Merge pull request #4196 from github/dependabot/github_actions/dot-github/workflows/actions-minor-e631a66382

Bump ruby/setup-ruby from 1.326.0 to 1.327.0 in /.github/workflows in the actions-minor group across 1 directory
Merge pull request #4197 from github/mbg/vscode/workspace-improvements
2026-10-06 10:55:17 +00:00 · 2026-10-05 10:37:35 +00:00 · 2026-10-05 10:32:44 +00:00 · 2026-10-05 11:11:58 +01:00 · 2026-10-05 11:08:19 +01:00 · 2026-10-05 09:46:01 +00:00
58 changed files with 36159 additions and 11651 deletions
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,8 +8,6 @@ updates:
      interval: weekly
    cooldown:
      default-days: 7
-      exclude:
-        - "@actions/*"
    labels:
      - Rebuild
    # Ignore incompatible dependency updates
@@ -33,8 +31,6 @@ updates:
      interval: weekly
    cooldown:
      default-days: 7
-      exclude:
-        - "actions/*"
    labels:
      - Rebuild
    groups:
--- a/.github/workflows/__config-input.yml
+++ b/.github/workflows/__config-input.yml
@@ -51,6 +51,8 @@ jobs:
        with:
          node-version: 20.x
          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
      - name: Install dependencies
        run: npm ci
      - name: Prepare test
--- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml
+++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml
@@ -84,6 +84,8 @@ jobs:
        with:
          node-version: 20.x
          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
      - name: Install dependencies
        run: npm ci
      - name: Prepare test
--- a/.github/workflows/__packaging-config-inputs-js.yml
+++ b/.github/workflows/__packaging-config-inputs-js.yml
@@ -84,6 +84,8 @@ jobs:
        with:
          node-version: 20.x
          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
      - name: Install dependencies
        run: npm ci
      - name: Prepare test
--- a/.github/workflows/__packaging-config-js.yml
+++ b/.github/workflows/__packaging-config-js.yml
@@ -84,6 +84,8 @@ jobs:
        with:
          node-version: 20.x
          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
      - name: Install dependencies
        run: npm ci
      - name: Prepare test
--- a/.github/workflows/__packaging-inputs-js.yml
+++ b/.github/workflows/__packaging-inputs-js.yml
@@ -84,6 +84,8 @@ jobs:
        with:
          node-version: 20.x
          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
      - name: Install dependencies
        run: npm ci
      - name: Prepare test
--- a/.github/workflows/__rubocop-multi-language.yml
+++ b/.github/workflows/__rubocop-multi-language.yml
@@ -54,7 +54,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Set up Ruby
-        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
        with:
          ruby-version: 2.6
      - name: Install Code Scanning integration
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -47,6 +47,12 @@ jobs:
          node-version: ${{ matrix.node-version }}
          cache: "npm"

+      # Install a new enough version of `npm` to understand `min-release-age`
+      # that is still compatible with Node 20.
+      - name: Install newer npm
+        if: matrix.node-version == 20
+        run: npm install -g npm@11.19.1
+
      - name: Install dependencies
        run: |
          # Use the system Bash shell to ensure we can run commands like `npm ci`
@@ -95,6 +101,14 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

+      - name: Check for incorrect addresses in package-lock.json
+        run: |
+          if git grep -nE '(pkgs\.visualstudio\.com|pkgs\.dev\.azure\.com|packagefeedproxy\.microsoft\.io)' -- \
+              'package-lock.json'; then
+            echo "::error::package-lock.json contains internal package feed URLs. Replace them with public registry URLs."
+            exit 1
+          fi
+
      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
--- a/.github/workflows/rebuild.yml
+++ b/.github/workflows/rebuild.yml
@@ -54,32 +54,27 @@ jobs:
        run: |
          git fetch origin "$BASE_BRANCH"

-          # Allow merge conflicts in `lib`, since rebuilding should resolve them.
-          git merge "origin/$BASE_BRANCH"
-          MERGE_RESULT=$?
-
-          if [ "$MERGE_RESULT" -eq 0 ]; then
+          # Allow merge conflicts in `lib`, since rebuilding should resolve them. Conflicts leave the
+          # merge in progress, so check for `MERGE_HEAD` to tell them apart from failures that don't.
+          if git merge "origin/$BASE_BRANCH"; then
            echo "Merge succeeded cleanly."
-          elif [ "$MERGE_RESULT" -eq 1 ]; then
-            echo "Merge conflicts detected (exit code $MERGE_RESULT), continuing."
-          else
-            echo "git merge failed with unexpected exit code $MERGE_RESULT."
-            exit 1
-          fi
-
-          if [ "$MERGE_RESULT" -ne 0 ]; then
+          elif git rev-parse --verify MERGE_HEAD >/dev/null 2>&1; then
+            echo "Merge conflicts detected, continuing."
            echo "merge-in-progress=true" >> $GITHUB_OUTPUT

-            # Check for merge conflicts outside of `lib`. Disable git diff's trailing whitespace check
-            # since `node_modules/@types/semver/README.md` fails it.
-            if git -c core.whitespace=-trailing-space diff --check | grep --invert-match '^lib/'; then
+            # Check for merge conflicts outside of `lib`.
+            CONFLICTS_OUTSIDE_LIB=$(git diff --name-only --diff-filter=U | grep --invert-match '^lib/' || true)
+            if [ -n "$CONFLICTS_OUTSIDE_LIB" ]; then
              echo "Merge conflicts were detected outside of the lib directory. Please resolve them manually."
-              git -c core.whitespace=-trailing-space diff --check | grep --invert-match '^lib/' || true
+              echo "$CONFLICTS_OUTSIDE_LIB"
              exit 1
            fi

            echo "No merge conflicts found outside the lib directory. We should be able to resolve all of" \
              "these by rebuilding the Action."
+          else
+            echo "git merge failed for a reason other than merge conflicts."
+            exit 1
          fi

      - name: Compile TypeScript
--- a/.npmrc
+++ b/.npmrc
@@ -1 +1,2 @@
 lockfile-version=3
+min-release-age=7
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -7,6 +7,10 @@
    // transpiled JavaScript
    "build": true,
    "lib": true,
+
+    // exclude "tests" by default because it causes VSCode to start language-specific extensions
+    // that are not typically needed during development (or indeed may not work correctly)
+    "tests": true
  },
  "search.exclude": {
    "**/node_modules": true,
@@ -18,7 +22,7 @@
  "git.ignoreLimitWarning": true,
  // Use the vendored TypeScript version to have a consistent development experience across
  // machines.
-  "typescript.tsdk": "node_modules/typescript/lib",
+  "js/ts.tsdk.path": "node_modules/typescript/lib",
  "[typescript]": {
    "editor.defaultFormatter": "esbenp.prettier-vscode"
  },
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,14 @@

 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.

+## [UNRELEASED]
+
+No user facing changes.
+
+## 4.38.2 - 24 Sept 2026
+
+- Update default CodeQL bundle version to [2.27.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1). [#4160](https://github.com/github/codeql-action/pull/4160)
+
 ## 4.38.1 - 18 Sept 2026

