diff --git a/.github/workflows/__analysis-kinds.yml b/.github/workflows/__analysis-kinds.yml
index 5d0576e2f..5353c1095 100644
--- a/.github/workflows/__analysis-kinds.yml
+++ b/.github/workflows/__analysis-kinds.yml
@@ -87,7 +87,7 @@ jobs:
           post-processed-sarif-path: '${{ runner.temp }}/post-processed'
 
       - name: Upload SARIF files
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: |
             analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
@@ -95,7 +95,7 @@ jobs:
           retention-days: 7
 
       - name: Upload post-processed SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: |
             post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
diff --git a/.github/workflows/__config-export.yml b/.github/workflows/__config-export.yml
index 0c7a2cc15..f8d0ecf0c 100644
--- a/.github/workflows/__config-export.yml
+++ b/.github/workflows/__config-export.yml
@@ -65,7 +65,7 @@ jobs:
           output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Upload SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
           path: '${{ runner.temp }}/results/javascript.sarif'
diff --git a/.github/workflows/__config-input.yml b/.github/workflows/__config-input.yml
index f3f248cda..c015526c6 100644
--- a/.github/workflows/__config-input.yml
+++ b/.github/workflows/__config-input.yml
@@ -47,7 +47,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 20.x
           cache: npm
diff --git a/.github/workflows/__diagnostics-export.yml b/.github/workflows/__diagnostics-export.yml
index c55f3de9b..32361c922 100644
--- a/.github/workflows/__diagnostics-export.yml
+++ b/.github/workflows/__diagnostics-export.yml
@@ -76,7 +76,7 @@ jobs:
           output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Upload SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
           path: '${{ runner.temp }}/results/javascript.sarif'
diff --git a/.github/workflows/__export-file-baseline-information.yml b/.github/workflows/__export-file-baseline-information.yml
index acdb09908..597c7ce9b 100644
--- a/.github/workflows/__export-file-baseline-information.yml
+++ b/.github/workflows/__export-file-baseline-information.yml
@@ -97,7 +97,7 @@ jobs:
         with:
           output: '${{ runner.temp }}/results'
       - name: Upload SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
           path: '${{ runner.temp }}/results/javascript.sarif'
diff --git a/.github/workflows/__job-run-uuid-sarif.yml b/.github/workflows/__job-run-uuid-sarif.yml
index 429a69494..b24ab3900 100644
--- a/.github/workflows/__job-run-uuid-sarif.yml
+++ b/.github/workflows/__job-run-uuid-sarif.yml
@@ -62,7 +62,7 @@ jobs:
         with:
           output: '${{ runner.temp }}/results'
       - name: Upload SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
           path: '${{ runner.temp }}/results/javascript.sarif'
diff --git a/.github/workflows/__packaging-codescanning-config-inputs-js.yml b/.github/workflows/__packaging-codescanning-config-inputs-js.yml
index 4cb0499d6..27139c831 100644
--- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml
+++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml
@@ -80,7 +80,7 @@ jobs:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Install Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 20.x
           cache: npm
diff --git a/.github/workflows/__packaging-config-inputs-js.yml b/.github/workflows/__packaging-config-inputs-js.yml
index ed049214e..9844c4348 100644
--- a/.github/workflows/__packaging-config-inputs-js.yml
+++ b/.github/workflows/__packaging-config-inputs-js.yml
@@ -80,7 +80,7 @@ jobs:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Install Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 20.x
           cache: npm
diff --git a/.github/workflows/__packaging-config-js.yml b/.github/workflows/__packaging-config-js.yml
index 7cf99882b..916e89276 100644
--- a/.github/workflows/__packaging-config-js.yml
+++ b/.github/workflows/__packaging-config-js.yml
@@ -80,7 +80,7 @@ jobs:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Install Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 20.x
           cache: npm
diff --git a/.github/workflows/__packaging-inputs-js.yml b/.github/workflows/__packaging-inputs-js.yml
index 6b488a7cf..01ddb5dc3 100644
--- a/.github/workflows/__packaging-inputs-js.yml
+++ b/.github/workflows/__packaging-inputs-js.yml
@@ -80,7 +80,7 @@ jobs:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Install Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 20.x
           cache: npm
diff --git a/.github/workflows/codescanning-config-cli.yml b/.github/workflows/codescanning-config-cli.yml
index 54474d58f..782031948 100644
--- a/.github/workflows/codescanning-config-cli.yml
+++ b/.github/workflows/codescanning-config-cli.yml
@@ -57,7 +57,7 @@ jobs:
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Set up Node.js
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: 24
         cache: 'npm'
diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml
index 936fe6e95..c61bd6b17 100644
--- a/.github/workflows/debug-artifacts-failure-safe.yml
+++ b/.github/workflows/debug-artifacts-failure-safe.yml
@@ -89,7 +89,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       - name: Check expected artifacts exist
         run: |
           LANGUAGES="cpp csharp go java javascript python"
diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml
index 8792aea32..6d162d9c0 100644
--- a/.github/workflows/debug-artifacts-safe.yml
+++ b/.github/workflows/debug-artifacts-safe.yml
@@ -82,7 +82,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       - name: Check expected artifacts exist
         run: |
           VERSIONS="stable-v2.20.7 default linked nightly-latest"
diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml
index c493c2a38..354da0afd 100644
--- a/.github/workflows/post-release-mergeback.yml
+++ b/.github/workflows/post-release-mergeback.yml
@@ -47,7 +47,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0  # ensure we have all tags and can push commits
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: 'npm'
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 2ae059440..ccbe4a6d2 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -42,7 +42,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: "npm"
@@ -110,7 +110,7 @@ jobs:
           fi
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: "npm"
@@ -175,7 +175,7 @@ jobs:
 
