Merge main into releases/v4

[github-actions]

Merging d2e135a into releases/v4.

Conductor for this PR is @henrymercer.

Contains the following pull requests:

• Remove unused @schemastore/package dependency #3779 (@henrymercer)
• Bump brace-expansion from 1.1.12 to 1.1.13 #3780 (@henrymercer)
• Mergeback v4.35.1 refs/heads/releases/v4 into main #3783 (@henrymercer)
• Move time-sensitive Actions workflows to ubuntu-latest #3786 (@henrymercer)
• Generate and analyse esbuild bundle metadata #3787 (@mbg)
• Overlay: Only require Git 2.36.0 for repos that contain submodules #3789 (@henrymercer)
• Extend start-proxy.yml to test multiple registry support #3792 (@mario-campos)
• Python: Disable standard library extraction on GHES #3794 (@henrymercer)
• Deprecate TRAP cache cleanup #3795 (@henrymercer)
• Add tests for getCredentials with multiple goproxy_servers and maven_… #3799 (@mario-campos)
• Upgrade to TypeScript 6 #3800 (@henrymercer)
• Mark Swift incompatible OS as configuration error #3801 (@henrymercer)
• Bump lodash from 4.17.23 to 4.18.1 #3802 (@henrymercer)
• Bump eslint-plugin-jsdoc from 62.8.0 to 62.8.1 in the npm-minor group across 1 directory #3803 (@henrymercer)
• Bump eslint-plugin-jsdoc from 62.8.1 to 62.9.0 in the npm-minor group #3804 (@henrymercer)
• Store language aliases from linked CLI #3806 (@henrymercer)
• Fix OIDC credential property names #3807 (@mbg)
• Fix pr-checks/tsconfig.json for TS6 #3810 (@mbg)
• Refactoring: Introduce overlay/caching.ts #3819 (@henrymercer)
• Bump the actions-minor group across 1 directory with 2 updates #3820 (@henrymercer)
• Bump the npm-minor group across 1 directory with 6 updates #3821 (@henrymercer)
• Update default bundle to 2.25.2 #3823 (@henrymercer)

Please do the following:

• Ensure the CHANGELOG displays the correct version and date.
• Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
• Check that there are not any unexpected commits being merged into the releases/v4 branch.
• Ensure the docs team is aware of any documentation changes that need to be released.
• Mark the PR as ready for review to trigger the full set of PR checks.
• Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.
• Merge the mergeback PR that will automatically be created once this PR is merged.
• Merge all backport PRs to older release branches, that will automatically be created once this PR is merged.

[Copilot]

Pull request overview

This release-branch merge brings main changes into releases/v4 and bumps the action to the 4.35.2 release, including the corresponding changelog entry and dependency/tooling updates.

Changes:

• Bump action version to 4.35.2 and update CHANGELOG.md for the release.
• Update default CodeQL bundle to 2.25.2 and apply assorted feature/refactor/test updates included in the merge.
• Refresh dependencies, build tooling, and PR checks/workflows.

