Merge pull request #3183 from github/update-v4.30.7-55283843c

Merge main into releases/v4
Update changelog for v4.30.7
2026-05-04 04:40:09 +00:00 · 2025-10-07 10:21:14 -05:00 · 2025-10-06 18:19:26 +00:00 · 2025-10-06 12:52:46 -05:00 · 2025-10-06 11:40:43 -05:00 · 2025-10-03 12:59:21 -05:00
180 changed files with 52914 additions and 3599 deletions
@@ -6,6 +6,16 @@ import * as assert from 'assert'

 const actualConfig = loadActualConfig()

+function sortConfigArrays(config) {
+  for (const key of Object.keys(config)) {
+    const value = config[key];
+    if (key === 'queries' && Array.isArray(value)) {
+      config[key] = value.sort();
+    }
+  }
+  return config;
+}
+
 const rawExpectedConfig = process.argv[3].trim()
 if (!rawExpectedConfig) {
  core.setFailed('No expected configuration provided')
@@ -18,8 +28,8 @@ if (!rawExpectedConfig) {
 const expectedConfig = rawExpectedConfig ? JSON.parse(rawExpectedConfig) : undefined;

 assert.deepStrictEqual(
-  actualConfig,
-  expectedConfig,
+  sortConfigArrays(actualConfig),
+  sortConfigArrays(expectedConfig),
  'Expected configuration does not match actual configuration'
 );

@@ -16,5 +16,5 @@ inputs:
      Comma separated list of query ids that should NOT be included in this SARIF file.

 runs:
-  using: node20
+  using: node24
  main: index.js
@@ -2,7 +2,7 @@ name: "Prepare test"
 description: Performs some preparation to run tests
 inputs:
  version:
-    description: "The version of the CodeQL CLI to use. Can be 'linked', 'default', 'nightly-latest', 'nightly-YYYYMMDD', or 'stable-vX.Y.Z"
+    description: "The version of the CodeQL CLI to use. Can be 'linked', 'default', 'nightly', 'nightly-latest', 'nightly-YYYYMMDD', or 'stable-vX.Y.Z"
    required: true
  use-all-platform-bundle:
    description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL"
@@ -35,7 +35,10 @@ runs:
      run: |
        set -e # Fail this Action if `gh release list` fails.

-        if [[ "$VERSION" == "linked" ]]; then
+        if [[ "$VERSION" == "nightly" || "$VERSION" == "nightly-latest" ]]; then
+          echo "tools-url=nightly" >> "$GITHUB_OUTPUT"
+          exit 0
+        elif [[ "$VERSION" == "linked" ]]; then
          echo "tools-url=linked" >> "$GITHUB_OUTPUT"
          exit 0
        elif [[ "$VERSION" == "default" ]]; then
@@ -43,29 +46,20 @@ runs:
          exit 0
        fi

-        if [[ "$VERSION" == "nightly-latest" && "$RUNNER_OS" != "Windows" ]]; then
-          extension="tar.zst"
-        else
-          extension="tar.gz"
-        fi
-
        if [[ "$USE_ALL_PLATFORM_BUNDLE" == "true" ]]; then
-          artifact_name="codeql-bundle.$extension"
+          artifact_name="codeql-bundle.tar.gz"
        elif [[ "$RUNNER_OS" == "Linux" ]]; then
-          artifact_name="codeql-bundle-linux64.$extension"
+          artifact_name="codeql-bundle-linux64.tar.gz"
        elif [[ "$RUNNER_OS" == "macOS" ]]; then
-          artifact_name="codeql-bundle-osx64.$extension"
+          artifact_name="codeql-bundle-osx64.tar.gz"
        elif [[ "$RUNNER_OS" == "Windows" ]]; then
-          artifact_name="codeql-bundle-win64.$extension"
+          artifact_name="codeql-bundle-win64.tar.gz"
        else
          echo "::error::Unrecognized OS $RUNNER_OS"
          exit 1
        fi

-        if [[ "$VERSION" == "nightly-latest" ]]; then
-          tag=`gh release list --repo dsp-testing/codeql-cli-nightlies -L 1 | cut -f 3`
-          echo "tools-url=https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/$tag/$artifact_name" >> $GITHUB_OUTPUT
-        elif [[ "$VERSION" == *"nightly"* ]]; then
+        if [[ "$VERSION" == *"nightly"* ]]; then
          version=`echo "$VERSION" | sed -e 's/^.*\-//'`
          echo "tools-url=https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-$version/$artifact_name" >> $GITHUB_OUTPUT
        elif [[ "$VERSION" == *"stable"* ]]; then
@@ -20,18 +20,14 @@ updates:
        patterns:
          - "*"
  - package-ecosystem: github-actions
-    directory: "/"
+    directories:
+      - "/.github/workflows"
+      - "/.github/actions"
    schedule:
      interval: weekly
+    labels:
+      - Rebuild
    groups:
      actions:
        patterns:
          - "*"
-  - package-ecosystem: github-actions
-    directory: "/.github/actions/setup-swift/" # All subdirectories outside of "/.github/workflows" must be explicitly included.
-    schedule:
-      interval: weekly
-    groups:
-      actions-setup-swift:
-        patterns:
-          - "*"
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  all-platform-bundle:
    strategy:
@@ -45,7 +48,12 @@ jobs:
        include:
          - os: ubuntu-latest
            version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+          - os: windows-latest
+            version: nightly-latest
    name: All-platform bundle
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -62,7 +70,7 @@ jobs:
          use-all-platform-bundle: 'true'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  analyze-ref-input:
    strategy:
@@ -45,11 +48,8 @@ jobs:
        include:
          - os: ubuntu-latest
            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
    name: "Analyze: 'ref' and 'sha' from inputs"
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -66,7 +66,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  autobuild-action:
    strategy:
@@ -40,6 +43,7 @@ jobs:
          - os: windows-latest
            version: linked
    name: autobuild-action
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  autobuild-direct-tracing-with-working-dir:
    strategy:
@@ -52,6 +55,7 @@ jobs:
          - os: windows-latest
            version: nightly-latest
    name: Autobuild direct tracing (custom working directory)
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -1,100 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: PR Check - Autobuild direct tracing
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-      - main
-      - releases/v*
-  pull_request:
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - ready_for_review
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
-  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
-defaults:
-  run:
-    shell: bash
-jobs:
-  autobuild-direct-tracing:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            version: linked
-          - os: windows-latest
-            version: linked
-          - os: ubuntu-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
-    name: Autobuild direct tracing
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v5
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - name: Install Java
-        uses: actions/setup-java@v5
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
-      - name: Set up Java test repo configuration
-        run: |
-          mv * .github ../action/tests/multi-language-repo/
-          mv ../action/tests/multi-language-repo/.github/workflows .github
-          mv ../action/tests/java-repo/* .
-
-      - uses: ./../action/init
-        id: init
-        with:
-          build-mode: autobuild
-          db-location: ${{ runner.temp }}/customDbLocation
-          languages: java
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-      - name: Check that indirect tracing is disabled
-        run: |
-          if [[ ! -z "${CODEQL_RUNNER}" ]]; then
-            echo "Expected indirect tracing to be disabled, but the" \
-              "CODEQL_RUNNER environment variable is set."
-            exit 1
-          fi
-
-      - uses: ./../action/analyze
-    env:
-      CODEQL_ACTION_AUTOBUILD_BUILD_MODE_DIRECT_TRACING: true
-      CODEQL_ACTION_TEST_MODE: true
@@ -27,8 +27,11 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
-  test-autobuild-working-dir:
+  autobuild-working-dir:
    strategy:
      fail-fast: false
      matrix:
@@ -36,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: linked
    name: Autobuild working directory
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -21,12 +21,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  build-mode-autobuild:
    strategy:
@@ -34,8 +47,15 @@ jobs:
      matrix:
        include:
          - os: ubuntu-latest
+            version: linked
+          - os: windows-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+          - os: windows-latest
            version: nightly-latest
    name: Build mode autobuild
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -51,6 +71,11 @@ jobs:
          version: ${{ matrix.version }}
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
+      - name: Install Java
+        uses: actions/setup-java@v5
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Set up Java test repo configuration
        run: |
          mv * .github ../action/tests/multi-language-repo/
@@ -65,6 +90,11 @@ jobs:
          languages: java
          tools: ${{ steps.prepare-test.outputs.tools-url }}

+      - name: Install yq
+        if: runner.os == 'Windows'
+        run: |
+          choco install yq -y
+
      - name: Validate database build mode
        run: |
          metadata_path="$RUNNER_TEMP/customDbLocation/java/codeql-database.yml"
@@ -74,6 +104,14 @@ jobs:
            exit 1
          fi

+      - name: Check that indirect tracing is disabled
+        run: |
+          if [[ ! -z "${CODEQL_RUNNER}" ]]; then
+            echo "Expected indirect tracing to be disabled, but the" \
+              "CODEQL_RUNNER environment variable is set."
+            exit 1
+          fi
+
      - uses: ./../action/analyze
    env:
      CODEQL_ACTION_TEST_MODE: true
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  build-mode-manual:
    strategy:
@@ -46,6 +49,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Build mode manual
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -62,7 +66,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  build-mode-none:
    strategy:
@@ -38,6 +41,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Build mode none
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  build-mode-rollback:
    strategy:
@@ -36,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Build mode rollback
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  bundle-toolcache:
    strategy:
@@ -40,6 +43,7 @@ jobs:
          - os: windows-latest
            version: linked
    name: 'Bundle: Caching checks'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -56,7 +60,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Remove CodeQL from toolcache
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        with:
          script: |
            const fs = require('fs');
@@ -66,7 +70,7 @@ jobs:
      - name: Install @actions/tool-cache
        run: npm install @actions/tool-cache
      - name: Check toolcache does not contain CodeQL
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        with:
          script: |
            const toolcache = require('@actions/tool-cache');
@@ -85,7 +89,7 @@ jobs:
          output: ${{ runner.temp }}/results
          upload-database: false
      - name: Check CodeQL is installed within the toolcache
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        with:
          script: |
            const toolcache = require('@actions/tool-cache');
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  bundle-zstd:
    strategy:
@@ -40,6 +43,7 @@ jobs:
          - os: windows-latest
            version: linked
    name: 'Bundle: Zstandard checks'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -56,7 +60,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Remove CodeQL from toolcache
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        with:
          script: |
            const fs = require('fs');
@@ -81,7 +85,7 @@ jobs:
          path: ${{ runner.temp }}/results/javascript.sarif
          retention-days: 7
      - name: Check diagnostic with expected tools URL appears in SARIF
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        env:
          SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
        with:
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  cleanup-db-cluster-dir:
    strategy:
@@ -36,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: linked
    name: Clean up database cluster directory
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  config-export:
    strategy:
@@ -35,17 +38,10 @@ jobs:
        include:
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
    name: Config export
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -77,7 +73,7 @@ jobs:
          path: ${{ runner.temp }}/results/javascript.sarif
          retention-days: 7
      - name: Check config properties appear in SARIF
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        env:
          SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
        with:
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  config-input:
    strategy:
@@ -36,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: linked
    name: Config input
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -45,7 +49,7 @@ jobs:
      - name: Check out repository
        uses: actions/checkout@v5
      - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: npm
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  cpp-deptrace-disabled:
    strategy:
@@ -40,6 +43,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: 'C/C++: disabling autoinstalling dependencies (Linux)'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  cpp-deptrace-enabled-on-macos:
    strategy:
@@ -38,6 +41,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  cpp-deptrace-enabled:
    strategy:
@@ -40,6 +43,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: 'C/C++: autoinstalling dependencies (Linux)'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  diagnostics-export:
    strategy:
@@ -35,17 +38,10 @@ jobs:
        include:
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
    name: Diagnostic export
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -88,7 +84,7 @@ jobs:
          path: ${{ runner.temp }}/results/javascript.sarif
          retention-days: 7
      - name: Check diagnostics appear in SARIF
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        env:
          SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
        with:
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  export-file-baseline-information:
    strategy:
@@ -50,6 +53,7 @@ jobs:
          - os: windows-latest
            version: nightly-latest
    name: Export file baseline information
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -66,7 +70,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  extractor-ram-threads:
    strategy:
@@ -36,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: linked
    name: Extractor ram and threads options test
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -27,8 +27,11 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
-  test-proxy:
+  global-proxy:
    strategy:
      fail-fast: false
      matrix:
@@ -38,6 +41,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Proxy test
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  go-custom-queries:
    strategy:
@@ -48,6 +51,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: 'Go: Custom queries'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -64,7 +68,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  go-indirect-tracing-workaround-diagnostic:
    strategy:
@@ -46,6 +49,7 @@ jobs:
          - os: ubuntu-latest
            version: default
    name: 'Go: diagnostic when Go is changed after init step'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -62,7 +66,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -71,7 +75,7 @@ jobs:
          languages: go
          tools: ${{ steps.prepare-test.outputs.tools-url }}
  # Deliberately change Go after the `init` step
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
        with:
          go-version: '1.20'
      - name: Build code
@@ -81,7 +85,7 @@ jobs:
          output: ${{ runner.temp }}/results
          upload-database: false
      - name: Check diagnostic appears in SARIF
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        env:
          SARIF_PATH: ${{ runner.temp }}/results/go.sarif
        with:
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  go-indirect-tracing-workaround-no-file-program:
    strategy:
@@ -46,6 +49,7 @@ jobs:
          - os: ubuntu-latest
            version: default
    name: 'Go: diagnostic when `file` is not installed'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -62,7 +66,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -82,7 +86,7 @@ jobs:
          output: ${{ runner.temp }}/results
          upload-database: false
      - name: Check diagnostic appears in SARIF
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        env:
          SARIF_PATH: ${{ runner.temp }}/results/go.sarif
        with:
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  go-indirect-tracing-workaround:
    strategy:
@@ -46,6 +49,7 @@ jobs:
          - os: ubuntu-latest
            version: default
    name: 'Go: workaround for indirect tracing'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -62,7 +66,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  go-tracing-autobuilder:
    strategy:
@@ -80,6 +83,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: 'Go: tracing with autobuilder step'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -96,7 +100,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  go-tracing-custom-build-steps:
    strategy:
@@ -80,6 +83,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: 'Go: tracing with custom build steps'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -96,7 +100,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  go-tracing-legacy-workflow:
    strategy:
@@ -80,6 +83,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: 'Go: tracing with legacy workflow'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -96,7 +100,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  init-with-registries:
    strategy:
@@ -35,23 +38,12 @@ jobs:
        include:
          - os: ubuntu-latest
            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
    name: 'Packaging: Download using registries'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      packages: read
@@ -114,8 +106,6 @@ jobs:
          fi

      - name: Verify contents of qlconfig.yml
-    # yq is not available on windows
-        if: runner.os != 'Windows'
        run: |
          QLCONFIG_PATH=$RUNNER_TEMP/qlconfig.yml
          cat $QLCONFIG_PATH | yq -e '.registries[] | select(.url == "https://ghcr.io/v2/") | select(.packages == "*/*")'
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  javascript-source-root:
    strategy:
@@ -40,6 +43,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Custom source root
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  job-run-uuid-sarif:
    strategy:
@@ -36,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Job run UUID added to SARIF
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  language-aliases:
    strategy:
@@ -36,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: linked
    name: Language aliases
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -37,15 +37,19 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
-  test-local-codeql:
+  local-bundle:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
-            version: nightly-latest
+            version: linked
    name: Local CodeQL bundle
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -62,15 +66,13 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Fetch a CodeQL bundle
-        env:
-          CODEQL_URL: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Fetch latest CodeQL bundle
        run: |
-          wget "$CODEQL_URL"
+          wget https://github.com/github/codeql-action/releases/latest/download/codeql-bundle-linux64.tar.zst
      - id: init
        uses: ./../action/init
        with:
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  multi-language-autodetect:
    strategy:
@@ -80,6 +83,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Multi-language repository
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -96,7 +100,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  overlay-init-fallback:
    strategy:
@@ -38,6 +41,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Overlay database init fallback
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  packaging-codescanning-config-inputs-js:
    strategy:
@@ -45,23 +48,12 @@ jobs:
        include:
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
          - os: ubuntu-latest
            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
    name: 'Packaging: Config and input passed to the CLI'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -71,7 +63,7 @@ jobs:
      - name: Check out repository
        uses: actions/checkout@v5
      - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: npm
@@ -85,7 +77,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  packaging-config-inputs-js:
    strategy:
@@ -45,23 +48,12 @@ jobs:
        include:
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
          - os: ubuntu-latest
            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
    name: 'Packaging: Config and input'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -71,7 +63,7 @@ jobs:
      - name: Check out repository
        uses: actions/checkout@v5
      - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: npm
@@ -85,7 +77,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  packaging-config-js:
    strategy:
@@ -45,23 +48,12 @@ jobs:
        include:
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
          - os: ubuntu-latest
            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
    name: 'Packaging: Config file'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -71,7 +63,7 @@ jobs:
      - name: Check out repository
        uses: actions/checkout@v5
      - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: npm
@@ -85,7 +77,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  packaging-inputs-js:
    strategy:
@@ -45,23 +48,12 @@ jobs:
        include:
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
          - os: ubuntu-latest
            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
    name: 'Packaging: Action input'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -71,7 +63,7 @@ jobs:
      - name: Check out repository
        uses: actions/checkout@v5
      - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: npm
@@ -85,7 +77,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  quality-queries:
    strategy:
@@ -42,24 +45,6 @@ jobs:
          - os: ubuntu-latest
            version: linked
            analysis-kinds: code-scanning,code-quality
-          - os: macos-latest
-            version: linked
-            analysis-kinds: code-scanning
-          - os: macos-latest
-            version: linked
-            analysis-kinds: code-quality
-          - os: macos-latest
-            version: linked
-            analysis-kinds: code-scanning,code-quality
-          - os: windows-latest
-            version: linked
-            analysis-kinds: code-scanning
-          - os: windows-latest
-            version: linked
-            analysis-kinds: code-quality
-          - os: windows-latest
-            version: linked
-            analysis-kinds: code-scanning,code-quality
          - os: ubuntu-latest
            version: nightly-latest
            analysis-kinds: code-scanning
@@ -69,25 +54,8 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
            analysis-kinds: code-scanning,code-quality
-          - os: macos-latest
-            version: nightly-latest
-            analysis-kinds: code-scanning
-          - os: macos-latest
-            version: nightly-latest
-            analysis-kinds: code-quality
-          - os: macos-latest
-            version: nightly-latest
-            analysis-kinds: code-scanning,code-quality
-          - os: windows-latest
-            version: nightly-latest
-            analysis-kinds: code-scanning
-          - os: windows-latest
-            version: nightly-latest
-            analysis-kinds: code-quality
-          - os: windows-latest
-            version: nightly-latest
-            analysis-kinds: code-scanning,code-quality
    name: Quality queries input
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -130,7 +98,7 @@ jobs:
          retention-days: 7
      - name: Check quality query does not appear in security SARIF
        if: contains(matrix.analysis-kinds, 'code-scanning')
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        env:
          SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
          EXPECT_PRESENT: 'false'
@@ -138,7 +106,7 @@ jobs:
          script: ${{ env.CHECK_SCRIPT }}
      - name: Check quality query appears in quality SARIF
        if: contains(matrix.analysis-kinds, 'code-quality')
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        env:
          SARIF_PATH: ${{ runner.temp }}/results/javascript.quality.sarif
          EXPECT_PRESENT: 'true'
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  remote-config:
    strategy:
@@ -48,6 +51,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Remote config file
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -64,7 +68,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  resolve-environment-action:
    strategy:
@@ -35,23 +38,12 @@ jobs:
        include:
          - os: ubuntu-latest
            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
    name: Resolve environment
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  rubocop-multi-language:
    strategy:
@@ -36,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: default
    name: RuboCop multi-language
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -52,7 +56,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Set up Ruby
-        uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
+        uses: ruby/setup-ruby@0481980f17b760ef6bca5e8c55809102a0af1e5a # v1.263.0
        with:
          ruby-version: 2.6
      - name: Install Code Scanning integration
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  ruby:
    strategy:
@@ -46,6 +49,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: Ruby analysis
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  rust:
    strategy:
@@ -44,6 +47,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Rust analysis
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  split-workflow:
    strategy:
@@ -56,6 +59,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: Split workflow
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -72,7 +76,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  start-proxy:
    strategy:
@@ -40,6 +43,7 @@ jobs:
          - os: windows-latest
            version: linked
    name: Start proxy
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  submit-sarif-failure:
    strategy:
@@ -40,6 +43,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Submit SARIF after failure
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: write # needed to upload the SARIF file
@@ -27,6 +27,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  swift-autobuild:
    strategy:
@@ -36,6 +39,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: Swift analysis using autobuild
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  swift-custom-build:
    strategy:
@@ -50,6 +53,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: Swift analysis using a custom build command
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -66,7 +70,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  unset-environment:
    strategy:
@@ -48,6 +51,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Test unsetting environment variables
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -64,7 +68,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  upload-quality-sarif:
    strategy:
@@ -45,11 +48,8 @@ jobs:
        include:
          - os: ubuntu-latest
            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
    name: 'Upload-sarif: code quality endpoint'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -66,17 +66,15 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
      - uses: ./../action/init
        with:
          tools: ${{ steps.prepare-test.outputs.tools-url }}
-          languages: cpp,csharp,java,javascript,python
-          config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
-            github.sha }}
-          analysis-kinds: code-scanning,code-quality
+          languages: csharp,java,javascript,python
+          analysis-kinds: code-quality
      - name: Build code
        run: ./build.sh
  # Generate some SARIF we can upload with the upload-sarif step
@@ -86,8 +84,12 @@ jobs:
          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
          upload: never
      - uses: ./../action/upload-sarif
+        id: upload-sarif
        with:
          ref: refs/heads/main
          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
+      - name: Check output from `upload-sarif` step
+        if: '!(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-quality)'
+        run: exit 1
    env:
      CODEQL_ACTION_TEST_MODE: true
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  upload-ref-sha-input:
    strategy:
@@ -45,11 +48,8 @@ jobs:
        include:
          - os: ubuntu-latest
            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
    name: "Upload-sarif: 'ref' and 'sha' from inputs"
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -66,7 +66,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -37,6 +37,9 @@ on:
 defaults:
  run:
    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  with-checkout-path:
    strategy:
@@ -45,11 +48,8 @@ jobs:
        include:
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
    name: Use a custom `checkout_path`
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -66,7 +66,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -23,6 +23,7 @@ env:
 jobs:
  # Identify the CodeQL tool versions to use in the analysis job.
  check-codeql-versions:
+    if: github.triggering_actor != 'dependabot[bot]'
    runs-on: ubuntu-latest
    outputs:
      versions: ${{ steps.compare.outputs.versions }}
@@ -75,6 +76,7 @@ jobs:
        echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT

  analyze-javascript:
+    if: github.triggering_actor != 'dependabot[bot]'
    needs: [check-codeql-versions]
    strategy:
      fail-fast: false
@@ -110,6 +112,7 @@ jobs:
        upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && 'always') || 'never' }}

  analyze-other:
+    if: github.triggering_actor != 'dependabot[bot]'
    runs-on: ubuntu-latest

    strategy:
@@ -28,6 +28,7 @@ defaults:

 jobs:
  code-scanning-config-tests:
+    if: github.triggering_actor != 'dependabot[bot]'
    continue-on-error: true

    permissions:
@@ -41,16 +42,10 @@ jobs:
        include:
        - os: ubuntu-latest
          version: linked
-        - os: macos-latest
-          version: linked
        - os: ubuntu-latest
          version: default
-        - os: macos-latest
-          version: default
        - os: ubuntu-latest
          version: nightly-latest
-        - os: macos-latest
-          version: nightly-latest

