Bumps the github-actions group with 2 updates in the / directory:
[github/codeql-action](https://github.com/github/codeql-action) and
[ossf/scorecard-action](https://github.com/ossf/scorecard-action).
Updates `github/codeql-action` from 3.30.5 to 3.30.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v3.30.6</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>3.30.6 - 02 Oct 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.2. <a
href="https://redirect.github.com/github/codeql-action/pull/3168">#3168</a></li>
</ul>
<p>See the full <a
href="https://github.com/github/codeql-action/blob/v3.30.6/CHANGELOG.md">CHANGELOG.md</a>
for more information.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<ul>
<li>[v4+ only] The CodeQL Action now runs on Node.js v24. <a
href="https://redirect.github.com/github/codeql-action/pull/3169">#3169</a></li>
</ul>
<h2>3.30.6 - 02 Oct 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.2. <a
href="https://redirect.github.com/github/codeql-action/pull/3168">#3168</a></li>
</ul>
<h2>3.30.5 - 26 Sep 2025</h2>
<ul>
<li>We fixed a bug that was introduced in <code>3.30.4</code> with
<code>upload-sarif</code> which resulted in files without a
<code>.sarif</code> extension not getting uploaded. <a
href="https://redirect.github.com/github/codeql-action/pull/3160">#3160</a></li>
</ul>
<h2>3.30.4 - 25 Sep 2025</h2>
<ul>
<li>We have improved the CodeQL Action's ability to validate that the
workflow it is used in does not use different versions of the CodeQL
Action for different workflow steps. Mixing different versions of the
CodeQL Action in the same workflow is unsupported and can lead to
unpredictable results. A warning will now be emitted from the
<code>codeql-action/init</code> step if different versions of the CodeQL
Action are detected in the workflow file. Additionally, an error will
now be thrown by the other CodeQL Action steps if they load a
configuration file that was generated by a different version of the
<code>codeql-action/init</code> step. <a
href="https://redirect.github.com/github/codeql-action/pull/3099">#3099</a>
and <a
href="https://redirect.github.com/github/codeql-action/pull/3100">#3100</a></li>
<li>We added support for reducing the size of dependency caches for Java
analyses, which will reduce cache usage and speed up workflows. This
will be enabled automatically at a later time. <a
href="https://redirect.github.com/github/codeql-action/pull/3107">#3107</a></li>
<li>You can now run the latest CodeQL nightly bundle by passing
<code>tools: nightly</code> to the <code>init</code> action. In general,
the nightly bundle is unstable and we only recommend running it when
directed by GitHub staff. <a
href="https://redirect.github.com/github/codeql-action/pull/3130">#3130</a></li>
<li>Update default CodeQL bundle version to 2.23.1. <a
href="https://redirect.github.com/github/codeql-action/pull/3118">#3118</a></li>
</ul>
<h2>3.30.3 - 10 Sep 2025</h2>
<p>No user facing changes.</p>
<h2>3.30.2 - 09 Sep 2025</h2>
<ul>
<li>Fixed a bug which could cause language autodetection to fail. <a
href="https://redirect.github.com/github/codeql-action/pull/3084">#3084</a></li>
<li>Experimental: The <code>quality-queries</code> input that was added
in <code>3.29.2</code> as part of an internal experiment is now
deprecated and will be removed in an upcoming version of the CodeQL
Action. It has been superseded by a new <code>analysis-kinds</code>
input, which is part of the same internal experiment. Do not use this in
production as it is subject to change at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3064">#3064</a></li>
</ul>
<h2>3.30.1 - 05 Sep 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3077">#3077</a></li>
</ul>
<h2>3.30.0 - 01 Sep 2025</h2>
<ul>
<li>Reduce the size of the CodeQL Action, speeding up workflows by
approximately 4 seconds. <a
href="https://redirect.github.com/github/codeql-action/pull/3054">#3054</a></li>
</ul>
<h2>3.29.11 - 21 Aug 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.22.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3044">#3044</a></li>
</ul>
<h2>3.29.10 - 18 Aug 2025</h2>
<p>No user facing changes.</p>
<h2>3.29.9 - 12 Aug 2025</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="64d10c1313"><code>64d10c1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3172">#3172</a>
from github/update-v3.30.6-10feb5d2a</li>
<li><a
href="909610e8a8"><code>909610e</code></a>
Update changelog for v3.30.6</li>
<li><a
href="10feb5d2a2"><code>10feb5d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3167">#3167</a>
from github/mbg/upload-sarif/find-then-filter</li>
<li><a
href="4182ea3d4e"><code>4182ea3</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3168">#3168</a>
from github/update-bundle/codeql-bundle-v2.23.2</li>
<li><a
href="34afe5b7b1"><code>34afe5b</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3171">#3171</a>
from github/mbg/start-proxy/telemetry</li>
<li><a
href="096fe67f97"><code>096fe67</code></a>
Merge branch 'main' into update-bundle/codeql-bundle-v2.23.2</li>
<li><a
href="b4964014ad"><code>b496401</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3170">#3170</a>
from github/mbg/start-proxy/remove-update-workflow</li>
<li><a
href="d573787cca"><code>d573787</code></a>
Report registry types that are configured for CodeQL in
<code>start-proxy</code> telemetry</li>
<li><a
href="15916800df"><code>1591680</code></a>
Send a basic status report in <code>start-proxy</code> Action if it
