Merge pull request #4283 from github/sam-robson/decode-diff-informed-sarif-uris

fix: decode SARIF location URIs in diff-informed alert filtering
Merge pull request #4288 from github/dependabot/npm_and_yarn/node-forge-1.4.1
2026-11-04 12:09:46 +00:00 · 2026-11-03 19:47:09 +00:00 · 2026-11-03 15:53:37 +00:00 · 2026-11-03 15:49:12 +00:00 · 2026-11-03 15:38:38 +00:00 · 2026-11-03 15:36:40 +00:00
144 changed files with 18745 additions and 8933 deletions
--- a/.github/actions/prepare-test/action.yml
+++ b/.github/actions/prepare-test/action.yml
@@ -6,11 +6,11 @@ inputs:
    required: true
  use-all-platform-bundle:
    description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL"
-    default: 'false'
+    default: "false"
    required: false
  setup-kotlin:
    description: "If true, we setup kotlin"
-    default: 'true'
+    default: "true"
    required: true
 outputs:
  tools-url:
@@ -73,7 +73,10 @@ runs:
          exit 1
        fi

-    - uses: fwilhe2/setup-kotlin@9c245a6425255f5e98ba1ce6c15d31fce7eca9da
+    - uses: fwilhe2/setup-kotlin@b325539ca8f6e1d9ee04efed06f49bdbf5426dbb # v2.1
      if: ${{ inputs.setup-kotlin == 'true' }}
      with:
-        version: 1.8.21
+        # Kotlin is installed on the runners by default, but the version that is pre-installed is too new
+        # to be supported by CodeQL. This Kotlin version is selected to be compatible with both the default Java
+        # version on the `ubuntu-latest` runners and CodeQL.
+        version: 2.1.20
--- a/.github/actions/release-initialise/action.yml
+++ b/.github/actions/release-initialise/action.yml
@@ -16,7 +16,7 @@ runs:
      shell: bash

    - name: Set up Node
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
      with:
        node-version: 24
        cache: 'npm'
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -16,6 +16,14 @@ updates:
      # This might be fixed when we move to eslint v9.
      - dependency-name: "eslint-plugin-import"
        versions: [">=2.30.0"]
+
+      # Some of our dependencies are lagging behind with support for new versions of
+      # `undici` which is why we have to override it in `package.json`. Dependabot
+      # workflows fail when they try to update a dependency that is explicitly
+      # overriden. Since this happens somewhat routinely at the moment, we are
+      # excluding `undici` here and have to manually update it when needed.
+      - dependency-name: "undici"
+        versions: [">=7.30.1"]
    groups:
      npm-minor:
        patterns:
@@ -26,7 +34,7 @@ updates:
  - package-ecosystem: github-actions
    directories:
      - "/.github/workflows"
-      - "/.github/actions"
+      - "/.github/actions/*/"
    schedule:
      interval: weekly
    cooldown:
--- a/.github/workflows/__all-platform-bundle.yml
+++ b/.github/workflows/__all-platform-bundle.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,28 +42,23 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: all-platform-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: all-platform-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  all-platform-bundle:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
            version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
            version: nightly-latest
    name: All-platform bundle
    if: github.triggering_actor != 'dependabot[bot]'
@@ -89,11 +79,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__analysis-kinds.yml
+++ b/.github/workflows/__analysis-kinds.yml
@@ -19,53 +19,43 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: analysis-kinds-${{github.ref}}-${{inputs.java-version}}
+  group: analysis-kinds-${{github.ref}}
 jobs:
  analysis-kinds:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
            analysis-kinds: code-scanning
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
            analysis-kinds: code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
            analysis-kinds: code-scanning,code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
            analysis-kinds: risk-assessment
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
            analysis-kinds: code-scanning
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
            analysis-kinds: code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
            analysis-kinds: code-scanning,code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
            analysis-kinds: risk-assessment
    name: Analysis kinds
@@ -78,11 +68,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__analyze-ref-input.yml
+++ b/.github/workflows/__analyze-ref-input.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,24 +42,19 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: analyze-ref-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: analyze-ref-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  analyze-ref-input:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
    name: "Analyze: 'ref' and 'sha' from inputs"
    if: github.triggering_actor != 'dependabot[bot]'
@@ -85,11 +75,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__autobuild-action.yml
+++ b/.github/workflows/__autobuild-action.yml
@@ -25,11 +25,6 @@ on:
        description: The version of .NET to install
        required: false
        default: 9.x
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -37,28 +32,23 @@ on:
        description: The version of .NET to install
        required: false
        default: 9.x
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: autobuild-action-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.java-version}}
+  group: autobuild-action-${{github.ref}}-${{inputs.dotnet-version}}
 jobs:
  autobuild-action:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: macos-latest
+          - os: macos-26
            version: linked
-          - os: windows-latest
+          - os: windows-2025
            version: linked
    name: autobuild-action
    if: github.triggering_actor != 'dependabot[bot]'
@@ -74,11 +64,6 @@ jobs:
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml
+++ b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml
@@ -44,13 +44,13 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: windows-latest
+          - os: windows-2025
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
            version: nightly-latest
    name: Autobuild direct tracing (custom working directory)
    if: github.triggering_actor != 'dependabot[bot]'
--- a/.github/workflows/__autobuild-working-dir.yml
+++ b/.github/workflows/__autobuild-working-dir.yml
@@ -19,32 +19,22 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: autobuild-working-dir-${{github.ref}}-${{inputs.java-version}}
+  group: autobuild-working-dir-${{github.ref}}
 jobs:
  autobuild-working-dir:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
    name: Autobuild working directory
    if: github.triggering_actor != 'dependabot[bot]'
@@ -56,11 +46,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__build-mode-autobuild.yml
+++ b/.github/workflows/__build-mode-autobuild.yml
@@ -44,13 +44,13 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: windows-latest
+          - os: windows-2025
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
            version: nightly-latest
    name: Build mode autobuild
    if: github.triggering_actor != 'dependabot[bot]'
--- a/.github/workflows/__build-mode-manual.yml
+++ b/.github/workflows/__build-mode-manual.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,24 +42,19 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: build-mode-manual-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: build-mode-manual-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  build-mode-manual:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: Build mode manual
    if: github.triggering_actor != 'dependabot[bot]'
@@ -85,11 +75,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__build-mode-none.yml
+++ b/.github/workflows/__build-mode-none.yml
@@ -19,34 +19,24 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: build-mode-none-${{github.ref}}-${{inputs.java-version}}
+  group: build-mode-none-${{github.ref}}
 jobs:
  build-mode-none:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: Build mode none
    if: github.triggering_actor != 'dependabot[bot]'
@@ -58,11 +48,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__build-mode-rollback.yml
+++ b/.github/workflows/__build-mode-rollback.yml
@@ -19,32 +19,22 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: build-mode-rollback-${{github.ref}}-${{inputs.java-version}}
+  group: build-mode-rollback-${{github.ref}}
 jobs:
  build-mode-rollback:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: Build mode rollback
    if: github.triggering_actor != 'dependabot[bot]'
@@ -56,11 +46,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__bundle-from-nightly.yml
+++ b/.github/workflows/__bundle-from-nightly.yml
@@ -19,32 +19,22 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-from-nightly-${{github.ref}}-${{inputs.java-version}}
+  group: bundle-from-nightly-${{github.ref}}
 jobs:
  bundle-from-nightly:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
    name: 'Bundle: From nightly'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -56,11 +46,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__bundle-from-toolcache.yml
+++ b/.github/workflows/__bundle-from-toolcache.yml
@@ -19,32 +19,22 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-from-toolcache-${{github.ref}}-${{inputs.java-version}}
+  group: bundle-from-toolcache-${{github.ref}}
 jobs:
  bundle-from-toolcache:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: toolcache
    name: 'Bundle: From toolcache'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -56,11 +46,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Install Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
--- a/.github/workflows/__bundle-toolcache.yml
+++ b/.github/workflows/__bundle-toolcache.yml
@@ -19,36 +19,26 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-toolcache-${{github.ref}}-${{inputs.java-version}}
+  group: bundle-toolcache-${{github.ref}}
 jobs:
  bundle-toolcache:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: macos-latest
+          - os: macos-26
            version: linked
-          - os: windows-latest
+          - os: windows-2025
            version: linked
    name: 'Bundle: Caching checks'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -60,11 +50,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Install Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
--- a/.github/workflows/__cleanup-db-cluster-dir.yml
+++ b/.github/workflows/__cleanup-db-cluster-dir.yml
@@ -19,32 +19,22 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cleanup-db-cluster-dir-${{github.ref}}-${{inputs.java-version}}
+  group: cleanup-db-cluster-dir-${{github.ref}}
 jobs:
  cleanup-db-cluster-dir:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
    name: Clean up database cluster directory
    if: github.triggering_actor != 'dependabot[bot]'
@@ -56,11 +46,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__config-export.yml
+++ b/.github/workflows/__config-export.yml
@@ -19,34 +19,24 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: config-export-${{github.ref}}-${{inputs.java-version}}
+  group: config-export-${{github.ref}}
 jobs:
  config-export:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: Config export
    if: github.triggering_actor != 'dependabot[bot]'
@@ -58,11 +48,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__config-input.yml
+++ b/.github/workflows/__config-input.yml
@@ -19,32 +19,22 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: config-input-${{github.ref}}-${{inputs.java-version}}
+  group: config-input-${{github.ref}}
 jobs:
  config-input:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
    name: Config input
    if: github.triggering_actor != 'dependabot[bot]'
@@ -56,11 +46,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Install Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
--- a/.github/workflows/__cpp-deptrace-disabled.yml
+++ b/.github/workflows/__cpp-deptrace-disabled.yml
@@ -19,36 +19,26 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cpp-deptrace-disabled-${{github.ref}}-${{inputs.java-version}}
+  group: cpp-deptrace-disabled-${{github.ref}}
 jobs:
  cpp-deptrace-disabled:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: 'C/C++: disabling autoinstalling dependencies (Linux)'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -60,11 +50,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml
+++ b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml
@@ -19,34 +19,24 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cpp-deptrace-enabled-on-macos-${{github.ref}}-${{inputs.java-version}}
+  group: cpp-deptrace-enabled-on-macos-${{github.ref}}
 jobs:
  cpp-deptrace-enabled-on-macos:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: macos-latest
+          - os: macos-26
            version: linked
-          - os: macos-latest
+          - os: macos-26
            version: nightly-latest
    name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -58,11 +48,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__cpp-deptrace-enabled.yml
+++ b/.github/workflows/__cpp-deptrace-enabled.yml
@@ -19,36 +19,26 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cpp-deptrace-enabled-${{github.ref}}-${{inputs.java-version}}
+  group: cpp-deptrace-enabled-${{github.ref}}
 jobs:
  cpp-deptrace-enabled:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: 'C/C++: autoinstalling dependencies (Linux)'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -60,11 +50,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__diagnostics-export.yml
+++ b/.github/workflows/__diagnostics-export.yml
@@ -19,34 +19,24 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: diagnostics-export-${{github.ref}}-${{inputs.java-version}}
+  group: diagnostics-export-${{github.ref}}
 jobs:
  diagnostics-export:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: Diagnostic export
    if: github.triggering_actor != 'dependabot[bot]'
@@ -58,11 +48,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Install Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
--- a/.github/workflows/__diagnostics-without-db.yml
+++ b/.github/workflows/__diagnostics-without-db.yml
@@ -19,32 +19,22 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: diagnostics-without-db-${{github.ref}}-${{inputs.java-version}}
+  group: diagnostics-without-db-${{github.ref}}
 jobs:
  diagnostics-without-db:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
    name: Diagnostic export without database
    if: github.triggering_actor != 'dependabot[bot]'
@@ -63,11 +53,6 @@ jobs:
      #
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Install Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
@@ -123,7 +108,7 @@ jobs:
      contents: read
      security-events: read
    timeout-minutes: 5
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -137,7 +122,7 @@ jobs:
      - name: Install dependencies
        run: npm ci
      - name: Download workflow artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: test-mode-sarif-*
          path: sarif
--- a/.github/workflows/__export-file-baseline-information.yml
+++ b/.github/workflows/__export-file-baseline-information.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,28 +42,23 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: export-file-baseline-information-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: export-file-baseline-information-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  export-file-baseline-information:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
            version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
            version: nightly-latest
    name: Export file baseline information
    if: github.triggering_actor != 'dependabot[bot]'
@@ -89,11 +79,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__extractor-ram-threads.yml
+++ b/.github/workflows/__extractor-ram-threads.yml
@@ -19,32 +19,22 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: extractor-ram-threads-${{github.ref}}-${{inputs.java-version}}
+  group: extractor-ram-threads-${{github.ref}}
 jobs:
  extractor-ram-threads:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
    name: Extractor ram and threads options test
    if: github.triggering_actor != 'dependabot[bot]'
@@ -56,11 +46,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__global-proxy.yml
+++ b/.github/workflows/__global-proxy.yml
@@ -34,9 +34,9 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: Proxy test
    if: github.triggering_actor != 'dependabot[bot]'
--- a/.github/workflows/__go-custom-queries.yml
+++ b/.github/workflows/__go-custom-queries.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,26 +42,21 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-custom-queries-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: go-custom-queries-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  go-custom-queries:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: 'Go: Custom queries'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -87,11 +77,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
+++ b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
@@ -25,11 +25,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      go-version:
@@ -37,24 +32,19 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-indirect-tracing-workaround-diagnostic-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: go-indirect-tracing-workaround-diagnostic-${{github.ref}}-${{inputs.go-version}}
 jobs:
  go-indirect-tracing-workaround-diagnostic:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
    name: 'Go: diagnostic when Go is changed after init step'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -71,11 +61,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
+++ b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
@@ -25,11 +25,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      go-version:
@@ -37,24 +32,19 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-indirect-tracing-workaround-no-file-program-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: go-indirect-tracing-workaround-no-file-program-${{github.ref}}-${{inputs.go-version}}
 jobs:
  go-indirect-tracing-workaround-no-file-program:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
    name: 'Go: diagnostic when `file` is not installed'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -71,11 +61,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__go-indirect-tracing-workaround.yml
+++ b/.github/workflows/__go-indirect-tracing-workaround.yml
@@ -25,11 +25,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      go-version:
@@ -37,24 +32,19 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-indirect-tracing-workaround-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: go-indirect-tracing-workaround-${{github.ref}}-${{inputs.go-version}}
 jobs:
  go-indirect-tracing-workaround:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
    name: 'Go: workaround for indirect tracing'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -71,11 +61,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__go-tracing-autobuilder.yml
+++ b/.github/workflows/__go-tracing-autobuilder.yml
@@ -25,11 +25,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      go-version:
@@ -37,44 +32,39 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-tracing-autobuilder-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: go-tracing-autobuilder-${{github.ref}}-${{inputs.go-version}}
 jobs:
  go-tracing-autobuilder:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
            version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.21.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.22.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.23.9
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.24.3
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.25.6
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: macos-latest
+          - os: macos-26
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
            version: nightly-latest
    name: 'Go: tracing with autobuilder step'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -91,11 +81,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__go-tracing-custom-build-steps.yml
+++ b/.github/workflows/__go-tracing-custom-build-steps.yml
@@ -25,11 +25,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      go-version:
@@ -37,44 +32,39 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-tracing-custom-build-steps-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: go-tracing-custom-build-steps-${{github.ref}}-${{inputs.go-version}}
 jobs:
  go-tracing-custom-build-steps:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
            version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.21.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.22.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.23.9
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.24.3
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.25.6
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: macos-latest
+          - os: macos-26
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
            version: nightly-latest
    name: 'Go: tracing with custom build steps'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -91,11 +81,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__go-tracing-legacy-workflow.yml
+++ b/.github/workflows/__go-tracing-legacy-workflow.yml
@@ -25,11 +25,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      go-version:
@@ -37,44 +32,39 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-tracing-legacy-workflow-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: go-tracing-legacy-workflow-${{github.ref}}-${{inputs.go-version}}
 jobs:
  go-tracing-legacy-workflow:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
            version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.21.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.22.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.23.9
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.24.3
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.25.6
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: macos-latest
+          - os: macos-26
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
            version: nightly-latest
    name: 'Go: tracing with legacy workflow'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -91,11 +81,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__go.yml
+++ b/.github/workflows/__go.yml
@@ -20,11 +20,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 jobs:
  go-custom-queries:
    name: 'Go: Custom queries'
@@ -35,7 +30,6 @@ jobs:
    with:
      dotnet-version: ${{ inputs.dotnet-version }}
      go-version: ${{ inputs.go-version }}
-      java-version: ${{ inputs.java-version }}
  go-indirect-tracing-workaround-diagnostic:
    name: 'Go: diagnostic when Go is changed after init step'
    permissions:
@@ -44,7 +38,6 @@ jobs:
    uses: ./.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
    with:
      go-version: ${{ inputs.go-version }}
-      java-version: ${{ inputs.java-version }}
  go-indirect-tracing-workaround-no-file-program:
    name: 'Go: diagnostic when `file` is not installed'
    permissions:
@@ -53,7 +46,6 @@ jobs:
    uses: ./.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
    with:
      go-version: ${{ inputs.go-version }}
-      java-version: ${{ inputs.java-version }}
  go-indirect-tracing-workaround:
    name: 'Go: workaround for indirect tracing'
    permissions:
@@ -62,7 +54,6 @@ jobs:
    uses: ./.github/workflows/__go-indirect-tracing-workaround.yml
    with:
      go-version: ${{ inputs.go-version }}
-      java-version: ${{ inputs.java-version }}
  go-tracing-autobuilder:
    name: 'Go: tracing with autobuilder step'
    permissions:
@@ -71,7 +62,6 @@ jobs:
    uses: ./.github/workflows/__go-tracing-autobuilder.yml
    with:
      go-version: ${{ inputs.go-version }}
-      java-version: ${{ inputs.java-version }}
  go-tracing-custom-build-steps:
    name: 'Go: tracing with custom build steps'
    permissions:
@@ -80,7 +70,6 @@ jobs:
    uses: ./.github/workflows/__go-tracing-custom-build-steps.yml
    with:
      go-version: ${{ inputs.go-version }}
-      java-version: ${{ inputs.java-version }}
  go-tracing-legacy-workflow:
    name: 'Go: tracing with legacy workflow'
    permissions:
@@ -89,4 +78,3 @@ jobs:
    uses: ./.github/workflows/__go-tracing-legacy-workflow.yml
    with:
      go-version: ${{ inputs.go-version }}
-      java-version: ${{ inputs.java-version }}
--- a/.github/workflows/__init-with-registries.yml
+++ b/.github/workflows/__init-with-registries.yml
@@ -19,36 +19,26 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: init-with-registries-${{github.ref}}-${{inputs.java-version}}
+  group: init-with-registries-${{github.ref}}
 jobs:
  init-with-registries:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: 'Packaging: Download using registries'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -60,11 +50,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__javascript-source-root.yml
+++ b/.github/workflows/__javascript-source-root.yml
@@ -19,36 +19,26 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: javascript-source-root-${{github.ref}}-${{inputs.java-version}}
+  group: javascript-source-root-${{github.ref}}
 jobs:
  javascript-source-root:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: Custom source root
    if: github.triggering_actor != 'dependabot[bot]'
@@ -60,11 +50,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__job-run-uuid-sarif.yml
+++ b/.github/workflows/__job-run-uuid-sarif.yml
@@ -19,32 +19,22 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: job-run-uuid-sarif-${{github.ref}}-${{inputs.java-version}}
+  group: job-run-uuid-sarif-${{github.ref}}
 jobs:
  job-run-uuid-sarif:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: Job run UUID added to SARIF
    if: github.triggering_actor != 'dependabot[bot]'
@@ -56,11 +46,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__language-aliases.yml
+++ b/.github/workflows/__language-aliases.yml
@@ -19,32 +19,22 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: language-aliases-${{github.ref}}-${{inputs.java-version}}
+  group: language-aliases-${{github.ref}}
 jobs:
  language-aliases:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
    name: Language aliases
    if: github.triggering_actor != 'dependabot[bot]'
@@ -56,11 +46,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__linux-arm64.yml
+++ b/.github/workflows/__linux-arm64.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,17 +42,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  linux-arm64:
    strategy:
@@ -85,11 +75,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__local-bundle.yml
+++ b/.github/workflows/__local-bundle.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,24 +42,19 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: local-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: local-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  local-bundle:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
    name: Local CodeQL bundle
    if: github.triggering_actor != 'dependabot[bot]'
@@ -85,11 +75,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__multi-language-autodetect.yml
+++ b/.github/workflows/__multi-language-autodetect.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,58 +42,53 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: multi-language-autodetect-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: multi-language-autodetect-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  multi-language-autodetect:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
            version: stable-v2.20.7
          - os: macos-15-xlarge
            version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.21.4
          - os: macos-15-xlarge
            version: stable-v2.21.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.22.4
          - os: macos-15-xlarge
            version: stable-v2.22.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.23.9
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
            version: stable-v2.23.9
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.24.3
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
            version: stable-v2.24.3
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.25.6
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
            version: stable-v2.25.6
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
            version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
            version: nightly-latest
    name: Multi-language repository
    if: github.triggering_actor != 'dependabot[bot]'
@@ -119,11 +109,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -136,7 +121,7 @@ jobs:
        # imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
        # See https://github.com/github/codeql-action/pull/3212
        if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: '3.13.15'