    # Code-Scanning config not created because environment variable is not set
    name: Code Scanning Configuration tests
@@ -61,9 +56,9 @@ jobs:
      uses: actions/checkout@v5

    - name: Set up Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v5
      with:
-        node-version: '20'
+        node-version: 24
        cache: 'npm'

    - name: Install dependencies
@@ -180,13 +175,13 @@ jobs:
      with:
        expected-config-file-contents: |
          {
-            "queries": [
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" },
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }
-            ],
            "packs": {
              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
-            }
+            },
+            "queries": [
+              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
+              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
+            ]
          }
        languages: javascript
        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
@@ -24,6 +24,7 @@ defaults:

 jobs:
  upload-artifacts:
+    if: github.triggering_actor != 'dependabot[bot]'
    strategy:
      fail-fast: false
      matrix:
@@ -50,7 +51,7 @@ jobs:
        uses: ./.github/actions/prepare-test
        with:
          version: ${{ matrix.version }}
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
        with:
          go-version: ^1.13.1
      - uses: ./../action/init
@@ -70,6 +71,7 @@ jobs:
          expect-error: true
  download-and-check-artifacts:
    name: Download and check debug artifacts after failure in analyze
+    if: github.triggering_actor != 'dependabot[bot]'
    needs: upload-artifacts
    timeout-minutes: 45
    permissions:
@@ -23,6 +23,7 @@ defaults:

 jobs:
  upload-artifacts:
+    if: github.triggering_actor != 'dependabot[bot]'
    strategy:
      fail-fast: false
      matrix:
@@ -46,7 +47,7 @@ jobs:
        uses: ./.github/actions/prepare-test
        with:
          version: ${{ matrix.version }}
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
        with:
          go-version: ^1.13.1
      - uses: ./../action/init
@@ -64,6 +65,7 @@ jobs:
        id: analysis
  download-and-check-artifacts:
    name: Download and check debug artifacts
+    if: github.triggering_actor != 'dependabot[bot]'
    needs: upload-artifacts
    timeout-minutes: 45
    permissions:
@@ -47,7 +47,7 @@ jobs:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0  # ensure we have all tags and can push commits
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5

      - name: Update git config
        run: |
@@ -139,7 +139,7 @@ jobs:
          token: "${{ secrets.GITHUB_TOKEN }}"

      - name: Generate token
-        uses: actions/create-github-app-token@v2.1.1
+        uses: actions/create-github-app-token@v2.1.4
        id: app-token
        with:
          app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -15,10 +15,12 @@ defaults:
 jobs:
  unit-tests:
    name: Unit Tests
+    if: github.triggering_actor != 'dependabot[bot]'
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
+        node-version: [20, 24]
    permissions:
      contents: read
      security-events: write # needed to upload ESLint results
@@ -31,15 +33,15 @@ jobs:
        run: git config --global core.autocrlf false

      - uses: actions/checkout@v5
-      
+
      - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
        with:
-          node-version: '20.x'
+          node-version: ${{ matrix.node-version }}
          cache: 'npm'

      - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: 3.11

@@ -54,24 +56,31 @@ jobs:
        run: .github/workflows/script/check-js.sh

      - name: Verify PR checks up to date
+        if: always()
        run: .github/workflows/script/verify-pr-checks.sh

      - name: Run unit tests
+        if: always()
        run: npm test

+      - name: Run pr-checks tests
+        if: always()
+        working-directory: pr-checks
+        run: python -m unittest discover
+
      - name: Lint
-        if: matrix.os != 'windows-latest'
+        if: always() && matrix.os != 'windows-latest'
        run: npm run lint-ci

      - name: Upload sarif
        uses: github/codeql-action/upload-sarif@v3
-        if: matrix.os == 'ubuntu-latest'
+        if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24
        with:
          sarif_file: eslint.sarif
          category: eslint

  check-node-version:
-    if: github.event.pull_request
+    if: github.event.pull_request && github.triggering_actor != 'dependabot[bot]'
    name: Check Action Node versions
    runs-on: ubuntu-latest
    timeout-minutes: 45
@@ -18,6 +18,7 @@ defaults:

 jobs:
  test-setup-python-scripts:
+    if: github.triggering_actor != 'dependabot[bot]'
    env:
      CODEQL_ACTION_TEST_MODE: true
    timeout-minutes: 45
@@ -26,7 +27,7 @@ jobs:
    runs-on: windows-latest

    steps:
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@v6
      with:
        python-version: 3.12

@@ -22,6 +22,7 @@ defaults:
 jobs:
  query-filters:
    name: Query Filters Tests
+    if: github.triggering_actor != 'dependabot[bot]'
    timeout-minutes: 45
    runs-on: ubuntu-latest
    permissions:
@@ -31,9 +32,9 @@ jobs:
      uses: actions/checkout@v5

    - name: Install Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v5
      with:
-        node-version: 20.x
+        node-version: 24
        cache: npm

    - name: Install dependencies
@@ -15,6 +15,10 @@ jobs:
    runs-on: ubuntu-latest
    if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch'

+    env:
+      HEAD_REF: ${{ github.event.pull_request.head.ref || github.event.ref }}
+      BASE_BRANCH: ${{ github.event.pull_request.base.ref || 'main' }}
+
    permissions:
      contents: write # needed to push rebuilt commit
      pull-requests: write # needed to comment on the PR
@@ -23,7 +27,7 @@ jobs:
        uses: actions/checkout@v5
        with:
          fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref || github.event.ref }}
+          ref: ${{ env.HEAD_REF }}

      - name: Remove label
        if: github.event_name == 'pull_request'
@@ -41,8 +45,6 @@ jobs:

      - name: Merge in changes from base branch
        id: merge
-        env:
-          BASE_BRANCH: ${{ github.event.pull_request.base.ref || 'main' }}
        run: |
          git fetch origin "$BASE_BRANCH"

@@ -72,13 +74,20 @@ jobs:
          npm run build

      - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: 3.11

-      - name: Generate workflows
+      - name: Sync back version updates to generated workflows
+        # Only sync back versions on Dependabot update PRs
+        if: startsWith(env.HEAD_REF, 'dependabot/')
+        working-directory: pr-checks
+        run: |
+          python3 sync_back.py -v
+
+      - name: Generate workflows
+        working-directory: pr-checks
        run: |
-          cd pr-checks
          python -m pip install --upgrade pip
          pip install ruamel.yaml==0.17.31
          python3 sync.py
@@ -10,6 +10,10 @@ on:
        required: true
  # Only for dry-runs of changes to the workflow.
  push:
+    # Don't run dry-run on release branches, to avoid an issue where the
+    # "new" tag determined by the "Prepare release" job already exists.
+    branches-ignore:
+      - releases/v*
    paths:
      - .github/workflows/rollback-release.yml
      - .github/actions/prepare-mergeback-branch/**
@@ -133,7 +137,7 @@ jobs:

      - name: Generate token
        if: github.event_name == 'workflow_dispatch'
-        uses: actions/create-github-app-token@v2.1.1
+        uses: actions/create-github-app-token@v2.1.4
        id: app-token
        with:
          app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -16,6 +16,18 @@ if [ ! -z "$(git status --porcelain)" ]; then
    # If we get a fail here then the PR needs attention
    >&2 echo "Failed: JavaScript files are not up to date. Run 'rm -rf lib && npm run-script build' to update"
    git status
+
+    echo "### Transpiled JS diff" >> $GITHUB_STEP_SUMMARY
+    echo "" >> $GITHUB_STEP_SUMMARY
+    echo '```diff' >> $GITHUB_STEP_SUMMARY
+    git diff --output="$RUNNER_TEMP/js.diff"
+    cat "$RUNNER_TEMP/js.diff" >> $GITHUB_STEP_SUMMARY
+    echo '```' >> $GITHUB_STEP_SUMMARY
+
+    # Reset bundled files to allow other checks to test for changes
+    git checkout lib
+
+    # Fail this check
    exit 1
 fi
 echo "Success: JavaScript files are up to date"
@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
 # Update the required checks based on the current branch.

+set -euo pipefail
+
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 REPO_DIR="$(dirname "$SCRIPT_DIR")"
 GRANDPARENT_DIR="$(dirname "$REPO_DIR")"
@@ -31,6 +33,12 @@ CHECKS="$(gh api repos/github/codeql-action/commits/"${GITHUB_SHA}"/check-runs -

 echo "$CHECKS" | jq

+# Fail if there are no checks
+if [ -z "$CHECKS" ] || [ "$(echo "$CHECKS" | jq '. | length')" -eq 0 ]; then
+  echo "No checks found for $GITHUB_SHA"
+  exit 1
+fi
+
 echo "{\"contexts\": ${CHECKS}}" > checks.json

 echo "Updating main"
@@ -20,6 +20,14 @@ if [ ! -z "$(git status --porcelain)" ]; then
    git diff
    git status
    >&2 echo "Failed: PR checks are not up to date. Run 'cd pr-checks && python3 sync.py' to update"
+
+    echo "### Generated workflows diff" >> $GITHUB_STEP_SUMMARY
+    echo "" >> $GITHUB_STEP_SUMMARY
+    echo '```diff' >> $GITHUB_STEP_SUMMARY
+    git diff --output="$RUNNER_TEMP/workflows.diff"
+    cat "$RUNNER_TEMP/workflows.diff" >> $GITHUB_STEP_SUMMARY
+    echo '```' >> $GITHUB_STEP_SUMMARY
+
    exit 1
 fi
-echo "Success: PR checks are up to date"
+echo "Success: PR checks are up to date"
@@ -28,6 +28,7 @@ jobs:
        - os: ubuntu-latest
          version: nightly-latest
    name: 'CodeQL Bundle All'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -46,7 +47,7 @@ jobs:
      uses: ./../action/init
      with:
        # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
-        languages: cpp,csharp,go,java,javascript,python,ruby 
+        languages: cpp,csharp,go,java,javascript,python,ruby
        tools: ${{ steps.prepare-test.outputs.tools-url }}
    - name: Build code
      run: ./build.sh
@@ -41,9 +41,9 @@ jobs:
          git config --global user.name "github-actions[bot]"

      - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
        with:
-          node-version: '20.x'
+          node-version: 24
          cache: 'npm'

      - name: Install dependencies
@@ -1,99 +0,0 @@
-name: Update dependency proxy release assets
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "The tag of CodeQL Bundle release that contains the proxy binaries as release assets"
-        type: string
-        required: true
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  update:
-    name: Update code and create PR
-    timeout-minutes: 15
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write # needed to push the updated files
-      pull-requests: write # needed to create the PR
-    env:
-      RELEASE_TAG: ${{ inputs.tag }}
-    steps:
-      - name: Check release tag format
-        id: checks
-        run: |
-          if ! [[ $RELEASE_TAG =~ ^codeql-bundle-v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Invalid release tag: expected a CodeQL bundle tag in the 'codeql-bundle-vM.N.P' format."
-            exit 1
-          fi
-
-          echo "target_branch=dependency-proxy/$RELEASE_TAG" >> $GITHUB_OUTPUT
-
-      - name: Check that the release exists
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-        run: |
-          (gh release view --repo "$GITHUB_REPOSITORY" --json "assets" "$RELEASE_TAG" && echo "Release found.") || exit 1
-
-      - name: Install Node
-        uses: actions/setup-node@v4
-
-      - name: Checkout repository
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0  # ensure we have all tags and can push commits
-          ref: main
-
-      - name: Update git config
-        run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-
-      - name: Update release tag and version
-        run: |
-          NOW=$(date +"%Y%m%d%H%M%S") # only used to make sure we don't fetch stale binaries from the toolcache
-          sed -i "s|https://github.com/github/codeql-action/releases/download/codeql-bundle-v[0-9.]\+/|https://github.com/github/codeql-action/releases/download/$RELEASE_TAG/|g" ./src/start-proxy-action.ts
-          sed -i "s/\"v2.0.[0-9]\+\"/\"v2.0.$NOW\"/g" ./src/start-proxy-action.ts
-
-      - name: Compile TypeScript and commit changes
-        env:
-          TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}
-        run: |
-          set -exu
-          git checkout -b "$TARGET_BRANCH"
-
-          npm run build
-          git add ./src/start-proxy-action.ts
-          git add ./lib
-          git commit -m "Update release used by \`start-proxy\` action"
-
-      - name: Push changes and open PR
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-          TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}
-          PR_FLAG: ${{ (github.event_name == 'workflow_dispatch' && '--draft') || '--dry-run' }}
-        run: |
-          set -exu
-          pr_title="Update release used by \`start-proxy\` to \`$RELEASE_TAG\`"
-          pr_body=$(cat << EOF
-            This PR updates the \`start-proxy\` action to use the private registry proxy binaries that
-            are attached as release assets to the \`$RELEASE_TAG\` release.
-
-
-            Please do the following before merging:
-
-            - [ ] Verify that the changes to the code are correct.
-            - [ ] Mark the PR as ready for review to trigger the CI.
-          EOF
-          )
-
-          git push origin "$TARGET_BRANCH"
-          gh pr create \
-            --head "$TARGET_BRANCH" \
-            --base "main" \
-            --title "${pr_title}" \
-            --body "${pr_body}" \
-            $PR_FLAG
@@ -93,7 +93,7 @@ jobs:
      pull-requests: write # needed to create pull request
    steps:
    - name: Generate token
-      uses: actions/create-github-app-token@v2.1.1
+      uses: actions/create-github-app-token@v2.1.4
      id: app-token
      with:
        app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -17,7 +17,7 @@ jobs:

    steps:
      - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - name: Checkout CodeQL Action
@@ -8,6 +8,11 @@
    "build": true,
    "lib": true,
  },
+  "search.exclude": {
+    "**/node_modules": true,
+    "build": true,
+    "lib": true,
+  },
  // Installing a new Node package often triggers VS Code's git limit warnings as there is typically
  // an intermediate stage where many files are modified. This setting suppresses these warnings.
  "git.ignoreLimitWarning": true,
@@ -2,10 +2,24 @@

 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.

-## [UNRELEASED]
+## 4.30.7 - 06 Oct 2025
+
+- [v4+ only] The CodeQL Action now runs on Node.js v24. [#3169](https://github.com/github/codeql-action/pull/3169)
+
+## 3.30.6 - 02 Oct 2025
+
+- Update default CodeQL bundle version to 2.23.2. [#3168](https://github.com/github/codeql-action/pull/3168)
+
+## 3.30.5 - 26 Sep 2025
+
+- We fixed a bug that was introduced in `3.30.4` with `upload-sarif` which resulted in files without a `.sarif` extension not getting uploaded. [#3160](https://github.com/github/codeql-action/pull/3160)
+
+## 3.30.4 - 25 Sep 2025

 - We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the `codeql-action/init` step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the `codeql-action/init` step. [#3099](https://github.com/github/codeql-action/pull/3099) and [#3100](https://github.com/github/codeql-action/pull/3100)
 - We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. [#3107](https://github.com/github/codeql-action/pull/3107)
+- You can now run the latest CodeQL nightly bundle by passing `tools: nightly` to the `init` action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. [#3130](https://github.com/github/codeql-action/pull/3130)
+- Update default CodeQL bundle version to 2.23.1. [#3118](https://github.com/github/codeql-action/pull/3118)

 ## 3.30.3 - 10 Sep 2025

@@ -13,13 +13,14 @@ Please note that this project is released with a [Contributor Code of Conduct][c

 ## Development and Testing

-Before you start, ensure that you have a recent version of node (16 or higher) installed, along with a recent version of npm (9.2 or higher). You can see which version of node is used by the action in `init/action.yml`.
+Before you start, ensure that you have a recent version of node (24 or higher) installed, along with a recent version of npm (9.2 or higher). You can see which version of node is used by the action in `init/action.yml`.

 ### Common tasks

 * Transpile the TypeScript to JavaScript: `npm run build`.  Note that the JavaScript files are committed to git.
 * Run tests: `npm run test`.  You’ll need to ensure that the JavaScript files are up-to-date first by running the command above.
 * Run the linter: `npm run lint`.
+* Run tests for a specific path: `npm run ava -- ./src/filename.test.ts` or `npm run ava -- ./src/feature-flags/`

 This project also includes configuration to run tests from VSCode (with support for breakpoints) - open the test file you wish to run and choose "Debug AVA test file" from the Run menu in the Run panel.

@@ -62,7 +62,8 @@ For compiled languages:

 The following versions of the CodeQL Action are currently supported:

- v3 (latest)
+- v4 (latest)
+- v3

 ## Supported versions of the CodeQL Bundle on GitHub Enterprise Server

@@ -58,7 +58,7 @@ inputs:
    # If changing this, make sure to update workflow.ts accordingly.
    default: ${{ github.workspace }}
  ref:
-    description: "The ref where results will be uploaded. If not provided, the Action will use the GITHUB_REF environment variable. If provided, the sha input must be provided as well. This input is ignored for pull requests from forks."
+    description: "The ref where results will be uploaded. If not provided, the Action will use the GITHUB_REF environment variable. If provided, the sha input must be provided as well. This input is ignored for pull requests from forks. Expected format: refs/heads/<branch name>, refs/tags/<tag>, refs/pull/<number>/merge, or refs/pull/<number>/head."
    required: false
  sha:
    description: "The sha of the HEAD of the ref where results will be uploaded. If not provided, the Action will use the GITHUB_SHA environment variable. If provided, the ref input must be provided as well. This input is ignored for pull requests from forks."
@@ -92,6 +92,6 @@ outputs:
  sarif-id:
    description: The ID of the uploaded SARIF file.
 runs:
-  using: node20
+  using: node24
  main: "../lib/analyze-action.js"
  post: "../lib/analyze-action-post.js"
@@ -15,5 +15,5 @@ inputs:
      $GITHUB_WORKSPACE as its working directory.
    required: false
 runs:
-  using: node20
+  using: node24
  main: '../lib/autobuild-action.js'
@@ -146,6 +146,12 @@ export default [
      "@typescript-eslint/prefer-regexp-exec": "off",
      "@typescript-eslint/require-await": "off",
      "@typescript-eslint/restrict-template-expressions": "off",
+      "@typescript-eslint/no-unused-vars": [
+        "error",
+        {
+          "argsIgnorePattern": "^_",
+        }
+      ],
      "func-style": "off",
    },
  },
@@ -12,6 +12,9 @@ inputs:
      - The URL of a CodeQL Bundle tarball GitHub release asset, or
      - A special value `linked` which uses the version of the CodeQL tools
        that the Action has been bundled with.
+      - A special value `nightly` which uses the latest nightly version of the
+        CodeQL tools. Note that this is unstable and not recommended for
+        production use.