       - name: Upload repo size comment
         if: steps.fetch-base.outcome == 'success'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: repo-size-comment
           path: ${{ runner.temp }}/repo-size/
@@ -223,7 +223,7 @@ jobs:
 
     steps:
       - name: Download repo size comment
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: repo-size-comment
           path: repo-size-comment
diff --git a/.github/workflows/query-filters.yml b/.github/workflows/query-filters.yml
index 87b934eb6..1891f4195 100644
--- a/.github/workflows/query-filters.yml
+++ b/.github/workflows/query-filters.yml
@@ -33,7 +33,7 @@ jobs:
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Node.js
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: 24
         cache: npm
diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml
index c9522bf9a..1c174ac7a 100644
--- a/.github/workflows/rebuild.yml
+++ b/.github/workflows/rebuild.yml
@@ -30,7 +30,7 @@ jobs:
           ref: ${{ env.HEAD_REF }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: 'npm'
diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml
index d3ee924e5..43708f573 100644
--- a/.github/workflows/update-bundle.yml
+++ b/.github/workflows/update-bundle.yml
@@ -41,7 +41,7 @@ jobs:
           git config --global user.name "github-actions[bot]"
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: 'npm'
diff --git a/.github/workflows/update-supported-enterprise-server-versions.yml b/.github/workflows/update-supported-enterprise-server-versions.yml
index ee2649ad0..6510f11e2 100644
--- a/.github/workflows/update-supported-enterprise-server-versions.yml
+++ b/.github/workflows/update-supported-enterprise-server-versions.yml
@@ -26,7 +26,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: 'npm'
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8ce2edd61..b63b79671 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,14 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 ## [UNRELEASED]
 
+No user facing changes.
+
+## 4.39.0 - 15 Oct 2026
+
 - _Breaking change_: Bump the minimum required CodeQL bundle version to 2.20.7. [#4205](https://github.com/github/codeql-action/pull/4205)
+- The `codeql-action/analyze` step now validates that a correct argument for the `checkout_path` input has been provided. The `checkout_path` input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by `codeql-action/init`, then the CodeQL Action now produces a warning. [#4148](https://github.com/github/codeql-action/pull/4148)
+- Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. [#4206](https://github.com/github/codeql-action/pull/4206)
+- The `codeql-action/start-proxy` step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as `codeql-action/init`. This primarily benefits customers who are using GitHub instances other than `github.com` where the `codeql-action/start-proxy` step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. [#4198](https://github.com/github/codeql-action/pull/4198)
 
 ## 4.38.3 - 08 Oct 2026
 
diff --git a/lib/entry-points.js b/lib/entry-points.js
index 52f8e1042..e305218d1 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -170154,7 +170154,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) {
   return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME);
 }
 function getActionVersion() {
-  return "4.39.0";
+  return "4.39.1";
 }
 function getWorkflowEventName(env = getEnv()) {
   return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */);
@@ -187636,11 +187636,73 @@ var core25 = __toESM(require_core());
 
 // src/start-proxy.ts
 var path27 = __toESM(require("path"));
-var core24 = __toESM(require_core());
 var toolcache4 = __toESM(require_tool_cache());
 
-// src/start-proxy/validation.ts
+// src/start-proxy/status-report.ts
 var core23 = __toESM(require_core());
+async function sendSuccessStatusReport(startedAt, config, registry_types, status, logger2) {
+  const statusReportBase = await createStatusReportBase(
+    "start-proxy" /* StartProxy */,
+    "success",
+    startedAt,
+    config,
+    await checkDiskUsage(logger2),
+    logger2
+  );
+  if (statusReportBase !== void 0) {
+    const statusReport = {
+      ...statusReportBase,
+      registry_types: registry_types.sort().join(","),
+      start_proxy: status
+    };
+    await sendStatusReport(statusReport);
+  }
+}
+function getStartProxyErrorMessage(errorType) {
+  switch (errorType) {
+    case 0 /* DownloadFailed */:
+      return "Failed to download proxy archive.";
+    case 1 /* ExtractionFailed */:
+      return "Failed to extract proxy archive.";
+    case 2 /* CacheFailed */:
+      return "Failed to add proxy to toolcache";
+  }
+}
+var StartProxyError = class extends Error {
+  errorType;
+  constructor(errorType) {
+    super();
+    this.errorType = errorType;
+  }
+};
+function getSafeErrorMessage(error3) {
+  if (error3 instanceof StartProxyError) {
+    return getStartProxyErrorMessage(error3.errorType);
+  }
+  return `Error from start-proxy Action omitted (${error3.constructor.name}).`;
+}
+async function sendFailedStatusReport(logger2, startedAt, language, unwrappedError) {
+  const error3 = wrapError(unwrappedError);
+  core23.setFailed(`start-proxy action failed: ${error3.message}`);
+  const statusReportMessage = getSafeErrorMessage(error3);
+  const errorStatusReportBase = await createStatusReportBase(
+    "start-proxy" /* StartProxy */,
+    getActionsStatus(error3),
+    startedAt,
+    {
+      languages: language === void 0 ? void 0 : [language]
+    },
+    await checkDiskUsage(logger2),
+    logger2,
+    statusReportMessage
+  );
+  if (errorStatusReportBase !== void 0) {
+    await sendStatusReport(errorStatusReportBase);
+  }
+}
+
+// src/start-proxy/validation.ts
+var core24 = __toESM(require_core());
 function cloneCredential(schema, obj) {
   const result = {};
   for (const key of Object.keys(schema)) {
@@ -187659,14 +187721,14 @@ function getAuthConfig(config) {
   }
   if (isToken(config)) {
     if (isDefined2(config.token)) {
-      core23.setSecret(config.token);
+      core24.setSecret(config.token);
     }
     return cloneCredential(tokenSchema, config);
   } else {
     let username = void 0;
     let password = void 0;
     if ("password" in config && isString(config.password)) {
-      core23.setSecret(config.password);
+      core24.setSecret(config.password);
       password = config.password;
     }
     if ("username" in config && isString(config.username)) {
@@ -187680,65 +187742,6 @@ function getAuthConfig(config) {
 }
 
