Merge branch 'main' into dependabot/npm_and_yarn/node-forge-1.4.2

Bumps [node-forge](https://github.com/digitalbazaar/forge) from 1.4.1 to 1.4.2.
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](https://github.com/digitalbazaar/forge/compare/v1.4.1...v1.4.2)

---
updated-dependencies:
- dependency-name: node-forge
  dependency-version: 1.4.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/codeql/codeql-config-actions.yml

@@ -1,5 +0,0 @@
-paths-ignore:
-  - lib
-  - tests
-queries:
-  - uses: security-and-quality

.github/workflows/__linux-arm64.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: PR Check - Runner images
+name: PR Check - Linux Arm64
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -47,38 +47,16 @@ defaults:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: runner-images-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
-  runner-images:
+  linux-arm64:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-22.04
-            version: linked
-          - os: ubuntu-22.04-arm
-            version: linked
-          - os: ubuntu-24.04
-            version: linked
           - os: ubuntu-24.04-arm
-            version: linked
-          - os: ubuntu-26.04
-            version: linked
-          - os: ubuntu-26.04-arm
-            version: linked
-          - os: windows-2022
-            version: linked
-          - os: windows-2025
-            version: linked
-          - os: macos-15-large
-            version: linked
-          - os: macos-15-xlarge
-            version: linked
-          - os: macos-26-large
-            version: linked
-          - os: macos-26-xlarge
-            version: linked
-    name: Runner images
+            version: nightly-latest
+    name: Linux Arm64
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -124,5 +102,5 @@ jobs:
             echo "Found database for $lang"
           done
     env:
-      LANGUAGES: cpp,csharp,go,java,javascript,python,ruby${{ startsWith(matrix.os, 'macos') && ',swift' || '' }}
+      LANGUAGES: cpp,csharp,go,java,javascript,python,ruby
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/codeql.yml

@@ -19,16 +19,70 @@ env:
   CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
 
 jobs:
-  analyze:
+  # Identify the CodeQL tool versions to use in the analysis job.
+  check-codeql-versions:
     if: github.triggering_actor != 'dependabot[bot]'
     runs-on: ubuntu-26.04
+    outputs:
+      versions: ${{ steps.compare.outputs.versions }}
 
+    permissions:
+      contents: read
+      # We currently need `security-events: read` to access feature flags.
+      security-events: read
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Set up default CodeQL bundle
+        id: setup-default
+        uses: ./setup-codeql
+      - name: Set up linked CodeQL bundle
+        id: setup-linked
+        uses: ./setup-codeql
+        with:
+          tools: linked
+      - name: Compare default and linked CodeQL bundle versions
+        id: compare
+        env:
+          CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }}
+          CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }}
+        run: |
+          CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
+          CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)"
+          echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
+          echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED"
+
+          # If we're running on a pull request, run with both bundles, even if `tools: linked` would
+          # be the same as `tools: null`. This allows us to make the job for each of the bundles a
+          # required status check.
+          #
+          # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
+          # the same as running with `tools: null`.
+          if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then
+            VERSIONS_JSON='[null]'
+          else
+            VERSIONS_JSON='[null, "linked"]'
+          fi
+
+          # Output a JSON-encoded list with the distinct versions to test against.
+          echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
+          echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
+
+  analyze-javascript:
+    if: github.triggering_actor != 'dependabot[bot]'
+    needs: [check-codeql-versions]
     strategy:
       fail-fast: false
       matrix:
-        language:
-          - actions
-          - javascript
+        os:
+          - ubuntu-22.04
+          - ubuntu-24.04
+          - windows-2022
+          - windows-2025
+          - macos-14-xlarge
+          - macos-15-xlarge
+        tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }}
+    runs-on: ${{ matrix.os }}
 
     permissions:
       contents: read
@@ -41,15 +95,49 @@ jobs:
         uses: ./init
         id: init
         with:
-          languages: ${{ matrix.language }}
-          build-mode: none
-          config-file: ./.github/codeql/codeql-config-${{ matrix.language }}.yml
+          languages: javascript
+          config-file: ./.github/codeql/codeql-config-javascript.yml
+          tools: ${{ matrix.tools }}
       # confirm steps.init.outputs.codeql-path points to the codeql binary
       - name: Print CodeQL Version
         run: >
           "$CODEQL" version --format=json
         env:
           CODEQL: ${{steps.init.outputs.codeql-path}}
+      - name: Perform CodeQL Analysis
+        uses: ./analyze
+        with:
+          category: "/language:javascript"
+          upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
+
+  analyze-other:
+    if: github.triggering_actor != 'dependabot[bot]'
+    runs-on: ubuntu-26.04
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Initialize CodeQL
+        uses: ./init
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          config: >
+            paths-ignore:
+              - lib
+              - tests
+            queries:
+              - uses: security-and-quality
       - name: Perform CodeQL Analysis
         uses: ./analyze
         with:

