chore(deps): bump github/codeql-action from 4.36.0 to 4.36.1 - #13596
Merged
BagToad merged 1 commit intoJun 5, 2026
Conversation
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.36.0 to 4.36.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7211b7c...87557b9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.36.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
BagToad
approved these changes
Jun 5, 2026
BagToad
left a comment
BagToad
left a comment
Member
There was a problem hiding this comment.
Audit summary (generated)
Reviewed how we use github/codeql-action and the actual v4.36.0 → v4.36.1 source diff. Release notes literally say "No user facing changes," and the diff bears that out:
- Overlay-mode logic now tracks whether
CODEQL_OVERLAY_DATABASE_MODEwas set explicitly; when explicit, missing PR diff ranges no longer force overlay back tonone - GHES API compat max bumped 3.21 → 3.22
- Bundled deps:
semver7.7.4 → 7.8.0,tmp0.2.4 → 0.2.7 (adds path validation) - No
action.ymlinput/output changes forinit,analyze, orupload-sarif
Impact on us: None. We use init (langs go + actions, queries: security-and-quality), analyze (upload: false, output: sarif-results), and upload-sarif in codeql.yml, plus upload-sarif for gh.sarif in govulncheck.yml. We don't set CODEQL_OVERLAY_DATABASE_MODE, so the only behavioral change is dead code on our path. Our SARIF paths are simple relative paths and won't trip the hardened tmp validation.
LGTM.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps github/codeql-action from 4.36.0 to 4.36.1.
Release notes
Sourced from github/codeql-action's releases.
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
87557b9Merge pull request #3940 from github/update-v4.36.1-2a1689ed49431011Update changelog for v4.36.12a1689eMerge pull request #3939 from github/henrymercer/skip-overlay-revert-when-exp...5245323Disable missing diff-ranges fallback when overlay enabled manuallyd1eb120Merge pull request #3933 from github/update-supported-enterprise-server-versions115001bMerge pull request #3934 from github/dependabot/npm_and_yarn/npm-minor-86fb5c...cef2e7aMerge pull request #3925 from github/dependabot/github_actions/dot-github/wor...5e6adf7Merge pull request #3936 from github/dependabot/npm_and_yarn/tmp-0.2.7ad170e6Merge branch 'main' into dependabot/github_actions/dot-github/workflows/actio...6a37b3aRebuildDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)