      If not specified, the Action will check in several places until it finds
      the CodeQL tools.
@@ -162,6 +165,6 @@ outputs:
  codeql-version:
    description: The version of the CodeQL binary used for analysis
 runs:
-  using: node20
+  using: node24
  main: '../lib/init-action.js'
  post: '../lib/init-action-post.js'
@@ -22,7 +22,7 @@ test: build

 # Run the tests for a single file
 test_file filename: build
-    npx ava --verbose {{filename}}
+    npm run ava {{filename}}

 [doc("Refresh the .js build artefacts in the lib directory")]
 [confirm]
@@ -26438,16 +26438,17 @@ var require_package = __commonJS({
  "package.json"(exports2, module2) {
    module2.exports = {
      name: "codeql",
-      version: "3.30.4",
+      version: "4.30.7",
      private: true,
      description: "CodeQL action",
      scripts: {
        _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "npm run transpile && node build.mjs",
+        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
        lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
        "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
        "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        test: "npm run transpile && ava src/**.test.ts --serial --verbose",
+        ava: "npm run transpile && ava --serial --verbose",
+        test: "npm run ava -- src/",
        "test-debug": "npm run test -- --timeout=20m",
        transpile: "tsc --build --verbose"
      },
@@ -26463,7 +26464,7 @@ var require_package = __commonJS({
      dependencies: {
        "@actions/artifact": "^2.3.1",
        "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.0.5",
+        "@actions/cache": "^4.1.0",
        "@actions/core": "^1.11.1",
        "@actions/exec": "^1.1.1",
        "@actions/github": "^6.0.0",
@@ -26490,11 +26491,11 @@ var require_package = __commonJS({
      },
      devDependencies: {
        "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.3.2",
+        "@eslint/compat": "^1.4.0",
        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "^9.35.0",
+        "@eslint/js": "^9.36.0",
        "@microsoft/eslint-formatter-sarif": "^3.1.0",
-        "@octokit/types": "^14.1.0",
+        "@octokit/types": "^15.0.0",
        "@types/archiver": "^6.0.3",
        "@types/console-log-level": "^1.4.5",
        "@types/follow-redirects": "^1.14.4",
@@ -26503,10 +26504,10 @@ var require_package = __commonJS({
        "@types/node-forge": "^1.3.14",
        "@types/semver": "^7.7.1",
        "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.43.0",
+        "@typescript-eslint/eslint-plugin": "^8.44.1",
        "@typescript-eslint/parser": "^8.41.0",
        ava: "^6.4.1",
-        esbuild: "^0.25.9",
+        esbuild: "^0.25.10",
        eslint: "^8.57.1",
        "eslint-import-resolver-typescript": "^3.8.7",
        "eslint-plugin-filenames": "^1.3.2",
@@ -28541,7 +28542,7 @@ var require_brace_expansion = __commonJS({
      var isSequence = isNumericSequence || isAlphaSequence;
      var isOptions = m.body.indexOf(",") >= 0;
      if (!isSequence && !isOptions) {
-        if (m.post.match(/,.*\}/)) {
+        if (m.post.match(/,(?!,).*\}/)) {
          str2 = m.pre + "{" + m.body + escClose + m.post;
          return expand(str2);
        }
@@ -67282,7 +67283,7 @@ var require_package2 = __commonJS({
  "node_modules/@actions/cache/package.json"(exports2, module2) {
    module2.exports = {
      name: "@actions/cache",
-      version: "4.0.5",
+      version: "4.1.0",
      preview: true,
      description: "Actions cache lib",
      keywords: [
@@ -72091,11 +72092,18 @@ var require_cache2 = __commonJS({
            kind: "scalar",
            T: 9
            /*ScalarType.STRING*/
+          },
+          {
+            no: 3,
+            name: "message",
+            kind: "scalar",
+            T: 9
+            /*ScalarType.STRING*/
          }
        ]);
      }
      create(value) {
-        const message = { ok: false, signedUploadUrl: "" };
+        const message = { ok: false, signedUploadUrl: "", message: "" };
        globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
        if (value !== void 0)
          (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72114,6 +72122,10 @@ var require_cache2 = __commonJS({
            2:
              message.signedUploadUrl = reader.string();
              break;
+            case /* string message */
+            3:
+              message.message = reader.string();
+              break;
            default:
              let u = options.readUnknownField;
              if (u === "throw")
@@ -72130,6 +72142,8 @@ var require_cache2 = __commonJS({
          writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
        if (message.signedUploadUrl !== "")
          writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
+        if (message.message !== "")
+          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
        let u = options.writeUnknownFields;
        if (u !== false)
          (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -72235,11 +72249,18 @@ var require_cache2 = __commonJS({
            kind: "scalar",
            T: 3
            /*ScalarType.INT64*/
+          },
+          {
+            no: 3,
+            name: "message",
+            kind: "scalar",
+            T: 9
+            /*ScalarType.STRING*/
          }
        ]);
      }
      create(value) {
-        const message = { ok: false, entryId: "0" };
+        const message = { ok: false, entryId: "0", message: "" };
        globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
        if (value !== void 0)
          (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72258,6 +72279,10 @@ var require_cache2 = __commonJS({
            2:
              message.entryId = reader.int64().toString();
              break;
+            case /* string message */
+            3:
+              message.message = reader.string();
+              break;
            default:
              let u = options.readUnknownField;
              if (u === "throw")
@@ -72274,6 +72299,8 @@ var require_cache2 = __commonJS({
          writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
        if (message.entryId !== "0")
          writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
+        if (message.message !== "")
+          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
        let u = options.writeUnknownFields;
        if (u !== false)
          (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -73037,7 +73064,7 @@ var require_cache3 = __commonJS({
      });
    };
    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
    var core14 = __importStar4(require_core());
    var path6 = __importStar4(require("path"));
    var utils = __importStar4(require_cacheUtils());
@@ -73045,7 +73072,6 @@ var require_cache3 = __commonJS({
    var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
    var config_1 = require_config();
    var tar_1 = require_tar();
-    var constants_1 = require_constants7();
    var http_client_1 = require_lib();
    var ValidationError = class _ValidationError extends Error {
      constructor(message) {
@@ -73063,6 +73089,14 @@ var require_cache3 = __commonJS({
      }
    };
    exports2.ReserveCacheError = ReserveCacheError2;
+    var FinalizeCacheError = class _FinalizeCacheError extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "FinalizeCacheError";
+        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
+      }
+    };
+    exports2.FinalizeCacheError = FinalizeCacheError;
    function checkPaths(paths) {
      if (!paths || paths.length === 0) {
        throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -73334,9 +73368,6 @@ var require_cache3 = __commonJS({
          }
          const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
          core14.debug(`File Size: ${archiveFileSize}`);
-          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
-            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
-          }
          options.archiveSizeBytes = archiveFileSize;
          core14.debug("Reserving Cache");
          const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -73348,7 +73379,10 @@ var require_cache3 = __commonJS({
          try {
            const response = yield twirpClient.CreateCacheEntry(request);
            if (!response.ok) {
-              throw new Error("Response was not ok");
+              if (response.message) {
+                core14.warning(`Cache reservation failed: ${response.message}`);
+              }
+              throw new Error(response.message || "Response was not ok");
            }
            signedUploadUrl = response.signedUploadUrl;
          } catch (error2) {
@@ -73365,6 +73399,9 @@ var require_cache3 = __commonJS({
          const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
          core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
          if (!finalizeResponse.ok) {
+            if (finalizeResponse.message) {
+              throw new FinalizeCacheError(finalizeResponse.message);
+            }
            throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
          }
          cacheId = parseInt(finalizeResponse.entryId);
@@ -73374,6 +73411,8 @@ var require_cache3 = __commonJS({
            throw error2;
          } else if (typedError.name === ReserveCacheError2.name) {
            core14.info(`Failed to save: ${typedError.message}`);
+          } else if (typedError.name === FinalizeCacheError.name) {
+            core14.warning(typedError.message);
          } else {
            if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
              core14.error(`Failed to save: ${typedError.message}`);
@@ -94796,7 +94835,7 @@ var require_commonjs16 = __commonJS({
    var TYPEMASK = 1023;
    var entToType = (s) => s.isFile() ? IFREG : s.isDirectory() ? IFDIR : s.isSymbolicLink() ? IFLNK : s.isCharacterDevice() ? IFCHR : s.isBlockDevice() ? IFBLK : s.isSocket() ? IFSOCK : s.isFIFO() ? IFIFO : UNKNOWN;
    var normalizeCache = /* @__PURE__ */ new Map();
-    var normalize3 = (s) => {
+    var normalize2 = (s) => {
      const c = normalizeCache.get(s);
      if (c)
        return c;
@@ -94809,7 +94848,7 @@ var require_commonjs16 = __commonJS({
      const c = normalizeNocaseCache.get(s);
      if (c)
        return c;
-      const n = normalize3(s.toLowerCase());
+      const n = normalize2(s.toLowerCase());
      normalizeNocaseCache.set(s, n);
      return n;
    };
@@ -94978,7 +95017,7 @@ var require_commonjs16 = __commonJS({
       */
      constructor(name, type2 = UNKNOWN, root, roots, nocase, children, opts) {
        this.name = name;
-        this.#matchName = nocase ? normalizeNocase(name) : normalize3(name);
+        this.#matchName = nocase ? normalizeNocase(name) : normalize2(name);
        this.#type = type2 & TYPEMASK;
        this.nocase = nocase;
        this.roots = roots;
@@ -95071,7 +95110,7 @@ var require_commonjs16 = __commonJS({
          return this.parent || this;
        }
        const children = this.children();
-        const name = this.nocase ? normalizeNocase(pathPart) : normalize3(pathPart);
+        const name = this.nocase ? normalizeNocase(pathPart) : normalize2(pathPart);
        for (const p of children) {
          if (p.#matchName === name) {
            return p;
@@ -95316,7 +95355,7 @@ var require_commonjs16 = __commonJS({
       * directly.
       */
      isNamed(n) {
-        return !this.nocase ? this.#matchName === normalize3(n) : this.#matchName === normalizeNocase(n);
+        return !this.nocase ? this.#matchName === normalize2(n) : this.#matchName === normalizeNocase(n);
      }
      /**
       * Return the Path object corresponding to the target of a symbolic link.
@@ -95455,7 +95494,7 @@ var require_commonjs16 = __commonJS({
      #readdirMaybePromoteChild(e, c) {
        for (let p = c.provisional; p < c.length; p++) {
          const pchild = c[p];
-          const name = this.nocase ? normalizeNocase(e.name) : normalize3(e.name);
+          const name = this.nocase ? normalizeNocase(e.name) : normalize2(e.name);
          if (name !== pchild.#matchName) {
            continue;
          }
@@ -103286,7 +103325,7 @@ var require_tr46 = __commonJS({
      TRANSITIONAL: 0,
      NONTRANSITIONAL: 1
    };
-    function normalize3(str2) {
+    function normalize2(str2) {
      return str2.split("\0").map(function(s) {
        return s.normalize("NFC");
      }).join("\0");
@@ -103366,7 +103405,7 @@ var require_tr46 = __commonJS({
        processing_option = PROCESSING_OPTIONS.NONTRANSITIONAL;
      }
      var error2 = false;
-      if (normalize3(label) !== label || label[3] === "-" && label[4] === "-" || label[0] === "-" || label[label.length - 1] === "-" || label.indexOf(".") !== -1 || label.search(combiningMarksRegex) === 0) {
+      if (normalize2(label) !== label || label[3] === "-" && label[4] === "-" || label[0] === "-" || label[label.length - 1] === "-" || label.indexOf(".") !== -1 || label.search(combiningMarksRegex) === 0) {
        error2 = true;
      }
      var len = countSymbols(label);
@@ -103384,7 +103423,7 @@ var require_tr46 = __commonJS({
    }
    function processing(domain_name, useSTD3, processing_option) {
      var result = mapChars(domain_name, useSTD3, processing_option);
-      result.string = normalize3(result.string);
+      result.string = normalize2(result.string);
      var labels = result.string.split(".");
      for (var i = 0; i < labels.length; ++i) {
        try {
@@ -117487,7 +117526,6 @@ function wrapCliConfigurationError(cliError) {
 // src/config-utils.ts
 var fs3 = __toESM(require("fs"));
 var path3 = __toESM(require("path"));
-var semver4 = __toESM(require_semver2());

 // src/analyses.ts
 var AnalysisKind = /* @__PURE__ */ ((AnalysisKind2) => {
@@ -117500,8 +117538,17 @@ var supportedAnalysisKinds = new Set(Object.values(AnalysisKind));
 // src/caching-utils.ts
 var core6 = __toESM(require_core());

+// src/config/db-config.ts
+var semver2 = __toESM(require_semver2());
+var PACK_IDENTIFIER_PATTERN = (function() {
+  const alphaNumeric = "[a-z0-9]";
+  const alphaNumericDash = "[a-z0-9-]";
+  const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
+  return new RegExp(`^${component}/${component}$`);
+})();
+
 // src/feature-flags.ts
-var semver3 = __toESM(require_semver2());
+var semver4 = __toESM(require_semver2());

 // src/overlay-database-utils.ts
 var fs2 = __toESM(require("fs"));
@@ -117686,7 +117733,7 @@ function withGroup(groupName, f) {
 }

 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -117747,13 +117794,13 @@ function computeChangedFiles(baseFileOids, overlayFileOids) {
 }

 // src/tools-features.ts
-var semver2 = __toESM(require_semver2());
+var semver3 = __toESM(require_semver2());
 function isSupportedToolsFeature(versionInfo, feature) {
  return !!versionInfo.features && versionInfo.features[feature];
 }
 var SafeArtifactUploadVersion = "2.20.3";
 function isSafeArtifactUpload(codeQlVersion) {
-  return !codeQlVersion ? true : semver2.gte(codeQlVersion, SafeArtifactUploadVersion);
+  return !codeQlVersion ? true : semver3.gte(codeQlVersion, SafeArtifactUploadVersion);
 }

 // src/feature-flags.ts
@@ -117914,6 +117961,11 @@ var featureConfig = {
    minimumVersion: void 0,
    toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
  },
+  ["use_repository_properties" /* UseRepositoryProperties */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
+    minimumVersion: void 0
+  },
  ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -117955,12 +118007,6 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
  rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
  swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
 };
-var PACK_IDENTIFIER_PATTERN = (function() {
-  const alphaNumeric = "[a-z0-9]";
-  const alphaNumericDash = "[a-z0-9-]";
-  const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
-  return new RegExp(`^${component}/${component}$`);
-})();
 function getPathToParsedConfigFile(tempDir) {
  return path3.join(tempDir, "config");
 }
@@ -118625,7 +118671,7 @@ async function uploadCombinedSarifArtifacts(logger, gitHubVariant, codeQlVersion
      if (fs5.existsSync(baseTempDir)) {
        const outputDirs = fs5.readdirSync(baseTempDir);
        for (const outputDir of outputDirs) {
-          const sarifFiles = fs5.readdirSync(path5.resolve(baseTempDir, outputDir)).filter((f) => f.endsWith(".sarif"));
+          const sarifFiles = fs5.readdirSync(path5.resolve(baseTempDir, outputDir)).filter((f) => path5.extname(f) === ".sarif");
          for (const sarifFile of sarifFiles) {
            toUpload.push(path5.resolve(baseTempDir, outputDir, sarifFile));
          }
@@ -27722,7 +27722,7 @@ var require_pattern = __commonJS({
      const absolute = [];
      const relative2 = [];
      for (const pattern of patterns) {
-        if (isAbsolute3(pattern)) {
+        if (isAbsolute2(pattern)) {
          absolute.push(pattern);
        } else {
          relative2.push(pattern);
@@ -27731,10 +27731,10 @@ var require_pattern = __commonJS({
      return [absolute, relative2];
    }
    exports2.partitionAbsoluteAndRelative = partitionAbsoluteAndRelative;
-    function isAbsolute3(pattern) {
+    function isAbsolute2(pattern) {
      return path20.isAbsolute(pattern);
    }
-    exports2.isAbsolute = isAbsolute3;
+    exports2.isAbsolute = isAbsolute2;
  }
 });

@@ -28149,11 +28149,11 @@ var require_out = __commonJS({
      async.read(path20, getSettings(optionsOrSettingsOrCallback), callback);
    }
    exports2.stat = stat;
-    function statSync3(path20, optionsOrSettings) {
+    function statSync4(path20, optionsOrSettings) {
      const settings = getSettings(optionsOrSettings);
      return sync.read(path20, settings);
    }
-    exports2.statSync = statSync3;
+    exports2.statSync = statSync4;
    function getSettings(settingsOrOptions = {}) {
      if (settingsOrOptions instanceof settings_1.default) {
        return settingsOrOptions;
@@ -32287,16 +32287,17 @@ var require_package = __commonJS({
  "package.json"(exports2, module2) {
    module2.exports = {
      name: "codeql",
-      version: "3.30.4",
+      version: "4.30.7",
      private: true,
      description: "CodeQL action",
      scripts: {
        _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "npm run transpile && node build.mjs",
+        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
        lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
        "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
        "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        test: "npm run transpile && ava src/**.test.ts --serial --verbose",
+        ava: "npm run transpile && ava --serial --verbose",
+        test: "npm run ava -- src/",
        "test-debug": "npm run test -- --timeout=20m",
        transpile: "tsc --build --verbose"
      },
@@ -32312,7 +32313,7 @@ var require_package = __commonJS({
      dependencies: {
        "@actions/artifact": "^2.3.1",
        "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.0.5",
+        "@actions/cache": "^4.1.0",
        "@actions/core": "^1.11.1",
        "@actions/exec": "^1.1.1",
        "@actions/github": "^6.0.0",
@@ -32339,11 +32340,11 @@ var require_package = __commonJS({
      },
      devDependencies: {
        "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.3.2",
+        "@eslint/compat": "^1.4.0",
        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "^9.35.0",
+        "@eslint/js": "^9.36.0",
        "@microsoft/eslint-formatter-sarif": "^3.1.0",
-        "@octokit/types": "^14.1.0",
+        "@octokit/types": "^15.0.0",
        "@types/archiver": "^6.0.3",
        "@types/console-log-level": "^1.4.5",
        "@types/follow-redirects": "^1.14.4",
@@ -32352,10 +32353,10 @@ var require_package = __commonJS({
        "@types/node-forge": "^1.3.14",
        "@types/semver": "^7.7.1",
        "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.43.0",
+        "@typescript-eslint/eslint-plugin": "^8.44.1",
        "@typescript-eslint/parser": "^8.41.0",
        ava: "^6.4.1",
-        esbuild: "^0.25.9",
+        esbuild: "^0.25.10",
        eslint: "^8.57.1",
        "eslint-import-resolver-typescript": "^3.8.7",
        "eslint-plugin-filenames": "^1.3.2",
@@ -34390,7 +34391,7 @@ var require_brace_expansion = __commonJS({
      var isSequence = isNumericSequence || isAlphaSequence;
      var isOptions = m.body.indexOf(",") >= 0;
      if (!isSequence && !isOptions) {
-        if (m.post.match(/,.*\}/)) {
+        if (m.post.match(/,(?!,).*\}/)) {
          str2 = m.pre + "{" + m.body + escClose + m.post;
          return expand(str2);
        }
@@ -73131,7 +73132,7 @@ var require_package2 = __commonJS({
  "node_modules/@actions/cache/package.json"(exports2, module2) {
    module2.exports = {
      name: "@actions/cache",
-      version: "4.0.5",
+      version: "4.1.0",
      preview: true,
      description: "Actions cache lib",
      keywords: [
@@ -77940,11 +77941,18 @@ var require_cache2 = __commonJS({
            kind: "scalar",
            T: 9
            /*ScalarType.STRING*/
+          },
+          {
+            no: 3,
+            name: "message",
+            kind: "scalar",
+            T: 9
+            /*ScalarType.STRING*/
          }
        ]);
      }
      create(value) {
-        const message = { ok: false, signedUploadUrl: "" };
+        const message = { ok: false, signedUploadUrl: "", message: "" };
        globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
        if (value !== void 0)
          (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -77963,6 +77971,10 @@ var require_cache2 = __commonJS({
            2:
              message.signedUploadUrl = reader.string();
              break;
+            case /* string message */
+            3:
+              message.message = reader.string();
+              break;
            default:
              let u = options.readUnknownField;
              if (u === "throw")
@@ -77979,6 +77991,8 @@ var require_cache2 = __commonJS({
          writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
        if (message.signedUploadUrl !== "")
          writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
+        if (message.message !== "")
+          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
        let u = options.writeUnknownFields;
        if (u !== false)
          (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78084,11 +78098,18 @@ var require_cache2 = __commonJS({
            kind: "scalar",
            T: 3
            /*ScalarType.INT64*/
+          },
+          {
+            no: 3,
+            name: "message",
+            kind: "scalar",
+            T: 9
+            /*ScalarType.STRING*/
          }
        ]);
      }
      create(value) {
-        const message = { ok: false, entryId: "0" };
+        const message = { ok: false, entryId: "0", message: "" };
        globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
        if (value !== void 0)
          (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -78107,6 +78128,10 @@ var require_cache2 = __commonJS({
            2:
              message.entryId = reader.int64().toString();
              break;
+            case /* string message */
+            3:
+              message.message = reader.string();
+              break;
            default:
              let u = options.readUnknownField;
              if (u === "throw")
@@ -78123,6 +78148,8 @@ var require_cache2 = __commonJS({
          writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
        if (message.entryId !== "0")
          writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
+        if (message.message !== "")
+          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
        let u = options.writeUnknownFields;
        if (u !== false)
          (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78886,7 +78913,7 @@ var require_cache3 = __commonJS({
      });
    };
    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
    var core15 = __importStar4(require_core());
    var path20 = __importStar4(require("path"));
    var utils = __importStar4(require_cacheUtils());
@@ -78894,7 +78921,6 @@ var require_cache3 = __commonJS({
    var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
    var config_1 = require_config();
    var tar_1 = require_tar();
-    var constants_1 = require_constants10();
    var http_client_1 = require_lib();
    var ValidationError = class _ValidationError extends Error {
      constructor(message) {
@@ -78912,6 +78938,14 @@ var require_cache3 = __commonJS({
      }
    };
    exports2.ReserveCacheError = ReserveCacheError2;
+    var FinalizeCacheError = class _FinalizeCacheError extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "FinalizeCacheError";
+        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
+      }
+    };
+    exports2.FinalizeCacheError = FinalizeCacheError;
    function checkPaths(paths) {
      if (!paths || paths.length === 0) {
        throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -79183,9 +79217,6 @@ var require_cache3 = __commonJS({
          }
          const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
          core15.debug(`File Size: ${archiveFileSize}`);
-          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
-            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
-          }
          options.archiveSizeBytes = archiveFileSize;
          core15.debug("Reserving Cache");
          const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -79197,7 +79228,10 @@ var require_cache3 = __commonJS({
          try {
            const response = yield twirpClient.CreateCacheEntry(request);
            if (!response.ok) {
-              throw new Error("Response was not ok");
+              if (response.message) {
+                core15.warning(`Cache reservation failed: ${response.message}`);
+              }
+              throw new Error(response.message || "Response was not ok");
            }
            signedUploadUrl = response.signedUploadUrl;
          } catch (error2) {
@@ -79214,6 +79248,9 @@ var require_cache3 = __commonJS({
          const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
          core15.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
          if (!finalizeResponse.ok) {
+            if (finalizeResponse.message) {
+              throw new FinalizeCacheError(finalizeResponse.message);
+            }
            throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
          }
          cacheId = parseInt(finalizeResponse.entryId);
@@ -79223,6 +79260,8 @@ var require_cache3 = __commonJS({
            throw error2;
          } else if (typedError.name === ReserveCacheError2.name) {
            core15.info(`Failed to save: ${typedError.message}`);
+          } else if (typedError.name === FinalizeCacheError.name) {
+            core15.warning(typedError.message);
          } else {
            if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
              core15.error(`Failed to save: ${typedError.message}`);
@@ -89754,7 +89793,7 @@ async function tryGetFolderBytes(cacheDir, logger, quiet = false) {
  }
 }
 var hadTimeout = false;
-async function withTimeout(timeoutMs, promise, onTimeout) {
+async function waitForResultWithTimeLimit(timeoutMs, promise, onTimeout) {
  let finished2 = false;
  const mainTask = async () => {
    const result = await promise;
@@ -90128,6 +90167,7 @@ var CodeScanning = {
  target: "PUT /repos/:owner/:repo/code-scanning/analysis" /* CODE_SCANNING */,
  sarifExtension: ".sarif",
  sarifPredicate: (name) => name.endsWith(CodeScanning.sarifExtension) && !CodeQuality.sarifPredicate(name),
+  fixCategory: (_, category) => category,
  sentinelPrefix: "CODEQL_UPLOAD_SARIF_"
 };
 var CodeQuality = {
@@ -90136,6 +90176,7 @@ var CodeQuality = {
  target: "PUT /repos/:owner/:repo/code-quality/analysis" /* CODE_QUALITY */,
  sarifExtension: ".quality.sarif",
  sarifPredicate: (name) => name.endsWith(CodeQuality.sarifExtension),
+  fixCategory: fixCodeQualityCategory,
  sentinelPrefix: "CODEQL_UPLOAD_QUALITY_SARIF_"
 };

@@ -90198,6 +90239,14 @@ function getApiDetails() {
 function getApiClient() {
  return createApiClientWithDetails(getApiDetails());
 }
+function getAuthorizationHeaderFor(logger, apiDetails, url2) {
+  if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) {
+    logger.debug(`Providing an authorization token.`);
+    return `token ${apiDetails.auth}`;
+  }
+  logger.debug(`Not using an authorization token.`);
+  return void 0;
+}
 var cachedGitHubVersion = void 0;
 async function getGitHubVersionFromApi(apiClient, apiDetails) {
  if (parseGitHubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) {
@@ -90555,7 +90604,6 @@ function wrapCliConfigurationError(cliError) {
 // src/config-utils.ts
 var fs9 = __toESM(require("fs"));
 var path10 = __toESM(require("path"));
-var semver4 = __toESM(require_semver2());