--- a/.github/workflows/__overlay-init-fallback.yml
+++ b/.github/workflows/__overlay-init-fallback.yml
@@ -19,34 +19,24 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: overlay-init-fallback-${{github.ref}}-${{inputs.java-version}}
+  group: overlay-init-fallback-${{github.ref}}
 jobs:
  overlay-init-fallback:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: Overlay database init fallback
    if: github.triggering_actor != 'dependabot[bot]'
@@ -58,11 +48,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml
+++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,28 +42,23 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-codescanning-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: packaging-codescanning-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  packaging-codescanning-config-inputs-js:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: 'Packaging: Config and input passed to the CLI'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -89,11 +79,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Install Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
--- a/.github/workflows/__packaging-config-inputs-js.yml
+++ b/.github/workflows/__packaging-config-inputs-js.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,28 +42,23 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: packaging-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  packaging-config-inputs-js:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: 'Packaging: Config and input'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -89,11 +79,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Install Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
--- a/.github/workflows/__packaging-config-js.yml
+++ b/.github/workflows/__packaging-config-js.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,28 +42,23 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-config-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: packaging-config-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  packaging-config-js:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: 'Packaging: Config file'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -89,11 +79,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Install Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
--- a/.github/workflows/__packaging-inputs-js.yml
+++ b/.github/workflows/__packaging-inputs-js.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,28 +42,23 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: packaging-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  packaging-inputs-js:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: 'Packaging: Action input'
    if: github.triggering_actor != 'dependabot[bot]'
@@ -89,11 +79,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Install Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
--- a/.github/workflows/__per-language-bundle-validation.yml
+++ b/.github/workflows/__per-language-bundle-validation.yml
@@ -19,25 +19,15 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: per-language-bundle-validation-${{github.ref}}-${{inputs.java-version}}
+  group: per-language-bundle-validation-${{github.ref}}
 jobs:
  per-language-bundle-validation:
    strategy:
@@ -45,40 +35,40 @@ jobs:
      matrix:
        include:
          - language: actions
-            os: ubuntu-latest
+            os: ubuntu-26.04
            version: linked
            expected-extractors: actions javascript
          - language: cpp
-            os: ubuntu-latest
+            os: ubuntu-26.04
            version: linked
            build-mode: manual
            build-command: gcc -o main main.c
          - language: csharp
-            os: ubuntu-latest
+            os: ubuntu-26.04
            version: linked
            build-mode: none
          - language: go
-            os: ubuntu-latest
+            os: ubuntu-26.04
            version: linked
            build-mode: autobuild
          - language: java
-            os: ubuntu-latest
+            os: ubuntu-26.04
            version: linked
            build-mode: none
          - language: javascript
-            os: ubuntu-latest
+            os: ubuntu-26.04
            version: linked
          - language: python
-            os: ubuntu-latest
+            os: ubuntu-26.04
            version: linked
          - language: ruby
-            os: ubuntu-latest
+            os: ubuntu-26.04
            version: linked
          - language: rust
-            os: ubuntu-latest
+            os: ubuntu-26.04
            version: linked
          - language: swift
-            os: macos-latest-xlarge
+            os: macos-26-xlarge
            version: linked
            build-mode: autobuild
    name: Per-language bundles
@@ -91,11 +81,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Install Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
--- a/.github/workflows/__remote-config.yml
+++ b/.github/workflows/__remote-config.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,26 +42,21 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: remote-config-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: remote-config-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  remote-config:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: Remote config file
    if: github.triggering_actor != 'dependabot[bot]'
@@ -87,11 +77,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__resolve-environment-action.yml
+++ b/.github/workflows/__resolve-environment-action.yml
@@ -19,36 +19,26 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: resolve-environment-action-${{github.ref}}-${{inputs.java-version}}
+  group: resolve-environment-action-${{github.ref}}
 jobs:
  resolve-environment-action:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: Resolve environment
    if: github.triggering_actor != 'dependabot[bot]'
@@ -60,11 +50,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__rubocop-multi-language.yml
+++ b/.github/workflows/__rubocop-multi-language.yml
@@ -1,89 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: PR Check - RuboCop multi-language
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-      - main
-      - releases/v*
-  pull_request: {}
-  merge_group:
-    types:
-      - checks_requested
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
-  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: rubocop-multi-language-${{github.ref}}-${{inputs.java-version}}
-jobs:
-  rubocop-multi-language:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            version: default
-    name: RuboCop multi-language
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - name: Set up Ruby
-        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
-        with:
-          ruby-version: 2.6
-      - name: Install Code Scanning integration
-        run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
-      - name: Install dependencies
-        run: bundle install
-      - name: RuboCop run
-        run: |
-          bash -c "
-            bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
-            [[ $? -ne 2 ]]
-          "
-      - uses: ./../action/upload-sarif
-        with:
-          sarif_file: rubocop.sarif
-    env:
-      CODEQL_ACTION_TEST_MODE: true
--- a/.github/workflows/__ruby.yml
+++ b/.github/workflows/__ruby.yml
@@ -19,42 +19,32 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ruby-${{github.ref}}-${{inputs.java-version}}
+  group: ruby-${{github.ref}}
 jobs:
  ruby:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: macos-latest
+          - os: macos-26
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
-          - os: macos-latest
+          - os: macos-26
            version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
            version: nightly-latest
    name: Ruby analysis
    if: github.triggering_actor != 'dependabot[bot]'
@@ -66,11 +56,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__rust.yml
+++ b/.github/workflows/__rust.yml
@@ -19,40 +19,30 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: rust-${{github.ref}}-${{inputs.java-version}}
+  group: rust-${{github.ref}}
 jobs:
  rust:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
            version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: stable-v2.22.1
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: Rust analysis
    if: github.triggering_actor != 'dependabot[bot]'
@@ -64,11 +54,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__split-workflow.yml
+++ b/.github/workflows/__split-workflow.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,34 +42,29 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: split-workflow-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: split-workflow-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  split-workflow:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: macos-latest
+          - os: macos-26
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
-          - os: macos-latest
+          - os: macos-26
            version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
            version: nightly-latest
    name: Split workflow
    if: github.triggering_actor != 'dependabot[bot]'
@@ -95,11 +85,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__start-proxy.yml
+++ b/.github/workflows/__start-proxy.yml
@@ -19,36 +19,26 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: start-proxy-${{github.ref}}-${{inputs.java-version}}
+  group: start-proxy-${{github.ref}}
 jobs:
  start-proxy:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: macos-latest
+          - os: macos-26
            version: linked
-          - os: windows-latest
+          - os: windows-2025
            version: linked
    name: Start proxy
    if: github.triggering_actor != 'dependabot[bot]'
@@ -60,11 +50,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__submit-sarif-failure.yml
+++ b/.github/workflows/__submit-sarif-failure.yml
@@ -19,36 +19,26 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: submit-sarif-failure-${{github.ref}}-${{inputs.java-version}}
+  group: submit-sarif-failure-${{github.ref}}
 jobs:
  submit-sarif-failure:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: Submit SARIF after failure
    if: github.triggering_actor != 'dependabot[bot]'
@@ -60,11 +50,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__swift-autobuild.yml
+++ b/.github/workflows/__swift-autobuild.yml
@@ -19,32 +19,22 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: swift-autobuild-${{github.ref}}-${{inputs.java-version}}
+  group: swift-autobuild-${{github.ref}}
 jobs:
  swift-autobuild:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
            version: nightly-latest
    name: Swift analysis using autobuild
    if: github.triggering_actor != 'dependabot[bot]'
@@ -56,11 +46,6 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__swift-custom-build.yml
+++ b/.github/workflows/__swift-custom-build.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,28 +42,23 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: swift-custom-build-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: swift-custom-build-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  swift-custom-build:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
            version: linked
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
            version: default
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
            version: nightly-latest
    name: Swift analysis using a custom build command
    if: github.triggering_actor != 'dependabot[bot]'
@@ -89,11 +79,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__unset-environment.yml
+++ b/.github/workflows/__unset-environment.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,26 +42,21 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: unset-environment-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: unset-environment-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  unset-environment:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: nightly-latest
    name: Test unsetting environment variables
    if: github.triggering_actor != 'dependabot[bot]'
@@ -87,11 +77,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__unsupported-macos.yml
+++ b/.github/workflows/__unsupported-macos.yml
@@ -0,0 +1,135 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Unsupported macOS
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request: {}
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs: {}
+  workflow_call:
+    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: unsupported-macos-${{github.ref}}
+jobs:
+  unsupported-macos:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: xcode-27
+            version: linked
+          - os: xcode-27
+            version: nightly-latest
+    name: Unsupported macOS
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Check xcode_select_link
+        run: |
+          readlink /private/var/db/xcode_select_link
+          file -h /private/var/db/xcode_select_link
+
+      - uses: ./../action/init
+        id: init
+        continue-on-error: true
+        env:
+          CODEQL_ACTION_CHECK_UNSUPPORTED_TRACED_ANALYSIS: true
+          CODEQL_ACTION_ABORT_UNSUPPORTED_TRACED_ANALYSIS: true
+        with:
+          languages: swift
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Analyze
+        # We could run `analyze` here from `./../analyze`, but `getAnalyzeActionName` in `workflow.ts`
+        # can't cope with that unless we introduce a different testing environment. Since this step
+        # would just fail on `xcode-27` anyway, we just skip it instead.
+        if: false
+        uses: ./analyze
+        with:
+          category: '/test-codeql-version:${{ matrix.version }}'
+    env:
+      CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
+      CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+      CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+      CODEQL_ACTION_TEST_MODE: true
+  unsupported-macos-sarif-checks:
+    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - unsupported-macos
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 5
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Download workflow artifact
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: test-mode-sarif-*
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
+
+      - name: Check diagnostics appear in SARIF
+        env:
+          SARIF_PATH: "./sarif/"
+          DIAGNOSTIC_ID: "codeql-action/unsupported-traced-analysis-macos"
+          DIAGNOSTIC_NAME: "Traced analysis is not supported on this version of macOS"
+          EXPECTED_LOCATIONS: "0"
+          EXPECTED_MESSAGE: |
+            Traced analysis is not supported on macOS 27 or above.
+        run: npx tsx ./pr-checks/check-diagnostics.ts
+    env:
+      CODEQL_ACTION_TEST_MODE: true
--- a/.github/workflows/__upload-ref-sha-input.yml
+++ b/.github/workflows/__upload-ref-sha-input.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,24 +42,19 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: upload-ref-sha-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: upload-ref-sha-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  upload-ref-sha-input:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
    name: "Upload-sarif: 'ref' and 'sha' from inputs"
    if: github.triggering_actor != 'dependabot[bot]'
@@ -85,11 +75,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__upload-sarif.yml
+++ b/.github/workflows/__upload-sarif.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,30 +42,25 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: upload-sarif-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: upload-sarif-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  upload-sarif:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
            analysis-kinds: code-scanning
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
            analysis-kinds: code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: default
            analysis-kinds: code-scanning,code-quality
    name: Test different uses of `upload-sarif`
@@ -92,11 +82,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/__with-checkout-path.yml
+++ b/.github/workflows/__with-checkout-path.yml
@@ -30,11 +30,6 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -47,24 +42,19 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: with-checkout-path-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
+  group: with-checkout-path-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
  with-checkout-path:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
            version: linked
    name: Use a custom `checkout_path`
    if: github.triggering_actor != 'dependabot[bot]'
@@ -86,11 +76,6 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -22,7 +22,7 @@ jobs:
  # Identify the CodeQL tool versions to use in the analysis job.
  check-codeql-versions:
    if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
    outputs:
      versions: ${{ steps.compare.outputs.versions }}

