs: update sponsor section
6ee7c11 fix(no-unnecessary-type-assertion): preserve generic write casts (#1089)
e23cc83 fix(no-unnecessary-type-assertions): generic array false positive (#1045)
c3269c0 fix(no-unnecessary-type-assertion): avoid recursive unknown checks (#1086)
c214d5c chore: update Node.js to 26.5.0 (#1087)
002b818 refactor: drop dead isFunction guards built on a bitwise ast.Kind mask (#1078)
d6a1cb2 refactor: remove dead code from rules (#1079)
7823d59 refactor: miscellaneous code cleanup (#1077)
fcf43ff perf(no-unnecessary-type-arguments): skip signature resolution when node has ...
6875914 chore(deps): update gomod (#1081)
Additional commits viewable in compare view

Updates rolldown from 1.1.5 to 1.2.0

Release notes

Sourced from rolldown's releases.

v1.2.0

[1.2.0] - 2026-07-15

🚀 Features

dev: skip shipping factories for newly imported top-level modules (#10223) by @h-a-n-a

dev: per-client ship map for HMR patch sizing (#10208) by @h-a-n-a

dev: client-side HMR (#10164) by @h-a-n-a

dev: send a full-reload update to clients when a tsconfig changes (#10262) by @shulaoda

treat import.meta['url'] and import.meta['ROLLUP_FILE_URL_*'] as side-effect free (#10267) by @sapphi-red

rewrite import.meta['url'] (#10251) by @sapphi-red

add FILE_NOT_FOUND error (#10220) by @sapphi-red

treat import.meta.ROLLUP_FILE_URL_* as side-effect free (#10217) by @sapphi-red

🐛 Bug Fixes

sourcemap: preserve unmapped boundaries during composition (#10254) by @hyfdev

[format] in *FileNames option for ESM format should be es instead of esm (#10214) by @sapphi-red

sourcemap: preserve coarse mappings during composition (#10249) by @hyfdev

rolldown_plugin_vite_import_glob: support tsconfig paths with import.meta.glob (#10167) by @sapphi-red

dev: clear tsconfig caches for bare full builds (#10276) by @shulaoda

dev: force a full rebuild when a tsconfig changes (#10261) by @shulaoda

treat rooted drive-less module ids as absolute in preserveModules naming (#10235) by @IWANABETHATGUY

watch: rebuild when tsconfig files change (#10258) by @shulaoda

watch: drop tsconfig-merged transform options on each rebuild (#10257) by @shulaoda

incorrect EMPTY_IMPORT_META warning for import.meta.ROLLUP_FILE_URL_* for CJS output (#10221) by @sapphi-red

deconflict: rename CJS locals shadowing wrapped-ESM namespace objects (#9970) by @IWANABETHATGUY

rolldown: drop the unused runtime module after entry-level external flattening (#10237) by @IWANABETHATGUY

rolldown: re-propagate has_dynamic_exports to transitive star importers (#10239) by @IWANABETHATGUY

tree-shaking: tree-shake destructured dynamic import namespace bindings (#10213) by @logaretm

s390x: use json-escape-simd 3.1.1 for big-endian JSON escaping fix (#10211) by @satyamg1620

🚜 Refactor

dev: move full-reload to client side (#10207) by @h-a-n-a

readability follow-ups to the ReplaceWith migration (#10286) by @IWANABETHATGUY

replace take_in-then-write-back with ReplaceWith and by-value moves (#10285) by @Boshen

share the main resolver's cache with the transformer's tsconfig lookups (#10205) by @shulaoda

rolldown: extract the ns star-external __reExport emission rule into LinkingMetadata (#10238) by @IWANABETHATGUY

rolldown: unify link/generate diagnostics into a Diagnostics accumulator (#10234) by @IWANABETHATGUY

sourcemap_filenames: drop dead sourcemap-filename plumbing (#10189) by @IWANABETHATGUY

extract external import symbol merging into a method (#10224) by @IWANABETHATGUY

rolldown: skip CJS namespace merging under strict execution order (#10203) by @hyfdev

resolve the manual tsconfig per file instead of once at startup (#10200) by @shulaoda

rolldown: route interop ESM init emission through a shared init-target view (#10202) by @hyfdev

rolldown: collapse vestigial wrap-kind state and share chunk sort helper (#10201) by @hyfdev

📚 Documentation

show plugin kinds in JSDoc and each hook's description (#10218) by @sapphi-red

... (truncated)

Changelog

Sourced from rolldown's changelog.