 // src/start-proxy.ts
-function getStartProxyErrorMessage(errorType) {
-  switch (errorType) {
-    case 0 /* DownloadFailed */:
-      return "Failed to download proxy archive.";
-    case 1 /* ExtractionFailed */:
-      return "Failed to extract proxy archive.";
-    case 2 /* CacheFailed */:
-      return "Failed to add proxy to toolcache";
-  }
-}
-var StartProxyError = class extends Error {
-  errorType;
-  constructor(errorType) {
-    super();
-    this.errorType = errorType;
-  }
-};
-async function sendSuccessStatusReport(startedAt, config, registry_types, logger2) {
-  const statusReportBase = await createStatusReportBase(
-    "start-proxy" /* StartProxy */,
-    "success",
-    startedAt,
-    config,
-    await checkDiskUsage(logger2),
-    logger2
-  );
-  if (statusReportBase !== void 0) {
-    const statusReport = {
-      ...statusReportBase,
-      registry_types: registry_types.join(",")
-    };
-    await sendStatusReport(statusReport);
-  }
-}
-function getSafeErrorMessage(error3) {
-  if (error3 instanceof StartProxyError) {
-    return getStartProxyErrorMessage(error3.errorType);
-  }
-  return `Error from start-proxy Action omitted (${error3.constructor.name}).`;
-}
-async function sendFailedStatusReport(logger2, startedAt, language, unwrappedError) {
-  const error3 = wrapError(unwrappedError);
-  core24.setFailed(`start-proxy action failed: ${error3.message}`);
-  const statusReportMessage = getSafeErrorMessage(error3);
-  const errorStatusReportBase = await createStatusReportBase(
-    "start-proxy" /* StartProxy */,
-    getActionsStatus(error3),
-    startedAt,
-    {
-      languages: language === void 0 ? void 0 : [language]
-    },
-    await checkDiskUsage(logger2),
-    logger2,
-    statusReportMessage
-  );
-  if (errorStatusReportBase !== void 0) {
-    await sendStatusReport(errorStatusReportBase);
-  }
-}
 var UPDATEJOB_PROXY = "update-job-proxy";
 function isPAT(value) {
   return isAuthToken(value, [
@@ -187969,7 +187972,10 @@ async function getProxyBinaryPath(action, apiDetails) {
       );
       logger2.info(`Extracted the authentication proxy to '${proxyDir}'.`);
     }
-    return path27.join(proxyDir, proxyFileName);
+    return {
+      path: path27.join(proxyDir, proxyFileName),
+      version: proxyInfo.version
+    };
   } finally {
     logger2.endGroup();
   }
@@ -188340,7 +188346,7 @@ async function run7(action) {
       getApiDetails(action.env)
     );
     const proxyInfo = await startProxy(
-      proxyBin,
+      proxyBin.path,
       proxyConfig,
       proxyLogFilePath,
       logger2
@@ -188352,6 +188358,7 @@ async function run7(action) {
         languages: language === void 0 ? void 0 : [language]
       },
       proxyConfig.all_credentials.map((c) => c.type),
+      { proxy_version: proxyBin.version },
       logger2
     );
   } catch (unwrappedError) {
diff --git a/package-lock.json b/package-lock.json
index 42ba4bf1c..d702b0f6f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "4.39.0",
+  "version": "4.39.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "4.39.0",
+      "version": "4.39.1",
       "license": "MIT",
       "workspaces": [
         "pr-checks"
diff --git a/package.json b/package.json
index 755d561f1..209ded679 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "4.39.0",
+  "version": "4.39.1",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
diff --git a/pr-checks/changenotes.ts b/pr-checks/changenotes.ts
index 26035527b..d9ccd8461 100755
--- a/pr-checks/changenotes.ts
+++ b/pr-checks/changenotes.ts
@@ -50,6 +50,28 @@ function getChangenotes(): ChangenoteFile[] {
   });
 }
 
+/**
+ * Populates the '[UNRELEASED]' section of CHANGELOG.md with the contents
+ * of the changenotes in {@link CHANGENOTES_DIR} and then deletes those changenotes.
+ * @param contents The contents of CHANGELOG.md
+ * @returns The updated contents of CHANGELOG.md
+ */
+export function transferChangenotesToChangelog(contents: string): string {
+  const changenotes = getChangenotes();
+  const changenoteBodies = changenotes.map((c) => c.content.trim());
+  const changenotePaths = changenotes.map((c) => c.absolutePath);
+
+  const changelog = parseChangelog(contents);
+  addBodyLinesToUnreleasedSection(changelog, changenoteBodies);
+  const updatedChangelog = renderChangelog(changelog);
+
+  for (const p of changenotePaths) {
+    fs.unlinkSync(p);
+  }
+
+  return updatedChangelog;
+}
+
 const entryPoint = process.argv[1];
 if (entryPoint && import.meta.url === pathToFileURL(entryPoint).href) {
   try {
@@ -91,26 +113,13 @@ function usage(): ExitCode {
 
 function assemble(): ExitCode {
   try {
-    const changenotes = getChangenotes();
-    const changenoteBodies = changenotes.map((c) => c.content);
-    const changenotePaths = changenotes.map((c) => c.absolutePath);
-
     withChangelog((contents) => {
-      const changelog = parseChangelog(contents);
-      addBodyLinesToUnreleasedSection(changelog, changenoteBodies);
-      return renderChangelog(changelog);
+      return transferChangenotesToChangelog(contents);
     }, {});
-
-    // Delete changenotes only after successful processing.
-    for (const p of changenotePaths) {
-      fs.unlinkSync(p);
-    }
-
     return ExitCode.Success;
   } catch (e) {
     console.error("Failed to assemble changenotes to 'CHANGELOG.md'", e);
   }
-
   return ExitCode.Failure;
 }
 
diff --git a/pr-checks/checks/analysis-kinds.yml b/pr-checks/checks/analysis-kinds.yml
index 5b2aaf4aa..ef7cb80e1 100644
--- a/pr-checks/checks/analysis-kinds.yml
+++ b/pr-checks/checks/analysis-kinds.yml
@@ -46,7 +46,7 @@ steps:
       post-processed-sarif-path: "${{ runner.temp }}/post-processed"
 
   - name: Upload SARIF files
-    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
     with:
       name: |
         analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
@@ -54,7 +54,7 @@ steps:
       retention-days: 7
 
   - name: Upload post-processed SARIF
-    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
     with:
       name: |
         post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
diff --git a/pr-checks/checks/config-export.yml b/pr-checks/checks/config-export.yml
index 93c640735..205754151 100644
--- a/pr-checks/checks/config-export.yml
+++ b/pr-checks/checks/config-export.yml
@@ -14,7 +14,7 @@ steps:
       output: "${{ runner.temp }}/results"
       upload-database: false
   - name: Upload SARIF
-    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
     with:
       name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
       path: "${{ runner.temp }}/results/javascript.sarif"
diff --git a/pr-checks/checks/diagnostics-export.yml b/pr-checks/checks/diagnostics-export.yml
index 61b9ae5ef..93b3a8f60 100644
--- a/pr-checks/checks/diagnostics-export.yml
+++ b/pr-checks/checks/diagnostics-export.yml
@@ -27,7 +27,7 @@ steps:
       output: "${{ runner.temp }}/results"
       upload-database: false
   - name: Upload SARIF
-    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
     with:
       name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
       path: "${{ runner.temp }}/results/javascript.sarif"
diff --git a/pr-checks/checks/export-file-baseline-information.yml b/pr-checks/checks/export-file-baseline-information.yml
index ce22ec5d5..da3237238 100644
--- a/pr-checks/checks/export-file-baseline-information.yml
+++ b/pr-checks/checks/export-file-baseline-information.yml
@@ -27,7 +27,7 @@ steps:
     with:
       output: "${{ runner.temp }}/results"
   - name: Upload SARIF
-    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
     with:
       name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
       path: "${{ runner.temp }}/results/javascript.sarif"
diff --git a/pr-checks/checks/job-run-uuid-sarif.yml b/pr-checks/checks/job-run-uuid-sarif.yml
index b86725d94..879da226c 100644
--- a/pr-checks/checks/job-run-uuid-sarif.yml
+++ b/pr-checks/checks/job-run-uuid-sarif.yml
@@ -12,7 +12,7 @@ steps:
     with:
       output: "${{ runner.temp }}/results"
   - name: Upload SARIF
-    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
     with:
       name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
       path: "${{ runner.temp }}/results/javascript.sarif"
diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts
index 8dc1dd1d1..d6382786c 100755
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -215,8 +215,8 @@ const languageSetups: LanguageSetups = {
         name: "Install Node.js",
         uses: pinnedUses(
           "actions/setup-node",
-          "820762786026740c76f36085b0efc47a31fe5020",
-          "v7.0.0",
+          "949feb2413d6458794dcd2491c4babbbce0c15c1",
+          "v7.1.0",
         ),
         with: {
           "node-version": defaultLanguageVersions.javascript,
diff --git a/pr-checks/update-release-branch.ts b/pr-checks/update-release-branch.ts
index 93e50f7ad..9d46fd3ec 100755
--- a/pr-checks/update-release-branch.ts
+++ b/pr-checks/update-release-branch.ts
@@ -23,7 +23,13 @@ import { parseArgs } from "node:util";
 
 import { type ApiClient, getApiClient } from "./api-client";
 import * as changelog from "./changelog";
-import { DryRunOption, REPO_ROOT } from "./config";
+import { transferChangenotesToChangelog } from "./changenotes";
+import {
+  CHANGELOG_FILE,
+  CHANGENOTES_DIR,
+  DryRunOption,
+  REPO_ROOT,
+} from "./config";
 import {
   getCurrentVersion,
   replaceVersionInPackageJson,
@@ -693,11 +699,14 @@ export async function prepareNewBranch(
 
     console.log("Updating changelog");
     changelog.withChangelog(
-      (contents) => changelog.setVersionAndDate(version, contents),
+      (contents) => {
+        const populatedContents = transferChangenotesToChangelog(contents);
+        return changelog.setVersionAndDate(version, populatedContents);
+      },
       { ...options, initChangelog: true },
     );
 
-    runGit(["add", "CHANGELOG.md"], {
+    runGit(["add", CHANGELOG_FILE, CHANGENOTES_DIR], {
       dryRun: options.dryRun,
     });
     runGit(["commit", "-m", `Update changelog for v${version}`], {
diff --git a/src/start-proxy-action.ts b/src/start-proxy-action.ts
index 2f6f76988..ad1a2e143 100644
--- a/src/start-proxy-action.ts
+++ b/src/start-proxy-action.ts
@@ -109,7 +109,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
       getApiDetails(action.env),
     );
     const proxyInfo = await startProxy(
-      proxyBin,
+      proxyBin.path,
       proxyConfig,
       proxyLogFilePath,
       logger,
@@ -125,6 +125,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
         languages: language === undefined ? undefined : [language],
       },
       proxyConfig.all_credentials.map((c) => c.type),
+      { proxy_version: proxyBin.version },
       logger,
     );
   } catch (unwrappedError) {
diff --git a/src/start-proxy.test.ts b/src/start-proxy.test.ts
index 2b860ba97..447357595 100644
--- a/src/start-proxy.test.ts
+++ b/src/start-proxy.test.ts
@@ -1,6 +1,5 @@
 import * as filepath from "path";
 
-import * as core from "@actions/core";
 import * as toolcache from "@actions/tool-cache";
 import test, { ExecutionContext } from "ava";
 import sinon from "sinon";
@@ -18,7 +17,6 @@ import { getRunnerLogger, Logger } from "./logging";
 import { BundlePlatform, getBundlePlatform } from "./platform";
 import * as repository from "./setup/repository";
 import * as startProxyExports from "./start-proxy";
-import * as statusReport from "./status-report";
 import {
   addSinonAssertions,
   assertNotLogged,
@@ -33,94 +31,10 @@ import {
   setupTests,
   withRecordingLoggerAsync,
 } from "./testing-utils";
-import {
-  ConfigurationError,
-  GitHubVariant,
-  GitHubVersion,
-  withTmpDir,
-} from "./util";
+import { GitHubVariant, GitHubVersion, withTmpDir } from "./util";
 
 setupTests(test);
 
