chore(deps): bump github/codeql-action/analyze from 4.37.9 to 4.38.0 by dependabot[bot] · Pull Request #696 · SunSi12138/SharpLink

dependabot · 2026-09-13T18:33:58Z

Bumps github/codeql-action/analyze from 4.37.9 to 4.38.0.

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.0

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037

Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

... (truncated)

Commits

b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
02d5093 Update changelog for v4.38.0
7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
bfcc52b Run slow macOS checks on larger runners
8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
0b7ca40 Add changelog note
40484b3 Update default bundle to codeql-bundle-v2.27.0
977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
40a6b38 Address toolcache cleanup review feedback
deece8f Apply suggestion from @henrymercer
Additional commits viewable in compare view

Bumps TUnit from 1.63.0 to 1.64.6 --- updated-dependencies: - dependency-name: TUnit dependency-version: 1.64.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: testing ... Signed-off-by: dependabot[bot] <support@github.com>

…bf2f9 Bump the testing group with 1 update

Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.4 to 4.37.6. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@f205ea1...5595cca) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…ub/codeql-action/init-4.37.6 Bump github/codeql-action from 4.37.4 to 4.37.6

Bumps Microsoft.Extensions.DependencyInjection from 10.0.10 to 10.0.11 Bumps Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.10 to 10.0.11 Bumps Microsoft.Extensions.Diagnostics.HealthChecks from 10.0.10 to 10.0.11 Bumps Microsoft.Extensions.Hosting from 10.0.10 to 10.0.11 Bumps Microsoft.Extensions.Logging to 10.0.11 Bumps Microsoft.Extensions.Logging.Abstractions from 10.0.10 to 10.0.11 Bumps Microsoft.Extensions.Logging.Console from 10.0.10 to 10.0.11 --- updated-dependencies: - dependency-name: Microsoft.Extensions.DependencyInjection dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft-extensions - dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft-extensions - dependency-name: Microsoft.Extensions.Diagnostics.HealthChecks dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft-extensions - dependency-name: Microsoft.Extensions.Hosting dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft-extensions - dependency-name: Microsoft.Extensions.Logging dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft-extensions - dependency-name: Microsoft.Extensions.Logging dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-major dependency-group: microsoft-extensions - dependency-name: Microsoft.Extensions.Logging.Abstractions dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft-extensions - dependency-name: Microsoft.Extensions.Logging.Console dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft-extensions ... Signed-off-by: dependabot[bot] <support@github.com>

…e/microsoft-extensions-9b6f1c2dce Bump Microsoft.Extensions.DependencyInjection and 6 others

chore: release 1.1.2

Bumps TUnit from 1.64.6 to 1.65.68 --- updated-dependencies: - dependency-name: TUnit dependency-version: 1.65.68 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: testing ... Signed-off-by: dependabot[bot] <support@github.com>

…cc221a Bump the testing group with 1 update

Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.6 to 4.37.9. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5595cca...cdf488f) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…hub/codeql-action/analyze-4.37.9 chore(deps): bump github/codeql-action/analyze from 4.37.6 to 4.37.9

Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.6 to 4.37.9. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5595cca...cdf488f) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…hub/codeql-action/init-4.37.9 chore(deps): bump github/codeql-action/init from 4.37.6 to 4.37.9

…febc3 Bump Microsoft.CodeAnalysis.CSharp from 5.6.0 to 5.9.0

Bumps Microsoft.CodeAnalysis.Analyzers from 5.6.0 to 5.9.0 Bumps Microsoft.CodeAnalysis.CSharp from 5.0.0 to 5.9.0 --- updated-dependencies: - dependency-name: Microsoft.CodeAnalysis.Analyzers dependency-version: 5.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: roslyn - dependency-name: Microsoft.CodeAnalysis.CSharp dependency-version: 5.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: roslyn ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps TUnit from 1.65.68 to 1.66.16 --- updated-dependencies: - dependency-name: TUnit dependency-version: 1.66.16 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: testing ... Signed-off-by: dependabot[bot] <support@github.com>

Introduce independent local lifecycle, readiness, and cluster state domains for single- and multi-cluster clients. Start hosted clients without blocking on remote availability, supervise initial connectivity recovery, preserve legacy explicit connection semantics, keep runtime Add/Replace candidates in the new child lifecycle, and prevent compatibility connection failures from tearing down an already-running coordinator. Fixes #644

…adiness Decouple client lifecycle from remote readiness

Replace public RunAsync with explicit StartAsync, WaitForShutdownAsync, and StopAsync ownership. Move accept/runtime supervision into SharpLinkServer, keep per-connection cleanup failures local including heartbeat-timeout cleanup, simplify Generic Host lifetime bridging, migrate repository callers, and document terminal failure semantics. Fixes #646

Split server start/wait/stop lifecycle

…cycle" This reverts commit 8183ac2, restoring the first-parent tree at 9ba50b9.