[1.2.0] - 2026-07-15

🚀 Features

dev: skip shipping factories for newly imported top-level modules (#10223) by @h-a-n-a

dev: per-client ship map for HMR patch sizing (#10208) by @h-a-n-a

dev: client-side HMR (#10164) by @h-a-n-a

dev: send a full-reload update to clients when a tsconfig changes (#10262) by @shulaoda

treat import.meta['url'] and import.meta['ROLLUP_FILE_URL_*'] as side-effect free (#10267) by @sapphi-red

rewrite import.meta['url'] (#10251) by @sapphi-red

add FILE_NOT_FOUND error (#10220) by @sapphi-red

treat import.meta.ROLLUP_FILE_URL_* as side-effect free (#10217) by @sapphi-red

🐛 Bug Fixes

sourcemap: preserve unmapped boundaries during composition (#10254) by @hyfdev

[format] in *FileNames option for ESM format should be es instead of esm (#10214) by @sapphi-red

sourcemap: preserve coarse mappings during composition (#10249) by @hyfdev

rolldown_plugin_vite_import_glob: support tsconfig paths with import.meta.glob (#10167) by @sapphi-red

dev: clear tsconfig caches for bare full builds (#10276) by @shulaoda

dev: force a full rebuild when a tsconfig changes (#10261) by @shulaoda

treat rooted drive-less module ids as absolute in preserveModules naming (#10235) by @IWANABETHATGUY

watch: rebuild when tsconfig files change (#10258) by @shulaoda

watch: drop tsconfig-merged transform options on each rebuild (#10257) by @shulaoda

incorrect EMPTY_IMPORT_META warning for import.meta.ROLLUP_FILE_URL_* for CJS output (#10221) by @sapphi-red

deconflict: rename CJS locals shadowing wrapped-ESM namespace objects (#9970) by @IWANABETHATGUY

rolldown: drop the unused runtime module after entry-level external flattening (#10237) by @IWANABETHATGUY

rolldown: re-propagate has_dynamic_exports to transitive star importers (#10239) by @IWANABETHATGUY

tree-shaking: tree-shake destructured dynamic import namespace bindings (#10213) by @logaretm

s390x: use json-escape-simd 3.1.1 for big-endian JSON escaping fix (#10211) by @satyamg1620

🚜 Refactor

dev: move full-reload to client side (#10207) by @h-a-n-a

readability follow-ups to the ReplaceWith migration (#10286) by @IWANABETHATGUY

replace take_in-then-write-back with ReplaceWith and by-value moves (#10285) by @Boshen

share the main resolver's cache with the transformer's tsconfig lookups (#10205) by @shulaoda

rolldown: extract the ns star-external __reExport emission rule into LinkingMetadata (#10238) by @IWANABETHATGUY

rolldown: unify link/generate diagnostics into a Diagnostics accumulator (#10234) by @IWANABETHATGUY

sourcemap_filenames: drop dead sourcemap-filename plumbing (#10189) by @IWANABETHATGUY

extract external import symbol merging into a method (#10224) by @IWANABETHATGUY

rolldown: skip CJS namespace merging under strict execution order (#10203) by @hyfdev

resolve the manual tsconfig per file instead of once at startup (#10200) by @shulaoda

rolldown: route interop ESM init emission through a shared init-target view (#10202) by @hyfdev

rolldown: collapse vestigial wrap-kind state and share chunk sort helper (#10201) by @hyfdev

📚 Documentation

show plugin kinds in JSDoc and each hook's description (#10218) by @sapphi-red

add an explanation about removing imports from external modules without any messages (#10215) by @sapphi-red

... (truncated)

Commits

03e1e34 release: v1.2.0 (#10292)
f49ebe4 fix(sourcemap): preserve unmapped boundaries during composition (#10254)
1d3fb15 feat(dev): skip shipping factories for newly imported top-level modules (#10223)
3bd65ff refactor(dev): move full-reload to client side (#10207)
ab584a3 fix(sourcemap): preserve coarse mappings during composition (#10249)
84afd72 feat(dev): client-side HMR (#10164)
152ff69 fix(rolldown_plugin_vite_import_glob): support tsconfig paths with `import.me...
bb96d64 fix: treat rooted drive-less module ids as absolute in preserveModules naming...
fd6a0d0 fix(watch): rebuild when tsconfig files change (#10258)
fd15520 feat: treat import.meta['url'] and import.meta['ROLLUP_FILE_URL_*'] as si...
Additional commits viewable in compare view

Bumps the dependencies group with 5 updates:

Package	From	To
actions/checkout	`7.0.0`	`7.0.1`
github/codeql-action/init	`4.37.0`	`4.37.1`
github/codeql-action/analyze	`4.37.0`	`4.37.1`
actions/setup-node	`6.4.0`	`7.0.0`
zizmorcore/zizmor-action	`0.5.7`	`0.6.0`

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

Escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Various dependency updates