-const sendFailedStatusReportTest = makeMacro({
-  exec: async (
-    t: ExecutionContext<unknown>,
-    err: Error,
-    expectedMessage: string,
-    expectedStatus: statusReport.ActionStatus = "failure",
-  ) => {
-    const now = new Date();
-
-    // Override core.setFailed to avoid it setting the program's exit code
-    sinon.stub(core, "setFailed").returns();
-
-    const createStatusReportBase = sinon.stub(
-      statusReport,
-      "createStatusReportBase",
-    );
-    createStatusReportBase.resolves(undefined);
-
-    await withRecordingLoggerAsync(async (logger) => {
-      await startProxyExports.sendFailedStatusReport(
-        logger,
-        now,
-        undefined,
-        err,
-      );
-
-      // Check that the stub has been called exactly once, with the expected arguments,
-      // but not with the message from the error.
-      sinon.assert.calledOnceWithExactly(
-        createStatusReportBase,
-        statusReport.ActionName.StartProxy,
-        expectedStatus,
-        now,
-        sinon.match.any,
-        sinon.match.any,
-        sinon.match.any,
-        expectedMessage,
-      );
-      t.false(
-        createStatusReportBase.calledWith(
-          statusReport.ActionName.StartProxy,
-          expectedStatus,
-          now,
-          sinon.match.any,
-          sinon.match.any,
-          sinon.match.any,
-          sinon.match((msg: string) => msg.includes(err.message)),
-        ),
-        "createStatusReportBase was called with the error message",
-      );
-    });
-  },
-
-  title: (providedTitle = "") => `sendFailedStatusReport - ${providedTitle}`,
-});
-
-sendFailedStatusReportTest.serial(
-  "reports generic error message for non-StartProxyError error",
-  new Error("Something went wrong today"),
-  "Error from start-proxy Action omitted (Error).",
-);
-
-sendFailedStatusReportTest.serial(
-  "reports generic error message for non-StartProxyError error with safe error message",
-  new Error(
-    startProxyExports.getStartProxyErrorMessage(
-      startProxyExports.StartProxyErrorType.DownloadFailed,
-    ),
-  ),
-  "Error from start-proxy Action omitted (Error).",
-);
-
-sendFailedStatusReportTest.serial(
-  "reports generic error message for ConfigurationError error",
-  new ConfigurationError("Something went wrong today"),
-  "Error from start-proxy Action omitted (ConfigurationError).",
-  "user-error",
-);
-
 const toEncodedJSON = (data: any) =>
   Buffer.from(JSON.stringify(data)).toString("base64");
 
@@ -1036,16 +950,17 @@ test.serial(
       const state = initAllState({ logger, features });
       mockGetReleaseByTag(state.env);
 
-      const path = await startProxyExports.getProxyBinaryPath(
+      const result = await startProxyExports.getProxyBinaryPath(
         state,
         SAMPLE_DOTCOM_API_DETAILS,
       );
 
-      t.assert(path);
+      t.assert(result);
       t.is(
-        path,
+        result.path,
         filepath.join(toolcachePath, startProxyExports.getProxyFilename()),
       );
+      t.is(result.version, defaults.cliVersion);
     });
   },
 );
@@ -1089,7 +1004,7 @@ test.serial(
     sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
     state.env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "test/repo");
 
-    const path = await startProxyExports.getProxyBinaryPath(
+    const result = await startProxyExports.getProxyBinaryPath(
       {
         ...state,
         features: createFeatures([]),
@@ -1106,11 +1021,12 @@ test.serial(
     st.onceWith(extractTar, archivePath);
     st.onceWith(cacheDir, extractedPath);
 
-    t.assert(path);
+    t.assert(result);
     t.is(
-      path,
+      result.path,
       filepath.join(toolcachePath, startProxyExports.getProxyFilename()),
     );
+    t.is(result.version, defaults.cliVersion);
 
     checkExpectedLogMessages(t, logger.messages, [
       `Found private registry proxy ${startProxyExports.getProxyPackage(getTestPlatform(state))} in test/repo on https://api.github.com with URL ${downloadUrl}`,
@@ -1123,7 +1039,8 @@ test.serial(
   async (t) => {
     const logger = new RecordingLogger();
     const state = initAllState({ logger });
-    const expectedTag = "codeql-bundle-v2.20.1";
+    const expectedVersion = "2.20.1";
+    const expectedTag = `codeql-bundle-v${expectedVersion}`;
     const expectedParams = {
       owner: "test",
       repo: "repo",
@@ -1183,14 +1100,16 @@ test.serial(
       const getDefaultCliVersion = sinon
         .stub(features, "getEnabledDefaultCliVersions")
         .resolves({
-          enabledVersions: [{ cliVersion: "2.20.1", tagName: expectedTag }],
+          enabledVersions: [
+            { cliVersion: expectedVersion, tagName: expectedTag },
+          ],
         });
 
       // Stub this to always return `false` so we force `getCodeQLAssetDownloadURL` to use the (mocked) API.
       sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
       state.env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "test/repo");
 
-      const path = await startProxyExports.getProxyBinaryPath(
+      const result = await startProxyExports.getProxyBinaryPath(
         {
           ...state,
           features,
@@ -1208,11 +1127,12 @@ test.serial(
       st.onceWith(extractTar, archivePath);
       st.onceWith(cacheDir, extractedPath);
 
-      t.assert(path);
+      t.assert(result);
       t.is(
-        path,
+        result.path,
         filepath.join(toolcachePath, startProxyExports.getProxyFilename()),
       );
+      t.is(result.version, expectedVersion);
     });
 
     checkExpectedLogMessages(t, logger.messages, [
diff --git a/src/start-proxy.ts b/src/start-proxy.ts
index f4d59a4f7..cf9e914ba 100644
--- a/src/start-proxy.ts
+++ b/src/start-proxy.ts
@@ -1,6 +1,5 @@
 import * as path from "path";
 