 - The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. [#4146](https://github.com/github/codeql-action/pull/4146)
--- a/lib/defaults.json
+++ b/lib/defaults.json
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.0",
-  "cliVersion": "2.27.0",
-  "priorBundleVersion": "codeql-bundle-v2.26.4",
-  "priorCliVersion": "2.26.4"
+  "bundleVersion": "codeql-bundle-v2.27.1",
+  "cliVersion": "2.27.1",
+  "priorBundleVersion": "codeql-bundle-v2.27.0",
+  "priorCliVersion": "2.27.0"
 }
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
  "name": "codeql",
-  "version": "4.38.1",
+  "version": "4.38.3",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "codeql",
-      "version": "4.38.1",
+      "version": "4.38.3",
      "license": "MIT",
      "workspaces": [
        "pr-checks"
@@ -31,7 +31,7 @@
        "follow-redirects": "^1.16.0",
        "get-folder-size": "^5.0.0",
        "https-proxy-agent": "^7.0.6",
-        "js-yaml": "^5.4.1",
+        "js-yaml": "^5.4.2",
        "jsonschema": "1.5.0",
        "long": "^5.3.2",
        "node-forge": "^1.4.0",
@@ -58,14 +58,14 @@
        "eslint-import-resolver-typescript": "^4.4.5",
        "eslint-plugin-github": "^6.1.2",
        "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jsdoc": "^64.3.8",
+        "eslint-plugin-jsdoc": "^64.5.4",
        "eslint-plugin-no-async-foreach": "^0.1.1",
        "glob": "^13.0.6",
        "globals": "^17.12.0",
        "nock": "^14.0.17",
        "sinon": "^22.1.0",
        "typescript": "^6.0.3",
-        "typescript-eslint": "^8.70.0"
+        "typescript-eslint": "^8.70.1"
      }
    },
    "node_modules/@aashutoshrathi/word-wrap": {
@@ -374,9 +374,9 @@
      "license": "Apache-2.0"
    },
    "node_modules/@actions/artifact/node_modules/brace-expansion": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
-      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
+      "version": "2.1.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz",
+      "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
      "license": "MIT",
      "dependencies": {
        "balanced-match": "^1.0.0"
@@ -665,9 +665,9 @@
      }
    },
    "node_modules/@azure/core-client": {
-      "version": "1.10.1",
-      "resolved": "https://registry.npmjs.org/@azure/core-client/-/core-client-1.10.1.tgz",
-      "integrity": "sha512-Nh5PhEOeY6PrnxNPsEHRr9eimxLwgLlpmguQaHKBinFYA/RU9+kOYVOQqOrTsCL+KSxrLLl1gD8Dk5BFW/7l/w==",
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@azure/core-client/-/core-client-1.11.1.tgz",
+      "integrity": "sha512-2QygG2F76ZpMP2eMztiJvAiFMu71M9rDeU7vO/QKg5Css7MgM4frUOslFjhVjRhbGaCNPtz/S8M6y46/fFKVuQ==",
      "license": "MIT",
      "dependencies": {
        "@azure/abort-controller": "^2.1.2",
@@ -679,45 +679,47 @@
        "tslib": "^2.6.2"
      },
      "engines": {
-        "node": ">=20.0.0"
+        "node": ">=22.0.0"
      }
    },
    "node_modules/@azure/core-client/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.2.0.tgz",
+      "integrity": "sha512-fNAjWnA/nZ2jz31kxR/AqRaUT8ewHBw/WuBIosK0moMy1C9e5ValbDfFdIxJzVOOYaYkV/b2F1S4H/aHiqfVQg==",
      "license": "MIT",
      "dependencies": {
        "tslib": "^2.6.2"
      },
      "engines": {
-        "node": ">=18.0.0"
+        "node": ">=22.0.0"
      }
    },
    "node_modules/@azure/core-http-compat": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/@azure/core-http-compat/-/core-http-compat-2.3.1.tgz",
-      "integrity": "sha512-az9BkXND3/d5VgdRRQVkiJb2gOmDU8Qcq4GvjtBmDICNiQ9udFmDk4ZpSB5Qq1OmtDJGlQAfBaS4palFsazQ5g==",
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@azure/core-http-compat/-/core-http-compat-2.5.0.tgz",
+      "integrity": "sha512-BoSmXPx2er1Ai+wKlDvj29jIQespCNBwEmKyZVHO2kEFsWbGjAjwMCGzug3DJM5/QYIV3vej0S1zcU5bq9fa8w==",
      "license": "MIT",
      "dependencies": {
-        "@azure/abort-controller": "^2.1.2",
-        "@azure/core-client": "^1.10.0",
-        "@azure/core-rest-pipeline": "^1.22.0"
+        "@azure/abort-controller": "^2.1.2"
      },
      "engines": {
-        "node": ">=20.0.0"
+        "node": ">=22.0.0"
+      },
+      "peerDependencies": {
+        "@azure/core-client": "^1.10.0",
+        "@azure/core-rest-pipeline": "^1.22.0"
      }
    },
    "node_modules/@azure/core-http-compat/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.2.0.tgz",
+      "integrity": "sha512-fNAjWnA/nZ2jz31kxR/AqRaUT8ewHBw/WuBIosK0moMy1C9e5ValbDfFdIxJzVOOYaYkV/b2F1S4H/aHiqfVQg==",
      "license": "MIT",
      "dependencies": {
        "tslib": "^2.6.2"
      },
      "engines": {
-        "node": ">=18.0.0"
+        "node": ">=22.0.0"
      }
    },
    "node_modules/@azure/core-lro": {
@@ -760,9 +762,9 @@
      }
    },
    "node_modules/@azure/core-rest-pipeline": {
-      "version": "1.22.2",
-      "resolved": "https://registry.npmjs.org/@azure/core-rest-pipeline/-/core-rest-pipeline-1.22.2.tgz",
-      "integrity": "sha512-MzHym+wOi8CLUlKCQu12de0nwcq9k9Kuv43j4Wa++CsCpJwps2eeBQwD2Bu8snkxTtDKDx4GwjuR9E8yC8LNrg==",
+      "version": "1.25.0",
+      "resolved": "https://registry.npmjs.org/@azure/core-rest-pipeline/-/core-rest-pipeline-1.25.0.tgz",
+      "integrity": "sha512-bMs8ekJLjX8wPV+9IPBges1SLPyuDtE9g5gLDWOpxzKcoOFQnpLGkbcT1tdw3FaAmDS1gnPmMmJ6y/T5B96kIA==",
      "license": "MIT",
      "dependencies": {
        "@azure/abort-controller": "^2.1.2",
@@ -770,11 +772,11 @@
        "@azure/core-tracing": "^1.3.0",
        "@azure/core-util": "^1.13.0",
        "@azure/logger": "^1.3.0",
-        "@typespec/ts-http-runtime": "^0.3.0",
+        "@typespec/ts-http-runtime": "^0.3.4",
        "tslib": "^2.6.2"
      },
      "engines": {
-        "node": ">=20.0.0"
+        "node": ">=22.0.0"
      }
    },
    "node_modules/@azure/core-rest-pipeline/node_modules/@azure/abort-controller": {
@@ -854,9 +856,9 @@
      }
    },
    "node_modules/@azure/storage-blob": {
-      "version": "12.29.1",
-      "resolved": "https://registry.npmjs.org/@azure/storage-blob/-/storage-blob-12.29.1.tgz",
-      "integrity": "sha512-7ktyY0rfTM0vo7HvtK6E3UvYnI9qfd6Oz6z/+92VhGRveWng3kJwMKeUpqmW/NmwcDNbxHpSlldG+vsUnRFnBg==",
+      "version": "12.34.0",
+      "resolved": "https://registry.npmjs.org/@azure/storage-blob/-/storage-blob-12.34.0.tgz",
+      "integrity": "sha512-cXDTCAMwDx8Ng9yUe82kOOd2kPnZ8AQqe4FkLMcpaQ3Mvr3/PXVdvRhyP0FtY5/U5Oh6JGk3EcEibaFOymRLFw==",
      "license": "MIT",
      "dependencies": {
        "@azure/abort-controller": "^2.1.2",
@@ -870,12 +872,13 @@
        "@azure/core-util": "^1.11.0",
        "@azure/core-xml": "^1.4.5",
        "@azure/logger": "^1.1.4",
-        "@azure/storage-common": "^12.1.1",
+        "@azure/storage-common": "^12.5.0",
+        "apache-arrow": "^21.1.0",
        "events": "^3.0.0",
        "tslib": "^2.8.1"
      },
      "engines": {
-        "node": ">=20.0.0"
+        "node": ">=22.0.0"
      }
    },
    "node_modules/@azure/storage-blob/node_modules/@azure/abort-controller": {
@@ -891,15 +894,15 @@
      }
    },
    "node_modules/@azure/storage-common": {
-      "version": "12.1.1",
-      "resolved": "https://registry.npmjs.org/@azure/storage-common/-/storage-common-12.1.1.tgz",
-      "integrity": "sha512-eIOH1pqFwI6UmVNnDQvmFeSg0XppuzDLFeUNO/Xht7ODAzRLgGDh7h550pSxoA+lPDxBl1+D2m/KG3jWzCUjTg==",
+      "version": "12.5.0",
+      "resolved": "https://registry.npmjs.org/@azure/storage-common/-/storage-common-12.5.0.tgz",
+      "integrity": "sha512-bttzuhQiCIwrkzjPDA+AtAR7dg19L/CC6ztcqJ5LfvWpXuys9mHp0UQ0udYnoUvv9SCT9KTR5kqFvFr0e6k0lQ==",
      "license": "MIT",
      "dependencies": {
        "@azure/abort-controller": "^2.1.2",
        "@azure/core-auth": "^1.9.0",
-        "@azure/core-http-compat": "^2.2.0",
-        "@azure/core-rest-pipeline": "^1.19.1",
+        "@azure/core-http-compat": "^2.4.0",
+        "@azure/core-rest-pipeline": "^1.24.0",
        "@azure/core-tracing": "^1.2.0",
        "@azure/core-util": "^1.11.0",
        "@azure/logger": "^1.1.4",
@@ -907,19 +910,19 @@
        "tslib": "^2.8.1"
      },
      "engines": {
-        "node": ">=20.0.0"
+        "node": ">=22.0.0"
      }
    },
    "node_modules/@azure/storage-common/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.2.0.tgz",
+      "integrity": "sha512-fNAjWnA/nZ2jz31kxR/AqRaUT8ewHBw/WuBIosK0moMy1C9e5ValbDfFdIxJzVOOYaYkV/b2F1S4H/aHiqfVQg==",
      "license": "MIT",
      "dependencies": {
        "tslib": "^2.6.2"
      },
      "engines": {
-        "node": ">=18.0.0"
+        "node": ">=22.0.0"
      }
    },
    "node_modules/@emnapi/core": {
@@ -957,17 +960,17 @@
      }
    },
    "node_modules/@es-joy/jsdoccomment": {
-      "version": "0.97.0",
-      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.97.0.tgz",
-      "integrity": "sha512-EP8uoFfh6+GsdGCduYtmWAW0h7AO+Ayik9Vh5YbA2r/3N6lmJKkCNZX+q3QBXC1K6ixjQ/9igF2b7WVvLm063g==",
+      "version": "0.98.0",
+      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.98.0.tgz",
+      "integrity": "sha512-QS+b7I2aaSM+gZfDz1b9E4B367JJ2qTjFXRKF289iKkh9sYdZ21Q5MiF/Duzouy3J0C4VhM3I/8f2F4+zT8gYQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@types/estree": "^1.0.9",
-        "@typescript-eslint/types": "^8.69.0",
-        "comment-parser": "1.4.8",
+        "@typescript-eslint/types": "^8.70.0",
+        "comment-parser": "1.4.9",
        "esquery": "^1.7.0",
-        "jsdoc-type-pratt-parser": "~9.2.1"
+        "jsdoc-type-pratt-parser": "~9.2.2"
      },
      "engines": {
        "node": "^22.22.2 || >=24.15.0"
@@ -2593,7 +2596,7 @@
    },
    "node_modules/@types/debug": {
      "version": "4.1.13",
-      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/debug/-/debug-4.1.13.tgz",
+      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
      "integrity": "sha1-ItHMnVQtNZPK6nZPl0MGqzYobuc=",
      "license": "MIT",
      "dependencies": {
@@ -2636,7 +2639,7 @@
    },
    "node_modules/@types/mdast": {
      "version": "4.0.4",
-      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/mdast/-/mdast-4.0.4.tgz",
+      "resolved": "https://registry.npmjs.org/@types/mdast/-/mdast-4.0.4.tgz",
      "integrity": "sha1-fM9y7dLxqn3TQ34YDGQ3NYWATdY=",
      "license": "MIT",
      "dependencies": {
@@ -2645,7 +2648,7 @@
    },
    "node_modules/@types/ms": {
      "version": "2.1.0",
-      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/ms/-/ms-2.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz",
      "integrity": "sha1-BSqmekjszEMJ1/AZG35BQ0uQu3g=",
      "license": "MIT"
    },
@@ -2710,22 +2713,22 @@
    },
    "node_modules/@types/unist": {
      "version": "3.0.3",
-      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/unist/-/unist-3.0.3.tgz",
+      "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
      "integrity": "sha1-rKqw+RnOaczmKcLU7S60rcG2wgw=",
      "license": "MIT"
    },
    "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.70.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.70.0.tgz",
-      "integrity": "sha512-/v8HZt6RlyIZxB3ntehELOcUcfxKPVGWXnQdJuHRmzrqgF8nQypcC/oxGW+Ot4VGKDq81XugPKxx0n5PBtf9PA==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.70.1.tgz",
+      "integrity": "sha512-nDNrUQ/4ruSNYbu749TRY7cfrzPtoLHEXSNBI8aaNY32LlZCajixqRf3FqcKC4p5Cam4VOHYx/t+i5+nKXvrqA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.70.0",
-        "@typescript-eslint/type-utils": "8.70.0",
-        "@typescript-eslint/utils": "8.70.0",
-        "@typescript-eslint/visitor-keys": "8.70.0",
+        "@typescript-eslint/scope-manager": "8.70.1",
+        "@typescript-eslint/type-utils": "8.70.1",
+        "@typescript-eslint/utils": "8.70.1",
+        "@typescript-eslint/visitor-keys": "8.70.1",
        "ignore": "^7.0.5",
        "natural-compare": "^1.4.0",
        "ts-api-utils": "^2.5.0"
@@ -2738,7 +2741,7 @@
        "url": "https://opencollective.com/typescript-eslint"
      },
      "peerDependencies": {
-        "@typescript-eslint/parser": "^8.70.0",
+        "@typescript-eslint/parser": "^8.70.1",
        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
        "typescript": ">=4.8.4 <6.1.0"
      }
@@ -2754,16 +2757,16 @@
      }
    },
    "node_modules/@typescript-eslint/parser": {
-      "version": "8.70.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.70.0.tgz",
-      "integrity": "sha512-zYvrmj9Yxd63UGaXw+kdt6A0F0s0qveJyuatIM77bYC2DE4pgmg7a50u8LR7PRtXd0x+h+Tl3eXabGm06SWd3Q==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.70.1.tgz",
+      "integrity": "sha512-nO974WLllwhSFWQXnMLj6nDGa8f0khKEz1JzpPJ1u7Vm/4X1X6ZHajpoknU4bb41vJyMB0HHVyS2GqdhWfIXZw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/scope-manager": "8.70.0",
-        "@typescript-eslint/types": "8.70.0",
-        "@typescript-eslint/typescript-estree": "8.70.0",
-        "@typescript-eslint/visitor-keys": "8.70.0",
+        "@typescript-eslint/scope-manager": "8.70.1",
+        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/typescript-estree": "8.70.1",
+        "@typescript-eslint/visitor-keys": "8.70.1",
        "debug": "^4.4.3"
      },
      "engines": {
@@ -2797,14 +2800,14 @@
      }
    },
    "node_modules/@typescript-eslint/project-service": {
-      "version": "8.70.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.70.0.tgz",
-      "integrity": "sha512-hFHbTNqhU9G+2eKFXCBVb1tjFT/LceiJ4+HfLO4pTpDI0KHi6iajpcFFkaSQ9gXmCh7n82A0PthaayEdN6mspQ==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.70.1.tgz",
+      "integrity": "sha512-62xOgboPfwc3/IgPSX/W6oQR3ZbF04194FPGUGH8HL8iLFHbt/456/8Ph1wLNUgVF+s94FlHoipBsz+v7+LMnA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.70.0",
-        "@typescript-eslint/types": "^8.70.0",
+        "@typescript-eslint/tsconfig-utils": "^8.70.1",
+        "@typescript-eslint/types": "^8.70.1",
        "debug": "^4.4.3"
      },
      "engines": {
@@ -2837,14 +2840,14 @@
      }
    },
    "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.70.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.70.0.tgz",
-      "integrity": "sha512-8nP3Kwh5hlgZ4FicGvmznAmJe8UL4sdU8tLukrPaMuQmDuk4Y8xYfzu/aYZW4xT2JCgc7H/TpDI5cGlxcWJSqQ==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.70.1.tgz",
+      "integrity": "sha512-Pa0EeSeAusQc1WbjQMac+YfenewYTBu0KjgYvkUKwhXaHUKbFog23Dm/rp0DX/6tyYOQ3Xl1a+3EcFNZynGHCw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.70.0",
-        "@typescript-eslint/visitor-keys": "8.70.0"
+        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/visitor-keys": "8.70.1"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2855,9 +2858,9 @@
      }
    },
    "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.70.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.70.0.tgz",
-      "integrity": "sha512-adnkeeNq9Sq1sUf4+FRVc0KdgYghzsgFpZSQVZVvY0LCuUuN0FnQgyGzCJeC4fW1cdXseBAjU2EOqUIjbNcZUw==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.70.1.tgz",
+      "integrity": "sha512-jumze1fPI+sDOaM2TWGQdn39PDxTr7TZGeuyLkAbNyx2vtMT3uRnVKChN0hfht5V2TugphJzF6bYXvBcE09qqg==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2872,15 +2875,15 @@
      }
    },
    "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.70.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.70.0.tgz",
-      "integrity": "sha512-NUMKIhYVaVIVLnRL9CRt+VVcuLgSHUCpXn4/+K8wql+vdInUzvx8BjUO1oJ7cG9shjFJKtF8F8Hh2kCh3/KBVw==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.70.1.tgz",
+      "integrity": "sha512-7zKTnyvaVWqzLZHPFQtX1hVHqgkMC+WebPWakNCSyrQVbIP1AM0L0TlBZtACldIRb6PptI8Odk+jyZ5kP3B1VA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.70.0",
-        "@typescript-eslint/typescript-estree": "8.70.0",
-        "@typescript-eslint/utils": "8.70.0",
+        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/typescript-estree": "8.70.1",
+        "@typescript-eslint/utils": "8.70.1",
        "debug": "^4.4.3",
        "ts-api-utils": "^2.5.0"
      },
@@ -2915,9 +2918,9 @@
      }
    },
    "node_modules/@typescript-eslint/types": {
-      "version": "8.70.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.70.0.tgz",
-      "integrity": "sha512-asTOIYhDg4zdzOScCyaytrsV3cR6B4ecPQlXw/dJIm7J/MZTtCtfVII9JD8Geh4jTCrK/Xe6cg5UevoleMcoJQ==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.70.1.tgz",
+      "integrity": "sha512-Dm1ypdhhrGCTyyehxElhgJ6kgk8MVCv5qXdoOVqPr1uqk42jX8KjrZqhROvdShczA8qrDoYiOWn1ykWlx2k81Q==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2929,16 +2932,16 @@
      }
    },
    "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.70.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.70.0.tgz",
-      "integrity": "sha512-d9NmHMPEKQ7QCLLm1jI3zmoQBwT5KwFYjXBJ9ymZfKCUU+5rmTRykKAFvH5Qn/ZCds3CEAFS9OC9M/jkl0X2bA==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.70.1.tgz",
+      "integrity": "sha512-TU8PwyGN0PQJUcE96mw8eCQ44SmxGdQlJmlWakHaHQ15eIuuvye5yNtmh/i6oS88jzXVQB71xdNkbkB/fMwL0g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/project-service": "8.70.0",
-        "@typescript-eslint/tsconfig-utils": "8.70.0",
-        "@typescript-eslint/types": "8.70.0",
-        "@typescript-eslint/visitor-keys": "8.70.0",
+        "@typescript-eslint/project-service": "8.70.1",
+        "@typescript-eslint/tsconfig-utils": "8.70.1",
+        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/visitor-keys": "8.70.1",
        "debug": "^4.4.3",
        "minimatch": "^10.2.2",
        "semver": "^7.7.3",
@@ -2967,9 +2970,9 @@
      }
    },
    "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -3014,16 +3017,16 @@
      }
    },
    "node_modules/@typescript-eslint/utils": {
-      "version": "8.70.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.70.0.tgz",
-      "integrity": "sha512-oZmtKJz/4fufZ2p3+Cn3ijEojcdfR+1zYDH2xKYrEly0dR/Q/1xUPRCOlKGxod78nWlU2UnDe09GZ3TaknBFGA==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.70.1.tgz",
+      "integrity": "sha512-Esgul8MsnKnRLdYU2Eb2cRV9bS5HJYtKj1ByJnOzzG2M58DGdSUQ1jUuILxipqcpB2h9WLrbD5GijIWUjX/Tqw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.70.0",
-        "@typescript-eslint/types": "8.70.0",
-        "@typescript-eslint/typescript-estree": "8.70.0"
+        "@typescript-eslint/scope-manager": "8.70.1",
+        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/typescript-estree": "8.70.1"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3038,13 +3041,13 @@
      }
    },
    "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.70.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.70.0.tgz",
-      "integrity": "sha512-BoC8PiO4Hkdo0TVJh9Ntxr5MxPDI7/oFsrygN5ADelFSeXG/qgNuucIGA+L5Z6JpPTE/uRfcTWtscjbUaufepQ==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.70.1.tgz",
+      "integrity": "sha512-Vwj9lUIW5Xq3wQ9w6gv3R86g1hMK8f2zNOdGTAgeXUMMXFK78G9ruCjjqutHMNJc0+CH7LYRnHeUB9IT8wFmcw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.70.0",
+        "@typescript-eslint/types": "8.70.1",
        "eslint-visitor-keys": "^5.0.0"
      },
      "engines": {
@@ -3069,9 +3072,9 @@
      }
    },
    "node_modules/@typespec/ts-http-runtime": {
-      "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.2.tgz",
-      "integrity": "sha512-IlqQ/Gv22xUC1r/WQm4StLkYQmaaTsXAhUVsNE0+xiyf0yRFiH5++q78U3bw6bLKDCTmh0uqKB9eG9+Bt75Dkg==",
+      "version": "0.3.9",
+      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.9.tgz",
+      "integrity": "sha512-edSdeAqkdxBVzA1yL1LrLCml1YjyCVvPMtMqJpbF+6K609tHe8V6sQUzFQSGcYNhcuhOceZtjvN32+mpIth30A==",
      "license": "MIT",
      "dependencies": {
        "http-proxy-agent": "^7.0.0",
@@ -3079,7 +3082,7 @@
        "tslib": "^2.6.2"
      },
      "engines": {
-        "node": ">=20.0.0"
+        "node": ">=22.0.0"
      }
    },
    "node_modules/@ungap/structured-clone": {
@@ -3497,6 +3500,36 @@
        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
      }
    },
+    "node_modules/apache-arrow": {
+      "version": "21.2.0",
+      "resolved": "https://registry.npmjs.org/apache-arrow/-/apache-arrow-21.2.0.tgz",
+      "integrity": "sha512-Hxe6Agq26gQOM954qpzYSllJBPJl+e16U5CkfuMUhLrNba+5nKkttIVlflaovN6oaTratqMGAO8H5u/aNhmHWQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@types/node": "^25.2.0",
+        "flatbuffers": "^25.1.24",
+        "json-with-bigint": "^3.5.3",
+        "tslib": "^2.6.2"
+      },
+      "bin": {
+        "arrow2csv": "bin/arrow2csv.js"
+      }
+    },
+    "node_modules/apache-arrow/node_modules/@types/node": {
+      "version": "25.9.8",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.8.tgz",
+      "integrity": "sha512-VfMrScDmMhUJQmd5hArdQnFvK0OIeD36uN2Va1FcpYaLB/BgkgM8Ulc50XtYISPMz7APJ30+N0T5EM0jlcdfRw==",
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": ">=7.24.0 <7.24.7"
+      }
+    },
+    "node_modules/apache-arrow/node_modules/undici-types": {
+      "version": "7.24.6",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz",
+      "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==",
+      "license": "MIT"
+    },
    "node_modules/archiver": {
      "version": "8.0.0",
      "resolved": "https://registry.npmjs.org/archiver/-/archiver-8.0.0.tgz",
@@ -4001,9 +4034,9 @@
      "license": "MIT"
    },
    "node_modules/brace-expansion": {
-      "version": "1.1.18",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
-      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
      "license": "MIT",
      "dependencies": {
        "balanced-match": "^1.0.0",
@@ -4216,7 +4249,7 @@
    },
    "node_modules/character-entities": {
      "version": "2.0.2",
-      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/character-entities/-/character-entities-2.0.2.tgz",
+      "resolved": "https://registry.npmjs.org/character-entities/-/character-entities-2.0.2.tgz",
      "integrity": "sha1-LQnC5yzZUjB2zLIRV9/2atQ/zCI=",
      "license": "MIT",
      "funding": {
@@ -4377,9 +4410,9 @@
      "license": "MIT"
    },
    "node_modules/comment-parser": {
-      "version": "1.4.8",
-      "resolved": "https://registry.npmjs.org/comment-parser/-/comment-parser-1.4.8.tgz",
-      "integrity": "sha512-rKZTGo4fzKYna8UcL0isTg5wkBNla7bxTypLwZQXjIdi++IdP1OJ41rI5Mti3/jltkPujbu4i9LIARYA+zpotQ==",
+      "version": "1.4.9",
+      "resolved": "https://registry.npmjs.org/comment-parser/-/comment-parser-1.4.9.tgz",
+      "integrity": "sha512-+2AvZKjJaNq9GQljm3tr0utwrig5BL+jgJGvz5rDpGKNIp+ojcRXWUwBbh/sGIi1QCprR6PsKFakub+w1v+4hQ==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -4611,7 +4644,7 @@
    },
    "node_modules/decode-named-character-reference": {
      "version": "1.3.0",
-      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/decode-named-character-reference/-/decode-named-character-reference-1.3.0.tgz",
+      "resolved": "https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.3.0.tgz",
      "integrity": "sha1-PkBgN2CHTC5YZ2kbWZ1zp9oltT8=",
      "license": "MIT",
      "dependencies": {
@@ -4667,7 +4700,7 @@
    },
    "node_modules/dequal": {
      "version": "2.0.3",
-      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/dequal/-/dequal-2.0.3.tgz",
+      "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
      "integrity": "sha1-JkQhTxmX057Q7g7OcjNUkKesZ74=",
      "license": "MIT",
      "engines": {
@@ -4686,7 +4719,7 @@
    },
    "node_modules/devlop": {
      "version": "1.1.0",
-      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/devlop/-/devlop-1.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz",
      "integrity": "sha1-TbfCyk3G4Og0wwvnDJS7yXbccBg=",
      "license": "MIT",
      "dependencies": {
@@ -5311,9 +5344,9 @@
      }
    },
    "node_modules/eslint-plugin-import-x/node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -5348,17 +5381,17 @@
      }
    },
    "node_modules/eslint-plugin-jsdoc": {
-      "version": "64.3.8",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-64.3.8.tgz",
-      "integrity": "sha512-JXLYE2BVfmbqLrrslb9/vg3URg8okW5pMnppM+3EYwvPCbuOiSXGOJWaNK208wDx6xXawkIFGtRYgFgrW23dsg==",
+      "version": "64.5.4",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-64.5.4.tgz",
+      "integrity": "sha512-xfRhXPSSWT612muJ6XTvxuVJ8zYHv99qNgBqPVqF28aSqoy4s4XbSkrWXnYA2hl5ejC02yEpk6fqkj3BmJ6Xbg==",
      "dev": true,
      "license": "BSD-3-Clause",
      "dependencies": {
-        "@es-joy/jsdoccomment": "~0.97.0",
+        "@es-joy/jsdoccomment": "~0.98.0",
        "@es-joy/resolve.exports": "1.2.0",
-        "@typescript-eslint/utils": "^8.69.0",
+        "@typescript-eslint/utils": "^8.70.0",
        "are-docs-informative": "^0.1.1",
-        "comment-parser": "1.4.8",
+        "comment-parser": "1.4.9",
        "debug": "^4.4.3",
        "escape-string-regexp": "^5.0.0",
        "espree": "^11.2.0",
@@ -5374,7 +5407,13 @@
        "node": "^22.22.2 || >=24.15.0"
      },
      "peerDependencies": {
-        "eslint": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0"
+        "eslint": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0",
+        "typescript": "*"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
      }
    },
    "node_modules/eslint-plugin-jsdoc/node_modules/debug": {
@@ -5954,6 +5993,12 @@
        "node": ">=16"
      }
    },
+    "node_modules/flatbuffers": {
+      "version": "25.9.23",
+      "resolved": "https://registry.npmjs.org/flatbuffers/-/flatbuffers-25.9.23.tgz",
+      "integrity": "sha512-MI1qs7Lo4Syw0EOzUl0xjs2lsoeqFku44KpngfIduHBYvzm8h2+7K8YMQh1JtVVVrUvhLpNwqVi4DERegUJhPQ==",
+      "license": "Apache-2.0"
+    },
    "node_modules/flatted": {
      "version": "3.4.2",
      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
@@ -6221,9 +6266,9 @@
      }
    },
    "node_modules/glob/node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
      "license": "MIT",
      "dependencies": {
        "balanced-match": "^4.0.2"
@@ -7091,9 +7136,9 @@
      }
    },
    "node_modules/js-yaml": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.1.tgz",
-      "integrity": "sha512-28R/k+NAjeuf7+CKlTxWZVExJGwVVLwY06DgEnOMz2gEpfNkDcD7QvyiVPT0xy0XXhU8vHsd4Ot42OOPdJG7dQ==",
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.2.tgz",
+      "integrity": "sha512-m+aqu+LwO1O6sIopafj8HUVl5aawITwZQe/yHpMCKjaWBaA/d07B/QdMb3529REftiU+RMMHL3Vlsw3hON7vWg==",
      "funding": [
        {
          "type": "github",
@@ -7123,9 +7168,9 @@
      }
    },
    "node_modules/jsdoc-type-pratt-parser": {
-      "version": "9.2.1",
-      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.2.1.tgz",
-      "integrity": "sha512-V4Ww4EHnTcTLSOMoB0FsF72JhQvcAsriCm/LWnxJeGWoxIjEL2l9na11abQok5SYShq8m0Gl02el/xAbTCulvQ==",
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.2.2.tgz",
+      "integrity": "sha512-eFY7Rlscvv/BpY6UsVsjKwMhu1tJO/F4U/vC9g3yeRy/JqszuO1UP6Vdq+85G+3FP6fEw/sWR8a5ftPFY86csw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -7137,9 +7182,9 @@
      }
    },
    "node_modules/jsdoc-type-pratt-parser/node_modules/@types/node": {
-      "version": "26.5.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.5.0.tgz",
-      "integrity": "sha512-dVSGpriSoCgz8WnDNTuSSuSv1PC/ALXihO4ulRZt7Md8k9mlbdin3lGOcDE8SnWOgf513ByWlXd7BK4azmyg/A==",
+      "version": "26.6.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz",
+      "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -7474,7 +7519,7 @@
    },
    "node_modules/mdast-util-to-string": {
      "version": "4.0.0",
-      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/mdast-util-to-string/-/mdast-util-to-string-4.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/mdast-util-to-string/-/mdast-util-to-string-4.0.0.tgz",
      "integrity": "sha1-elEhR1VWoE5+3etnsmSq550xKBQ=",
      "license": "MIT",
      "dependencies": {
@@ -7513,7 +7558,7 @@
    },
    "node_modules/micromark": {
      "version": "4.0.2",
-      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark/-/micromark-4.0.2.tgz",
+      "resolved": "https://registry.npmjs.org/micromark/-/micromark-4.0.2.tgz",
      "integrity": "sha1-kTlaPhiEoZjmIRbjPJxWjjmTb9s=",
      "funding": [
        {
@@ -7548,7 +7593,7 @@
    },
    "node_modules/micromark-core-commonmark": {
      "version": "2.0.3",
-      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-core-commonmark/-/micromark-core-commonmark-2.0.3.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-core-commonmark/-/micromark-core-commonmark-2.0.3.tgz",
      "integrity": "sha1-xpFjDkhQIaaM8o28Kyyifr9njNQ=",
      "funding": [
        {
@@ -7582,7 +7627,7 @@
    },
    "node_modules/micromark-factory-destination": {
      "version": "2.0.1",
-      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-factory-destination/-/micromark-factory-destination-2.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-factory-destination/-/micromark-factory-destination-2.0.1.tgz",
      "integrity": "sha1-j++OD3CB8EdPvdkt61DJkKAmRjk=",
      "funding": [
        {
@@ -7603,7 +7648,7 @@
    },
    "node_modules/micromark-factory-label": {
      "version": "2.0.1",
-      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-factory-label/-/micromark-factory-label-2.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-factory-label/-/micromark-factory-label-2.0.1.tgz",
      "integrity": "sha1-UmfvqX8eUlTvx/ILRZo4yyEFi6E=",
      "funding": [
        {
@@ -7625,7 +7670,7 @@
    },
    "node_modules/micromark-factory-space": {
      "version": "2.0.1",
-      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-factory-space/-/micromark-factory-space-2.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-factory-space/-/micromark-factory-space-2.0.1.tgz",
      "integrity": "sha1-NtAhLpYrKzEh+FJfx6PHwCnzNPw=",
      "funding": [
        {
@@ -7645,7 +7690,7 @@
    },
    "node_modules/micromark-factory-title": {
      "version": "2.0.1",
-      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-factory-title/-/micromark-factory-title-2.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-factory-title/-/micromark-factory-title-2.0.1.tgz",
      "integrity": "sha1-I35KpdWKlYY/AQMtnumwkPHebpQ=",
      "funding": [
        {
@@ -7667,7 +7712,7 @@
    },
    "node_modules/micromark-factory-whitespace": {
      "version": "2.0.1",
-      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-factory-whitespace/-/micromark-factory-whitespace-2.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-factory-whitespace/-/micromark-factory-whitespace-2.0.1.tgz",
      "integrity": "sha1-BrJrKYPE0nv8xlezPiUTTUhosLE=",
      "funding": [
        {
@@ -7689,7 +7734,7 @@
    },
    "node_modules/micromark-util-character": {
      "version": "2.1.1",
-      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-util-character/-/micromark-util-character-2.1.1.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-util-character/-/micromark-util-character-2.1.1.tgz",
      "integrity": "sha1-L5h4MaQNTFEKwmHomFLE6XA8zaY=",
      "funding": [
        {
@@ -7709,7 +7754,7 @@
    },
    "node_modules/micromark-util-chunked": {
      "version": "2.0.1",
-      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-util-chunked/-/micromark-util-chunked-2.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-util-chunked/-/micromark-util-chunked-2.0.1.tgz",
      "integrity": "sha1-R/vNk0caP8yrhs/wOEf8NVLbEFE=",
      "funding": [
        {
@@ -7728,7 +7773,7 @@
    },
    "node_modules/micromark-util-classify-character": {
      "version": "2.0.1",
-      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-util-classify-character/-/micromark-util-classify-character-2.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-util-classify-character/-/micromark-util-classify-character-2.0.1.tgz",
      "integrity": "sha1-05n6+cRcoUyLS+mLHqSBvO2Htik=",
      "funding": [
        {
@@ -7749,7 +7794,7 @@
    },
    "node_modules/micromark-util-combine-extensions": {
      "version": "2.0.1",
-      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-util-combine-extensions/-/micromark-util-combine-extensions-2.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-util-combine-extensions/-/micromark-util-combine-extensions-2.0.1.tgz",
      "integrity": "sha1-Kg9JCrCL/1zC/V7sbdDKBPibMKk=",
      "funding": [
        {
@@ -7769,7 +7814,7 @@
    },
    "node_modules/micromark-util-decode-numeric-character-reference": {
      "version": "2.0.2",
-      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-util-decode-numeric-character-reference/-/micromark-util-decode-numeric-character-reference-2.0.2.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-util-decode-numeric-character-reference/-/micromark-util-decode-numeric-character-reference-2.0.2.tgz",
      "integrity": "sha1-/PFbZgl5OI5vEYzba/fXnXPSb+U=",
      "funding": [
        {
@@ -7788,7 +7833,7 @@
    },
    "node_modules/micromark-util-decode-string": {
      "version": "2.0.1",
-      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-util-decode-string/-/micromark-util-decode-string-2.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-util-decode-string/-/micromark-util-decode-string-2.0.1.tgz",
      "integrity": "sha1-bLmVguXScehO/KjmGoB5lNcWHrI=",
      "funding": [
        {
@@ -7810,7 +7855,7 @@
    },
    "node_modules/micromark-util-encode": {
      "version": "2.0.1",
-      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-util-encode/-/micromark-util-encode-2.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-util-encode/-/micromark-util-encode-2.0.1.tgz",
      "integrity": "sha1-DVHRwJVVHPqsNoMmljz1XxX1QLg=",
      "funding": [
        {
@@ -7826,7 +7871,7 @@
    },
    "node_modules/micromark-util-html-tag-name": {
      "version": "2.0.1",
-      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-util-html-tag-name/-/micromark-util-html-tag-name-2.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-util-html-tag-name/-/micromark-util-html-tag-name-2.0.1.tgz",
      "integrity": "sha1-5AQDCWSBmGtBwQZif5j3LU0QuCU=",
      "funding": [
        {
@@ -7842,7 +7887,7 @@
    },
    "node_modules/micromark-util-normalize-identifier": {
      "version": "2.0.1",
-      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-util-normalize-identifier/-/micromark-util-normalize-identifier-2.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-util-normalize-identifier/-/micromark-util-normalize-identifier-2.0.1.tgz",
      "integrity": "sha1-ww13sugyrPZSb4vxqke8nJQ4wW0=",
      "funding": [
        {
@@ -7861,7 +7906,7 @@
    },
    "node_modules/micromark-util-resolve-all": {
      "version": "2.0.1",
-      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-util-resolve-all/-/micromark-util-resolve-all-2.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-util-resolve-all/-/micromark-util-resolve-all-2.0.1.tgz",
      "integrity": "sha1-4aLWLN0jcjCirhGDkCexk4HjHos=",
      "funding": [
        {
@@ -7880,7 +7925,7 @@
    },
    "node_modules/micromark-util-sanitize-uri": {
      "version": "2.0.1",
-      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-util-sanitize-uri/-/micromark-util-sanitize-uri-2.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-util-sanitize-uri/-/micromark-util-sanitize-uri-2.0.1.tgz",
      "integrity": "sha1-q4l4m4GKWHUrc9a1UjhiG3+qj9c=",
      "funding": [
        {
@@ -7901,7 +7946,7 @@
    },
    "node_modules/micromark-util-subtokenize": {
      "version": "2.1.0",
-      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-util-subtokenize/-/micromark-util-subtokenize-2.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-util-subtokenize/-/micromark-util-subtokenize-2.1.0.tgz",
      "integrity": "sha1-2K3lug8xl6HPaimZ+7/mNXoaGe4=",
      "funding": [
        {
@@ -7923,7 +7968,7 @@
    },
    "node_modules/micromark-util-symbol": {
      "version": "2.0.1",
-      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-util-symbol/-/micromark-util-symbol-2.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-util-symbol/-/micromark-util-symbol-2.0.1.tgz",
      "integrity": "sha1-5dpJTo6ysHGg0I+zT2zv7GwKGbg=",
      "funding": [
        {
@@ -7939,7 +7984,7 @@
    },
    "node_modules/micromark-util-types": {
      "version": "2.0.2",
-      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromark-util-types/-/micromark-util-types-2.0.2.tgz",
+      "resolved": "https://registry.npmjs.org/micromark-util-types/-/micromark-util-types-2.0.2.tgz",
      "integrity": "sha1-8AIl9fWg68MlT5bDa2YFxLOTkI4=",
      "funding": [
        {
@@ -8721,9 +8766,9 @@
      }
    },
    "node_modules/readdir-glob/node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
      "license": "MIT",
      "dependencies": {
        "balanced-match": "^4.0.2"
@@ -9799,9 +9844,9 @@
      "license": "0BSD"
    },
    "node_modules/tsx": {
-      "version": "4.23.13",
-      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.13.tgz",
-      "integrity": "sha512-BL5MGkRln6aDYhb0xbQlEAGw743BaZYWdbWtdJOBriYJboKgUUYCadFp2/FpBBZquBC/ezNBn7wMMPx7FDZUDw==",
+      "version": "4.23.15",
+      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.15.tgz",
+      "integrity": "sha512-Yiex1Ovn8z2xPpOWckIiysV1SSyRMY9BkLF++q0yKiDxCqRhosKfMg3janKkiLBwZ5c/YryloKwGZcrEmtwxKw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -9951,16 +9996,16 @@
      }
    },
    "node_modules/typescript-eslint": {
-      "version": "8.70.0",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.70.0.tgz",
-      "integrity": "sha512-P/W5cz70/cQAuKfY3xwQMWWTV7BvJ0mAQmi+9mBcsVPaBUpd6Ohpa+fECv9rBFrQcig86jAiNBFNWUqnTjr4pw==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.70.1.tgz",
+      "integrity": "sha512-AcWG7KDjZ2THNXsgwttMaGmzVi0VFRlFYfqFHYQRbDpF3owuYbuiL8c7UUrd2k8s3PoSfIQrWfrGXfcElrWLYA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.70.0",
-        "@typescript-eslint/parser": "8.70.0",
-        "@typescript-eslint/typescript-estree": "8.70.0",
-        "@typescript-eslint/utils": "8.70.0"
+        "@typescript-eslint/eslint-plugin": "8.70.1",
+        "@typescript-eslint/parser": "8.70.1",
+        "@typescript-eslint/typescript-estree": "8.70.1",
+        "@typescript-eslint/utils": "8.70.1"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -10024,7 +10069,7 @@
    },
    "node_modules/unist-util-stringify-position": {
      "version": "4.0.0",
-      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/unist-util-stringify-position/-/unist-util-stringify-position-4.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-4.0.0.tgz",
      "integrity": "sha1-RJxuIaiA4IVb9aq63rOnQDFKusI=",
      "license": "MIT",
      "dependencies": {
@@ -10367,9 +10412,9 @@
      }
    },
    "node_modules/yaml": {
-      "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
-      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
+      "version": "2.9.1",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
+      "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==",
      "license": "ISC",
      "bin": {
        "yaml": "bin.mjs"
@@ -10460,11 +10505,11 @@
        "lite-matter": "^0.1.2",
        "mdast-util-from-markdown": "^2.0.3",
        "semver": "^7.8.5",
-        "yaml": "^2.9.0"
+        "yaml": "^2.9.1"
      },
      "devDependencies": {
        "@types/node": "^20.19.43",
-        "tsx": "^4.23.13"
+        "tsx": "^4.23.15"
      }
    }
  }
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "codeql",
-  "version": "4.38.1",
+  "version": "4.38.3",
  "private": true,
  "description": "CodeQL action",
  "scripts": {
@@ -39,13 +39,13 @@
    "follow-redirects": "^1.16.0",
    "get-folder-size": "^5.0.0",
    "https-proxy-agent": "^7.0.6",
-    "js-yaml": "^5.4.1",
+    "js-yaml": "^5.4.2",
    "jsonschema": "1.5.0",
    "long": "^5.3.2",
    "node-forge": "^1.4.0",
    "semver": "^7.8.5",
-    "uuid": "^14.0.2",
-    "undici": "^6.28.0"
+    "undici": "^6.28.0",
+    "uuid": "^14.0.2"
  },
  "devDependencies": {
    "@ava/typescript": "6.0.0",
@@ -66,14 +66,14 @@
    "eslint-import-resolver-typescript": "^4.4.5",
    "eslint-plugin-github": "^6.1.2",
    "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jsdoc": "^64.3.8",
+    "eslint-plugin-jsdoc": "^64.5.4",
    "eslint-plugin-no-async-foreach": "^0.1.1",
    "glob": "^13.0.6",
    "globals": "^17.12.0",
    "nock": "^14.0.17",
    "sinon": "^22.1.0",
    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.70.0"
+    "typescript-eslint": "^8.70.1"
  },
  "overrides": {
    "@actions/tool-cache": {
--- a/pr-checks/bundle-changelog.test.ts
+++ b/pr-checks/bundle-changelog.test.ts
@@ -112,7 +112,7 @@ ${NO_CHANGES_STR}`;
 describe("updateChangelog", async () => {
  await it("removes `NO_CHANGES_STR` if present in [UNRELEASED] section", async () => {
    const result = updateChangelog(EMPTY_CHANGELOG, "");
-    assert.ok(!result.includes(NO_CHANGES_STR.trim()));
+    assert.ok(!result.includes(NO_CHANGES_STR));
  });

