build support - #1
Merged
Merged
Conversation
add pre-commit configuration add gh actions add dependabot configuration
Member
|
Thanks! |
lvca
pushed a commit
that referenced
this pull request
Sep 7, 2021
Get latest commits from main project
mergify Bot
added a commit
that referenced
this pull request
Aug 29, 2025
….3.8 to 0.3.13 in /studio [skip ci] Bumps [@jridgewell/gen-mapping](https://github.com/jridgewell/sourcemaps/tree/HEAD/packages/gen-mapping) from 0.3.8 to 0.3.13. Changelog *Sourced from [`@jridgewell/gen-mapping`'s changelog](https://github.com/jridgewell/sourcemaps/blob/main/packages/gen-mapping/CHANGELOG.md).* > [0.3.13] - 2025-08-12 > ===================== > > * Use `default` subpath export: <jridgewell/sourcemaps@aab8d72> > * Transform `export default` into `module.exports =` in UMD plugin: <jridgewell/sourcemaps@cf85c75> > > **Full Changelog**: <jridgewell/sourcemaps@gen-mapping/0.3.12...gen-mapping/0.3.13> > > [0.3.12] - 2025-07-01 > ===================== > > * Use `Object.assign` to avoid polyfill in old Node versions: <jridgewell/sourcemaps@dd0615a> > * Optimize UMD wrapper: <jridgewell/sourcemaps@557ca37> > * Reorder subpath exports to improve import usage: [#35](https://github.com/jridgewell/sourcemaps/tree/HEAD/packages/gen-mapping/issues/35) > > **Full Changelog**: <jridgewell/sourcemaps@gen-mapping/0.3.11...gen-mapping/0.3.12> > > [0.3.11] - 2025-06-30 > ===================== > > * Update UMD Wrapper to fix webpack build issue: [#33](https://github.com/jridgewell/sourcemaps/tree/HEAD/packages/gen-mapping/issues/33) > * Add `getOwnPropertyDescriptors` polyfill to support Node v6: [#34](https://github.com/jridgewell/sourcemaps/tree/HEAD/packages/gen-mapping/issues/34) > > **Full Changelog**: <jridgewell/sourcemaps@gen-mapping/0.3.10...gen-mapping/0.3.11> > > [0.3.10] - 2025-06-30 > ===================== > > * Remove `require(esm)` support to fix bug with Node v22: <jridgewell/sourcemaps@e957842> > > **Full Changelog**: <jridgewell/sourcemaps@gen-mapping/0.3.9...gen-mapping/0.3.10> > > [0.3.9] - 2025-06-29 > ==================== > > * Fix package types for CJS and ESM imports: <jridgewell/sourcemaps@a924ed3> > * fix: use stable version of sourcemap-codec dependency: [#26](https://github.com/jridgewell/sourcemaps/tree/HEAD/packages/gen-mapping/issues/26) (thanks [`@benmccann`](https://github.com/benmccann)) > * Add `module-sync` exports type for [require(esm)](https://joyeecheung.github.io/blog/2024/03/18/require-esm-in-node-js/): <jridgewell/sourcemaps@3836f6c> > * Add type declaration source maps to assist go-to-definition: <jridgewell/sourcemaps@9a02665> > * Temporarily remove scopes/ranges APIs: <jridgewell/sourcemaps@7575b63> > * Include set-array source directly in gen-mapping project: [#1](https://github.com/jridgewell/sourcemaps/tree/HEAD/packages/gen-mapping/issues/1) (thanks [`@benmccann`](https://github.com/benmccann)) > > **Full Changelog**: <jridgewell/sourcemaps@gen-mapping/0.3.5...gen-mapping/0.3.9> > > [0.3.5] - 2024-03-01 > ==================== > > * Add `ignoreList` support: <jridgewell/gen-mapping@9add0c2> > > **Full Changelog**: <jridgewell/gen-mapping@v0.3.4...v0.3.5> > > [0.3.4] - 2024-02-24 > ==================== > > **Full Changelog**: <jridgewell/gen-mapping@v0.3.3...v0.3.4> > > [0.3.3] - 2023-04-07 > ==================== ... (truncated) Commits * [`a969b67`](jridgewell/sourcemaps@a969b67) gen-mapping/0.3.13 * [`aab8d72`](jridgewell/sourcemaps@aab8d72) Use default subpath condition for fallback * [`c780a90`](jridgewell/sourcemaps@c780a90) Update links to point to monorepo * [`e2fa5d7`](jridgewell/sourcemaps@e2fa5d7) remapping/2.3.4 * [`26fe89d`](jridgewell/sourcemaps@26fe89d) gen-mapping/0.3.12 * [`a1c0fa0`](jridgewell/sourcemaps@a1c0fa0) Reorder subpath exports * [`dd0615a`](jridgewell/sourcemaps@dd0615a) gen-mapping: Use `Object.assign` to avoid needing `getOwnPropertyDescriptors`... * [`82195c5`](jridgewell/sourcemaps@82195c5) gen-mapping/0.3.11 * [`58ea44b`](jridgewell/sourcemaps@58ea44b) Update changelogs * [`e0c7250`](jridgewell/sourcemaps@e0c7250) Why isn't GH autolinking commit SHAs? * See full diff in [compare view](https://github.com/jridgewell/sourcemaps/commits/gen-mapping/0.3.13/packages/gen-mapping) [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
mergify Bot
added a commit
that referenced
this pull request
Oct 12, 2025
…4 [skip ci] Bumps [org.jacoco:jacoco-maven-plugin](https://github.com/jacoco/jacoco) from 0.8.13 to 0.8.14. Release notes *Sourced from [org.jacoco:jacoco-maven-plugin's releases](https://github.com/jacoco/jacoco/releases).* > 0.8.14 > ------ > > New Features > ------------ > > * JaCoCo now officially supports Java 25 (GitHub [#1950](https://redirect.github.com/jacoco/jacoco/issues/1950)). > * Experimental support for Java 26 class files (GitHub [#1870](https://redirect.github.com/jacoco/jacoco/issues/1807)). > * Branches added by the Kotlin compiler for default argument number 33 or higher are filtered out during generation of report (GitHub [#1655](https://redirect.github.com/jacoco/jacoco/issues/1655)). > * Part of bytecode generated by the Kotlin compiler for elvis operator that follows safe call operator is filtered out during generation of report (GitHub [#1814](https://redirect.github.com/jacoco/jacoco/issues/1814), [#1954](https://redirect.github.com/jacoco/jacoco/issues/1954)). > * Part of bytecode generated by the Kotlin compiler for more cases of chained safe call operators is filtered out during generation of report (GitHub [#1956](https://redirect.github.com/jacoco/jacoco/issues/1956)). > * Part of bytecode generated by the Kotlin compiler for invocations of suspendCoroutineUninterceptedOrReturn intrinsic is filtered out during generation of report (GitHub [#1929](https://redirect.github.com/jacoco/jacoco/issues/1929)). > * Part of bytecode generated by the Kotlin compiler for suspending lambdas with parameters is filtered out during generation of report (GitHub [#1945](https://redirect.github.com/jacoco/jacoco/issues/1945)). > * Part of bytecode generated by the Kotlin compiler for suspending functions and lambdas with suspension points that return inline value class is filtered out during generation of report (GitHub [#1871](https://redirect.github.com/jacoco/jacoco/issues/1871)). > * Part of bytecode generated by the Kotlin Compose compiler plugin for pausable composition is filtered out during generation of report (GitHub [#1911](https://redirect.github.com/jacoco/jacoco/issues/1911)). > * Methods generated by the Kotlin serialization compiler plugin are filtered out (GitHub [#1885](https://redirect.github.com/jacoco/jacoco/issues/1885), [#1970](https://redirect.github.com/jacoco/jacoco/issues/1970), [#1971](https://redirect.github.com/jacoco/jacoco/issues/1971)). > > Fixed