Conversation
Mergeback v4.32.3 refs/heads/releases/v4 into main
Log information about the runner which may affect the private registry proxy
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.3.4 to 5.3.6. - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.3.4...v5.3.6) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.3.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…-parser-5.3.6 Bump fast-xml-parser from 5.3.4 to 5.3.6
…rties-ff Use new feature flag for repository properties
Update default bundle to 2.24.2
Contributor
There was a problem hiding this comment.
Pull request overview
Release-branch merge PR that brings changes from main into releases/v4 for the 4.32.4 release, including version/changelog updates and the set of feature work and fixes listed in the PR description.
Changes:
- Bump the action version to
4.32.4and add the4.32.4release notes. - Update the default CodeQL bundle to
2.24.2. - Merge in feature work including new analysis kind support, proxy certificate/environment diagnostics improvements, and new feature flags (plus dependency updates).
Reviewed changes
Copilot reviewed 39 out of 45 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/upload-lib/types.ts | Introduces typed payload interfaces for SARIF upload variants. |
| src/upload-lib.ts | Uses typed payloads and adds analysis-specific payload transformation for uploads. |
| src/upload-lib.test.ts | Updates/extends upload-lib tests for new analysis kinds and typed payloads. |
| src/testing-utils.ts | Enhances test logging utilities (recording logger + improved assertion output). |
| src/start-proxy/types.ts | Adds shared proxy-related types (CA, auth creds, proxy config). |
| src/start-proxy/environment.ts | Adds runner environment inspection/logging for proxy-related settings (esp. Java). |
| src/start-proxy/environment.test.ts | Adds unit tests for proxy environment inspection behaviors. |
| src/start-proxy/ca.ts | Extracts CA generation and adds FF-gated certificate improvements/determinism. |
| src/start-proxy/ca.test.ts | Adds tests for CA generation with/without the FF. |
| src/start-proxy-action.ts | Wires in environment inspection and FF-gated improved proxy certificates. |
| src/setup-codeql.ts | Adds FF support to force nightly tools in dynamic workflows; exports helpers/types for testing. |
| src/setup-codeql.test.ts | Adds tests for nightly selection (explicit + forced by FF) and adjusts env setup. |
| src/languages.ts | Adds JavaEnvVars enum for Java-related environment variable names. |
| src/init-action.ts | Adds FF-gated Java network debugging by extending JAVA_TOOL_OPTIONS. |
| src/feature-flags.ts | Adds new feature flags and updates repository-properties FF value to v2 string. |
| src/environment.ts | Adds env var for risk assessment ID. |
| src/diagnostics.ts | Allows diagnostics to be buffered before config exists (no-language diagnostics). |
| src/defaults.json | Updates linked default CodeQL bundle/CLI versions to 2.24.2. |
| src/config-utils.ts | Updates “primary analysis kind/config” logic to handle additional analysis kinds. |
| src/config-utils.test.ts | Adds tests covering the updated primary analysis config selection logic. |
| src/analyze.ts | Simplifies category handling to always use analysis.fixCategory. |
| src/analyze.test.ts | Extends SARIF extension tests to include risk assessment extension. |
| src/analyses.ts | Adds risk-assessment analysis kind, compatibility matrix, and upload payload transform hook. |
| src/analyses.test.ts | Adds tests for compatibility matrix, SARIF predicate behavior, and risk assessment payload transform. |
| pr-checks/checks/bundle-from-nightly.yml | Adds a PR check ensuring forced-nightly behavior uses a nightly bundle. |
| pr-checks/checks/analysis-kinds.yml | Updates PR check to cover analysis-kinds including risk-assessment and adjusts artifact upload. |
| package.json | Bumps package/action version to 4.32.4. |
| package-lock.json | Updates lockfile for 4.32.4 and bumps fast-xml-parser to 5.3.6 (and strnum to ^2.1.2). |
| lib/resolve-environment-action.js | Generated JS output update corresponding to TS changes and dependency bumps. |
| lib/defaults.json | Generated defaults update matching src/defaults.json. |
| CHANGELOG.md | Adds 4.32.4 release notes (bundle bump + proxy/nightly/java debugging notes). |
| .github/workflows/__bundle-from-nightly.yml | Generated workflow for the new nightly-bundle PR check. |
| .github/workflows/__analysis-kinds.yml | Generated workflow updates for expanded analysis-kinds testing. |
| .github/update-release-branch.py | Adjusts release PR generation to prefer PR author when they’re GitHub staff. |
henrymercer
reviewed
Feb 20, 2026
CHANGELOG.md
Outdated
| ## 4.32.4 - 20 Feb 2026 | ||
|
|
||
| - Update default CodeQL bundle version to [2.24.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2). [#3493](https://github.com/github/codeql-action/pull/3493) | ||
| - Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone soon. [#3473](https://github.com/github/codeql-action/pull/3473) |
Contributor
There was a problem hiding this comment.
Can we be more specific than "soon" here?
Member
There was a problem hiding this comment.
I have changed it (conservatively and to be more specific) to "in February"
Co-authored-by: Henry Mercer <henrymercer@github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
mbg
approved these changes
Feb 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merging 39ba80c into
releases/v4.Conductor for this PR is @mbg.
Contains the following pull requests:
csraanalysis kind #3474 (@mbg)nightlybundle indynamicworkflows #3484 (@mbg)Please do the following:
releases/v4branch.Create a merge commitis selected rather thanSquash and mergeorRebase and merge.