 // src/caching-utils.ts
 var core6 = __toESM(require_core());
@@ -90569,6 +90617,15 @@ function shouldStoreCache(kind) {
  return kind === "full" /* Full */ || kind === "store" /* Store */;
 }

+// src/config/db-config.ts
+var semver2 = __toESM(require_semver2());
+var PACK_IDENTIFIER_PATTERN = (function() {
+  const alphaNumeric = "[a-z0-9]";
+  const alphaNumericDash = "[a-z0-9-]";
+  const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
+  return new RegExp(`^${component}/${component}$`);
+})();
+
 // src/diff-informed-analysis-utils.ts
 var fs8 = __toESM(require("fs"));
 var path9 = __toESM(require("path"));
@@ -90576,11 +90633,11 @@ var path9 = __toESM(require("path"));
 // src/feature-flags.ts
 var fs7 = __toESM(require("fs"));
 var path8 = __toESM(require("path"));
-var semver3 = __toESM(require_semver2());
+var semver4 = __toESM(require_semver2());

 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.0";
-var cliVersion = "2.23.0";
+var bundleVersion = "codeql-bundle-v2.23.2";
+var cliVersion = "2.23.2";

 // src/overlay-database-utils.ts
 var crypto = __toESM(require("crypto"));
@@ -90811,7 +90868,7 @@ function formatDuration(durationMs) {
 }

 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -90872,7 +90929,7 @@ function computeChangedFiles(baseFileOids, overlayFileOids) {
 }
 var CACHE_VERSION = 1;
 var CACHE_PREFIX = "codeql-overlay-base-database";
-var MAX_CACHE_OPERATION_MS = 12e4;
+var MAX_CACHE_OPERATION_MS = 6e5;
 function checkOverlayBaseDatabase(config, logger, warningPrefix) {
  const baseDatabaseOidsFilePath = getBaseDatabaseOidsFilePath(config);
  if (!fs6.existsSync(baseDatabaseOidsFilePath)) {
@@ -90940,7 +90997,7 @@ async function uploadOverlayBaseDatabaseToCache(codeql, config, logger) {
    `Uploading overlay-base database to Actions cache with key ${cacheSaveKey}`
  );
  try {
-    const cacheId = await withTimeout(
+    const cacheId = await waitForResultWithTimeLimit(
      MAX_CACHE_OPERATION_MS,
      actionsCache.saveCache([dbLocation], cacheSaveKey),
      () => {
@@ -90982,7 +91039,7 @@ function createCacheKeyHash(components) {
 }

 // src/tools-features.ts
-var semver2 = __toESM(require_semver2());
+var semver3 = __toESM(require_semver2());
 function isSupportedToolsFeature(versionInfo, feature) {
  return !!versionInfo.features && versionInfo.features[feature];
 }
@@ -91148,6 +91205,11 @@ var featureConfig = {
    minimumVersion: void 0,
    toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
  },
+  ["use_repository_properties" /* UseRepositoryProperties */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
+    minimumVersion: void 0
+  },
  ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -91266,7 +91328,7 @@ var GitHubFeatureFlags = class {
      DEFAULT_VERSION_FEATURE_FLAG_PREFIX.length,
      f.length - DEFAULT_VERSION_FEATURE_FLAG_SUFFIX.length
    ).replace(/_/g, ".");
-    if (!semver3.valid(version)) {
+    if (!semver4.valid(version)) {
      this.logger.warning(
        `Ignoring feature flag ${f} as it does not specify a valid CodeQL version.`
      );
@@ -91498,7 +91560,7 @@ async function uploadTrapCaches(codeql, config, logger) {
      process.env.GITHUB_SHA || "unknown"
    );
    logger.info(`Uploading TRAP cache to Actions cache with key ${key}`);
-    await withTimeout(
+    await waitForResultWithTimeLimit(
      MAX_CACHE_OPERATION_MS2,
      actionsCache2.saveCache([cacheDir], key),
      () => {
@@ -91615,12 +91677,6 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
  rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
  swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
 };
-var PACK_IDENTIFIER_PATTERN = (function() {
-  const alphaNumeric = "[a-z0-9]";
-  const alphaNumericDash = "[a-z0-9-]";
-  const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
-  return new RegExp(`^${component}/${component}$`);
-})();
 function getPathToParsedConfigFile(tempDir) {
  return path10.join(tempDir, "config");
 }
@@ -92051,7 +92107,10 @@ function sanitizeUrlForStatusReport(url2) {

 // src/setup-codeql.ts
 var CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action";
+var CODEQL_NIGHTLIES_REPOSITORY_OWNER = "dsp-testing";
+var CODEQL_NIGHTLIES_REPOSITORY_NAME = "codeql-cli-nightlies";
 var CODEQL_BUNDLE_VERSION_ALIAS = ["linked", "latest"];
+var CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"];
 function getCodeQLBundleExtension(compressionMethod) {
  switch (compressionMethod) {
    case "gzip":
@@ -92194,7 +92253,7 @@ async function findOverridingToolsInCache(humanReadableVersion, logger) {
  return void 0;
 }
 async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, variant, tarSupportsZstd, logger) {
-  if (toolsInput && !CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput) && !toolsInput.startsWith("http")) {
+  if (toolsInput && !isReservedToolsValue(toolsInput) && !toolsInput.startsWith("http")) {
    logger.info(`Using CodeQL CLI from local path ${toolsInput}`);
    const compressionMethod2 = inferCompressionMethod(toolsInput);
    if (compressionMethod2 === void 0) {
@@ -92209,23 +92268,27 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
      toolsVersion: "local"
    };
  }
+  let cliVersion2;
+  let tagName;
+  let url2;
+  if (toolsInput !== void 0 && CODEQL_NIGHTLY_TOOLS_INPUTS.includes(toolsInput)) {
+    logger.info(
+      `Using the latest CodeQL CLI nightly, as requested by 'tools: ${toolsInput}'.`
+    );
+    toolsInput = await getNightlyToolsUrl(logger);
+  }
  const forceShippedTools = toolsInput && CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput);
  if (forceShippedTools) {
+    cliVersion2 = cliVersion;
+    tagName = bundleVersion;
    logger.info(
-      `'tools: ${toolsInput}' was requested, so using CodeQL version ${defaultCliVersion.cliVersion}, the version shipped with the Action.`
+      `'tools: ${toolsInput}' was requested, so using CodeQL version ${cliVersion2}, the version shipped with the Action.`
    );
    if (toolsInput === "latest") {
      logger.warning(
        "`tools: latest` has been renamed to `tools: linked`, but the old name is still supported. No action is required."
      );
    }
-  }
-  let cliVersion2;
-  let tagName;
-  let url2;
-  if (forceShippedTools) {
-    cliVersion2 = cliVersion;
-    tagName = bundleVersion;
  } else if (toolsInput !== void 0) {
    tagName = tryGetTagNameFromUrl(toolsInput, logger);
    url2 = toolsInput;
@@ -92375,11 +92438,12 @@ var downloadCodeQL = async function(codeqlURL, compressionMethod, maybeBundleVer
  let authorization = void 0;
  if (searchParams.has("token")) {
    logger.debug("CodeQL tools URL contains an authorization token.");
-  } else if (codeqlURL.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) {
-    logger.debug("Providing an authorization token to download CodeQL tools.");
-    authorization = `token ${apiDetails.auth}`;
  } else {
-    logger.debug("Downloading CodeQL tools without an authorization token.");
+    authorization = getAuthorizationHeaderFor(
+      logger,
+      apiDetails,
+      codeqlURL
+    );
  }
  const toolcacheInfo = getToolcacheDestinationInfo(
    maybeBundleVersion,
@@ -92506,6 +92570,34 @@ async function useZstdBundle(cliVersion2, tarSupportsZstd) {
 function getTempExtractionDir(tempDir) {
  return path12.join(tempDir, v4_default());
 }
+async function getNightlyToolsUrl(logger) {
+  const zstdAvailability = await isZstdAvailable(logger);
+  const compressionMethod = await useZstdBundle(
+    CODEQL_VERSION_ZSTD_BUNDLE,
+    zstdAvailability.available
+  ) ? "zstd" : "gzip";
+  try {
+    const release3 = await getApiClient().rest.repos.listReleases({
+      owner: CODEQL_NIGHTLIES_REPOSITORY_OWNER,
+      repo: CODEQL_NIGHTLIES_REPOSITORY_NAME,
+      per_page: 1,
+      page: 1,
+      prerelease: true
+    });
+    const latestRelease = release3.data[0];
+    if (!latestRelease) {
+      throw new Error("Could not find the latest nightly release.");
+    }
+    return `https://github.com/${CODEQL_NIGHTLIES_REPOSITORY_OWNER}/${CODEQL_NIGHTLIES_REPOSITORY_NAME}/releases/download/${latestRelease.tag_name}/${getCodeQLBundleName(compressionMethod)}`;
+  } catch (e) {
+    throw new Error(
+      `Failed to retrieve the latest nightly release: ${wrapError(e)}`
+    );
+  }
+}
+function isReservedToolsValue(tools) {
+  return CODEQL_BUNDLE_VERSION_ALIAS.includes(tools) || CODEQL_NIGHTLY_TOOLS_INPUTS.includes(tools);
+}

 // src/tracer-config.ts
 var fs13 = __toESM(require("fs"));
@@ -93248,6 +93340,7 @@ async function makeGlobber(patterns) {
  return glob.create(patterns.join("\n"));
 }
 async function uploadDependencyCaches(config, logger, minimizeJavaJars) {
+  const status = [];
  for (const language of config.languages) {
    const cacheConfig = getDefaultCacheConfig()[language];
    if (cacheConfig === void 0) {
@@ -93258,6 +93351,7 @@ async function uploadDependencyCaches(config, logger, minimizeJavaJars) {
    }
    const globber = await makeGlobber(cacheConfig.hash);
    if ((await globber.glob()).length === 0) {
+      status.push({ language, result: "no-hash" /* NoHash */ });
      logger.info(
        `Skipping upload of dependency cache for ${language} as we cannot calculate a hash for the cache key.`
      );
@@ -93265,6 +93359,7 @@ async function uploadDependencyCaches(config, logger, minimizeJavaJars) {
    }
    const size = await getTotalCacheSize(cacheConfig.paths, logger, true);
    if (size === 0) {
+      status.push({ language, result: "empty" /* Empty */ });
      logger.info(
        `Skipping upload of dependency cache for ${language} since it is empty.`
      );
@@ -93275,18 +93370,28 @@ async function uploadDependencyCaches(config, logger, minimizeJavaJars) {
      `Uploading cache of size ${size} for ${language} with key ${key}...`
    );
    try {
+      const start = performance.now();
      await actionsCache3.saveCache(cacheConfig.paths, key);
+      const upload_duration_ms = Math.round(performance.now() - start);
+      status.push({
+        language,
+        result: "stored" /* Stored */,
+        upload_size_bytes: Math.round(size),
+        upload_duration_ms
+      });
    } catch (error2) {
      if (error2 instanceof actionsCache3.ReserveCacheError) {
        logger.info(
          `Not uploading cache for ${language}, because ${key} is already in use.`
        );
        logger.debug(error2.message);
+        status.push({ language, result: "duplicate" /* Duplicate */ });
      } else {
        throw error2;
      }
    }
  }
+  return status;
 }
 async function cacheKey2(language, cacheConfig, minimizeJavaJars = false) {
  const hash2 = await glob.hashFiles(cacheConfig.hash.join("\n"));
@@ -93736,7 +93841,7 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
    logger.info(`Interpreting ${analysis.name} results for ${language}`);
    let category = automationDetailsId;
    if (analysis.kind === "code-quality" /* CodeQuality */) {
-      category = fixCodeQualityCategory(logger, automationDetailsId);
+      category = analysis.fixCategory(logger, automationDetailsId);
    }
    const sarifFile = path16.join(
      sarifFolder,
@@ -94018,6 +94123,9 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
    logger.warning(
      `Caught an exception while gathering information for telemetry: ${e}. Will skip sending status report.`
    );
+    if (isInTestMode()) {
+      throw e;
+    }
    return void 0;
  }
 }
@@ -95609,6 +95717,7 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
  logger.info(`Processing sarif files: ${JSON.stringify(sarifPaths)}`);
  const gitHubVersion = await getGitHubVersion();
  let sarif;
+  category = uploadTarget.fixCategory(logger, category);
  if (sarifPaths.length > 1) {
    for (const sarifPath of sarifPaths) {
      const parsedSarif = readSarifFile(sarifPath);
@@ -95851,7 +95960,7 @@ function filterAlertsByDiffRange(logger, sarif) {
 }

 // src/analyze-action.ts
-async function sendStatusReport2(startedAt, config, stats, error2, trapCacheUploadTime, dbCreationTimings, didUploadTrapCaches, trapCacheCleanup, logger) {
+async function sendStatusReport2(startedAt, config, stats, error2, trapCacheUploadTime, dbCreationTimings, didUploadTrapCaches, trapCacheCleanup, dependencyCacheResults, logger) {
  const status = getActionsStatus(error2, stats?.analyze_failure_language);
  const statusReportBase = await createStatusReportBase(
    "finish" /* Analyze */,
@@ -95868,7 +95977,8 @@ async function sendStatusReport2(startedAt, config, stats, error2, trapCacheUplo
      ...statusReportBase,
      ...stats || {},
      ...dbCreationTimings || {},
-      ...trapCacheCleanup || {}
+      ...trapCacheCleanup || {},
+      dependency_caching_upload_results: dependencyCacheResults
    };
    if (config && didUploadTrapCaches) {
      const trapCacheUploadStatusReport = {
@@ -95949,6 +96059,7 @@ async function run() {
  let trapCacheUploadTime = void 0;
  let dbCreationTimings = void 0;
  let didUploadTrapCaches = false;
+  let dependencyCacheResults;
  initializeEnvironment(getActionVersion());
  persistInputs();
  const logger = getActionsLogger();
@@ -96056,16 +96167,14 @@ async function run() {
        core14.setOutput("sarif-id", uploadResult.sarifID);
      }
      if (isCodeQualityEnabled(config)) {
+        const analysis = CodeQuality;
        const qualityUploadResult = await uploadFiles(
          outputDir,
          getRequiredInput("checkout_path"),
-          fixCodeQualityCategory(
-            logger,
-            getOptionalInput("category")
-          ),
+          getOptionalInput("category"),
          features,
          logger,
-          CodeQuality
+          analysis
        );
        core14.setOutput("quality-sarif-id", qualityUploadResult.sarifID);
      }
@@ -96087,7 +96196,11 @@ async function run() {
        "java_minimize_dependency_jars" /* JavaMinimizeDependencyJars */,
        codeql
      );
-      await uploadDependencyCaches(config, logger, minimizeJavaJars);
+      dependencyCacheResults = await uploadDependencyCaches(
+        config,
+        logger,
+        minimizeJavaJars
+      );
    }
    if (isInTestMode()) {
      logger.debug("In test mode. Waiting for processing is disabled.");
@@ -96118,6 +96231,7 @@ async function run() {
      dbCreationTimings,
      didUploadTrapCaches,
      trapCacheCleanupTelemetry,
+      dependencyCacheResults,
      logger
    );
    return;
@@ -96135,6 +96249,7 @@ async function run() {
      dbCreationTimings,
      didUploadTrapCaches,
      trapCacheCleanupTelemetry,
+      dependencyCacheResults,
      logger
    );
  } else if (runStats) {
@@ -96147,6 +96262,7 @@ async function run() {
      dbCreationTimings,
      didUploadTrapCaches,
      trapCacheCleanupTelemetry,
+      dependencyCacheResults,
      logger
    );
  } else {
@@ -96159,6 +96275,7 @@ async function run() {
      dbCreationTimings,
      didUploadTrapCaches,
      trapCacheCleanupTelemetry,
+      dependencyCacheResults,
      logger
    );
  }
@@ -26438,16 +26438,17 @@ var require_package = __commonJS({
  "package.json"(exports2, module2) {
    module2.exports = {
      name: "codeql",
-      version: "3.30.4",
+      version: "4.30.7",
      private: true,
      description: "CodeQL action",
      scripts: {
        _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "npm run transpile && node build.mjs",
+        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
        lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
        "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
        "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        test: "npm run transpile && ava src/**.test.ts --serial --verbose",
+        ava: "npm run transpile && ava --serial --verbose",
+        test: "npm run ava -- src/",
        "test-debug": "npm run test -- --timeout=20m",
        transpile: "tsc --build --verbose"
      },
@@ -26463,7 +26464,7 @@ var require_package = __commonJS({
      dependencies: {
        "@actions/artifact": "^2.3.1",
        "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.0.5",
+        "@actions/cache": "^4.1.0",
        "@actions/core": "^1.11.1",
        "@actions/exec": "^1.1.1",
        "@actions/github": "^6.0.0",
@@ -26490,11 +26491,11 @@ var require_package = __commonJS({
      },
      devDependencies: {
        "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.3.2",
+        "@eslint/compat": "^1.4.0",
        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "^9.35.0",
+        "@eslint/js": "^9.36.0",
        "@microsoft/eslint-formatter-sarif": "^3.1.0",
-        "@octokit/types": "^14.1.0",
+        "@octokit/types": "^15.0.0",
        "@types/archiver": "^6.0.3",
        "@types/console-log-level": "^1.4.5",
        "@types/follow-redirects": "^1.14.4",
@@ -26503,10 +26504,10 @@ var require_package = __commonJS({
        "@types/node-forge": "^1.3.14",
        "@types/semver": "^7.7.1",
        "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.43.0",
+        "@typescript-eslint/eslint-plugin": "^8.44.1",
        "@typescript-eslint/parser": "^8.41.0",
        ava: "^6.4.1",
-        esbuild: "^0.25.9",
+        esbuild: "^0.25.10",
        eslint: "^8.57.1",
        "eslint-import-resolver-typescript": "^3.8.7",
        "eslint-plugin-filenames": "^1.3.2",
@@ -28541,7 +28542,7 @@ var require_brace_expansion = __commonJS({
      var isSequence = isNumericSequence || isAlphaSequence;
      var isOptions = m.body.indexOf(",") >= 0;
      if (!isSequence && !isOptions) {
-        if (m.post.match(/,.*\}/)) {
+        if (m.post.match(/,(?!,).*\}/)) {
          str2 = m.pre + "{" + m.body + escClose + m.post;
          return expand(str2);
        }
@@ -67282,7 +67283,7 @@ var require_package2 = __commonJS({
  "node_modules/@actions/cache/package.json"(exports2, module2) {
    module2.exports = {
      name: "@actions/cache",
-      version: "4.0.5",
+      version: "4.1.0",
      preview: true,
      description: "Actions cache lib",
      keywords: [
@@ -72091,11 +72092,18 @@ var require_cache2 = __commonJS({
            kind: "scalar",
            T: 9
            /*ScalarType.STRING*/
+          },
+          {
+            no: 3,
+            name: "message",
+            kind: "scalar",
+            T: 9
+            /*ScalarType.STRING*/
          }
        ]);
      }
      create(value) {
-        const message = { ok: false, signedUploadUrl: "" };
+        const message = { ok: false, signedUploadUrl: "", message: "" };
        globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
        if (value !== void 0)
          (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72114,6 +72122,10 @@ var require_cache2 = __commonJS({
            2:
              message.signedUploadUrl = reader.string();
              break;
+            case /* string message */
+            3:
+              message.message = reader.string();
+              break;
            default:
              let u = options.readUnknownField;
              if (u === "throw")
@@ -72130,6 +72142,8 @@ var require_cache2 = __commonJS({
          writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
        if (message.signedUploadUrl !== "")
          writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
+        if (message.message !== "")
+          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
        let u = options.writeUnknownFields;
        if (u !== false)
          (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -72235,11 +72249,18 @@ var require_cache2 = __commonJS({
            kind: "scalar",
            T: 3
            /*ScalarType.INT64*/
+          },
+          {
+            no: 3,
+            name: "message",
+            kind: "scalar",
+            T: 9
+            /*ScalarType.STRING*/
          }
        ]);
      }
      create(value) {
-        const message = { ok: false, entryId: "0" };
+        const message = { ok: false, entryId: "0", message: "" };
        globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
        if (value !== void 0)
          (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72258,6 +72279,10 @@ var require_cache2 = __commonJS({
            2:
              message.entryId = reader.int64().toString();
              break;
+            case /* string message */
+            3:
+              message.message = reader.string();
+              break;
            default:
              let u = options.readUnknownField;
              if (u === "throw")
@@ -72274,6 +72299,8 @@ var require_cache2 = __commonJS({
          writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
        if (message.entryId !== "0")
          writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
+        if (message.message !== "")
+          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
        let u = options.writeUnknownFields;
        if (u !== false)
          (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -73037,7 +73064,7 @@ var require_cache3 = __commonJS({
      });
    };
    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
    var core14 = __importStar4(require_core());
    var path7 = __importStar4(require("path"));
    var utils = __importStar4(require_cacheUtils());
@@ -73045,7 +73072,6 @@ var require_cache3 = __commonJS({
    var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
    var config_1 = require_config();
    var tar_1 = require_tar();
-    var constants_1 = require_constants7();
    var http_client_1 = require_lib();
    var ValidationError = class _ValidationError extends Error {
      constructor(message) {
@@ -73063,6 +73089,14 @@ var require_cache3 = __commonJS({
      }
    };
    exports2.ReserveCacheError = ReserveCacheError;
+    var FinalizeCacheError = class _FinalizeCacheError extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "FinalizeCacheError";
+        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
+      }
+    };
+    exports2.FinalizeCacheError = FinalizeCacheError;
    function checkPaths(paths) {
      if (!paths || paths.length === 0) {
        throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -73334,9 +73368,6 @@ var require_cache3 = __commonJS({
          }
          const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
          core14.debug(`File Size: ${archiveFileSize}`);
-          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
-            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
-          }
          options.archiveSizeBytes = archiveFileSize;
          core14.debug("Reserving Cache");
          const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -73348,7 +73379,10 @@ var require_cache3 = __commonJS({
          try {
            const response = yield twirpClient.CreateCacheEntry(request);
            if (!response.ok) {
-              throw new Error("Response was not ok");
+              if (response.message) {
+                core14.warning(`Cache reservation failed: ${response.message}`);
+              }
+              throw new Error(response.message || "Response was not ok");
            }
            signedUploadUrl = response.signedUploadUrl;
          } catch (error2) {
@@ -73365,6 +73399,9 @@ var require_cache3 = __commonJS({
          const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
          core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
          if (!finalizeResponse.ok) {
+            if (finalizeResponse.message) {
+              throw new FinalizeCacheError(finalizeResponse.message);
+            }
            throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
          }
          cacheId = parseInt(finalizeResponse.entryId);
@@ -73374,6 +73411,8 @@ var require_cache3 = __commonJS({
            throw error2;
          } else if (typedError.name === ReserveCacheError.name) {
            core14.info(`Failed to save: ${typedError.message}`);
+          } else if (typedError.name === FinalizeCacheError.name) {
+            core14.warning(typedError.message);
          } else {
            if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
              core14.error(`Failed to save: ${typedError.message}`);
@@ -78229,7 +78268,6 @@ function wrapCliConfigurationError(cliError) {
 // src/config-utils.ts
 var fs4 = __toESM(require("fs"));
 var path4 = __toESM(require("path"));
-var semver4 = __toESM(require_semver2());