succeeds</li>
<li><a
href="cb5a2849ac"><code>cb5a284</code></a>
Send status report when <code>start-proxy</code> fails</li>
<li>Additional commits viewable in <a
href="3599b3baa1...64d10c1313">compare
view</a></li>
</ul>
</details>
<br />
Updates `ossf/scorecard-action` from 2.4.2 to 2.4.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ossf/scorecard-action/releases">ossf/scorecard-action's
releases</a>.</em></p>
<blockquote>
<h2>v2.4.3</h2>
<h2>What's Changed</h2>
<p>This update bumps the Scorecard version to the v5.3.0 release. For a
complete list of changes, please refer to the <a
href="https://github.com/ossf/scorecard/releases/tag/v5.3.0">Scorecard
v5.3.0 release notes</a>.</p>
<h2>Documentation</h2>
<ul>
<li>docs: clarify <code>GITHUB_TOKEN</code> permissions needed for
private repos by <a
href="https://github.com/pankajtaneja5"><code>@pankajtaneja5</code></a>
in <a
href="https://redirect.github.com/ossf/scorecard-action/pull/1574">ossf/scorecard-action#1574</a></li>
<li>📖 Fix recommended command to test the image in development by
<a
href="https://github.com/deivid-rodriguez"><code>@deivid-rodriguez</code></a>
in <a
href="https://redirect.github.com/ossf/scorecard-action/pull/1583">ossf/scorecard-action#1583</a></li>
</ul>
<h2>Other</h2>
<ul>
<li>add missing top-level token permissions to workflows by <a
href="https://github.com/timothyklee"><code>@timothyklee</code></a> in
<a
href="https://redirect.github.com/ossf/scorecard-action/pull/1566">ossf/scorecard-action#1566</a></li>
<li>setup codeowners for requesting reviews by <a
href="https://github.com/spencerschrock"><code>@spencerschrock</code></a>
in <a
href="https://redirect.github.com/ossf/scorecard-action/pull/1576">ossf/scorecard-action#1576</a></li>
<li>🌱 Improve printing options by <a
href="https://github.com/deivid-rodriguez"><code>@deivid-rodriguez</code></a>
in <a
href="https://redirect.github.com/ossf/scorecard-action/pull/1584">ossf/scorecard-action#1584</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/timothyklee"><code>@timothyklee</code></a>
made their first contribution in <a
href="https://redirect.github.com/ossf/scorecard-action/pull/1566">ossf/scorecard-action#1566</a></li>
<li><a
href="https://github.com/pankajtaneja5"><code>@pankajtaneja5</code></a>
made their first contribution in <a
href="https://redirect.github.com/ossf/scorecard-action/pull/1574">ossf/scorecard-action#1574</a></li>
<li><a
href="https://github.com/deivid-rodriguez"><code>@deivid-rodriguez</code></a>
made their first contribution in <a
href="https://redirect.github.com/ossf/scorecard-action/pull/1584">ossf/scorecard-action#1584</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/ossf/scorecard-action/compare/v2.4.2...v2.4.3">https://github.com/ossf/scorecard-action/compare/v2.4.2...v2.4.3</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4eaacf0543"><code>4eaacf0</code></a>
bump docker to ghcr v2.4.3 (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1587">#1587</a>)</li>
<li><a
href="42e3a017b9"><code>42e3a01</code></a>
🌱 Bump the github-actions group with 3 updates (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1585">#1585</a>)</li>
<li><a
href="88c07acb7b"><code>88c07ac</code></a>
🌱 Bump github.com/sigstore/cosign/v2 from 2.5.2 to 2.6.0 (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1579">#1579</a>)</li>
<li><a
href="6c690f2f38"><code>6c690f2</code></a>
Bump github.com/ossf/scorecard/v5 from v5.2.1 to v5.3.0 (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1586">#1586</a>)</li>
<li><a
href="92083b5269"><code>92083b5</code></a>
📖 Fix recommended command to test the image in development (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1583">#1583</a>)</li>
<li><a
href="7975ea6064"><code>7975ea6</code></a>
🌱 Bump the docker-images group across 1 directory with 2
updates (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1">#1</a>...</li>
<li><a
href="0d1a74394f"><code>0d1a743</code></a>
🌱 Bump github.com/spf13/cobra from 1.9.1 to 1.10.1 (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1575">#1575</a>)</li>
<li><a
href="46e6e0c0ac"><code>46e6e0c</code></a>
🌱 Bump the github-actions group with 2 updates (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1580">#1580</a>)</li>
<li><a
href="c3f1350159"><code>c3f1350</code></a>
🌱 Improve printing options (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1584">#1584</a>)</li>
<li><a
href="43e475b79a"><code>43e475b</code></a>
🌱 Bump golang.org/x/net from 0.42.0 to 0.44.0 (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1578">#1578</a>)</li>
<li>Additional commits viewable in <a
href="05b42c6244...4eaacf0543">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Automatically generated pull request to update the known wrapper
checksums.
In case of conflicts, manually run the workflow from the [Actions
tab](https://github.com/gradle/actions/actions/workflows/update-checksums-file.yml),
the changes will then be force-pushed onto this pull request branch.
Do not manually update the pull request branch; those changes might get
overwritten.
> [!IMPORTANT]
> GitHub workflows have not been executed for this pull request yet.
Before merging, close and then directly reopen this pull request to
trigger the workflows.
Bumps the github-actions group with 2 updates in the / directory:
[gradle/actions](https://github.com/gradle/actions) and
[github/codeql-action](https://github.com/github/codeql-action).
Updates `gradle/actions` from 4.4.3 to 4.4.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gradle/actions/releases">gradle/actions's
releases</a>.</em></p>
<blockquote>
<h2>v4.4.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump the github-actions group across 2 directories with 3 updates by
<a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/726">gradle/actions#726</a></li>
<li>Regenerating package lock by <a
href="https://github.com/cdsap"><code>@cdsap</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/729">gradle/actions#729</a></li>
<li>Update known wrapper checksums by <a
href="https://github.com/github-actions"><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/730">gradle/actions#730</a></li>
<li>Bump the github-actions group across 1 directory with 3 updates by
<a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/735">gradle/actions#735</a></li>
<li>Bump the gradle group across 3 directories with 1 update by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/734">gradle/actions#734</a></li>
<li>Bump the npm-dependencies group in /sources with 4 updates by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/733">gradle/actions#733</a></li>
<li>Bump references to Develocity Gradle plugin from 4.1.1 to 4.2 by <a
href="https://github.com/bot-githubaction"><code>@bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/736">gradle/actions#736</a></li>
<li>Handle gracefully parse errors in checksum file by <a
href="https://github.com/jprinet"><code>@jprinet</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/737">gradle/actions#737</a></li>
<li>Bump Gradle Wrapper from 9.0.0 to 9.1.0 in
/.github/workflow-samples/kotlin-dsl by <a
href="https://github.com/bot-githubaction"><code>@bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/742">gradle/actions#742</a></li>
<li>Bump Gradle Wrapper from 9.0.0 to 9.1.0 in
/.github/workflow-samples/java-toolchain by <a
href="https://github.com/bot-githubaction"><code>@bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/741">gradle/actions#741</a></li>
<li>Bump Gradle Wrapper from 9.0.0 to 9.1.0 in
/.github/workflow-samples/groovy-dsl by <a
href="https://github.com/bot-githubaction"><code>@bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/740">gradle/actions#740</a></li>
<li>Bump Gradle Wrapper from 9.0.0 to 9.1.0 in
/.github/workflow-samples/gradle-plugin by <a
href="https://github.com/bot-githubaction"><code>@bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/739">gradle/actions#739</a></li>
<li>Bump Gradle Wrapper from 9.0.0 to 9.1.0 in
/sources/test/init-scripts by <a
href="https://github.com/bot-githubaction"><code>@bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/738">gradle/actions#738</a></li>
<li>Update known wrapper checksums by <a
href="https://github.com/github-actions"><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/743">gradle/actions#743</a></li>
<li>Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre in
/.github/workflow-samples/kotlin-dsl in the gradle group across 1
directory by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/746">gradle/actions#746</a></li>
<li>Bump the npm-dependencies group in /sources with 5 updates by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/745">gradle/actions#745</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/gradle/actions/compare/v4...v4.4.4">https://github.com/gradle/actions/compare/v4...v4.4.4</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="748248ddd2"><code>748248d</code></a>
Bump the npm-dependencies group in /sources with 5 updates (<a
href="https://redirect.github.com/gradle/actions/issues/745">#745</a>)</li>
<li><a
href="81b68c9429"><code>81b68c9</code></a>
Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre in
/.github/workflo...</li>
<li><a
href="13617309e3"><code>1361730</code></a>
Bump com.google.guava:guava</li>
<li><a
href="a86ac1167d"><code>a86ac11</code></a>
Bump the npm-dependencies group in /sources with 5 updates</li>
<li><a
href="182e4d39a6"><code>182e4d3</code></a>
[bot] Update dist directory</li>
<li><a
href="a48a0fa47f"><code>a48a0fa</code></a>
Update known wrapper checksums (<a
href="https://redirect.github.com/gradle/actions/issues/743">#743</a>)</li>
<li><a
href="6d7d019840"><code>6d7d019</code></a>
Update known wrapper checksums</li>
<li><a
href="0e052761e2"><code>0e05276</code></a>
Bump Gradle Wrapper from 9.0.0 to 9.1.0 in /sources/test/init-scripts
(<a
href="https://redirect.github.com/gradle/actions/issues/738">#738</a>)</li>
<li><a
href="2e40f51ba3"><code>2e40f51</code></a>
Bump Gradle Wrapper from 9.0.0 to 9.1.0 in
/.github/workflow-samples/gradle-p...</li>
<li><a
href="ed3ef92603"><code>ed3ef92</code></a>
Bump Gradle Wrapper from 9.0.0 to 9.1.0 in
/.github/workflow-samples/groovy-d...</li>
<li>Additional commits viewable in <a
href="ed408507ea...748248ddd2">compare
view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 3.30.3 to 3.30.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v3.30.5</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>3.30.5 - 26 Sep 2025</h2>
<ul>
<li>We fixed a bug that was introduced in <code>3.30.4</code> with
<code>upload-sarif</code> which resulted in files without a
<code>.sarif</code> extension not getting uploaded. <a
href="https://redirect.github.com/github/codeql-action/pull/3160">#3160</a></li>
</ul>
<p>See the full <a
href="https://github.com/github/codeql-action/blob/v3.30.5/CHANGELOG.md">CHANGELOG.md</a>
for more information.</p>
<h2>v3.30.4</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>3.30.4 - 25 Sep 2025</h2>
<ul>