bugs > ---------- > > * Fixed handling of implicit else clause of when with String subject in Kotlin (GitHub [#1813](https://redirect.github.com/jacoco/jacoco/issues/1813), [#1940](https://redirect.github.com/jacoco/jacoco/issues/1940)). > * Fixed handling of implicit default clause of switch by String in Java when compiled by ECJ (GitHub [#1813](https://redirect.github.com/jacoco/jacoco/issues/1813), [#1940](https://redirect.github.com/jacoco/jacoco/issues/1940)). > Fixed handling of exceptions in chains of safe call operators in Kotlin (GitHub [#1819](https://redirect.github.com/jacoco/jacoco/issues/1819)). > > Non-functional Changes > ---------------------- > > * JaCoCo now depends on ASM 9.9 (GitHub [#1965](https://redirect.github.com/jacoco/jacoco/issues/1965)). Commits * [`2eb2483`](jacoco/jacoco@2eb2483) Prepare release v0.8.14 * [`de76181`](jacoco/jacoco@de76181) KotlinSerializableFilter should filter more methods ([#1971](https://redirect.github.com/jacoco/jacoco/issues/1971)) * [`89c4bd5`](jacoco/jacoco@89c4bd5) Fix NPE in KotlinSerializableFilter ([#1970](https://redirect.github.com/jacoco/jacoco/issues/1970)) * [`0981128`](jacoco/jacoco@0981128) Migrate release staging to the Central Publisher Portal ([#1968](https://redirect.github.com/jacoco/jacoco/issues/1968)) * [`d07bc6b`](jacoco/jacoco@d07bc6b) Add filter for bytecode generated by Kotlin serialization compiler plugin ([#1](https://redirect.github.com/jacoco/jacoco/issues/1)... * [`5e35fd5`](jacoco/jacoco@5e35fd5) Upgrade maven-dependency-plugin to 3.9.0 ([#1966](https://redirect.github.com/jacoco/jacoco/issues/1966)) * [`c2fe5cc`](jacoco/jacoco@c2fe5cc) Upgrade ASM to 9.9 ([#1965](https://redirect.github.com/jacoco/jacoco/issues/1965)) * [`b0f8e23`](jacoco/jacoco@b0f8e23) KotlinSafeCallOperatorFilter should filter "unoptimized" safe call followed b... * [`c7bd3f4`](jacoco/jacoco@c7bd3f4) Upgrade spotless-maven-plugin to 3.0.0 ([#1961](https://redirect.github.com/jacoco/jacoco/issues/1961)) * [`faa289d`](jacoco/jacoco@faa289d) KotlinSafeCallOperatorFilter should not be affected by presence of pseudo ins... * Additional commits viewable in [compare view](jacoco/jacoco@v0.8.13...v0.8.14) [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
mergify Bot
added a commit
that referenced
this pull request
Dec 1, 2025
…in /studio [skip ci] Bumps [swagger-ui-dist](https://github.com/swagger-api/swagger-ui) from 5.30.2 to 5.30.3. Release notes *Sourced from [swagger-ui-dist's releases](https://github.com/swagger-api/swagger-ui/releases).* > v5.30.3 > ------- > > [5.30.3](swagger-api/swagger-ui@v5.30.2...v5.30.3) (2025-11-25) > ------------------------------------------------------------------------------------------ > > ### Bug Fixes > > * **deps:** update vulnerable `@release-it/conventional-changelog` to 10.0.2 ([#10645](https://redirect.github.com/swagger-api/swagger-ui/issues/10645)) ([6acfc6e](swagger-api/swagger-ui@6acfc6e)) > * **deps:** update vulnerable dependencies (js-yaml & glob) ([#10644](https://redirect.github.com/swagger-api/swagger-ui/issues/10644)) ([03cf01b](swagger-api/swagger-ui@03cf01b)) > * **utils:** handle sanitizing multi-level relative paths ([#10640](https://redirect.github.com/swagger-api/swagger-ui/issues/10640)) ([58aff59](swagger-api/swagger-ui@58aff59)), closes [#4107](https://redirect.github.com/swagger-api/swagger-ui/issues/4107) Commits * [`199761a`](swagger-api/swagger-ui@199761a) chore(release): cut the 5.30.3 release * [`6acfc6e`](swagger-api/swagger-ui@6acfc6e) fix(deps): update vulnerable `@release-it/conventional-changelog` to 10.0.2 ([#1](https://redirect.github.com/swagger-api/swagger-ui/issues/1)... * [`03cf01b`](swagger-api/swagger-ui@03cf01b) fix(deps): update vulnerable dependencies (js-yaml & glob) ([#10644](https://redirect.github.com/swagger-api/swagger-ui/issues/10644)) * [`8d9142e`](swagger-api/swagger-ui@8d9142e) chore(deps): bump actions/checkout from 5 to 6 ([#10643](https://redirect.github.com/swagger-api/swagger-ui/issues/10643)) * [`58aff59`](swagger-api/swagger-ui@58aff59) fix(utils): handle sanitizing multi-level relative paths ([#10640](https://redirect.github.com/swagger-api/swagger-ui/issues/10640)) * [`85f0c5f`](swagger-api/swagger-ui@85f0c5f) chore(deps): bump js-yaml from 4.1.0 to 4.1.1 ([#10637](https://redirect.github.com/swagger-api/swagger-ui/issues/10637)) * [`7f75ee3`](swagger-api/swagger-ui@7f75ee3) chore(deps): bump actions/setup-node from 5 to 6 ([#10608](https://redirect.github.com/swagger-api/swagger-ui/issues/10608)) * [`2067270`](swagger-api/swagger-ui@2067270) chore(deps): bump github/codeql-action from 3 to 4 ([#10595](https://redirect.github.com/swagger-api/swagger-ui/issues/10595)) * See full diff in [compare view](swagger-api/swagger-ui@v5.30.2...v5.30.3) [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
This was referenced Jan 27, 2026
This was referenced Feb 15, 2026
Merged
mergify Bot
added a commit
that referenced
this pull request
Jul 19, 2026
Bumps the github-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [actions/setup-java](https://github.com/actions/setup-java) | `5.5.0` | `5.6.0` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.171` | `1.0.178` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.0` | `4.37.1` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.0` | `4.37.1` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.0` | `4.37.1` | Updates `actions/setup-java` from 5.5.0 to 5.6.0 Release notes *Sourced from [actions/setup-java's releases](https://github.com/actions/setup-java/releases).* > v5.6.0 > ------ > > What's Changed > -------------- > > * Backport to v5: Add Maven compiler problem matcher for javac diagnostics by [`@brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1087](https://redirect.github.com/actions/setup-java/pull/1087) > * feat: expose cache-primary-key output ([#597](https://redirect.github.com/actions/setup-java/issues/597)) [v5 backport] by [`@brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1089](https://redirect.github.com/actions/setup-java/pull/1089) > * dist: Cover Tencent Kona JDK 25 ([#1108](https://redirect.github.com/actions/setup-java/issues/1108)) [v5 backport] by [`@brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1110](https://redirect.github.com/actions/setup-java/pull/1110) > * Backport [#1111](https://redirect.github.com/actions/setup-java/issues/1111): Preserve Maven toolchains across repeated setup-java runs ([#1099](https://redirect.github.com/actions/setup-java/issues/1099)) by [`@brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1113](https://redirect.github.com/actions/setup-java/pull/1113) > * Backport [#1097](https://redirect.github.com/actions/setup-java/issues/1097)/[#1098](https://redirect.github.com/actions/setup-java/issues/1098) to v5: cache Maven and Gradle wrapper distributions separately by [`@brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1122](https://redirect.github.com/actions/setup-java/pull/1122) > > **Full Changelog**: <actions/setup-java@v5...v5.6.0> Commits * [`03ad4de`](actions/setup-java@03ad4de) Backport [#1097](https://redirect.github.com/actions/setup-java/issues/1097)/[#1098](https://redirect.github.com/actions/setup-java/issues/1098): cache Maven and Gradle wrapper distributions separately... * [`d229d2e`](actions/setup-java@d229d2e) Backport [#1111](https://redirect.github.com/actions/setup-java/issues/1111): Preserve Maven toolchains across repeated setup-java runs ([#1](https://redirect.github.com/actions/setup-java/issues/1)... * [`bbf0f69`](actions/setup-java@bbf0f69) dist: Cover Tencent Kona JDK 25 ([#1110](https://redirect.github.com/actions/setup-java/issues/1110)) * [`513edc4`](actions/setup-java@513edc4) feat: expose cache-primary-key output ([#597](https://redirect.github.com/actions/setup-java/issues/597)) [v5 backport] ([#1089](https://redirect.github.com/actions/setup-java/issues/1089)) * [`62df799`](actions/setup-java@62df799) Add Maven compiler problem matcher for javac diagnostics ([#1087](https://redirect.github.com/actions/setup-java/issues/1087)) * [`176156a`](actions/setup-java@176156a) chore: bump version to 5.6.0 for v5 release line * [`bf7b8de`](actions/setup-java@bf7b8de) build: rebuild dist for backported changes ([#1079](https://redirect.github.com/actions/setup-java/issues/1079), [#1083](https://redirect.github.com/actions/setup-java/issues/1083), [#1084](https://redirect.github.com/actions/setup-java/issues/1084)) * [`0173e6d`](actions/setup-java@0173e6d) Infer distribution from asdf .tool-versions vendor prefix ([#1084](https://redirect.github.com/actions/setup-java/issues/1084)) * [`f45cd82`](actions/setup-java@f45cd82) Rename jdkFile input to jdk-file with deprecated alias ([#1083](https://redirect.github.com/actions/setup-java/issues/1083)) * [`e2863ad`](actions/setup-java@e2863ad) Map Zulu x86 architecture to i686 for Azul Metadata API ([#1079](https://redirect.github.com/actions/setup-java/issues/1079)) * Additional commits viewable in [compare view](actions/setup-java@0f481fc...03ad4de) Updates `anthropics/claude-code-action` from 1.0.171 to 1.0.178 Release notes *Sourced from [anthropics/claude-code-action's releases](https://github.com/anthropics/claude-code-action/releases).* > v1.0.178 > -------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.178> > > v1.0.177 > -------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.177> > > v1.0.176 > -------- > > What's Changed > -------------- > > * docs: fix dead example links in custom-automations.md by [`@evol1228`](https://github.com/evol1228) in [anthropics/claude-code-action#1513](https://redirect.github.com/anthropics/claude-code-action/pull/1513) > * test: cover prepareContext validation error branches by [`@farmer-data`](https://github.com/farmer-data) in [anthropics/claude-code-action#1460](https://redirect.github.com/anthropics/claude-code-action/pull/1460) > * fix: sanitize {{label}} in branch name templates by [`@pa-arth`](https://github.com/pa-arth) in [anthropics/claude-code-action#1492](https://redirect.github.com/anthropics/claude-code-action/pull/1492) > * fix(sanitizer): strip alt text from reference-style markdown images by [`@HumphreySun98`](https://github.com/HumphreySun98) in [anthropics/claude-code-action#1488](https://redirect.github.com/anthropics/claude-code-action/pull/1488) > * fix: map claude\_args model to SDK options by [`@Epochex`](https://github.com/Epochex) in [anthropics/claude-code-action#1474](https://redirect.github.com/anthropics/claude-code-action/pull/1474) > * fix: allow leading underscore in branch names (valid per git-check-ref-format) by [`@riley-mete-db`](https://github.com/riley-mete-db) in [anthropics/claude-code-action#1486](https://redirect.github.com/anthropics/claude-code-action/pull/1486) > * fix(format): filter out thinking\_tokens system messages from step summary by [`@anishesg`](https://github.com/anishesg) in [anthropics/claude-code-action#1479](https://redirect.github.com/anthropics/claude-code-action/pull/1479) > * docs: map custom\_instructions to --append-system-prompt ([#1480](https://redirect.github.com/anthropics/claude-code-action/issues/1480)) by [`@farmer-data`](https://github.com/farmer-data) in [anthropics/claude-code-action#1484](https://redirect.github.com/anthropics/claude-code-action/pull/1484) > * fix: handle null comment/review author from deleted accounts by [`@pa-arth`](https://github.com/pa-arth) in [anthropics/claude-code-action#1490](https://redirect.github.com/anthropics/claude-code-action/pull/1490) > > New Contributors > ---------------- > > * [`@evol1228`](https://github.com/evol1228) made their first contribution in [anthropics/claude-code-action#1513](https://redirect.github.com/anthropics/claude-code-action/pull/1513) > * [`@pa-arth`](https://github.com/pa-arth) made their first contribution in [anthropics/claude-code-action#1492](https://redirect.github.com/anthropics/claude-code-action/pull/1492) > * [`@HumphreySun98`](https://github.com/HumphreySun98) made their first contribution in [anthropics/claude-code-action#1488](https://redirect.github.com/anthropics/claude-code-action/pull/1488) > * [`@Epochex`](https://github.com/Epochex) made their first contribution in [anthropics/claude-code-action#1474](https://redirect.github.com/anthropics/claude-code-action/pull/1474) > * [`@riley-mete-db`](https://github.com/riley-mete-db) made their first contribution in [anthropics/claude-code-action#1486](https://redirect.github.com/anthropics/claude-code-action/pull/1486) > * [`@anishesg`](https://github.com/anishesg) made their first contribution in [anthropics/claude-code-action#1479](https://redirect.github.com/anthropics/claude-code-action/pull/1479) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.176> > > v1.0.175 > -------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.175> > > v1.0.174 > -------- > > What's Changed > -------------- > > * fix(sanitizer): redact GitHub user-to-server (ghu\_) tokens by [`@NickNojiri`](https://github.com/NickNojiri) in [anthropics/claude-code-action#1502](https://redirect.github.com/anthropics/claude-code-action/pull/1502) > > New Contributors > ---------------- > > * [`@NickNojiri`](https://github.com/NickNojiri) made their first contribution in [anthropics/claude-code-action#1502](https://redirect.github.com/anthropics/claude-code-action/pull/1502) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.174> > > v1.0.173 > -------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.173> > > v1.0.172 > -------- > > What's Changed > -------------- > > * fix(sdk): fail step when result has is\_error:true despite success subtype by [`@syf2211`](https://github.com/syf2211) in [anthropics/claude-code-action#1496](https://redirect.github.com/anthropics/claude-code-action/pull/1496) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.172> Commits * [`af0559e`](anthropics/claude-code-action@af0559e) chore: bump Claude Code to 2.1.215 and Agent SDK to 0.3.215 * [`3553f84`](anthropics/claude-code-action@3553f84) chore: bump Claude Code to 2.1.214 and Agent SDK to 0.3.214 * [`700e7f8`](anthropics/claude-code-action@700e7f8) chore: bump Claude Code to 2.1.212 and Agent SDK to 0.3.212 * [`3e807ec`](anthropics/claude-code-action@3e807ec) fix: handle null comment/review author from deleted accounts ([#1490](https://redirect.github.com/anthropics/claude-code-action/issues/1490)) * [`2988cbe`](anthropics/claude-code-action@2988cbe) docs: map custom\_instructions to --append-system-prompt ([#1480](https://redirect.github.com/anthropics/claude-code-action/issues/1480)) ([#1484](https://redirect.github.com/anthropics/claude-code-action/issues/1484)) * [`a1c0599`](anthropics/claude-code-action@a1c0599) fix(format): filter out thinking\_tokens system messages from step summary ([#1](https://redirect.github.com/anthropics/claude-code-action/issues/1)... * [`5bfa96a`](anthropics/claude-code-action@5bfa96a) fix: allow leading underscore in branch names (valid per git-check-ref-format... * [`214a706`](anthropics/claude-code-action@214a706) fix: map claude\_args model to SDK options ([#1474](https://redirect.github.com/anthropics/claude-code-action/issues/1474)) * [`5f509a1`](anthropics/claude-code-action@5f509a1) fix(sanitizer): strip alt text from reference-style markdown images ([#1488](https://redirect.github.com/anthropics/claude-code-action/issues/1488)) * [`e64308f`](anthropics/claude-code-action@e64308f) fix: sanitize {{label}} in branch name templates ([#1492](https://redirect.github.com/anthropics/claude-code-action/issues/1492)) * Additional commits viewable in [compare view](anthropics/claude-code-action@e90deca...af0559e) Updates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.1 Release notes *Sourced from [github/codeql-action/upload-sarif's releases](https://github.com/github/codeql-action/releases).* > v4.37.1 > ------- > > * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956) > * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019) Changelog *Sourced from [github/codeql-action/upload-sarif's changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md).* > CodeQL Action Changelog > ======================= > > See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. > > [UNRELEASED] > ------------ > > No user facing changes. > > 4.37.1 - 16 Jul 2026 > -------------------- > > * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956) > * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019) > > 4.37.0 - 08 Jul 2026 > -------------------- > > * Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://redirect.github.com/github/codeql-action/pull/3995) > * In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://redirect.github.com/github/codeql-action/pull/3973) > > 4.36.3 - 01 Jul 2026 > -------------------- > > No user facing changes. > > 4.36.2 - 04 Jun 2026 > -------------------- > > * Cache CodeQL CLI version information across Actions steps. [#3943](https://redirect.github.com/github/codeql-action/pull/3943) > * Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://redirect.github.com/github/codeql-action/pull/3937) > * Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://redirect.github.com/github/codeql-action/pull/3948) > > 4.36.1 - 02 Jun 2026 > -------------------- > > No user facing changes. > > 4.36.0 - 22 May 2026 > -------------------- > > * *Breaking change*: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://redirect.github.com/github/codeql-action/pull/3894) > * Add support for SHA-256 Git object IDs. [#3893](https://redirect.github.com/github/codeql-action/pull/3893) > * Update default CodeQL bundle version to [2.25.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5). [#3926](https://redirect.github.com/github/codeql-action/pull/3926) > > 4.35.5 - 15 May 2026 > -------------------- > > * We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://redirect.github.com/github/codeql-action/pull/3899) > * For performance and accuracy reasons, [improved incremental analysis](https://redirect.github.com/github/roadmap/issues/1158) will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. [#3791](https://redirect.github.com/github/codeql-action/pull/3791) > * If multiple inputs are provided for the GitHub-internal `analysis-kinds` input, only `code-scanning` will be enabled. The `analysis-kinds` input is experimental, for GitHub-internal use only, and may change without notice at any time. [#3892](https://redirect.github.com/github/codeql-action/pull/3892) > * Added an experimental change which, when running a Code Scanning analysis for a PR with [improved incremental analysis](https://redirect.github.com/github/roadmap/issues/1158) enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. [#3880](https://redirect.github.com/github/codeql-action/pull/3880) > > 4.35.4 - 07 May 2026 > -------------------- > > * Update default CodeQL bundle version to [2.25.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4). [#3881](https://redirect.github.com/github/codeql-action/pull/3881) > > 4.35.3 - 01 May 2026 > -------------------- ... (truncated) Commits * [`7188fc3`](github/codeql-action@7188fc3) Merge pull request [#4020](https://redirect.github.com/github/codeql-action/issues/4020) from github/update-v4.37.1-9e7c07009 * [`c8b5f69`](github/codeql-action@c8b5f69) Update changelog for v4.37.1 * [`9e7c070`](github/codeql-action@9e7c070) Merge pull request [#4014](https://redirect.github.com/github/codeql-action/issues/4014) from github/mbg/explicit-remote-prefix * [`3492b7e`](github/codeql-action@3492b7e) Change `REMOTE_PATH_PREFIX` to `remote=` * [`3654baa`](github/codeql-action@3654baa) Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix * [`2d682ac`](github/codeql-action@2d682ac) Merge pull request [#4017](https://redirect.github.com/github/codeql-action/issues/4017) from github/dependabot/github\_actions/dot-github/wor... * [`23f6a50`](github/codeql-action@23f6a50) Merge pull request [#4009](https://redirect.github.com/github/codeql-action/issues/4009) from github/mbg/action-state/additions * [`1ee3c75`](github/codeql-action@1ee3c75) Merge pull request [#4018](https://redirect.github.com/github/codeql-action/issues/4018) from github/dependabot/github\_actions/dot-github/wor... * [`e053684`](github/codeql-action@e053684) Merge pull request [#4015](https://redirect.github.com/github/codeql-action/issues/4015) from github/dependabot/npm\_and\_yarn/npm-minor-fd2e83... * [`6803c56`](github/codeql-action@6803c56) Merge pull request [#4019](https://redirect.github.com/github/codeql-action/issues/4019) from github/update-bundle/codeql-bundle-v2.26.1 * Additional commits viewable in [compare view](github/codeql-action@99df26d...7188fc3) Updates `github/codeql-action/init` from 4.37.0 to 4.37.1 Release notes *Sourced from [github/codeql-action/init's releases](https://github.com/github/codeql-action/releases).* > v4.37.1 > ------- > > * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956) > * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019) Changelog *Sourced from [github/codeql-action/init's changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md).* > CodeQL Action Changelog > ======================= > > See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. > > [UNRELEASED] > ------------ > > No user facing changes. > > 4.37.1 - 16 Jul 2026 > -------------------- > > * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956) > * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019) > > 4.37.0 - 08 Jul 2026 > -------------------- > > * Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://redirect.github.com/github/codeql-action/pull/3995) > * In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://redirect.github.com/github/codeql-action/pull/3973) > > 4.36.3 - 01 Jul 2026 > -------------------- > > No user facing changes. > > 4.36.2 - 04 Jun 2026 > -------------------- > > * Cache CodeQL CLI version information across Actions steps. [#3943](https://redirect.github.com/github/codeql-action/pull/3943) > * Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://redirect.github.com/github/codeql-action/pull/3937) > * Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://redirect.github.com/github/codeql-action/pull/3948) > > 4.36.1 - 02 Jun 2026 > -------------------- > > No user facing changes. > > 4.36.0 - 22 May 2026 > -------------------- > > * *Breaking change*: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://redirect.github.com/github/codeql-action/pull/3894) > * Add support for SHA-256 Git object IDs. [#3893](https://redirect.github.com/github/codeql-action/pull/3893) > * Update default CodeQL bundle version to [2.25.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5). [#3926](https://redirect.github.com/github/codeql-action/pull/3926) > > 4.35.5 - 15 May 2026 > -------------------- > > * We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://redirect.github.com/github/codeql-action/pull/3899) > * For performance and accuracy reasons, [improved incremental analysis](https://redirect.github.com/github/roadmap/issues/1158) will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. [#3791](https://redirect.github.com/github/codeql-action/pull/3791) > * If multiple inputs are provided for the GitHub-internal `analysis-kinds` input, only `code-scanning` will be enabled. The `analysis-kinds` input is experimental, for GitHub-internal use only, and may change without notice at any time. [#3892](https://redirect.github.com/github/codeql-action/pull/3892) > * Added an experimental change which, when running a Code Scanning analysis for a PR with [improved incremental analysis](https://redirect.github.com/github/roadmap/issues/1158) enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. [#3880](https://redirect.github.com/github/codeql-action/pull/3880) > > 4.35.4 - 07 May 2026 > -------------------- > > * Update default CodeQL bundle version to [2.25.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4). [#3881](https://redirect.github.com/github/codeql-action/pull/3881) > > 4.35.3 - 01 May 2026 > -------------------- ... (truncated) Commits * [`7188fc3`](github/codeql-action@7188fc3) Merge pull request [#4020](https://redirect.github.com/github/codeql-action/issues/4020) from github/update-v4.37.1-9e7c07009 * [`c8b5f69`](github/codeql-action@c8b5f69) Update changelog for v4.37.1 * [`9e7c070`](github/codeql-action@9e7c070) Merge pull request [#4014](https://redirect.github.com/github/codeql-action/issues/4014) from github/mbg/explicit-remote-prefix * [`3492b7e`](github/codeql-action@3492b7e) Change `REMOTE_PATH_PREFIX` to `remote=` * [`3654baa`](github/codeql-action@3654baa) Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix * [`2d682ac`](github/codeql-action@2d682ac) Merge pull request [#4017](https://redirect.github.com/github/codeql-action/issues/4017) from github/dependabot/github\_actions/dot-github/wor... * [`23f6a50`](github/codeql-action@23f6a50) Merge pull request [#4009](https://redirect.github.com/github/codeql-action/issues/4009) from github/mbg/action-state/additions * [`1ee3c75`](github/codeql-action@1ee3c75) Merge pull request [#4018](https://redirect.github.com/github/codeql-action/issues/4018) from github/dependabot/github\_actions/dot-github/wor... * [`e053684`](github/codeql-action@e053684) Merge pull request [#4015](https://redirect.github.com/github/codeql-action/issues/4015) from github/dependabot/npm\_and\_yarn/npm-minor-fd2e83... * [`6803c56`](github/codeql-action@6803c56) Merge pull request [#4019](https://redirect.github.com/github/codeql-action/issues/4019) from github/update-bundle/codeql-bundle-v2.26.1 * Additional commits viewable in [compare view](github/codeql-action@99df26d...7188fc3) Updates `github/codeql-action/analyze` from 4.37.0 to 4.37.1 Release notes *Sourced from [github/codeql-action/analyze's releases](https://github.com/github/codeql-action/releases).* > v4.37.1 > ------- > > * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956) > * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019) Changelog *Sourced from [github/codeql-action/analyze's changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md).* > CodeQL Action Changelog > ======================= > > See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. > > [UNRELEASED] > ------------ > > No user facing changes. > > 4.37.1 - 16 Jul 2026 > -------------------- > > * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956) > * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019) > > 4.37.0 - 08 Jul 2026 > -------------------- > > * Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://redirect.github.com/github/codeql-action/pull/3995) > * In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://redirect.github.com/github/codeql-action/pull/3973) > > 4.36.3 - 01 Jul 2026 > -------------------- > > No user facing changes. > > 4.36.2 - 04 Jun 2026 > -------------------- > > * Cache CodeQL CLI version information across Actions steps. [#3943](https://redirect.github.com/github/codeql-action/pull/3943) > * Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://redirect.github.com/github/codeql-action/pull/3937) > * Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://redirect.github.com/github/codeql-action/pull/3948) > > 4.36.1 - 02 Jun 2026 > -------------------- > > No user facing changes. > > 4.36.0 - 22 May 2026 > -------------------- > > * *Breaking change*: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://redirect.github.com/github/codeql-action/pull/3894) > * Add support for SHA-256 Git object IDs. [#3893](https://redirect.github.com/github/codeql-action/pull/3893) > * Update default CodeQL bundle version to [2.25.