.github/workflows/deflake.yml

@@ -61,7 +61,6 @@ on:
       - "PR Check - Remote config file"
       - "PR Check - Resolve environment"
       - "PR Check - Ruby analysis"
-      - "PR Check - Runner images"
       - "PR Check - Rust analysis"
       - "PR Check - Split workflow"
       - "PR Check - Start proxy"

lib/entry-points.js

@@ -160398,6 +160398,7 @@ var require_pem = __commonJS({
     };
     pem.decode = function(str) {
       var rval = [];
+      str = String(str);
       var messages = _pemMessageScanner(str);
       var rHeader = /(?:^|[^\x21-\x7e])([\x21-\x7e]+):\s*([\x21-\x7e\s^:]+)/;
       var rCRLF = /\r?\n/;
@@ -184864,16 +184865,13 @@ async function deleteToolcacheBundles({
       }
       const versionDirectory = path12.join(toolDirectory, entry.name);
       try {
-        const deletionStart = import_perf_hooks3.performance.now();
         await fs15.promises.rm(versionDirectory, {
           force: true,
           recursive: true
         });
         deletedVersions.push(entry.name);
         logger2.info(
-          `Deleted the CodeQL tools at '${versionDirectory}' from the toolcache to free up disk space (${formatDuration(
-            durationMsSince(deletionStart)
-          )}).`
+          `Deleted the CodeQL tools at '${versionDirectory}' from the toolcache to free up disk space.`
         );
       } catch (e) {
         failed = true;
@@ -185372,14 +185370,13 @@ async function tryDeleteToolcacheBundles({
   if (!isGitHubHostedRunner(env) || !isToolcacheOnWorkspaceFilesystem(logger2)) {
     return;
   }
-  const startTime = import_perf_hooks4.performance.now();
   const result = await deleteToolcacheBundles({ env, logger: logger2 });
   addNoLanguageDiagnostic(
     void 0,
     makeTelemetryDiagnostic(
       "codeql-action/toolcache-bundle-cleanup",
       "Toolcache CodeQL bundle cleanup",
-      { ...result, durationMs: durationMsSince(startTime) }
+      { ...result }
     )
   );
 }

package-lock.json

@@ -33,7 +33,7 @@
         "js-yaml": "^5.5.0",
         "jsonschema": "1.5.0",
         "long": "^5.3.2",
-        "node-forge": "^1.4.1",
+        "node-forge": "^1.4.2",
         "semver": "^7.8.5",
         "undici": "^7.30.1",
         "uuid": "^14.0.3"
@@ -8198,9 +8198,9 @@
       }
     },
     "node_modules/node-forge": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.1.tgz",
-      "integrity": "sha512-w5/MfWaeMrpR/5ba6fZyAUTLSuE6aYz7H/3cYrqwZEmf5eQS3IaaLgJt4MBv7HglGFWmV22K8h4U18RJQmw/ow==",
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.2.tgz",
+      "integrity": "sha512-rRtAR5XLJ8gCKd9du4qrKAsgCG1ObGP4gLeNJMa4vYSeq4bmBMOJk5IHkrviBV0q7uoAJlVd8HEQYQSVUb4FGQ==",
       "license": "(BSD-3-Clause OR GPL-2.0)",
       "engines": {
         "node": ">= 6.13.0"

package.json

@@ -43,7 +43,7 @@
     "js-yaml": "^5.5.0",
     "jsonschema": "1.5.0",
     "long": "^5.3.2",
-    "node-forge": "^1.4.1",
+    "node-forge": "^1.4.2",
     "semver": "^7.8.5",
     "undici": "^7.30.1",
     "uuid": "^14.0.3"

pr-checks/checks/linux-arm64.yml

@@ -0,0 +1,35 @@
+name: "Linux Arm64"
+description: "An end-to-end integration test running on a Linux Arm64 runner, checking that the native linux-arm64 CodeQL bundle is downloaded and can analyze interpreted and compiled code"
+operatingSystems:
+  - os: ubuntu
+    runner-image: ubuntu-24.04-arm
+# The native linux-arm64 CodeQL bundle is only available in recent CLI releases, so we restrict this
+# check to `nightly-latest`, which is guaranteed to ship it. Older stable versions do not have an
+# arm64 asset, and `prepare-test` would resolve an x64 bundle URL for them on this runner.
+versions:
+  - nightly-latest
+installGo: true
+installDotNet: true
+# The set of languages CodeQL supports on this platform, excluding Swift (macOS only).
+env:
+  LANGUAGES: cpp,csharp,go,java,javascript,python,ruby
+steps:
+  - uses: ./../action/init
+    with:
+      languages: ${{ env.LANGUAGES }}
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - name: Build code
+    run: ./build.sh
+  - uses: ./../action/analyze
+    with:
+      upload-database: false
+  - name: Assert databases exist
+    run: |
+      cd "$RUNNER_TEMP/codeql_databases"
+      for lang in ${LANGUAGES//,/ }; do
+        if [[ ! -d "$lang" ]]; then
+          echo "Did not find a database for $lang"
+          exit 1
+        fi
+        echo "Found database for $lang"
+      done

pr-checks/checks/runner-images.yml

@@ -1,66 +0,0 @@
-name: "Runner images"
-description: "An end-to-end integration test checking that CodeQL can analyze interpreted and compiled code on the GitHub-hosted runner images"
-# This check runs on each image listed in
-# https://github.com/actions/runner-images#available-images, except for:
-# - `ubuntu-slim`, which is intended for lightweight jobs rather than builds like this one.
-# - `windows-11-arm`, since CodeQL doesn't support Windows on Arm64.
-# - `xcode-27`, a preview image that the `unsupported-macos` check runs on.
-operatingSystems:
-  # The Ubuntu 22.04 images have brownouts from 23 March 2027 and are retired on 17 April 2027, so
-  # remove them before the brownouts start.
-  # See https://github.com/actions/runner-images/issues/14254.
-  - os: ubuntu
-    runner-image: ubuntu-22.04
-  - os: ubuntu
-    runner-image: ubuntu-22.04-arm
-  - os: ubuntu
-    runner-image: ubuntu-24.04
-  - os: ubuntu
-    runner-image: ubuntu-24.04-arm
-  - os: ubuntu
-    runner-image: ubuntu-26.04
-  - os: ubuntu
-    runner-image: ubuntu-26.04-arm
-  - os: windows
-    runner-image: windows-2022
-  - os: windows
-    runner-image: windows-2025
-  # Use larger runners for macOS to keep these jobs off the critical path.
-  - os: macos
-    runner-image: macos-15-large
-  - os: macos
-    runner-image: macos-15-xlarge
-  - os: macos
-    runner-image: macos-26-large
-  - os: macos
-    runner-image: macos-26-xlarge
-# Other PR checks cover the supported CodeQL versions, so this check only tests the linked version.
-# Linux Arm64 bundles are only available for CodeQL 2.27.0 and later, so older stable versions
-# can't run on the Arm64 images.
-versions:
-  - linked
-installGo: true
-installDotNet: true
-# The languages to build and analyze. CodeQL only supports Swift on macOS.
-env:
-  LANGUAGES: "cpp,csharp,go,java,javascript,python,ruby${{ startsWith(matrix.os, 'macos') && ',swift' || '' }}"
-steps:
-  - uses: ./../action/init
-    with:
-      languages: ${{ env.LANGUAGES }}
-      tools: ${{ steps.prepare-test.outputs.tools-url }}
-  - name: Build code
-    run: ./build.sh
-  - uses: ./../action/analyze
-    with:
-      upload-database: false
-  - name: Assert databases exist
-    run: |
-      cd "$RUNNER_TEMP/codeql_databases"
-      for lang in ${LANGUAGES//,/ }; do
-        if [[ ! -d "$lang" ]]; then
-          echo "Did not find a database for $lang"
-          exit 1
-        fi
-        echo "Found database for $lang"
-      done

pr-checks/excluded.yml

@@ -24,5 +24,3 @@ is:
   # PRs), so requiring them would block the PRs they don't run on.
   - "github-advanced-security"
   - "License compliance check"
-  # Only runs when a PR is removed from the merge queue.
-  - "Notify"