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

3d3c42e prep v7.0.1 release (#2531)
2880268 escape values passed to --unset (#2530)
12cd223 trim only ascii whitespace for branch (#2521)
62661c4 skip running unsafe pr check if input is default (#2518)
e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
631c942 eslint 9 (#2474)
4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
ba09753 Bump actions/checkout from 6 to 7 (#2488)
b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
Additional commits viewable in compare view

Updates github/codeql-action/init from 4.37.0 to 4.37.1

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.1

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.1 - 16 Jul 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

... (truncated)

Commits

7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
c8b5f69 Update changelog for v4.37.1
9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
3492b7e Change REMOTE_PATH_PREFIX to remote=
3654baa Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
2d682ac Merge pull request #4017 from github/dependabot/github_actions/dot-github/wor...
23f6a50 Merge pull request #4009 from github/mbg/action-state/additions
1ee3c75 Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...
e053684 Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...
6803c56 Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1
Additional commits viewable in

Bumps the dependencies group with 4 updates: [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt), [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint), [oxlint-tsgolint](https://github.com/oxc-project/tsgolint) and [rolldown](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown). Updates `oxfmt` from 0.58.0 to 0.59.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.59.0/npm/oxfmt) Updates `oxlint` from 1.73.0 to 1.74.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.74.0/npm/oxlint) Updates `oxlint-tsgolint` from 0.24.0 to 0.25.0 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v0.24.0...v0.25.0) Updates `rolldown` from 1.1.5 to 1.2.0 - [Release notes](https://github.com/rolldown/rolldown/releases) - [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md) - [Commits](https://github.com/rolldown/rolldown/commits/v1.2.0/packages/rolldown) chore: Bump the dependencies group with 5 updates Bumps the dependencies group with 5 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.0` | `4.37.1` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.0` | `4.37.1` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.7` | `0.6.0` | Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `github/codeql-action/init` from 4.37.0 to 4.37.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@99df26d...7188fc3) Updates `github/codeql-action/analyze` from 4.37.0 to 4.37.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@99df26d...7188fc3) Updates `actions/setup-node` from 6.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...8207627) Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.0 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@192e21d...6599ee8) --- updated-dependencies: - dependency-name: oxfmt dependency-version: 0.59.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: oxlint dependency-version: 1.74.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: oxlint-tsgolint dependency-version: 0.25.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: rolldown dependency-version: 1.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: github/codeql-action/init dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: github/codeql-action/analyze dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies - dependency-name: zizmorcore/zizmor-action dependency-version: 0.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

codecov · 2026-07-21T06:10:08Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 21, 2026

alex289 approved these changes Jul 21, 2026

View reviewed changes

alex289 merged commit eafc4a8 into main Jul 21, 2026
8 checks passed

alex289 deleted the dependabot/dependencies-6d9f58b9f3 branch July 21, 2026 08:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: Bump the "dependencies" group with 2 updates across multiple ecosystems#14

chore: Bump the "dependencies" group with 2 updates across multiple ecosystems#14
alex289 merged 1 commit into
mainfrom
dependabot/dependencies-6d9f58b9f3

dependabot Bot commented on behalf of github Jul 21, 2026

Uh oh!

codecov Bot commented Jul 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 21, 2026

[0.59.0] - 2026-07-13

🐛 Bug Fixes

[0.55.0] - 2026-06-15

🚀 Features

[0.54.0] - 2026-06-08

📚 Documentation

[0.52.0] - 2026-05-26

🚀 Features

[0.50.0] - 2026-05-15

🐛 Bug Fixes

[0.49.0] - 2026-05-11

🚀 Features

[0.45.0] - 2026-04-13

🐛 Bug Fixes

[0.44.0] - 2026-04-06

🐛 Bug Fixes

oxlint v1.27.0 && oxfmt v0.12.0

Oxlint v1.27.0

🚀 Features

🐛 Bug Fixes

⚡ Performance

📚 Documentation

Oxfmt v0.12.0

[1.74.0] - 2026-07-13

🚀 Features

🐛 Bug Fixes

⚡ Performance

v0.25.0

What's Changed

v1.2.0

[1.2.0] - 2026-07-15

🚀 Features

🐛 Bug Fixes

🚜 Refactor

📚 Documentation

[1.2.0] - 2026-07-15

🚀 Features

🐛 Bug Fixes

🚜 Refactor

📚 Documentation

v7.0.1

What's Changed

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.37.1

CodeQL Action Changelog

[UNRELEASED]

4.37.1 - 16 Jul 2026

4.37.0 - 08 Jul 2026

4.36.3 - 01 Jul 2026

4.36.2 - 04 Jun 2026

4.36.1 - 02 Jun 2026

4.36.0 - 22 May 2026

4.35.5 - 15 May 2026

4.35.4 - 07 May 2026

4.35.3 - 01 May 2026

Uh oh!

codecov Bot commented Jul 21, 2026

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone