Skip to content

#4018 fix: Cypher temporal component access on date/datetime returns null#4031

Merged
robfrank merged 2 commits into
mainfrom
fix/4018-cypher-temporal-component-access
Apr 29, 2026
Merged

#4018 fix: Cypher temporal component access on date/datetime returns null#4031
robfrank merged 2 commits into
mainfrom
fix/4018-cypher-temporal-component-access

Conversation

@robfrank

Copy link
Copy Markdown
Collaborator

Summary

  • date().year, date().month, date().day, datetime().year, etc. all returned null instead of the expected numeric component
  • Root cause: ChainedPropertyAccessExpression.evaluate() (used when the base of a property access is a function call, not a bare variable) handled Document, Map, and Result types but was missing CypherTemporalValue, LocalDate, and LocalDateTime branches
  • Fix: added the three missing temporal instanceof checks in ChainedPropertyAccessExpression, mirroring what PropertyAccessExpression already did correctly

Test plan

  • 10 new regression tests added to OpenCypherTemporalFunctionsComprehensiveTest covering date(), datetime(), localdatetime(), localtime(), and time() component accessors on both literal and current-time expressions
  • All 10 new tests fail before the fix, pass after
  • All 5417 existing OpenCypher tests pass (0 regressions)

Fixes #4018

🤖 Generated with Claude Code

…ion calls returns null

ChainedPropertyAccessExpression (used when the base is a function call like
date().year) was missing temporal type handling, falling through to null.
Added CypherTemporalValue, LocalDate, and LocalDateTime branches mirroring
PropertyAccessExpression.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@codacy-production

codacy-production Bot commented Apr 29, 2026

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 8 complexity

Metric Results
Complexity 8

View in Codacy

🟢 Coverage 33.33% diff coverage · -7.88% coverage variation

Metric Results
Coverage variation -7.88% coverage variation
Diff coverage 33.33% diff coverage

View coverage diff in Codacy

Coverage variation details
Coverable lines Covered lines Coverage
Common ancestor commit (7d94afb) 120170 87923 73.17%
Head commit (3e73b4b) 151431 (+31261) 98864 (+10941) 65.29% (-7.88%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details
Coverable lines Covered lines Diff coverage
Pull request (#4031) 6 2 33.33%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

@claude

claude Bot commented Apr 29, 2026

Copy link
Copy Markdown

Code Review - #4031: Cypher temporal component access fix

Overview

This PR correctly fixes a null-return bug when accessing temporal components (.year, .month, .day, etc.) on the result of a temporal function call (e.g., date().year, datetime().hour). The root cause - ChainedPropertyAccessExpression missing temporal type handling that PropertyAccessExpression already had - is correctly identified and the fix is minimal and well-targeted.


Code Quality

Fix in CypherExpressionBuilder.java (lines 1671-1679)

The three added branches exactly mirror PropertyAccessExpression.evaluate(), which is good. One structural observation: the same type-dispatch logic now lives in two places. If a new temporal type is added in the future, both classes need updating. A shared static helper (e.g., TemporalPropertyAccess.get(Object base, String name)) would eliminate this duplication. Not a blocker for this PR, but worth noting.

Behavioral inconsistency (pre-existing, not introduced here)

PropertyAccessExpression throws CommandExecutionException for unrecognized base types, while ChainedPropertyAccessExpression silently returns null. The new temporal branches make both paths consistent with each other, but the outer fallthrough still differs. Worth a follow-up.


Test Coverage

The 10 new regression tests are appropriate and cover the main scenarios. A few observations:

Fully qualified type names instead of imports

The new tests use java.time.LocalDate.now() and java.time.ZonedDateTime.now() as fully qualified names rather than imports. The existing file has no java.time.* imports, so these should be added to the import block for consistency with project style:

// Add to imports:
import java.time.LocalDate;
import java.time.ZonedDateTime;

// Then in tests:
final LocalDate today = LocalDate.now();
final ZonedDateTime now = ZonedDateTime.now();

Theoretical race condition in "current time" tests

dateComponentsFromCurrentDate() and datetimeYearFromCurrentDatetime() capture now before issuing the query. If the test runs right at a day/year boundary the captured value and the query result may disagree. Very unlikely in practice, but literal-based tests (date('2020-01-15').year) are fully deterministic and the pattern used elsewhere in this file. Consider replacing or supplementing the current-time tests with purely deterministic assertions, or at minimum document the accepted flakiness risk.

Minor: Assertions.assertThat() vs static-imported assertThat()

Several new tests use the fully qualified Assertions.assertThat(result.hasNext()).isTrue() alongside the static-import assertThat(...). The rest of the file uses the static import uniformly. The redundant Assertions. qualifier could be dropped.


Summary

  • Fix is correct, minimal, and well-explained in the PR description.
  • Tests demonstrate the regression clearly.
  • Suggested improvements: import java.time types instead of fully qualifying them, consider deterministic alternatives to "current time" tests, and watch for future duplication between the two property-access classes.

Overall this is a solid targeted fix - the concerns above are style/maintenance notes rather than blockers.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces support for accessing temporal components such as year, month, day, hour, and minute in OpenCypher queries. The changes include updates to the CypherExpressionBuilder to handle property access for CypherTemporalValue, LocalDate, and LocalDateTime types, along with a comprehensive suite of tests. Feedback suggests simplifying the type-checking logic in CypherExpressionBuilder by potentially consolidating the instanceof checks or better utilizing the CypherTemporalValue interface to avoid explicit type checks.

Comment on lines +1671 to +1679
if (baseValue instanceof CypherTemporalValue) {
return ((CypherTemporalValue) baseValue).getTemporalProperty(propertyName);
}
if (baseValue instanceof LocalDate) {
return new CypherDate((LocalDate) baseValue).getTemporalProperty(propertyName);
}
if (baseValue instanceof LocalDateTime) {
return new CypherLocalDateTime((LocalDateTime) baseValue).getTemporalProperty(propertyName);
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The temporal type checks can be simplified by using a single instanceof check or a pattern matching switch if the Java version allows, but at minimum, consider consolidating the logic to avoid repeated getTemporalProperty calls if possible, or ensure that the CypherTemporalValue interface is fully utilized to avoid explicit LocalDate and LocalDateTime checks here.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The three instanceof checks are necessary because LocalDate and LocalDateTime are java.time types that do not implement CypherTemporalValue - they need to be wrapped in CypherDate/CypherLocalDateTime before the property can be resolved. This is the same pattern used in PropertyAccessExpression.evaluate() for the same reason.

Consolidating into a single check would require either making java.time types implement CypherTemporalValue (a larger structural change) or adding a wrapper method - both are beyond the scope of this targeted fix. The duplication between the two expression classes is noted in the Claude bot review as a future improvement.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude

claude Bot commented Apr 29, 2026

Copy link
Copy Markdown

Code Review

Overview

This PR fixes a real bug: ChainedPropertyAccessExpression (used when the base of a property access is a function call like date().year) was missing the temporal type branches that PropertyAccessExpression already handled correctly. The root cause analysis is accurate, the fix is minimal and correct.


Code Quality

The fix is correct and follows the existing pattern. The three added branches in ChainedPropertyAccessExpression.evaluate() are a direct mirror of what PropertyAccessExpression already does.

One concern worth raising: the duplicated logic now lives in two places. If a new temporal type is added (e.g., a future ZonedDateTime direct return from a function), it will need to be added to both PropertyAccessExpression and ChainedPropertyAccessExpression. A shared static helper would make this easier to maintain:

// e.g., in a shared TemporalPropertyAccessUtil or on CypherTemporalValue itself
static Object getTemporalProperty(final Object value, final String propertyName) {
    if (value instanceof CypherTemporalValue ctv)
        return ctv.getTemporalProperty(propertyName);
    if (value instanceof LocalDate ld)
        return new CypherDate(ld).getTemporalProperty(propertyName);
    if (value instanceof LocalDateTime ldt)
        return new CypherLocalDateTime(ldt).getTemporalProperty(propertyName);
    return null;
}

This is a suggestion for follow-up, not a blocker.


Behavior Asymmetry (pre-existing, worth documenting)

PropertyAccessExpression throws CommandExecutionException for unrecognized types (e.g., accessing .foo on an Integer). ChainedPropertyAccessExpression silently returns null for the same case. This asymmetry pre-exists this PR, but since this PR touches the file, it is worth a comment in the code or a follow-up issue. The return null; on the last line of ChainedPropertyAccessExpression.evaluate() will silently swallow type errors like date().year on a non-temporal type.


Performance

For the LocalDate / LocalDateTime branches, each property access allocates a new CypherDate / CypherLocalDateTime wrapper just to call getTemporalProperty. This matches what PropertyAccessExpression already does, so it is not a regression. However, if these paths are hot (e.g., in a large RETURN over many rows), the allocation could be avoided by extracting the property lookup directly. Low priority, but worth a note.


Test Coverage

The 10 new regression tests are well-chosen and cover:

  • Literal date/datetime/localdatetime/localtime/time component access
  • Current date/datetime component access (live values)

One potential flakiness risk: datetimeYearFromCurrentDatetime captures ZonedDateTime.now() before the query executes. If this test runs at exactly midnight on a year boundary, the year could differ between the Java capture and the query result. The probability is negligible, but if this becomes a flaky CI test, that is why. Replacing with a fixed literal (as done in the other tests) would fully eliminate the risk.


Minor

  • The section comment // ==================== Temporal component accessor tests (issue #4018) ==================== uses a banner style not present elsewhere in the test class. Prefer a plain blank line + @Test to stay consistent with the surrounding style.
  • The var row = result.next() usage is fine for Java 21.

Summary

The fix is correct and the test coverage is solid. Two actionable suggestions:

  1. Consider a shared helper to avoid the duplicated temporal instanceof chain between PropertyAccessExpression and ChainedPropertyAccessExpression (follow-up OK).
  2. Replace the live-time test (datetimeYearFromCurrentDatetime) with a fixed literal to avoid a theoretical midnight flake.

Neither is a blocker. Good find and clean fix.

@robfrank

Copy link
Copy Markdown
Collaborator Author

Addressed the review feedback in the second commit:

  • Added import java.time.LocalDate and import java.time.ZonedDateTime - replaced inline FQNs in test methods with imported short names
  • Dropped redundant Assertions. qualifier on hasNext() assertions - the static assertThat(boolean) overload is unambiguous

Not changed:

  • Three instanceof checks - LocalDate/LocalDateTime don't implement CypherTemporalValue, so consolidation isn't possible without structural changes outside this fix's scope (explained in inline thread)
  • Current-time tests (dateComponentsFromCurrentDate, datetimeYearFromCurrentDatetime) - accepted the theoretical boundary risk; tests complete in milliseconds and the pattern matches the rest of the file
  • Shared static helper for temporal dispatch between PropertyAccessExpression and ChainedPropertyAccessExpression - valid future improvement, tracked separately

@robfrank

Copy link
Copy Markdown
Collaborator Author

On the banner comment style: the // ==================== ... ==================== pattern is used throughout this file already (see // ==================== duration() Tests ==================== at line 55, // ==================== duration.between() Tests ==================== at line 96, and others). The new section follows that convention.

On the datetimeYearFromCurrentDatetime flakiness concern: dateComponentsFromCurrentDate uses the identical capture-before-query pattern and is already in the file. Accepting the same risk there.

Everything else (shared helper, behavior asymmetry, performance) already acknowledged as follow-up.

@codecov

codecov Bot commented Apr 29, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 16.66667% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 64.26%. Comparing base (7d94afb) to head (3e73b4b).
⚠️ Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
...ery/opencypher/parser/CypherExpressionBuilder.java 16.66% 4 Missing and 1 partial ⚠️
Additional details and impacted files
@@           Coverage Diff           @@
##             main    #4031   +/-   ##
=======================================
  Coverage   64.25%   64.26%           
=======================================
  Files        1597     1597           
  Lines      120170   120176    +6     
  Branches    25589    25592    +3     
=======================================
+ Hits        77220    77228    +8     
- Misses      32278    32279    +1     
+ Partials    10672    10669    -3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@robfrank
robfrank merged commit f4d14cf into main Apr 29, 2026
26 of 29 checks passed
tae898 pushed a commit to humemai/arcadedb-embedded-python that referenced this pull request May 1, 2026
robfrank added a commit that referenced this pull request May 12, 2026
tae898 pushed a commit to humemai/arcadedb-embedded-python that referenced this pull request Jun 28, 2026
tae898 pushed a commit to humemai/arcadedb-embedded-python that referenced this pull request Jun 28, 2026
tae898 pushed a commit to humemai/arcadedb-embedded-python that referenced this pull request Jun 28, 2026
@lvca
lvca deleted the fix/4018-cypher-temporal-component-access branch July 3, 2026 20:18
mergify Bot added a commit that referenced this pull request Jul 26, 2026
…updates [skip ci]

Bumps the github-actions group with 6 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.178` | `1.0.183` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.1` | `4.37.3` |
| [docker/login-action](https://github.com/docker/login-action) | `4.4.0` | `4.5.1` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.1` | `4.37.3` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.1` | `4.37.3` |
Updates `actions/checkout` from 7.0.0 to 7.0.1
Release notes

*Sourced from [actions/checkout's releases](https://github.com/actions/checkout/releases).*

> v7.0.1
> ------
>
> What's Changed
> --------------
>
> * skip running unsafe pr check if input is default by [`@​aiqiaoy`](https://github.com/aiqiaoy) in [actions/checkout#2518](https://redirect.github.com/actions/checkout/pull/2518)
> * trim only ascii whitespace for branch by [`@​aiqiaoy`](https://github.com/aiqiaoy) in [actions/checkout#2521](https://redirect.github.com/actions/checkout/pull/2521)
> * escape values passed to --unset by [`@​aiqiaoy`](https://github.com/aiqiaoy) in [actions/checkout#2530](https://redirect.github.com/actions/checkout/pull/2530)
> * Various dependency updates
>
> **Full Changelog**: <actions/checkout@v7...v7.0.1>


Changelog

*Sourced from [actions/checkout's changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md).*

> Changelog
> =========
>
> v7.0.1
> ------
>
> * Skip running unsafe pr check if input is default by [`@​aiqiaoy`](https://github.com/aiqiaoy) in [actions/checkout#2518](https://redirect.github.com/actions/checkout/pull/2518)
> * Trim only ascii whitespace for branch by [`@​aiqiaoy`](https://github.com/aiqiaoy) in [actions/checkout#2521](https://redirect.github.com/actions/checkout/pull/2521)
> * Escape values passed to --unset by [`@​aiqiaoy`](https://github.com/aiqiaoy) in [actions/checkout#2530](https://redirect.github.com/actions/checkout/pull/2530)
> * Various dependency updates
>
> v7.0.0
> ------
>
> * Block checking out fork PR for pull\_request\_target and workflow\_run by [`@​aiqiaoy`](https://github.com/aiqiaoy) in [actions/checkout#2454](https://redirect.github.com/actions/checkout/pull/2454)
> * Various dependency updates
>
> v6.0.3
> ------
>
> * Fix checkout init for SHA-256 repositories by [`@​yaananth`](https://github.com/yaananth) in [actions/checkout#2439](https://redirect.github.com/actions/checkout/pull/2439)
> * fix: expand merge commit SHA regex and add SHA-256 test cases by [`@​yaananth`](https://github.com/yaananth) in [actions/checkout#2414](https://redirect.github.com/actions/checkout/pull/2414)
>
> v6.0.2
> ------
>
> * Fix tag handling: preserve annotations and explicit fetch-tags by [`@​ericsciple`](https://github.com/ericsciple) in [actions/checkout#2356](https://redirect.github.com/actions/checkout/pull/2356)
>
> v6.0.1
> ------
>
> * Add worktree support for persist-credentials includeIf by [`@​ericsciple`](https://github.com/ericsciple) in [actions/checkout#2327](https://redirect.github.com/actions/checkout/pull/2327)
>
> v6.0.0
> ------
>
> * Persist creds to a separate file by [`@​ericsciple`](https://github.com/ericsciple) in [actions/checkout#2286](https://redirect.github.com/actions/checkout/pull/2286)
> * Update README to include Node.js 24 support details and requirements by [`@​salmanmkc`](https://github.com/salmanmkc) in [actions/checkout#2248](https://redirect.github.com/actions/checkout/pull/2248)
>
> v5.0.1
> ------
>
> * Port v6 cleanup to v5 by [`@​ericsciple`](https://github.com/ericsciple) in [actions/checkout#2301](https://redirect.github.com/actions/checkout/pull/2301)
>
> v5.0.0
> ------
>
> * Update actions checkout to use node 24 by [`@​salmanmkc`](https://github.com/salmanmkc) in [actions/checkout#2226](https://redirect.github.com/actions/checkout/pull/2226)
>
> v4.3.1
> ------
>
> * Port v6 cleanup to v4 by [`@​ericsciple`](https://github.com/ericsciple) in [actions/checkout#2305](https://redirect.github.com/actions/checkout/pull/2305)
>
> v4.3.0
> ------
>
> * docs: update README.md by [`@​motss`](https://github.com/motss) in [actions/checkout#1971](https://redirect.github.com/actions/checkout/pull/1971)
> * Add internal repos for checking out multiple repositories by [`@​mouismail`](https://github.com/mouismail) in [actions/checkout#1977](https://redirect.github.com/actions/checkout/pull/1977)
> * Documentation update - add recommended permissions to Readme by [`@​benwells`](https://github.com/benwells) in [actions/checkout#2043](https://redirect.github.com/actions/checkout/pull/2043)
> * Adjust positioning of user email note and permissions heading by [`@​joshmgross`](https://github.com/joshmgross) in [actions/checkout#2044](https://redirect.github.com/actions/checkout/pull/2044)
> * Update README.md by [`@​nebuk89`](https://github.com/nebuk89) in [actions/checkout#2194](https://redirect.github.com/actions/checkout/pull/2194)
> * Update CODEOWNERS for actions by [`@​TingluoHuang`](https://github.com/TingluoHuang) in [actions/checkout#2224](https://redirect.github.com/actions/checkout/pull/2224)
> * Update package dependencies by [`@​salmanmkc`](https://github.com/salmanmkc) in [actions/checkout#2236](https://redirect.github.com/actions/checkout/pull/2236)
>
> v4.2.2
> ------
>
> * `url-helper.ts` now leverages well-known environment variables by [`@​jww3`](https://github.com/jww3) in [actions/checkout#1941](https://redirect.github.com/actions/checkout/pull/1941)
> * Expand unit test coverage for `isGhes` by [`@​jww3`](https://github.com/jww3) in [actions/checkout#1946](https://redirect.github.com/actions/checkout/pull/1946)
>
> v4.2.1
> ------
>
> * Check out other refs/\* by commit if provided, fall back to ref by [`@​orhantoy`](https://github.com/orhantoy) in [actions/checkout#1924](https://redirect.github.com/actions/checkout/pull/1924)

