Merge releases/v4 into releases/v3

.github/actions/prepare-mergeback-branch/action.yml

@@ -92,8 +92,7 @@ runs:
           Please do the following:
 
           - [ ] Approve running the full set of PR checks.
-          - [ ] Approve and merge the PR. When merging the PR, make sure "Create a merge commit" is
-                selected rather than "Squash and merge" or "Rebase and merge".
+          - [ ] Approve and merge the PR. When merging the PR, make sure "Create a merge commit" is selected rather than "Squash and merge" or "Rebase and merge".
         EOF
         )
 

.github/dependabot.yml

@@ -8,8 +8,6 @@ updates:
       interval: weekly
     cooldown:
       default-days: 7
-      exclude:
-        - "@actions/*"
     labels:
       - Rebuild
     # Ignore incompatible dependency updates
@@ -33,8 +31,6 @@ updates:
       interval: weekly
     cooldown:
       default-days: 7
-      exclude:
-        - "actions/*"
     labels:
       - Rebuild
     groups:

.github/workflows/pr-checks.yml

@@ -47,6 +47,12 @@ jobs:
           node-version: ${{ matrix.node-version }}
           cache: "npm"
 
+      # Install a new enough version of `npm` to understand `min-release-age`
+      # that is still compatible with Node 20.
+      - name: Install newer npm
+        if: matrix.node-version == 20
+        run: npm install -g npm@11.19.1
+
       - name: Install dependencies
         run: |
           # Use the system Bash shell to ensure we can run commands like `npm ci`
@@ -95,6 +101,14 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: Check for incorrect addresses in package-lock.json
+        run: |
+          if git grep -nE '(pkgs\.visualstudio\.com|pkgs\.dev\.azure\.com|packagefeedproxy\.microsoft\.io)' -- \
+              'package-lock.json'; then
+            echo "::error::package-lock.json contains internal package feed URLs. Replace them with public registry URLs."
+            exit 1
+          fi
+
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -114,9 +128,9 @@ jobs:
         working-directory: pr-checks
         run: npx tsx --test
 
-      - name: Run `pr-checks/changenotes.mts` to ensure that all unreleased change notes are valid
+      - name: Run `pr-checks/changenotes.ts` to ensure that all unreleased change notes are valid
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
-        run: npx tsx pr-checks/changenotes.mts validate
+        run: npx tsx pr-checks/changenotes.ts validate
 
       - name: Verify all Actions use the same Node version
         id: head-version

.github/workflows/prepare-release.yml

@@ -28,7 +28,7 @@ defaults:
 
 jobs:
   prepare:
-    name: "Prepare release"
+    name: "Release info"
     runs-on: ubuntu-latest
     if: github.repository == 'github/codeql-action'
 

.github/workflows/rebuild.yml

@@ -54,32 +54,27 @@ jobs:
         run: |
           git fetch origin "$BASE_BRANCH"
 
-          # Allow merge conflicts in `lib`, since rebuilding should resolve them.
-          git merge "origin/$BASE_BRANCH"
-          MERGE_RESULT=$?
-
-          if [ "$MERGE_RESULT" -eq 0 ]; then
+          # Allow merge conflicts in `lib`, since rebuilding should resolve them. Conflicts leave the
+          # merge in progress, so check for `MERGE_HEAD` to tell them apart from failures that don't.
+          if git merge "origin/$BASE_BRANCH"; then
             echo "Merge succeeded cleanly."
-          elif [ "$MERGE_RESULT" -eq 1 ]; then
-            echo "Merge conflicts detected (exit code $MERGE_RESULT), continuing."
-          else
-            echo "git merge failed with unexpected exit code $MERGE_RESULT."
-            exit 1
-          fi
-
-          if [ "$MERGE_RESULT" -ne 0 ]; then
+          elif git rev-parse --verify MERGE_HEAD >/dev/null 2>&1; then
+            echo "Merge conflicts detected, continuing."
             echo "merge-in-progress=true" >> $GITHUB_OUTPUT
 
-            # Check for merge conflicts outside of `lib`. Disable git diff's trailing whitespace check
-            # since `node_modules/@types/semver/README.md` fails it.
-            if git -c core.whitespace=-trailing-space diff --check | grep --invert-match '^lib/'; then
+            # Check for merge conflicts outside of `lib`.
+            CONFLICTS_OUTSIDE_LIB=$(git diff --name-only --diff-filter=U | grep --invert-match '^lib/' || true)
+            if [ -n "$CONFLICTS_OUTSIDE_LIB" ]; then
               echo "Merge conflicts were detected outside of the lib directory. Please resolve them manually."
-              git -c core.whitespace=-trailing-space diff --check | grep --invert-match '^lib/' || true
+              echo "$CONFLICTS_OUTSIDE_LIB"
               exit 1
             fi
 
             echo "No merge conflicts found outside the lib directory. We should be able to resolve all of" \
               "these by rebuilding the Action."
+          else
+            echo "git merge failed for a reason other than merge conflicts."
+            exit 1
           fi
 