<li>We have improved the CodeQL Action's ability to validate that the
workflow it is used in does not use different versions of the CodeQL
Action for different workflow steps. Mixing different versions of the
CodeQL Action in the same workflow is unsupported and can lead to
unpredictable results. A warning will now be emitted from the
<code>codeql-action/init</code> step if different versions of the CodeQL
Action are detected in the workflow file. Additionally, an error will
now be thrown by the other CodeQL Action steps if they load a
configuration file that was generated by a different version of the
<code>codeql-action/init</code> step. <a
href="https://redirect.github.com/github/codeql-action/pull/3099">#3099</a>
and <a
href="https://redirect.github.com/github/codeql-action/pull/3100">#3100</a></li>
<li>We added support for reducing the size of dependency caches for Java
analyses, which will reduce cache usage and speed up workflows. This
will be enabled automatically at a later time. <a
href="https://redirect.github.com/github/codeql-action/pull/3107">#3107</a></li>
<li>You can now run the latest CodeQL nightly bundle by passing
<code>tools: nightly</code> to the <code>init</code> action. In general,
the nightly bundle is unstable and we only recommend running it when
directed by GitHub staff. <a
href="https://redirect.github.com/github/codeql-action/pull/3130">#3130</a></li>
<li>Update default CodeQL bundle version to 2.23.1. <a
href="https://redirect.github.com/github/codeql-action/pull/3118">#3118</a></li>
</ul>
<p>See the full <a
href="https://github.com/github/codeql-action/blob/v3.30.4/CHANGELOG.md">CHANGELOG.md</a>
for more information.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>3.30.5 - 26 Sep 2025</h2>
<ul>
<li>We fixed a bug that was introduced in <code>3.30.4</code> with
<code>upload-sarif</code> which resulted in files without a
<code>.sarif</code> extension not getting uploaded. <a
href="https://redirect.github.com/github/codeql-action/pull/3160">#3160</a></li>
</ul>
<h2>3.30.4 - 25 Sep 2025</h2>
<ul>
<li>We have improved the CodeQL Action's ability to validate that the
workflow it is used in does not use different versions of the CodeQL
Action for different workflow steps. Mixing different versions of the
CodeQL Action in the same workflow is unsupported and can lead to
unpredictable results. A warning will now be emitted from the
<code>codeql-action/init</code> step if different versions of the CodeQL
Action are detected in the workflow file. Additionally, an error will
now be thrown by the other CodeQL Action steps if they load a
configuration file that was generated by a different version of the
<code>codeql-action/init</code> step. <a
href="https://redirect.github.com/github/codeql-action/pull/3099">#3099</a>
and <a
href="https://redirect.github.com/github/codeql-action/pull/3100">#3100</a></li>
<li>We added support for reducing the size of dependency caches for Java
analyses, which will reduce cache usage and speed up workflows. This
will be enabled automatically at a later time. <a
href="https://redirect.github.com/github/codeql-action/pull/3107">#3107</a></li>
<li>You can now run the latest CodeQL nightly bundle by passing
<code>tools: nightly</code> to the <code>init</code> action. In general,
the nightly bundle is unstable and we only recommend running it when
directed by GitHub staff. <a
href="https://redirect.github.com/github/codeql-action/pull/3130">#3130</a></li>
<li>Update default CodeQL bundle version to 2.23.1. <a
href="https://redirect.github.com/github/codeql-action/pull/3118">#3118</a></li>
</ul>
<h2>3.30.3 - 10 Sep 2025</h2>
<p>No user facing changes.</p>
<h2>3.30.2 - 09 Sep 2025</h2>
<ul>
<li>Fixed a bug which could cause language autodetection to fail. <a
href="https://redirect.github.com/github/codeql-action/pull/3084">#3084</a></li>
<li>Experimental: The <code>quality-queries</code> input that was added
in <code>3.29.2</code> as part of an internal experiment is now
deprecated and will be removed in an upcoming version of the CodeQL
Action. It has been superseded by a new <code>analysis-kinds</code>
input, which is part of the same internal experiment. Do not use this in
production as it is subject to change at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3064">#3064</a></li>
</ul>
<h2>3.30.1 - 05 Sep 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3077">#3077</a></li>
</ul>
<h2>3.30.0 - 01 Sep 2025</h2>
<ul>
<li>Reduce the size of the CodeQL Action, speeding up workflows by
approximately 4 seconds. <a
href="https://redirect.github.com/github/codeql-action/pull/3054">#3054</a></li>
</ul>
<h2>3.29.11 - 21 Aug 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.22.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3044">#3044</a></li>
</ul>
<h2>3.29.10 - 18 Aug 2025</h2>
<p>No user facing changes.</p>
<h2>3.29.9 - 12 Aug 2025</h2>
<p>No user facing changes.</p>
<h2>3.29.8 - 08 Aug 2025</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="3599b3baa1"><code>3599b3b</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3161">#3161</a>
from github/update-v3.30.5-0a67bd46a</li>
<li><a
href="2ca0085e58"><code>2ca0085</code></a>
Update changelog for v3.30.5</li>
<li><a
href="0a67bd46a0"><code>0a67bd4</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3160">#3160</a>
from github/mbg/fix/upload-sarif</li>
<li><a
href="8e34f2f3bf"><code>8e34f2f</code></a>
Add changelog</li>
<li><a
href="0b7fc56648"><code>0b7fc56</code></a>
Fix <code>upload-sarif</code> not uploading non-<code>.sarif</code>
files</li>
<li><a