…cycle-readiness" This reverts commit 9ba50b9, restoring the pre-accident main tree at 21ed74f.

…26-09-10 Revert accidental main merges from 2026-09-10

…e3670 Bump the roslyn group with 2 updates

…165df4 Bump the testing group with 1 update

Release SharpLink 2.0.0: merge dev into main

release: finalize SharpLink 2.0.0 on main

Merge the reviewed 2.0.0 performance corrections from dev into main. The release branch tree is identical to the verified dev commit bae9e50; this merge adds main history only, with no source changes beyond the two reviewed performance corrections (#677, #678).

Brings the five reviewed dev changes that landed after the previous release merge (#681, #682, #684, #688, #689) onto main history: the logical-call allocation shape split, the single-observation OneWay client-stream terminal, the single-sample request time budget, the server-streaming terminal signal, and the resolve-stage clock-read reduction. The merged tree is identical to the verified dev commit 708b9d5; this merge adds main history only, with no additional source changes.

Release: merge the reviewed 2.0.0 dev content into main

Bring the reviewed #698 and #699 dev tree onto the current main history without changing version metadata, tags, or release state.

Advance the main synchronization branch to the current dev tree after #701. Keep the known unsupported Browser auto-layout variance as retained evidence without making it a release blocker.

Advance the main synchronization branch to the current dev tree after #702.

Advance the main synchronization branch to the current dev tree after #703 and #704.

Advance the main synchronization branch to the current dev tree after #705.

…bility chore: sync reviewed CI stability fixes into main

docs(codec): sync CoreCLR-first compatibility contract

SunSi12138 · 2026-09-19T05:00:38Z

@dependabot rebase

Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.9 to 4.38.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@cdf488f...b96794f) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.38.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot and others added 30 commits August 9, 2026 18:13

Merge pull request #96 from SunSi12138/dependabot/nuget/testing-41a5c…

d820396

…bf2f9 Bump the testing group with 1 update

chore(ci): pair CodeQL actions at 4.37.6

dbf4b33

Merge pull request #97 from SunSi12138/dependabot/github_actions/gith…

2f83637

…ub/codeql-action/init-4.37.6 Bump github/codeql-action from 4.37.4 to 4.37.6

Merge pull request #389 from SunSi12138/dependabot/nuget/demo/DemoBas…

15d6f56

…e/microsoft-extensions-9b6f1c2dce Bump Microsoft.Extensions.DependencyInjection and 6 others

chore: bump version to 1.1.2

76877f7

Merge pull request #390 from SunSi12138/release/1.1.2

63d710d

chore: release 1.1.2

Merge pull request #468 from SunSi12138/dependabot/nuget/testing-dff2…

56c0bcb

…cc221a Bump the testing group with 1 update

Merge pull request #469 from SunSi12138/dependabot/github_actions/git…

ae6fe8b

…hub/codeql-action/analyze-4.37.9 chore(deps): bump github/codeql-action/analyze from 4.37.6 to 4.37.9

Merge pull request #470 from SunSi12138/dependabot/github_actions/git…

1d7928a

…hub/codeql-action/init-4.37.9 chore(deps): bump github/codeql-action/init from 4.37.6 to 4.37.9

chore(deps): bump Microsoft.CodeAnalysis.CSharp from 5.6.0 to 5.9.0

a6a0829

Merge pull request #467 from SunSi12138/dependabot/nuget/roslyn-0c453…

21ed74f

…febc3 Bump Microsoft.CodeAnalysis.CSharp from 5.6.0 to 5.9.0

Merge pull request #647 from SunSi12138/issue-644-client-lifecycle-re…

9ba50b9

…adiness Decouple client lifecycle from remote readiness

Merge pull request #648 from SunSi12138/issue-646-server-lifecycle

8183ac2

Split server start/wait/stop lifecycle

Revert "Merge pull request #648 from SunSi12138/issue-646-server-life…

952c2de

…cycle" This reverts commit 8183ac2, restoring the first-parent tree at 9ba50b9.

