)]}'
{
  "commit": "470d6931c170dafe9feb5a808f58df1f94779355",
  "tree": "e3d8713ab0c0b47d7c193011526284b5185b4870",
  "parents": [
    "b0adb9bb1f24dfe5ad7d82a3b9890400cca2dd3f"
  ],
  "author": {
    "name": "dependabot[bot]",
    "email": "49699333+dependabot[bot]@users.noreply.github.com",
    "time": "Fri Jul 17 12:12:36 2026 -0400"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Fri Jul 17 12:12:36 2026 -0400"
  },
  "message": "build(deps): bump the github-actions group with 2 updates (#6801)\n\nBumps the github-actions group with 2 updates:\n[lukka/get-cmake](https://github.com/lukka/get-cmake) and\n[github/codeql-action/upload-sarif](https://github.com/github/codeql-action).\n\nUpdates `lukka/get-cmake` from 4.3.4 to 4.4.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/releases\"\u003elukka/get-cmake\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eCMake v4.4.0\u003c/h2\u003e\n\u003cp\u003eThe \u003ccode\u003eget-cmake\u003c/code\u003e action downloads and caches CMake and\nNinja on your workflows. Versions can be specified using \u003ca\nhref\u003d\"https://docs.npmjs.com/about-semantic-versioning\"\u003esemantic\nversioning ranges\u003c/a\u003e using \u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/blob/latest/action.yml#L13\"\u003e\u003ccode\u003ecmakeVersion\u003c/code\u003e\u003c/a\u003e\nand \u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/blob/latest/action.yml#L16\"\u003e\u003ccode\u003eninjaVersion\u003c/code\u003e\u003c/a\u003e\ninputs.\u003c/p\u003e\n\u003cp\u003eChanges:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003elatest\u003c/code\u003e is now using CMake version \u003ccode\u003ev4.4.0\u003c/code\u003e,\nuse this one-liner e.g.:\n\u003ccode\u003euses: lukka/get-cmake@latest\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eEnjoy!\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/commit/e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3\"\u003e\u003ccode\u003ee690607\u003c/code\u003e\u003c/a\u003e\nNew CMake version(s): cmake-v4.4.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/commit/80ed063af494e28dd56b85fb7a630f2f8f55ceed\"\u003e\u003ccode\u003e80ed063\u003c/code\u003e\u003c/a\u003e\nNew CMake version(s): cmake-rc-v4.4.0-rc3\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/compare/f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9...e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for\ncustomers using CodeQL version 2.20.6 and earlier. These versions of\nCodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise\nServer 3.16, and will be unsupported by the next minor release of the\nCodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases\npage\u003c/a\u003e for the relevant changes to the CodeQL CLI and language\npacks.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for\ncustomers using CodeQL version 2.20.6 and earlier. These versions of\nCodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise\nServer 3.16, and will be unsupported by the next minor release of the\nCodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.0 - 08 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIn addition to the existing input format, the\n\u003ccode\u003econfig-file\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e\nstep will soon support a new \u003ccode\u003e[owner/]repo[@ref][:path]\u003c/code\u003e\nformat. All components except the repository name are optional. If\nomitted, \u003ccode\u003eowner\u003c/code\u003e defaults to the same owner as the repository\nthe analysis is running for, \u003ccode\u003eref\u003c/code\u003e to \u003ccode\u003emain\u003c/code\u003e, and\n\u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003e.github/codeql-action.yaml\u003c/code\u003e. Support\nfor this format ships in this version of the CodeQL Action, but will\nonly be enabled over the coming weeks. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3973\"\u003e#3973\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.36.3 - 01 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.2 - 04 Jun 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCache CodeQL CLI version information across Actions steps. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3943\"\u003e#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReduce requests while waiting for analysis processing by using\nexponential backoff when polling SARIF processing status. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3937\"\u003e#3937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6\"\u003e2.25.6\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3948\"\u003e#3948\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.36.1 - 02 Jun 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.0 - 22 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle\nversion to 2.19.4. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.5 - 15 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action\nare generated to avoid duplication across bundles and reduce the size of\nthe repository by around 70%. This should have no effect on the runtime\nbehaviour of the CodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e will now only be enabled on a pull request when\ndiff-informed analysis is also enabled for that run. If diff-informed\nanalysis is unavailable (for example, because the PR diff ranges could\nnot be computed), the action will fall back to a full analysis. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal\n\u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will\nbe enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for\nGitHub-internal use only, and may change without notice at any time. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning\nanalysis for a PR with \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have\na cached overlay-base database for the configured languages. This speeds\nup analysis for a repository when there is not yet a cached overlay-base\ndatabase for the latest CLI version. We expect to roll this change out\nto everyone in May. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.4 - 07 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.3 - 01 May 2026\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/7188fc363630916deb702c7fdcf4e481b751f97a\"\u003e\u003ccode\u003e7188fc3\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/4020\"\u003e#4020\u003c/a\u003e\nfrom github/update-v4.37.1-9e7c07009\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/c8b5f69be686908c3dfd844428137d56fe80c936\"\u003e\u003ccode\u003ec8b5f69\u003c/code\u003e\u003c/a\u003e\nUpdate changelog for v4.37.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/9e7c070092090e89e8b3d62f977d4456e0732cd7\"\u003e\u003ccode\u003e9e7c070\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/4014\"\u003e#4014\u003c/a\u003e\nfrom github/mbg/explicit-remote-prefix\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/3492b7e9ab96e28b1d8b971345d30e929c6f8fee\"\u003e\u003ccode\u003e3492b7e\u003c/code\u003e\u003c/a\u003e\nChange \u003ccode\u003eREMOTE_PATH_PREFIX\u003c/code\u003e to \u003ccode\u003eremote\u003d\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/3654baa924bc6456db54002581cb7c1c877548c4\"\u003e\u003ccode\u003e3654baa\u003c/code\u003e\u003c/a\u003e\nMerge remote-tracking branch \u0027origin/main\u0027 into\nmbg/explicit-remote-prefix\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/2d682ac05f1b3588aaff3814826bede39b9ba6bb\"\u003e\u003ccode\u003e2d682ac\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/4017\"\u003e#4017\u003c/a\u003e\nfrom github/dependabot/github_actions/dot-github/wor...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/23f6a50753a88efd9b7ae8687b29f6bdb65f6250\"\u003e\u003ccode\u003e23f6a50\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/4009\"\u003e#4009\u003c/a\u003e\nfrom github/mbg/action-state/additions\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/1ee3c75d1988ab8621f01ebb165115c38d56df91\"\u003e\u003ccode\u003e1ee3c75\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/4018\"\u003e#4018\u003c/a\u003e\nfrom github/dependabot/github_actions/dot-github/wor...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/e053684dc500899b0b5520edc8549ac0f1ed730b\"\u003e\u003ccode\u003ee053684\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/4015\"\u003e#4015\u003c/a\u003e\nfrom github/dependabot/npm_and_yarn/npm-minor-fd2e83...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/6803c5671d2f87a83ed96e151c441b1cb3bdc66a\"\u003e\u003ccode\u003e6803c56\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/4019\"\u003e#4019\u003c/a\u003e\nfrom github/update-bundle/codeql-bundle-v2.26.1\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s major version (unless you unignore this specific\ndependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s minor version (unless you unignore this specific\ndependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR\nand stop Dependabot creating any more for the specific dependency\n(unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore\nconditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will\nremove the ignore condition of the specified dependency and ignore\nconditions\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "90d5c57f608adddda84c8a796187e9624b35ab2e",
      "old_mode": 33188,
      "old_path": ".github/workflows/ios.yml",
      "new_id": "4a8e89a274591cfaefa0f7d65dd09082e710e3fa",
      "new_mode": 33188,
      "new_path": ".github/workflows/ios.yml"
    },
    {
      "type": "modify",
      "old_id": "7269256348563eb863bbbbdf020e1de5885a2177",
      "old_mode": 33188,
      "old_path": ".github/workflows/scorecard.yml",
      "new_id": "833fd9ad4cb06904fd9d42068771c1b421e770fb",
      "new_mode": 33188,
      "new_path": ".github/workflows/scorecard.yml"
    }
  ]
}