  await it("doesn't remove `NO_CHANGES_STR` if present in versioned section", async () => {
@@ -120,7 +120,7 @@ describe("updateChangelog", async () => {
      EMPTY_CHANGELOG.replace(UNRELEASED_PLACEHOLDER, "1.2.3"),
      "",
    );
-    assert.ok(result.includes(NO_CHANGES_STR.trim()));
+    assert.ok(result.includes(NO_CHANGES_STR));
  });

  await it("throws if there are no sections", async () => {
--- a/pr-checks/changelog.test.ts
+++ b/pr-checks/changelog.test.ts
@@ -9,17 +9,46 @@ import * as fs from "node:fs";
 import { describe, it } from "node:test";

 import {
+  addBodyLinesToUnreleasedSection,
+  ChangelogSection,
  EMPTY_CHANGELOG,
+  getHeader,
  getReleaseDateString,
+  NO_CHANGES_STR,
  parseChangelog,
  processChangelogForBackports,
  renderChangelog,
  setVersionAndDate,
+  UNRELEASED_PLACEHOLDER,
 } from "./changelog";
 import { CHANGELOG_FILE } from "./config";

 const testDate = new Date(2026, 7, 14);

+describe("getHeader", async () => {
+  function Section(headerLine: string): ChangelogSection {
+    return {
+      headerLine,
+      bodyLines: [],
+    };
+  }
+  await it("returns non-headers unchanged", () => {
+    assert.equal("foo", getHeader(Section("foo")));
+    assert.equal("- bar", getHeader(Section("- bar")));
+  });
+  await it("strips octothorpes", async () => {
+    assert.equal("foo", getHeader(Section("# foo")));
+    assert.equal("foo", getHeader(Section("## foo")));
+    assert.equal("foo", getHeader(Section("### foo")));
+    assert.equal("foo", getHeader(Section("#### foo")));
+    assert.equal("foo", getHeader(Section("##### foo")));
+    assert.equal("foo", getHeader(Section("###### foo")));
+  });
+  await it("strips whitespace", async () => {
+    assert.equal("foo", getHeader(Section("# foo  ")));
+  });
+});
+
 describe("getReleaseDateString", async () => {
  await it("formats dates as expected", async () => {
    assert.equal(getReleaseDateString(testDate), "14 Aug 2026");
@@ -70,3 +99,73 @@ describe("processChangelogForBackports", async () => {
    assert.deepEqual(result.split("\n"), testChangelogResult.split("\n"));
  });
 });
+
+describe("addBodyLinesToUnreleasedSection", async () => {
+  function newChangelogWithSections(sections: ChangelogSection[]) {
+    return {
+      preamble: [],
+      sections,
+    };
+  }
+
+  await it("throws error if '[UNRELEASED]' section is not first", async () => {
+    const invalidChangelog = newChangelogWithSections([
+      {
+        headerLine: "## Release 1.0.0",
+        bodyLines: [],
+      },
+      {
+        headerLine: `## ${UNRELEASED_PLACEHOLDER}`,
+        bodyLines: [],
+      },
+    ]);
+    assert.throws(() =>
+      addBodyLinesToUnreleasedSection(invalidChangelog, ["foo"]),
+    );
+  });
+
+  await it("overwrites 'No user facing changes.'", async () => {
+    const changelog = newChangelogWithSections([
+      {
+        headerLine: `## ${UNRELEASED_PLACEHOLDER}`,
+        bodyLines: ["", NO_CHANGES_STR, ""],
+      },
+    ]);
+
+    addBodyLinesToUnreleasedSection(changelog, ["- foo"]);
+
+    assert.equal(changelog.sections[0].bodyLines.length, 3);
+    assert.deepEqual(changelog.sections[0].bodyLines, ["", "- foo", ""]);
+  });
+
+  await it("does nothing if lines is empty", async () => {
+    const changelog = newChangelogWithSections([
+      {
+        headerLine: `## ${UNRELEASED_PLACEHOLDER}`,
+        bodyLines: ["", NO_CHANGES_STR, ""],
+      },
+    ]);
+    const changelogClone = structuredClone(changelog);
+
+    addBodyLinesToUnreleasedSection(changelog, []);
+
+    assert.deepEqual(changelog, changelogClone);
+  });
+
+  await it("inserts a line", async () => {
+    const changelog = newChangelogWithSections([
+      {
+        headerLine: `## ${UNRELEASED_PLACEHOLDER}`,
+        bodyLines: ["", "- Added a new dependency.", ""],
+      },
+    ]);
+    const lineToInsert = "- foo";
+
+    addBodyLinesToUnreleasedSection(changelog, [lineToInsert]);
+
+    assert.equal(changelog.sections[0].bodyLines.length, 4);
+    assert.ok(
+      changelog.sections[0].bodyLines.some((line) => line === lineToInsert),
+    );
+  });
+});
--- a/pr-checks/changelog.ts
+++ b/pr-checks/changelog.ts
@@ -6,14 +6,16 @@ import { CHANGELOG_FILE, DryRunOption } from "./config";
 export const UNRELEASED_PLACEHOLDER = "[UNRELEASED]";