... (truncated)


Commits

* [`3d3c42e`](actions/checkout@3d3c42e) prep v7.0.1 release ([#2531](https://redirect.github.com/actions/checkout/issues/2531))
* [`2880268`](actions/checkout@2880268) escape values passed to --unset ([#2530](https://redirect.github.com/actions/checkout/issues/2530))
* [`12cd223`](actions/checkout@12cd223) trim only ascii whitespace for branch ([#2521](https://redirect.github.com/actions/checkout/issues/2521))
* [`62661c4`](actions/checkout@62661c4) skip running unsafe pr check if input is default ([#2518](https://redirect.github.com/actions/checkout/issues/2518))
* [`e8d4307`](actions/checkout@e8d4307) Bump the minor-actions-dependencies group with 2 updates ([#2499](https://redirect.github.com/actions/checkout/issues/2499))
* [`631c942`](actions/checkout@631c942) eslint 9 ([#2474](https://redirect.github.com/actions/checkout/issues/2474))
* [`4f1f4ae`](actions/checkout@4f1f4ae) Bump actions/upload-artifact from 4 to 7 ([#2476](https://redirect.github.com/actions/checkout/issues/2476))
* [`ba09753`](actions/checkout@ba09753) Bump actions/checkout from 6 to 7 ([#2488](https://redirect.github.com/actions/checkout/issues/2488))
* [`b9e0990`](actions/checkout@b9e0990) Bump docker/login-action from 3.3.0 to 4.2.0 ([#2479](https://redirect.github.com/actions/checkout/issues/2479))
* [`e8cb398`](actions/checkout@e8cb398) Bump docker/build-push-action from 6.5.0 to 7.2.0 ([#2478](https://redirect.github.com/actions/checkout/issues/2478))
* Additional commits viewable in [compare view](actions/checkout@9c091bb...3d3c42e)
  
Updates `anthropics/claude-code-action` from 1.0.178 to 1.0.183
Release notes

*Sourced from [anthropics/claude-code-action's releases](https://github.com/anthropics/claude-code-action/releases).*

> v1.0.183
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.183>
>
> v1.0.182
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.182>
>
> v1.0.181
> --------
>
> What's Changed
> --------------
>
> * fix: share one exchanged WIF credential across spawned Claude processes by [`@​KeisukeYamashita`](https://github.com/KeisukeYamashita) in [anthropics/claude-code-action#1407](https://redirect.github.com/anthropics/claude-code-action/pull/1407)
>
> New Contributors
> ----------------
>
> * [`@​KeisukeYamashita`](https://github.com/KeisukeYamashita) made their first contribution in [anthropics/claude-code-action#1407](https://redirect.github.com/anthropics/claude-code-action/pull/1407)
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.181>
>
> v1.0.180
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.180>
>
> v1.0.179
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.179>


Commits

* [`be7b93b`](anthropics/claude-code-action@be7b93b) chore: bump Claude Code to 2.1.220 and Agent SDK to 0.3.220
* [`e0cf66d`](anthropics/claude-code-action@e0cf66d) chore: bump Claude Code to 2.1.219 and Agent SDK to 0.3.219
* [`44423bd`](anthropics/claude-code-action@44423bd) chore: bump Claude Code to 2.1.218 and Agent SDK to 0.3.218
* [`b00a341`](anthropics/claude-code-action@b00a341) fix: share one exchanged WIF credential across spawned Claude processes ([#1407](https://redirect.github.com/anthropics/claude-code-action/issues/1407))
* [`fa7e2f0`](anthropics/claude-code-action@fa7e2f0) chore: bump Claude Code to 2.1.217 and Agent SDK to 0.3.217
* [`b76a077`](anthropics/claude-code-action@b76a077) chore: bump Claude Code to 2.1.216 and Agent SDK to 0.3.216
* See full diff in [compare view](anthropics/claude-code-action@af0559e...be7b93b)
  
Updates `github/codeql-action/upload-sarif` from 4.37.1 to 4.37.3
Release notes

*Sourced from [github/codeql-action/upload-sarif's releases](https://github.com/github/codeql-action/releases).*

> v4.37.3
> -------
>
> No user facing changes.
>
> v4.37.2
> -------
>
> * The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://redirect.github.com/github/codeql-action/pull/4023)
> * The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://redirect.github.com/github/codeql-action/pull/4007)


Changelog

*Sourced from [github/codeql-action/upload-sarif's changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md).*