-import * as core from "@actions/core";
 import * as toolcache from "@actions/tool-cache";
 
 import { ActionState } from "./action-common";
@@ -10,7 +9,6 @@ import {
   type GitHubApiDetails,
 } from "./api-client";
 import * as artifactScanner from "./artifact-scanner";
-import { Config } from "./config-utils";
 import * as defaults from "./defaults.json";
 import {
   CodeQLDefaultVersionInfo,
@@ -22,6 +20,10 @@ import { BuiltInLanguage } from "./languages";
 import { Logger } from "./logging";
 import { BundlePlatform, getBundlePlatform } from "./platform";
 import { getCodeQLAssetDownloadURL } from "./setup/repository";
+import {
+  StartProxyError,
+  StartProxyErrorType,
+} from "./start-proxy/status-report";
 import {
   Address,
   Registry,
@@ -32,144 +34,10 @@ import {
   RawCredential,
 } from "./start-proxy/types";
 import { getAuthConfig } from "./start-proxy/validation";
-import {
-  ActionName,
-  createStatusReportBase,
-  getActionsStatus,
-  sendStatusReport,
-  StatusReportBase,
-} from "./status-report";
-import * as util from "./util";
 import { ConfigurationError, getErrorMessage, isDefined } from "./util";
 
 export * from "./start-proxy/types";
-
-/**
- * Enumerates specific error types for which we have corresponding error messages that
- * are safe to include in status reports.
- */
-export enum StartProxyErrorType {
-  DownloadFailed,
-  ExtractionFailed,
-  CacheFailed,
-}
-
-/**
- * @returns The error message corresponding to the error type.
- */
-export function getStartProxyErrorMessage(
-  errorType: StartProxyErrorType,
-): string {
-  switch (errorType) {
-    case StartProxyErrorType.DownloadFailed:
-      return "Failed to download proxy archive.";
-    case StartProxyErrorType.ExtractionFailed:
-      return "Failed to extract proxy archive.";
-    case StartProxyErrorType.CacheFailed:
-      return "Failed to add proxy to toolcache";
-  }
-}
-
-/**
- * We want to avoid accidentally leaking secrets that may be contained in exception
- * messages in the `start-proxy` action. Consequently, we don't report the messages
- * of arbitrary exceptions. This type of error ensures that the message is one from
- * `StartProxyErrorType` and therefore safe to include in a status report.
- */
-export class StartProxyError extends Error {
-  public readonly errorType: StartProxyErrorType;
-
-  constructor(errorType: StartProxyErrorType) {
-    super();
-    this.errorType = errorType;
-  }
-}
-
-/**
- * Sends a status report for the `start-proxy` action indicating a successful outcome.
- *
- * @param startedAt When the action was started.
- * @param config The configuration used.
- * @param registry_types The types of registries that are configured.
- * @param logger The logger to use.
- */
-export async function sendSuccessStatusReport(
-  startedAt: Date,
-  config: Partial<Config>,
-  registry_types: string[],
-  logger: Logger,
-) {
-  const statusReportBase = await createStatusReportBase(
-    ActionName.StartProxy,
-    "success",
-    startedAt,
-    config,
-    await util.checkDiskUsage(logger),
-    logger,
-  );
-  if (statusReportBase !== undefined) {
-    const statusReport: StatusReportBase = {
-      ...statusReportBase,
-      registry_types: registry_types.join(","),
-    };
-    await sendStatusReport(statusReport);
-  }
-}
-
-/**
- * Returns an error message for `error` that can safely be reported in a status report,
- * i.e. that does not contain sensitive information.
- *
- * @param error The error for which to get an error message.
- */
-export function getSafeErrorMessage(error: Error): string {
-  // If the error is a `StartProxyError`, resolve the error type to the corresponding
-  // error message.
-  if (error instanceof StartProxyError) {
-    return getStartProxyErrorMessage(error.errorType);
-  }
-
-  // Otherwise, omit the actual error message.
-  return `Error from start-proxy Action omitted (${error.constructor.name}).`;
-}
-
-/**
- * Sends a status report for the `start-proxy` action indicating a failure.
- *
- * @param logger The logger to use.
- * @param startedAt When the action was started.
- * @param language The language provided as input, if any.
- * @param unwrappedError The exception that was thrown.
- */
-export async function sendFailedStatusReport(
-  logger: Logger,
-  startedAt: Date,
-  language: BuiltInLanguage | undefined,
-  unwrappedError: unknown,
-) {
-  const error = util.wrapError(unwrappedError);
-  core.setFailed(`start-proxy action failed: ${error.message}`);
-
-  // To avoid the possibility of leaking sensitive information into the telemetry,
-  // we don't include arbitrary error messages. Instead, `getSafeErrorMessage` will
-  // return a generic message that includes the type of the error, unless it can decide
-  // that the message is safe to include.
-  const statusReportMessage = getSafeErrorMessage(error);
-  const errorStatusReportBase = await createStatusReportBase(
-    ActionName.StartProxy,
-    getActionsStatus(error),
-    startedAt,
-    {
-      languages: language === undefined ? undefined : [language],
-    },
-    await util.checkDiskUsage(logger),
-    logger,
-    statusReportMessage,
-  );
-  if (errorStatusReportBase !== undefined) {
-    await sendStatusReport(errorStatusReportBase);
-  }
-}
+export * from "./start-proxy/status-report";
 
 /** The basename of the proxy artifacts. */
 export const UPDATEJOB_PROXY = "update-job-proxy";
@@ -529,18 +397,28 @@ export function getProxyFilename() {
     : UPDATEJOB_PROXY;
 }
 
