Merge pull request #3996 from github/update-v4.37.0-c7c896d71

Merge main into releases/v4
Add changenote for #3973
2026-10-03 17:41:28 +00:00 · 2026-07-08 13:08:22 +01:00 · 2026-07-08 12:53:26 +01:00 · 2026-07-08 11:42:48 +00:00 · 2026-07-08 07:57:31 +00:00 · 2026-07-08 07:34:38 +00:00
6 changed files with 17 additions and 16 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,9 +2,10 @@

 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.

-## [UNRELEASED]
+## 4.37.0 - 08 Jul 2026

-No user facing changes.
+- Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://github.com/github/codeql-action/pull/3995)
+- In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://github.com/github/codeql-action/pull/3973)

 ## 4.36.3 - 01 Jul 2026

--- a/lib/defaults.json
+++ b/lib/defaults.json
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.25.6",
-  "cliVersion": "2.25.6",
-  "priorBundleVersion": "codeql-bundle-v2.25.5",
-  "priorCliVersion": "2.25.5"
+  "bundleVersion": "codeql-bundle-v2.26.0",
+  "cliVersion": "2.26.0",
+  "priorBundleVersion": "codeql-bundle-v2.25.6",
+  "priorCliVersion": "2.25.6"
 }
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -145002,7 +145002,7 @@ function getDiffRangesJsonFilePath() {
  return path2.join(getTemporaryDirectory(), PR_DIFF_RANGE_JSON_FILENAME);
 }
 function getActionVersion() {
-  return "4.36.4";
+  return "4.37.0";
 }
 function getWorkflowEventName() {
  return getRequiredEnvParam("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */);
@@ -146204,8 +146204,8 @@ var path5 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());

 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.25.6";
-var cliVersion = "2.25.6";
+var bundleVersion = "codeql-bundle-v2.26.0";
+var cliVersion = "2.26.0";

 // src/overlay/index.ts
 var fs4 = __toESM(require("fs"));
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
  "name": "codeql",
-  "version": "4.36.4",
+  "version": "4.37.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "codeql",
-      "version": "4.36.4",
+      "version": "4.37.0",
      "license": "MIT",
      "workspaces": [
        "pr-checks"
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "codeql",
-  "version": "4.36.4",
+  "version": "4.37.0",
  "private": true,
  "description": "CodeQL action",
  "scripts": {
--- a/src/defaults.json
+++ b/src/defaults.json
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.25.6",
-  "cliVersion": "2.25.6",
-  "priorBundleVersion": "codeql-bundle-v2.25.5",
-  "priorCliVersion": "2.25.5"
+  "bundleVersion": "codeql-bundle-v2.26.0",
+  "cliVersion": "2.26.0",
+  "priorBundleVersion": "codeql-bundle-v2.25.6",
+  "priorCliVersion": "2.25.6"
 }
Author	SHA1	Message	Date
Michael B. Gale	99df26d4f1	Merge pull request #3996 from github/update-v4.37.0-c7c896d71 Merge main into releases/v4	2026-07-08 13:08:22 +01:00
Michael B. Gale	31c27074fd	Add changenote for #3973	2026-07-08 12:53:26 +01:00
github-actions[bot]	72df2181aa	Update changelog for v4.37.0	2026-07-08 11:42:48 +00:00
Michael B. Gale	c7c896d71b	Merge pull request #3995 from github/update-bundle/codeql-bundle-v2.26.0 Update default bundle to 2.26.0	2026-07-08 07:57:31 +00:00
github-actions[bot]	3f34ff0ea3	Add changelog note	2026-07-08 07:34:38 +00:00
github-actions[bot]	43bec09f1d	Update default bundle to codeql-bundle-v2.26.0	2026-07-08 07:34:33 +00:00