> CodeQL Action Changelog
> =======================
>
> See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
>
> [UNRELEASED]
> ------------
>
> * This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://redirect.github.com/github/codeql-action/pull/4037)
>
> 4.37.3 - 22 Jul 2026
> --------------------
>
> No user facing changes.
>
> 4.37.2 - 21 Jul 2026
> --------------------
>
> * The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://redirect.github.com/github/codeql-action/pull/4023)
> * The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://redirect.github.com/github/codeql-action/pull/4007)
>
> 4.37.1 - 16 Jul 2026
> --------------------
>
> * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956)
> * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019)
>
> 4.37.0 - 08 Jul 2026
> --------------------
>
> * Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://redirect.github.com/github/codeql-action/pull/3995)
> * In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://redirect.github.com/github/codeql-action/pull/3973)
>
> 4.36.3 - 01 Jul 2026
> --------------------
>
> No user facing changes.
>
> 4.36.2 - 04 Jun 2026
> --------------------
>
> * Cache CodeQL CLI version information across Actions steps. [#3943](https://redirect.github.com/github/codeql-action/pull/3943)
> * Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://redirect.github.com/github/codeql-action/pull/3937)
> * Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://redirect.github.com/github/codeql-action/pull/3948)
>
> 4.36.1 - 02 Jun 2026
> --------------------
>
> No user facing changes.
>
> 4.36.0 - 22 May 2026
> --------------------
>
> * *Breaking change*: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://redirect.github.com/github/codeql-action/pull/3894)
> * Add support for SHA-256 Git object IDs. [#3893](https://redirect.github.com/github/codeql-action/pull/3893)
> * Update default CodeQL bundle version to [2.25.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5). [#3926](https://redirect.github.com/github/codeql-action/pull/3926)
>
> 4.35.5 - 15 May 2026
> --------------------
>
> * We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://redirect.github.com/github/codeql-action/pull/3899)

... (truncated)


Commits

* [`e4fba86`](github/codeql-action@e4fba86) Merge pull request [#4031](https://redirect.github.com/github/codeql-action/issues/4031) from github/update-v4.37.3-72f6a9da0
* [`fb50ab5`](github/codeql-action@fb50ab5) Update changelog for v4.37.3
* [`72f6a9d`](github/codeql-action@72f6a9d) Merge pull request [#4030](https://redirect.github.com/github/codeql-action/issues/4030) from github/mbg/fix/no-proxy
* [`3b5ee58`](github/codeql-action@3b5ee58) Use default `request` options instead of `undefined`
* [`bfb6be4`](github/codeql-action@bfb6be4) Merge pull request [#4028](https://redirect.github.com/github/codeql-action/issues/4028) from github/mergeback/v4.37.2-to-main-e0647621
* [`526ab84`](github/codeql-action@526ab84) Rebuild
* [`d6217b9`](github/codeql-action@d6217b9) Update changelog and version after v4.37.2
* [`e064762`](github/codeql-action@e064762) Merge pull request [#4027](https://redirect.github.com/github/codeql-action/issues/4027) from github/update-v4.37.2-385bcdc5a
* [`e0faed8`](github/codeql-action@e0faed8) Add a couple of change notes
* [`73aad0e`](github/codeql-action@73aad0e) Update changelog for v4.37.2
* Additional commits viewable in [compare view](github/codeql-action@7188fc3...e4fba86)
  
Updates `docker/login-action` from 4.4.0 to 4.5.1
Release notes

*Sourced from [docker/login-action's releases](https://github.com/docker/login-action/releases).*

> v4.5.1
> ------
>
> * Support `dhi.io` as Docker Hub OIDC registry by [`@​crazy-max`](https://github.com/crazy-max) in [docker/login-action#1054](https://redirect.github.com/docker/login-action/pull/1054)
>
> **Full Changelog**: <docker/login-action@v4.5.0...v4.5.1>
>
> v4.5.0
> ------
>
> * [Docker Hub OIDC](https://github.com/docker/login-action#docker-hub) login support by [`@​crazy-max`](https://github.com/crazy-max) in [docker/login-action#1048](https://redirect.github.com/docker/login-action/pull/1048)
> * Bump `@​aws-sdk/client-ecr` and `@​aws-sdk/client-ecr-public` to 3.1091.0 in [docker/login-action#1037](https://redirect.github.com/docker/login-action/pull/1037)
> * Bump `@​docker/actions-toolkit` from 0.92.0 to 0.94.0 in [docker/login-action#1044](https://redirect.github.com/docker/login-action/pull/1044) [docker/login-action#1050](https://redirect.github.com/docker/login-action/pull/1050)
> * Bump brace-expansion from 1.1.13 to 1.1.16 in [docker/login-action#1046](https://redirect.github.com/docker/login-action/pull/1046)
> * Bump js-yaml from 5.2.0 to 5.2.1 in [docker/login-action#1038](https://redirect.github.com/docker/login-action/pull/1038)
>
> **Full Changelog**: <docker/login-action@v4.4.0...v4.5.0>


Commits

* [`abd2ef4`](docker/login-action@abd2ef4) Merge pull request [#1055](https://redirect.github.com/docker/login-action/issues/1055) from crazy-max/test-registry-auth-oidc
* [`d49d3a9`](docker/login-action@d49d3a9) Merge pull request [#1054](https://redirect.github.com/docker/login-action/issues/1054) from crazy-max/oidc-missing-dhi
* [`b58b17c`](docker/login-action@b58b17c) test: cover Docker Hub OIDC with registry-auth
* [`be646c2`](docker/login-action@be646c2) chore: update generated content
* [`d77c059`](docker/login-action@d77c059) support dhi.io as Docker Hub OIDC registry
* [`06fb636`](docker/login-action@06fb636) Merge pull request [#1037](https://redirect.github.com/docker/login-action/issues/1037) from docker/dependabot/npm\_and\_yarn/aws-sdk-dependen...
* [`a8bc953`](docker/login-action@a8bc953) [dependabot skip] chore: update generated content
* [`f54b901`](docker/login-action@f54b901) build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
* [`77f18f6`](docker/login-action@77f18f6) Merge pull request [#1049](https://redirect.github.com/docker/login-action/issues/1049) from docker/dependabot/github\_actions/codeql-actions...
* [`ec0bf28`](docker/login-action@ec0bf28) Merge pull request [#1050](https://redirect.github.com/docker/login-action/issues/1050) from docker/dependabot/npm\_and\_yarn/docker/actions-t...
* Additional commits viewable in [compare view](docker/login-action@af1e73f...abd2ef4)
  
Updates `github/codeql-action/init` from 4.37.1 to 4.37.3
Release notes

*Sourced from [github/codeql-action/init's releases](https://github.com/github/codeql-action/releases).*

> v4.37.3
> -------
>
> No user facing changes.
>
> v4.37.2
> -------
>
> * The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://redirect.github.com/github/codeql-action/pull/4023)
> * The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://redirect.github.com/github/codeql-action/pull/4007)


Changelog

*Sourced from [github/codeql-action/init's changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md).*

> CodeQL Action Changelog
> =======================
>
> See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
>
> [UNRELEASED]
> ------------
>
> * This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://redirect.github.com/github/codeql-action/pull/4037)
>
> 4.37.3 - 22 Jul 2026
> --------------------
>
> No user facing changes.
>
> 4.37.2 - 21 Jul 2026
> --------------------
>
> * The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://redirect.github.com/github/codeql-action/pull/4023)
> * The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://redirect.github.com/github/codeql-action/pull/4007)
>
> 4.37.1 - 16 Jul 2026
> --------------------
>
> * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956)
> * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019)
>
> 4.37.0 - 08 Jul 2026
> --------------------
>
> * Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://redirect.github.com/github/codeql-action/pull/3995)
> * In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://redirect.github.com/github/codeql-action/pull/3973)
>
> 4.36.3 - 01 Jul 2026
> --------------------
>
> No user facing changes.
>
> 4.36.2 - 04 Jun 2026
> --------------------
>
> * Cache CodeQL CLI version information across Actions steps. [#3943](https://redirect.github.com/github/codeql-action/pull/3943)
> * Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://redirect.github.com/github/codeql-action/pull/3937)
> * Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://redirect.github.com/github/codeql-action/pull/3948)
>
> 4.36.1 - 02 Jun 2026
> --------------------
>
> No user facing changes.
>
> 4.36.0 - 22 May 2026
> --------------------
>
> * *Breaking change*: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://redirect.github.com/github/codeql-action/pull/3894)
> * Add support for SHA-256 Git object IDs. [#3893](https://redirect.github.com/github/codeql-action/pull/3893)
> * Update default CodeQL bundle version to [2.25.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5). [#3926](https://redirect.github.com/github/codeql-action/pull/3926)
>
> 4.35.5 - 15 May 2026
> --------------------
>
> * We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://redirect.github.com/github/codeql-action/pull/3899)

... (truncated)