Show a summary per file

File	Description
tsconfig.json	Updates TS compiler settings for TS6 and bundler-style module resolution.
src/trap-caching.ts	Adds deprecation warning for TRAP cache cleanup.
src/tools-features.ts	Removes a tools feature flag entry related to Python stdlib extraction.
src/testing-utils.ts	Updates overlay mode import path after overlay refactor.
src/status-report.ts	Updates overlay caching stats import after refactor.
src/start-proxy/types.ts	Fixes OIDC credential JSON property names to hyphenated keys.
src/start-proxy/types.test.ts	Updates tests to use hyphenated OIDC credential keys.
src/start-proxy.ts	Switches language alias handling to a checked-in aliases JSON snapshot.
src/start-proxy.test.ts	Adds/updates tests for multi-registry credentials and OIDC keys.
src/overlay/overlay-database-mode.ts	Extracts OverlayDatabaseMode enum into its own module.
src/overlay/index.ts	Refactors overlay module by moving caching logic out to overlay/caching.ts.
src/overlay/index.test.ts	Updates tests to align with overlay caching refactor.
src/overlay/caching.ts	New module containing overlay-base database cache upload/download logic.
src/overlay/caching.test.ts	New test suite for overlay caching module and stable cache keys.
src/known-language-aliases.json	Adds a checked-in snapshot of CodeQL language aliases.
src/init-action.ts	Updates overlay imports; adjusts Swift incompatible OS handling; removes Python stdlib override feature logic.
src/init-action-post-helper.ts	Updates overlay mode import path after refactor.
src/init-action-post-helper.test.ts	Updates overlay mode import path in tests.
src/git-utils.ts	Lowers Git requirement logic by only using --recurse-submodules when submodules exist.
src/git-utils.test.ts	Updates/extends tests for submodule-aware git ls-files behavior.
src/feature-flags.ts	Removes Python stdlib extraction feature flag configuration.
src/defaults.json	Bumps default CodeQL bundle/CLI versions to 2.25.2.
src/database-upload.ts	Updates overlay mode import path after refactor.
src/config-utils.ts	Adjusts overlay Git version validation to apply stricter requirement only when submodules exist.
src/config-utils.test.ts	Updates overlay enablement tests for new submodule-aware Git version logic.
src/codeql.ts	Updates overlay mode import path after refactor.
src/cli-errors.ts	Adds Swift incompatible OS configuration error category.
src/cli-errors.test.ts	Adds test coverage for Swift incompatible OS error wrapping.
src/analyze.ts	Updates overlay mode import path after refactor.
src/analyze-action.ts	Imports overlay cache upload from new overlay/caching module.
pr-checks/tsconfig.json	Adjusts PR-checks TS config for TS6 compatibility.
pr-checks/sync-checks.ts	Refactors API client construction into a dedicated module.
pr-checks/config.ts	Adds constant for esbuild metafile path used by tooling.
pr-checks/checks/start-proxy.yml	Extends start-proxy PR check to validate multiple registries in outputs.
pr-checks/checks/rubocop-multi-language.yml	Updates ruby/setup-ruby action version pin.
pr-checks/checks/language-aliases.yml	Updates language alias check inputs/expectations (removes Swift).
pr-checks/bundle-metadata.ts	Adds script to print esbuild bundle sizes from metafile.
pr-checks/api-client.ts	New shared API client helper for PR-check scripts.
package.json	Bumps package version to 4.35.2; updates deps; extends build to print bundle metadata.
package-lock.json	Lockfile updates for version bump and dependency upgrades.
lib/upload-sarif-action-post.js	Generated distribution artifact update (not reviewed).
lib/start-proxy-action-post.js	Generated distribution artifact update (not reviewed).
lib/defaults.json	Generated distribution artifact update of defaults (not reviewed).
build.mjs	Enables esbuild metafile output and writes meta.json.
CHANGELOG.md	Adds 4.35.2 release notes entry.
.gitignore	Ignores generated meta.json build metadata file.
.github/workflows/update-release-branch.yml	Moves time-sensitive jobs to ubuntu-latest; bumps token action.
.github/workflows/update-bundle.yml	Moves to ubuntu-latest; adds step to update checked-in language aliases snapshot.
.github/workflows/rollback-release.yml	Bumps actions/create-github-app-token version.
.github/workflows/prepare-release.yml	Moves to ubuntu-latest.
.github/workflows/post-release-mergeback.yml	Moves to ubuntu-latest; bumps token action.
.github/workflows/debug-artifacts-failure-safe.yml	Specifies languages for debug artifacts workflow init step.
.github/workflows/__start-proxy.yml	Generated workflow update (not reviewed).
.github/workflows/__rubocop-multi-language.yml	Generated workflow update (not reviewed).
.github/workflows/__language-aliases.yml	Generated workflow update (not reviewed).
.github/dependabot.yml	Extends Dependabot npm updates to also cover /pr-checks.

Copilot's findings

• Files reviewed: 47/66 changed files
• Comments generated: 1