@@ -106,7 +106,7 @@ jobs:

  analyze-other:
    if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04

    strategy:
      fail-fast: false
--- a/.github/workflows/codescanning-config-cli.yml
+++ b/.github/workflows/codescanning-config-cli.yml
@@ -41,11 +41,11 @@ jobs:
      fail-fast: false
      matrix:
        include:
-        - os: ubuntu-latest
+        - os: ubuntu-26.04
          version: linked
-        - os: ubuntu-latest
+        - os: ubuntu-26.04
          version: default
-        - os: ubuntu-latest
+        - os: ubuntu-26.04
          version: nightly-latest

    # Code-Scanning config not created because environment variable is not set
--- a/.github/workflows/debug-artifacts-failure-safe.yml
+++ b/.github/workflows/debug-artifacts-failure-safe.yml
@@ -6,13 +6,13 @@ env:
 on:
  push:
    branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
  pull_request:
  merge_group:
    types: [checks_requested]
  schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
  workflow_dispatch:

 concurrency:
@@ -30,10 +30,10 @@ jobs:
      fail-fast: false
      matrix:
        version:
-        - stable-v2.20.7
-        - default
-        - linked
-        - nightly-latest
+          - stable-v2.20.7
+          - default
+          - linked
+          - nightly-latest
    name: Upload debug artifacts after failure in analyze
    continue-on-error: true
    env:
@@ -43,7 +43,12 @@ jobs:
      # We currently need `security-events: read` to access feature flags.
      security-events: read
    timeout-minutes: 45
-    runs-on: ubuntu-latest
+
+    # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
+    # We could install that older version on the newer runners, or use the older runner.
+    # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
+
    steps:
      - name: Dump GitHub event
        run: cat "${GITHUB_EVENT_PATH}"
@@ -60,7 +65,7 @@ jobs:
      - name: Install .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
-          dotnet-version: '9.x'
+          dotnet-version: "9.x"
      - name: Assert best-effort artifact scan completed
        uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
      - uses: ./../action/init
@@ -86,12 +91,13 @@ jobs:
    timeout-minutes: 45
    permissions:
      contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
      - name: Check expected artifacts exist
        run: |
+          VERSIONS="stable-v2.20.7 default linked nightly-latest"
          LANGUAGES="cpp csharp go java javascript python"
          for version in $VERSIONS; do
            echo "Artifacts from version $version:"
--- a/.github/workflows/debug-artifacts-safe.yml
+++ b/.github/workflows/debug-artifacts-safe.yml
@@ -5,13 +5,13 @@ env:
 on:
  push:
    branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
  pull_request:
  merge_group:
    types: [checks_requested]
  schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
  workflow_dispatch:

 concurrency:
@@ -29,10 +29,10 @@ jobs:
      fail-fast: false
      matrix:
        version:
-        - stable-v2.20.7
-        - default
-        - linked
-        - nightly-latest
+          - stable-v2.20.7
+          - default
+          - linked
+          - nightly-latest
    name: Upload debug artifacts
    env:
      CODEQL_ACTION_TEST_MODE: true
@@ -41,7 +41,12 @@ jobs:
      contents: read
      # We currently need `security-events: read` to access feature flags.
      security-events: read
-    runs-on: ubuntu-latest
+
+    # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
+    # We could install that older version on the newer runners, or use the older runner.
+    # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
+
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -56,7 +61,7 @@ jobs:
      - name: Install .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
-          dotnet-version: '9.x'
+          dotnet-version: "9.x"
      - name: Assert best-effort artifact scan completed
        uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
      - uses: ./../action/init
@@ -79,7 +84,7 @@ jobs:
    timeout-minutes: 45
    permissions:
      contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
--- a/.github/workflows/deflake.yml
+++ b/.github/workflows/deflake.yml
@@ -60,7 +60,6 @@ on:
      - "PR Check - Proxy test"
      - "PR Check - Remote config file"
      - "PR Check - Resolve environment"
-      - "PR Check - RuboCop multi-language"
      - "PR Check - Ruby analysis"
      - "PR Check - Rust analysis"
      - "PR Check - Split workflow"
--- a/.github/workflows/post-release-mergeback.yml
+++ b/.github/workflows/post-release-mergeback.yml
@@ -10,7 +10,7 @@ on:
  workflow_dispatch:
    inputs:
      baseBranch:
-        description: 'The base branch to merge into'
+        description: "The base branch to merge into"
        default: main
        required: false

@@ -24,7 +24,7 @@ defaults:

 jobs:
  merge-back:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
    environment: Automation
    if: github.repository == 'github/codeql-action'
    env:
@@ -41,16 +41,16 @@ jobs:

      - name: Dump GitHub context
        env:
-          GITHUB_CONTEXT: '${{ toJson(github) }}'
+          GITHUB_CONTEXT: "${{ toJson(github) }}"
        run: echo "${GITHUB_CONTEXT}"

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
-          fetch-depth: 0  # ensure we have all tags and can push commits
+          fetch-depth: 0 # ensure we have all tags and can push commits
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
-          cache: 'npm'
+          cache: "npm"

      - name: Install JavaScript dependencies
        run: npm ci
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -25,7 +25,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-26.04, macos-26, windows-2025]
        node-version: [20, 24]
    permissions:
      contents: read
@@ -71,7 +71,7 @@ jobs:
        run: npm test

      - name: Lint
-        if: always() && matrix.os != 'windows-latest'
+        if: always() && matrix.os != 'windows-2025'
        run: npm run lint-ci

      - name: Upload sarif
@@ -81,7 +81,7 @@ jobs:
        # paired `push` run that the queue branch creates use that ref, so gate on the ref itself
        # rather than the event. The same results are uploaded by the `pull_request` run and again
        # by the `push` run on `main`.
-        if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
+        if: matrix.os == 'ubuntu-26.04' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
        with:
          sarif_file: eslint.sarif
          category: eslint
@@ -93,7 +93,7 @@ jobs:
    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
    timeout-minutes: 10

    concurrency:
@@ -126,10 +126,15 @@ jobs:
        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
        run: .github/workflows/script/verify-pr-checks.sh

+      - name: Typecheck pr-checks scripts
+        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
+        working-directory: pr-checks
+        run: npm run typecheck
+
      - name: Run pr-checks tests
        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
        working-directory: pr-checks
-        run: npx tsx --test
+        run: npm run test

      - name: Run `pr-checks/changenotes.ts` to ensure that all unreleased change notes are valid
        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
--- a/.github/workflows/pr-dequeued.yml
+++ b/.github/workflows/pr-dequeued.yml
@@ -21,8 +21,23 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          REASON: ${{ github.event.reason }}
-          USER: ${{ github.event.pull_request.user.login }}
        run: |
-          echo "@$USER The pull request was removed from the merge queue (\`$REASON\`)." \
+          # Mention whoever added the PR to the merge queue rather than the PR author, who may be a
+          # bot such as Dependabot. The `dequeued` event payload doesn't identify the enqueuer, so
+          # look them up in the most recent `AddedToMergeQueueEvent` on the PR's timeline.
+          enqueuer=$(gh api graphql \
+            -F number="$PR_NUMBER" \
+            -f query='
+              query($number: Int!) {
+                repository(owner: "github", name: "codeql-action") {
+                  pullRequest(number: $number) {
+                    timelineItems(itemTypes: [ADDED_TO_MERGE_QUEUE_EVENT], last: 1) {
+                      nodes { ... on AddedToMergeQueueEvent { enqueuer { login } } }
+                    }
+                  }
+                }
+              }' \
+            --jq '.data.repository.pullRequest.timelineItems.nodes[0].enqueuer.login')
+          echo "@$enqueuer The pull request was removed from the merge queue (\`$REASON\`)." \
            "Please resolve any issues if required and enqueue the PR again." |
            gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"
--- a/.github/workflows/prepare-release.yml
+++ b/.github/workflows/prepare-release.yml
@@ -29,7 +29,7 @@ defaults:
 jobs:
  prepare:
    name: "Release info"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
    if: github.repository == 'github/codeql-action'

    permissions:
--- a/.github/workflows/python312-windows.yml
+++ b/.github/workflows/python312-windows.yml
@@ -29,10 +29,10 @@ jobs:
      contents: read
      # We currently need `security-events: read` to access feature flags.
      security-events: read
-    runs-on: windows-latest
+    runs-on: windows-2025

    steps:
-    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+    - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
      with:
        python-version: 3.12