src/setup-codeql.test.ts

@@ -1821,8 +1821,7 @@ function createToolcacheEntry(
 /**
  * Stubs out the download and the diagnostic sink, then downloads the CodeQL tools.
  *
- * @returns the extraction directory and, if the toolcache cleanup diagnostic was emitted, the
- * cleanup duration it reports and its other attributes.
+ * @returns the extraction directory and the toolcache cleanup diagnostic, if emitted.
  */
 async function runDownloadCodeQL(
   toolcacheRoot: string,
@@ -1838,7 +1837,6 @@ async function runDownloadCodeQL(
 ): Promise<{
   codeqlFolder: string;
   cleanupDiagnostic: toolsDownload.ToolcacheCleanupResult | undefined;
-  cleanupDurationMs: number | undefined;
 }> {
   stubDownloadAndExtract();
   const addDiagnostic = sinon.stub(diagnostics, "addNoLanguageDiagnostic");
@@ -1868,21 +1866,11 @@ async function runDownloadCodeQL(
     .map((call) => call.args[1])
     .find((d) => d.source?.id === "codeql-action/toolcache-bundle-cleanup");
 
-  if (diagnostic === undefined) {
-    return {
-      codeqlFolder,
-      cleanupDiagnostic: undefined,
-      cleanupDurationMs: undefined,
-    };
-  }
-
-  // The duration varies between runs, so split it out to let tests compare the other attributes
-  // exactly.
-  const { durationMs, ...cleanupDiagnostic } =
-    diagnostic.attributes as toolsDownload.ToolcacheCleanupResult & {
-      durationMs: number;
-    };
-  return { codeqlFolder, cleanupDiagnostic, cleanupDurationMs: durationMs };
+  return {
+    codeqlFolder,
+    cleanupDiagnostic: diagnostic?.attributes as
+      toolsDownload.ToolcacheCleanupResult | undefined,
+  };
 }
 
 /**
@@ -2003,35 +1991,6 @@ test.serial(
   },
 );
 
-test.serial(
-  "downloadCodeQLBundle reports the total time taken to clean up the toolcache",
-  async (t) => {
-    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-
-      createToolcacheEntry(tmpDir, "CodeQL", CLEANUP_CLI_VERSION);
-      createToolcacheEntry(tmpDir, "CodeQL", CLEANUP_STALE_VERSION);
-
-      // Advance the clock by 1.5s each time a path is deleted, so that deleting both versions
-      // takes 3s.
-      let elapsedMs = 1000;
-      sinon.stub(performance, "now").callsFake(() => elapsedMs);
-      const rm = fs.promises.rm;
-      sinon.stub(fs.promises, "rm").callsFake(async (...args) => {
-        elapsedMs += 1500;
-        await rm(...args);
-      });
-
-      const { cleanupDurationMs } = await runDownloadCodeQL(
-        tmpDir,
-        CLEANUP_BUNDLE_VERSION,
-      );
-
-      t.is(cleanupDurationMs, 3000);
-    });
-  },
-);
-
 test.serial(
   "downloadCodeQLBundle reports no deleted versions when the toolcache has no CodeQL bundles",
   async (t) => {

src/setup-codeql.ts

@@ -814,7 +814,6 @@ async function tryDeleteToolcacheBundles({
     return;
   }
 
-  const startTime = performance.now();
   const result = await deleteToolcacheBundles({ env, logger });
 
   addNoLanguageDiagnostic(
@@ -822,7 +821,7 @@ async function tryDeleteToolcacheBundles({
     makeTelemetryDiagnostic(
       "codeql-action/toolcache-bundle-cleanup",
       "Toolcache CodeQL bundle cleanup",
-      { ...result, durationMs: util.durationMsSince(startTime) },
+      { ...result },
     ),
   );
 }

src/tools-download.ts

@@ -342,16 +342,13 @@ export async function deleteToolcacheBundles({
       const versionDirectory = path.join(toolDirectory, entry.name);
 
       try {
-        const deletionStart = performance.now();
         await fs.promises.rm(versionDirectory, {
           force: true,
           recursive: true,
         });
         deletedVersions.push(entry.name);
         logger.info(
-          `Deleted the CodeQL tools at '${versionDirectory}' from the toolcache to free up disk space (${formatDuration(
-            durationMsSince(deletionStart),
-          )}).`,
+          `Deleted the CodeQL tools at '${versionDirectory}' from the toolcache to free up disk space.`,
         );
       } catch (e) {
         failed = true;