 /** The default contents for a section in the changelog. */
-export const NO_CHANGES_STR = "No user facing changes.\n\n";
+export const NO_CHANGES_STR = "No user facing changes.";

 /** Placeholder changelog content for a new release. */
 export const EMPTY_CHANGELOG = `# CodeQL Action Changelog

 ## ${UNRELEASED_PLACEHOLDER}

-${NO_CHANGES_STR}`;
+${NO_CHANGES_STR}
+
+`;

 /**
 * Represents sections in a changelog.
@@ -31,6 +33,13 @@ export interface Changelog {
  sections: ChangelogSection[];
 }

+/**
+ * Returns the text of the header (without the '## ' prefix) of the given section.
+ * */
+export function getHeader(section: ChangelogSection): string {
+  return section.headerLine.replace(/^#+\s+/, "").trimEnd();
+}
+
 /** Returns `date` formatted as `DD Mon YYYY`. */
 export function getReleaseDateString(today: Date = new Date()): string {
  return today.toLocaleDateString("en-GB", {
@@ -125,6 +134,42 @@ export function parseChangelog(content: string): Changelog {
  return { preamble, sections };
 }

+/**
+ * Inserts the changenotes `lines` in the `[UNRELEASED]` section of `changelog`.
+ * If the section contains the stock message {@link NO_CHANGES_STR}, then
+ * `lines` will be inserted in place and the stock message will be deleted.
+ *
+ * @throws Error -- if the [UNRELEASED] section does not exist.
+ *
+ * @param changelog The CHANGELOG object to modify.
+ * @param lines The changenotes to insert.
+ */
+export function addBodyLinesToUnreleasedSection(
+  changelog: Changelog,
+  lines: string[],
+) {
+  // Do nothing if there is nothing to insert.
+  if (lines.length === 0) return;
+
+  const unreleasedSection = changelog.sections[0];
+  if (getHeader(unreleasedSection) !== UNRELEASED_PLACEHOLDER) {
+    throw Error(
+      `'${UNRELEASED_PLACEHOLDER}' is not the first section of 'CHANGELOG.md'`,
+    );
+  }
+
+  if (unreleasedSection.bodyLines.includes(NO_CHANGES_STR)) {
+    unreleasedSection.bodyLines = ["", ...lines, ""];
+    return;
+  }
+
+  // The last body line should be a blank line (for spacing).
+  // Remove it so that we can add `lines` and then add the blank line back.
+  unreleasedSection.bodyLines.pop();
+  unreleasedSection.bodyLines.push(...lines);
+  unreleasedSection.bodyLines.push("");
+}
+
 /**
 * Combines an array of lines into a single string by adding line breaks.
 */
@@ -204,7 +249,7 @@ export function processChangelogForBackports(

    // Add an entry if we didn't keep any.
    if (!foundContent) {
-      section.bodyLines.push(NO_CHANGES_STR.trim());
+      section.bodyLines.push(NO_CHANGES_STR);
    }
  }

--- a/pr-checks/changelog/validate.mts
+++ b/pr-checks/changelog/validate.mts
@@ -119,14 +119,3 @@ export function isValidChangenoteFile(filename: string): boolean {

  return isValid;
 }
-
-/**
- * Validates the change-note files of the given list of file paths, ignoring ".gitkeep".
- * @param filepaths A list of filepaths to validate
- * @returns True if all the paths are valid, false otherwise.
- */
-export function isValidAllChangenoteFiles(filepaths: string[]): boolean {
-  return filepaths
-    .filter((f) => f !== ".gitkeep")
-    .reduce((r, filePath) => r && isValidChangenoteFile(filePath), true);
-}
--- a/pr-checks/changelog/validate.test.mts
+++ b/pr-checks/changelog/validate.test.mts
@@ -1,13 +1,10 @@
 import assert from "node:assert/strict";
-import * as fs from "node:fs";
-import * as path from "node:path";
 import { describe, it } from "node:test";

-import { withTmpDir, withTmpFile } from "../../src/util";
+import { withTmpFile } from "../../src/util";

 import {
  hasValidChangenoteCategory,
-  isValidAllChangenoteFiles,
  isValidChangenoteContent,
  isValidChangenoteFile,
  isValidChangenoteFilename,
@@ -187,39 +184,3 @@ await describe("isValidChangenoteFile", async () => {
    );
  });
 });
-
-await describe("isValidAllChangenoteFiles", async () => {
-  await it("accepts list of file paths of valid change-notes", async () => {
-    await withTmpDir(async (tmpDir) => {
-      const fileName1 = path.join(tmpDir, "2026-01-01-fix-bug.md");
-      const fileName2 = path.join(tmpDir, "2026-01-02-add-feature.md");
-      fs.writeFileSync(fileName1, "---\ncategory: fix\n---\n- Fixed a bug\n");
-      fs.writeFileSync(
-        fileName2,
-        "---\ncategory: feature\n---\n- Added a feature\n",
-      );
-      assert.equal(isValidAllChangenoteFiles([fileName1, fileName2]), true);
-    });
-  });
-
-  await it("accepts the empty list", async () => {
-    assert.equal(isValidAllChangenoteFiles([]), true);
-  });
-
-  await it("accepts list of .gitkeep", async () => {
-    assert.equal(isValidAllChangenoteFiles([".gitkeep"]), true);
-  });
-
-  await it("rejects list containing a file path to an invalid change-note", async () => {
-    await withTmpDir(async (tmpDir) => {
-      const fileName1 = path.join(tmpDir, "2026-01-01-fix-bug.md");
-      const fileName2 = path.join(tmpDir, "2026-01-02-wrong-category.md");
-      fs.writeFileSync(fileName1, "---\ncategory: fix\n---\n- Fixed a bug\n");
-      fs.writeFileSync(
-        fileName2,
-        "---\ncategory: foobar\n---\n- Added a feature\n",
-      );
-      assert.equal(isValidAllChangenoteFiles([fileName1, fileName2]), false);
-    });
-  });
-});
--- a/pr-checks/changenotes.mts
+++ b/pr-checks/changenotes.mts
@@ -3,21 +3,64 @@
 import * as fs from "node:fs";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
+import path from "path";

-import { isValidAllChangenoteFiles } from "./changelog/validate.mjs";
+import { ExitCode } from "@actions/core";
+import { matter } from "lite-matter";
+
+import {
+  addBodyLinesToUnreleasedSection,
+  parseChangelog,
+  renderChangelog,
+  withChangelog,
+} from "./changelog";
+import { isValidChangenoteFile } from "./changelog/validate.mjs";
 import { CHANGENOTES_DIR } from "./config";

+/**
+ * Describes a changenote file, including its file path, frontmatter, and content.
+ */
+interface ChangenoteFile {
+  absolutePath: string;
+  data: Record<string, any>;
+  content: string;
+}
+
+/**
+ * Returns the absolute file paths of all files in
+ * {@link CHANGENOTES_DIR} (except ".gitkeep").
+ * */
+function listUnreleasedChangenoteDir(): string[] {
+  return fs
+    .readdirSync(CHANGENOTES_DIR)
+    .filter((name) => name !== ".gitkeep")
+    .map((name) => path.join(CHANGENOTES_DIR, name));
+}
+
+/**
+ * Scans the {@link CHANGENOTES_DIR} directory for changenote files
+ * and returns a parsed listing of those changenote files.
+ */
+function getChangenotes(): ChangenoteFile[] {
+  return listUnreleasedChangenoteDir().map((absolutePath) => {
+    return {
+      absolutePath,
+      ...matter(fs.readFileSync(absolutePath, "utf-8")),
+    };
+  });
+}
+
 const entryPoint = process.argv[1];
 if (entryPoint && import.meta.url === pathToFileURL(entryPoint).href) {
  try {
    process.exit(main());
  } catch (error) {
    console.error(error);
-    process.exit(1);
+    process.exit(ExitCode.Failure);
  }
 }

-function main(): number {
+function main(): ExitCode {
  const { positionals } = parseArgs({
    allowPositionals: true,
    strict: true,
@@ -27,24 +70,59 @@ function main(): number {
    case undefined:
    case "help":
      return usage();
+    case "assemble":
+      return assemble();
    case "validate":
      return validate();
    default:
      console.error(`Unknown command: ${command}`);
-      return 1;
+      return ExitCode.Failure;
  }
 }

-function usage(): number {
-  console.log(`Usage: changenotes.mts validate`);
-  return 0;
+function usage(): ExitCode {
+  const message =
+    "Usage: changenotes.mts assemble\n" +
+    "       changenotes.mts validate\n" +
+    "       changenotes.mts help";
+  console.log(message);
+  return ExitCode.Success;
 }

-function validate(): number {
+function assemble(): ExitCode {
  try {
-    if (isValidAllChangenoteFiles(fs.readdirSync(CHANGENOTES_DIR))) {
+    const changenotes = getChangenotes();
+    const changenoteBodies = changenotes.map((c) => c.content);
+    const changenotePaths = changenotes.map((c) => c.absolutePath);
+
+    withChangelog((contents) => {
+      const changelog = parseChangelog(contents);
+      addBodyLinesToUnreleasedSection(changelog, changenoteBodies);
+      return renderChangelog(changelog);
+    }, {});
+
+    // Delete changenotes only after successful processing.
+    for (const p of changenotePaths) {
+      fs.unlinkSync(p);
+    }
+
+    return ExitCode.Success;
+  } catch (e) {
+    console.error("Failed to assemble changenotes to 'CHANGELOG.md'", e);
+  }
+
+  return ExitCode.Failure;
+}
+
+function validate(): ExitCode {
+  try {
+    const allChangenotesValid = getChangenotes().reduce(
+      (r, changenote) => r && isValidChangenoteFile(changenote.absolutePath),
+      true,
+    );
+    if (allChangenotesValid) {
      console.log(`All changenotes in '${CHANGENOTES_DIR}' are valid.`);
-      return 0;
+      return ExitCode.Success;
    }
  } catch (error) {
    console.error(
@@ -52,5 +130,5 @@ function validate(): number {
      error,
    );
  }
-  return 1;
+  return ExitCode.Failure;
 }
--- a/pr-checks/checks/rubocop-multi-language.yml
+++ b/pr-checks/checks/rubocop-multi-language.yml
@@ -5,7 +5,7 @@ versions:
  - default
 steps:
  - name: Set up Ruby
-    uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+    uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
    with:
      ruby-version: 2.6
  - name: Install Code Scanning integration
--- a/pr-checks/package.json
+++ b/pr-checks/package.json
@@ -10,10 +10,10 @@
    "lite-matter": "^0.1.2",
    "mdast-util-from-markdown": "^2.0.3",
    "semver": "^7.8.5",
-    "yaml": "^2.9.0"
+    "yaml": "^2.9.1"
  },
  "devDependencies": {
    "@types/node": "^20.19.43",
-    "tsx": "^4.23.13"
+    "tsx": "^4.23.15"
  }
 }
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -221,6 +221,12 @@ const languageSetups: LanguageSetups = {
          cache: "npm",
        },
      },
+      // Install a new enough version of `npm` to understand `min-release-age`
+      // that is still compatible with Node 20.
+      {
+        name: "Install newer npm",
+        run: "npm install -g npm@11.19.1",
+      },
      {
        name: "Install dependencies",
        run: "npm ci",
--- a/src/action-common.ts
+++ b/src/action-common.ts
@@ -19,6 +19,10 @@ export interface BaseState {
  name: ActionName;
  /** When the Action was started. */
  startedAt: Date;
+  /** The platform the Action is running on. */
+  platform: NodeJS.Platform;
+  /** The architecture of the host. */
+  arch: NodeJS.Architecture;
 }

 /** Describes different state features that an Action may have. */
@@ -98,6 +102,8 @@ export async function runInActions(action: Action) {
    const actionState = {
      name: action.name,
      startedAt,
+      platform: process.platform,
+      arch: process.arch,
      logger,
      env,
      actions: actionsEnv,
--- a/src/actions-util.ts
+++ b/src/actions-util.ts
@@ -14,6 +14,7 @@ import {
  getCodeQLDatabasePath,
  ConfigurationError,
  getEnv,
+  getErrorMessage,
 } from "./util";

 /**
@@ -412,14 +413,23 @@ export const persistInputs = function (env: Env = getEnv()) {
 /**
 * Restores all inputs to the action from the persisted state.
 */
-export const restoreInputs = function () {
-  const persistedInputs = core.getState(persistedInputsKey);
-  if (persistedInputs) {
-    for (const [name, value] of JSON.parse(persistedInputs)) {
-      process.env[name] = value;
+export function restoreInputs(logger: Logger) {
+  try {
+    const persistedInputsValue = core.getState(persistedInputsKey);
+    if (persistedInputsValue) {
+      const persistedInputs = JSON.parse(persistedInputsValue);
+
+      for (const [name, value] of persistedInputs) {
+        process.env[name] = value;
+      }
    }
+  } catch (err) {
+    logger.error(`Unable to restore inputs: ${getErrorMessage(err)}`);
+    throw new Error(
+      "Failed to restore inputs from the state set by this action's main execution.",
+    );
  }
-};
+}

 export interface PullRequestBranches {
  base: string;
--- a/src/analyze-action-post.ts
+++ b/src/analyze-action-post.ts
@@ -25,8 +25,8 @@ export async function runWrapper() {
  // possible, and only use safe functions outside.

  try {
-    actionsUtil.restoreInputs();
    const logger = getActionsLogger();
+    actionsUtil.restoreInputs(logger);
    const gitHubVersion = await getGitHubVersion();
    checkGitHubVersionInRange(gitHubVersion, logger);

--- a/src/analyze-action.ts
+++ b/src/analyze-action.ts
@@ -212,7 +212,11 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
  await runAutobuild(config, BuiltInLanguage.go, logger);
 }

-async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
+async function run({
+  startedAt,
+  logger,
+  actions,
+}: ActionState<["Base", "Logger", "Actions"]>) {
  // To capture errors appropriately, keep as much code within the try-catch as
  // possible, and only use safe functions outside.

@@ -307,8 +311,13 @@ async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
      logger,
    );

+    const checkoutPath = actions.getRequiredInput("checkout_path");
+
    // Setup diff informed analysis if needed (based on whether init created the file)
-    const diffRangePackDir = await setupDiffInformedQueryRun(logger);
+    const diffRangePackDir = await setupDiffInformedQueryRun(
+      logger,
+      checkoutPath,
+    );

    await warnIfGoInstalledAfterInit(config, logger);
    await runAutobuildIfLegacyGoWorkflow(config, logger);
@@ -354,7 +363,6 @@ async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
      actionsUtil.getOptionalInput("upload"),
    );
    if (runStats) {
-      const checkoutPath = actionsUtil.getRequiredInput("checkout_path");
      const category = actionsUtil.getOptionalInput("category");

      uploadResults = await postProcessAndUploadSarif(
@@ -388,18 +396,23 @@ async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
    // Possibly upload the overlay-base database to actions cache.
    // Note: Take care with the ordering of this call since databases may be cleaned up
    // at the `overlay` level.
-    await cleanupAndUploadOverlayBaseDatabaseToCache(codeql, config, logger);
+    await cleanupAndUploadOverlayBaseDatabaseToCache(
+      codeql,
+      config,
+      logger,
+      checkoutPath,
+    );

    // Possibly upload the database bundles for remote queries.
    // Note: Take care with the ordering of this call since databases may be cleaned up
    // at the `overlay` or `clear` level.
    databaseUploadResults = await cleanupAndUploadDatabases(
+      { logger, features },
      repositoryNwo,
      codeql,
      config,
      apiDetails,
-      features,
-      logger,
+      checkoutPath,
    );

    // Possibly upload the TRAP caches for later re-use
--- a/src/analyze.ts
+++ b/src/analyze.ts
@@ -5,7 +5,7 @@ import { performance } from "perf_hooks";
 import * as io from "@actions/io";
 import * as yaml from "js-yaml";

-import { getTemporaryDirectory, getRequiredInput } from "./actions-util";
+import { getTemporaryDirectory } from "./actions-util";
 import * as analyses from "./analyses";
 import { setupCppAutobuild } from "./autobuild";
 import { type CodeQL } from "./codeql";
@@ -233,6 +233,7 @@ async function finalizeDatabaseCreation(
 */
 export async function setupDiffInformedQueryRun(
  logger: Logger,
+  checkoutPath: string,
 ): Promise<string | undefined> {
  return await withGroupAsync(
    "Generating diff range extension pack",
@@ -245,7 +246,6 @@ export async function setupDiffInformedQueryRun(
        return undefined;
      }

-      const checkoutPath = getRequiredInput("checkout_path");
      const packDir = writeDiffRangeDataExtensionPack(
        logger,
        diffRanges,
--- a/src/api-client.test.ts
+++ b/src/api-client.test.ts
@@ -111,103 +111,115 @@ test.serial("getGitHubVersion for GHEC-DR", async (t) => {
  t.deepEqual({ type: util.GitHubVariant.GHEC_DR }, gheDotcom);
 });

-test.serial(
-  "wrapApiConfigurationError correctly wraps specific configuration errors",
-  (t) => {
+test("wrapApiConfigurationError doesn't wrap errors it isn't supposed to", (t) => {
+  const unwrappedErrors = [
    // We don't reclassify arbitrary errors
-    const arbitraryError = new Error("arbitrary error");
-    let res = api.wrapApiConfigurationError(arbitraryError);
-    t.is(res, arbitraryError);
+    new Error("arbitrary error"),
+    // Same goes for arbitrary strings
+    "arbitrary error",
+    // If an HTTP error doesn't contain a specific error message, we don't wrap it.
+    new util.HTTPError("arbitrary HTTP error", 456),
+  ];

-    // Same goes for arbitrary errors
-    const configError = new util.ConfigurationError("arbitrary error");
-    res = api.wrapApiConfigurationError(configError);
-    t.is(res, configError);
-
-    // If an HTTP error doesn't contain a specific error message, we don't
-    // wrap is an an API error.
-    const httpError = new util.HTTPError("arbitrary HTTP error", 456);
-    res = api.wrapApiConfigurationError(httpError);
-    t.is(res, httpError);
-
-    // For other HTTP errors, we wrap them as Configuration errors if they contain
-    // specific error messages.
-    const httpNotFoundError = new util.HTTPError("commit not found", 404);
-    res = api.wrapApiConfigurationError(httpNotFoundError);
-    t.deepEqual(res, new util.ConfigurationError("commit not found"));
-
-    const refNotFoundError = new util.HTTPError(
-      "ref 'refs/heads/jitsi' not found in this repository - https://docs.github.com/rest",
-      404,
-    );
-    res = api.wrapApiConfigurationError(refNotFoundError);
-    t.deepEqual(
+  for (const unwrappedError of unwrappedErrors) {
+    const res = api.wrapApiConfigurationError(unwrappedError);
+    t.is(
      res,
-      new util.ConfigurationError(
-        "ref 'refs/heads/jitsi' not found in this repository - https://docs.github.com/rest",
-      ),
+      unwrappedError,
+      `${util.getErrorMessage(unwrappedError)} should not be wrapped by wrapApiConfigurationError`,
    );
+  }
+});

-    const apiRateLimitError = new util.HTTPError(
-      "API rate limit exceeded for installation",
-      403,
-    );
-    res = api.wrapApiConfigurationError(apiRateLimitError);
-    t.deepEqual(
-      res,
-      new util.ConfigurationError("API rate limit exceeded for installation"),
-    );
+test("wrapApiConfigurationError correctly wraps specific configuration errors", (t) => {
+  // For other HTTP errors, we wrap them as Configuration errors if they contain
+  // specific error messages.
+  const httpNotFoundError = new util.HTTPError("commit not found", 404);
+  const refNotFoundError = new util.HTTPError(
+    "ref 'refs/heads/jitsi' not found in this repository - https://docs.github.com/rest",
+    404,
+  );
+  const apiRateLimitError = new util.HTTPError(
+    "API rate limit exceeded for installation",
+    403,
+  );
+  const resourceNotAccessibleError = new util.HTTPError(
+    "Resource not accessible by integration",
+    403,
+  );
+  const errorsToWrap = [
+    httpNotFoundError,
+    refNotFoundError,
+    apiRateLimitError,
+    resourceNotAccessibleError,
+  ];

-    const tokenSuggestionMessage =
-      "Please check that your token is valid and has the required permissions: contents: read, security-events: write";
-    const badCredentialsError = new util.HTTPError("Bad credentials", 401);
-    res = api.wrapApiConfigurationError(badCredentialsError);
+  for (const errorToWrap of errorsToWrap) {
+    const res = api.wrapApiConfigurationError(errorToWrap);
+    t.deepEqual(res, new util.ConfigurationError(errorToWrap.message));
+  }
+});
+
+test("wrapApiConfigurationError wraps token errors", async (t) => {
+  const tokenSuggestionMessage =
+    "Please check that your token is valid and has the required permissions: contents: read, security-events: write";
+  const badCredentialsError = new util.HTTPError("Bad credentials", 401);
+  const notFoundError = new util.HTTPError("Not Found", 404);
+  const errorsToWrap = [badCredentialsError, notFoundError];
+
+  for (const errorToWrap of errorsToWrap) {
+    const res = api.wrapApiConfigurationError(errorToWrap);
    t.deepEqual(res, new util.ConfigurationError(tokenSuggestionMessage));
+  }
+});

-    const notFoundError = new util.HTTPError("Not Found", 404);
-    res = api.wrapApiConfigurationError(notFoundError);
-    t.deepEqual(res, new util.ConfigurationError(tokenSuggestionMessage));
+test("wrapApiConfigurationError wraps enablement errors", async (t) => {
+  // Enablement errors.
+  const enablementErrorMessages = [
+    "Code Security must be enabled for this repository to use code scanning",
+    "Advanced Security must be enabled for this repository to use code scanning",
+    "Code Scanning is not enabled for this repository. Please enable code scanning in the repository settings.",
+    "Code quality is not enabled for this repository. Please enable code quality in the repository settings.",
+  ];
+  const transforms = [
+    (msg: string) => msg,
+    (msg: string) => msg.toLowerCase(),
+    (msg: string) => msg.toLocaleUpperCase(),
+  ];

-    const resourceNotAccessibleError = new util.HTTPError(
-      "Resource not accessible by integration",
-      403,
-    );
-    res = api.wrapApiConfigurationError(resourceNotAccessibleError);
-    t.deepEqual(
-      res,
-      new util.ConfigurationError("Resource not accessible by integration"),
-    );
-
-    // Enablement errors.
-    const enablementErrorMessages = [
-      "Code Security must be enabled for this repository to use code scanning",
-      "Advanced Security must be enabled for this repository to use code scanning",
-      "Code Scanning is not enabled for this repository. Please enable code scanning in the repository settings.",
-      "Code quality is not enabled for this repository. Please enable code quality in the repository settings.",
-    ];
-    const transforms = [
-      (msg: string) => msg,
-      (msg: string) => msg.toLowerCase(),
-      (msg: string) => msg.toLocaleUpperCase(),
-    ];
-
-    for (const enablementErrorMessage of enablementErrorMessages) {
-      for (const transform of transforms) {
-        const enablementError = new util.HTTPError(
-          transform(enablementErrorMessage),
-          403,
-        );
-        res = api.wrapApiConfigurationError(enablementError);
-        t.deepEqual(
-          res,
-          new util.ConfigurationError(
-            api.getFeatureEnablementError(enablementError.message),
-          ),
-        );
-      }
+  for (const enablementErrorMessage of enablementErrorMessages) {
+    for (const transform of transforms) {
+      const enablementError = new util.HTTPError(
+        transform(enablementErrorMessage),
+        403,
+      );
+      const res = api.wrapApiConfigurationError(enablementError);
+      t.deepEqual(
+        res,
+        new util.ConfigurationError(
+          api.getFeatureEnablementError(enablementError.message),
+        ),
+      );
    }
-  },
-);
+  }
+});
+
+test("wrapApiConfigurationError doesn't double-wrap errors", async (t) => {
+  // This test checks that errors don't get wrapped a second time if `wrapApiConfigurationError`
+  // is called on an error that was already wrapped by a previous call to `wrapApiConfigurationError`.
+  // Start by calling `wrapApiConfigurationError` on an unwrapped error that should be wrapped:
+  const unwrappedError = new util.HTTPError("commit not found", 404);
+  const wrappedError = api.wrapApiConfigurationError(unwrappedError);
+
+  // Sanity-check that it was wrapped, as expected.
+  t.deepEqual(
+    wrappedError,
+    new util.ConfigurationError(unwrappedError.message),
+  );
+
+  // The result of the second call should be exactly `wrappedError`:
+  t.is(api.wrapApiConfigurationError(wrappedError), wrappedError);
+});

 test("getRegistryProxy - returns undefined if the proxy is not configured", async (t) => {
  const target = callee(api.getRegistryProxy).withArgs();
--- a/src/api-client.ts
+++ b/src/api-client.ts
@@ -219,25 +219,31 @@ export async function getGitHubVersionFromApi(
    return { type: GitHubVariant.DOTCOM };
  }

-  // Doesn't strictly have to be the meta endpoint as we're only
-  // using the response headers which are available on every request.
-  //
-  // See https://docs.github.com/en/rest/meta/meta#get-github-meta-information.
-  // eslint-disable-next-line @typescript-eslint/no-unsafe-call
-  const response = await apiClient.rest.meta.get();
+  try {
+    // Doesn't strictly have to be the meta endpoint as we're only
+    // using the response headers which are available on every request.
+    //
+    // See https://docs.github.com/en/rest/meta/meta#get-github-meta-information.
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-call
+    const response = await apiClient.rest.meta.get();

-  // This happens on dotcom, although we expect to have already returned in that
-  // case. This can also serve as a fallback in cases we haven't foreseen.
-  if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === undefined) {
-    return { type: GitHubVariant.DOTCOM };
+    // This happens on dotcom, although we expect to have already returned in that
+    // case. This can also serve as a fallback in cases we haven't foreseen.
+    if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === undefined) {
+      return { type: GitHubVariant.DOTCOM };
+    }
+
+    if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === "ghe.com") {
+      return { type: GitHubVariant.GHEC_DR };
+    }
+
+    const version = response.headers[
+      GITHUB_ENTERPRISE_VERSION_HEADER
+    ] as string;
+    return { type: GitHubVariant.GHES, version };
+  } catch (err) {
+    throw wrapApiConfigurationError(err);
  }
-
-  if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === "ghe.com") {
-    return { type: GitHubVariant.GHEC_DR };
-  }
-
-  const version = response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] as string;
-  return { type: GitHubVariant.GHES, version };
 }

 /**
@@ -249,9 +255,10 @@ export async function getGitHubVersionFromApi(
 */
 export async function getGitHubVersion(): Promise<GitHubVersion> {
  if (cachedGitHubVersion === undefined) {
+    const apiDetails = getApiDetails();
    cachedGitHubVersion = await getGitHubVersionFromApi(
-      getApiClient(),
-      getApiDetails(),
+      createApiClientWithDetails(apiDetails),
+      apiDetails,
    );
  }
  return cachedGitHubVersion;
@@ -414,7 +421,14 @@ export function getFeatureEnablementError(message: string): string {
  return `Please verify that the necessary features are enabled: ${message}`;
 }

-export function wrapApiConfigurationError(e: unknown) {
+/**
+ * Decides whether `e` is a known error returned by the GitHub API that we should
+ * classify as a `ConfigurationError`.
+ *
+ * @param e The error to classify.
+ * @returns Either `e` or a corresponding `ConfigurationError`.
+ */
+export function wrapApiConfigurationError<T>(e: T): T | ConfigurationError {
  const httpError = asHTTPError(e);
  if (httpError !== undefined) {
    if (
--- a/src/codeql-bundle.test.ts
+++ b/src/codeql-bundle.test.ts
@@ -1,7 +1,26 @@
 import test from "ava";

-import { getCodeQLBundleFromUrl } from "./codeql-bundle";
+import { getCodeQLBundleFromUrl, getCodeQLBundleName } from "./codeql-bundle";
 import { BuiltInLanguage } from "./languages";
+import { BundlePlatform } from "./platform";
+
+test("getCodeQLBundleName returns a per-language bundle name only when a language is specified", (t) => {
+  t.is(
+    getCodeQLBundleName("zstd", BundlePlatform.Linux64, BuiltInLanguage.java),
+    "codeql-bundle-java-linux64.tar.zst",
+  );
+  t.is(
+    getCodeQLBundleName("zstd", BundlePlatform.Linux64),
+    "codeql-bundle-linux64.tar.zst",
+  );
+});
+
+test("getCodeQLBundleName names the Swift bundle for macOS", (t) => {
+  t.is(
+    getCodeQLBundleName("zstd", BundlePlatform.Osx64, BuiltInLanguage.swift),
+    "codeql-bundle-swift-osx64.tar.zst",
+  );
+});

 for (const [assetName, language] of [
  ["codeql-bundle-java-linux64.tar.zst", BuiltInLanguage.java],
--- a/src/codeql-bundle.ts
+++ b/src/codeql-bundle.ts
@@ -1,4 +1,6 @@
 import { BuiltInLanguage, parseBuiltInLanguage } from "./languages";
+import { BundlePlatform } from "./platform";
+import type { CompressionMethod } from "./tar";

 /** Describes the contents and location of a downloadable CodeQL bundle. */
 export type CodeQLBundle =
@@ -11,6 +13,42 @@ export type CodeQLBundle =
      combinedBundleURL?: string;
    };

+/** A resolved download, including its bundle identity and version. */
+export interface CodeQLDownloadSource {
+  /** Distinguishes downloads from local archives and cached installations. */
+  sourceType: "download";
+  /** The bundle to download. */
+  bundle: CodeQLBundle;
+  /** The compression format of the bundle archive. */
+  compressionMethod: CompressionMethod;
+  /** Bundle version of the tools, if known. */
+  bundleVersion?: string;
+  /** Requested CLI version, if known. */
+  cliVersion?: string;
+  /** Resolved version for telemetry, independent of whether the bundle can be cached. */
+  toolsVersion: string;
+}
+
+/** Returns the exact bundle asset name for a platform and optional language. */
+export function getCodeQLBundleName(
+  compressionMethod: CompressionMethod,
+  platform: BundlePlatform | undefined,
+  language?: BuiltInLanguage,
+): string {
+  const extensions: Record<CompressionMethod, string> = {
+    gzip: ".tar.gz",
+    zstd: ".tar.zst",
+  };
+  const extension = extensions[compressionMethod];
+  if (platform === undefined) {
+    return `codeql-bundle${extension}`;
+  }
+  if (language !== undefined) {
+    return `codeql-bundle-${language}-${platform}${extension}`;
+  }
+  return `codeql-bundle-${platform}${extension}`;
+}
+
 const PER_LANGUAGE_BUNDLE_NAME =
  /^codeql-bundle-(.+)-(?:linux64|osx64|win64)\.tar\.(?:gz|zst)$/;

--- a/src/codeql.ts
+++ b/src/codeql.ts
@@ -937,6 +937,7 @@ async function getCodeQLForCmd(
          "--format=json",
          `--language=${language}`,
          "--extractor-include-aliases",
+          "-J-XX:-UsePerfData",
          ...getExtraOptionsFromEnv(["resolve", "extractor"]),
        ],
        {
@@ -951,7 +952,13 @@ async function getCodeQLForCmd(
          },
        },
      ).exec();
-      return JSON.parse(extractorPath) as string;
+      try {
+        return JSON.parse(extractorPath) as string;
+      } catch (err) {
+        throw new Error(
+          `Failed to parse extractor path for '${language}' from CLI: ${getErrorMessage(err)}\nOutput was: ${extractorPath}`,
+        );
+      }
    },
    async resolveQueriesStartingPacks(queries: string[]): Promise<string[]> {
      const codeqlArgs = [
--- a/src/config-utils.ts
+++ b/src/config-utils.ts
@@ -1425,7 +1425,12 @@ export async function getConfig(
  }
  if (config.version !== getActionVersion()) {
    throw new ConfigurationError(
-      `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`,
+      [
+        `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'.`,
+        "All steps in a workflow that use `github/codeql-action` must use the same version to work correctly.",
+        "If you are using Dependabot to manage dependency updates, you can configure a dependency group to update all `github/codeql-action` steps at the same time.",
+        "For more information, see https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#groups--",
+      ].join(" "),
    );
  }

--- a/src/database-upload.test.ts
+++ b/src/database-upload.test.ts
@@ -20,8 +20,9 @@ import {
  checkExpectedLogMessages,
  createFeatures,
  createTestConfig,
-  getRecordingLogger,
-  LoggedMessage,
+  getTestEnv,
+  initAllState,
+  RecordingLogger,
  setupActionsVars,
  setupTests,
 } from "./testing-utils";
@@ -90,23 +91,24 @@ test.serial(
  "Abort database upload if 'upload-database' input set to false",
  async (t) => {
    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
+      const env = getTestEnv();
+      setupActionsVars(tmpDir, tmpDir, {}, env);
      sinon
        .stub(actionsUtil, "getRequiredInput")
        .withArgs("upload-database")
        .returns("false");
      sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);

-      const loggedMessages: LoggedMessage[] = [];
+      const logger = new RecordingLogger();
      await cleanupAndUploadDatabases(
+        initAllState({ env, logger }),
        testRepoName,
        getCodeQL(),
        getTestConfig(tmpDir),
        testApiDetails,
-        createFeatures([]),
-        getRecordingLogger(loggedMessages),
+        "",
      );
-      checkExpectedLogMessages(t, loggedMessages, [
+      checkExpectedLogMessages(t, logger.messages, [
        "Database upload disabled in workflow. Skipping upload.",
      ]);
    });
@@ -117,7 +119,8 @@ test.serial(
  "Abort database upload if 'analysis-kinds: code-scanning' is not enabled",
  async (t) => {
    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
+      const env = getTestEnv();
+      setupActionsVars(tmpDir, tmpDir, {}, env);
      sinon
        .stub(actionsUtil, "getRequiredInput")
        .withArgs("upload-database")
@@ -126,8 +129,9 @@ test.serial(

      await mockHttpRequests(201);

-      const loggedMessages: LoggedMessage[] = [];
+      const logger = new RecordingLogger();
      await cleanupAndUploadDatabases(
+        initAllState({ env, logger }),
        testRepoName,
        getCodeQL(),
        {
@@ -135,10 +139,9 @@ test.serial(
          analysisKinds: [AnalysisKind.CodeQuality],
        },
        testApiDetails,
-        createFeatures([]),
-        getRecordingLogger(loggedMessages),
+        "",
      );
-      checkExpectedLogMessages(t, loggedMessages, [
+      checkExpectedLogMessages(t, logger.messages, [
        "Not uploading database because 'analysis-kinds: code-scanning' is not enabled.",
      ]);
    });
@@ -147,7 +150,8 @@ test.serial(

 test.serial("Abort database upload if running against GHES", async (t) => {
  await withTmpDir(async (tmpDir) => {
-    setupActionsVars(tmpDir, tmpDir);
+    const env = getTestEnv();
+    setupActionsVars(tmpDir, tmpDir, {}, env);
    sinon
      .stub(actionsUtil, "getRequiredInput")
      .withArgs("upload-database")
@@ -157,16 +161,16 @@ test.serial("Abort database upload if running against GHES", async (t) => {
    const config = getTestConfig(tmpDir);
    config.gitHubVersion = { type: GitHubVariant.GHES, version: "3.0" };

-    const loggedMessages: LoggedMessage[] = [];
+    const logger = new RecordingLogger();
    await cleanupAndUploadDatabases(
+      initAllState({ env, logger }),
      testRepoName,
      getCodeQL(),
      config,
      testApiDetails,
-      createFeatures([]),
-      getRecordingLogger(loggedMessages),
+      "",
    );
-    checkExpectedLogMessages(t, loggedMessages, [
+    checkExpectedLogMessages(t, logger.messages, [
      "Not running against github.com or GHEC-DR. Skipping upload.",
    ]);
  });
@@ -176,23 +180,24 @@ test.serial(
  "Abort database upload if not analyzing default branch",
  async (t) => {
    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
+      const env = getTestEnv();
+      setupActionsVars(tmpDir, tmpDir, {}, env);
      sinon
        .stub(actionsUtil, "getRequiredInput")
        .withArgs("upload-database")
        .returns("true");
      sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(false);