--- a/.github/workflows/query-filters.yml
+++ b/.github/workflows/query-filters.yml
@@ -25,7 +25,7 @@ jobs:
    name: Query Filters Tests
    if: github.triggering_actor != 'dependabot[bot]'
    timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
    permissions:
      contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
    steps:
--- a/.github/workflows/rebuild.yml
+++ b/.github/workflows/rebuild.yml
@@ -12,7 +12,7 @@ defaults:
 jobs:
  rebuild:
    name: Rebuild Action
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
    if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch'

    env:
@@ -33,7 +33,7 @@ jobs:
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
-          cache: 'npm'
+          cache: "npm"

      - name: Remove label
        if: github.event_name == 'pull_request'
--- a/.github/workflows/rollback-release.yml
+++ b/.github/workflows/rollback-release.yml
@@ -34,7 +34,7 @@ jobs:
  rollback:
    name: "Create rollback release"
    if: github.repository == 'github/codeql-action'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
    timeout-minutes: 45

    # Don't set the deployment environment for test runs
--- a/.github/workflows/test-codeql-bundle-all.yml
+++ b/.github/workflows/test-codeql-bundle-all.yml
@@ -27,7 +27,7 @@ jobs:
      fail-fast: false
      matrix:
        include:
-        - os: ubuntu-latest
+        - os: ubuntu-26.04
          version: nightly-latest
    name: 'CodeQL Bundle All'
    if: github.triggering_actor != 'dependabot[bot]'
--- a/.github/workflows/update-bundle.yml
+++ b/.github/workflows/update-bundle.yml
@@ -20,7 +20,7 @@ defaults:
 jobs:
  update-bundle:
    if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
    permissions:
      contents: write # needed to push commits
      pull-requests: write # needed to create pull requests
@@ -113,11 +113,12 @@ jobs:
          echo "CLI_VERSION=$cli_version" | tee -a "$GITHUB_ENV"
          echo "PR_URL=$pr_url" | tee -a "$GITHUB_ENV"

-      - name: Create changelog note
+      - name: Create changenote
        run: |
          npx tsx pr-checks/bundle-changelog.ts

-      - name: Push changelog note
+      - name: Push changenote
        run: |
-          git commit -am "Add changelog note"
+          git add unreleased-change-notes
+          git commit -m "Add changenote"
          git push
--- a/.github/workflows/update-release-branch.yml
+++ b/.github/workflows/update-release-branch.yml
@@ -26,7 +26,7 @@ jobs:
  update:
    name: "Update release branch"
    timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
    if: github.event_name == 'workflow_dispatch'
    needs: [prepare]
    env:
@@ -79,7 +79,7 @@ jobs:
  backport:
    name: "Create backport"
    timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
    environment: Automation
    needs: [prepare]
    if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,13 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th

 No user facing changes.

+## 4.39.2 - 03 Nov 2026
+
+- Update default CodeQL bundle version to [2.27.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4). [#4284](https://github.com/github/codeql-action/pull/4284)
+- _Upcoming breaking change_: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4266](https://github.com/github/codeql-action/pull/4266)
+- Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See [this blog post for more information](https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/). The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the [Tool Status Page](https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning). This check will be rolled out following this release of the CodeQL Action. [#4221](https://github.com/github/codeql-action/pull/4221)
+- The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The `analyze` Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#4243](https://github.com/github/codeql-action/pull/4243)
+
 ## 4.39.1 - 21 Oct 2026

 - Update default CodeQL bundle version to [2.27.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3). [#4256](https://github.com/github/codeql-action/pull/4256)
--- a/README.md
+++ b/README.md
@@ -76,7 +76,6 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n
 | `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
 | `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
 | `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
-| `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |

 See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server).

--- a/lib/defaults.json
+++ b/lib/defaults.json
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.3",
-  "cliVersion": "2.27.3",
-  "priorBundleVersion": "codeql-bundle-v2.27.2",
-  "priorCliVersion": "2.27.2"
+  "bundleVersion": "codeql-bundle-v2.27.4",
+  "cliVersion": "2.27.4",
+  "priorBundleVersion": "codeql-bundle-v2.27.3",
+  "priorCliVersion": "2.27.3"
 }
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
  "name": "codeql",
-  "version": "4.39.2",
+  "version": "4.39.3",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "codeql",
-      "version": "4.39.2",
+      "version": "4.39.3",
      "license": "MIT",
      "workspaces": [
        "pr-checks"
@@ -30,12 +30,12 @@
        "follow-redirects": "^1.16.1",
        "get-folder-size": "^5.0.0",
        "https-proxy-agent": "^7.0.6",
-        "js-yaml": "^5.4.3",
+        "js-yaml": "^5.5.0",
        "jsonschema": "1.5.0",
        "long": "^5.3.2",
-        "node-forge": "^1.4.0",
+        "node-forge": "^1.4.1",
        "semver": "^7.8.5",
-        "undici": "^6.28.0",
+        "undici": "^7.30.1",
        "uuid": "^14.0.3"
      },
      "devDependencies": {
@@ -50,29 +50,21 @@
        "@types/node-forge": "^1.3.14",
        "@types/sarif": "^2.1.7",
        "@types/semver": "^7.8.0",
-        "@types/sinon": "^22.0.0",
+        "@types/sinon": "^22.0.1",
        "ava": "^6.4.1",
        "esbuild": "^0.28.2",
        "eslint": "^9.39.5",
        "eslint-import-resolver-typescript": "^4.4.5",
        "eslint-plugin-github": "^6.1.2",
        "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jsdoc": "^65.3.4",
+        "eslint-plugin-jsdoc": "^65.4.0",
        "eslint-plugin-no-async-foreach": "^0.1.1",
        "glob": "^13.0.6",
        "globals": "^17.13.0",
        "nock": "^14.0.17",
        "sinon": "^22.1.0",
        "typescript": "^6.0.3",
-        "typescript-eslint": "^8.71.2"
-      }
-    },
-    "node_modules/@aashutoshrathi/word-wrap": {
-      "version": "1.2.6",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
+        "typescript-eslint": "^8.72.0"
      }
    },
    "node_modules/@actions/artifact": {
@@ -958,18 +950,89 @@
        "tslib": "^2.4.0"
      }
    },
+    "node_modules/@es-joy/escodegen": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/@es-joy/escodegen/-/escodegen-4.2.0.tgz",
+      "integrity": "sha512-jWqqS3StW6vGwJeT8yu6alS4nipOBi3kD/pR63+9hG2NfGafCJ4viDME15mVf+fyupyptcUJDXfv63gFF5Gzfg==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "@es-joy/estraverse": "^7.1.1",
+        "@es-joy/jsdoccomment": "^0.62.0",
+        "esprima": "^4.0.1",
+        "esutils": "^2.0.3",
+        "optionator": "^0.9.4"
+      },
+      "bin": {
+        "escodegen": "bin/escodegen.js",
+        "esgenerate": "bin/esgenerate.js"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "optionalDependencies": {
+        "source-map": "~0.7.6"
+      }
+    },
+    "node_modules/@es-joy/escodegen/node_modules/@es-joy/jsdoccomment": {
+      "version": "0.62.0",
+      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.62.0.tgz",
+      "integrity": "sha512-yWi6sm7INEwnfS7IJvE0dU+RTrwzLPFcY7e7eGpu/l5Q9lWfQ2ROwZ0qVnc242jw2TUPsfHX3XMIISkGBv57RQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.8",
+        "@typescript-eslint/types": "^8.44.1",
+        "comment-parser": "1.4.1",
+        "esquery": "^1.6.0",
+        "jsdoc-type-pratt-parser": "~5.9.0"
+      },
+      "engines": {
+        "node": ">=20.11.0"
+      }
+    },
+    "node_modules/@es-joy/escodegen/node_modules/comment-parser": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/comment-parser/-/comment-parser-1.4.1.tgz",
+      "integrity": "sha512-buhp5kePrmda3vhc5B9t7pUQXAb2Tnd0qgpkIhPhkHXxJpiPJ11H0ZEU0oBpJ2QztSbzG/ZxMj/CHsYJqRHmyg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12.0.0"
+      }
+    },
+    "node_modules/@es-joy/escodegen/node_modules/jsdoc-type-pratt-parser": {
+      "version": "5.9.2",
+      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-5.9.2.tgz",
+      "integrity": "sha512-TYzkACp/wPvDJLRY7qpHXtrhgwoAaojIOnLaaVNi+AbPU2u1kkjfKd9hXXTq0qSAGsyYXvwUXt99h9I5iCmjjw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/@es-joy/estraverse": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/@es-joy/estraverse/-/estraverse-7.1.1.tgz",
+      "integrity": "sha512-h2d737iS0LFAqypZOmXizu54qAbHofI/RpD30Zom03O6BCXKHuFevWKPcGarZbGq82h7qSBb5G6kLdhTMO+caw==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
    "node_modules/@es-joy/jsdoccomment": {
-      "version": "0.98.0",
-      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.98.0.tgz",
-      "integrity": "sha512-QS+b7I2aaSM+gZfDz1b9E4B367JJ2qTjFXRKF289iKkh9sYdZ21Q5MiF/Duzouy3J0C4VhM3I/8f2F4+zT8gYQ==",
+      "version": "0.100.0",
+      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.100.0.tgz",
+      "integrity": "sha512-QuIT5kMg3XWN22Wa1rcXmR/GkfSg6Ygs/ikMiHihdSpu+o3O59LygkFV9srKa5xHplBFwNd5ZCo3bywL4k7qMQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@types/estree": "^1.0.9",
-        "@typescript-eslint/types": "^8.70.0",
+        "@typescript-eslint/types": "^8.72.0",
        "comment-parser": "1.4.9",
        "esquery": "^1.7.0",
-        "jsdoc-type-pratt-parser": "~9.2.2"
+        "jsdoc-type-pratt-parser": "~9.3.0"
      },
      "engines": {
        "node": "^22.22.2 || >=24.15.0"
@@ -2681,20 +2744,15 @@
      "license": "MIT"
    },
    "node_modules/@types/sinon": {
-      "version": "22.0.0",
-      "resolved": "https://registry.npmjs.org/@types/sinon/-/sinon-22.0.0.tgz",
-      "integrity": "sha512-TDbVpbccc2HfiqHR09Argj3mHV1KMW7sCCKj52fsl8lbRLkEn7fB1966EWhOKWUBcqfBueZuPoA7/OK1CKiy3g==",
+      "version": "22.0.1",
+      "resolved": "https://registry.npmjs.org/@types/sinon/-/sinon-22.0.1.tgz",
+      "integrity": "sha512-MThluJXPmpBY+Z5S3565F2z+hjkCXnBrr36j2mitVQ7JUtxA+A+YQhs+0Q6J8jxb0SVJvydO+6NWfj9EBzpiBQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@types/sinonjs__fake-timers": "*"
+        "@sinonjs/fake-timers": "^15.4.0"
      }
    },
-    "node_modules/@types/sinonjs__fake-timers": {
-      "version": "8.1.2",
-      "dev": true,
-      "license": "MIT"
-    },
    "node_modules/@types/unist": {
      "version": "3.0.3",
      "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
@@ -2702,17 +2760,17 @@
      "license": "MIT"
    },
    "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.71.2.tgz",
-      "integrity": "sha512-K72/pvT7qpm8q3k8G5u93NCSN1RcLxX5h7Gw0bQpbMXviBHeY6Nx1WEwmk9wP+eKTSQ8ecxvcgt/ZX/rB938xQ==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.72.0.tgz",
+      "integrity": "sha512-aysKgysPX9XOv/dk95UkvUDe++Q3n3dJPG9CEWT3RUccxfkPJ+Qn6nhKPDhZXU6Ofo9kgwGWwKyQCnZIXTgngg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.71.2",
-        "@typescript-eslint/type-utils": "8.71.2",
-        "@typescript-eslint/utils": "8.71.2",
-        "@typescript-eslint/visitor-keys": "8.71.2",
+        "@typescript-eslint/scope-manager": "8.72.0",
+        "@typescript-eslint/type-utils": "8.72.0",
+        "@typescript-eslint/utils": "8.72.0",
+        "@typescript-eslint/visitor-keys": "8.72.0",
        "ignore": "^7.0.5",
        "natural-compare": "^1.4.0",
        "ts-api-utils": "^2.5.0"
@@ -2725,7 +2783,7 @@
        "url": "https://opencollective.com/typescript-eslint"
      },
      "peerDependencies": {
-        "@typescript-eslint/parser": "^8.71.2",
+        "@typescript-eslint/parser": "^8.72.0",
        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
        "typescript": ">=4.8.4 <6.1.0"
      }
@@ -2741,16 +2799,16 @@
      }
    },
    "node_modules/@typescript-eslint/parser": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.71.2.tgz",
-      "integrity": "sha512-aTtmZjp/x3gsGHkDs04/1I8kNogBJkpQaeGaN0PfiG43NzDEmW2n+OP5im9wfsvyX0yP1UZWBrAGtDBfH9jEVw==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.72.0.tgz",
+      "integrity": "sha512-0O+x3ynciD6zuXb1CKSu165haQV6ey53DKhHHUnujP7U+XlltJG+/keT0Xhd1HXCze+IHf7Tvt39ovyepX/LNw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/scope-manager": "8.71.2",
-        "@typescript-eslint/types": "8.71.2",
-        "@typescript-eslint/typescript-estree": "8.71.2",
-        "@typescript-eslint/visitor-keys": "8.71.2",
+        "@typescript-eslint/scope-manager": "8.72.0",
+        "@typescript-eslint/types": "8.72.0",
+        "@typescript-eslint/typescript-estree": "8.72.0",
+        "@typescript-eslint/visitor-keys": "8.72.0",
        "debug": "^4.4.3"
      },
      "engines": {
@@ -2784,14 +2842,14 @@
      }
    },
    "node_modules/@typescript-eslint/project-service": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.71.2.tgz",
-      "integrity": "sha512-Pd68GsLVh5ZXlcEccFPdhSOvtHZ/2WU0XsA8zmXOS3F158lVlcTLhfQ6qvtL1RzbMie0Kp8xtbVwAg4nejKPHw==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.72.0.tgz",
+      "integrity": "sha512-bzHngBbmIgzj6TsTjVUCntGx6FFLgE7mPjpO0PzHycOaZHXqS43XnrkFIHRS16LLr/xO6FHSXG3GJFo/F4bSBQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.71.2",
-        "@typescript-eslint/types": "^8.71.2",
+        "@typescript-eslint/tsconfig-utils": "^8.72.0",
+        "@typescript-eslint/types": "^8.72.0",
        "debug": "^4.4.3"
      },
      "engines": {
@@ -2824,14 +2882,14 @@
      }
    },
    "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.71.2.tgz",
-      "integrity": "sha512-YF4wgg5iUX5Obywoac27B56FhozMNFhdJSbh11H5GBAwmBtfyRhmgTQqW9tRNNmHDvsZ2CX6UGzoz+YfYn2Leg==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.72.0.tgz",
+      "integrity": "sha512-JewPyJOYcXBSAS7PIgufscHOwZqhTGyBRiQJhhuDln66tMchxvvt7nJ90JKKIoOelmdHA3kAQbm9cEUHc4JSEA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.2",
-        "@typescript-eslint/visitor-keys": "8.71.2"
+        "@typescript-eslint/types": "8.72.0",
+        "@typescript-eslint/visitor-keys": "8.72.0"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2842,9 +2900,9 @@
      }
    },
    "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.71.2.tgz",
-      "integrity": "sha512-jz49TAWokm/7yWD9/o837nYax9DyALxIPOImdImvVzo6canBCZYzin8zJyqNR5k1j9K1DE0bVvr0XYB+99uAdg==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.72.0.tgz",
+      "integrity": "sha512-0vbxCf7xLVPSjcOdm6eQbgViH8EDJ8xnl1laLT9yoqSz2YmcSfSg5Vdl0JUvZf6rcuJ0ZivJIuMD4edTg8obaA==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2859,15 +2917,15 @@
      }
    },
    "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.71.2.tgz",
-      "integrity": "sha512-cC8UaalCViJkb3rH/xLIvidEwoFRtMZMUqDjjJMGEKaTFwYRHYBcoczlEGHuvkHEO8svRDrgZ0yQgOArFmwang==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.72.0.tgz",
+      "integrity": "sha512-gEXxmmbSTSOVTC37IYYvremOM31v+UN2W772bJxmVYPhAOPSUxtacyb7wkm1EhkYKU6KzFJsdU44DCV4to0LWw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.2",
-        "@typescript-eslint/typescript-estree": "8.71.2",
-        "@typescript-eslint/utils": "8.71.2",
+        "@typescript-eslint/types": "8.72.0",
+        "@typescript-eslint/typescript-estree": "8.72.0",
+        "@typescript-eslint/utils": "8.72.0",
        "debug": "^4.4.3",
        "ts-api-utils": "^2.5.0"
      },
@@ -2902,9 +2960,9 @@
      }
    },
    "node_modules/@typescript-eslint/types": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.71.2.tgz",
-      "integrity": "sha512-y5Ukl3oVp7e/VGxqIoEXoeb/Roj71PAJ4WG/N/RGj+eeDvKRLM15kGr9MijLbN0i03S52zxu31Z98E5gWChJKw==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.72.0.tgz",
+      "integrity": "sha512-Adfoy59kxNEjT5E5fnyrp7GpHYuWs8ONbdohu4ez6IU46qDq8LltG90tLmkucZB2uhYL8mqBjtXqGd8yhfjXqQ==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2916,16 +2974,16 @@
      }
    },
    "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.71.2.tgz",
-      "integrity": "sha512-DgNOEsl4pdYzwSL+N/Cl33tX1Hlw3FvId73LnKXfq7jnrF2viOEn7X+P7RBkkSWCVm92gnWd28GIC5vJuLREeA==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.72.0.tgz",
+      "integrity": "sha512-gwLfFgWcw15tN2KXDCJvxEOQjPn+P3j/n3eSqkZ5sX4VpW9Cosodr+tWwBZRvJT3TcKx6HnPRGZMCNAiP1Xhug==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/project-service": "8.71.2",
-        "@typescript-eslint/tsconfig-utils": "8.71.2",
-        "@typescript-eslint/types": "8.71.2",
-        "@typescript-eslint/visitor-keys": "8.71.2",
+        "@typescript-eslint/project-service": "8.72.0",
+        "@typescript-eslint/tsconfig-utils": "8.72.0",
+        "@typescript-eslint/types": "8.72.0",
+        "@typescript-eslint/visitor-keys": "8.72.0",
        "debug": "^4.4.3",
        "minimatch": "^10.2.2",
        "semver": "^7.7.3",
@@ -3001,16 +3059,16 @@
      }
    },
    "node_modules/@typescript-eslint/utils": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.71.2.tgz",
-      "integrity": "sha512-RyKa1G1M9rKHDhrk+HJtiF1MvLD5Ux2JW3TSkzw+02pRALdpJb+QzG1Y5em+LvCgzGwgg8H7mBRFKljNz7ImPw==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.72.0.tgz",
+      "integrity": "sha512-0up3oArJZBYnzOaEXKo8DmI43QvMZyPoFEt9LWzRJcyl/RcJjfKKPebknN1VbTgXBf3M/KggUh5uUMdURLnseg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.71.2",
-        "@typescript-eslint/types": "8.71.2",
-        "@typescript-eslint/typescript-estree": "8.71.2"
+        "@typescript-eslint/scope-manager": "8.72.0",
+        "@typescript-eslint/types": "8.72.0",
+        "@typescript-eslint/typescript-estree": "8.72.0"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3025,13 +3083,13 @@
      }
    },
    "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.71.2.tgz",
-      "integrity": "sha512-zozlN0UA32bSG2zkKAgQyRYSbEISVoyU6vvkKYo2aSny74D8Jh4e+POkJ6Lk0dlezZi5x7TtD+88Xb06IB8nhg==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.72.0.tgz",
+      "integrity": "sha512-E2mroviasaWecDzTGiGMtuEguuLVOeRggnrIn93CJuxYJzQBHbyymlT08aVQydbBal5538o+JkBKXh2sRuCyIA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/types": "8.72.0",
        "eslint-visitor-keys": "^5.0.0"
      },
      "engines": {
@@ -3576,6 +3634,7 @@
    },
    "node_modules/argparse": {
      "version": "2.0.1",
+      "dev": true,
      "license": "Python-2.0"
    },
    "node_modules/aria-query": {
@@ -5365,15 +5424,16 @@
      }
    },
    "node_modules/eslint-plugin-jsdoc": {
-      "version": "65.3.4",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.3.4.tgz",
-      "integrity": "sha512-Z3/ro8sZPqnXKhyAzCNa3F7KCZ3js5xVx/q9BEvTjUGzN6OIQfdb+q3Sc9lJ3zCfyPnN0tI524ulZjYRxAwnAw==",
+      "version": "65.4.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.4.0.tgz",
+      "integrity": "sha512-bRiU6LfCFmLL7GuePKvA6ZIcXLonhZGCg2TgQLmkcExeVdAirQp2Hsf3xeSUTmlKwAAsREVEOLbZYD8F7oA69g==",
      "dev": true,
      "license": "BSD-3-Clause",
      "dependencies": {
-        "@es-joy/jsdoccomment": "~0.98.0",
+        "@es-joy/escodegen": "^4.2.0",
+        "@es-joy/jsdoccomment": "~0.100.0",
        "@es-joy/resolve.exports": "1.2.0",
-        "@typescript-eslint/utils": "^8.70.1",
+        "@typescript-eslint/utils": "^8.72.0",
        "are-docs-informative": "^0.1.1",
        "comment-parser": "1.4.9",
        "debug": "^4.4.3",
@@ -7121,9 +7181,9 @@
      }
    },
    "node_modules/js-yaml": {
-      "version": "5.4.3",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.3.tgz",
-      "integrity": "sha512-yzzNtgczwgoVHNigCyKTXcQJU4Y8t/ikU4UxXW0BvrLfHTGWZhsNcOT2s/a7vn81/4KqVnNmHjaUEPlvWnNwVw==",
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.5.0.tgz",
+      "integrity": "sha512-paNr4LFIFPjeeSmwNYdrb8FafLLG/Cr2Af3GjbsHJ5CxIjH4r0c2emlmRdAtpPAieP1gRVzk6buBbVP5gBMGAg==",
      "funding": [
        {
          "type": "github",
@@ -7136,12 +7196,28 @@
      ],
      "license": "MIT",
      "dependencies": {
-        "argparse": "^2.0.1"
+        "argparse": "^3.0.3"
      },
      "bin": {
        "js-yaml": "bin/js-yaml.mjs"
      }
    },
+    "node_modules/js-yaml/node_modules/argparse": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-3.0.3.tgz",
+      "integrity": "sha512-Sn98ftV3KfsO8xfLPHG6oT8y+b0yvbrLgZjgPDXsharNY15tTAjqIsIju4S32nl6/iEUNNE4v+yL2Zhm8ooP3w==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
+      "license": "PSF-2.0"
+    },
    "node_modules/jschardet": {
      "version": "3.1.4",
      "resolved": "https://registry.npmjs.org/jschardet/-/jschardet-3.1.4.tgz",
@@ -7153,36 +7229,18 @@
      }
    },
    "node_modules/jsdoc-type-pratt-parser": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.2.2.tgz",
-      "integrity": "sha512-eFY7Rlscvv/BpY6UsVsjKwMhu1tJO/F4U/vC9g3yeRy/JqszuO1UP6Vdq+85G+3FP6fEw/sWR8a5ftPFY86csw==",
+      "version": "9.3.0",
+      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.3.0.tgz",
+      "integrity": "sha512-JZ8lKMCZXDlM1jAjAK5tTmtFJtgv6iFQQfjE3Fza6jBRACUueaEXLY17n1u05JO1lcPkNxgP+ddEDtiPsk5ktg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@types/estree": "^1.0.9",
-        "@types/node": "^26.4.0"
+        "@types/estree": "^1.0.9"
      },
      "engines": {
        "node": "^22.22.2 || >=24.15.0"
      }
    },
-    "node_modules/jsdoc-type-pratt-parser/node_modules/@types/node": {
-      "version": "26.6.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz",
-      "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~8.9.0"
-      }
-    },
-    "node_modules/jsdoc-type-pratt-parser/node_modules/undici-types": {
-      "version": "8.9.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
-      "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
-      "dev": true,
-      "license": "MIT"
-    },
    "node_modules/json-buffer": {
      "version": "3.0.1",
      "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
@@ -8140,9 +8198,9 @@
      }
    },
    "node_modules/node-forge": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.0.tgz",
-      "integrity": "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==",
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.1.tgz",
+      "integrity": "sha512-w5/MfWaeMrpR/5ba6fZyAUTLSuE6aYz7H/3cYrqwZEmf5eQS3IaaLgJt4MBv7HglGFWmV22K8h4U18RJQmw/ow==",
      "license": "(BSD-3-Clause OR GPL-2.0)",
      "engines": {
        "node": ">= 6.13.0"
@@ -8343,16 +8401,18 @@
      }
    },
    "node_modules/optionator": {
-      "version": "0.9.3",
+      "version": "0.9.4",
+      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
+      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@aashutoshrathi/word-wrap": "^1.2.3",
        "deep-is": "^0.1.3",
        "fast-levenshtein": "^2.0.6",
        "levn": "^0.4.1",
        "prelude-ls": "^1.2.1",
-        "type-check": "^0.4.0"
+        "type-check": "^0.4.0",
+        "word-wrap": "^1.2.5"
      },
      "engines": {
        "node": ">= 0.8.0"
@@ -9276,6 +9336,17 @@
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
+    "node_modules/source-map": {
+      "version": "0.7.6",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.6.tgz",
+      "integrity": "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "optional": true,
+      "engines": {
+        "node": ">= 12"
+      }
+    },
    "node_modules/spdx-exceptions": {
      "version": "2.5.0",
      "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.5.0.tgz",
@@ -9981,16 +10052,16 @@
      }
    },
    "node_modules/typescript-eslint": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.71.2.tgz",
-      "integrity": "sha512-Rz4effbMy2g9wnvOJZG6SbVavX313Lap1vNEbk1RUochzickvzP8P4HB+bkNg5e50eVz1hQGjh9K1omI1xB4Bw==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.72.0.tgz",
+      "integrity": "sha512-r26Fkc8As+mZvqp7SLsMmNFyYUup/6CjK7/eHBHmhOw6GH6n6YFxHVFrG0jN1c5CMpDzelLPxvgeCOzx7BjN+A==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.71.2",
-        "@typescript-eslint/parser": "8.71.2",
-        "@typescript-eslint/typescript-estree": "8.71.2",
-        "@typescript-eslint/utils": "8.71.2"
+        "@typescript-eslint/eslint-plugin": "8.72.0",
+        "@typescript-eslint/parser": "8.72.0",
+        "@typescript-eslint/typescript-estree": "8.72.0",
+        "@typescript-eslint/utils": "8.72.0"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -10024,12 +10095,12 @@
      }
    },
    "node_modules/undici": {
-      "version": "6.28.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
-      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
+      "version": "7.30.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.1.tgz",
+      "integrity": "sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==",
      "license": "MIT",
      "engines": {
-        "node": ">=18.17"
+        "node": ">=20.18.1"
      }
    },
    "node_modules/undici-types": {
@@ -10309,6 +10380,16 @@
        "url": "https://github.com/sponsors/ljharb"
      }
    },
+    "node_modules/word-wrap": {
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
+      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
    "node_modules/wrap-ansi": {
      "version": "7.0.0",
      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
@@ -10488,6 +10569,7 @@
        "@octokit/core": "^7.0.8",
        "@octokit/plugin-paginate-rest": ">=16.0.0",
        "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
+        "glob": "^13.0.6",
        "lite-matter": "^0.1.2",
        "mdast-util-from-markdown": "^2.1.0",
        "semver": "^7.8.5",
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "codeql",
-  "version": "4.39.2",
+  "version": "4.39.3",
  "private": true,
  "description": "CodeQL action",
  "scripts": {
@@ -13,7 +13,8 @@
    "test": "npm run ava -- src/",
    "test-debug": "npm run test -- --timeout=20m",
    "transpile": "tsc --build --verbose tsconfig.json",
-    "update-pr-checks": "./pr-checks/sync.sh"
+    "update-pr-checks": "./pr-checks/sync.sh",
+    "typecheck": "tsc --noEmit"
  },
  "license": "MIT",
  "workspaces": [
@@ -38,12 +39,12 @@
    "follow-redirects": "^1.16.1",
    "get-folder-size": "^5.0.0",
    "https-proxy-agent": "^7.0.6",
-    "js-yaml": "^5.4.3",
+    "js-yaml": "^5.5.0",
    "jsonschema": "1.5.0",
    "long": "^5.3.2",
-    "node-forge": "^1.4.0",
+    "node-forge": "^1.4.1",
    "semver": "^7.8.5",
-    "undici": "^6.28.0",
+    "undici": "^7.30.1",
    "uuid": "^14.0.3"
  },
  "devDependencies": {
@@ -58,21 +59,21 @@
    "@types/node-forge": "^1.3.14",
    "@types/sarif": "^2.1.7",
    "@types/semver": "^7.8.0",
-    "@types/sinon": "^22.0.0",
+    "@types/sinon": "^22.0.1",
    "ava": "^6.4.1",
    "esbuild": "^0.28.2",
    "eslint": "^9.39.5",
    "eslint-import-resolver-typescript": "^4.4.5",
    "eslint-plugin-github": "^6.1.2",
    "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jsdoc": "^65.3.4",
+    "eslint-plugin-jsdoc": "^65.4.0",
    "eslint-plugin-no-async-foreach": "^0.1.1",
    "glob": "^13.0.6",
    "globals": "^17.13.0",
    "nock": "^14.0.17",
    "sinon": "^22.1.0",
    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.71.2"
+    "typescript-eslint": "^8.72.0"
  },
  "overrides": {
    "@actions/tool-cache": {
@@ -94,6 +95,6 @@
      "semver": ">=6.3.1"
    },
    "glob": "^13.0.6",
-    "undici": "^6.28.0"
+    "undici": "^7.30.1"
  }
 }
--- a/pr-checks/bundle-changelog.test.ts
+++ b/pr-checks/bundle-changelog.test.ts
@@ -10,17 +10,13 @@ import { afterEach, beforeEach, describe, it } from "node:test";