 // src/analyses.ts
 var AnalysisKind = /* @__PURE__ */ ((AnalysisKind2) => {
@@ -78242,14 +78280,23 @@ var supportedAnalysisKinds = new Set(Object.values(AnalysisKind));
 // src/caching-utils.ts
 var core6 = __toESM(require_core());

+// src/config/db-config.ts
+var semver2 = __toESM(require_semver2());
+var PACK_IDENTIFIER_PATTERN = (function() {
+  const alphaNumeric = "[a-z0-9]";
+  const alphaNumericDash = "[a-z0-9-]";
+  const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
+  return new RegExp(`^${component}/${component}$`);
+})();
+
 // src/feature-flags.ts
 var fs3 = __toESM(require("fs"));
 var path3 = __toESM(require("path"));
-var semver3 = __toESM(require_semver2());
+var semver4 = __toESM(require_semver2());

 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.0";
-var cliVersion = "2.23.0";
+var bundleVersion = "codeql-bundle-v2.23.2";
+var cliVersion = "2.23.2";

 // src/overlay-database-utils.ts
 var fs2 = __toESM(require("fs"));
@@ -78426,7 +78473,7 @@ function getActionsLogger() {
 }

 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -78487,7 +78534,7 @@ function computeChangedFiles(baseFileOids, overlayFileOids) {
 }

 // src/tools-features.ts
-var semver2 = __toESM(require_semver2());
+var semver3 = __toESM(require_semver2());
 function isSupportedToolsFeature(versionInfo, feature) {
  return !!versionInfo.features && versionInfo.features[feature];
 }
@@ -78652,6 +78699,11 @@ var featureConfig = {
    minimumVersion: void 0,
    toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
  },
+  ["use_repository_properties" /* UseRepositoryProperties */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
+    minimumVersion: void 0
+  },
  ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -78770,7 +78822,7 @@ var GitHubFeatureFlags = class {
      DEFAULT_VERSION_FEATURE_FLAG_PREFIX.length,
      f.length - DEFAULT_VERSION_FEATURE_FLAG_SUFFIX.length
    ).replace(/_/g, ".");
-    if (!semver3.valid(version)) {
+    if (!semver4.valid(version)) {
      this.logger.warning(
        `Ignoring feature flag ${f} as it does not specify a valid CodeQL version.`
      );
@@ -78957,12 +79009,6 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
  rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
  swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
 };
-var PACK_IDENTIFIER_PATTERN = (function() {
-  const alphaNumeric = "[a-z0-9]";
-  const alphaNumericDash = "[a-z0-9-]";
-  const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
-  return new RegExp(`^${component}/${component}$`);
-})();
 function getPathToParsedConfigFile(tempDir) {
  return path4.join(tempDir, "config");
 }
@@ -79826,6 +79872,9 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
    logger.warning(
      `Caught an exception while gathering information for telemetry: ${e}. Will skip sending status report.`
    );
+    if (isInTestMode()) {
+      throw e;
+    }
    return void 0;
  }
 }
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.23.0",
-  "cliVersion": "2.23.0",
-  "priorBundleVersion": "codeql-bundle-v2.22.4",
-  "priorCliVersion": "2.22.4"
+  "bundleVersion": "codeql-bundle-v2.23.2",
+  "cliVersion": "2.23.2",
+  "priorBundleVersion": "codeql-bundle-v2.23.1",
+  "priorCliVersion": "2.23.1"
 }
@@ -27722,7 +27722,7 @@ var require_pattern = __commonJS({
      const absolute = [];
      const relative2 = [];
      for (const pattern of patterns) {
-        if (isAbsolute3(pattern)) {
+        if (isAbsolute2(pattern)) {
          absolute.push(pattern);
        } else {
          relative2.push(pattern);
@@ -27731,10 +27731,10 @@ var require_pattern = __commonJS({
      return [absolute, relative2];
    }
    exports2.partitionAbsoluteAndRelative = partitionAbsoluteAndRelative;
-    function isAbsolute3(pattern) {
+    function isAbsolute2(pattern) {
      return path19.isAbsolute(pattern);
    }
-    exports2.isAbsolute = isAbsolute3;
+    exports2.isAbsolute = isAbsolute2;
  }
 });

@@ -28149,11 +28149,11 @@ var require_out = __commonJS({
      async.read(path19, getSettings(optionsOrSettingsOrCallback), callback);
    }
    exports2.stat = stat;
-    function statSync2(path19, optionsOrSettings) {
+    function statSync3(path19, optionsOrSettings) {
      const settings = getSettings(optionsOrSettings);
      return sync.read(path19, settings);
    }
-    exports2.statSync = statSync2;
+    exports2.statSync = statSync3;
    function getSettings(settingsOrOptions = {}) {
      if (settingsOrOptions instanceof settings_1.default) {
        return settingsOrOptions;
@@ -32287,16 +32287,17 @@ var require_package = __commonJS({
  "package.json"(exports2, module2) {
    module2.exports = {
      name: "codeql",
-      version: "3.30.4",
+      version: "4.30.7",
      private: true,
      description: "CodeQL action",
      scripts: {
        _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "npm run transpile && node build.mjs",
+        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
        lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
        "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
        "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        test: "npm run transpile && ava src/**.test.ts --serial --verbose",
+        ava: "npm run transpile && ava --serial --verbose",
+        test: "npm run ava -- src/",
        "test-debug": "npm run test -- --timeout=20m",
        transpile: "tsc --build --verbose"
      },
@@ -32312,7 +32313,7 @@ var require_package = __commonJS({
      dependencies: {
        "@actions/artifact": "^2.3.1",
        "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.0.5",
+        "@actions/cache": "^4.1.0",
        "@actions/core": "^1.11.1",
        "@actions/exec": "^1.1.1",
        "@actions/github": "^6.0.0",
@@ -32339,11 +32340,11 @@ var require_package = __commonJS({
      },
      devDependencies: {
        "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.3.2",
+        "@eslint/compat": "^1.4.0",
        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "^9.35.0",
+        "@eslint/js": "^9.36.0",
        "@microsoft/eslint-formatter-sarif": "^3.1.0",
-        "@octokit/types": "^14.1.0",
+        "@octokit/types": "^15.0.0",
        "@types/archiver": "^6.0.3",
        "@types/console-log-level": "^1.4.5",
        "@types/follow-redirects": "^1.14.4",
@@ -32352,10 +32353,10 @@ var require_package = __commonJS({
        "@types/node-forge": "^1.3.14",
        "@types/semver": "^7.7.1",
        "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.43.0",
+        "@typescript-eslint/eslint-plugin": "^8.44.1",
        "@typescript-eslint/parser": "^8.41.0",
        ava: "^6.4.1",
-        esbuild: "^0.25.9",
+        esbuild: "^0.25.10",
        eslint: "^8.57.1",
        "eslint-import-resolver-typescript": "^3.8.7",
        "eslint-plugin-filenames": "^1.3.2",
@@ -34390,7 +34391,7 @@ var require_brace_expansion = __commonJS({
      var isSequence = isNumericSequence || isAlphaSequence;
      var isOptions = m.body.indexOf(",") >= 0;
      if (!isSequence && !isOptions) {
-        if (m.post.match(/,.*\}/)) {
+        if (m.post.match(/,(?!,).*\}/)) {
          str2 = m.pre + "{" + m.body + escClose + m.post;
          return expand(str2);
        }
@@ -73131,7 +73132,7 @@ var require_package2 = __commonJS({
  "node_modules/@actions/cache/package.json"(exports2, module2) {
    module2.exports = {
      name: "@actions/cache",
-      version: "4.0.5",
+      version: "4.1.0",
      preview: true,
      description: "Actions cache lib",
      keywords: [
@@ -77940,11 +77941,18 @@ var require_cache2 = __commonJS({
            kind: "scalar",
            T: 9
            /*ScalarType.STRING*/
+          },
+          {
+            no: 3,
+            name: "message",
+            kind: "scalar",
+            T: 9
+            /*ScalarType.STRING*/
          }
        ]);
      }
      create(value) {
-        const message = { ok: false, signedUploadUrl: "" };
+        const message = { ok: false, signedUploadUrl: "", message: "" };
        globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
        if (value !== void 0)
          (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -77963,6 +77971,10 @@ var require_cache2 = __commonJS({
            2:
              message.signedUploadUrl = reader.string();
              break;
+            case /* string message */
+            3:
+              message.message = reader.string();
+              break;
            default:
              let u = options.readUnknownField;
              if (u === "throw")
@@ -77979,6 +77991,8 @@ var require_cache2 = __commonJS({
          writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
        if (message.signedUploadUrl !== "")
          writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
+        if (message.message !== "")
+          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
        let u = options.writeUnknownFields;
        if (u !== false)
          (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78084,11 +78098,18 @@ var require_cache2 = __commonJS({
            kind: "scalar",
            T: 3
            /*ScalarType.INT64*/
+          },
+          {
+            no: 3,
+            name: "message",
+            kind: "scalar",
+            T: 9
+            /*ScalarType.STRING*/
          }
        ]);
      }
      create(value) {
-        const message = { ok: false, entryId: "0" };
+        const message = { ok: false, entryId: "0", message: "" };
        globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
        if (value !== void 0)
          (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -78107,6 +78128,10 @@ var require_cache2 = __commonJS({
            2:
              message.entryId = reader.int64().toString();
              break;
+            case /* string message */
+            3:
+              message.message = reader.string();
+              break;
            default:
              let u = options.readUnknownField;
              if (u === "throw")
@@ -78123,6 +78148,8 @@ var require_cache2 = __commonJS({
          writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
        if (message.entryId !== "0")
          writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
+        if (message.message !== "")
+          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
        let u = options.writeUnknownFields;
        if (u !== false)
          (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78886,7 +78913,7 @@ var require_cache3 = __commonJS({
      });
    };
    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
    var core18 = __importStar4(require_core());
    var path19 = __importStar4(require("path"));
    var utils = __importStar4(require_cacheUtils());
@@ -78894,7 +78921,6 @@ var require_cache3 = __commonJS({
    var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
    var config_1 = require_config();
    var tar_1 = require_tar();
-    var constants_1 = require_constants10();
    var http_client_1 = require_lib();
    var ValidationError = class _ValidationError extends Error {
      constructor(message) {
@@ -78912,6 +78938,14 @@ var require_cache3 = __commonJS({
      }
    };
    exports2.ReserveCacheError = ReserveCacheError2;
+    var FinalizeCacheError = class _FinalizeCacheError extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "FinalizeCacheError";
+        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
+      }
+    };
+    exports2.FinalizeCacheError = FinalizeCacheError;
    function checkPaths(paths) {
      if (!paths || paths.length === 0) {
        throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -79183,9 +79217,6 @@ var require_cache3 = __commonJS({
          }
          const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
          core18.debug(`File Size: ${archiveFileSize}`);
-          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
-            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
-          }
          options.archiveSizeBytes = archiveFileSize;
          core18.debug("Reserving Cache");
          const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -79197,7 +79228,10 @@ var require_cache3 = __commonJS({
          try {
            const response = yield twirpClient.CreateCacheEntry(request);
            if (!response.ok) {
-              throw new Error("Response was not ok");
+              if (response.message) {
+                core18.warning(`Cache reservation failed: ${response.message}`);
+              }
+              throw new Error(response.message || "Response was not ok");
            }
            signedUploadUrl = response.signedUploadUrl;
          } catch (error2) {
@@ -79214,6 +79248,9 @@ var require_cache3 = __commonJS({
          const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
          core18.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
          if (!finalizeResponse.ok) {
+            if (finalizeResponse.message) {
+              throw new FinalizeCacheError(finalizeResponse.message);
+            }
            throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
          }
          cacheId = parseInt(finalizeResponse.entryId);
@@ -79223,6 +79260,8 @@ var require_cache3 = __commonJS({
            throw error2;
          } else if (typedError.name === ReserveCacheError2.name) {
            core18.info(`Failed to save: ${typedError.message}`);
+          } else if (typedError.name === FinalizeCacheError.name) {
+            core18.warning(typedError.message);
          } else {
            if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
              core18.error(`Failed to save: ${typedError.message}`);
@@ -100645,7 +100684,7 @@ var require_commonjs16 = __commonJS({
    var TYPEMASK = 1023;
    var entToType = (s) => s.isFile() ? IFREG : s.isDirectory() ? IFDIR : s.isSymbolicLink() ? IFLNK : s.isCharacterDevice() ? IFCHR : s.isBlockDevice() ? IFBLK : s.isSocket() ? IFSOCK : s.isFIFO() ? IFIFO : UNKNOWN;
    var normalizeCache = /* @__PURE__ */ new Map();
-    var normalize4 = (s) => {
+    var normalize3 = (s) => {
      const c = normalizeCache.get(s);
      if (c)
        return c;
@@ -100658,7 +100697,7 @@ var require_commonjs16 = __commonJS({
      const c = normalizeNocaseCache.get(s);
      if (c)
        return c;
-      const n = normalize4(s.toLowerCase());
+      const n = normalize3(s.toLowerCase());
      normalizeNocaseCache.set(s, n);
      return n;
    };
@@ -100827,7 +100866,7 @@ var require_commonjs16 = __commonJS({
       */
      constructor(name, type2 = UNKNOWN, root, roots, nocase, children, opts) {
        this.name = name;
-        this.#matchName = nocase ? normalizeNocase(name) : normalize4(name);
+        this.#matchName = nocase ? normalizeNocase(name) : normalize3(name);
        this.#type = type2 & TYPEMASK;
        this.nocase = nocase;
        this.roots = roots;
@@ -100920,7 +100959,7 @@ var require_commonjs16 = __commonJS({
          return this.parent || this;
        }
        const children = this.children();
-        const name = this.nocase ? normalizeNocase(pathPart) : normalize4(pathPart);
+        const name = this.nocase ? normalizeNocase(pathPart) : normalize3(pathPart);
        for (const p of children) {
          if (p.#matchName === name) {
            return p;
@@ -101165,7 +101204,7 @@ var require_commonjs16 = __commonJS({
       * directly.
       */
      isNamed(n) {
-        return !this.nocase ? this.#matchName === normalize4(n) : this.#matchName === normalizeNocase(n);
+        return !this.nocase ? this.#matchName === normalize3(n) : this.#matchName === normalizeNocase(n);
      }
      /**
       * Return the Path object corresponding to the target of a symbolic link.
@@ -101304,7 +101343,7 @@ var require_commonjs16 = __commonJS({
      #readdirMaybePromoteChild(e, c) {
        for (let p = c.provisional; p < c.length; p++) {
          const pchild = c[p];
-          const name = this.nocase ? normalizeNocase(e.name) : normalize4(e.name);
+          const name = this.nocase ? normalizeNocase(e.name) : normalize3(e.name);
          if (name !== pchild.#matchName) {
            continue;
          }
@@ -109135,7 +109174,7 @@ var require_tr46 = __commonJS({
      TRANSITIONAL: 0,
      NONTRANSITIONAL: 1
    };
-    function normalize4(str2) {
+    function normalize3(str2) {
      return str2.split("\0").map(function(s) {
        return s.normalize("NFC");
      }).join("\0");
@@ -109215,7 +109254,7 @@ var require_tr46 = __commonJS({
        processing_option = PROCESSING_OPTIONS.NONTRANSITIONAL;
      }
      var error2 = false;
-      if (normalize4(label) !== label || label[3] === "-" && label[4] === "-" || label[0] === "-" || label[label.length - 1] === "-" || label.indexOf(".") !== -1 || label.search(combiningMarksRegex) === 0) {
+      if (normalize3(label) !== label || label[3] === "-" && label[4] === "-" || label[0] === "-" || label[label.length - 1] === "-" || label.indexOf(".") !== -1 || label.search(combiningMarksRegex) === 0) {
        error2 = true;
      }
      var len = countSymbols(label);
@@ -109233,7 +109272,7 @@ var require_tr46 = __commonJS({
    }
    function processing(domain_name, useSTD3, processing_option) {
      var result = mapChars(domain_name, useSTD3, processing_option);
-      result.string = normalize4(result.string);
+      result.string = normalize3(result.string);
      var labels = result.string.split(".");
      for (var i = 0; i < labels.length; ++i) {
        try {
@@ -128298,6 +128337,9 @@ function getWorkflowRunAttempt() {
 function isSelfHostedRunner() {
  return process.env.RUNNER_ENVIRONMENT === "self-hosted";
 }
+function isDefaultSetup() {
+  return getWorkflowEventName() === "dynamic";
+}
 function prettyPrintInvocation(cmd, args) {
  return [cmd, ...args].map((x) => x.includes(" ") ? `'${x}'` : x).join(" ");
 }
@@ -128363,6 +128405,30 @@ var restoreInputs = function() {
    }
  }
 };
+var qualityCategoryMapping = {
+  "c#": "csharp",
+  cpp: "c-cpp",
+  c: "c-cpp",
+  "c++": "c-cpp",
+  java: "java-kotlin",
+  javascript: "javascript-typescript",
+  typescript: "javascript-typescript",
+  kotlin: "java-kotlin"
+};
+function fixCodeQualityCategory(logger, category) {
+  if (category !== void 0 && isDefaultSetup() && category.startsWith("/language:")) {
+    const language = category.substring("/language:".length);
+    const mappedLanguage = qualityCategoryMapping[language];
+    if (mappedLanguage) {
+      const newCategory = `/language:${mappedLanguage}`;
+      logger.info(
+        `Adjusted category for Code Quality from '${category}' to '${newCategory}'.`
+      );
+      return newCategory;
+    }
+  }
+  return category;
+}

 // src/api-client.ts
 var core5 = __toESM(require_core());
@@ -128417,6 +128483,14 @@ function getApiDetails() {
 function getApiClient() {
  return createApiClientWithDetails(getApiDetails());
 }
+function getAuthorizationHeaderFor(logger, apiDetails, url2) {
+  if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) {
+    logger.debug(`Providing an authorization token.`);
+    return `token ${apiDetails.auth}`;
+  }
+  logger.debug(`Not using an authorization token.`);
+  return void 0;
+}
 var cachedGitHubVersion = void 0;
 async function getGitHubVersionFromApi(apiClient, apiDetails) {
  if (parseGitHubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) {
@@ -128487,6 +128561,18 @@ function computeAutomationID(analysis_key, environment) {
  }
  return automationID;
 }
+async function listActionsCaches(key, ref) {
+  const repositoryNwo = getRepositoryNwo();
+  return await getApiClient().paginate(
+    "GET /repos/{owner}/{repo}/actions/caches",
+    {
+      owner: repositoryNwo.owner,
+      repo: repositoryNwo.repo,
+      key,
+      ref
+    }
+  );
+}
 function wrapApiConfigurationError(e) {
  if (isHTTPError(e)) {
    if (e.message.includes("API rate limit exceeded for installation") || e.message.includes("commit not found") || e.message.includes("Resource not accessible by integration") || /ref .* not found in this repository/.test(e.message)) {
@@ -128500,6 +128586,9 @@ function wrapApiConfigurationError(e) {
  return e;
 }

+// src/caching-utils.ts
+var core6 = __toESM(require_core());
+
 // src/codeql.ts
 var fs13 = __toESM(require("fs"));
 var path13 = __toESM(require("path"));
@@ -128746,7 +128835,6 @@ function wrapCliConfigurationError(cliError) {
 // src/config-utils.ts
 var fs9 = __toESM(require("fs"));
 var path10 = __toESM(require("path"));
-var semver4 = __toESM(require_semver2());

 // src/analyses.ts
 var AnalysisKind = /* @__PURE__ */ ((AnalysisKind2) => {
@@ -128761,6 +128849,7 @@ var CodeScanning = {
  target: "PUT /repos/:owner/:repo/code-scanning/analysis" /* CODE_SCANNING */,
  sarifExtension: ".sarif",
  sarifPredicate: (name) => name.endsWith(CodeScanning.sarifExtension) && !CodeQuality.sarifPredicate(name),
+  fixCategory: (_2, category) => category,
  sentinelPrefix: "CODEQL_UPLOAD_SARIF_"
 };
 var CodeQuality = {
@@ -128769,11 +128858,18 @@ var CodeQuality = {
  target: "PUT /repos/:owner/:repo/code-quality/analysis" /* CODE_QUALITY */,
  sarifExtension: ".quality.sarif",
  sarifPredicate: (name) => name.endsWith(CodeQuality.sarifExtension),
+  fixCategory: fixCodeQualityCategory,
  sentinelPrefix: "CODEQL_UPLOAD_QUALITY_SARIF_"
 };

-// src/caching-utils.ts
-var core6 = __toESM(require_core());
+// src/config/db-config.ts
+var semver2 = __toESM(require_semver2());
+var PACK_IDENTIFIER_PATTERN = (function() {
+  const alphaNumeric = "[a-z0-9]";
+  const alphaNumericDash = "[a-z0-9-]";
+  const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
+  return new RegExp(`^${component}/${component}$`);
+})();

 // src/diff-informed-analysis-utils.ts
 var fs8 = __toESM(require("fs"));
@@ -128782,11 +128878,11 @@ var path9 = __toESM(require("path"));
 // src/feature-flags.ts
 var fs7 = __toESM(require("fs"));
 var path8 = __toESM(require("path"));
-var semver3 = __toESM(require_semver2());
+var semver4 = __toESM(require_semver2());

 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.0";
-var cliVersion = "2.23.0";
+var bundleVersion = "codeql-bundle-v2.23.2";
+var cliVersion = "2.23.2";

 // src/overlay-database-utils.ts
 var fs6 = __toESM(require("fs"));
@@ -129016,7 +129112,7 @@ function formatDuration(durationMs) {
 }

 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -129077,13 +129173,13 @@ function computeChangedFiles(baseFileOids, overlayFileOids) {
 }

