matrix-art.meta

294.json (9288B)

---

 {
   "number": 294,
   "title": "Bump github/codeql-action from 2.1.11 to 2.1.38",
   "state": "merged",
   "diff_file": "294.diff",
   "author": "dependabot[bot]",
   "created_at": "2023-01-16T08:12:53Z",
   "closed_at": "2023-01-16T08:29:48Z",
   "merged_at": "2023-01-16T08:29:48Z",
   "base_ref": "main",
   "head_ref": "dependabot/github_actions/github/codeql-action-2.1.38",
   "labels": [
     "dependencies",
     "github_actions"
   ],
   "assignees": [
     "MTRNord"
   ],
   "requested_reviewers": [
     "MTRNord"
   ],
   "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.11 to 2.1.38.\n<details>\n<summary>Changelog</summary>\n<p><em>Sourced from <a href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\">github/codeql-action's changelog</a>.</em></p>\n<blockquote>\n<h1>CodeQL Action Changelog</h1>\n<h2>[UNRELEASED]</h2>\n<p>No user facing changes.</p>\n<h2>2.1.38 - 12 Jan 2023</h2>\n<ul>\n<li>Update default CodeQL bundle version to 2.12.0. <a href=\"https://github-redirect.dependabot.com/github/codeql-action/pull/1466\">#1466</a></li>\n</ul>\n<h2>2.1.37 - 14 Dec 2022</h2>\n<ul>\n<li>Update default CodeQL bundle version to 2.11.6. <a href=\"https://github-redirect.dependabot.com/github/codeql-action/pull/1433\">#1433</a></li>\n</ul>\n<h2>2.1.36 - 08 Dec 2022</h2>\n<ul>\n<li>Update default CodeQL bundle version to 2.11.5. <a href=\"https://github-redirect.dependabot.com/github/codeql-action/pull/1412\">#1412</a></li>\n<li>Add a step that tries to upload a SARIF file for the workflow run when that workflow run fails. This will help better surface failed code scanning workflow runs. <a href=\"https://github-redirect.dependabot.com/github/codeql-action/pull/1393\">#1393</a></li>\n<li>Python automatic dependency installation will no longer consider dependecy code installed in venv as user-written, for projects using Poetry that specify <code>virtualenvs.in-project = true</code> in their <code>poetry.toml</code>. <a href=\"https://github-redirect.dependabot.com/github/codeql-action/pull/1419\">#1419</a>.</li>\n</ul>\n<h2>2.1.35 - 01 Dec 2022</h2>\n<p>No user facing changes.</p>\n<h2>2.1.34 - 25 Nov 2022</h2>\n<ul>\n<li>Update default CodeQL bundle version to 2.11.4. <a href=\"https://github-redirect.dependabot.com/github/codeql-action/pull/1391\">#1391</a></li>\n<li>Fixed a bug where some the <code>init</code> action and the <code>analyze</code> action would have different sets of experimental feature flags enabled. <a href=\"https://github-redirect.dependabot.com/github/codeql-action/pull/1384\">#1384</a></li>\n</ul>\n<h2>2.1.33 - 16 Nov 2022</h2>\n<ul>\n<li>Go is now analyzed in the same way as other compiled languages such as C/C++, C#, and Java. This completes the rollout of the feature described in <a href=\"https://github.com/github/codeql-action/blob/main/#2127---06-oct-2022\">CodeQL Action version 2.1.27</a>. <a href=\"https://github-redirect.dependabot.com/github/codeql-action/pull/1322\">#1322</a></li>\n<li>Bump the minimum CodeQL bundle version to 2.6.3. <a href=\"https://github-redirect.dependabot.com/github/codeql-action/pull/1358\">#1358</a></li>\n</ul>\n<h2>2.1.32 - 14 Nov 2022</h2>\n<ul>\n<li>Update default CodeQL bundle version to 2.11.3. <a href=\"https://github-redirect.dependabot.com/github/codeql-action/pull/1348\">#1348</a></li>\n<li>Update the ML-powered additional query pack for JavaScript to version 0.4.0. <a href=\"https://github-redirect.dependabot.com/github/codeql-action/pull/1351\">#1351</a></li>\n</ul>\n<h2>2.1.31 - 04 Nov 2022</h2>\n<ul>\n<li>The <code>rb/weak-cryptographic-algorithm</code> Ruby query has been updated to no longer report uses of hash functions such as <code>MD5</code> and <code>SHA1</code> even if they are known to be weak. These hash algorithms are used very often in non-sensitive contexts, making the query too imprecise in practice. For more information, see the corresponding change in the <a href=\"https://github-redirect.dependabot.com/github/codeql/pull/11129\">github/codeql