-      const loggedMessages: LoggedMessage[] = [];
+      const logger = new RecordingLogger();
      await cleanupAndUploadDatabases(
+        initAllState({ env, logger }),
        testRepoName,
        getCodeQL(),
        getTestConfig(tmpDir),
        testApiDetails,
-        createFeatures([]),
-        getRecordingLogger(loggedMessages),
+        "",
      );
-      checkExpectedLogMessages(t, loggedMessages, [
+      checkExpectedLogMessages(t, logger.messages, [
        "Not analyzing default branch. Skipping upload.",
      ]);
    });
@@ -203,7 +208,8 @@ test.serial(
  "Don't crash if uploading a database fails with a non-retryable error",
  async (t) => {
    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
+      const env = getTestEnv();
+      setupActionsVars(tmpDir, tmpDir, {}, env);
      sinon
        .stub(actionsUtil, "getRequiredInput")
        .withArgs("upload-database")
@@ -212,17 +218,17 @@ test.serial(

      const databaseUploadSpy = await mockHttpRequests(422);

-      const loggedMessages: LoggedMessage[] = [];
+      const logger = new RecordingLogger();
      await cleanupAndUploadDatabases(
+        initAllState({ env, logger }),
        testRepoName,
        getCodeQL(),
        getTestConfig(tmpDir),
        testApiDetails,
-        createFeatures([]),
-        getRecordingLogger(loggedMessages),
+        "",
      );

-      checkExpectedLogMessages(t, loggedMessages, [
+      checkExpectedLogMessages(t, logger.messages, [
        "Failed to upload database for javascript: some error message",
      ]);

@@ -236,7 +242,8 @@ test.serial(
  "Don't crash if uploading a database fails with a retryable error",
  async (t) => {
    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
+      const env = getTestEnv();
+      setupActionsVars(tmpDir, tmpDir, {}, env);
      sinon
        .stub(actionsUtil, "getRequiredInput")
        .withArgs("upload-database")
@@ -251,17 +258,17 @@ test.serial(
        .stub(global, "setTimeout")
        .callsFake((fn: () => void) => originalSetTimeout(fn, 0));

-      const loggedMessages: LoggedMessage[] = [];
+      const logger = new RecordingLogger();
      await cleanupAndUploadDatabases(
+        initAllState({ env, logger }),
        testRepoName,
        getCodeQL(),
        getTestConfig(tmpDir),
        testApiDetails,
-        createFeatures([]),
-        getRecordingLogger(loggedMessages),
+        "",
      );

-      checkExpectedLogMessages(t, loggedMessages, [
+      checkExpectedLogMessages(t, logger.messages, [
        "Failed to upload database for javascript: some error message",
      ]);

@@ -279,7 +286,8 @@ test.serial(

 test.serial("Successfully uploading a database to github.com", async (t) => {
  await withTmpDir(async (tmpDir) => {
-    setupActionsVars(tmpDir, tmpDir);
+    const env = getTestEnv();
+    setupActionsVars(tmpDir, tmpDir, {}, env);
    sinon
      .stub(actionsUtil, "getRequiredInput")
      .withArgs("upload-database")
@@ -288,16 +296,16 @@ test.serial("Successfully uploading a database to github.com", async (t) => {

    await mockHttpRequests(201);

-    const loggedMessages: LoggedMessage[] = [];
+    const logger = new RecordingLogger();
    await cleanupAndUploadDatabases(
+      initAllState({ env, logger }),
      testRepoName,
      getCodeQL(),
      getTestConfig(tmpDir),
      testApiDetails,
-      createFeatures([]),
-      getRecordingLogger(loggedMessages),
+      "",
    );
-    checkExpectedLogMessages(t, loggedMessages, [
+    checkExpectedLogMessages(t, logger.messages, [
      "Successfully uploaded database for javascript",
    ]);
  });
@@ -305,7 +313,8 @@ test.serial("Successfully uploading a database to github.com", async (t) => {

 test.serial("Successfully uploading a database to GHEC-DR", async (t) => {
  await withTmpDir(async (tmpDir) => {
-    setupActionsVars(tmpDir, tmpDir);
+    const env = getTestEnv();
+    setupActionsVars(tmpDir, tmpDir, {}, env);
    sinon
      .stub(actionsUtil, "getRequiredInput")
      .withArgs("upload-database")
@@ -314,8 +323,9 @@ test.serial("Successfully uploading a database to GHEC-DR", async (t) => {

    const databaseUploadSpy = await mockHttpRequests(201);

-    const loggedMessages: LoggedMessage[] = [];
+    const logger = new RecordingLogger();
    await cleanupAndUploadDatabases(
+      initAllState({ env, logger }),
      testRepoName,
      getCodeQL(),
      getTestConfig(tmpDir),
@@ -324,10 +334,9 @@ test.serial("Successfully uploading a database to GHEC-DR", async (t) => {
        url: "https://tenant.ghe.com",
        apiURL: undefined,
      },
-      createFeatures([]),
-      getRecordingLogger(loggedMessages),
+      "",
    );
-    checkExpectedLogMessages(t, loggedMessages, [
+    checkExpectedLogMessages(t, logger.messages, [
      "Successfully uploaded database for javascript",
    ]);
    t.assert(
@@ -343,7 +352,8 @@ test.serial(
  "Records overlay and clear cleanup sizes when uploading an overlay-base database",
  async (t) => {
    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
+      const env = getTestEnv();
+      setupActionsVars(tmpDir, tmpDir, {}, env);
      sinon
        .stub(actionsUtil, "getRequiredInput")
        .withArgs("upload-database")
@@ -375,14 +385,16 @@ test.serial(
      const config = getTestConfig(tmpDir);
      config.overlayDatabaseMode = OverlayDatabaseMode.OverlayBase;

-      const loggedMessages: LoggedMessage[] = [];
      const results = await cleanupAndUploadDatabases(
+        initAllState({
+          env,
+          features: createFeatures([Feature.UploadOverlayDbToApi]),
+        }),
        testRepoName,
        codeql,
        config,
        testApiDetails,
-        createFeatures([Feature.UploadOverlayDbToApi]),
-        getRecordingLogger(loggedMessages),
+        "",
      );

      // The database should be cleaned up at the `overlay` level for the upload
@@ -402,7 +414,8 @@ test.serial(
  "Does not measure clear cleanup size for a regular (non-overlay-base) upload",
  async (t) => {
    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
+      const env = getTestEnv();
+      setupActionsVars(tmpDir, tmpDir, {}, env);
      sinon
        .stub(actionsUtil, "getRequiredInput")
        .withArgs("upload-database")
@@ -422,12 +435,15 @@ test.serial(
      });

      const results = await cleanupAndUploadDatabases(
+        initAllState({
+          env,
+          features: createFeatures([Feature.UploadOverlayDbToApi]),
+        }),
        testRepoName,
        codeql,
        getTestConfig(tmpDir),
        testApiDetails,
-        createFeatures([Feature.UploadOverlayDbToApi]),
-        getRecordingLogger([]),
+        "",
      );

      // A regular upload is cleaned only once, at the `clear` level.
@@ -441,7 +457,8 @@ test.serial(

 test.serial("Does not measure clear cleanup size in debug mode", async (t) => {
  await withTmpDir(async (tmpDir) => {
-    setupActionsVars(tmpDir, tmpDir);
+    const env = getTestEnv();
+    setupActionsVars(tmpDir, tmpDir, {}, env);
    sinon
      .stub(actionsUtil, "getRequiredInput")
      .withArgs("upload-database")
@@ -465,12 +482,15 @@ test.serial("Does not measure clear cleanup size in debug mode", async (t) => {
    config.debugMode = true;

    const results = await cleanupAndUploadDatabases(
+      initAllState({
+        env,
+        features: createFeatures([Feature.UploadOverlayDbToApi]),
+      }),
      testRepoName,
      codeql,
      config,
      testApiDetails,
-      createFeatures([Feature.UploadOverlayDbToApi]),
-      getRecordingLogger([]),
+      "",
    );

    // In debug mode we clean up at the `overlay` level for the upload but skip
@@ -486,7 +506,8 @@ test.serial(
  "Does not record a clear cleanup duration when the clear cleanup fails",
  async (t) => {
    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
+      const env = getTestEnv();
+      setupActionsVars(tmpDir, tmpDir, {}, env);
      sinon
        .stub(actionsUtil, "getRequiredInput")
        .withArgs("upload-database")
@@ -510,12 +531,15 @@ test.serial(
      config.overlayDatabaseMode = OverlayDatabaseMode.OverlayBase;

      const results = await cleanupAndUploadDatabases(
+        initAllState({
+          env,
+          features: createFeatures([Feature.UploadOverlayDbToApi]),
+        }),
        testRepoName,
        codeql,
        config,
        testApiDetails,
-        createFeatures([Feature.UploadOverlayDbToApi]),
-        getRecordingLogger([]),
+        "",
      );

      // When the `clear` cleanup fails, no size is measured, so we should not
--- a/src/database-upload.ts
+++ b/src/database-upload.ts
@@ -1,5 +1,6 @@
 import * as fs from "fs";

+import { ActionState } from "./action-common";
 import * as actionsUtil from "./actions-util";
 import { AnalysisKind } from "./analyses";
 import {
@@ -9,7 +10,7 @@ import {
 } from "./api-client";
 import { type CodeQL } from "./codeql";
 import { Config } from "./config-utils";
-import { Feature, FeatureEnablement } from "./feature-flags";
+import { Feature } from "./feature-flags";
 import * as gitUtils from "./git-utils";
 import { Logger, withGroupAsync } from "./logging";
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
@@ -45,13 +46,15 @@ export interface DatabaseUploadResult {
 }

 export async function cleanupAndUploadDatabases(
+  action: ActionState<["Logger", "FeatureFlags"]>,
  repositoryNwo: RepositoryNwo,
  codeql: CodeQL,
  config: Config,
  apiDetails: GitHubApiDetails,
-  features: FeatureEnablement,
-  logger: Logger,
+  checkoutPath: string,
 ): Promise<DatabaseUploadResult[]> {
+  const logger = action.logger;
+
  if (actionsUtil.getRequiredInput("upload-database") !== "true") {
    logger.debug("Database upload disabled in workflow. Skipping upload.");
    return [];
@@ -87,7 +90,7 @@ export async function cleanupAndUploadDatabases(
  // If config.overlayDatabaseMode is OverlayBase, then we have overlay base databases for all languages.
  const shouldUploadOverlayBase =
    config.overlayDatabaseMode === OverlayDatabaseMode.OverlayBase &&
-    (await features.getValue(Feature.UploadOverlayDbToApi, codeql));
+    (await action.features.getValue(Feature.UploadOverlayDbToApi, codeql));
  const cleanupLevel = shouldUploadOverlayBase
    ? CleanupLevel.Overlay
    : CleanupLevel.Clear;
@@ -110,9 +113,7 @@ export async function cleanupAndUploadDatabases(
        includeDiagnostics: false,
      });
      bundledDbSize = fs.statSync(bundledDb).size;
-      const commitOid = await gitUtils.getCommitOid(
-        actionsUtil.getRequiredInput("checkout_path"),
-      );
+      const commitOid = await gitUtils.getCommitOid(checkoutPath);
      // Upload with manual retry logic. We disable Octokit's built-in retries
      // because the request body is a ReadStream, which can only be consumed
      // once.
--- a/src/defaults.json
+++ b/src/defaults.json
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.0",
-  "cliVersion": "2.27.0",
-  "priorBundleVersion": "codeql-bundle-v2.26.4",
-  "priorCliVersion": "2.26.4"
+  "bundleVersion": "codeql-bundle-v2.27.1",
+  "cliVersion": "2.27.1",
+  "priorBundleVersion": "codeql-bundle-v2.27.0",
+  "priorCliVersion": "2.27.0"
 }
--- a/src/git-utils.test.ts
+++ b/src/git-utils.test.ts
@@ -29,10 +29,13 @@ test.serial(
      process.env["GITHUB_SHA"] = currentSha;

      const callback = sinon.stub(gitUtils, "getCommitOid");
-      callback.withArgs("HEAD").resolves(currentSha);
+      callback.withArgs(sinon.match.string, "HEAD").resolves(currentSha);

      const actualRef = await gitUtils.getRef();
      t.deepEqual(actualRef, expectedRef);
+
+      t.is(callback.callCount, 1);
+      t.true(callback.calledOnceWith(tmpDir, "HEAD"));
    });
  },
 );
@@ -48,11 +51,17 @@ test.serial(
      const sha = "a".repeat(40);

      const callback = sinon.stub(gitUtils, "getCommitOid");
-      callback.withArgs("refs/remotes/pull/1/merge").resolves(sha);
-      callback.withArgs("HEAD").resolves(sha);
+      callback
+        .withArgs(sinon.match.string, "refs/remotes/pull/1/merge")
+        .resolves(sha);
+      callback.withArgs(sinon.match.any, "HEAD").resolves(sha);

      const actualRef = await gitUtils.getRef();
      t.deepEqual(actualRef, expectedRef);
+
+      t.is(callback.callCount, 2);
+      t.true(callback.calledWith(tmpDir, "HEAD"));
+      t.true(callback.calledWith(tmpDir, "refs/remotes/pull/1/merge"));
    });
  },
 );
@@ -66,11 +75,18 @@ test.serial(
      process.env["GITHUB_SHA"] = "a".repeat(40);

      const callback = sinon.stub(gitUtils, "getCommitOid");
-      callback.withArgs(tmpDir, "refs/pull/1/merge").resolves("a".repeat(40));
+      callback
+        .withArgs(tmpDir, "refs/remotes/pull/1/merge")
+        .resolves("a".repeat(40));
      callback.withArgs(tmpDir, "HEAD").resolves("b".repeat(40));
+      callback.throws(new Error("Unexpected getCommitOid call in test."));

      const actualRef = await gitUtils.getRef();
      t.deepEqual(actualRef, "refs/pull/1/head");
+
+      t.is(callback.callCount, 2);
+      t.true(callback.calledWith(tmpDir, "refs/remotes/pull/1/merge"));
+      t.true(callback.calledWith(tmpDir, "HEAD"));
    });
  },
 );
@@ -92,11 +108,14 @@ test.serial(
      process.env["GITHUB_SHA"] = "a".repeat(40);

      const callback = sinon.stub(gitUtils, "getCommitOid");
-      callback.withArgs("refs/pull/1/merge").resolves("b".repeat(40));
-      callback.withArgs("HEAD").resolves("b".repeat(40));
+      callback.withArgs(tmpDir, "refs/pull/1/merge").resolves("b".repeat(40));
+      callback.withArgs(sinon.match.any, "HEAD").resolves("b".repeat(40));

      const actualRef = await gitUtils.getRef();
      t.deepEqual(actualRef, "refs/pull/2/merge");
+
+      // getCommitOid shouldn't be called, because the ref should be taken from the input
+      t.is(callback.callCount, 0);
    });
  },
 );
--- a/src/init-action-post.ts
+++ b/src/init-action-post.ts
@@ -12,7 +12,7 @@ import {
  getTemporaryDirectory,
  printDebugLogs,
 } from "./actions-util";
-import { getGitHubVersion } from "./api-client";
+import { getGitHubVersion, wrapApiConfigurationError } from "./api-client";
 import { CachingKind } from "./caching-utils";
 import { getCodeQL } from "./codeql";
 import { type Config, getConfig } from "./config-utils";
@@ -62,9 +62,11 @@ async function run(startedAt: Date) {
    const jobStatus = getOptionalInput("job-status");

    // Restore inputs from `init` Action.
-    restoreInputs();
+    restoreInputs(logger);

-    const gitHubVersion = await getGitHubVersion();
+    config = await getConfig(getTemporaryDirectory(), logger);
+
+    const gitHubVersion = config?.gitHubVersion ?? (await getGitHubVersion());
    checkGitHubVersionInRange(gitHubVersion, logger);

    const repositoryNwo = getRepositoryNwo();
@@ -75,7 +77,6 @@ async function run(startedAt: Date) {
      logger,
    );

-    config = await getConfig(getTemporaryDirectory(), logger);
    if (config === undefined) {
      logger.warning(
        "Debugging artifacts are unavailable since the 'init' Action failed before it could produce any.",
@@ -107,7 +108,7 @@ async function run(startedAt: Date) {
      }
    }
  } catch (unwrappedError) {
-    const error = wrapError(unwrappedError);
+    const error = wrapApiConfigurationError(wrapError(unwrappedError));
    core.setFailed(error.message);

    const statusReportBase = await createStatusReportBase(
--- a/src/init-action.ts
+++ b/src/init-action.ts
@@ -38,7 +38,7 @@ import {
  makeDiagnostic,
  makeTelemetryDiagnostic,
 } from "./diagnostics";
-import { EnvVar } from "./environment";
+import { ActionsEnvVars, EnvVar } from "./environment";
 import { Feature, FeatureEnablement, initFeatures } from "./feature-flags";
 import { loadRepositoryProperties } from "./feature-flags/properties";
 import {
@@ -81,7 +81,6 @@ import {
  DEFAULT_DEBUG_ARTIFACT_NAME,
  DEFAULT_DEBUG_DATABASE_NAME,
  getCodeQLMemoryLimit,
-  getRequiredEnvParam,
  getThreadsFlagValue,
  initializeEnvironment,
  ConfigurationError,
@@ -225,8 +224,8 @@ async function run(
    apiDetails = {
      auth: getRequiredInput("token"),
      externalRepoAuth: getOptionalInput("external-repository-token"),
-      url: getRequiredEnvParam("GITHUB_SERVER_URL"),
-      apiURL: getRequiredEnvParam("GITHUB_API_URL"),
+      url: actionState.env.getRequired(ActionsEnvVars.GITHUB_SERVER_URL),
+      apiURL: actionState.env.getRequired(ActionsEnvVars.GITHUB_API_URL),
    };

    const gitHubVersion = await getGitHubVersion();
@@ -255,7 +254,7 @@ async function run(
    // source-root is relative, it is relative to the GITHUB_WORKSPACE. If
    // source-root is absolute, it is used as given.
    sourceRoot = path.resolve(
-      getRequiredEnvParam("GITHUB_WORKSPACE"),
+      actionState.env.getRequired(ActionsEnvVars.GITHUB_WORKSPACE),
      getOptionalInput("source-root") || "",
    );

@@ -383,7 +382,9 @@ async function run(
      repository: repositoryNwo,
      tempDir: getTemporaryDirectory(),
      codeql,
-      workspacePath: getRequiredEnvParam("GITHUB_WORKSPACE"),
+      workspacePath: actionState.env.getRequired(
+        ActionsEnvVars.GITHUB_WORKSPACE,
+      ),
      sourceRoot,
      githubVersion: gitHubVersion,
      apiDetails,
@@ -715,7 +716,7 @@ async function run(
      );
    }

-    const tracerConfig = await getCombinedTracerConfig(codeql, config);
+    const tracerConfig = await getCombinedTracerConfig(logger, codeql, config);
    if (tracerConfig !== undefined) {
      for (const [key, value] of Object.entries(tracerConfig.env)) {
        core.exportVariable(key, value);
--- a/src/overlay/caching.ts
+++ b/src/overlay/caching.ts
@@ -3,11 +3,7 @@ import * as fs from "fs";
 import * as actionsCache from "@actions/cache";
 import * as semver from "semver";

-import {
-  getRequiredInput,
-  getWorkflowRunAttempt,
-  getWorkflowRunID,
-} from "../actions-util";
+import { getWorkflowRunAttempt, getWorkflowRunID } from "../actions-util";
 import { getAutomationID, listActionsCaches } from "../api-client";
 import { createCacheKeyHash } from "../caching-utils";
 import { type CodeQL } from "../codeql";
@@ -107,12 +103,13 @@ async function checkOverlayBaseDatabase(
 * Uploads the overlay-base database to the GitHub Actions cache. If conditions
 * for uploading are not met, the function does nothing and returns false.
 *
- * This function uses the `checkout_path` input to determine the repository path
+ * This function uses the `checkoutPath` to determine the repository path
 * and works only when called from `analyze` or `upload-sarif`.
 *
 * @param codeql The CodeQL instance
 * @param config The configuration object
 * @param logger The logger instance
+ * @param checkoutPath The path at which the repository is checked out at.
 * @returns A promise that resolves to true if the upload was performed and
 * successfully completed, or false otherwise
 */
@@ -120,6 +117,7 @@ export async function cleanupAndUploadOverlayBaseDatabaseToCache(
  codeql: CodeQL,
  config: Config,
  logger: Logger,
+  checkoutPath: string,
 ): Promise<boolean> {
  const overlayDatabaseMode = config.overlayDatabaseMode;
  if (overlayDatabaseMode !== OverlayDatabaseMode.OverlayBase) {
@@ -180,7 +178,6 @@ export async function cleanupAndUploadOverlayBaseDatabaseToCache(
  }

  const codeQlVersion = (await codeql.getVersion()).version;
-  const checkoutPath = getRequiredInput("checkout_path");
  const cacheSaveKey = await getCacheSaveKey(
    config,
    codeQlVersion,
--- a/src/per-language-bundles.test.ts
+++ b/src/per-language-bundles.test.ts
@@ -38,7 +38,6 @@ async function checkEligibility(
        [ActionsEnvVars.RUNNER_ENVIRONMENT]: "github-hosted",
      }),
      features: createFeatures([Feature.PerLanguageBundles]),
-      logger: getRecordingLogger([], { logToConsole: false }),
      ...stateOverrides,
    }),
    { ...ELIGIBLE_OPTIONS, ...overrides },
@@ -134,7 +133,6 @@ test("getPerLanguageBundleLanguage explains a disabled feature before checking e
  const messages: LoggedMessage[] = [];
  const language = await getPerLanguageBundleLanguage(
    initAllState({
-      env: getTestEnv(),
      features: createFeatures([]),
      logger: getRecordingLogger(messages, { logToConsole: false }),
    }),
--- a/src/per-language-bundles.ts
+++ b/src/per-language-bundles.ts
@@ -102,8 +102,11 @@ export async function getPerLanguageBundleLanguage(
    return explain("the job is not running on a GitHub-hosted runner");
  }

-  // Check whether per-language bundles are published for the requested CLI version.
-  // Latest-nightly selection skips this release-version check, but not the other eligibility checks.
+  // Nightly releases are identified by dates rather than versions. If
+  // `isLatestNightly` is `true`, the latest nightly is requested with
+  // `tools: nightly` and we don't yet have the corresponding tag at this point.
+  // Therefore, we skip the version check and don't have an equivalent.
+  // We can safely assume that the latest nightly will have per-language bundles.
  if (!isLatestNightly) {
    if (cliVersion === undefined) {
      return explain("the requested CLI version is unknown");
@@ -128,3 +131,16 @@ export async function getPerLanguageBundleLanguage(

  return language;
 }
+
+/** Explains why an eligible per-language bundle is being replaced by a combined bundle. */
+export function logPerLanguageBundleFallback(
+  { logger }: ActionState<["Logger"]>,
+  language: BuiltInLanguage,
+  location: string,
+): void {
+  logger.warning(
+    `No per-language CodeQL bundle for '${language}' was found at ${location}, so ` +
+      "falling back to the bundle that contains all languages. This analysis will still " +
+      "produce correct results, but will take longer to set up.",
+  );
+}
--- a/src/sarif/index.ts
+++ b/src/sarif/index.ts
@@ -1,6 +1,7 @@
 import * as fs from "fs";

 import { Logger } from "../logging";
+import { getErrorMessage } from "../util";

 import * as sarif from "sarif";

@@ -48,7 +49,13 @@ export function getToolNames(sarifFile: Partial<sarif.Log>): string[] {
 * @returns The resulting JSON value, cast to a SARIF `Log`.
 */
 export function readSarifFile(sarifFilePath: string): Partial<sarif.Log> {
-  return JSON.parse(fs.readFileSync(sarifFilePath, "utf8")) as sarif.Log;
+  try {
+    return JSON.parse(fs.readFileSync(sarifFilePath, "utf8")) as sarif.Log;
+  } catch (err) {
+    throw new Error(
+      `Parsing SARIF file at '${sarifFilePath}' failed: ${getErrorMessage(err)}`,
+    );
+  }
 }

 // Takes a list of paths to sarif files and combines them together,
--- a/src/setup-codeql-action.ts
+++ b/src/setup-codeql-action.ts
@@ -12,7 +12,7 @@ import { getGitHubVersion } from "./api-client";
 import { CodeQL } from "./codeql";
 import { ComputedInput, getToolsInput } from "./config/inputs";
 import { getRawLanguagesNoAutodetect } from "./config-utils";
-import { EnvVar } from "./environment";
+import { ActionsEnvVars, EnvVar } from "./environment";
 import { initFeatures } from "./feature-flags";
 import { loadRepositoryProperties } from "./feature-flags/properties";
 import { initCodeQL } from "./init";
@@ -32,7 +32,6 @@ import {
  checkDiskUsage,
  checkForTimeout,
  checkGitHubVersionInRange,
-  getRequiredEnvParam,
  initializeEnvironment,
  ConfigurationError,
  wrapError,
@@ -108,8 +107,8 @@ async function run(
    const apiDetails = {
      auth: getRequiredInput("token"),
      externalRepoAuth: getOptionalInput("external-repository-token"),
-      url: getRequiredEnvParam("GITHUB_SERVER_URL"),
-      apiURL: getRequiredEnvParam("GITHUB_API_URL"),
+      url: actionState.env.getRequired(ActionsEnvVars.GITHUB_SERVER_URL),
+      apiURL: actionState.env.getRequired(ActionsEnvVars.GITHUB_API_URL),
    };

    const gitHubVersion = await getGitHubVersion();
--- a/src/setup-codeql.test.ts
+++ b/src/setup-codeql.test.ts
@@ -69,25 +69,29 @@ function stubHostedNightly(tagName: string) {
    available: true,
    foundZstdBinary: true,
  });
-  const fetchRelease = sinon
-    .stub<Parameters<typeof fetch>, ReturnType<typeof fetch>>()
-    .rejects(new Error("Unexpected API request in nightly bundle test"));
-  fetchRelease
-    .withArgs(
-      "https://api.github.com/repos/dsp-testing/codeql-cli-nightlies/releases?per_page=1&page=1&prerelease=true",
-      sinon.match({ method: "GET" }),
-    )
-    .callsFake(
-      async () =>
-        new Response(JSON.stringify([{ tag_name: tagName }]), {
-          headers: { "content-type": "application/json" },
-        }),
-    );
  const client = github.getOctokit("123", {
-    request: { fetch: fetchRelease },
+    request: {
+      fetch: async () => {
+        throw new Error("Unexpected API request in nightly bundle test");
+      },
+    },
  });
+  const listReleases = sinon
+    .stub(client.rest.repos, "listReleases")
+    .rejects(new Error("Unexpected release request in nightly bundle test"));
+  listReleases
+    .withArgs({
+      owner: "dsp-testing",
+      repo: "codeql-cli-nightlies",
+      per_page: 1,
+      page: 1,
+      prerelease: true,
+    })
+    .resolves({
+      data: [{ tag_name: tagName }],
+    } as Awaited<ReturnType<typeof client.rest.repos.listReleases>>);
  sinon.stub(api, "getApiClient").value(() => client);
-  return fetchRelease;
+  return listReleases;
 }

 test.serial("parse codeql bundle url version", (t) => {
@@ -431,7 +435,7 @@ test.serial(

      // Check that the `CodeQLToolsSource` object matches our expectations.
      const expectedVersion = `0.0.0-${expectedDate}`;
-      const expectedURL = `https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/${expectedTag}/${setupCodeql.getCodeQLBundleName("zstd")}`;
+      const expectedURL = `https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/${expectedTag}/codeql-bundle-linux64.tar.zst`;
      t.deepEqual(source, {
        bundle: { kind: "combined", url: expectedURL },
        bundleVersion: expectedDate,
@@ -501,7 +505,7 @@ test.serial(

      // Check that the `CodeQLToolsSource` object matches our expectations.
      const expectedVersion = `0.0.0-${expectedDate}`;
-      const expectedURL = `https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/${expectedTag}/${setupCodeql.getCodeQLBundleName("zstd")}`;
+      const expectedURL = `https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/${expectedTag}/codeql-bundle-linux64.tar.zst`;
      t.deepEqual(source, {
        bundle: { kind: "combined", url: expectedURL },
        bundleVersion: expectedDate,
@@ -1139,30 +1143,6 @@ const PER_LANGUAGE_CLI_VERSION = {
  ],
 };

-test.serial(
-  "getCodeQLBundleName returns a per-language bundle name only when a language is specified",
-  (t) => {
-    sinon.stub(process, "platform").value("linux");
-    sinon.stub(process, "arch").value("x64");
-    t.is(
-      setupCodeql.getCodeQLBundleName("zstd", BuiltInLanguage.java),
-      "codeql-bundle-java-linux64.tar.zst",
-    );
-    t.is(
-      setupCodeql.getCodeQLBundleName("zstd"),
-      "codeql-bundle-linux64.tar.zst",
-    );
-  },
-);
-
-test.serial("getCodeQLBundleName names the Swift bundle for macOS", (t) => {
-  sinon.stub(process, "platform").value("darwin");
-  t.is(
-    setupCodeql.getCodeQLBundleName("zstd", BuiltInLanguage.swift),
-    "codeql-bundle-swift-osx64.tar.zst",
-  );
-});
-
 test.serial(
  "getCodeQLSource downloads the per-language bundle for a single explicit language",
  async (t) => {
--- a/src/setup-codeql.ts
+++ b/src/setup-codeql.ts
@@ -17,7 +17,12 @@ import {
  isRunningLocalAction,
 } from "./actions-util";
 import * as api from "./api-client";
-import { CodeQLBundle, getCodeQLBundleFromUrl } from "./codeql-bundle";
+import {
+  CodeQLBundle,
+  CodeQLDownloadSource,
+  getCodeQLBundleFromUrl,
+  getCodeQLBundleName,
+} from "./codeql-bundle";
 import * as defaults from "./defaults.json";
 import {
  addNoLanguageDiagnostic,
@@ -35,7 +40,10 @@ import {
 import { BuiltInLanguage } from "./languages";
 import { Logger } from "./logging";
 import { getCodeQlVersionsForOverlayBaseDatabases } from "./overlay/caching";
-import { getPerLanguageBundleLanguage } from "./per-language-bundles";
+import {
+  getPerLanguageBundleLanguage,
+  logPerLanguageBundleFallback,
+} from "./per-language-bundles";
 import { getBundlePlatform } from "./platform";
 import * as tar from "./tar";
 import {
@@ -49,6 +57,8 @@ import {
 import * as util from "./util";
 import { isGoodVersion } from "./util";

+export type { CodeQLDownloadSource } from "./codeql-bundle";
+
 export enum ToolsSource {
  Unknown = "UNKNOWN",
  Local = "LOCAL",
@@ -64,41 +74,6 @@ const CODEQL_BUNDLE_VERSION_ALIAS: string[] = ["linked", "latest"];
 const CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"];
 const CODEQL_TOOLCACHE_INPUT = "toolcache";

-function getCodeQLBundleExtension(
-  compressionMethod: tar.CompressionMethod,
-): string {
-  switch (compressionMethod) {
-    case "gzip":
-      return ".tar.gz";
-    case "zstd":
-      return ".tar.zst";
-    default:
-      util.assertNever(compressionMethod);
-  }
-}
-
-/**
- * Returns the name of the CodeQL bundle asset to download.
- *
- * @param compressionMethod The compression method of the bundle.
- * @param language Optional language for a per-language bundle. If omitted, returns a combined bundle name.
- */
-export function getCodeQLBundleName(
-  compressionMethod: tar.CompressionMethod,
-  language?: BuiltInLanguage,
-): string {
-  const extension = getCodeQLBundleExtension(compressionMethod);
-  const platform = getBundlePlatform();
-
-  if (platform === undefined) {
-    return `codeql-bundle${extension}`;
-  }
-  if (language !== undefined) {
-    return `codeql-bundle-${language}-${platform}${extension}`;
-  }
-  return `codeql-bundle-${platform}${extension}`;
-}
-
 export function getCodeQLActionRepository(logger: Logger): string {
  if (isRunningLocalAction()) {
    // This handles the case where the Action does not come from an Action repository,
@@ -223,22 +198,6 @@ export function convertToSemVer(version: string, logger: Logger): string {
  return s;
 }

-/** A resolved download, including its bundle identity and version. */
-export interface CodeQLDownloadSource {
-  /** Distinguishes downloads from local archives and cached installations. */
-  sourceType: "download";
-  /** The bundle to download. */
-  bundle: CodeQLBundle;
-  /** The compression format of the bundle archive. */
-  compressionMethod: tar.CompressionMethod;
-  /** Bundle version of the tools, if known. */
-  bundleVersion?: string;
-  /** Requested CLI version, if known. */
-  cliVersion?: string;
-  /** Resolved version for telemetry, independent of whether the bundle can be cached. */
-  toolsVersion: string;
-}
-
 export type CodeQLToolsSource =
  | {
      codeqlTarPath: string;
@@ -757,13 +716,14 @@ export async function getCodeQLSource(
        ? "zstd"
        : "gzip";

+    const platform = getBundlePlatform();
    const perLanguageBundleLanguage = await getPerLanguageBundleLanguage(
      { env: getEnv(), features, logger },
      {
        rawLanguages,
        cliVersion,
        compressionMethod,
-        platform: getBundlePlatform(),
+        platform,
        variant,
      },
    );
@@ -773,7 +733,7 @@ export async function getCodeQLSource(
      getCodeQLBundleDownloadURL(
        bundleTagName,
        apiDetails,
-        getCodeQLBundleName(compressionMethod, language),
+        getCodeQLBundleName(compressionMethod, platform, language),
        logger,
      );

@@ -1153,11 +1113,7 @@ export async function downloadCodeQLBundle(
    ) {
      throw e;
    }
-    logger.warning(
-      `No per-language CodeQL bundle for '${bundle.language}' was found at ${bundle.url}, so ` +
-        "falling back to the bundle that contains all languages. This analysis will still " +
-        "produce correct results, but will take longer to set up.",
-    );
+    logPerLanguageBundleFallback(action, bundle.language, bundle.url);

    const result = await downloadCodeQL(
      {
@@ -1215,11 +1171,12 @@ async function getLatestNightlyBundle(
    ? "zstd"
    : "gzip";

+  const platform = getBundlePlatform();
  const language = await getPerLanguageBundleLanguage(action, {
    rawLanguages,
    cliVersion: undefined,
    compressionMethod,
-    platform: getBundlePlatform(),
+    platform,
    variant,
    isLatestNightly: true,
  });
@@ -1241,14 +1198,18 @@ async function getLatestNightlyBundle(
    }
    const assetUrl = (name: string) =>
      `https://github.com/${CODEQL_NIGHTLIES_REPOSITORY_OWNER}/${CODEQL_NIGHTLIES_REPOSITORY_NAME}/releases/download/${latestRelease.tag_name}/${name}`;
-    const url = assetUrl(getCodeQLBundleName(compressionMethod, language));
+    const url = assetUrl(
+      getCodeQLBundleName(compressionMethod, platform, language),
+    );
    return language === undefined
      ? { kind: "combined", url }
      : {
          kind: "per-language",
          url,
          language,
-          combinedBundleURL: assetUrl(getCodeQLBundleName(compressionMethod)),
+          combinedBundleURL: assetUrl(
+            getCodeQLBundleName(compressionMethod, platform),
+          ),
        };
  } catch (e) {
    throw new Error(
--- a/src/start-proxy-action-post.ts
+++ b/src/start-proxy-action-post.ts
@@ -20,7 +20,7 @@ export async function runWrapper() {

  try {
    // Restore inputs from `start-proxy` Action.
-    actionsUtil.restoreInputs();
+    actionsUtil.restoreInputs(logger);

    // Kill the running proxy
    const pid = core.getState("proxy-process-pid");
@@ -38,12 +38,6 @@ export async function runWrapper() {
      logger.info(
        "Debug mode is on. Uploading proxy log as Actions debugging artifact...",
      );
-      if (config?.gitHubVersion.type === undefined) {
-        logger.warning(
-          `Did not upload debug artifacts because cannot determine the GitHub variant running.`,
-        );
-        return;
-      }
      const gitHubVersion = await getGitHubVersion();
      checkGitHubVersionInRange(gitHubVersion, logger);

--- a/src/start-proxy-action.ts
+++ b/src/start-proxy-action.ts
@@ -98,7 +98,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
    };

    // Start the Proxy
-    const proxyBin = await getProxyBinaryPath(logger, features);
+    const proxyBin = await getProxyBinaryPath({ ...action, features });
    const proxyInfo = await startProxy(
      proxyBin,
      proxyConfig,
--- a/src/start-proxy.test.ts
+++ b/src/start-proxy.test.ts
@@ -5,6 +5,7 @@ import * as toolcache from "@actions/tool-cache";
 import test, { ExecutionContext } from "ava";
 import sinon from "sinon";

