chore(deps): bump github/codeql-action/autobuild from 4.36.2 to 4.37.1 by dependabot[bot] · Pull Request #3365 · getsentry/sentry-cli

dependabot · 2026-07-13T21:33:53Z

Bumps github/codeql-action/autobuild from 4.36.2 to 4.37.1.

Release notes

Sourced from github/codeql-action/autobuild's releases.

v4.37.1

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/autobuild's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.1 - 16 Jul 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

... (truncated)

Commits

7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
c8b5f69 Update changelog for v4.37.1
9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
3492b7e Change REMOTE_PATH_PREFIX to remote=
3654baa Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
2d682ac Merge pull request #4017 from github/dependabot/github_actions/dot-github/wor...
23f6a50 Merge pull request #4009 from github/mbg/action-state/additions
1ee3c75 Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...
e053684 Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...
6803c56 Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1
Additional commits viewable in compare view

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 36b8b3b. Configure here.}

cursor · 2026-07-13T21:34:28Z

      # If this step fails, then you should remove it and run the build manually (see below)
      - name: Autobuild
-        uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # 4.35.4
+        uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # 4.37.0


Mismatched CodeQL action versions

Medium Severity

This change pins github/codeql-action/autobuild to 4.37.0 while init and analyze in the same job still use 4.35.4. The three steps are meant to run the same CodeQL Action release so shared CLI metadata, caches, and step-to-step state stay aligned; mixing minors can break or destabilize the CodeQL workflow.

Additional Locations (2)

.github/workflows/codeql-analysis.yml#L39-L40

.github/workflows/codeql-analysis.yml#L61-L62

^{Reviewed by Cursor Bugbot for commit 36b8b3b. Configure here.}

szokeasaurusrex · 2026-07-17T10:08:36Z

@dependabot rebase

Bumps [github/codeql-action/autobuild](https://github.com/github/codeql-action) from 4.36.2 to 4.37.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@8aad20d...7188fc3) --- updated-dependencies: - dependency-name: github/codeql-action/autobuild dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

…tion/autobuild-4.37.0

dependabot · 2026-07-17T11:20:57Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 13, 2026

dependabot Bot requested review from a team and szokeasaurusrex as code owners July 13, 2026 21:33

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 13, 2026

cursor Bot reviewed Jul 13, 2026

View reviewed changes

szokeasaurusrex approved these changes Jul 17, 2026

View reviewed changes

dependabot Bot changed the title ~~chore(deps): bump github/codeql-action/autobuild from 4.35.4 to 4.37.0~~ chore(deps): bump github/codeql-action/autobuild from 4.36.2 to 4.37.1 Jul 17, 2026

dependabot Bot force-pushed the dependabot/github_actions/github/codeql-action/autobuild-4.37.0 branch from 36b8b3b to 2522602 Compare July 17, 2026 10:09

Merge branch 'master' into dependabot/github_actions/github/codeql-ac…

fccfdb8

…tion/autobuild-4.37.0

szokeasaurusrex closed this Jul 17, 2026

dependabot Bot deleted the dependabot/github_actions/github/codeql-action/autobuild-4.37.0 branch July 17, 2026 11:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): bump github/codeql-action/autobuild from 4.36.2 to 4.37.1#3365

chore(deps): bump github/codeql-action/autobuild from 4.36.2 to 4.37.1#3365
dependabot[bot] wants to merge 2 commits into
masterfrom
dependabot/github_actions/github/codeql-action/autobuild-4.37.0

dependabot Bot commented on behalf of github Jul 13, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jul 13, 2026

Uh oh!

szokeasaurusrex commented Jul 17, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.37.1

v4.37.0

v4.36.3

CodeQL Action Changelog

[UNRELEASED]

4.37.1 - 16 Jul 2026

4.37.0 - 08 Jul 2026

4.36.3 - 01 Jul 2026

4.36.2 - 04 Jun 2026

4.36.1 - 02 Jun 2026

4.36.0 - 22 May 2026

4.35.5 - 15 May 2026

4.35.4 - 07 May 2026

4.35.3 - 01 May 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 13, 2026

Choose a reason for hiding this comment

Mismatched CodeQL action versions

Uh oh!

szokeasaurusrex commented Jul 17, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jul 13, 2026 •

edited

Loading