Sourced from github/codeql-action/init's releases.

v4.37.0

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

... (truncated)

• 99df26d Merge pull request #3996 from github/update-v4.37.0-c7c896d71
• 31c2707 Add changenote for #3973
• 72df218 Update changelog for v4.37.0
• c7c896d Merge pull request #3995 from github/update-bundle/codeql-bundle-v2.26.0
• 3f34ff0 Add changelog note
• 43bec09 Update default bundle to codeql-bundle-v2.26.0
• f58f0d1 Merge pull request #3973 from github/mbg/repo-props/config-file-shorthands
• 7dc37cb Merge remote-tracking branch 'origin/main' into mbg/repo-props/config-file-sh...
• 8e22350 Thread ActionState to initConfig
• 69c9e8c Mark some status-report imports as type-only to avoid circular dependencies
• Additional commits viewable in compare view

Sourced from github/codeql-action/analyze's releases.

v4.37.0

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

... (truncated)

• 99df26d Merge pull request #3996 from github/update-v4.37.0-c7c896d71
• 31c2707 Add changenote for #3973
• 72df218 Update changelog for v4.37.0
• c7c896d Merge pull request #3995 from github/update-bundle/codeql-bundle-v2.26.0
• 3f34ff0 Add changelog note
• 43bec09 Update default bundle to codeql-bundle-v2.26.0
• f58f0d1 Merge pull request #3973 from github/mbg/repo-props/config-file-shorthands
• 7dc37cb Merge remote-tracking branch 'origin/main' into mbg/repo-props/config-file-sh...
• 8e22350 Thread ActionState to initConfig
• 69c9e8c Mark some status-report imports as type-only to avoid circular dependencies
• Additional commits viewable in compare view

Sourced from fallow-rs/fallow's releases.

v3.3.0: verifiable plugin authoring, config recommendations, and hardened agent surfaces

Agent-facing plugin authoring, config recommendations, and a blast-radius tool

• fallow plugin-check: a read-only dry-run for external-plugin authoring. It reports per plugin whether it activated (and which detection requirement was unmet when it did not), and for manifestEntries rules the matched manifests, when-gate results, seeded entries with path_exists, and typed warnings[]. Deterministic output, always exit 0.
• manifestEntries for external plugins: a fallow-plugin-*.jsonc can now derive entry points from framework manifest files (recursive glob + JSON/JSONC parse + dotted-field when gate + ${dotted.field} interpolation), making manifest-driven monorepo frameworks self-serviceable without a built-in plugin.
• fallow recommend: a read-only, project-tailored config recommendation for cold-start onboarding; detects frameworks living in workspace packages too.
• impact_closure MCP tool: the pre-edit blast radius as a one-call primitive. Wraps fallow dead-code --impact-closure <path> --format json (reverse dependencies, re-export chains, coordination gaps) so agents no longer pay for the full inspect_target bundle to answer "what breaks if I change this file?".
• Self-documenting capability surface: fallow schema now enumerates the security-candidate category ids (with an include_required flag), publishes each rule's default severity and opt-in status, and every config-schema key carries a description.

Detection accuracy

• Class-member crediting got three structural upgrades: member access through interface- or type-alias-typed property hops now resolves same-file and cross-module (thanks @​martijnwalraven for the report in #1785); options objects typed by a local, unexported class credit the members of their imported property types (#1788); and Playwright Page Object methods used through a function-wrapped fixture (export function appTest() { return base.extend(...) }) are credited (thanks @​committedpazz for the report in #1791).
• Iteration bindings credit class members in three more shapes: Vue v-for over a ref.value / store.<field> source, Angular @for / *ngFor in an external templateUrl, and function-local array receivers (#1716, #1717, #1718).
• React Router and Remix route loaders now feed unused-load-data-key with framework-scoped harvesting, and fallow health --css reports near_duplicate_css_in_js_tokens alongside the existing theme-token near-duplicates.

Reliability

• The npm wrapper exits non-zero when the binary dies by a signal (previously a SIGSEGV or OOM kill read as exit 0 to CI gates); signal deaths map to 128 plus the signal number with the name on stderr, and the Linux fallback prefers the statically linked musl build when libc cannot be detected.
• A panic inside @fallow/node no longer aborts the host Node process: the addon ships with a dedicated unwinding profile and catches panics at the FFI boundary, surfacing a structured FallowNodeError with code FALLOW_PANIC.
• The LSP emits UTF-16 column positions as the protocol negotiates, so diagnostics, hover, and code lenses land on the right characters on lines containing non-ASCII text, and the remove-export quick fix no longer corrupts lines with Unicode indentation.
• fallow health --hotspots reports churn-fetch failures on stderr instead of emitting a second JSON document.