+import { ActionState } from "./action-common";
 import * as apiClient from "./api-client";
 import * as defaults from "./defaults.json";
 import { setUpFeatureFlagTests } from "./feature-flags/testing-util";
@@ -12,12 +13,14 @@ import { UnvalidatedObject, validateSchema } from "./json";
 import { makeFromSchema } from "./json/testing-util";
 import { BuiltInLanguage } from "./languages";
 import { getRunnerLogger, Logger } from "./logging";
+import { BundlePlatform, getBundlePlatform } from "./platform";
 import * as startProxyExports from "./start-proxy";
 import * as statusReport from "./status-report";
 import {
  assertNotLogged,
  checkExpectedLogMessages,
  createFeatures,
+  initAllState,
  makeMacro,
  makeTestToken,
  RecordingLogger,
@@ -685,6 +688,12 @@ test("getCredentials always returns ALWAYS_ENABLED_REGISTRY_TYPE credentials for
  }
 });

+test("getProxyPackage - includes platform in name", (t) => {
+  for (const platform of Object.values(BundlePlatform)) {
+    t.true(startProxyExports.getProxyPackage(platform).includes(platform));
+  }
+});
+
 function mockGetApiClient(endpoints: any) {
  return (
    sinon
@@ -721,6 +730,44 @@ function mockOfflineFeatures(tempDir: string, logger: Logger) {
  return setUpFeatureFlagTests(tempDir, logger, gitHubVersion);
 }

+/** Gets the `BundlePlatform` based on the `action` state, but defaults to `Linux64` if undefined. */
+function getTestPlatform(action: ActionState<["Base"]>) {
+  return (
+    getBundlePlatform(action.platform, action.arch) ?? BundlePlatform.Linux64
+  );
+}
+
+test.serial(
+  "getDownloadUrl logs unknown platforms/arch and defaults to linux64",
+  async (t) => {
+    const logger = new RecordingLogger();
+    mockGetReleaseByTag();
+
+    await withTmpDir(async (tempDir) => {
+      const features = mockOfflineFeatures(tempDir, logger);
+      const state = initAllState({
+        platform: "android",
+        arch: "ppc",
+        logger,
+        features,
+      });
+      const info = await startProxyExports.getDownloadUrl(state);
+
+      t.is(info.version, startProxyExports.UPDATEJOB_PROXY_VERSION);
+      t.is(
+        info.url,
+        startProxyExports.getFallbackUrl(
+          startProxyExports.getProxyPackage(BundlePlatform.Linux64),
+        ),
+      );
+
+      t.true(
+        logger.hasMessage(`Unsupported platform android on architecture ppc`),
+      );
+    });
+  },
+);
+
 test.serial(
  "getDownloadUrl returns fallback when `getReleaseByVersion` rejects",
  async (t) => {
@@ -729,15 +776,15 @@ test.serial(

    await withTmpDir(async (tempDir) => {
      const features = mockOfflineFeatures(tempDir, logger);
-      const info = await startProxyExports.getDownloadUrl(
-        getRunnerLogger(true),
-        features,
-      );
+      const state = initAllState({ logger, features });
+      const info = await startProxyExports.getDownloadUrl(state);

      t.is(info.version, startProxyExports.UPDATEJOB_PROXY_VERSION);
      t.is(
        info.url,
-        startProxyExports.getFallbackUrl(startProxyExports.getProxyPackage()),
+        startProxyExports.getFallbackUrl(
+          startProxyExports.getProxyPackage(getTestPlatform(state)),
+        ),
      );
    });
  },
@@ -751,18 +798,18 @@ test.serial(

    await withTmpDir(async (tempDir) => {
      const features = mockOfflineFeatures(tempDir, logger);
+      const state = initAllState({ logger, features });

      for (const assets of testAssets) {
        const stub = mockGetReleaseByTag(assets);
-        const info = await startProxyExports.getDownloadUrl(
-          getRunnerLogger(true),
-          features,
-        );
+        const info = await startProxyExports.getDownloadUrl(state);

        t.is(info.version, startProxyExports.UPDATEJOB_PROXY_VERSION);
        t.is(
          info.url,
-          startProxyExports.getFallbackUrl(startProxyExports.getProxyPackage()),
+          startProxyExports.getFallbackUrl(
+            startProxyExports.getProxyPackage(getTestPlatform(state)),
+          ),
        );

        stub.restore();
@@ -773,18 +820,19 @@ test.serial(

 test.serial("getDownloadUrl returns matching release asset", async (t) => {
  const logger = new RecordingLogger();
+  const state = initAllState({ logger });
  const assets = [
    { name: "foo", url: "other-url" },
-    { name: startProxyExports.getProxyPackage(), url: "url-we-want" },
+    {
+      name: startProxyExports.getProxyPackage(getTestPlatform(state)),
+      url: "url-we-want",
+    },
  ];
  mockGetReleaseByTag(assets);

  await withTmpDir(async (tempDir) => {
    const features = mockOfflineFeatures(tempDir, logger);
-    const info = await startProxyExports.getDownloadUrl(
-      getRunnerLogger(true),
-      features,
-    );
+    const info = await startProxyExports.getDownloadUrl({ ...state, features });

    t.is(info.version, defaults.cliVersion);
    t.is(info.url, "url-we-want");
@@ -918,7 +966,9 @@ test.serial(
      sinon.stub(toolcache, "find").returns(toolcachePath);

      const features = mockOfflineFeatures(tempDir, logger);
-      const path = await startProxyExports.getProxyBinaryPath(logger, features);
+      const path = await startProxyExports.getProxyBinaryPath(
+        initAllState({ logger, features }),
+      );

      t.assert(path);
      t.is(
@@ -933,9 +983,13 @@ test.serial(
  "getProxyBinaryPath - downloads proxy if not in cache",
  async (t) => {
    const logger = new RecordingLogger();
+    const state = initAllState({ logger });
    const downloadUrl = "url-we-want";
    mockGetReleaseByTag([
-      { name: startProxyExports.getProxyPackage(), url: downloadUrl },
+      {
+        name: startProxyExports.getProxyPackage(getTestPlatform(state)),
+        url: downloadUrl,
+      },
    ]);

    const toolcachePath = "/path/to/proxy/dir";
@@ -958,10 +1012,10 @@ test.serial(
      .resolves(extractedPath);
    const cacheDir = sinon.stub(toolcache, "cacheDir").resolves(toolcachePath);

-    const path = await startProxyExports.getProxyBinaryPath(
-      logger,
-      createFeatures([]),
-    );
+    const path = await startProxyExports.getProxyBinaryPath({
+      ...state,
+      features: createFeatures([]),
+    });

    t.assert(find.calledOnce);
    t.assert(getApiDetails.calledOnce);
@@ -976,7 +1030,7 @@ test.serial(
    );

    checkExpectedLogMessages(t, logger.messages, [
-      `Found '${startProxyExports.getProxyPackage()}' in release '${defaults.bundleVersion}' at '${downloadUrl}'`,
+      `Found '${startProxyExports.getProxyPackage(getTestPlatform(state))}' in release '${defaults.bundleVersion}' at '${downloadUrl}'`,
    ]);
  },
 );
@@ -985,6 +1039,7 @@ test.serial(
  "getProxyBinaryPath - downloads proxy based on features if not in cache",
  async (t) => {
    const logger = new RecordingLogger();
+    const state = initAllState({ logger });
    const expectedTag = "codeql-bundle-v2.20.1";
    const expectedParams = {
      owner: "github",
@@ -994,7 +1049,7 @@ test.serial(
    const downloadUrl = "url-we-want";
    const assets = [
      {
-        name: startProxyExports.getProxyPackage(),
+        name: startProxyExports.getProxyPackage(getTestPlatform(state)),
        url: downloadUrl,
      },
    ];
@@ -1045,7 +1100,10 @@ test.serial(
        .resolves({
          enabledVersions: [{ cliVersion: "2.20.1", tagName: expectedTag }],
        });
-      const path = await startProxyExports.getProxyBinaryPath(logger, features);
+      const path = await startProxyExports.getProxyBinaryPath({
+        ...state,
+        features,
+      });

      t.assert(getDefaultCliVersion.calledOnce);
      sinon.assert.calledOnceWithMatch(
@@ -1067,7 +1125,7 @@ test.serial(
    });

    checkExpectedLogMessages(t, logger.messages, [
-      `Found '${startProxyExports.getProxyPackage()}' in release '${expectedTag}' at '${downloadUrl}'`,
+      `Found '${startProxyExports.getProxyPackage(getTestPlatform(state))}' in release '${expectedTag}' at '${downloadUrl}'`,
    ]);
  },
 );
--- a/src/start-proxy.ts
+++ b/src/start-proxy.ts
@@ -3,6 +3,7 @@ import * as path from "path";
 import * as core from "@actions/core";
 import * as toolcache from "@actions/tool-cache";

+import { ActionState } from "./action-common";
 import {
  getApiClient,
  getApiDetails,
@@ -20,6 +21,7 @@ import {
 import * as json from "./json";
 import { BuiltInLanguage } from "./languages";
 import { Logger } from "./logging";
+import { BundlePlatform, getBundlePlatform } from "./platform";
 import {
  Address,
  Registry,
@@ -370,14 +372,10 @@ export function getCredentials(

 /**
 * Gets the name of the proxy release asset for the current platform.
+ *
+ * @param platform The platform to get the asset name for.
 */
-export function getProxyPackage(): string {
-  const platform =
-    process.platform === "win32"
-      ? "win64"
-      : process.platform === "darwin"
-        ? "osx64"
-        : "linux64";
+export function getProxyPackage(platform: BundlePlatform): string {
  return `${UPDATEJOB_PROXY}-${platform}.tar.gz`;
 }

@@ -417,25 +415,33 @@ async function getCliVersionFromFeatures(
 * Determines the URL of the proxy release asset that we should download if its not
 * already in the toolcache, and its version.
 *
- * @param logger The logger to use.
- * @param features Information about enabled features.
+ * @param action The action state.
 * @returns Returns the download URL and version of the proxy package we plan to use.
 */
 export async function getDownloadUrl(
-  logger: Logger,
-  features: FeatureEnablement,
+  action: ActionState<["Base", "Logger", "FeatureFlags"]>,
 ): Promise<{ url: string; version: string }> {
-  const proxyPackage = getProxyPackage();
+  // Default to linux64 if we don't recognise the platform+arch pair.
+  // This maintains the behaviour we had before switching to `getBundlePlatform` here.
+  let platform = getBundlePlatform(action.platform, action.arch);
+  if (platform === undefined) {
+    action.logger.warning(
+      `Unsupported platform ${action.platform} on architecture ${action.arch}, defaulting to ${BundlePlatform.Linux64}`,
+    );
+    platform = BundlePlatform.Linux64;
+  }
+
+  const proxyPackage = getProxyPackage(platform);

  try {
-    const useFeaturesToDetermineCLI = await features.getValue(
+    const useFeaturesToDetermineCLI = await action.features.getValue(
      Feature.StartProxyUseFeaturesRelease,
    );

    // Retrieve information about the CLI version we should use. This will be either the linked
    // version, or the one enabled by FFs.
    const versionInfo = useFeaturesToDetermineCLI
-      ? (await getCliVersionFromFeatures(features)).enabledVersions[0]
+      ? (await getCliVersionFromFeatures(action.features)).enabledVersions[0]
      : {
          cliVersion: defaults.cliVersion,
          tagName: defaults.bundleVersion,
@@ -447,7 +453,7 @@ export async function getDownloadUrl(
    // Search the release's assets to find the one we are looking for.
    for (const asset of cliRelease.data.assets) {
      if (asset.name === proxyPackage) {
-        logger.info(
+        action.logger.info(
          `Found '${proxyPackage}' in release '${versionInfo.tagName}' at '${asset.url}'`,
        );
        return {
@@ -460,13 +466,13 @@ export async function getDownloadUrl(
      }
    }
  } catch (ex) {
-    logger.warning(
+    action.logger.warning(
      `Failed to retrieve information about the linked release: ${getErrorMessage(ex)}`,
    );
  }

  // Fallback to the hard-coded URL.
-  logger.info(
+  action.logger.info(
    `Did not find '${proxyPackage}' in the linked release, falling back to hard-coded version.`,
  );
  return {
@@ -559,15 +565,15 @@ export function getProxyFilename() {
 * runner's tool cache. Otherwise, it downloads and extracts the proxy binary,
 * and stores it in the tool cache.
 *
- * @param logger The logger to use.
+ * @param action The action state.
 * @returns The path to the proxy binary.
 */
 export async function getProxyBinaryPath(
-  logger: Logger,
-  features: FeatureEnablement,
+  action: ActionState<["Base", "Logger", "FeatureFlags"]>,
 ): Promise<string> {
+  const logger = action.logger;
  const proxyFileName = getProxyFilename();
-  const proxyInfo = await getDownloadUrl(logger, features);
+  const proxyInfo = await getDownloadUrl(action);

  let proxyBin = toolcache.find(proxyFileName, proxyInfo.version);
  if (!proxyBin) {
--- a/src/testing-utils.ts
+++ b/src/testing-utils.ts
@@ -234,6 +234,8 @@ export function initAllState(
  return {
    name: ActionName.Init,
    startedAt: new Date(),
+    platform: process.platform,
+    arch: process.arch,
    logger: new RecordingLogger(),
    env,
    actions: getTestActionsEnv(env),
--- a/src/tracer-config.test.ts
+++ b/src/tracer-config.test.ts
@@ -7,7 +7,12 @@ import * as sinon from "sinon";
 import { CodeQL, getCodeQLForTesting } from "./codeql";
 import * as configUtils from "./config-utils";
 import { BuiltInLanguage } from "./languages";
-import { createTestConfig, makeVersionInfo, setupTests } from "./testing-utils";
+import {
+  createTestConfig,
+  makeVersionInfo,
+  RecordingLogger,
+  setupTests,
+} from "./testing-utils";
 import { ToolsFeature } from "./tools-features";
 import { getCombinedTracerConfig } from "./tracer-config";
 import * as util from "./util";
@@ -42,18 +47,20 @@ async function stubCodeql(
 }

 test("getCombinedTracerConfig - return undefined when no languages are traced languages", async (t) => {
+  const logger = new RecordingLogger();
  await util.withTmpDir(async (tmpDir) => {
    const config = getTestConfig(tmpDir);
    // No traced languages
    config.languages = [BuiltInLanguage.javascript, BuiltInLanguage.python];
    t.deepEqual(
-      await getCombinedTracerConfig(await stubCodeql(), config),
+      await getCombinedTracerConfig(logger, await stubCodeql(), config),
      undefined,
    );
  });
 });

 test("getCombinedTracerConfig", async (t) => {
+  const logger = new RecordingLogger();
  await util.withTmpDir(async (tmpDir) => {
    const config = getTestConfig(tmpDir);

@@ -82,7 +89,11 @@ test("getCombinedTracerConfig", async (t) => {
    );
    fs.writeFileSync(startTracingJson, JSON.stringify(startTracingEnv));

-    const result = await getCombinedTracerConfig(await stubCodeql(), config);
+    const result = await getCombinedTracerConfig(
+      logger,
+      await stubCodeql(),
+      config,
+    );
    t.notDeepEqual(result, undefined);

    t.false(Object.prototype.hasOwnProperty.call(result?.env, "CODEQL_RUNNER"));
--- a/src/tracer-config.ts
+++ b/src/tracer-config.ts
@@ -4,7 +4,7 @@ import * as path from "path";
 import { type CodeQL } from "./codeql";
 import { type Config } from "./config-utils";
 import { Logger } from "./logging";
-import { asyncSome, BuildMode } from "./util";
+import { asyncSome, BuildMode, getErrorMessage } from "./util";

 export type TracerConfig = {
  env: { [key: string]: string };
@@ -77,23 +77,28 @@ export async function endTracingForCluster(
 }

 async function getTracerConfigForCluster(
+  logger: Logger,
  config: Config,
 ): Promise<TracerConfig> {
-  const tracingEnvVariables = JSON.parse(
-    fs.readFileSync(
-      path.resolve(
-        config.dbLocation,
-        "temp/tracingEnvironment/start-tracing.json",
-      ),
-      "utf8",
-    ),
+  const filePath = path.resolve(
+    config.dbLocation,
+    "temp/tracingEnvironment/start-tracing.json",
  );
-  return {
-    env: tracingEnvVariables,
-  };
+  try {
+    const tracingEnvVariables = JSON.parse(fs.readFileSync(filePath, "utf8"));
+    return {
+      env: tracingEnvVariables,
+    };
+  } catch (err) {
+    logger.error(
+      `Failed to parse tracing environment from '${filePath}': ${getErrorMessage(err)}`,
+    );
+    throw new Error(`Failed to parse tracing environment from '${filePath}'.`);
+  }
 }

 export async function getCombinedTracerConfig(
+  logger: Logger,
  codeql: CodeQL,
  config: Config,
 ): Promise<TracerConfig | undefined> {
@@ -101,5 +106,5 @@ export async function getCombinedTracerConfig(
    return undefined;
  }

-  return await getTracerConfigForCluster(config);
+  return await getTracerConfigForCluster(logger, config);
 }
--- a/src/upload-sarif-action-post.ts
+++ b/src/upload-sarif-action-post.ts
@@ -17,9 +17,10 @@ export async function runWrapper() {
  // possible, and only use safe functions outside.

  try {
-    // Restore inputs from `upload-sarif` Action.
-    actionsUtil.restoreInputs();
    const logger = getActionsLogger();
+
+    // Restore inputs from `upload-sarif` Action.
+    actionsUtil.restoreInputs(logger);
    const gitHubVersion = await getGitHubVersion();
    checkGitHubVersionInRange(gitHubVersion, logger);

--- a/src/util.ts
+++ b/src/util.ts
@@ -682,7 +682,7 @@ export async function bundleDb(
  return databaseBundlePath;
 }

-/** Returns the elapsed milliseconds, rounded, since a `performance.now()` timestamp. */
+/** Returns the elapsed milliseconds, rounded, since `startTime` was recorded with `performance.now()`. */
 export function durationMsSince(startTime: number): number {
  return Math.round(performance.now() - startTime);
 }
@@ -894,7 +894,13 @@ export function parseMatrixInput(
  if (matrixInput === undefined || matrixInput === "null") {
    return undefined;
  }
-  return JSON.parse(matrixInput) as { [key: string]: string };
+  try {
+    return JSON.parse(matrixInput) as { [key: string]: string };
+  } catch (err) {
+    throw new Error(
+      `Failed to parse matrix input '${matrixInput}': ${getErrorMessage(err)}`,
+    );
+  }
 }

 export function wrapError(error: unknown): Error {
@@ -1037,7 +1043,11 @@ export enum BuildMode {
 }

 export function cloneObject<T>(obj: T): T {
-  return JSON.parse(JSON.stringify(obj)) as T;
+  try {
+    return JSON.parse(JSON.stringify(obj)) as T;
+  } catch (err) {
+    throw new Error(`Cloning object failed: ${getErrorMessage(err)}`);
+  }
 }

 export async function cleanUpPath(file: string, name: string, logger: Logger) {