+export type ProxyBinary = {
+  /** The path to the proxy binary to run. */
+  path: string;
+  /**
+   * The version associated with the proxy binary.
+   * This usually corresponds to the CodeQL CLI release that the binary was obtained from.
+   */
+  version: string;
+};
+
 /**
  * Gets a path to the proxy binary. If possible, this function will find the proxy in the
  * runner's tool cache. Otherwise, it downloads and extracts the proxy binary,
  * and stores it in the tool cache.
  *
  * @param action The action state.
- * @returns The path to the proxy binary.
+ * @returns The path to the proxy binary and its version.
  */
 export async function getProxyBinaryPath(
   action: ActionState<["Base", "ReadOnlyEnv", "Logger", "FeatureFlags"]>,
   apiDetails: GitHubApiDetails,
-): Promise<string> {
+): Promise<ProxyBinary> {
   const logger = action.logger;
   logger.startGroup("Setting up authentication proxy");
 
@@ -578,7 +456,10 @@ export async function getProxyBinaryPath(
 
       logger.info(`Extracted the authentication proxy to '${proxyDir}'.`);
     }
-    return path.join(proxyDir, proxyFileName);
+    return {
+      path: path.join(proxyDir, proxyFileName),
+      version: proxyInfo.version,
+    };
   } finally {
     logger.endGroup();
   }
diff --git a/src/start-proxy/status-report.test.ts b/src/start-proxy/status-report.test.ts
new file mode 100644
index 000000000..c73478396
--- /dev/null
+++ b/src/start-proxy/status-report.test.ts
@@ -0,0 +1,136 @@
+import * as core from "@actions/core";
+import test, { ExecutionContext } from "ava";
+import sinon from "sinon";
+
+import * as statusReport from "../status-report";
+import {
+  createTestConfig,
+  makeMacro,
+  RecordingLogger,
+  setupTests,
+  withRecordingLoggerAsync,
+} from "../testing-utils";
+import { ConfigurationError } from "../util";
+
+import * as startProxyExports from "./status-report";
+
+setupTests(test);
+
+test.serial("sendSuccessStatusReport", async (t) => {
+  const logger = new RecordingLogger();
+  const now = new Date();
+  const config = createTestConfig({});
+  const proxy_version = "1.2.3";
+  const registry_types = ["git_source", "docker_registry"];
+
+  const createStatusReportBase = sinon.stub(
+    statusReport,
+    "createStatusReportBase",
+  );
+  createStatusReportBase.resolves({
+    action_name: statusReport.ActionName.StartProxy,
+  } as statusReport.StatusReportBase);
+
+  const sendStatusReport = sinon
+    .stub(statusReport, "sendStatusReport")
+    .resolves();
+
+  await startProxyExports.sendSuccessStatusReport(
+    now,
+    config,
+    registry_types,
+    { proxy_version },
+    logger,
+  );
+
+  t.is(createStatusReportBase.callCount, 1);
+
+  t.is(sendStatusReport.callCount, 1);
+  t.is(sendStatusReport.args[0].length, 1);
+
+  const arg = sendStatusReport.args[0][0];
+  t.like(arg, {
+    action_name: statusReport.ActionName.StartProxy,
+    registry_types: "docker_registry,git_source",
+    start_proxy: { proxy_version },
+  });
+});
+
+const sendFailedStatusReportTest = makeMacro({
+  exec: async (
+    t: ExecutionContext<unknown>,
+    err: Error,
+    expectedMessage: string,
+    expectedStatus: statusReport.ActionStatus = "failure",
+  ) => {
+    const now = new Date();
+
+    // Override core.setFailed to avoid it setting the program's exit code
+    sinon.stub(core, "setFailed").returns();
+
+    const createStatusReportBase = sinon.stub(
+      statusReport,
+      "createStatusReportBase",
+    );
+    createStatusReportBase.resolves(undefined);
+
+    await withRecordingLoggerAsync(async (logger) => {
+      await startProxyExports.sendFailedStatusReport(
+        logger,
+        now,
+        undefined,
+        err,
+      );
+
+      // Check that the stub has been called exactly once, with the expected arguments,
+      // but not with the message from the error.
+      sinon.assert.calledOnceWithExactly(
+        createStatusReportBase,
+        statusReport.ActionName.StartProxy,
+        expectedStatus,
+        now,
+        sinon.match.any,
+        sinon.match.any,
+        sinon.match.any,
+        expectedMessage,
+      );
+      t.false(
+        createStatusReportBase.calledWith(
+          statusReport.ActionName.StartProxy,
+          expectedStatus,
+          now,
+          sinon.match.any,
+          sinon.match.any,
+          sinon.match.any,
+          sinon.match((msg: string) => msg.includes(err.message)),
+        ),
+        "createStatusReportBase was called with the error message",
+      );
+    });
+  },
+
+  title: (providedTitle = "") => `sendFailedStatusReport - ${providedTitle}`,
+});
+
+sendFailedStatusReportTest.serial(
+  "reports generic error message for non-StartProxyError error",
+  new Error("Something went wrong today"),
+  "Error from start-proxy Action omitted (Error).",
+);
+
+sendFailedStatusReportTest.serial(
+  "reports generic error message for non-StartProxyError error with safe error message",
+  new Error(
+    startProxyExports.getStartProxyErrorMessage(
+      startProxyExports.StartProxyErrorType.DownloadFailed,
+    ),
+  ),
+  "Error from start-proxy Action omitted (Error).",
+);
+
+sendFailedStatusReportTest.serial(
+  "reports generic error message for ConfigurationError error",
+  new ConfigurationError("Something went wrong today"),
+  "Error from start-proxy Action omitted (ConfigurationError).",
+  "user-error",
+);
diff --git a/src/start-proxy/status-report.ts b/src/start-proxy/status-report.ts
new file mode 100644
index 000000000..76ad3c8da
--- /dev/null
+++ b/src/start-proxy/status-report.ts
@@ -0,0 +1,153 @@
+import * as core from "@actions/core";
+
+import type { Config } from "../config-utils";
+import type { BuiltInLanguage } from "../languages";
+import type { Logger } from "../logging";
+import {
+  ActionName,
+  createStatusReportBase,
+  getActionsStatus,
+  sendStatusReport,
+  type StatusReportBase,
+} from "../status-report";
+import * as util from "../util";
+
+/** Additional status report data from `start-proxy`. */