 // src/tools-features.ts
-var semver2 = __toESM(require_semver2());
+var semver3 = __toESM(require_semver2());
 function isSupportedToolsFeature(versionInfo, feature) {
  return !!versionInfo.features && versionInfo.features[feature];
 }
 var SafeArtifactUploadVersion = "2.20.3";
 function isSafeArtifactUpload(codeQlVersion) {
-  return !codeQlVersion ? true : semver2.gte(codeQlVersion, SafeArtifactUploadVersion);
+  return !codeQlVersion ? true : semver3.gte(codeQlVersion, SafeArtifactUploadVersion);
 }

 // src/feature-flags.ts
@@ -129247,6 +129343,11 @@ var featureConfig = {
    minimumVersion: void 0,
    toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
  },
+  ["use_repository_properties" /* UseRepositoryProperties */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
+    minimumVersion: void 0
+  },
  ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -129365,7 +129466,7 @@ var GitHubFeatureFlags = class {
      DEFAULT_VERSION_FEATURE_FLAG_PREFIX.length,
      f.length - DEFAULT_VERSION_FEATURE_FLAG_SUFFIX.length
    ).replace(/_/g, ".");
-    if (!semver3.valid(version)) {
+    if (!semver4.valid(version)) {
      this.logger.warning(
        `Ignoring feature flag ${f} as it does not specify a valid CodeQL version.`
      );
@@ -129570,12 +129671,6 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
  rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
  swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
 };
-var PACK_IDENTIFIER_PATTERN = (function() {
-  const alphaNumeric = "[a-z0-9]";
-  const alphaNumericDash = "[a-z0-9-]";
-  const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
-  return new RegExp(`^${component}/${component}$`);
-})();
 function getPathToParsedConfigFile(tempDir) {
  return path10.join(tempDir, "config");
 }
@@ -129994,7 +130089,10 @@ function sanitizeUrlForStatusReport(url2) {

 // src/setup-codeql.ts
 var CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action";
+var CODEQL_NIGHTLIES_REPOSITORY_OWNER = "dsp-testing";
+var CODEQL_NIGHTLIES_REPOSITORY_NAME = "codeql-cli-nightlies";
 var CODEQL_BUNDLE_VERSION_ALIAS = ["linked", "latest"];
+var CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"];
 function getCodeQLBundleExtension(compressionMethod) {
  switch (compressionMethod) {
    case "gzip":
@@ -130137,7 +130235,7 @@ async function findOverridingToolsInCache(humanReadableVersion, logger) {
  return void 0;
 }
 async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, variant, tarSupportsZstd, logger) {
-  if (toolsInput && !CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput) && !toolsInput.startsWith("http")) {
+  if (toolsInput && !isReservedToolsValue(toolsInput) && !toolsInput.startsWith("http")) {
    logger.info(`Using CodeQL CLI from local path ${toolsInput}`);
    const compressionMethod2 = inferCompressionMethod(toolsInput);
    if (compressionMethod2 === void 0) {
@@ -130152,23 +130250,27 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
      toolsVersion: "local"
    };
  }
+  let cliVersion2;
+  let tagName;
+  let url2;
+  if (toolsInput !== void 0 && CODEQL_NIGHTLY_TOOLS_INPUTS.includes(toolsInput)) {
+    logger.info(
+      `Using the latest CodeQL CLI nightly, as requested by 'tools: ${toolsInput}'.`
+    );
+    toolsInput = await getNightlyToolsUrl(logger);
+  }
  const forceShippedTools = toolsInput && CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput);
  if (forceShippedTools) {
+    cliVersion2 = cliVersion;
+    tagName = bundleVersion;
    logger.info(
-      `'tools: ${toolsInput}' was requested, so using CodeQL version ${defaultCliVersion.cliVersion}, the version shipped with the Action.`
+      `'tools: ${toolsInput}' was requested, so using CodeQL version ${cliVersion2}, the version shipped with the Action.`
    );
    if (toolsInput === "latest") {
      logger.warning(
        "`tools: latest` has been renamed to `tools: linked`, but the old name is still supported. No action is required."
      );
    }
-  }
-  let cliVersion2;
-  let tagName;
-  let url2;
-  if (forceShippedTools) {
-    cliVersion2 = cliVersion;
-    tagName = bundleVersion;
  } else if (toolsInput !== void 0) {
    tagName = tryGetTagNameFromUrl(toolsInput, logger);
    url2 = toolsInput;
@@ -130318,11 +130420,12 @@ var downloadCodeQL = async function(codeqlURL, compressionMethod, maybeBundleVer
  let authorization = void 0;
  if (searchParams.has("token")) {
    logger.debug("CodeQL tools URL contains an authorization token.");
-  } else if (codeqlURL.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) {
-    logger.debug("Providing an authorization token to download CodeQL tools.");
-    authorization = `token ${apiDetails.auth}`;
  } else {
-    logger.debug("Downloading CodeQL tools without an authorization token.");
+    authorization = getAuthorizationHeaderFor(
+      logger,
+      apiDetails,
+      codeqlURL
+    );
  }
  const toolcacheInfo = getToolcacheDestinationInfo(
    maybeBundleVersion,
@@ -130449,6 +130552,34 @@ async function useZstdBundle(cliVersion2, tarSupportsZstd) {
 function getTempExtractionDir(tempDir) {
  return path12.join(tempDir, v4_default());
 }
+async function getNightlyToolsUrl(logger) {
+  const zstdAvailability = await isZstdAvailable(logger);
+  const compressionMethod = await useZstdBundle(
+    CODEQL_VERSION_ZSTD_BUNDLE,
+    zstdAvailability.available
+  ) ? "zstd" : "gzip";
+  try {
+    const release3 = await getApiClient().rest.repos.listReleases({
+      owner: CODEQL_NIGHTLIES_REPOSITORY_OWNER,
+      repo: CODEQL_NIGHTLIES_REPOSITORY_NAME,
+      per_page: 1,
+      page: 1,
+      prerelease: true
+    });
+    const latestRelease = release3.data[0];
+    if (!latestRelease) {
+      throw new Error("Could not find the latest nightly release.");
+    }
+    return `https://github.com/${CODEQL_NIGHTLIES_REPOSITORY_OWNER}/${CODEQL_NIGHTLIES_REPOSITORY_NAME}/releases/download/${latestRelease.tag_name}/${getCodeQLBundleName(compressionMethod)}`;
+  } catch (e) {
+    throw new Error(
+      `Failed to retrieve the latest nightly release: ${wrapError(e)}`
+    );
+  }
+}
+function isReservedToolsValue(tools) {
+  return CODEQL_BUNDLE_VERSION_ALIAS.includes(tools) || CODEQL_NIGHTLY_TOOLS_INPUTS.includes(tools);
+}

 // src/tracer-config.ts
 async function shouldEnableIndirectTracing(codeql, config) {
@@ -131079,6 +131210,22 @@ var core11 = __toESM(require_core());
 // src/dependency-caching.ts
 var actionsCache3 = __toESM(require_cache3());
 var glob = __toESM(require_glob3());
+var CODEQL_DEPENDENCY_CACHE_PREFIX = "codeql-dependencies";
+async function getDependencyCacheUsage(logger) {
+  try {
+    const caches = await listActionsCaches(CODEQL_DEPENDENCY_CACHE_PREFIX);
+    const totalSize = caches.reduce(
+      (acc, cache) => acc + (cache.size_in_bytes ?? 0),
+      0
+    );
+    return { count: caches.length, size_bytes: totalSize };
+  } catch (err) {
+    logger.warning(
+      `Unable to retrieve information about dependency cache usage: ${getErrorMessage(err)}`
+    );
+  }
+  return void 0;
+}

 // src/analyze.ts
 function dbIsFinalized(config, language, logger) {
@@ -131452,6 +131599,9 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
    logger.warning(
      `Caught an exception while gathering information for telemetry: ${e}. Will skip sending status report.`
    );
+    if (isInTestMode()) {
+      throw e;
+    }
    return void 0;
  }
 }
@@ -133043,6 +133193,7 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
  logger.info(`Processing sarif files: ${JSON.stringify(sarifPaths)}`);
  const gitHubVersion = await getGitHubVersion();
  let sarif;
+  category = uploadTarget.fixCategory(logger, category);
  if (sarifPaths.length > 1) {
    for (const sarifPath of sarifPaths) {
      const parsedSarif = readSarifFile(sarifPath);
@@ -133628,6 +133779,7 @@ async function runWrapper() {
  const startedAt = /* @__PURE__ */ new Date();
  let config;
  let uploadFailedSarifResult;
+  let dependencyCachingUsage;
  try {
    restoreInputs();
    const gitHubVersion = await getGitHubVersion();
@@ -133655,6 +133807,9 @@ async function runWrapper() {
        features,
        logger
      );
+      if (await isAnalyzingDefaultBranch() && config.dependencyCachingEnabled !== "none" /* None */) {
+        dependencyCachingUsage = await getDependencyCacheUsage(logger);
+      }
    }
  } catch (unwrappedError) {
    const error2 = wrapError(unwrappedError);
@@ -133688,7 +133843,8 @@ async function runWrapper() {
    const statusReport = {
      ...statusReportBase,
      ...uploadFailedSarifResult,
-      job_status: getFinalJobStatus()
+      job_status: getFinalJobStatus(),
+      dependency_caching_usage: dependencyCachingUsage
    };
    logger.info("Sending status report for init-post step.");
    await sendStatusReport(statusReport);
@@ -26438,16 +26438,17 @@ var require_package = __commonJS({
  "package.json"(exports2, module2) {
    module2.exports = {
      name: "codeql",
-      version: "3.30.4",
+      version: "4.30.7",
      private: true,
      description: "CodeQL action",
      scripts: {
        _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "npm run transpile && node build.mjs",
+        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
        lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
        "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
        "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        test: "npm run transpile && ava src/**.test.ts --serial --verbose",
+        ava: "npm run transpile && ava --serial --verbose",
+        test: "npm run ava -- src/",
        "test-debug": "npm run test -- --timeout=20m",
        transpile: "tsc --build --verbose"
      },
@@ -26463,7 +26464,7 @@ var require_package = __commonJS({
      dependencies: {
        "@actions/artifact": "^2.3.1",
        "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.0.5",
+        "@actions/cache": "^4.1.0",
        "@actions/core": "^1.11.1",
        "@actions/exec": "^1.1.1",
        "@actions/github": "^6.0.0",
@@ -26490,11 +26491,11 @@ var require_package = __commonJS({
      },
      devDependencies: {
        "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.3.2",
+        "@eslint/compat": "^1.4.0",
        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "^9.35.0",
+        "@eslint/js": "^9.36.0",
        "@microsoft/eslint-formatter-sarif": "^3.1.0",
-        "@octokit/types": "^14.1.0",
+        "@octokit/types": "^15.0.0",
        "@types/archiver": "^6.0.3",
        "@types/console-log-level": "^1.4.5",
        "@types/follow-redirects": "^1.14.4",
@@ -26503,10 +26504,10 @@ var require_package = __commonJS({
        "@types/node-forge": "^1.3.14",
        "@types/semver": "^7.7.1",
        "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.43.0",
+        "@typescript-eslint/eslint-plugin": "^8.44.1",
        "@typescript-eslint/parser": "^8.41.0",
        ava: "^6.4.1",
-        esbuild: "^0.25.9",
+        esbuild: "^0.25.10",
        eslint: "^8.57.1",
        "eslint-import-resolver-typescript": "^3.8.7",
        "eslint-plugin-filenames": "^1.3.2",
@@ -28541,7 +28542,7 @@ var require_brace_expansion = __commonJS({
      var isSequence = isNumericSequence || isAlphaSequence;
      var isOptions = m.body.indexOf(",") >= 0;
      if (!isSequence && !isOptions) {
-        if (m.post.match(/,.*\}/)) {
+        if (m.post.match(/,(?!,).*\}/)) {
          str2 = m.pre + "{" + m.body + escClose + m.post;
          return expand(str2);
        }
@@ -67282,7 +67283,7 @@ var require_package2 = __commonJS({
  "node_modules/@actions/cache/package.json"(exports2, module2) {
    module2.exports = {
      name: "@actions/cache",
-      version: "4.0.5",
+      version: "4.1.0",
      preview: true,
      description: "Actions cache lib",
      keywords: [
@@ -72091,11 +72092,18 @@ var require_cache2 = __commonJS({
            kind: "scalar",
            T: 9
            /*ScalarType.STRING*/
+          },
+          {
+            no: 3,
+            name: "message",
+            kind: "scalar",
+            T: 9
+            /*ScalarType.STRING*/
          }
        ]);
      }
      create(value) {
-        const message = { ok: false, signedUploadUrl: "" };
+        const message = { ok: false, signedUploadUrl: "", message: "" };
        globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
        if (value !== void 0)
          (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72114,6 +72122,10 @@ var require_cache2 = __commonJS({
            2:
              message.signedUploadUrl = reader.string();
              break;
+            case /* string message */
+            3:
+              message.message = reader.string();
+              break;
            default:
              let u = options.readUnknownField;
              if (u === "throw")
@@ -72130,6 +72142,8 @@ var require_cache2 = __commonJS({
          writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
        if (message.signedUploadUrl !== "")
          writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
+        if (message.message !== "")
+          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
        let u = options.writeUnknownFields;
        if (u !== false)
          (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -72235,11 +72249,18 @@ var require_cache2 = __commonJS({
            kind: "scalar",
            T: 3
            /*ScalarType.INT64*/
+          },
+          {
+            no: 3,
+            name: "message",
+            kind: "scalar",
+            T: 9
+            /*ScalarType.STRING*/
          }
        ]);
      }
      create(value) {
-        const message = { ok: false, entryId: "0" };
+        const message = { ok: false, entryId: "0", message: "" };
        globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
        if (value !== void 0)
          (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72258,6 +72279,10 @@ var require_cache2 = __commonJS({
            2:
              message.entryId = reader.int64().toString();
              break;
+            case /* string message */
+            3:
+              message.message = reader.string();
+              break;
            default:
              let u = options.readUnknownField;
              if (u === "throw")
@@ -72274,6 +72299,8 @@ var require_cache2 = __commonJS({
          writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
        if (message.entryId !== "0")
          writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
+        if (message.message !== "")
+          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
        let u = options.writeUnknownFields;
        if (u !== false)
          (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -73037,7 +73064,7 @@ var require_cache3 = __commonJS({
      });
    };
    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
    var core13 = __importStar4(require_core());
    var path5 = __importStar4(require("path"));
    var utils = __importStar4(require_cacheUtils());
@@ -73045,7 +73072,6 @@ var require_cache3 = __commonJS({
    var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
    var config_1 = require_config();
    var tar_1 = require_tar();
-    var constants_1 = require_constants7();
    var http_client_1 = require_lib();
    var ValidationError = class _ValidationError extends Error {
      constructor(message) {
@@ -73063,6 +73089,14 @@ var require_cache3 = __commonJS({
      }
    };
    exports2.ReserveCacheError = ReserveCacheError;
+    var FinalizeCacheError = class _FinalizeCacheError extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "FinalizeCacheError";
+        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
+      }
+    };
+    exports2.FinalizeCacheError = FinalizeCacheError;
    function checkPaths(paths) {
      if (!paths || paths.length === 0) {
        throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -73334,9 +73368,6 @@ var require_cache3 = __commonJS({
          }
          const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
          core13.debug(`File Size: ${archiveFileSize}`);
-          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
-            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
-          }
          options.archiveSizeBytes = archiveFileSize;
          core13.debug("Reserving Cache");
          const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -73348,7 +73379,10 @@ var require_cache3 = __commonJS({
          try {
            const response = yield twirpClient.CreateCacheEntry(request);
            if (!response.ok) {
-              throw new Error("Response was not ok");
+              if (response.message) {
+                core13.warning(`Cache reservation failed: ${response.message}`);
+              }
+              throw new Error(response.message || "Response was not ok");
            }
            signedUploadUrl = response.signedUploadUrl;
          } catch (error2) {
@@ -73365,6 +73399,9 @@ var require_cache3 = __commonJS({
          const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
          core13.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
          if (!finalizeResponse.ok) {
+            if (finalizeResponse.message) {
+              throw new FinalizeCacheError(finalizeResponse.message);
+            }
            throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
          }
          cacheId = parseInt(finalizeResponse.entryId);
@@ -73374,6 +73411,8 @@ var require_cache3 = __commonJS({
            throw error2;
          } else if (typedError.name === ReserveCacheError.name) {
            core13.info(`Failed to save: ${typedError.message}`);
+          } else if (typedError.name === FinalizeCacheError.name) {
+            core13.warning(typedError.message);
          } else {
            if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
              core13.error(`Failed to save: ${typedError.message}`);
@@ -78228,7 +78267,6 @@ function wrapCliConfigurationError(cliError) {
 // src/config-utils.ts
 var fs3 = __toESM(require("fs"));
 var path3 = __toESM(require("path"));
-var semver4 = __toESM(require_semver2());

 // src/analyses.ts
 var AnalysisKind = /* @__PURE__ */ ((AnalysisKind2) => {
@@ -78241,8 +78279,17 @@ var supportedAnalysisKinds = new Set(Object.values(AnalysisKind));
 // src/caching-utils.ts
 var core6 = __toESM(require_core());

+// src/config/db-config.ts
+var semver2 = __toESM(require_semver2());
+var PACK_IDENTIFIER_PATTERN = (function() {
+  const alphaNumeric = "[a-z0-9]";
+  const alphaNumericDash = "[a-z0-9-]";
+  const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
+  return new RegExp(`^${component}/${component}$`);
+})();
+
 // src/feature-flags.ts
-var semver3 = __toESM(require_semver2());
+var semver4 = __toESM(require_semver2());

 // src/overlay-database-utils.ts
 var fs2 = __toESM(require("fs"));
@@ -78419,7 +78466,7 @@ function getActionsLogger() {
 }

 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -78480,7 +78527,7 @@ function computeChangedFiles(baseFileOids, overlayFileOids) {
 }