href="94a9b7a110"><code>94a9b7a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3155">#3155</a>
from github/mbg/node/no-install-in-actions</li>
<li><a
href="a0ae9ba202"><code>a0ae9ba</code></a>
Log what the script is doing</li>
<li><a
href="b27a8ef21f"><code>b27a8ef</code></a>
Exit if running in an Actions workflow</li>
<li><a
href="65925679a3"><code>6592567</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3139">#3139</a>
from github/henrymercer/fix-log-message</li>
<li><a
href="fa64a7dee6"><code>fa64a7d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3154">#3154</a>
from github/mbg/node/check-up-to-date-deps</li>
<li>Additional commits viewable in <a
href="192325c861...3599b3baa1">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Bumps the npm-dependencies group in /sources with 5 updates:
| Package | From | To |
| --- | --- | --- |
| @gradle-tech/develocity-agent | `1.0.2` | `2.0.2` |
|
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
| `24.5.0` | `24.5.2` |
|
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin)
| `8.44.0` | `8.44.1` |
| [@vercel/ncc](https://github.com/vercel/ncc) | `0.38.3` | `0.38.4` |
| [ts-jest](https://github.com/kulshekhar/ts-jest) | `29.4.2` | `29.4.4`
|
Updates `@gradle-tech/develocity-agent` from 1.0.2 to 2.0.2
Updates `@types/node` from 24.5.0 to 24.5.2
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/eslint-plugin` from 8.44.0 to 8.44.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases"><code>@typescript-eslint/eslint-plugin</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v8.44.1</h2>
<h2>8.44.1 (2025-09-22)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-base-to-string] make
ignoredTypeNames match type names without generics (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11597">#11597</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unsafe-enum-comparison] support
unions of literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11599">#11599</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] should not report
passing values to promise aggregators which may be a promise in an array
literal (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11611">#11611</a>)</li>
<li><strong>typescript-estree:</strong> forbid class property with name
<code>constructor</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11590">#11590</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>fisker Cheung <a
href="https://github.com/fisker"><code>@fisker</code></a></li>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger"><code>@kirkwaiblinger</code></a></li>
<li>mdm317</li>
<li>Ronen Amiel</li>
</ul>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md"><code>@typescript-eslint/eslint-plugin</code>'s
changelog</a>.</em></p>
<blockquote>
<h2>8.44.1 (2025-09-22)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [await-thenable] should not report
passing values to promise aggregators which may be a promise in an array
literal (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11611">#11611</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unsafe-enum-comparison] support
unions of literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11599">#11599</a>)</li>
<li><strong>eslint-plugin:</strong> [no-base-to-string] make
ignoredTypeNames match type names without generics (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11597">#11597</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger"><code>@kirkwaiblinger</code></a></li>
<li>mdm317</li>
<li>Ronen Amiel</li>
</ul>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="c1980522cd"><code>c198052</code></a>
chore(release): publish 8.44.1</li>
<li><a
href="c392a0de2d"><code>c392a0d</code></a>
fix(eslint-plugin): [await-thenable] should not report passing values to
prom...</li>
<li><a
href="20c3d97235"><code>20c3d97</code></a>
fix(eslint-plugin): [no-unsafe-enum-comparison] support unions of
literals (#...</li>
<li><a
href="4fde781fdf"><code>4fde781</code></a>
fix(eslint-plugin): [no-base-to-string] make ignoredTypeNames match type
name...</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.44.1/packages/eslint-plugin">compare
view</a></li>
</ul>
</details>
<br />
Updates `@vercel/ncc` from 0.38.3 to 0.38.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/ncc/releases"><code>@vercel/ncc</code>'s
releases</a>.</em></p>
<blockquote>
<h2>0.38.4</h2>
<h2><a
href="https://github.com/vercel/ncc/compare/0.38.3...0.38.4">0.38.4</a>
(2025-09-18)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>cjs-build:</strong> enable evaluating import.meta in cjs
build (<a
href="https://redirect.github.com/vercel/ncc/issues/1236">#1236</a>) (<a
href="e72d34d97e">e72d34d</a>),
closes <a
href="https://redirect.github.com//redirect.github.com/vercel/ncc/pull/897/issues/discussion_r836916315">vercel/ncc#897</a>
<a
href="https://redirect.github.com/vercel/ncc/issues/1019">#1019</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e72d34d97e"><code>e72d34d</code></a>
fix(cjs-build): enable evaluating import.meta in cjs build (<a
href="https://redirect.github.com/vercel/ncc/issues/1236">#1236</a>)</li>
<li><a
href="186af2b5f3"><code>186af2b</code></a>
chore(deps): Bump amannn/action-semantic-pull-request from 5.5.3 to
6.1.1 (<a
href="https://redirect.github.com/vercel/ncc/issues/1">#1</a>...</li>
<li><a
href="162c7d4f49"><code>162c7d4</code></a>
chore(deps): Bump actions/checkout from 4 to 5 (<a
href="https://redirect.github.com/vercel/ncc/issues/1283">#1283</a>)</li>
<li><a
href="24734b5502"><code>24734b5</code></a>
chore(deps): Bump cipher-base from 1.0.4 to 1.0.6 (<a