+export interface StartProxyStatus {
+  proxy_version: string;
+}
+
+/** The type of successful status reports from `start-proxy`. */
+type StartProxySuccessReport = StatusReportBase & {
+  start_proxy: StartProxyStatus;
+};
+
+/**
+ * Sends a status report for the `start-proxy` action indicating a successful outcome.
+ *
+ * @param startedAt When the action was started.
+ * @param config The configuration used.
+ * @param registry_types The types of registries that are configured.
+ * @param status Status information.
+ * @param logger The logger to use.
+ */
+export async function sendSuccessStatusReport(
+  startedAt: Date,
+  config: Partial<Config>,
+  registry_types: string[],
+  status: StartProxyStatus,
+  logger: Logger,
+) {
+  const statusReportBase = await createStatusReportBase(
+    ActionName.StartProxy,
+    "success",
+    startedAt,
+    config,
+    await util.checkDiskUsage(logger),
+    logger,
+  );
+  if (statusReportBase !== undefined) {
+    const statusReport: StartProxySuccessReport = {
+      ...statusReportBase,
+      registry_types: registry_types.sort().join(","),
+      start_proxy: status,
+    };
+    await sendStatusReport(statusReport);
+  }
+}
+
+/**
+ * Enumerates specific error types for which we have corresponding error messages that
+ * are safe to include in status reports.
+ */
+export enum StartProxyErrorType {
+  DownloadFailed,
+  ExtractionFailed,
+  CacheFailed,
+}
+
+/**
+ * @returns The error message corresponding to the error type.
+ */
+export function getStartProxyErrorMessage(
+  errorType: StartProxyErrorType,
+): string {
+  switch (errorType) {
+    case StartProxyErrorType.DownloadFailed:
+      return "Failed to download proxy archive.";
+    case StartProxyErrorType.ExtractionFailed:
+      return "Failed to extract proxy archive.";
+    case StartProxyErrorType.CacheFailed:
+      return "Failed to add proxy to toolcache";
+  }
+}
+
+/**
+ * We want to avoid accidentally leaking secrets that may be contained in exception
+ * messages in the `start-proxy` action. Consequently, we don't report the messages
+ * of arbitrary exceptions. This type of error ensures that the message is one from
+ * `StartProxyErrorType` and therefore safe to include in a status report.
+ */
+export class StartProxyError extends Error {
+  public readonly errorType: StartProxyErrorType;
+
+  constructor(errorType: StartProxyErrorType) {
+    super();
+    this.errorType = errorType;
+  }
+}
+
+/**
+ * Returns an error message for `error` that can safely be reported in a status report,
+ * i.e. that does not contain sensitive information.
+ *
+ * @param error The error for which to get an error message.
+ */
+export function getSafeErrorMessage(error: Error): string {
+  // If the error is a `StartProxyError`, resolve the error type to the corresponding
+  // error message.
+  if (error instanceof StartProxyError) {
+    return getStartProxyErrorMessage(error.errorType);
+  }
+
+  // Otherwise, omit the actual error message.
+  return `Error from start-proxy Action omitted (${error.constructor.name}).`;
+}
+
+/**
+ * Sends a status report for the `start-proxy` action indicating a failure.
+ *
+ * @param logger The logger to use.
+ * @param startedAt When the action was started.
+ * @param language The language provided as input, if any.
+ * @param unwrappedError The exception that was thrown.
+ */
+export async function sendFailedStatusReport(
+  logger: Logger,
+  startedAt: Date,
+  language: BuiltInLanguage | undefined,
+  unwrappedError: unknown,
+) {
+  const error = util.wrapError(unwrappedError);
+  core.setFailed(`start-proxy action failed: ${error.message}`);
+
+  // To avoid the possibility of leaking sensitive information into the telemetry,
+  // we don't include arbitrary error messages. Instead, `getSafeErrorMessage` will
+  // return a generic message that includes the type of the error, unless it can decide
+  // that the message is safe to include.
+  const statusReportMessage = getSafeErrorMessage(error);
+  const errorStatusReportBase = await createStatusReportBase(
+    ActionName.StartProxy,
+    getActionsStatus(error),
+    startedAt,
+    {
+      languages: language === undefined ? undefined : [language],
+    },
+    await util.checkDiskUsage(logger),
+    logger,
+    statusReportMessage,
+  );
+  if (errorStatusReportBase !== undefined) {
+    await sendStatusReport(errorStatusReportBase);
+  }
+}
diff --git a/unreleased-change-notes/analyze-checkout-path-validation.md b/unreleased-change-notes/analyze-checkout-path-validation.md
deleted file mode 100644
index 4704376a4..000000000
--- a/unreleased-change-notes/analyze-checkout-path-validation.md
+++ /dev/null
@@ -1 +0,0 @@
-- The `codeql-action/analyze` step now validates that a correct argument for the `checkout_path` input has been provided. The `checkout_path` input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by `codeql-action/init`, then the CodeQL Action now produces a warning. [#4148](https://github.com/github/codeql-action/pull/4148)
diff --git a/unreleased-change-notes/restore-keys.md b/unreleased-change-notes/restore-keys.md
deleted file mode 100644
index 3612c1b60..000000000
--- a/unreleased-change-notes/restore-keys.md
+++ /dev/null
@@ -1 +0,0 @@
-- Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. [#4206](https://github.com/github/codeql-action/pull/4206)
diff --git a/unreleased-change-notes/start-proxy-setup-logic.md b/unreleased-change-notes/start-proxy-setup-logic.md
deleted file mode 100644
index fc3582843..000000000
--- a/unreleased-change-notes/start-proxy-setup-logic.md
+++ /dev/null
@@ -1 +0,0 @@
-- The `codeql-action/start-proxy` step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as `codeql-action/init`. This primarily benefits customers who are using GitHub instances other than `github.com` where the `codeql-action/start-proxy` step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. [#4198](https://github.com/github/codeql-action/pull/4198)