 // src/tools-features.ts
-var semver2 = __toESM(require_semver2());
+var semver3 = __toESM(require_semver2());
 function isSupportedToolsFeature(versionInfo, feature) {
  return !!versionInfo.features && versionInfo.features[feature];
 }
@@ -78643,6 +78690,11 @@ var featureConfig = {
    minimumVersion: void 0,
    toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
  },
+  ["use_repository_properties" /* UseRepositoryProperties */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
+    minimumVersion: void 0
+  },
  ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -78684,12 +78736,6 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
  rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
  swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
 };
-var PACK_IDENTIFIER_PATTERN = (function() {
-  const alphaNumeric = "[a-z0-9]";
-  const alphaNumericDash = "[a-z0-9-]";
-  const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
-  return new RegExp(`^${component}/${component}$`);
-})();
 function getPathToParsedConfigFile(tempDir) {
  return path3.join(tempDir, "config");
 }
@@ -79453,6 +79499,9 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
    logger.warning(
      `Caught an exception while gathering information for telemetry: ${e}. Will skip sending status report.`
    );
+    if (isInTestMode()) {
+      throw e;
+    }
    return void 0;
  }
 }
@@ -26438,16 +26438,17 @@ var require_package = __commonJS({
  "package.json"(exports2, module2) {
    module2.exports = {
      name: "codeql",
-      version: "3.30.4",
+      version: "4.30.7",
      private: true,
      description: "CodeQL action",
      scripts: {
        _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "npm run transpile && node build.mjs",
+        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
        lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
        "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
        "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        test: "npm run transpile && ava src/**.test.ts --serial --verbose",
+        ava: "npm run transpile && ava --serial --verbose",
+        test: "npm run ava -- src/",
        "test-debug": "npm run test -- --timeout=20m",
        transpile: "tsc --build --verbose"
      },
@@ -26463,7 +26464,7 @@ var require_package = __commonJS({
      dependencies: {
        "@actions/artifact": "^2.3.1",
        "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.0.5",
+        "@actions/cache": "^4.1.0",
        "@actions/core": "^1.11.1",
        "@actions/exec": "^1.1.1",
        "@actions/github": "^6.0.0",
@@ -26490,11 +26491,11 @@ var require_package = __commonJS({
      },
      devDependencies: {
        "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.3.2",
+        "@eslint/compat": "^1.4.0",
        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "^9.35.0",
+        "@eslint/js": "^9.36.0",
        "@microsoft/eslint-formatter-sarif": "^3.1.0",
-        "@octokit/types": "^14.1.0",
+        "@octokit/types": "^15.0.0",
        "@types/archiver": "^6.0.3",
        "@types/console-log-level": "^1.4.5",
        "@types/follow-redirects": "^1.14.4",
@@ -26503,10 +26504,10 @@ var require_package = __commonJS({
        "@types/node-forge": "^1.3.14",
        "@types/semver": "^7.7.1",
        "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.43.0",
+        "@typescript-eslint/eslint-plugin": "^8.44.1",
        "@typescript-eslint/parser": "^8.41.0",
        ava: "^6.4.1",
-        esbuild: "^0.25.9",
+        esbuild: "^0.25.10",
        eslint: "^8.57.1",
        "eslint-import-resolver-typescript": "^3.8.7",
        "eslint-plugin-filenames": "^1.3.2",
@@ -28541,7 +28542,7 @@ var require_brace_expansion = __commonJS({
      var isSequence = isNumericSequence || isAlphaSequence;
      var isOptions = m.body.indexOf(",") >= 0;
      if (!isSequence && !isOptions) {
-        if (m.post.match(/,.*\}/)) {
+        if (m.post.match(/,(?!,).*\}/)) {
          str2 = m.pre + "{" + m.body + escClose + m.post;
          return expand(str2);
        }
@@ -67282,7 +67283,7 @@ var require_package2 = __commonJS({
  "node_modules/@actions/cache/package.json"(exports2, module2) {
    module2.exports = {
      name: "@actions/cache",
-      version: "4.0.5",
+      version: "4.1.0",
      preview: true,
      description: "Actions cache lib",
      keywords: [
@@ -72091,11 +72092,18 @@ var require_cache2 = __commonJS({
            kind: "scalar",
            T: 9
            /*ScalarType.STRING*/
+          },
+          {
+            no: 3,
+            name: "message",
+            kind: "scalar",
+            T: 9
+            /*ScalarType.STRING*/
          }
        ]);
      }
      create(value) {
-        const message = { ok: false, signedUploadUrl: "" };
+        const message = { ok: false, signedUploadUrl: "", message: "" };
        globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
        if (value !== void 0)
          (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72114,6 +72122,10 @@ var require_cache2 = __commonJS({
            2:
              message.signedUploadUrl = reader.string();
              break;
+            case /* string message */
+            3:
+              message.message = reader.string();
+              break;
            default:
              let u = options.readUnknownField;
              if (u === "throw")
@@ -72130,6 +72142,8 @@ var require_cache2 = __commonJS({
          writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
        if (message.signedUploadUrl !== "")
          writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
+        if (message.message !== "")
+          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
        let u = options.writeUnknownFields;
        if (u !== false)
          (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -72235,11 +72249,18 @@ var require_cache2 = __commonJS({
            kind: "scalar",
            T: 3
            /*ScalarType.INT64*/
+          },
+          {
+            no: 3,
+            name: "message",
+            kind: "scalar",
+            T: 9
+            /*ScalarType.STRING*/
          }
        ]);
      }
      create(value) {
-        const message = { ok: false, entryId: "0" };
+        const message = { ok: false, entryId: "0", message: "" };
        globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
        if (value !== void 0)
          (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72258,6 +72279,10 @@ var require_cache2 = __commonJS({
            2:
              message.entryId = reader.int64().toString();
              break;
+            case /* string message */
+            3:
+              message.message = reader.string();
+              break;
            default:
              let u = options.readUnknownField;
              if (u === "throw")
@@ -72274,6 +72299,8 @@ var require_cache2 = __commonJS({
          writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
        if (message.entryId !== "0")
          writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
+        if (message.message !== "")
+          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
        let u = options.writeUnknownFields;
        if (u !== false)
          (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -73037,7 +73064,7 @@ var require_cache3 = __commonJS({
      });
    };
    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
    var core14 = __importStar4(require_core());
    var path2 = __importStar4(require("path"));
    var utils = __importStar4(require_cacheUtils());
@@ -73045,7 +73072,6 @@ var require_cache3 = __commonJS({
    var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
    var config_1 = require_config();
    var tar_1 = require_tar();
-    var constants_1 = require_constants7();
    var http_client_1 = require_lib();
    var ValidationError = class _ValidationError extends Error {
      constructor(message) {
@@ -73063,6 +73089,14 @@ var require_cache3 = __commonJS({
      }
    };
    exports2.ReserveCacheError = ReserveCacheError2;
+    var FinalizeCacheError = class _FinalizeCacheError extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "FinalizeCacheError";
+        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
+      }
+    };
+    exports2.FinalizeCacheError = FinalizeCacheError;
    function checkPaths(paths) {
      if (!paths || paths.length === 0) {
        throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -73334,9 +73368,6 @@ var require_cache3 = __commonJS({
          }
          const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
          core14.debug(`File Size: ${archiveFileSize}`);
-          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
-            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
-          }
          options.archiveSizeBytes = archiveFileSize;
          core14.debug("Reserving Cache");
          const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -73348,7 +73379,10 @@ var require_cache3 = __commonJS({
          try {
            const response = yield twirpClient.CreateCacheEntry(request);
            if (!response.ok) {
-              throw new Error("Response was not ok");
+              if (response.message) {
+                core14.warning(`Cache reservation failed: ${response.message}`);
+              }
+              throw new Error(response.message || "Response was not ok");
            }
            signedUploadUrl = response.signedUploadUrl;
          } catch (error2) {
@@ -73365,6 +73399,9 @@ var require_cache3 = __commonJS({
          const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
          core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
          if (!finalizeResponse.ok) {
+            if (finalizeResponse.message) {
+              throw new FinalizeCacheError(finalizeResponse.message);
+            }
            throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
          }
          cacheId = parseInt(finalizeResponse.entryId);
@@ -73374,6 +73411,8 @@ var require_cache3 = __commonJS({
            throw error2;
          } else if (typedError.name === ReserveCacheError2.name) {
            core14.info(`Failed to save: ${typedError.message}`);
+          } else if (typedError.name === FinalizeCacheError.name) {
+            core14.warning(typedError.message);
          } else {
            if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
              core14.error(`Failed to save: ${typedError.message}`);
@@ -93456,7 +93495,7 @@ var require_commonjs16 = __commonJS({
    var TYPEMASK = 1023;
    var entToType = (s) => s.isFile() ? IFREG : s.isDirectory() ? IFDIR : s.isSymbolicLink() ? IFLNK : s.isCharacterDevice() ? IFCHR : s.isBlockDevice() ? IFBLK : s.isSocket() ? IFSOCK : s.isFIFO() ? IFIFO : UNKNOWN;
    var normalizeCache = /* @__PURE__ */ new Map();
-    var normalize2 = (s) => {
+    var normalize = (s) => {
      const c = normalizeCache.get(s);
      if (c)
        return c;
@@ -93469,7 +93508,7 @@ var require_commonjs16 = __commonJS({
      const c = normalizeNocaseCache.get(s);
      if (c)
        return c;
-      const n = normalize2(s.toLowerCase());
+      const n = normalize(s.toLowerCase());
      normalizeNocaseCache.set(s, n);
      return n;
    };
@@ -93638,7 +93677,7 @@ var require_commonjs16 = __commonJS({
       */
      constructor(name, type2 = UNKNOWN, root, roots, nocase, children, opts) {
        this.name = name;
-        this.#matchName = nocase ? normalizeNocase(name) : normalize2(name);
+        this.#matchName = nocase ? normalizeNocase(name) : normalize(name);
        this.#type = type2 & TYPEMASK;
        this.nocase = nocase;
        this.roots = roots;
@@ -93731,7 +93770,7 @@ var require_commonjs16 = __commonJS({
          return this.parent || this;
        }
        const children = this.children();
-        const name = this.nocase ? normalizeNocase(pathPart) : normalize2(pathPart);
+        const name = this.nocase ? normalizeNocase(pathPart) : normalize(pathPart);
        for (const p of children) {
          if (p.#matchName === name) {
            return p;
@@ -93976,7 +94015,7 @@ var require_commonjs16 = __commonJS({
       * directly.
       */
      isNamed(n) {
-        return !this.nocase ? this.#matchName === normalize2(n) : this.#matchName === normalizeNocase(n);
+        return !this.nocase ? this.#matchName === normalize(n) : this.#matchName === normalizeNocase(n);
      }
      /**
       * Return the Path object corresponding to the target of a symbolic link.
@@ -94115,7 +94154,7 @@ var require_commonjs16 = __commonJS({
      #readdirMaybePromoteChild(e, c) {
        for (let p = c.provisional; p < c.length; p++) {
          const pchild = c[p];
-          const name = this.nocase ? normalizeNocase(e.name) : normalize2(e.name);
+          const name = this.nocase ? normalizeNocase(e.name) : normalize(e.name);
          if (name !== pchild.#matchName) {
            continue;
          }
@@ -101946,7 +101985,7 @@ var require_tr46 = __commonJS({
      TRANSITIONAL: 0,
      NONTRANSITIONAL: 1
    };
-    function normalize2(str2) {
+    function normalize(str2) {
      return str2.split("\0").map(function(s) {
        return s.normalize("NFC");
      }).join("\0");
@@ -102026,7 +102065,7 @@ var require_tr46 = __commonJS({
        processing_option = PROCESSING_OPTIONS.NONTRANSITIONAL;
      }
      var error2 = false;
-      if (normalize2(label) !== label || label[3] === "-" && label[4] === "-" || label[0] === "-" || label[label.length - 1] === "-" || label.indexOf(".") !== -1 || label.search(combiningMarksRegex) === 0) {
+      if (normalize(label) !== label || label[3] === "-" && label[4] === "-" || label[0] === "-" || label[label.length - 1] === "-" || label.indexOf(".") !== -1 || label.search(combiningMarksRegex) === 0) {
        error2 = true;
      }
      var len = countSymbols(label);
@@ -102044,7 +102083,7 @@ var require_tr46 = __commonJS({
    }
    function processing(domain_name, useSTD3, processing_option) {
      var result = mapChars(domain_name, useSTD3, processing_option);
-      result.string = normalize2(result.string);
+      result.string = normalize(result.string);
      var labels = result.string.split(".");
      for (var i = 0; i < labels.length; ++i) {
        try {
@@ -117127,7 +117166,6 @@ async function getGitHubVersion() {
 // src/config-utils.ts
 var fs = __toESM(require("fs"));
 var path = __toESM(require("path"));
-var semver4 = __toESM(require_semver2());

 // src/analyses.ts
 var AnalysisKind = /* @__PURE__ */ ((AnalysisKind2) => {
@@ -117140,8 +117178,17 @@ var supportedAnalysisKinds = new Set(Object.values(AnalysisKind));
 // src/caching-utils.ts
 var core6 = __toESM(require_core());

+// src/config/db-config.ts
+var semver2 = __toESM(require_semver2());
+var PACK_IDENTIFIER_PATTERN = (function() {
+  const alphaNumeric = "[a-z0-9]";
+  const alphaNumericDash = "[a-z0-9-]";
+  const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
+  return new RegExp(`^${component}/${component}$`);
+})();
+
 // src/feature-flags.ts
-var semver3 = __toESM(require_semver2());
+var semver4 = __toESM(require_semver2());

 // src/overlay-database-utils.ts
 var actionsCache = __toESM(require_cache3());
@@ -117158,12 +117205,12 @@ function getActionsLogger() {
 }

 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;

 // src/tools-features.ts
-var semver2 = __toESM(require_semver2());
+var semver3 = __toESM(require_semver2());

 // src/feature-flags.ts
 var featureConfig = {
@@ -117323,6 +117370,11 @@ var featureConfig = {
    minimumVersion: void 0,
    toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
  },
+  ["use_repository_properties" /* UseRepositoryProperties */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
+    minimumVersion: void 0
+  },
  ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -117364,12 +117416,6 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
  rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
  swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
 };
-var PACK_IDENTIFIER_PATTERN = (function() {
-  const alphaNumeric = "[a-z0-9]";
-  const alphaNumericDash = "[a-z0-9-]";
-  const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
-  return new RegExp(`^${component}/${component}$`);
-})();
 function getPathToParsedConfigFile(tempDir) {
  return path.join(tempDir, "config");
 }
@@ -29019,7 +29019,7 @@ var require_pattern = __commonJS({
      const absolute = [];
      const relative2 = [];
      for (const pattern of patterns) {
-        if (isAbsolute3(pattern)) {
+        if (isAbsolute2(pattern)) {
          absolute.push(pattern);
        } else {
          relative2.push(pattern);
@@ -29028,10 +29028,10 @@ var require_pattern = __commonJS({
      return [absolute, relative2];
    }
    exports2.partitionAbsoluteAndRelative = partitionAbsoluteAndRelative;
-    function isAbsolute3(pattern) {
+    function isAbsolute2(pattern) {
      return path15.isAbsolute(pattern);
    }
-    exports2.isAbsolute = isAbsolute3;
+    exports2.isAbsolute = isAbsolute2;
  }
 });

@@ -29446,11 +29446,11 @@ var require_out = __commonJS({
      async.read(path15, getSettings(optionsOrSettingsOrCallback), callback);
    }
    exports2.stat = stat;
-    function statSync2(path15, optionsOrSettings) {
+    function statSync3(path15, optionsOrSettings) {
      const settings = getSettings(optionsOrSettings);
      return sync.read(path15, settings);
    }
-    exports2.statSync = statSync2;
+    exports2.statSync = statSync3;
    function getSettings(settingsOrOptions = {}) {
      if (settingsOrOptions instanceof settings_1.default) {
        return settingsOrOptions;
@@ -33584,16 +33584,17 @@ var require_package = __commonJS({
  "package.json"(exports2, module2) {
    module2.exports = {
      name: "codeql",
-      version: "3.30.4",
+      version: "4.30.7",
      private: true,
      description: "CodeQL action",
      scripts: {
        _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "npm run transpile && node build.mjs",
+        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
        lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
        "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
        "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        test: "npm run transpile && ava src/**.test.ts --serial --verbose",
+        ava: "npm run transpile && ava --serial --verbose",
+        test: "npm run ava -- src/",
        "test-debug": "npm run test -- --timeout=20m",
        transpile: "tsc --build --verbose"
      },
@@ -33609,7 +33610,7 @@ var require_package = __commonJS({
      dependencies: {
        "@actions/artifact": "^2.3.1",
        "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.0.5",
+        "@actions/cache": "^4.1.0",
        "@actions/core": "^1.11.1",
        "@actions/exec": "^1.1.1",
        "@actions/github": "^6.0.0",
@@ -33636,11 +33637,11 @@ var require_package = __commonJS({
      },
      devDependencies: {
        "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.3.2",
+        "@eslint/compat": "^1.4.0",
        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "^9.35.0",
+        "@eslint/js": "^9.36.0",
        "@microsoft/eslint-formatter-sarif": "^3.1.0",
-        "@octokit/types": "^14.1.0",
+        "@octokit/types": "^15.0.0",
        "@types/archiver": "^6.0.3",
        "@types/console-log-level": "^1.4.5",
        "@types/follow-redirects": "^1.14.4",
@@ -33649,10 +33650,10 @@ var require_package = __commonJS({
        "@types/node-forge": "^1.3.14",
        "@types/semver": "^7.7.1",
        "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.43.0",
+        "@typescript-eslint/eslint-plugin": "^8.44.1",
        "@typescript-eslint/parser": "^8.41.0",
        ava: "^6.4.1",
-        esbuild: "^0.25.9",
+        esbuild: "^0.25.10",
        eslint: "^8.57.1",
        "eslint-import-resolver-typescript": "^3.8.7",
        "eslint-plugin-filenames": "^1.3.2",
@@ -35687,7 +35688,7 @@ var require_brace_expansion = __commonJS({
      var isSequence = isNumericSequence || isAlphaSequence;
      var isOptions = m.body.indexOf(",") >= 0;
      if (!isSequence && !isOptions) {
-        if (m.post.match(/,.*\}/)) {
+        if (m.post.match(/,(?!,).*\}/)) {
          str2 = m.pre + "{" + m.body + escClose + m.post;
          return expand(str2);
        }
@@ -74428,7 +74429,7 @@ var require_package2 = __commonJS({
  "node_modules/@actions/cache/package.json"(exports2, module2) {
    module2.exports = {
      name: "@actions/cache",
-      version: "4.0.5",
+      version: "4.1.0",
      preview: true,
      description: "Actions cache lib",
      keywords: [
@@ -79237,11 +79238,18 @@ var require_cache2 = __commonJS({
            kind: "scalar",
            T: 9
            /*ScalarType.STRING*/
+          },
+          {
+            no: 3,
+            name: "message",
+            kind: "scalar",
+            T: 9
+            /*ScalarType.STRING*/
          }
        ]);
      }
      create(value) {
-        const message = { ok: false, signedUploadUrl: "" };
+        const message = { ok: false, signedUploadUrl: "", message: "" };
        globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
        if (value !== void 0)
          (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -79260,6 +79268,10 @@ var require_cache2 = __commonJS({
            2:
              message.signedUploadUrl = reader.string();
              break;
+            case /* string message */
+            3:
+              message.message = reader.string();
+              break;
            default:
              let u = options.readUnknownField;
              if (u === "throw")
@@ -79276,6 +79288,8 @@ var require_cache2 = __commonJS({
          writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
        if (message.signedUploadUrl !== "")
          writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
+        if (message.message !== "")
+          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
        let u = options.writeUnknownFields;
        if (u !== false)
          (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -79381,11 +79395,18 @@ var require_cache2 = __commonJS({
            kind: "scalar",
            T: 3
            /*ScalarType.INT64*/
+          },
+          {
+            no: 3,
+            name: "message",
+            kind: "scalar",
+            T: 9
+            /*ScalarType.STRING*/
          }
        ]);
      }
      create(value) {
-        const message = { ok: false, entryId: "0" };
+        const message = { ok: false, entryId: "0", message: "" };
        globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
        if (value !== void 0)
          (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -79404,6 +79425,10 @@ var require_cache2 = __commonJS({
            2:
              message.entryId = reader.int64().toString();
              break;
+            case /* string message */
+            3:
+              message.message = reader.string();
+              break;
            default:
              let u = options.readUnknownField;
              if (u === "throw")
@@ -79420,6 +79445,8 @@ var require_cache2 = __commonJS({
          writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
        if (message.entryId !== "0")
          writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
+        if (message.message !== "")
+          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
        let u = options.writeUnknownFields;
        if (u !== false)
          (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -80183,7 +80210,7 @@ var require_cache3 = __commonJS({
      });
    };
    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
    var core12 = __importStar4(require_core());
    var path15 = __importStar4(require("path"));
    var utils = __importStar4(require_cacheUtils());
@@ -80191,7 +80218,6 @@ var require_cache3 = __commonJS({
    var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
    var config_1 = require_config();
    var tar_1 = require_tar();
-    var constants_1 = require_constants10();
    var http_client_1 = require_lib();
    var ValidationError = class _ValidationError extends Error {
      constructor(message) {
@@ -80209,6 +80235,14 @@ var require_cache3 = __commonJS({
      }
    };
    exports2.ReserveCacheError = ReserveCacheError;
+    var FinalizeCacheError = class _FinalizeCacheError extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "FinalizeCacheError";
+        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
+      }
+    };
+    exports2.FinalizeCacheError = FinalizeCacheError;
    function checkPaths(paths) {
      if (!paths || paths.length === 0) {
        throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -80480,9 +80514,6 @@ var require_cache3 = __commonJS({
          }
          const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
          core12.debug(`File Size: ${archiveFileSize}`);
-          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
-            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
-          }
          options.archiveSizeBytes = archiveFileSize;
          core12.debug("Reserving Cache");
          const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -80494,7 +80525,10 @@ var require_cache3 = __commonJS({
          try {
            const response = yield twirpClient.CreateCacheEntry(request);
            if (!response.ok) {
-              throw new Error("Response was not ok");
+              if (response.message) {
+                core12.warning(`Cache reservation failed: ${response.message}`);
+              }
+              throw new Error(response.message || "Response was not ok");
            }
            signedUploadUrl = response.signedUploadUrl;
          } catch (error2) {
@@ -80511,6 +80545,9 @@ var require_cache3 = __commonJS({
          const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
          core12.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
          if (!finalizeResponse.ok) {
+            if (finalizeResponse.message) {
+              throw new FinalizeCacheError(finalizeResponse.message);
+            }
            throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
          }
          cacheId = parseInt(finalizeResponse.entryId);
@@ -80520,6 +80557,8 @@ var require_cache3 = __commonJS({
            throw error2;
          } else if (typedError.name === ReserveCacheError.name) {
            core12.info(`Failed to save: ${typedError.message}`);
+          } else if (typedError.name === FinalizeCacheError.name) {
+            core12.warning(typedError.message);
          } else {
            if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
              core12.error(`Failed to save: ${typedError.message}`);
@@ -84782,6 +84821,7 @@ __export(upload_lib_exports, {
  InvalidSarifUploadError: () => InvalidSarifUploadError,
  buildPayload: () => buildPayload,
  findSarifFilesInDir: () => findSarifFilesInDir,
+  getGroupedSarifFilePaths: () => getGroupedSarifFilePaths,
  getSarifFilePaths: () => getSarifFilePaths,
  populateRunAutomationDetails: () => populateRunAutomationDetails,
  readSarifFile: () => readSarifFile,
@@ -88434,6 +88474,9 @@ function getWorkflowRunAttempt() {
  }
  return workflowRunAttempt;
 }
+function isDefaultSetup() {
+  return getWorkflowEventName() === "dynamic";
+}
 function prettyPrintInvocation(cmd, args) {
  return [cmd, ...args].map((x) => x.includes(" ") ? `'${x}'` : x).join(" ");
 }
@@ -88490,6 +88533,57 @@ async function runTool(cmd, args = [], opts = {}) {
  }
  return stdout;
 }
+var qualityCategoryMapping = {
+  "c#": "csharp",
+  cpp: "c-cpp",
+  c: "c-cpp",
+  "c++": "c-cpp",
+  java: "java-kotlin",
+  javascript: "javascript-typescript",
+  typescript: "javascript-typescript",
+  kotlin: "java-kotlin"
+};
+function fixCodeQualityCategory(logger, category) {
+  if (category !== void 0 && isDefaultSetup() && category.startsWith("/language:")) {
+    const language = category.substring("/language:".length);
+    const mappedLanguage = qualityCategoryMapping[language];
+    if (mappedLanguage) {
+      const newCategory = `/language:${mappedLanguage}`;
+      logger.info(
+        `Adjusted category for Code Quality from '${category}' to '${newCategory}'.`
+      );
+      return newCategory;
+    }
+  }
+  return category;
+}
+
+// src/analyses.ts
+var AnalysisKind = /* @__PURE__ */ ((AnalysisKind2) => {
+  AnalysisKind2["CodeScanning"] = "code-scanning";
+  AnalysisKind2["CodeQuality"] = "code-quality";
+  return AnalysisKind2;
+})(AnalysisKind || {});
+var supportedAnalysisKinds = new Set(Object.values(AnalysisKind));
+var CodeScanning = {
+  kind: "code-scanning" /* CodeScanning */,
+  name: "code scanning",
+  target: "PUT /repos/:owner/:repo/code-scanning/analysis" /* CODE_SCANNING */,
+  sarifExtension: ".sarif",
+  sarifPredicate: (name) => name.endsWith(CodeScanning.sarifExtension) && !CodeQuality.sarifPredicate(name),
+  fixCategory: (_, category) => category,
+  sentinelPrefix: "CODEQL_UPLOAD_SARIF_"
+};
+var CodeQuality = {
+  kind: "code-quality" /* CodeQuality */,
+  name: "code quality",
+  target: "PUT /repos/:owner/:repo/code-quality/analysis" /* CODE_QUALITY */,
+  sarifExtension: ".quality.sarif",
+  sarifPredicate: (name) => name.endsWith(CodeQuality.sarifExtension),
+  fixCategory: fixCodeQualityCategory,
+  sentinelPrefix: "CODEQL_UPLOAD_QUALITY_SARIF_"
+};
+var SarifScanOrder = [CodeQuality, CodeScanning];

 // src/api-client.ts
 var core5 = __toESM(require_core());
@@ -88544,6 +88638,14 @@ function getApiDetails() {
 function getApiClient() {
  return createApiClientWithDetails(getApiDetails());
 }
+function getAuthorizationHeaderFor(logger, apiDetails, url2) {
+  if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) {
+    logger.debug(`Providing an authorization token.`);
+    return `token ${apiDetails.auth}`;
+  }
+  logger.debug(`Not using an authorization token.`);
+  return void 0;
+}
 var cachedGitHubVersion = void 0;
 async function getGitHubVersionFromApi(apiClient, apiDetails) {
  if (parseGitHubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) {
@@ -88873,29 +88975,29 @@ function wrapCliConfigurationError(cliError) {
 // src/config-utils.ts
 var fs7 = __toESM(require("fs"));
 var path9 = __toESM(require("path"));
-var semver4 = __toESM(require_semver2());
-
-// src/analyses.ts
-var AnalysisKind = /* @__PURE__ */ ((AnalysisKind2) => {
-  AnalysisKind2["CodeScanning"] = "code-scanning";
-  AnalysisKind2["CodeQuality"] = "code-quality";
-  return AnalysisKind2;
-})(AnalysisKind || {});
-var supportedAnalysisKinds = new Set(Object.values(AnalysisKind));