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5). [#3926](https://redirect.github.com/github/codeql-action/pull/3926) > > 4.35.5 - 15 May 2026 > -------------------- > > * We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://redirect.github.com/github/codeql-action/pull/3899) > * For performance and accuracy reasons, [improved incremental analysis](https://redirect.github.com/github/roadmap/issues/1158) will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. [#3791](https://redirect.github.com/github/codeql-action/pull/3791) > * If multiple inputs are provided for the GitHub-internal `analysis-kinds` input, only `code-scanning` will be enabled. The `analysis-kinds` input is experimental, for GitHub-internal use only, and may change without notice at any time. [#3892](https://redirect.github.com/github/codeql-action/pull/3892) > * Added an experimental change which, when running a Code Scanning analysis for a PR with [improved incremental analysis](https://redirect.github.com/github/roadmap/issues/1158) enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. [#3880](https://redirect.github.com/github/codeql-action/pull/3880) > > 4.35.4 - 07 May 2026 > -------------------- > > * Update default CodeQL bundle version to [2.25.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4). [#3881](https://redirect.github.com/github/codeql-action/pull/3881) > > 4.35.3 - 01 May 2026 > -------------------- ... (truncated) Commits * [`7188fc3`](github/codeql-action@7188fc3) Merge pull request [#4020](https://redirect.github.com/github/codeql-action/issues/4020) from github/update-v4.37.1-9e7c07009 * [`c8b5f69`](github/codeql-action@c8b5f69) Update changelog for v4.37.1 * [`9e7c070`](github/codeql-action@9e7c070) Merge pull request [#4014](https://redirect.github.com/github/codeql-action/issues/4014) from github/mbg/explicit-remote-prefix * [`3492b7e`](github/codeql-action@3492b7e) Change `REMOTE_PATH_PREFIX` to `remote=` * [`3654baa`](github/codeql-action@3654baa) Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix * [`2d682ac`](github/codeql-action@2d682ac) Merge pull request [#4017](https://redirect.github.com/github/codeql-action/issues/4017) from github/dependabot/github\_actions/dot-github/wor... * [`23f6a50`](github/codeql-action@23f6a50) Merge pull request [#4009](https://redirect.github.com/github/codeql-action/issues/4009) from github/mbg/action-state/additions * [`1ee3c75`](github/codeql-action@1ee3c75) Merge pull request [#4018](https://redirect.github.com/github/codeql-action/issues/4018) from github/dependabot/github\_actions/dot-github/wor... * [`e053684`](github/codeql-action@e053684) Merge pull request [#4015](https://redirect.github.com/github/codeql-action/issues/4015) from github/dependabot/npm\_and\_yarn/npm-minor-fd2e83... * [`6803c56`](github/codeql-action@6803c56) Merge pull request [#4019](https://redirect.github.com/github/codeql-action/issues/4019) from github/update-bundle/codeql-bundle-v2.26.1 * Additional commits viewable in [compare view](github/codeql-action@99df26d...7188fc3) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
This was referenced Jul 20, 2026
mergify Bot
added a commit
that referenced
this pull request
Jul 26, 2026
…o [skip ci] Bumps [marked](https://github.com/markedjs/marked) from 18.0.6 to 18.0.7. Release notes *Sourced from [marked's releases](https://github.com/markedjs/marked/releases).* > v18.0.7 > ------- > > [18.0.7](markedjs/marked@v18.0.6...v18.0.7) (2026-07-21) > ----------------------------------------------------------------------------------- > > ### Bug Fixes > > * Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexes ([#4014](https://redirect.github.com/markedjs/marked/issues/4014)) ([f945fc5](markedjs/marked@f945fc5)), closes [#3991](https://redirect.github.com/markedjs/marked/issues/3991) > * Avoid O(n^2) masked source rebuild in inline tokenizer ([#4017](https://redirect.github.com/markedjs/marked/issues/4017)) ([9154f8f](markedjs/marked@9154f8f)) > * keep empty list after blockquote as a sibling block ([#4004](https://redirect.github.com/markedjs/marked/issues/4004)) ([3f144a0](markedjs/marked@3f144a0)) > * preserve code spans adjacent to tildes ([#4012](https://redirect.github.com/markedjs/marked/issues/4012)) ([0de7188](markedjs/marked@0de7188)) > * Recognize setext headings whose first line starts with # ([#4015](https://redirect.github.com/markedjs/marked/issues/4015)) ([f056437](markedjs/marked@f056437)), closes [#1](https://redirect.github.com/markedjs/marked/issues/1) > * treat a line of only tabs as a blank line between paragraphs ([#4007](https://redirect.github.com/markedjs/marked/issues/4007)) ([bc2f121](markedjs/marked@bc2f121)) Commits * [`a8971a1`](markedjs/marked@a8971a1) chore(release): 18.0.7 [skip ci] * [`d899c2e`](markedjs/marked@d899c2e) chore(deps): bump actions/setup-node from 6 to 7 ([#4025](https://redirect.github.com/markedjs/marked/issues/4025)) * [`7fbf82e`](markedjs/marked@7fbf82e) chore(deps-dev): bump semantic-release from 25.0.7 to 25.0.8 ([#4026](https://redirect.github.com/markedjs/marked/issues/4026)) * [`738edf2`](markedjs/marked@738edf2) chore(deps-dev): bump brace-expansion from 5.0.2 to 5.0.6 ([#4027](https://redirect.github.com/markedjs/marked/issues/4027)) * [`9154f8f`](markedjs/marked@9154f8f) fix: Avoid O(n^2) masked source rebuild in inline tokenizer ([#4017](https://redirect.github.com/markedjs/marked/issues/4017)) * [`f945fc5`](markedjs/marked@f945fc5) fix: Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexe... * [`3f144a0`](markedjs/marked@3f144a0) fix: keep empty list after blockquote as a sibling block ([#4004](https://redirect.github.com/markedjs/marked/issues/4004)) * [`0de7188`](markedjs/marked@0de7188) fix: preserve code spans adjacent to tildes ([#4012](https://redirect.github.com/markedjs/marked/issues/4012)) * [`f056437`](markedjs/marked@f056437) fix: Recognize setext headings whose first line starts with # ([#4015](https://redirect.github.com/markedjs/marked/issues/4015)) * [`12bfa94`](markedjs/marked@12bfa94) chore(deps-dev): bump semantic-release from 25.0.5 to 25.0.7 ([#4020](https://redirect.github.com/markedjs/marked/issues/4020)) * Additional commits viewable in [compare view](markedjs/marked@v18.0.6...v18.0.7) [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