 import {
  CLI_VERSION_ENV_VAR,
+  getChangenote,
  getCLIVersion,
  getPRNumber,
  getPRUrl,
  PR_URL_ENV_VAR,
-  updateChangelog,
 } from "./bundle-changelog";
-import {
-  EMPTY_CHANGELOG,
-  NO_CHANGES_STR,
-  UNRELEASED_PLACEHOLDER,
-} from "./changelog";
+import { isValidChangenoteContent } from "./changelog/validate";

 let testDir: string;

@@ -85,58 +81,15 @@ describe("getPRNumber", async () => {
  });
 });

-const testChangelog = `${EMPTY_CHANGELOG.trimEnd()}
-
-## 4.23.7
-
- Other change
-
-## 4.23.6
-
-${NO_CHANGES_STR}`;
-
-const expectedChangelog = `# CodeQL Action Changelog
-
-## ${UNRELEASED_PLACEHOLDER}
-
- Update default CodeQL bundle version to
-
-## 4.23.7
-
- Other change
-
-## 4.23.6
-
-${NO_CHANGES_STR}`;
-
-describe("updateChangelog", async () => {
-  await it("removes `NO_CHANGES_STR` if present in [UNRELEASED] section", async () => {
-    const result = updateChangelog(EMPTY_CHANGELOG, "");
-    assert.ok(!result.includes(NO_CHANGES_STR));
-  });
-
-  await it("doesn't remove `NO_CHANGES_STR` if present in versioned section", async () => {
-    const result = updateChangelog(
-      EMPTY_CHANGELOG.replace(UNRELEASED_PLACEHOLDER, "1.2.3"),
-      "",
+describe("getChangenote", async () => {
+  await it("returns a note linking to the bundle release and the PR", async () => {
+    assert.equal(
+      getChangenote("1.2.3", testPrUrl),
+      "- Update default CodeQL bundle version to [1.2.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v1.2.3). [#42](https://github.com/github/codeql-action/pulls/42)\n",
    );
-    assert.ok(result.includes(NO_CHANGES_STR));
  });

-  await it("throws if there are no sections", async () => {
-    assert.throws(() => {
-      updateChangelog(
-        "# CodeQL Action Changelog",
-        "- Update default CodeQL bundle version to",
-      );
-    });
-  });
-
-  await it("adds note at the end of the first section", async () => {
-    const result = updateChangelog(
-      testChangelog,
-      "- Update default CodeQL bundle version to",
-    );
-    assert.deepEqual(result, expectedChangelog);
+  await it("returns valid changenote content", async () => {
+    assert.ok(isValidChangenoteContent(getChangenote("1.2.3", testPrUrl)));
  });
 });
--- a/pr-checks/bundle-changelog.ts
+++ b/pr-checks/bundle-changelog.ts
@@ -1,17 +1,13 @@
 #!/usr/bin/env npx tsx

 /**
- * Updates the changelog with a change note for an updated CodeQL CLI bundle.
+ * Creates a changenote file for an update to the default CodeQL CLI bundle.
 */

 import * as fs from "node:fs";
+import * as path from "node:path";

-import {
-  parseChangelog,
-  renderChangelog,
-  UNRELEASED_PLACEHOLDER,
-} from "./changelog";
-import { CHANGELOG_FILE, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config";
+import { CHANGENOTES_DIR, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config";
 import { getErrorMessage } from "./util";

 export const CLI_VERSION_ENV_VAR = "CLI_VERSION";
@@ -58,42 +54,19 @@ export function getPRNumber(prUrl: string) {
 }

 /**
- * Updates `changelog` by adding `changelogNote` to the first section.
+ * Returns the contents of the changenote file for an update to the default
+ * CodeQL CLI bundle.
 *
- * @param contents The existing changelog contents.
- * @param changelogNote The note to add to the first section.
+ * @param cliVersion The CodeQL CLI version of the new default bundle.
+ * @param prUrl The URL of the PR that updates the default bundle.
+ * @throws If the PR number can't be determined from `prUrl`.
 */
-export function updateChangelog(contents: string, changelogNote: string) {
-  // If the "[UNRELEASED]" section starts with "no user facing changes", remove that line.
-  contents = contents.replace(
-    `## ${UNRELEASED_PLACEHOLDER}\n\nNo user facing changes.`,
-    `## ${UNRELEASED_PLACEHOLDER}\n`,
-  );
+export function getChangenote(cliVersion: string, prUrl: string): string {
+  // The GitHub Release for the new bundle version.
+  const bundleReleaseUrl = `${CLI_BUNDLE_RELEASE_URL_PREFIX}${cliVersion}`;

-  const changelog = parseChangelog(contents);
-
-  if (changelog.sections.length === 0) {
-    throw new Error("The changelog contains no existing sections.");
-  }
-
-  // Add the changelog note to the bottom of the first section.
-  const firstSection = changelog.sections[0];
-  const lastLine = firstSection.bodyLines.pop();
-
-  if (lastLine !== undefined && lastLine.trim() !== "") {
-    // We expect the last line to be empty. If it isn't for some reason,
-    // add it back.
-    firstSection.bodyLines.push(lastLine);
-  }
-
-  firstSection.bodyLines.push(changelogNote);
-
-  // If the last line is empty as expected, then add it back in after the new note.
-  if (lastLine?.trim() === "") {
-    firstSection.bodyLines.push(lastLine);
-  }
-
-  return renderChangelog(changelog);
+  const prNumber = getPRNumber(prUrl);
+  return `- Update default CodeQL bundle version to [${cliVersion}](${bundleReleaseUrl}). [#${prNumber}](${prUrl})\n`;
 }

 function main() {
@@ -101,22 +74,19 @@ function main() {
    const cliVersion = getCLIVersion();
    const prUrl = getPRUrl();

-    // The GitHub Release for the new bundle version.
-    const bundleReleaseUrl = `${CLI_BUNDLE_RELEASE_URL_PREFIX}${cliVersion}`;
-
-    // Get the PR number from the PR URL.
-    const prNumber = getPRNumber(prUrl);
-    const changelogNote = `- Update default CodeQL bundle version to [${cliVersion}](${bundleReleaseUrl}). [#${prNumber}](${prUrl})`;
-
-    let changelog = fs.readFileSync(CHANGELOG_FILE, "utf-8");
-
-    changelog = updateChangelog(changelog, changelogNote);
-
-    fs.writeFileSync(CHANGELOG_FILE, changelog);
+    // Include the CLI version in the file name so that changenotes for
+    // different bundle updates don't conflict.
+    const changenotePath = path.join(
+      CHANGENOTES_DIR,
+      `update-bundle-${cliVersion}.md`,
+    );
+    fs.writeFileSync(changenotePath, getChangenote(cliVersion, prUrl));

    return 0;
  } catch (err) {
-    console.error(`Failed to bundle changelog: ${getErrorMessage(err)}`);
+    console.error(
+      `Failed to create changenote for bundle update: ${getErrorMessage(err)}`,
+    );
    return -1;
  }
 }
--- a/pr-checks/check-diagnostics.ts
+++ b/pr-checks/check-diagnostics.ts
@@ -1,6 +1,8 @@
 import fs from "fs";
+import path from "path";

 import * as core from "@actions/core";
+import { globSync } from "glob";

 import * as sarif from "../src/sarif";

@@ -34,59 +36,83 @@ function checkStatusPageNotification(n: sarif.Notification) {
  }
 }

+function checkSarif(sarifFile: string) {
+  core.info(`Checking SARIF file at '${sarifFile}'`);
+
+  const log = JSON.parse(fs.readFileSync(sarifFile, "utf8")) as sarif.Log;
+  const run = log.runs[0];
+
+  if (run.invocations === undefined) {
+    throw new Error("run.invocations is undefined");
+  }
+
+  const toolExecutionNotifications =
+    run.invocations[0].toolExecutionNotifications;
+
+  if (toolExecutionNotifications === undefined) {
+    throw new Error("toolExecutionNotifications is undefined");
+  }
+
+  const statusPageNotifications = toolExecutionNotifications.filter(
+    (n) =>
+      n.descriptor?.id === DIAGNOSTIC_ID &&
+      n.properties?.visibility?.statusPage,
+  );
+  if (statusPageNotifications.length !== 1) {
+    core.setFailed(
+      "Expected exactly one status page reporting descriptor for this diagnostic in the " +
+        `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
+        `${statusPageNotifications.length}. All notification reporting descriptors: ` +
+        `${JSON.stringify(toolExecutionNotifications)}.`,
+    );
+  }
+  checkStatusPageNotification(statusPageNotifications[0]);
+
+  const notifications = run.tool.driver.notifications;
+
+  if (notifications === undefined) {
+    throw new Error("notifications is undefined");
+  }
+
+  const diagnosticNotification = notifications.filter(
+    (n) =>
+      n.id === DIAGNOSTIC_ID &&
+      n.name === DIAGNOSTIC_ID &&
+      n.fullDescription?.text === DIAGNOSTIC_NAME,
+  );
+  if (diagnosticNotification.length !== 1) {
+    core.setFailed(
+      "Expected exactly one notification for this diagnostic in the " +
+        `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
+        `${diagnosticNotification.length}. All notifications: ` +
+        `${JSON.stringify(notifications)}.`,
+    );
+  }
+}
+
 const sarifPath = process.env["SARIF_PATH"];

 if (sarifPath === undefined) {
-  throw new Error("The path to a SARIF file must be set in 'SARIF_PATH'.");
-}
-
-const log = JSON.parse(fs.readFileSync(sarifPath, "utf8")) as sarif.Log;
-const run = log.runs[0];
-
-if (run.invocations === undefined) {
-  throw new Error("run.invocations is undefined");
-}
-
-const toolExecutionNotifications =
-  run.invocations[0].toolExecutionNotifications;
-
-if (toolExecutionNotifications === undefined) {
-  throw new Error("toolExecutionNotifications is undefined");
-}
-
-const statusPageNotifications = toolExecutionNotifications.filter(
-  (n) =>
-    n.descriptor?.id === DIAGNOSTIC_ID && n.properties?.visibility?.statusPage,
-);
-if (statusPageNotifications.length !== 1) {
-  core.setFailed(
-    "Expected exactly one status page reporting descriptor for this diagnostic in the " +
-      `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
-      `${statusPageNotifications.length}. All notification reporting descriptors: ` +
-      `${JSON.stringify(toolExecutionNotifications)}.`,
+  throw new Error(
+    "The path to a SARIF file or directory must be set in 'SARIF_PATH'.",
  );
 }
-checkStatusPageNotification(statusPageNotifications[0]);

-const notifications = run.tool.driver.notifications;
+if (fs.statSync(sarifPath).isDirectory()) {
+  const sarifFiles = globSync("**/*.sarif", {
+    cwd: path.resolve(sarifPath),
+    absolute: true,
+  });

-if (notifications === undefined) {
-  throw new Error("notifications is undefined");
-}
+  if (sarifFiles.length < 1) {
+    throw new Error(`Unable to find any .sarif files in '${sarifPath}'.`);
+  }

-const diagnosticNotification = notifications.filter(
-  (n) =>
-    n.id === DIAGNOSTIC_ID &&
-    n.name === DIAGNOSTIC_ID &&
-    n.fullDescription?.text === DIAGNOSTIC_NAME,
-);
-if (diagnosticNotification.length !== 1) {
-  core.setFailed(
-    "Expected exactly one notification for this diagnostic in the " +
-      `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
-      `${diagnosticNotification.length}. All notifications: ` +
-      `${JSON.stringify(notifications)}.`,
-  );
+  for (const sarifFile of sarifFiles) {
+    checkSarif(sarifFile);
+  }
+} else {
+  checkSarif(sarifPath);
 }

 core.info("Finished diagnostic export test");
--- a/pr-checks/checks/all-platform-bundle.yml
+++ b/pr-checks/checks/all-platform-bundle.yml
@@ -3,7 +3,7 @@ description: "Tests using an all-platform CodeQL Bundle"
 operatingSystems:
  - ubuntu
  - os: macos
-    runner-image: macos-latest-xlarge
+    runner-image: macos-26-xlarge
  - windows
 versions:
  - nightly-latest
--- a/pr-checks/checks/diagnostics-without-db.yml
+++ b/pr-checks/checks/diagnostics-without-db.yml
@@ -53,7 +53,7 @@ validationJobs:
    installNode: true
    steps:
      - name: Download workflow artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: test-mode-sarif-*
          path: sarif
--- a/pr-checks/checks/multi-language-autodetect.yml
+++ b/pr-checks/checks/multi-language-autodetect.yml
@@ -3,7 +3,7 @@ description: "An end-to-end integration test of a multi-language repository usin
 operatingSystems:
  - ubuntu
  - os: macos
-    runner-image: macos-latest-xlarge
+    runner-image: macos-26-xlarge
  # Older CodeQL CLI versions only support Swift up to 6.1, which requires Xcode 16. That is
  # not available on macOS 26, so run these versions on macOS 15 where we select Xcode 16
  # below. See https://github.com/actions/runner-images/issues/14167.
@@ -23,7 +23,7 @@ steps:
    # imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
    # See https://github.com/github/codeql-action/pull/3212
    if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
-    uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+    uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
    with:
      python-version: "3.13.15"

--- a/pr-checks/checks/per-language-bundle-validation.yml
+++ b/pr-checks/checks/per-language-bundle-validation.yml
@@ -3,41 +3,41 @@ description: Validates extraction and analysis using each per-language CodeQL bu
 matrix:
  include:
    - language: actions
-      os: ubuntu-latest
+      os: ubuntu-26.04
      version: linked
      # Actions also needs the JavaScript extractor.
      expected-extractors: actions javascript
    - language: cpp
-      os: ubuntu-latest
+      os: ubuntu-26.04
      version: linked
      build-mode: manual
      build-command: gcc -o main main.c
    - language: csharp
-      os: ubuntu-latest
+      os: ubuntu-26.04
      version: linked
      build-mode: none
    - language: go
-      os: ubuntu-latest
+      os: ubuntu-26.04
      version: linked
      build-mode: autobuild
    - language: java
-      os: ubuntu-latest
+      os: ubuntu-26.04
      version: linked
      build-mode: none
    - language: javascript
-      os: ubuntu-latest
+      os: ubuntu-26.04
      version: linked
    - language: python
-      os: ubuntu-latest
+      os: ubuntu-26.04
      version: linked
    - language: ruby
-      os: ubuntu-latest
+      os: ubuntu-26.04
      version: linked
    - language: rust
-      os: ubuntu-latest
+      os: ubuntu-26.04
      version: linked
    - language: swift
-      os: macos-latest-xlarge
+      os: macos-26-xlarge
      version: linked
      build-mode: autobuild
 installNode: true
--- a/pr-checks/checks/rubocop-multi-language.yml
+++ b/pr-checks/checks/rubocop-multi-language.yml
@@ -1,23 +0,0 @@
-name: "RuboCop multi-language"
-description: "Tests using RuboCop to analyze a multi-language repository and then using the CodeQL Action to upload the resulting SARIF"
-# This check doesn't use CodeQL, so the `version` matrix variable is unused.
-versions:
-  - default
-steps:
-  - name: Set up Ruby
-    uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
-    with:
-      ruby-version: 2.6
-  - name: Install Code Scanning integration
-    run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
-  - name: Install dependencies
-    run: bundle install
-  - name: RuboCop run
-    run: |
-      bash -c "
-        bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
-        [[ $? -ne 2 ]]
-      "
-  - uses: ./../action/upload-sarif
-    with:
-      sarif_file: rubocop.sarif
--- a/pr-checks/checks/swift-autobuild.yml
+++ b/pr-checks/checks/swift-autobuild.yml
@@ -4,7 +4,7 @@ versions:
  - nightly-latest
 operatingSystems:
  - os: macos
-    runner-image: macos-latest-xlarge
+    runner-image: macos-26-xlarge
 steps:
  - uses: ./../action/init
    id: init
--- a/pr-checks/checks/swift-custom-build.yml
+++ b/pr-checks/checks/swift-custom-build.yml
@@ -6,7 +6,7 @@ versions:
  - nightly-latest
 operatingSystems:
  - os: macos
-    runner-image: macos-latest-xlarge
+    runner-image: macos-26-xlarge
 installGo: true
 installDotNet: true
 env:
--- a/pr-checks/checks/unsupported-macos.yml
+++ b/pr-checks/checks/unsupported-macos.yml
@@ -0,0 +1,67 @@
+name: "Unsupported macOS"
+description: "Tests that unsupported macOS versions are detected and result in appropriate diagnostics."
+versions:
+  - linked
+  - nightly-latest
+installNode: true
+
+operatingSystems:
+  - os: macos
+    runner-image: xcode-27
+
+env:
+  # Allow the failed SARIF file to be generated.
+  CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
+  # But don't actually upload it.
+  CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+  # Mark telemetry for this workflow so it can be treated separately.
+  CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+
+steps:
+  - name: Check xcode_select_link
+    run: |
+      readlink /private/var/db/xcode_select_link
+      file -h /private/var/db/xcode_select_link
+
+  - uses: ./../action/init
+    id: init
+    continue-on-error: true
+    env:
+      CODEQL_ACTION_CHECK_UNSUPPORTED_TRACED_ANALYSIS: true
+      CODEQL_ACTION_ABORT_UNSUPPORTED_TRACED_ANALYSIS: true
+    with:
+      languages: swift
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+  - name: Analyze
+    # We could run `analyze` here from `./../analyze`, but `getAnalyzeActionName` in `workflow.ts`
+    # can't cope with that unless we introduce a different testing environment. Since this step
+    # would just fail on `xcode-27` anyway, we just skip it instead.
+    if: false
+    uses: ./analyze
+    with:
+      category: "/test-codeql-version:${{ matrix.version }}"
+
+validationJobs:
+  unsupported-macos-sarif-checks:
+    checkout: true
+    installNode: true
+    steps:
+      - name: Download workflow artifact
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: test-mode-sarif-*
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
+
+      - name: Check diagnostics appear in SARIF
+        env:
+          SARIF_PATH: "./sarif/"
+          DIAGNOSTIC_ID: "codeql-action/unsupported-traced-analysis-macos"
+          DIAGNOSTIC_NAME: "Traced analysis is not supported on this version of macOS"
+          EXPECTED_LOCATIONS: "0"
+          EXPECTED_MESSAGE: |
+            Traced analysis is not supported on macOS 27 or above.
+        run: npx tsx ./pr-checks/check-diagnostics.ts
--- a/pr-checks/package.json
+++ b/pr-checks/package.json
@@ -2,6 +2,11 @@
  "private": true,
  "description": "Dependencies for codeql-action scripts",
  "type": "module",
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "npx tsx --test",
+    "checks": "npm run typecheck && npm run test"
+  },
  "dependencies": {
    "@actions/core": "^2.0.3",
    "@actions/github": "^8.0.1",
@@ -9,6 +14,7 @@
    "@octokit/core": "^7.0.8",
    "@octokit/plugin-paginate-rest": ">=16.0.0",
    "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
+    "glob": "^14.0.3",
    "lite-matter": "^0.1.2",
    "mdast-util-from-markdown": "^2.1.0",
    "semver": "^7.8.5",
--- a/pr-checks/sync-back.test.ts
+++ b/pr-checks/sync-back.test.ts
@@ -56,9 +56,18 @@ jobs:

    const result = scanGeneratedWorkflows(workflowDir);

-    assert.equal(result["actions/checkout"], "v4");
-    assert.equal(result["actions/setup-node"], "v5");
-    assert.equal(result["actions/setup-go"], "v6");
+    assert.deepEqual(
+      result.actionVersions["actions/checkout"],
+      new Set(["v4"]),
+    );
+    assert.deepEqual(
+      result.actionVersions["actions/setup-node"],
+      new Set(["v5"]),
+    );
+    assert.deepEqual(
+      result.actionVersions["actions/setup-go"],
+      new Set(["v6"]),
+    );
  });

  await it("scanning workflows with version comments", () => {
@@ -78,12 +87,18 @@ jobs:

    const result = scanGeneratedWorkflows(workflowDir);

-    assert.equal(result["actions/checkout"], "v4");
-    assert.equal(
-      result["ruby/setup-ruby"],
-      "44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0",
+    assert.deepEqual(
+      result.actionVersions["actions/checkout"],
+      new Set(["v4"]),
+    );
+    assert.deepEqual(
+      result.actionVersions["ruby/setup-ruby"],
+      new Set(["44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0"]),
+    );
+    assert.deepEqual(
+      result.actionVersions["actions/setup-python"],
+      new Set(["v6 # Latest Python"]),
    );
-    assert.equal(result["actions/setup-python"], "v6 # Latest Python");
  });

  await it("ignores local actions", () => {
@@ -103,9 +118,15 @@ jobs:

    const result = scanGeneratedWorkflows(workflowDir);

-    assert.equal(result["actions/checkout"], "v4");
-    assert.equal("./.github/actions/local-action" in result, false);
-    assert.equal("./another-local-action" in result, false);
+    assert.deepEqual(
+      result.actionVersions["actions/checkout"],
+      new Set(["v4"]),
+    );
+    assert.equal(
+      "./.github/actions/local-action" in result.actionVersions,
+      false,
+    );
+    assert.equal("./another-local-action" in result.actionVersions, false);
  });
 });

@@ -128,8 +149,8 @@ const steps = [
    fs.writeFileSync(syncTsPath, syncTsContent);

    const actionVersions = {
-      "actions/setup-node": "v5",
-      "actions/setup-go": "v6",
+      "actions/setup-node": new Set(["v5"]),
+      "actions/setup-go": new Set(["v6"]),
    };

    const result = updateSyncTs(syncTsPath, actionVersions);
@@ -155,7 +176,7 @@ const steps = [
    fs.writeFileSync(syncTsPath, syncTsContent);

    const actionVersions = {
-      "actions/setup-node": "v5 # Latest version",
+      "actions/setup-node": new Set(["v5 # Latest version"]),
    };

    const result = updateSyncTs(syncTsPath, actionVersions);
@@ -182,7 +203,7 @@ const steps = [
    fs.writeFileSync(syncTsPath, syncTsContent);

    const actionVersions = {
-      "actions/setup-node": "v5",
+      "actions/setup-node": new Set(["v5"]),
    };

    const result = updateSyncTs(syncTsPath, actionVersions);
@@ -206,7 +227,9 @@ const steps = [
    fs.writeFileSync(syncTsPath, syncTsContent);

    const actionVersions = {
-      "actions/setup-node": "48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0",
+      "actions/setup-node": new Set([
+        "48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0",
+      ]),
    };

    const result = updateSyncTs(syncTsPath, actionVersions);
@@ -244,8 +267,9 @@ steps:
      "actions/checkout": "v4",
      "actions/setup-node": "v5 # Latest",
    };
+    const byWorkflow = { ["test.yml"]: actionVersions };

-    const result = updateTemplateFiles(checksDir, actionVersions);
+    const result = updateTemplateFiles(checksDir, byWorkflow);
    assert.equal(result.length, 1);
    assert.ok(result.includes(templatePath));