 // src/caching-utils.ts
 var core6 = __toESM(require_core());

+// src/config/db-config.ts
+var semver2 = __toESM(require_semver2());
+var PACK_IDENTIFIER_PATTERN = (function() {
+  const alphaNumeric = "[a-z0-9]";
+  const alphaNumericDash = "[a-z0-9-]";
+  const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
+  return new RegExp(`^${component}/${component}$`);
+})();
+
 // src/diff-informed-analysis-utils.ts
 var fs6 = __toESM(require("fs"));
 var path8 = __toESM(require("path"));

 // src/feature-flags.ts
-var semver3 = __toESM(require_semver2());
+var semver4 = __toESM(require_semver2());

 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.0";
-var cliVersion = "2.23.0";
+var bundleVersion = "codeql-bundle-v2.23.2";
+var cliVersion = "2.23.2";

 // src/overlay-database-utils.ts
 var fs5 = __toESM(require("fs"));
@@ -89114,7 +89216,7 @@ function formatDuration(durationMs) {
 }

 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -89175,7 +89277,7 @@ function computeChangedFiles(baseFileOids, overlayFileOids) {
 }

 // src/tools-features.ts
-var semver2 = __toESM(require_semver2());
+var semver3 = __toESM(require_semver2());
 function isSupportedToolsFeature(versionInfo, feature) {
  return !!versionInfo.features && versionInfo.features[feature];
 }
@@ -89339,6 +89441,11 @@ var featureConfig = {
    minimumVersion: void 0,
    toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
  },
+  ["use_repository_properties" /* UseRepositoryProperties */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
+    minimumVersion: void 0
+  },
  ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -89398,12 +89505,6 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
  rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
  swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
 };
-var PACK_IDENTIFIER_PATTERN = (function() {
-  const alphaNumeric = "[a-z0-9]";
-  const alphaNumericDash = "[a-z0-9-]";
-  const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
-  return new RegExp(`^${component}/${component}$`);
-})();
 function getPathToParsedConfigFile(tempDir) {
  return path9.join(tempDir, "config");
 }
@@ -89822,7 +89923,10 @@ function sanitizeUrlForStatusReport(url2) {

 // src/setup-codeql.ts
 var CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action";
+var CODEQL_NIGHTLIES_REPOSITORY_OWNER = "dsp-testing";
+var CODEQL_NIGHTLIES_REPOSITORY_NAME = "codeql-cli-nightlies";
 var CODEQL_BUNDLE_VERSION_ALIAS = ["linked", "latest"];
+var CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"];
 function getCodeQLBundleExtension(compressionMethod) {
  switch (compressionMethod) {
    case "gzip":
@@ -89965,7 +90069,7 @@ async function findOverridingToolsInCache(humanReadableVersion, logger) {
  return void 0;
 }
 async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, variant, tarSupportsZstd, logger) {
-  if (toolsInput && !CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput) && !toolsInput.startsWith("http")) {
+  if (toolsInput && !isReservedToolsValue(toolsInput) && !toolsInput.startsWith("http")) {
    logger.info(`Using CodeQL CLI from local path ${toolsInput}`);
    const compressionMethod2 = inferCompressionMethod(toolsInput);
    if (compressionMethod2 === void 0) {
@@ -89980,23 +90084,27 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
      toolsVersion: "local"
    };
  }
+  let cliVersion2;
+  let tagName;
+  let url2;
+  if (toolsInput !== void 0 && CODEQL_NIGHTLY_TOOLS_INPUTS.includes(toolsInput)) {
+    logger.info(
+      `Using the latest CodeQL CLI nightly, as requested by 'tools: ${toolsInput}'.`
+    );
+    toolsInput = await getNightlyToolsUrl(logger);
+  }
  const forceShippedTools = toolsInput && CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput);
  if (forceShippedTools) {
+    cliVersion2 = cliVersion;
+    tagName = bundleVersion;
    logger.info(
-      `'tools: ${toolsInput}' was requested, so using CodeQL version ${defaultCliVersion.cliVersion}, the version shipped with the Action.`
+      `'tools: ${toolsInput}' was requested, so using CodeQL version ${cliVersion2}, the version shipped with the Action.`
    );
    if (toolsInput === "latest") {
      logger.warning(
        "`tools: latest` has been renamed to `tools: linked`, but the old name is still supported. No action is required."
      );
    }
-  }
-  let cliVersion2;
-  let tagName;
-  let url2;
-  if (forceShippedTools) {
-    cliVersion2 = cliVersion;
-    tagName = bundleVersion;
  } else if (toolsInput !== void 0) {
    tagName = tryGetTagNameFromUrl(toolsInput, logger);
    url2 = toolsInput;
@@ -90146,11 +90254,12 @@ var downloadCodeQL = async function(codeqlURL, compressionMethod, maybeBundleVer
  let authorization = void 0;
  if (searchParams.has("token")) {
    logger.debug("CodeQL tools URL contains an authorization token.");
-  } else if (codeqlURL.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) {
-    logger.debug("Providing an authorization token to download CodeQL tools.");
-    authorization = `token ${apiDetails.auth}`;
  } else {
-    logger.debug("Downloading CodeQL tools without an authorization token.");
+    authorization = getAuthorizationHeaderFor(
+      logger,
+      apiDetails,
+      codeqlURL
+    );
  }
  const toolcacheInfo = getToolcacheDestinationInfo(
    maybeBundleVersion,
@@ -90277,6 +90386,34 @@ async function useZstdBundle(cliVersion2, tarSupportsZstd) {
 function getTempExtractionDir(tempDir) {
  return path11.join(tempDir, v4_default());
 }
+async function getNightlyToolsUrl(logger) {
+  const zstdAvailability = await isZstdAvailable(logger);
+  const compressionMethod = await useZstdBundle(
+    CODEQL_VERSION_ZSTD_BUNDLE,
+    zstdAvailability.available
+  ) ? "zstd" : "gzip";
+  try {
+    const release = await getApiClient().rest.repos.listReleases({
+      owner: CODEQL_NIGHTLIES_REPOSITORY_OWNER,
+      repo: CODEQL_NIGHTLIES_REPOSITORY_NAME,
+      per_page: 1,
+      page: 1,
+      prerelease: true
+    });
+    const latestRelease = release.data[0];
+    if (!latestRelease) {
+      throw new Error("Could not find the latest nightly release.");
+    }
+    return `https://github.com/${CODEQL_NIGHTLIES_REPOSITORY_OWNER}/${CODEQL_NIGHTLIES_REPOSITORY_NAME}/releases/download/${latestRelease.tag_name}/${getCodeQLBundleName(compressionMethod)}`;
+  } catch (e) {
+    throw new Error(
+      `Failed to retrieve the latest nightly release: ${wrapError(e)}`
+    );
+  }
+}
+function isReservedToolsValue(tools) {
+  return CODEQL_BUNDLE_VERSION_ALIAS.includes(tools) || CODEQL_NIGHTLY_TOOLS_INPUTS.includes(tools);
+}

 // src/tracer-config.ts
 async function shouldEnableIndirectTracing(codeql, config) {
@@ -92301,6 +92438,54 @@ function getSarifFilePaths(sarifPath, isSarif) {
  }
  return sarifFiles;
 }
+async function getGroupedSarifFilePaths(logger, sarifPath) {
+  const stats = fs13.statSync(sarifPath, { throwIfNoEntry: false });
+  if (stats === void 0) {
+    throw new ConfigurationError(`Path does not exist: ${sarifPath}`);
+  }
+  const results = {};
+  if (stats.isDirectory()) {
+    let unassignedSarifFiles = findSarifFilesInDir(
+      sarifPath,
+      (name) => path14.extname(name) === ".sarif"
+    );
+    logger.debug(
+      `Found the following .sarif files in ${sarifPath}: ${unassignedSarifFiles.join(", ")}`
+    );
+    for (const analysisConfig of SarifScanOrder) {
+      const filesForCurrentAnalysis = unassignedSarifFiles.filter(
+        analysisConfig.sarifPredicate
+      );
+      if (filesForCurrentAnalysis.length > 0) {
+        logger.debug(
+          `The following SARIF files are for ${analysisConfig.name}: ${filesForCurrentAnalysis.join(", ")}`
+        );
+        unassignedSarifFiles = unassignedSarifFiles.filter(
+          (name) => !analysisConfig.sarifPredicate(name)
+        );
+        results[analysisConfig.kind] = filesForCurrentAnalysis;
+      } else {
+        logger.debug(`Found no SARIF files for ${analysisConfig.name}`);
+      }
+    }
+    if (unassignedSarifFiles.length !== 0) {
+      logger.warning(
+        `Found files in ${sarifPath} which do not belong to any analysis: ${unassignedSarifFiles.join(", ")}`
+      );
+    }
+  } else {
+    for (const analysisConfig of SarifScanOrder) {
+      if (analysisConfig.kind === "code-scanning" /* CodeScanning */ || analysisConfig.sarifPredicate(sarifPath)) {
+        logger.debug(
+          `Using '${sarifPath}' as a SARIF file for ${analysisConfig.name}.`
+        );
+        results[analysisConfig.kind] = [sarifPath];
+        break;
+      }
+    }
+  }
+  return results;
+}
 function countResultsInSarif(sarif) {
  let numResults = 0;
  const parsedSarif = JSON.parse(sarif);
@@ -92415,6 +92600,7 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
  logger.info(`Processing sarif files: ${JSON.stringify(sarifPaths)}`);
  const gitHubVersion = await getGitHubVersion();
  let sarif;
+  category = uploadTarget.fixCategory(logger, category);
  if (sarifPaths.length > 1) {
    for (const sarifPath of sarifPaths) {
      const parsedSarif = readSarifFile(sarifPath);
@@ -92660,6 +92846,7 @@ function filterAlertsByDiffRange(logger, sarif) {
  InvalidSarifUploadError,
  buildPayload,
  findSarifFilesInDir,
+  getGroupedSarifFilePaths,
  getSarifFilePaths,
  populateRunAutomationDetails,
  readSarifFile,
@@ -26438,16 +26438,17 @@ var require_package = __commonJS({
  "package.json"(exports2, module2) {
    module2.exports = {
      name: "codeql",
-      version: "3.30.4",
+      version: "4.30.7",
      private: true,
      description: "CodeQL action",
      scripts: {
        _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "npm run transpile && node build.mjs",
+        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
        lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
        "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
        "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        test: "npm run transpile && ava src/**.test.ts --serial --verbose",
+        ava: "npm run transpile && ava --serial --verbose",
+        test: "npm run ava -- src/",
        "test-debug": "npm run test -- --timeout=20m",
        transpile: "tsc --build --verbose"
      },
@@ -26463,7 +26464,7 @@ var require_package = __commonJS({
      dependencies: {
        "@actions/artifact": "^2.3.1",
        "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.0.5",
+        "@actions/cache": "^4.1.0",
        "@actions/core": "^1.11.1",
        "@actions/exec": "^1.1.1",
        "@actions/github": "^6.0.0",
@@ -26490,11 +26491,11 @@ var require_package = __commonJS({
      },
      devDependencies: {
        "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.3.2",
+        "@eslint/compat": "^1.4.0",
        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "^9.35.0",
+        "@eslint/js": "^9.36.0",
        "@microsoft/eslint-formatter-sarif": "^3.1.0",
-        "@octokit/types": "^14.1.0",
+        "@octokit/types": "^15.0.0",
        "@types/archiver": "^6.0.3",
        "@types/console-log-level": "^1.4.5",
        "@types/follow-redirects": "^1.14.4",
@@ -26503,10 +26504,10 @@ var require_package = __commonJS({
        "@types/node-forge": "^1.3.14",
        "@types/semver": "^7.7.1",
        "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.43.0",
+        "@typescript-eslint/eslint-plugin": "^8.44.1",
        "@typescript-eslint/parser": "^8.41.0",
        ava: "^6.4.1",
-        esbuild: "^0.25.9",
+        esbuild: "^0.25.10",
        eslint: "^8.57.1",
        "eslint-import-resolver-typescript": "^3.8.7",
        "eslint-plugin-filenames": "^1.3.2",
@@ -106365,7 +106366,7 @@ var require_brace_expansion3 = __commonJS({
      var isSequence = isNumericSequence || isAlphaSequence;
      var isOptions = m.body.indexOf(",") >= 0;
      if (!isSequence && !isOptions) {
-        if (m.post.match(/,.*\}/)) {
+        if (m.post.match(/,(?!,).*\}/)) {
          str2 = m.pre + "{" + m.body + escClose + m.post;
          return expand(str2);
        }
@@ -109984,7 +109985,7 @@ var require_package3 = __commonJS({
  "node_modules/@actions/cache/package.json"(exports2, module2) {
    module2.exports = {
      name: "@actions/cache",
-      version: "4.0.5",
+      version: "4.1.0",
      preview: true,
      description: "Actions cache lib",
      keywords: [
@@ -110567,11 +110568,18 @@ var require_cache2 = __commonJS({
            kind: "scalar",
            T: 9
            /*ScalarType.STRING*/
+          },
+          {
+            no: 3,
+            name: "message",
+            kind: "scalar",
+            T: 9
+            /*ScalarType.STRING*/
          }
        ]);
      }
      create(value) {
-        const message = { ok: false, signedUploadUrl: "" };
+        const message = { ok: false, signedUploadUrl: "", message: "" };
        globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
        if (value !== void 0)
          (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -110590,6 +110598,10 @@ var require_cache2 = __commonJS({
            2:
              message.signedUploadUrl = reader.string();
              break;
+            case /* string message */
+            3:
+              message.message = reader.string();
+              break;
            default:
              let u = options.readUnknownField;
              if (u === "throw")
@@ -110606,6 +110618,8 @@ var require_cache2 = __commonJS({
          writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
        if (message.signedUploadUrl !== "")
          writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
+        if (message.message !== "")
+          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
        let u = options.writeUnknownFields;
        if (u !== false)
          (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -110711,11 +110725,18 @@ var require_cache2 = __commonJS({
            kind: "scalar",
            T: 3
            /*ScalarType.INT64*/
+          },
+          {
+            no: 3,
+            name: "message",
+            kind: "scalar",
+            T: 9
+            /*ScalarType.STRING*/
          }
        ]);
      }
      create(value) {
-        const message = { ok: false, entryId: "0" };
+        const message = { ok: false, entryId: "0", message: "" };
        globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
        if (value !== void 0)
          (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -110734,6 +110755,10 @@ var require_cache2 = __commonJS({
            2:
              message.entryId = reader.int64().toString();
              break;
+            case /* string message */
+            3:
+              message.message = reader.string();
+              break;
            default:
              let u = options.readUnknownField;
              if (u === "throw")
@@ -110750,6 +110775,8 @@ var require_cache2 = __commonJS({
          writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
        if (message.entryId !== "0")
          writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
+        if (message.message !== "")
+          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
        let u = options.writeUnknownFields;
        if (u !== false)
          (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -111513,7 +111540,7 @@ var require_cache3 = __commonJS({
      });
    };
    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
    var core14 = __importStar4(require_core());
    var path2 = __importStar4(require("path"));
    var utils = __importStar4(require_cacheUtils());
@@ -111521,7 +111548,6 @@ var require_cache3 = __commonJS({
    var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
    var config_1 = require_config2();
    var tar_1 = require_tar2();
-    var constants_1 = require_constants10();
    var http_client_1 = require_lib();
    var ValidationError = class _ValidationError extends Error {
      constructor(message) {
@@ -111539,6 +111565,14 @@ var require_cache3 = __commonJS({
      }
    };
    exports2.ReserveCacheError = ReserveCacheError2;
+    var FinalizeCacheError = class _FinalizeCacheError extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "FinalizeCacheError";
+        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
+      }
+    };
+    exports2.FinalizeCacheError = FinalizeCacheError;
    function checkPaths(paths) {
      if (!paths || paths.length === 0) {
        throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -111810,9 +111844,6 @@ var require_cache3 = __commonJS({
          }
          const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
          core14.debug(`File Size: ${archiveFileSize}`);
-          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
-            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
-          }
          options.archiveSizeBytes = archiveFileSize;
          core14.debug("Reserving Cache");
          const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -111824,7 +111855,10 @@ var require_cache3 = __commonJS({
          try {
            const response = yield twirpClient.CreateCacheEntry(request);
            if (!response.ok) {
-              throw new Error("Response was not ok");
+              if (response.message) {
+                core14.warning(`Cache reservation failed: ${response.message}`);
+              }
+              throw new Error(response.message || "Response was not ok");
            }
            signedUploadUrl = response.signedUploadUrl;
          } catch (error2) {
@@ -111841,6 +111875,9 @@ var require_cache3 = __commonJS({
          const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
          core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
          if (!finalizeResponse.ok) {
+            if (finalizeResponse.message) {
+              throw new FinalizeCacheError(finalizeResponse.message);
+            }
            throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
          }
          cacheId = parseInt(finalizeResponse.entryId);
@@ -111850,6 +111887,8 @@ var require_cache3 = __commonJS({
            throw error2;
          } else if (typedError.name === ReserveCacheError2.name) {
            core14.info(`Failed to save: ${typedError.message}`);
+          } else if (typedError.name === FinalizeCacheError.name) {
+            core14.warning(typedError.message);
          } else {
            if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
              core14.error(`Failed to save: ${typedError.message}`);
@@ -117287,14 +117326,20 @@ var cliErrorsConfig = {
  }
 };

-// src/config-utils.ts
-var semver4 = __toESM(require_semver2());
-
 // src/caching-utils.ts
 var core6 = __toESM(require_core());

+// src/config/db-config.ts
+var semver2 = __toESM(require_semver2());
+var PACK_IDENTIFIER_PATTERN = (function() {
+  const alphaNumeric = "[a-z0-9]";
+  const alphaNumericDash = "[a-z0-9-]";
+  const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
+  return new RegExp(`^${component}/${component}$`);
+})();
+
 // src/feature-flags.ts
-var semver3 = __toESM(require_semver2());
+var semver4 = __toESM(require_semver2());

 // src/overlay-database-utils.ts
 var actionsCache = __toESM(require_cache3());
@@ -117319,15 +117364,15 @@ function withGroup(groupName, f) {
 }

 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;

 // src/tools-features.ts
-var semver2 = __toESM(require_semver2());
+var semver3 = __toESM(require_semver2());
 var SafeArtifactUploadVersion = "2.20.3";
 function isSafeArtifactUpload(codeQlVersion) {
-  return !codeQlVersion ? true : semver2.gte(codeQlVersion, SafeArtifactUploadVersion);
+  return !codeQlVersion ? true : semver3.gte(codeQlVersion, SafeArtifactUploadVersion);
 }

 // src/feature-flags.ts
@@ -117488,6 +117533,11 @@ var featureConfig = {
    minimumVersion: void 0,
    toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
  },
+  ["use_repository_properties" /* UseRepositoryProperties */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
+    minimumVersion: void 0
+  },
  ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -117529,12 +117579,6 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
  rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
  swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
 };
-var PACK_IDENTIFIER_PATTERN = (function() {
-  const alphaNumeric = "[a-z0-9]";
-  const alphaNumericDash = "[a-z0-9-]";
-  const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
-  return new RegExp(`^${component}/${component}$`);
-})();

 // src/setup-codeql.ts
 var toolcache3 = __toESM(require_tool_cache());
@@ -117575,7 +117619,7 @@ async function uploadCombinedSarifArtifacts(logger, gitHubVariant, codeQlVersion
      if (fs.existsSync(baseTempDir)) {
        const outputDirs = fs.readdirSync(baseTempDir);
        for (const outputDir of outputDirs) {
-          const sarifFiles = fs.readdirSync(path.resolve(baseTempDir, outputDir)).filter((f) => f.endsWith(".sarif"));
+          const sarifFiles = fs.readdirSync(path.resolve(baseTempDir, outputDir)).filter((f) => path.extname(f) === ".sarif");
          for (const sarifFile of sarifFiles) {
            toUpload.push(path.resolve(baseTempDir, outputDir, sarifFile));
          }
@@ -1,15 +1,16 @@
 {
  "name": "codeql",
-  "version": "3.30.4",
+  "version": "4.30.7",
  "private": true,
  "description": "CodeQL action",
  "scripts": {
    "_build_comment": "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-    "build": "npm run transpile && node build.mjs",
+    "build": "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
    "lint": "eslint --report-unused-disable-directives --max-warnings=0 .",
    "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
    "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-    "test": "npm run transpile && ava src/**.test.ts --serial --verbose",
+    "ava": "npm run transpile && ava --serial --verbose",
+    "test": "npm run ava -- src/",
    "test-debug": "npm run test -- --timeout=20m",
    "transpile": "tsc --build --verbose"
  },
@@ -25,7 +26,7 @@
  "dependencies": {
    "@actions/artifact": "^2.3.1",
    "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-    "@actions/cache": "^4.0.5",
+    "@actions/cache": "^4.1.0",
    "@actions/core": "^1.11.1",
    "@actions/exec": "^1.1.1",
    "@actions/github": "^6.0.0",
@@ -52,11 +53,11 @@
  },
  "devDependencies": {
    "@ava/typescript": "6.0.0",
-    "@eslint/compat": "^1.3.2",
+    "@eslint/compat": "^1.4.0",
    "@eslint/eslintrc": "^3.3.1",
-    "@eslint/js": "^9.35.0",
+    "@eslint/js": "^9.36.0",
    "@microsoft/eslint-formatter-sarif": "^3.1.0",
-    "@octokit/types": "^14.1.0",
+    "@octokit/types": "^15.0.0",
    "@types/archiver": "^6.0.3",
    "@types/console-log-level": "^1.4.5",
    "@types/follow-redirects": "^1.14.4",
@@ -65,10 +66,10 @@
    "@types/node-forge": "^1.3.14",
    "@types/semver": "^7.7.1",
    "@types/sinon": "^17.0.4",
-    "@typescript-eslint/eslint-plugin": "^8.43.0",
+    "@typescript-eslint/eslint-plugin": "^8.44.1",
    "@typescript-eslint/parser": "^8.41.0",
    "ava": "^6.4.1",
-    "esbuild": "^0.25.9",
+    "esbuild": "^0.25.10",
    "eslint": "^8.57.1",
    "eslint-import-resolver-typescript": "^3.8.7",
    "eslint-plugin-filenames": "^1.3.2",
--- a/Show More
+++ b/Show More