       - name: Compile TypeScript

.github/workflows/rollback-release.yml

@@ -10,8 +10,7 @@ on:
         required: true
   # Only for dry-runs of changes to the workflow.
   push:
-    # Don't run dry-run on release branches, to avoid an issue where the
-    # "new" tag determined by the "Prepare release" job already exists.
+    # Don't run dry-run on release branches, since that's unnecessary.
     branches-ignore:
       - releases/v*
     paths:
@@ -24,7 +23,7 @@ defaults:
 
 jobs:
   prepare:
-    name: "Prepare release"
+    name: "Prepare"
     if: github.repository == 'github/codeql-action'
 
     permissions:
@@ -107,8 +106,10 @@ jobs:
           # We usually expect to checkout `inputs.rollback-tag` (required for `workflow_dispatch`),
           # but use `v0.0.0` for testing.
           ROLLBACK_TAG: ${{ inputs.rollback-tag || 'v0.0.0' }}
-          RELEASE_TAG: ${{ needs.prepare.outputs.version }}
-          MAJOR_VERSION_TAG: ${{ needs.prepare.outputs.major_version }}
+          # Use `needs.prepare.outputs.version` for actual runs and `v0.0.1` for testing.
+          RELEASE_TAG: ${{ case(github.event_name == 'workflow_dispatch', needs.prepare.outputs.version, 'v0.0.1') }}
+          # Use `needs.prepare.outputs.major_version` for actual runs and `v0` for testing.
+          MAJOR_VERSION_TAG: ${{ case(github.event_name == 'workflow_dispatch', needs.prepare.outputs.major_version, 'v0') }}
         run: |
           git checkout "refs/tags/${ROLLBACK_TAG}"
           git tag --annotate "${RELEASE_TAG}" --message "${RELEASE_TAG}"
@@ -184,4 +185,3 @@ jobs:
           # Setting this to `true` for non-workflow_dispatch events will
           # still push the `branch`, but won't create a corresponding PR
           dry-run: "${{ github.event_name != 'workflow_dispatch' }}"
-

.github/workflows/update-release-branch.yml

@@ -16,15 +16,15 @@ defaults:
     shell: bash
 
 jobs:
-
   prepare:
-    name: "Prepare release"
+    name: "Prepare"
     permissions:
       contents: read
 
     uses: ./.github/workflows/prepare-release.yml
 
   update:
+    name: "Update release branch"
     timeout-minutes: 45
     runs-on: ubuntu-latest
     if: github.event_name == 'workflow_dispatch'
@@ -77,6 +77,7 @@ jobs:
           --conductor ${GITHUB_ACTOR}
 
   backport:
+    name: "Create backport"
     timeout-minutes: 45
     runs-on: ubuntu-latest
     environment: Automation

.npmrc

@@ -1 +1,2 @@
 lockfile-version=3
+min-release-age=7

.vscode/settings.json

@@ -7,6 +7,10 @@
     // transpiled JavaScript
     "build": true,
     "lib": true,
+
+    // exclude "tests" by default because it causes VSCode to start language-specific extensions
+    // that are not typically needed during development (or indeed may not work correctly)
+    "tests": true
   },
   "search.exclude": {
     "**/node_modules": true,
@@ -18,7 +22,7 @@
   "git.ignoreLimitWarning": true,
   // Use the vendored TypeScript version to have a consistent development experience across
   // machines.
-  "typescript.tsdk": "node_modules/typescript/lib",
+  "js/ts.tsdk.path": "node_modules/typescript/lib",
   "[typescript]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode"
   },

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
 
+## 3.38.3 - 08 Oct 2026
+
+- _Upcoming breaking change_: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4188](https://github.com/github/codeql-action/pull/4188)
+- Update default CodeQL bundle version to [2.27.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2). [#4203](https://github.com/github/codeql-action/pull/4203)
+- Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. [#4184](https://github.com/github/codeql-action/pull/4184)
+
 ## 3.38.2 - 24 Sept 2026
 
 - Update default CodeQL bundle version to [2.27.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1). [#4160](https://github.com/github/codeql-action/pull/4160)

README.md

@@ -72,12 +72,11 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n
 
 | Minimum CodeQL Action | Minimum CodeQL Bundle Version | GitHub Environment | Notes |
 |-----------------------|-------------------------------|--------------------|-------|
+| `v4.36.2` | `2.25.6` | Enterprise Server 3.22 | |
 | `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
 | `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
 | `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
 | `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |
-| `v3.28.12` | `2.20.7` | Enterprise Server 3.17 | |
-| `v3.28.6` | `2.20.3` | Enterprise Server 3.16 | |
 
 See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server).
 

eslint.config.mjs

@@ -158,7 +158,7 @@ export default [
     },
   },
   {
-    files: ["**/*.ts", "**/*.js", "**/*.mts"],
+    files: ["**/*.ts", "**/*.js"],
 
     rules: {
       "@typescript-eslint/no-explicit-any": "off",
@@ -180,7 +180,7 @@ export default [
     },
   },
   {
-    files: ["pr-checks/**/*.ts", "pr-checks/**/*.mts"],
+    files: ["pr-checks/**/*.ts"],
 
     languageOptions: {
       parserOptions: {

lib/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.1",
-  "cliVersion": "2.27.1",
-  "priorBundleVersion": "codeql-bundle-v2.27.0",
-  "priorCliVersion": "2.27.0"
+  "bundleVersion": "codeql-bundle-v2.27.2",
+  "cliVersion": "2.27.2",
+  "priorBundleVersion": "codeql-bundle-v2.27.1",
+  "priorCliVersion": "2.27.1"
 }