href="https://redirect.github.com/vercel/ncc/issues/1280">#1280</a>)</li>
<li><a
href="7bf44d5bf9"><code>7bf44d5</code></a>
chore(deps): Bump sha.js from 2.4.11 to 2.4.12 (<a
href="https://redirect.github.com/vercel/ncc/issues/1281">#1281</a>)</li>
<li><a
href="50f185180f"><code>50f1851</code></a>
chore(deps): Bump tmp from 0.2.3 to 0.2.4 (<a
href="https://redirect.github.com/vercel/ncc/issues/1278">#1278</a>)</li>
<li><a
href="d797f1b1ee"><code>d797f1b</code></a>
chore(deps-dev): Bump koa from 2.16.1 to 3.0.1 (<a
href="https://redirect.github.com/vercel/ncc/issues/1272">#1272</a>)</li>
<li><a
href="9bdbd474fd"><code>9bdbd47</code></a>
chore(deps): Bump pbkdf2 from 3.1.2 to 3.1.3 (<a
href="https://redirect.github.com/vercel/ncc/issues/1266">#1266</a>)</li>
<li><a
href="cbfd660dca"><code>cbfd660</code></a>
chore(deps-dev): bump test deps for aws-sdk (<a
href="https://redirect.github.com/vercel/ncc/issues/1263">#1263</a>)</li>
<li><a
href="d17397fbdf"><code>d17397f</code></a>
chore(deps-dev): Bump axios from 1.7.7 to 1.8.2 (<a
href="https://redirect.github.com/vercel/ncc/issues/1262">#1262</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/ncc/compare/0.38.3...0.38.4">compare
view</a></li>
</ul>
</details>
<br />
Updates `ts-jest` from 29.4.2 to 29.4.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/kulshekhar/ts-jest/releases">ts-jest's
releases</a>.</em></p>
<blockquote>
<h2>v29.4.4</h2>
<p>Please refer to <a
href="https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v29.4.3</h2>
<p>Please refer to <a
href="https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md">ts-jest's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/kulshekhar/ts-jest/compare/v29.4.3...v29.4.4">29.4.4</a>
(2025-09-19)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>revert <strong>29.4.3</strong> changes (<a
href="25cb706552">25cb706</a>),
closes <a
href="https://redirect.github.com/kulshekhar/ts-jest/issues/5049">#5049</a></li>
</ul>
<h2><a
href="https://github.com/kulshekhar/ts-jest/compare/v29.4.2...v29.4.3">29.4.3</a>
(2025-09-17)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>introduce <code>transpilation</code> option to replace
<code>isolatedModules</code> option (<a
href="https://redirect.github.com/kulshekhar/ts-jest/issues/5044">#5044</a>)
(<a
href="5868761514">5868761</a>),
closes <a
href="https://redirect.github.com/kulshekhar/ts-jest/issues/5013">#5013</a>
<a
href="https://redirect.github.com/kulshekhar/ts-jest/issues/4859">#4859</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="89a4f9f3d7"><code>89a4f9f</code></a>
chore(release): 29.4.4</li>
<li><a
href="25cb706552"><code>25cb706</code></a>
Revert "fix: introduce <code>transpilation</code> option to replace
<code>isolatedModules</code> op...</li>
<li><a
href="8a7e4c2e7e"><code>8a7e4c2</code></a>
build(deps): Update dependency ts-jest to ^29.4.3</li>
<li><a
href="51a5a92d25"><code>51a5a92</code></a>
build(deps): Update dependency <code>@types/node</code> to
v20.19.17</li>
<li><a
href="a44e9ccd8b"><code>a44e9cc</code></a>
chore(release): 29.4.3</li>
<li><a
href="97e2c03575"><code>97e2c03</code></a>
docs: correct link to doc for <code>transpilation</code> option</li>
<li><a
href="94b6ab4043"><code>94b6ab4</code></a>
build(deps): Update dependency esbuild to ~0.25.10</li>
<li><a
href="5868761514"><code>5868761</code></a>
fix: introduce <code>transpilation</code> option to replace
<code>isolatedModules</code> option (<a
href="https://redirect.github.com/kulshekhar/ts-jest/issues/5">#5</a>...</li>
<li><a
href="54dee263c9"><code>54dee26</code></a>
build(deps): Update dependency <code>@types/node</code> to
v20.19.16</li>
<li><a
href="f5ac13be8e"><code>f5ac13b</code></a>
build(deps): Update dependency memfs to ^4.42.0</li>
<li>Additional commits viewable in <a
href="https://github.com/kulshekhar/ts-jest/compare/v29.4.2...v29.4.4">compare
view</a></li>
</ul>
</details>
<br />
<details>
<summary>Most Recent Ignore Conditions Applied to This Pull
Request</summary>
| Dependency Name | Ignore Conditions |
| --- | --- |
| @types/node | [>= 22.a, < 23] |
</details>
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Bumps the gradle group with 1 update in the
/.github/workflow-samples/kotlin-dsl directory:
[com.google.guava:guava](https://github.com/google/guava).
Updates `com.google.guava:guava` from 33.4.8-jre to 33.5.0-jre
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/guava/releases">com.google.guava:guava's
releases</a>.</em></p>
<blockquote>
<h2>33.5.0</h2>
<h3>Maven</h3>
<pre lang="xml"><code><dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>33.5.0-jre</version>
<!-- or, for Android: -->
<version>33.5.0-android</version>
</dependency>
</code></pre>
<h3>Jar files</h3>
<ul>
<li><a
href="https://repo1.maven.org/maven2/com/google/guava/guava/33.5.0-jre/guava-33.5.0-jre.jar">33.5.0-jre.jar</a></li>
<li><a
href="https://repo1.maven.org/maven2/com/google/guava/guava/33.5.0-android/guava-33.5.0-android.jar">33.5.0-android.jar</a></li>
</ul>
<p>Guava requires <a
href="https://github.com/google/guava/wiki/UseGuavaInYourBuild#what-about-guavas-own-dependencies">one
runtime dependency</a>, which you can download here:</p>
<ul>
<li><a
href="https://repo1.maven.org/maven2/com/google/guava/failureaccess/1.0.3/failureaccess-1.0.3.jar">failureaccess-1.0.3.jar</a></li>
</ul>
<h3>Javadoc</h3>
<ul>
<li><a
href="https://guava.dev/releases/33.5.0-jre/api/docs/">33.5.0-jre</a></li>
<li><a
href="https://guava.dev/releases/33.5.0-android/api/docs/">33.5.0-android</a></li>
</ul>
<h3>JDiff</h3>
<ul>
<li><a
href="https://guava.dev/releases/33.5.0-jre/api/diffs/">33.5.0-jre vs.