repository</a>. <a href=\"https://github-redirect.dependabot.com/github/codeql-action/pull/1344\">#1344</a></li>\n</ul>\n<h2>2.1.30 - 02 Nov 2022</h2>\n<ul>\n<li>Improve the error message when using CodeQL bundle version 2.7.2 and earlier in a workflow that runs on a runner image such as <code>ubuntu-22.04</code> that uses glibc version 2.34 and later. <a href=\"https://github-redirect.dependabot.com/github/codeql-action/pull/1334\">#1334</a></li>\n</ul>\n<h2>2.1.29 - 26 Oct 2022</h2>\n<ul>\n<li>Update default CodeQL bundle version to 2.11.2. <a href=\"https://github-redirect.dependabot.com/github/codeql-action/pull/1320\">#1320</a></li>\n</ul>\n<!-- raw HTML omitted -->\n</blockquote>\n<p>... (truncated)</p>\n</details>\n<details>\n<summary>Commits</summary>\n<ul>\n<li><a href=\"https://github.com/github/codeql-action/commit/515828d97454b8354517688ddc5b48402b723750\"><code>515828d</code></a> Merge pull request <a href=\"https://github-redirect.dependabot.com/github/codeql-action/issues/1476\">#1476</a> from github/update-v2.1.38-70fdddff</li>\n<li><a href=\"https://github.com/github/codeql-action/commit/caa49ae471e2206bb15ab26ae8ec9dda485dc94b\"><code>caa49ae</code></a> Update changelog for v2.1.38</li>\n<li><a href=\"https://github.com/github/codeql-action/commit/70fdddff11426a4e021d90c8fb536bf6ab75ece3\"><code>70fdddf</code></a> Merge pull request <a href=\"https://github-redirect.dependabot.com/github/codeql-action/issues/1474\">#1474</a> from github/henrymercer/fix-ghae-setup-test</li>\n<li><a href=\"https://github.com/github/codeql-action/commit/6ba0a3655032fff9422e16fa94e3a280bf778649\"><code>6ba0a36</code></a> Add JSDoc for <code>mockDownloadApi</code></li>\n<li><a href=\"https://github.com/github/codeql-action/commit/4a918790cdf45c3e5af9a23ee15efd81f8015fc2\"><code>4a91879</code></a> Merge branch 'main' into henrymercer/fix-ghae-setup-test</li>\n<li><a href=\"https://github.com/github/codeql-action/commit/42d6d35dd1d831e6064c86b91e4b1c804fd9ce12\"><code>42d6d35</code></a> Merge pull request <a href=\"https://github-redirect.dependabot.com/github/codeql-action/issues/1464\">#1464</a> from github/aeisenberg/externalRepoTokenConfigParsing</li>\n<li><a href=\"https://github.com/github/codeql-action/commit/e009918fbcb4e55157869d3bc7319bf9f2ccd1f1\"><code>e009918</code></a> Merge branch 'main' into aeisenberg/externalRepoTokenConfigParsing</li>\n<li><a href=\"https://github.com/github/codeql-action/commit/70a288daae5b0efc46cbc040018a770f3bd2e27b\"><code>70a288d</code></a> Merge branch 'main' into henrymercer/fix-ghae-setup-test</li>\n<li><a href=\"https://github.com/github/codeql-action/commit/bdc7c5d203860b808ad2371e491a35160fc2f9c0\"><code>bdc7c5d</code></a> Merge pull request <a href=\"https://github-redirect.dependabot.com/github/codeql-action/issues/1466\">#1466</a> from github/dbartol/bundle-20230105</li>\n<li><a href=\"https://github.com/github/codeql-action/commit/272d916f238bfdc1f9a07a5566440c194549b7fc\"><code>272d916</code></a> Address comments from PR</li>\n<li>Additional commits viewable in <a href=\"https://github.com/github/codeql-action/compare/a3a6c128d771b6b9bdebb1c9d0583ebd2728a108...515828d97454b8354517688ddc5b48402b723750\">compare view</a></li>\n</ul>\n</details>\n<br />\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=2.1.11&new-version=2.1.38)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n<details>\n<summary>Dependabot commands and options</summary>\n<br />\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot merge` will merge this PR after your CI passes on it\n- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it\n- `@dependabot cancel merge` will cancel a previously requested merge and block automerging\n- `@dependabot reopen` will reopen this PR if it is closed\n- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n</details>\n\n<!-- Replace -->\n----\n\u231b Deploy Preview - Build in Progress\n<!-- Replace -->\n",
   "comments": [],
   "review_comments": []
 }