Commits

* [`e4fba86`](github/codeql-action@e4fba86) Merge pull request [#4031](https://redirect.github.com/github/codeql-action/issues/4031) from github/update-v4.37.3-72f6a9da0
* [`fb50ab5`](github/codeql-action@fb50ab5) Update changelog for v4.37.3
* [`72f6a9d`](github/codeql-action@72f6a9d) Merge pull request [#4030](https://redirect.github.com/github/codeql-action/issues/4030) from github/mbg/fix/no-proxy
* [`3b5ee58`](github/codeql-action@3b5ee58) Use default `request` options instead of `undefined`
* [`bfb6be4`](github/codeql-action@bfb6be4) Merge pull request [#4028](https://redirect.github.com/github/codeql-action/issues/4028) from github/mergeback/v4.37.2-to-main-e0647621
* [`526ab84`](github/codeql-action@526ab84) Rebuild
* [`d6217b9`](github/codeql-action@d6217b9) Update changelog and version after v4.37.2
* [`e064762`](github/codeql-action@e064762) Merge pull request [#4027](https://redirect.github.com/github/codeql-action/issues/4027) from github/update-v4.37.2-385bcdc5a
* [`e0faed8`](github/codeql-action@e0faed8) Add a couple of change notes
* [`73aad0e`](github/codeql-action@73aad0e) Update changelog for v4.37.2
* Additional commits viewable in [compare view](github/codeql-action@7188fc3...e4fba86)
  
Updates `github/codeql-action/analyze` from 4.37.1 to 4.37.3
Release notes

*Sourced from [github/codeql-action/analyze's releases](https://github.com/github/codeql-action/releases).*

> v4.37.3
> -------
>
> No user facing changes.
>
> v4.37.2
> -------
>
> * The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://redirect.github.com/github/codeql-action/pull/4023)
> * The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://redirect.github.com/github/codeql-action/pull/4007)


Changelog

*Sourced from [github/codeql-action/analyze's changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md).*

> CodeQL Action Changelog
> =======================
>
> See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
>
> [UNRELEASED]
> ------------
>
> * This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://redirect.github.com/github/codeql-action/pull/4037)
>
> 4.37.3 - 22 Jul 2026
> --------------------
>
> No user facing changes.
>
> 4.37.2 - 21 Jul 2026
> --------------------
>
> * The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://redirect.github.com/github/codeql-action/pull/4023)
> * The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://redirect.github.com/github/codeql-action/pull/4007)
>
> 4.37.1 - 16 Jul 2026
> --------------------
>
> * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956)
> * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019)
>
> 4.37.0 - 08 Jul 2026
> --------------------
>
> * Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://redirect.github.com/github/codeql-action/pull/3995)
> * In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://redirect.github.com/github/codeql-action/pull/3973)
>
> 4.36.3 - 01 Jul 2026
> --------------------
>
> No user facing changes.
>
> 4.36.2 - 04 Jun 2026
> --------------------
>
> * Cache CodeQL CLI version information across Actions steps. [#3943](https://redirect.github.com/github/codeql-action/pull/3943)
> * Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://redirect.github.com/github/codeql-action/pull/3937)
> * Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://redirect.github.com/github/codeql-action/pull/3948)
>
> 4.36.1 - 02 Jun 2026
> --------------------
>
> No user facing changes.
>
> 4.36.0 - 22 May 2026
> --------------------
>
> * *Breaking change*: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://redirect.github.com/github/codeql-action/pull/3894)
> * Add support for SHA-256 Git object IDs. [#3893](https://redirect.github.com/github/codeql-action/pull/3893)
> * Update default CodeQL bundle version to [2.25.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5). [#3926](https://redirect.github.com/github/codeql-action/pull/3926)
>
> 4.35.5 - 15 May 2026
> --------------------
>
> * We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://redirect.github.com/github/codeql-action/pull/3899)

... (truncated)


Commits

* [`e4fba86`](github/codeql-action@e4fba86) Merge pull request [#4031](https://redirect.github.com/github/codeql-action/issues/4031) from github/update-v4.37.3-72f6a9da0
* [`fb50ab5`](github/codeql-action@fb50ab5) Update changelog for v4.37.3
* [`72f6a9d`](github/codeql-action@72f6a9d) Merge pull request [#4030](https://redirect.github.com/github/codeql-action/issues/4030) from github/mbg/fix/no-proxy
* [`3b5ee58`](github/codeql-action@3b5ee58) Use default `request` options instead of `undefined`
* [`bfb6be4`](github/codeql-action@bfb6be4) Merge pull request [#4028](https://redirect.github.com/github/codeql-action/issues/4028) from github/mergeback/v4.37.2-to-main-e0647621
* [`526ab84`](github/codeql-action@526ab84) Rebuild
* [`d6217b9`](github/codeql-action@d6217b9) Update changelog and version after v4.37.2
* [`e064762`](github/codeql-action@e064762) Merge pull request [#4027](https://redirect.github.com/github/codeql-action/issues/4027) from github/update-v4.37.2-385bcdc5a
* [`e0faed8`](github/codeql-action@e0faed8) Add a couple of change notes
* [`73aad0e`](github/codeql-action@73aad0e) Update changelog for v4.37.2
* Additional commits viewable in [compare view](github/codeql-action@7188fc3...e4fba86)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Temporal component access on date/datetime values may return null

1 participant