33.4.8-jre</a></li>
<li><a
href="https://guava.dev/releases/33.5.0-android/api/diffs/">33.5.0-android
vs. 33.4.8-android</a></li>
<li><a
href="https://guava.dev/releases/33.5.0-android/api/androiddiffs/">33.5.0-android
vs. 33.5.0-jre</a></li>
</ul>
<h3>Changelog</h3>
<ul>
<li>Restored the <code>Automatic-Module-Name</code> to
<code>guava-android</code>. (It, unlike, <code>guava-jre</code>, is not
a proper module.) (7a04a8a955)</li>
<li>For users of <code>guava-gwt</code>: Google <a
href="https://redirect.github.com/gwtproject/gwt-site/pull/394">has
moved off GWT internally</a>. We plan to continue to release
<code>guava-gwt</code> for users of GWT and <a
href="https://github.com/google/j2cl">J2CL</a>, but the artifact is no
longer tested for GWT-specific issues, and we have limited resources to
fix any unexpected issues that might arise. While we do not anticipate
any specific problems, we can't guarantee how long support will
continue.</li>
<li>Increased our Android <code>minSdkVersion</code> to 23
(Marshmallow). This follows the minimum of Google's foundational Android
libraries, and we expect it to have no practical impact on users.
(5c23347cc1)</li>
<li>Listed the JSpecify annotations as an optional dependency in our
OSGi metadata. (2dfd572981)</li>
<li><code>cache</code>: Improved the handling of exceptions from compute
functions in <code>Cache.asMap()</code>. (We do still <a
href="https://guava.dev/releases/snapshot-jre/api/docs/com/google/common/cache/CacheBuilder.html#prefer-caffeine-over-guava-s-caching-api-heading">recommend</a>
using <a href="https://github.com/ben-manes/caffeine">Caffeine</a>
rather than <code>com.google.common.cache</code>.) (087f2c4a80)</li>
<li><code>collect</code>: Improved <code>Iterators.mergeSorted()</code>
to preserve stability for equal elements. (4dc93be9a8)</li>
<li><code>math</code>: Added <code>saturatedAbs</code> methods to
<code>IntMath</code> and <code>LongMath</code>. (ed0e518f20)</li>
<li><code>net</code>: Added <code>image/avif</code> to
<code>MediaType</code>. (53344caba6)</li>
<li><code>testing</code>: Made <code>CollectorTester</code> available to
Android users. (294c251079)</li>
<li><code>util.concurrent</code>: Added <code>Striped.custom</code>.
(1586eb271d)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/google/guava/commits">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Automatically generated pull request to update the known wrapper
checksums.
In case of conflicts, manually run the workflow from the [Actions
tab](https://github.com/gradle/actions/actions/workflows/update-checksums-file.yml),
the changes will then be force-pushed onto this pull request branch.
Do not manually update the pull request branch; those changes might get
overwritten.
> [!IMPORTANT]
> GitHub workflows have not been executed for this pull request yet.
Before merging, close and then directly reopen this pull request to
trigger the workflows.
Bumps the npm-dependencies group in /sources with 4 updates:
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node),
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin),
[globals](https://github.com/sindresorhus/globals) and
[ts-jest](https://github.com/kulshekhar/ts-jest).
Updates `@types/node` from 24.3.1 to 24.5.0
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/eslint-plugin` from 8.43.0 to 8.44.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases"><code>@typescript-eslint/eslint-plugin</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v8.44.0</h2>
<h2>8.44.0 (2025-09-15)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [await-thenable] report invalid
(non-promise) values passed to promise aggregator methods (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11267">#11267</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>deps:</strong> update dependency
<code>@eslint-community/eslint-utils</code> to v4.8.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11589">#11589</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-conversion]
ignore enum members (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11490">#11490</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Moses Odutusin <a
href="https://github.com/thebolarin"><code>@thebolarin</code></a></li>
<li>Ronen Amiel</li>
</ul>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md"><code>@typescript-eslint/eslint-plugin</code>'s
changelog</a>.</em></p>
<blockquote>
<h2>8.44.0 (2025-09-15)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [await-thenable] report invalid
(non-promise) values passed to promise aggregator methods (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11267">#11267</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-conversion]
ignore enum members (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11490">#11490</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Moses Odutusin <a
href="https://github.com/thebolarin"><code>@thebolarin</code></a></li>
<li>Ronen Amiel</li>
</ul>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="77056f77e6"><code>77056f7</code></a>
chore(release): publish 8.44.0</li>
<li><a
href="684e63f2c6"><code>684e63f</code></a>
chore(deps): update eslint monorepo to v9.35.0 (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/11600">#11600</a>)</li>
<li><a
href="2ed6857701"><code>2ed6857</code></a>
fix(eslint-plugin): [no-unnecessary-type-conversion] ignore enum members
(<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/11">#11</a>...</li>
<li><a
href="85d8dea3e1"><code>85d8dea</code></a>
feat(eslint-plugin): [await-thenable] report invalid (non-promise)
values pas...</li>
<li><a
href="42527dfe3c"><code>42527df</code></a>