Revert "Merge pull request #647 from SunSi12138/issue-644-client-life…

ed62ff6

…cycle-readiness" This reverts commit 9ba50b9, restoring the pre-accident main tree at 21ed74f.

Merge pull request #657 from SunSi12138/fix/revert-accidental-main-20…

c1faa7e

…26-09-10 Revert accidental main merges from 2026-09-10

Merge pull request #566 from SunSi12138/dependabot/nuget/roslyn-66d02…

0ba70fc

…e3670 Bump the roslyn group with 2 updates

Merge branch 'main' into dependabot/nuget/testing-9871165df4

bcdf918

Merge pull request #567 from SunSi12138/dependabot/nuget/testing-9871…

7b128b5

…165df4 Bump the testing group with 1 update

Merge dev into the 2.0 main release candidate

d6b33a3

SunSi12138 added 9 commits September 13, 2026 03:21

Merge release gate ownership fixes from dev

b9e7885

Merge deterministic release validation from dev

c502481

Merge pull request #671 from SunSi12138/release/2.0.0-main

1a1be20

Release SharpLink 2.0.0: merge dev into main

Merge main history for the 2.0.0 release

6ab1675

Merge pull request #676 from SunSi12138/release/2.0.0-final-main

b307800

release: finalize SharpLink 2.0.0 on main

Merge main history for the final 2.0.0 performance corrections

24ec9f8

Merge pull request #690 from SunSi12138/release/2.0.0-final

ac36ba4

Release: merge the reviewed 2.0.0 dev content into main

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 13, 2026

SunSi12138 added 6 commits September 18, 2026 18:02

chore: sync dev CI stability fixes onto main baseline

bc5ac5f

Bring the reviewed #698 and #699 dev tree onto the current main history without changing version metadata, tags, or release state.

chore: refresh main sync with Browser codec evidence policy

e9cb0b1

Advance the main synchronization branch to the current dev tree after #701. Keep the known unsupported Browser auto-layout variance as retained evidence without making it a release blocker.

chore: refresh main sync with Browser evidence validator follow-up

572b385

Advance the main synchronization branch to the current dev tree after #702.

chore: refresh main sync with Browser CoreCLR evidence

5d05e13

Advance the main synchronization branch to the current dev tree after #703 and #704.

chore: refresh main sync with deterministic Browser runtime identity

38d5f67

Advance the main synchronization branch to the current dev tree after #705.

Merge pull request #700 from SunSi12138/sync/dev-main-20260918-ci-sta…

e46d26b

…bility chore: sync reviewed CI stability fixes into main

dependabot Bot force-pushed the dependabot/github_actions/github/codeql-action/analyze-4.38.0 branch from 9f64aa0 to d0aff96 Compare September 18, 2026 11:54

Merge pull request #708 from SunSi12138/dev

8cbcffa

docs(codec): sync CoreCLR-first compatibility contract

SunSi12138 changed the base branch from main to dev September 19, 2026 04:56

dependabot Bot changed the base branch from dev to main September 19, 2026 05:02

dependabot Bot force-pushed the dependabot/github_actions/github/codeql-action/analyze-4.38.0 branch from d0aff96 to e15ae9a Compare September 19, 2026 05:02

SunSi12138 changed the base branch from main to dev September 19, 2026 05:02

SunSi12138 merged commit 00b2599 into dev Sep 19, 2026
42 of 45 checks passed

SunSi12138 deleted the dependabot/github_actions/github/codeql-action/analyze-4.38.0 branch September 19, 2026 05:05

SunSi12138 mentioned this pull request Sep 19, 2026

chore(deps): promote Dependabot updates to main #709

Merged

Navigation Menu

chore(deps): bump github/codeql-action/analyze from 4.37.9 to 4.38.0 - #696

chore(deps): bump github/codeql-action/analyze from 4.37.9 to 4.38.0#696
SunSi12138 merged 47 commits into
devfrom
dependabot/github_actions/github/codeql-action/analyze-4.38.0

dependabot Bot commented on behalf of github Sep 13, 2026 •

edited

Loading

Uh oh!

SunSi12138 commented Sep 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.38.0

CodeQL Action Changelog

[UNRELEASED]

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

4.37.9 - 26 Aug 2026

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

4.37.6 - 04 Aug 2026

4.37.5 - 03 Aug 2026

4.37.4 - 29 Jul 2026

4.37.3 - 22 Jul 2026

4.37.2 - 21 Jul 2026

Uh oh!

SunSi12138 commented Sep 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 13, 2026 •

edited

Loading