294.md (8941B)
1 # PR #294 Bump github/codeql-action from 2.1.11 to 2.1.38 2 3 - **Status:** merged 4 - **Author:** @dependabot[bot] 5 - **Created:** 2023-01-16T08:12:53Z 6 - **Branch:** dependabot/github_actions/github/codeql-action-2.1.38 → main 7 - **Merged:** 2023-01-16T08:29:48Z 8 - **Labels:** dependencies, github_actions 9 - **Assignees:** @MTRNord 10 - **Reviewers:** @MTRNord 11 - **Diff:** [294.diff](./294.diff) 12 13 --- 14 15 Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.11 to 2.1.38. 16 <details> 17 <summary>Changelog</summary> 18 <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> 19 <blockquote> 20 <h1>CodeQL Action Changelog</h1> 21 <h2>[UNRELEASED]</h2> 22 <p>No user facing changes.</p> 23 <h2>2.1.38 - 12 Jan 2023</h2> 24 <ul> 25 <li>Update default CodeQL bundle version to 2.12.0. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1466">#1466</a></li> 26 </ul> 27 <h2>2.1.37 - 14 Dec 2022</h2> 28 <ul> 29 <li>Update default CodeQL bundle version to 2.11.6. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1433">#1433</a></li> 30 </ul> 31 <h2>2.1.36 - 08 Dec 2022</h2> 32 <ul> 33 <li>Update default CodeQL bundle version to 2.11.5. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1412">#1412</a></li> 34 <li>Add a step that tries to upload a SARIF file for the workflow run when that workflow run fails. This will help better surface failed code scanning workflow runs. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1393">#1393</a></li> 35 <li>Python automatic dependency installation will no longer consider dependecy code installed in venv as user-written, for projects using Poetry that specify <code>virtualenvs.in-project = true</code> in their <code>poetry.toml</code>. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1419">#1419</a>.</li> 36 </ul> 37 <h2>2.1.35 - 01 Dec 2022</h2> 38 <p>No user facing changes.</p> 39 <h2>2.1.34 - 25 Nov 2022</h2> 40 <ul> 41 <li>Update default CodeQL bundle version to 2.11.4. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1391">#1391</a></li> 42 <li>Fixed a bug where some the <code>init</code> action and the <code>analyze</code> action would have different sets of experimental feature flags enabled. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1384">#1384</a></li> 43 </ul> 44 <h2>2.1.33 - 16 Nov 2022</h2> 45 <ul> 46 <li>Go is now analyzed in the same way as other compiled languages such as C/C++, C#, and Java. This completes the rollout of the feature described in <a href="https://github.com/github/codeql-action/blob/main/#2127---06-oct-2022">CodeQL Action version 2.1.27</a>. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1322">#1322</a></li> 47 <li>Bump the minimum CodeQL bundle version to 2.6.3. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1358">#1358</a></li> 48 </ul> 49 <h2>2.1.32 - 14 Nov 2022</h2> 50 <ul> 51 <li>Update default CodeQL bundle version to 2.11.3. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1348">#1348</a></li> 52 <li>Update the ML-powered additional query pack for JavaScript to version 0.4.0. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1351">#1351</a></li> 53 </ul> 54 <h2>2.1.31 - 04 Nov 2022</h2> 55 <ul> 56 <li>The <code>rb/weak-cryptographic-algorithm</code> Ruby query has been updated to no longer report uses of hash functions such as <code>MD5</code> and <code>SHA1</code> even if they are known to be weak. These hash algorithms are used very often in non-sensitive contexts, making the query too imprecise in practice. For more information, see the corresponding change in the <a href="https://github-redirect.dependabot.com/github/codeql/pull/11129">github/codeql repository</a>. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1344">#1344</a></li> 57 </ul> 58 <h2>2.1.30 - 02 Nov 2022</h2> 59 <ul> 60 <li>Improve the error message when using CodeQL bundle version 2.7.2 and earlier in a workflow that runs on a runner image such as <code>ubuntu-22.04</code> that uses glibc version 2.34 and later. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1334">#1334</a></li> 61 </ul> 62 <h2>2.1.29 - 26 Oct 2022</h2> 63 <ul> 64 <li>Update default CodeQL bundle version to 2.11.2. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1320">#1320</a></li> 65 </ul> 66 <!-- raw HTML omitted --> 67 </blockquote> 68 <p>... (truncated)</p> 69 </details> 70 <details> 71 <summary>Commits</summary> 72 <ul> 73 <li><a href="https://github.com/github/codeql-action/commit/515828d97454b8354517688ddc5b48402b723750"><code>515828d</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1476">#1476</a> from github/update-v2.1.38-70fdddff</li> 74 <li><a href="https://github.com/github/codeql-action/commit/caa49ae471e2206bb15ab26ae8ec9dda485dc94b"><code>caa49ae</code></a> Update changelog for v2.1.38</li> 75 <li><a href="https://github.com/github/codeql-action/commit/70fdddff11426a4e021d90c8fb536bf6ab75ece3"><code>70fdddf</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1474">#1474</a> from github/henrymercer/fix-ghae-setup-test</li> 76 <li><a href="https://github.com/github/codeql-action/commit/6ba0a3655032fff9422e16fa94e3a280bf778649"><code>6ba0a36</code></a> Add JSDoc for <code>mockDownloadApi</code></li> 77 <li><a href="https://github.com/github/codeql-action/commit/4a918790cdf45c3e5af9a23ee15efd81f8015fc2"><code>4a91879</code></a> Merge branch 'main' into henrymercer/fix-ghae-setup-test</li> 78 <li><a href="https://github.com/github/codeql-action/commit/42d6d35dd1d831e6064c86b91e4b1c804fd9ce12"><code>42d6d35</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1464">#1464</a> from github/aeisenberg/externalRepoTokenConfigParsing</li> 79 <li><a href="https://github.com/github/codeql-action/commit/e009918fbcb4e55157869d3bc7319bf9f2ccd1f1"><code>e009918</code></a> Merge branch 'main' into aeisenberg/externalRepoTokenConfigParsing</li> 80 <li><a href="https://github.com/github/codeql-action/commit/70a288daae5b0efc46cbc040018a770f3bd2e27b"><code>70a288d</code></a> Merge branch 'main' into henrymercer/fix-ghae-setup-test</li> 81 <li><a href="https://github.com/github/codeql-action/commit/bdc7c5d203860b808ad2371e491a35160fc2f9c0"><code>bdc7c5d</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1466">#1466</a> from github/dbartol/bundle-20230105</li> 82 <li><a href="https://github.com/github/codeql-action/commit/272d916f238bfdc1f9a07a5566440c194549b7fc"><code>272d916</code></a> Address comments from PR</li> 83 <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/a3a6c128d771b6b9bdebb1c9d0583ebd2728a108...515828d97454b8354517688ddc5b48402b723750">compare view</a></li> 84 </ul> 85 </details> 86 <br /> 87 88 89 [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) 90 91 Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. 92 93 [//]: # (dependabot-automerge-start) 94 [//]: # (dependabot-automerge-end) 95 96 --- 97 98 <details> 99 <summary>Dependabot commands and options</summary> 100 <br /> 101 102 You can trigger Dependabot actions by commenting on this PR: 103 - `@dependabot rebase` will rebase this PR 104 - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it 105 - `@dependabot merge` will merge this PR after your CI passes on it 106 - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it 107 - `@dependabot cancel merge` will cancel a previously requested merge and block automerging 108 - `@dependabot reopen` will reopen this PR if it is closed 109 - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually 110 - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) 111 - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) 112 - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) 113 114 115 </details> 116 117 <!-- Replace --> 118 ---- 119 ⌛ Deploy Preview - Build in Progress 120 <!-- Replace --> 121 122