@@ -269,8 +293,9 @@ steps:
    const actionVersions = {
      "ruby/setup-ruby": "55511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0",
    };
+    const byWorkflow = { ["test.yml"]: actionVersions };

-    const result = updateTemplateFiles(checksDir, actionVersions);
+    const result = updateTemplateFiles(checksDir, byWorkflow);
    assert.equal(result.length, 1);

    const updatedContent = fs.readFileSync(templatePath, "utf8");
--- a/pr-checks/sync-back.ts
+++ b/pr-checks/sync-back.ts
@@ -27,16 +27,39 @@ const CHECKS_DIR = path.join(PR_CHECKS_DIR, "checks");
 const WORKFLOW_DIR = path.join(REPO_ROOT, ".github", "workflows");
 const SYNC_TS_PATH = path.join(PR_CHECKS_DIR, "sync.ts");

+/** Type alias for action names. */
+type ActionName = string;
+
+/** Type alias for action versions. May include a comment. */
+type ActionVersion = string;
+
+/** Mappings of {@link ActionName}s to {@link ActionVersion}s. */
+type ActionVersions = Record<ActionName, ActionVersion>;
+
+/** Mappings of workflow names to {@link ActionVersions}. */
+type ActionVersionsByWorkflow = Record<string, ActionVersions>;
+
+/** The result of {@link scanGeneratedWorkflows}. */
+type ScanWorkflowResult = {
+  /** A mapping of {@link ActionName}s to all encountered {@link ActionVersion}s. */
+  actionVersions: Record<ActionName, Set<ActionVersion>>;
+
+  /** A mapping of workflow names to {@link ActionVersions}. */
+  actionVersionsByWorkflow: ActionVersionsByWorkflow;
+};
+
 /**
 * Scan generated workflow files to extract the latest action versions.
 *
 * @param workflowDir - Path to .github/workflows directory
- * @returns Map from action names to their latest versions (including comments)
+ *
+ * @returns A {@link ScanWorkflowResult} object containing information about the extracted action versions.
 */
 export function scanGeneratedWorkflows(
  workflowDir: string,
-): Record<string, string> {
-  const actionVersions: Record<string, string> = {};
+): ScanWorkflowResult {
+  const actionVersionsByWorkflow: ActionVersionsByWorkflow = {};
+  const actionVersions: Record<ActionName, Set<ActionVersion>> = {};

  const generatedFiles = fs
    .readdirSync(workflowDir)
@@ -46,6 +69,10 @@ export function scanGeneratedWorkflows(
  for (const filePath of generatedFiles) {
    const content = fs.readFileSync(filePath, "utf8");

+    // Get the basename of the workflow and drop the leading `__` from it.
+    const workflowName = path.basename(filePath).slice(2);
+    actionVersionsByWorkflow[workflowName] = {};
+
    // Find all action uses in the file, including potential comments
    // This pattern captures: action_name@version_with_possible_comment
    const pattern = /uses:\s+([^/\s]+\/[^@\s]+)@([^@\n]+)/g;
@@ -57,13 +84,26 @@ export function scanGeneratedWorkflows(

      // Only track non-local actions (those with / but not starting with ./)
      if (!actionName.startsWith("./")) {
-        // Assume that version numbers are consistent (this should be the case on a Dependabot update PR)
-        actionVersions[actionName] = versionWithComment;
+        // Record the version of the action for this workflow.
+        actionVersionsByWorkflow[workflowName][actionName] = versionWithComment;
+
+        // Record this version for the action so that we can write it to `sync.ts` if needed.
+        // Usually we'd expect there to be exactly one version per action across all workflows,
+        // but sometimes these can go out-of-sync if e.g. a workflow is added in a branch and a
+        // Dependabot PR is merged in the meantime that changes the version of an action that is
+        // used in the new workflow. Different versions of the same action across different
+        // workflows is not fundamentally a problem, but we may need to pick one for `sync.ts`
+        // so we warn there if we have multiple versions of an action.
+        if (actionVersions[actionName] === undefined) {
+          actionVersions[actionName] = new Set([versionWithComment]);
+        } else if (!actionVersions[actionName].has(versionWithComment)) {
+          actionVersions[actionName].add(versionWithComment);
+        }
      }
    }
  }

-  return actionVersions;
+  return { actionVersions, actionVersionsByWorkflow };
 }

 /**
@@ -79,7 +119,7 @@ export function scanGeneratedWorkflows(
 */
 export function updateSyncTs(
  syncTsPath: string,
-  actionVersions: Record<string, string>,
+  actionVersions: Record<ActionName, Set<ActionVersion>>,
 ): boolean {
  if (!fs.existsSync(syncTsPath)) {
    throw new Error(`Could not find ${syncTsPath}`);
@@ -89,9 +129,18 @@ export function updateSyncTs(
  const originalContent = content;

  // Update hardcoded action versions
-  for (const [actionName, versionWithComment] of Object.entries(
+  for (const [actionName, versionsWithComments] of Object.entries(
    actionVersions,
  )) {
+    // We usually expect `versionsWithComments` to contain one version. If there are multiple,
+    // we arbitrarily pick one and warn about it.
+    const versionsWithCommentsArray = Array.from(versionsWithComments);
+    const versionWithComment = versionsWithCommentsArray[0];
+    if (versionsWithComments.size > 1) {
+      console.warn(
+        `Inconsistent versions for ${actionName}. Arbitrarily picking '${versionWithComment}'. All found: ${versionsWithCommentsArray.join(", ")}`,
+      );
+    }
    // Split the scanned value into the ref (e.g. a commit SHA) and the optional
    // trailing version comment (e.g. `v6.0.3`).
    const ref = versionWithComment.includes("#")
@@ -138,12 +187,12 @@ export function updateSyncTs(
 * Update action versions in template files in pr-checks/checks/
 *
 * @param checksDir - Path to pr-checks/checks directory
- * @param actionVersions - Map of action names to versions (may include comments)
+ * @param actionVersionsByWorkflow - Map of workflows to maps of action names to versions (may include comments)
 * @returns List of files that were modified
 */
 export function updateTemplateFiles(
  checksDir: string,
-  actionVersions: Record<string, string>,
+  actionVersionsByWorkflow: ActionVersionsByWorkflow,
 ): string[] {
  const modifiedFiles: string[] = [];

@@ -156,6 +205,16 @@ export function updateTemplateFiles(
    let content = fs.readFileSync(filePath, "utf8");
    const originalContent = content;

+    const workflowName = path.basename(filePath);
+    const actionVersions = actionVersionsByWorkflow[workflowName];
+
+    if (actionVersions === undefined) {
+      console.info(
+        `Found no action versions for workflow template '${filePath}'.`,
+      );
+      continue;
+    }
+
    // Update action versions
    for (const [actionName, versionWithComment] of Object.entries(
      actionVersions,
@@ -191,12 +250,15 @@ function main(): number {
  const verbose = values.verbose ?? false;

  console.info("Scanning generated workflows for latest action versions...");
-  const actionVersions = scanGeneratedWorkflows(WORKFLOW_DIR);
+  const { actionVersions, actionVersionsByWorkflow } =
+    scanGeneratedWorkflows(WORKFLOW_DIR);

  if (verbose) {
    console.info("Found action versions:");
-    for (const [action, version] of Object.entries(actionVersions)) {
-      console.info(`  ${action}@${version}`);
+    for (const [action, versions] of Object.entries(actionVersions)) {
+      for (const version of versions) {
+        console.info(`  ${action}@${version}`);
+      }
    }
  }

@@ -215,7 +277,10 @@ function main(): number {
  }

  // Update template files
-  const templateModified = updateTemplateFiles(CHECKS_DIR, actionVersions);
+  const templateModified = updateTemplateFiles(
+    CHECKS_DIR,
+    actionVersionsByWorkflow,
+  );
  modifiedFiles.push(...templateModified);

  if (modifiedFiles.length > 0) {
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -43,6 +43,13 @@ type WorkflowInputs = Partial<Record<KnownInputName, WorkflowInput>>;
 /** An operating system identifier. */
 type OperatingSystemIdentifier = "ubuntu" | "macos" | "windows";

+/** Mapping from {@link OperatingSystemIdentifier} to default runner image labels. */
+const DEFAULT_RUNNER_IMAGES: Record<OperatingSystemIdentifier, string> = {
+  ubuntu: "ubuntu-26.04",
+  macos: "macos-26",
+  windows: "windows-2025",
+};
+
 /**
 * Represents an operating system matrix entry for a generated PR check workflow.
 *
@@ -137,7 +144,15 @@ interface LanguageSetup {
 /** Describes partial mappings from built-in languages to their specific setup information. */
 type LanguageSetups = Partial<Record<BuiltInLanguage, LanguageSetup>>;

-// The default set of CodeQL Bundle versions to use for the PR checks.
+/** A type representing version identifiers. */
+type Version =
+  | "default"
+  | "linked"
+  | "nightly-latest"
+  // This is an approximation, but sufficient validation for our needs here.
+  | `stable-v${number}.${number}.${number}`;
+
+/** The default set of CodeQL Bundle versions to use for the PR checks. */
 const defaultTestVersions = [
  // The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
  "stable-v2.20.7",
@@ -159,7 +174,10 @@ const defaultTestVersions = [
  "linked",
  // A nightly build directly from the our private repo, built in the last 24 hours.
  "nightly-latest",
-];
+] as const satisfies Version[];
+
+/** A type representing the default test versions. */
+type DefaultTestVersion = (typeof defaultTestVersions)[number];

 /** The default versions we use for languages / frameworks, if not specified as a workflow input. */
 const defaultLanguageVersions = {
@@ -285,8 +303,8 @@ const languageSetups: LanguageSetups = {
        name: "Install Python",
        uses: pinnedUses(
          "actions/setup-python",
-          "5fda3b95a4ea91299a34e894583c3862153e4b97",
-          "v7.0.0",
+          "6d4fd22b20465ccc0f7354476588e8df7c9ca0e0",
+          "v7.1.0",
        ),
        with: {
          "python-version": `\${{ inputs.python-version || '${defaultLanguageVersions.python}' }}`,
@@ -313,9 +331,11 @@ const languageSetups: LanguageSetups = {
  },
 };

-// This is essentially an arbitrary version of `yq`, which happened to be the one that
-// `choco` fetched when we moved away from using that here.
-// See https://github.com/github/codeql-action/pull/3423
+/**
+ * This is essentially an arbitrary version of `yq`, which happened to be the one that
+ * `choco` fetched when we moved away from using that here.
+ * See https://github.com/github/codeql-action/pull/3423
+ */
 const YQ_VERSION = "v4.50.1";

 const CHECKS_DIR = path.join(PR_CHECKS_DIR, "checks");
@@ -401,12 +421,6 @@ function generateJobMatrix(
      );
    }

-    const defaultRunnerImages = [
-      "ubuntu-latest",
-      "macos-latest",
-      "windows-latest",
-    ];
-
    for (const operatingSystemConfig of operatingSystems) {
      const operatingSystem =
        typeof operatingSystemConfig === "string"
@@ -436,16 +450,29 @@ function generateJobMatrix(
      const runnerImagesForOs =
        typeof operatingSystemConfig === "string" ||
        operatingSystemConfig["runner-image"] === undefined
-          ? defaultRunnerImages.filter((image) =>
+          ? Object.values(DEFAULT_RUNNER_IMAGES).filter((image) =>
              image.startsWith(operatingSystem),
            )
          : [operatingSystemConfig["runner-image"]];

      for (const runnerImage of runnerImagesForOs) {
-        matrix.push({
-          os: runnerImage,
-          version,
-        });
+        // stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest`.
+        // We could install that older version on the newer runners, or use the older runner.
+        // We do the latter here. This can be removed once we stop supporting `v2.20.7`.
+        // Since this is typed as `DefaultTestVersion`, it will become an error once `stable-v2.20.7`
+        // is removed from `defaultTestVersions`.
+        const requiresOlderRunnerImage: DefaultTestVersion = "stable-v2.20.7";
+        if (
+          runnerImage === DEFAULT_RUNNER_IMAGES["ubuntu"] &&
+          version === requiresOlderRunnerImage
+        ) {
+          matrix.push({ os: "ubuntu-24.04", version });
+        } else {
+          matrix.push({
+            os: runnerImage,
+            version,
+          });
+        }
      }
    }
  }
@@ -543,12 +570,8 @@ function generateJob(
    ? checkSpecification.useAllPlatformBundle
    : "false";

-  // Kotlin requires a compatible JDK rather than the runner image's default.
-  const setupInfo = getSetupSteps({
-    ...checkSpecification,
-    installJava:
-      checkSpecification.installJava ?? !("container" in checkSpecification),
-  });
+  // Determine which languages or frameworks have to be installed.
+  const setupInfo = getSetupSteps(checkSpecification);
  const workflowInputs = setupInfo.inputs;

  // Construct the workflow steps needed for this check.
@@ -644,16 +667,18 @@ function generateValidationJob(
  // Add the generated steps in front of the ones from the specification.
  specSteps.items.unshift(...checkoutStep, ...steps);

+  const baseCondition = "github.triggering_actor != 'dependabot[bot]'";
+
  const validationJob: Record<string, any> = {
    name: jobSpecification.name,
-    if: "github.triggering_actor != 'dependabot[bot]'",
+    if: baseCondition,
    needs: [checkName],
    permissions: {
      contents: "read",
      "security-events": "read",
    },
    "timeout-minutes": 5,
-    "runs-on": "ubuntu-latest",
+    "runs-on": DEFAULT_RUNNER_IMAGES["ubuntu"],
    steps: specSteps,
  };

--- a/Show More
+++ b/Show More