chore: remove unnecessary nullThrows() (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/11580">#11580</a>)</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.44.0/packages/eslint-plugin">compare
view</a></li>
</ul>
</details>
<br />
Updates `globals` from 16.3.0 to 16.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sindresorhus/globals/releases">globals's
releases</a>.</em></p>
<blockquote>
<h2>v16.4.0</h2>
<ul>
<li>Update globals (<a
href="https://redirect.github.com/sindresorhus/globals/issues/309">#309</a>)
8b8a2d6</li>
</ul>
<hr />
<p><a
href="https://github.com/sindresorhus/globals/compare/v16.3.0...v16.4.0">https://github.com/sindresorhus/globals/compare/v16.3.0...v16.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="52ba38b983"><code>52ba38b</code></a>
16.4.0</li>
<li><a
href="8b8a2d6252"><code>8b8a2d6</code></a>
Update globals (<a
href="https://redirect.github.com/sindresorhus/globals/issues/309">#309</a>)</li>
<li>See full diff in <a
href="https://github.com/sindresorhus/globals/compare/v16.3.0...v16.4.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `ts-jest` from 29.4.1 to 29.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/kulshekhar/ts-jest/releases">ts-jest's
releases</a>.</em></p>
<blockquote>
<h2>v29.4.2</h2>
<p>Please refer to <a
href="https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md">ts-jest's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/kulshekhar/ts-jest/compare/v29.4.1...v29.4.2">29.4.2</a>
(2025-09-15)</h2>
<h2>Bug Fixes</h2>
<ul>
<li>fix: node 14 compatibility (<a
href="https://github.com/kulshekhar/ts-jest/commit/aa0d563">aa0d563</a>),
fixes <a
href="https://redirect.github.com/kulshekhar/ts-jest/issues/5038">#5038</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="111a737efb"><code>111a737</code></a>
chore(release): 29.4.2</li>
<li><a
href="c472a99e5a"><code>c472a99</code></a>
build: add <code>conventional-changelog-angular</code> dep for CHANGELOG
generation</li>
<li><a
href="aa0d56331b"><code>aa0d563</code></a>
Fix Node.js v14 compatibility by replacing ??= operator with equivalent
if-nu...</li>
<li><a
href="a70aef71cb"><code>a70aef7</code></a>
build(deps): Update dependency <code>@types/node</code> to
v20.19.14</li>
<li><a
href="02ac30e26d"><code>02ac30e</code></a>
build(deps): Update dependency memfs to ^4.39.0</li>
<li><a
href="2875e61ff1"><code>2875e61</code></a>
build(deps): Update dependency globals to ^16.4.0</li>
<li><a
href="f820c6ffe9"><code>f820c6f</code></a>
build(deps): Update github/codeql-action digest to 192325c</li>
<li><a
href="431d84ec8d"><code>431d84e</code></a>
build(deps): Update ESLint packages to ^8.43.0</li>
<li><a
href="89948feb26"><code>89948fe</code></a>
build(deps): Update dependency vite to ^6.3.6</li>
<li><a
href="31f15ea110"><code>31f15ea</code></a>
build(deps): Update ESLint packages to ^9.35.0</li>
<li>Additional commits viewable in <a
href="https://github.com/kulshekhar/ts-jest/compare/v29.4.1...v29.4.2">compare
view</a></li>
</ul>
</details>
<br />
<details>
<summary>Most Recent Ignore Conditions Applied to This Pull
Request</summary>
| Dependency Name | Ignore Conditions |
| --- | --- |
| @types/node | [>= 22.a, < 23] |
</details>
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Bumps the gradle group with 1 update in the
/.github/workflow-samples/groovy-dsl directory:
com.gradle.common-custom-user-data-gradle-plugin.
Bumps the gradle group with 1 update in the
/.github/workflow-samples/kotlin-dsl directory:
com.gradle.common-custom-user-data-gradle-plugin.
Bumps the gradle group with 1 update in the /sources/test/init-scripts
directory: com.gradle.common-custom-user-data-gradle-plugin.
Updates `com.gradle.common-custom-user-data-gradle-plugin` from 2.3 to
2.4.0
Updates `com.gradle.common-custom-user-data-gradle-plugin` from 2.3 to
2.4.0
Updates `com.gradle.common-custom-user-data-gradle-plugin` from 2.3 to
2.4.0
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Bumps the gradle group with 1 update in the /.github/workflow-samples/groovy-dsl directory: com.gradle.common-custom-user-data-gradle-plugin.
Bumps the gradle group with 1 update in the /.github/workflow-samples/kotlin-dsl directory: com.gradle.common-custom-user-data-gradle-plugin.
Bumps the gradle group with 1 update in the /sources/test/init-scripts directory: com.gradle.common-custom-user-data-gradle-plugin.
Updates `com.gradle.common-custom-user-data-gradle-plugin` from 2.3 to 2.4.0
Updates `com.gradle.common-custom-user-data-gradle-plugin` from 2.3 to 2.4.0
Updates `com.gradle.common-custom-user-data-gradle-plugin` from 2.3 to 2.4.0
---
updated-dependencies:
- dependency-name: com.gradle.common-custom-user-data-gradle-plugin
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gradle
- dependency-name: com.gradle.common-custom-user-data-gradle-plugin
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gradle
- dependency-name: com.gradle.common-custom-user-data-gradle-plugin
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gradle
...
Signed-off-by: dependabot[bot] <support@github.com>
Automatically generated pull request to update the known wrapper
checksums.
In case of conflicts, manually run the workflow from the [Actions
tab](https://github.com/gradle/actions/actions/workflows/update-checksums-file.yml),
the changes will then be force-pushed onto this pull request branch.
Do not manually update the pull request branch; those changes might get
overwritten.
> [!IMPORTANT]
> GitHub workflows have not been executed for this pull request yet.
Before merging, close and then directly reopen this pull request to
trigger the workflows.
dependabot[bot]
Eric Haag
Jérôme Prinet
bot-githubaction
Tyler Bertrand
amyu