This was referenced Jul 27, 2026
lvca
added a commit
that referenced
this pull request
Aug 1, 2026
… edge list is unreadable Second code review raised a second-order effect the change had not stated: deleting a vertex disconnects its edges from the vertices on the OTHER end too, so the strict removal reaches a neighbour nobody asked to touch. Measured before/after on the same fixture - a healthy vertex whose neighbour's IN head chunk is unreadable: before: delete SUCCEEDED (edge record gone, neighbour still pointing at it) after: ConcurrentModificationException Keeping that strict, deliberately. Succeeding there means deleting the edge record while the neighbour keeps the back-reference, which is precisely the corruption this issue is about - and inflicting it on a vertex the caller never named. Under the concurrency this fix targets the retry resolves it; on a genuinely broken neighbour list the delete fails and CHECK DATABASE is the repair path. Issue #5680 tracks whether vertex deletion should keep a tolerant escape hatch, and now covers this case too. Pinned by deletingAVertexWhoseNeighbourListIsUnreadableReportsAConflictRatherThanDanglingTheReference, and stated in the strict lookup's javadoc and the release note. The review also suspected Issue4432CorruptVertexDeleteTest of passing only because the scan happens to reach the corrupt vertex before its neighbour. Checked, and it does not: LocalBucket detects the invalid record size on the first read and deletes the record ("Invalid record size 33554444 for record #1:0: deleting record"), so the corrupt vertex fails at RESOLUTION - which stays tolerant - and never reaches the strict head lookup. Deleting the neighbour first, with the corrupt vertex still present, raises the identical RecordNotFoundException with and without this branch.
lvca
added a commit
that referenced
this pull request
Aug 1, 2026
…nstead of skipping it (#5678) * fix(engine) #5670: an unreadable edge-list chunk retries the delete instead of skipping it Deleting an edge disconnects it from both endpoints and then deletes the edge record. The disconnection read the endpoint's chain best-effort: getEdgeHeadChunk answers null when the head chunk cannot be loaded, the chain hops used a plain lookup, and deleteEdge wrapped both in a catch (SchemaException | RecordNotFoundException). All three read "chunk unreadable" as "nothing to remove here" - and the edge record below was deleted anyway. Under concurrency a chunk is regularly unreadable for reasons that say nothing about the graph. A commit publishes its pages one at a time and a reader takes no commit lock, so a vertex page can expose a new edge-list head RID a moment before that head's own page is visible; and a chunk emptied by another transaction is relinked out of the chain while a walker is still following a pointer to it. Hitting either window ended the removal having removed nothing, so the back-reference outlived its edge: the endpoint reported one edge too many and check database reported one broken link. That is the reported ConcurrentEdgeAppendMergeTest failure - 3001 where 3000 was expected, with one integrity error alongside it - and instrumenting the null return reproduces it exactly. The append path (getOrCreateEdgeList) already answered this window with a retryable ConcurrentModificationException. The removal path now does the same: - getEdgeHeadChunkForWrite is the strict counterpart of getEdgeHeadChunk. Null means one thing only: the vertex has no edge list in that direction, so there is genuinely nothing to remove. - deleteEdge splits endpoint resolution from chain mutation, so only a vanished endpoint VERTEX is tolerated - there is nothing to disconnect from a vertex that is gone. - EdgeLinkedList.readChunk and loadChunkForWrite map an unreadable chunk to a retryable conflict. That subsumes StripedEdgeList.loadStripeHead, which is removed rather than left as dead code. - EdgeIteratorFilter's opportunistic pruning of an already-dangling reference runs inside a READ and stays best-effort: it absorbs the new retryable conflict and leaves the ghost for a later pass. Read paths are unchanged: iteration and counting still skip a momentarily unreadable chunk rather than failing. Tests: two deterministic contract tests (head chunk unreadable, mid-chain chunk unreadable) plus the reported concurrent shape. All three fail on the current code and pass with the fix. * fix(engine) #5670: read the head RID inside the strict lookup's try, where a lazy vertex can throw Code review found a real gap in getEdgeHeadChunkForWrite: the head-RID read sat OUTSIDE its try/catch. On a handle that has not materialised its record, ImmutableVertex.getOutEdgesHeadChunk()/getInEdgesHeadChunk() calls checkForLazyLoading(), which loads through LocalBucket.getRecord and raises RecordNotFoundException if the vertex was deleted concurrently - and RecordNotFoundException is NOT a NeedRetryException, so it failed the transaction outright rather than retrying it. The read-side getEdgeHeadChunk deliberately keeps that call inside its try for the same reason. The window is narrow but reachable: resolveEndpointToDisconnect checks existsRecord and resolves the vertex, then getEdgeHeadChunkForWrite reads the head, and a concurrent delete landing between the two slips past both guards. Leaving one non-retryable escape in a change whose whole point is to convert these transients into retries was inconsistent. The read moves inside the try, and the message now carries the underlying cause so the missing RID is still named. Also from the review: - The strict lookup's javadoc now states the price taken deliberately - a genuinely lost chunk is indistinguishable from a transiently invisible one, so it fails the removal on every attempt instead of completing it best-effort, with CHECK DATABASE as the repair path (issue #5680 records how that couples to the tolerance deleteVertex keeps). - The release note's visible-behaviour section names moveEdge, which disconnects through deleteEdge and so shares the new contract. - The stress test's worker catch says what it means: any exception surfacing there IS the bug, not a tolerated retry. Tests: headChunkForWriteRaisesRetryableConflictWhenTheVertexItselfVanishes pins the gap - it fails on the previous commit with a bare RecordNotFoundException out of checkForLazyLoading. * fix(engine) #5670: pin what a vertex delete does when its NEIGHBOUR's edge list is unreadable Second code review raised a second-order effect the change had not stated: deleting a vertex disconnects its edges from the vertices on the OTHER end too, so the strict removal reaches a neighbour nobody asked to touch. Measured