deps(actions): bump github/codeql-action/init from 4.35.5 to 4.36.3#182
deps(actions): bump github/codeql-action/init from 4.35.5 to 4.36.3#182dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.35.5 to 4.36.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@9e0d7b8...54f647b) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![datadog-prod-us1-4[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
There was a problem hiding this comment.
CodeQL security scanning workflow may fail at the analyze step if the database format created by v4.36.3 init is incompatible with v4.35.5 analyze, or if CLI version expectations diverge
Assertion details
- Input: CodeQL workflow with init at v4.36.3 and analyze at v4.35.5, where v4.36.0+ introduced breaking changes requiring CodeQL CLI ≥2.19.4
- Expected:
Both init and analyze actions should be on the same version (v4.36.3) to ensure database format compatibility and consistent CLI expectations - Actual:
The init action is bumped to v4.36.3 (with breaking change requiring CLI 2.19.4+) while analyze remains at v4.35.5, creating version skew that may cause database incompatibility or analysis failures
Was this helpful? React 👍 or 👎
🤖 Datadog Autotest · What is Autotest? · Any feedback? Reach out in #autotest
There was a problem hiding this comment.
This Dependabot PR bumps github/codeql-action/init from 4.35.5 to 4.36.3, introducing a version skew: the init action is now at v4.36.3 (which has a breaking change requiring CodeQL CLI ≥2.19.4) while the analyze action remains at v4.35.5. Using mismatched init and analyze versions can cause database format incompatibility or analysis failures if the CLI versions diverge in expected behavior. The analyze action should be bumped to v4.36.3 as well to ensure consistency.
🤖 Datadog Autotest · Commit a1a7d65 · What is Autotest? · Any feedback? Reach out in #autotest
|
Superseded by #190. |
Bumps github/codeql-action/init from 4.35.5 to 4.36.3.
Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
54f647bMerge pull request #3984 from github/update-v4.36.3-1f34ec164e78819eTrigger checks2c9d3d6Update changelog for v4.36.31f34ec1Merge pull request #3983 from github/mbg/repo-props/ff-for-config-file-propd5f0145Log when repository property has a value but is ignoredf27f563Add test for when the FF is off0025d0fUse FFf7fa18fAdd FF for config file repo property628fc3fMerge pull request #3979 from github/henrymercer/overlay-db-cleanup-size-tele...9cfb67bAdd clarifying commentsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)