Performance

• fallow audit precomputes its focus-map signals in one graph pass, removing an O(changed files x references) cost on large PRs.
• fallow health --css parses each CSS-in-JS consumer once per run instead of once per token definer.

Internal

• The duplication detector, trace, churn, and cross-reference engines are now owned solely by fallow-engine (about 20k duplicated lines deleted); CLI, JSON, LSP, and MCP surfaces are unchanged.
• The MCP server migrated to rmcp 2.x.

Full Changelog: fallow-rs/fallow@v3.2.0...v3.3.0

v3.2.0: configurable large-function threshold, surfaced in the health summary

Health: a configurable "function too big" threshold, surfaced in the summary

This release makes the unit-size (large-function) check configurable and reports the effective ceiling in the health output.

health.maxUnitSize: raise the large-function bar instead of switching it off

The line count at which a function is reported as an oversized "large function" was hardcoded to 60 LOC. That made test suites noisy: a describe() callback spans hundreds of lines, and each large it() body trips the threshold too. The only escape was health.ignore, which drops every health signal (complexity, CRAP, hotspots) for those files, so you lost complexity checking on your test code as well.

You can now raise the bar rather than turning it off:

• Set a global health.maxUnitSize (default 60).
• Or scope it to a glob with a per-file thresholdOverrides entry, for example { "files": ["**/*.test.*"], "maxUnitSize": 500 }. Leave functions empty so the override covers both the describe() wrapper and the individual it() blocks.

Complexity, cognitive, and CRAP findings on those files are unchanged. Like the existing maxCyclomatic / maxCognitive / maxCrap overrides, this filters the reported "large functions" list; the descriptive unit-size profile and the health score still reflect raw sizes (use health.ignore to remove a file from the score entirely). Resolved thresholds are inspectable via fallow config. Thanks @​digulla for the request. (Closes #1731)

... (truncated)

Sourced from fallow-rs/fallow's changelog.

Changelog

All notable changes to fallow are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Added

• fallow suppressions: a read-only inventory of every active suppression marker. Teams governing tech debt (and agents that need to distrust a "clean" verdict) previously had to grep for fallow-ignore by hand; fallow materialized every active suppression on each full run but exposed no way to list them. The new command groups markers per file with line, kind, level (file or line), origin, and reason, plus project totals (count by kind, markers without a reason) and a stale count cross-referenced from this run's stale-suppression findings (a join, not a new detection). Human and --format json renderers (new suppression-inventory envelope, schema version 1; blanket markers keep kind: null in JSON while human output reads "blanket"), with --workspace, --changed-workspaces, --changed-since, and --file scoping. Read-only governance surface: always exits 0.

• MCP tool list_suppressions: the suppression inventory, now reachable by agents. The fallow suppressions inventory was CLI-only, so agents on the MCP surface had to shell out to see what a "clean" verdict was hiding. The new read-only list_suppressions tool wraps fallow suppressions --format json and returns the suppression-inventory envelope verbatim (no new wire contract), forwarding workspace, changed_since, and repeated file scoping (plus production and the cache knobs). It runs a full analysis, so raise FALLOW_TIMEOUT_SECS on large repos; a governance surface, not a gate, so it always exits 0 even when suppressions exist.

• Native GitHub workflow output: --format github-annotations and --format github-summary. Workflows that run fallow directly (without the bundled action) previously got no inline PR annotations or job summary; that rendering lived only in the action's jq layer. github-annotations emits GitHub workflow-command lines (::error / ::warning / ::notice) for dead-code, dupes, health, audit, security (net-new, at ::notice), fix, and the bare combined run, sorted most-severe-first with a trailing ::notice total so GitHub's 10-per-type display cap never hides the worst findings silently. file= paths are rebased onto the git repository root when the analysis root is a subdirectory (override with --annotations-path-prefix), and dependency fix commands honor PKG_MANAGER before lockfile sniffing (npm, pnpm, yarn, bun). github-summary renders the job-summary markdown for >> "$GITHUB_STEP_SUMMARY". Both are log-based, so they render on fork PRs without a write token, unlike the PR-comment/review formats.

... (truncated)

• c9326d9 chore: release v3.3.0
• b39782a docs(rules): document the PositionMapper byte-to-UTF-16 boundary convention
• b005d10 fix(members): credit Playwright POM methods through function-wrapped fixture ...
• 48f415e refactor(core): remove engine-owned copy modules
• be01c9a fix(members): hop through local unexported options classes in typed-property ...
• c196a30 fix(members): credit member access through interface/type-alias property hops
• a4fb282 docs(rules): point churn wiring at fallow_engine paths in cli-crate.md
• e28ea4a docs(rules): fix stale fallow_core trace and fingerprint paths in cli-crate.md
• 618f1dd fix(lsp): use UTF-16 units for remove-export edit range with Unicode indentation
• ef6b1de test(cli): update architecture guardrails after core detector deletion
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions