Merge releases/v4 into releases/v3

.github/workflows/update-supported-enterprise-server-versions.yml

@@ -38,7 +38,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: github/enterprise-releases
-          token: ${{ secrets.ENTERPRISE_RELEASE_TOKEN }}
+          token: ${{ secrets.CODEQL_CI_ENTERPRISE_RELEASE_PAT }}
           path: ${{ github.workspace }}/enterprise-releases/
           sparse-checkout: releases.json
 

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
 
+## 3.37.5 - 03 Aug 2026
+
+- Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://github.com/github/codeql-action/pull/4061)
+
 ## 3.37.4 - 29 Jul 2026
 
 - This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "3.37.4",
+  "version": "3.37.5",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
@@ -71,9 +71,9 @@
     "glob": "^13.0.6",
     "globals": "^17.7.0",
     "nock": "^14.0.16",
-    "sinon": "^22.0.0",
+    "sinon": "^22.1.0",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.64.0"
+    "typescript-eslint": "^8.65.0"
   },
   "overrides": {
     "@actions/tool-cache": {

pr-checks/checks/job-run-uuid-sarif.yml

@@ -21,8 +21,8 @@ steps:
     run: |
       cd "$RUNNER_TEMP/results"
       actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif)
-      if [[ "$actual" != "$JOB_RUN_UUID" ]]; then
-        echo "Expected SARIF output to contain job run UUID '$JOB_RUN_UUID', but found '$actual'."
+      if [[ "$actual" != "$CODEQL_ACTION_JOB_RUN_UUID" ]]; then
+        echo "Expected SARIF output to contain job run UUID '$CODEQL_ACTION_JOB_RUN_UUID', but found '$actual'."
         exit 1
       else
         echo "Found job run UUID '$actual'."

pr-checks/checks/rubocop-multi-language.yml

@@ -5,7 +5,7 @@ versions:
   - default
 steps:
   - name: Set up Ruby
-    uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0
+    uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
     with:
       ruby-version: 2.6
   - name: Install Code Scanning integration