before/after on the same fixture - a healthy vertex whose neighbour's IN head chunk is unreadable: before: delete SUCCEEDED (edge record gone, neighbour still pointing at it) after: ConcurrentModificationException Keeping that strict, deliberately. Succeeding there means deleting the edge record while the neighbour keeps the back-reference, which is precisely the corruption this issue is about - and inflicting it on a vertex the caller never named. Under the concurrency this fix targets the retry resolves it; on a genuinely broken neighbour list the delete fails and CHECK DATABASE is the repair path. Issue #5680 tracks whether vertex deletion should keep a tolerant escape hatch, and now covers this case too. Pinned by deletingAVertexWhoseNeighbourListIsUnreadableReportsAConflictRatherThanDanglingTheReference, and stated in the strict lookup's javadoc and the release note. The review also suspected Issue4432CorruptVertexDeleteTest of passing only because the scan happens to reach the corrupt vertex before its neighbour. Checked, and it does not: LocalBucket detects the invalid record size on the first read and deletes the record ("Invalid record size 33554444 for record #1:0: deleting record"), so the corrupt vertex fails at RESOLUTION - which stays tolerant - and never reaches the strict head lookup. Deleting the neighbour first, with the corrupt vertex still present, raises the identical RecordNotFoundException with and without this branch. * docs(engine) #5670: say how to recover when a genuinely broken list blocks a delete Third code review's one ask before merge. The release note stated the trade - a genuinely broken endpoint list now fails the delete instead of completing it best-effort - but not what a user who hits it should DO. It now says: the symptom is a delete that keeps failing however often it retries (ordinary contention succeeds on a retry), the recovery is CHECK DATABASE ... FIX and then retry, and the repair is never blocked by the delete being blocked, because CHECK DATABASE reads edge lists through the best-effort reader. Verified: GraphDatabaseChecker uses getEdgeHeadChunk exclusively, and getEdgeHeadChunkForWrite has exactly one caller, deleteEdge. Also records the accepted retry-pressure shift the review flagged: on a hot super-node the transient publication window is now answered with a retry rather than passing silently, so those transactions retry slightly more often - from "quietly wrong" to "occasionally repeated", landing on the same super-node shape the bug affected. Names txRetryDelay/txRetries as the levers. The review also read the existsRecord check in resolveEndpointToDisconnect as arguably redundant with the resolution that follows. It is not, and the comment now says why: getOutVertex/getInVertex load with loadContent=false and hand back a LAZY handle, so a deleted endpoint does not surface there at all - it surfaces inside getEdgeHeadChunkForWrite, which maps it to a retryable conflict. The check is what separates "vertex gone, nothing to disconnect" (tolerated) from "vertex present, list unreadable" (retry). Dropping it would silently convert the first into the second - and headChunkForWriteRaisesRetryableConflictWhenTheVertexItselfVanishes is exactly that path. Graph package: 334 tests, 0 failures. * test(engine) #5670: bound the concurrent wait, and correct a comment that said the opposite of its code Fourth code review, both actionable items. The stress test's workers caught Exception and the main thread awaited the latch without a timeout, so an Error - or an AssertionError thrown off the main thread - would skip the countDown and hang the run instead of failing it. Workers now catch Throwable and the await is bounded at 5 minutes against a round that takes seconds, which is headroom a slow machine cannot exhaust but a wedged worker will. The review also spotted that deleteEdge's edge-record removal carried the comment "Use the database's delete method to ensure proper index cleanup instead of directly calling bucket.deleteRecord()" directly above a bucket.deleteRecord() call. Checked which of the two was wrong before touching either: an edge carrying an indexed property was deleted and its index went from 1 entry to 0, so the CODE is right and the comment was inverted. LocalDatabase.deleteRecordNoLock cleans the index entries and fires the delete events before dispatching an Edge to deleteEdge, so this call is deliberately the physical removal alone - going back through the database would repeat that work, not add it. The comment now says that. * docs(engine) #5670: give DELETE VERTEX the same prominence as edge delete, and guard a null endpoint Fifth code review's one ask, plus its theoretical-but-cheap point 4. The release note led with edge.delete() and mentioned the vertex reach only in passing, at the tail of the trade-off paragraph - while DELETE VERTEX is in fact the widest-reaching of the three affected operations, because it disconnects each edge from the vertex at the OTHER end and so lands the strict read on a NEIGHBOUR's list. A healthy vertex can now fail to delete because of a neighbour. The visible-effect section now lists the three operations that share the contract and says that outright, including that a healthy vertex next to a corrupted one is not deletable by the normal path until the corruption is repaired. resolveEndpointToDisconnect now returns null for a null endpoint RID instead of reaching existsRecord, which raises IllegalArgumentException on one - not covered by the catch below, not retryable, and so a hard failure escaping the one method whose job is to decide what is tolerable. An edge always carries both endpoints, so this is a guard rather than a case. Graph package: 334 tests, 0 failures (includes main's new EdgesConnectedToTest). * docs(engine) #5670: say why the ghost-prune catch is NeedRetryException and not the narrower CME Sixth code review read the catch as wider than its comment justified and suggested narrowing it to ConcurrentModificationException. Checked the other direction first: NeedRetryException has exactly two subclasses, CME and LockTimeoutException, and the second one says the same thing about this prune - come back for it later. Narrowing the catch would let a lock timeout escape an OPTIONAL repair into the read that triggered it, which is the outcome the catch exists to prevent. So the comment was the half that was wrong, and it now states that the condition being absorbed is "retry later", not one particular cause. No behaviour change; the comment now matches the code instead of the code being narrowed to match the comment.
This was referenced Aug 1, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
add pre-commit configuration
add gh actions
add dependabot configuration