You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
See the releases page for the relevant changes to the CodeQL CLI and language packs.
[UNRELEASED]
No user facing changes.
4.37.9 - 26 Aug 2026
Update default CodeQL bundle version to 2.26.4. #4106
4.37.8 - 21 Aug 2026
No user facing changes.
4.37.7 - 13 Aug 2026
Update default CodeQL bundle version to 2.26.3. #4085
4.37.6 - 04 Aug 2026
Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070
4.37.5 - 03 Aug 2026
Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061
4.37.4 - 29 Jul 2026
This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-toolsrepository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
Update default CodeQL bundle version to 2.26.2. #4051
4.37.3 - 22 Jul 2026
No user facing changes.
4.37.2 - 21 Jul 2026
The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007
4.37.1 - 16 Jul 2026
Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
Update default CodeQL bundle version to 2.26.1. #4019
4.37.0 - 08 Jul 2026
Update default CodeQL bundle version to 2.26.0. #3995
... (truncated)
Commits
ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
See the releases page for the relevant changes to the CodeQL CLI and language packs.
[UNRELEASED]
No user facing changes.
4.37.9 - 26 Aug 2026
Update default CodeQL bundle version to 2.26.4. #4106
4.37.8 - 21 Aug 2026
No user facing changes.
4.37.7 - 13 Aug 2026
Update default CodeQL bundle version to 2.26.3. #4085
4.37.6 - 04 Aug 2026
Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070
4.37.5 - 03 Aug 2026
Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061
4.37.4 - 29 Jul 2026
This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-toolsrepository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
Update default CodeQL bundle version to 2.26.2. #4051
4.37.3 - 22 Jul 2026
No user facing changes.
4.37.2 - 21 Jul 2026
The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007
4.37.1 - 16 Jul 2026
Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
Update default CodeQL bundle version to 2.26.1. #4019
4.37.0 - 08 Jul 2026
Update default CodeQL bundle version to 2.26.0. #3995
... (truncated)
Commits
ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
The action no longer installs pnpm through npm. It downloads pnpm's self-contained release binary for the runner's platform straight from pnpm's GitHub releases, verifies it against the SHA-256 digest GitHub publishes for the asset, and puts it on PATH. No Node.js, no npm, no @pnpm/exe, no self-update round-trip.
That also makes the action immune to broken npm artifacts. pnpm 11.13.0's @pnpm/exe build shipped without its platform binary, which made v1 install a placeholder file that failed later with This: not found and exit code 127. The GitHub release binary for that same version is fine, so v2 installs it correctly. v2 additionally verifies the install by running pnpm --version and comparing it against the requested version, so a bad artifact fails immediately with a clear message instead of surfacing as a confusing error in a later step.
Breaking changes
pnpm v11 or newer is required.v1 could set up pnpm 10 via pnpm self-update; v2 rejects anything below v11 with an explanatory error. The action is built around pnpm's self-contained release binaries and the pnpm runtime command, both of which arrived in v11.
The bin-dest output points somewhere new. It was ~/setup-pnpm/node_modules/.bin/bin; it is now ~/setup-pnpm (the dest directory itself). Workflows that read the output are unaffected — it still names the directory holding pnpm — but anything that hardcoded the old path needs updating.
cache-hit is stricter. It is now true only on an exact key match. v1 reported true for any restore. This matches what actions/cache means by cache-hit.
No inputs or outputs were removed or renamed.
What's new
Flexible version specs.version accepts an exact version (12.0.0-beta.4), a semver range (^12.0.0), or an npm dist-tag (next-12). It is still optional when packageManager or devEngines.packageManager is set in package.json.
Partial store cache reuse. Cache restore now falls back to restore keys, so a single changed dependency no longer forces a full re-download of the store.
New token input. Used for the GitHub release lookup, defaulting to ${{ github.token }} so the low anonymous API rate limit doesn't apply. It rarely needs to be set.
pnpx, pn, and pnx aliases are linked next to the pnpm binary.
Upgrading
For most workflows the upgrade is the tag:
- - uses: pnpm/setup@v1+ - uses: pnpm/setup@v2
... (truncated)
Commits
84cb39b fix: keep the installed runtime authoritative against context-aware shims (#25)
ed0c46d feat: install pnpm from the npm registry, verified against npm's signature (#24)
829b49b Add SDK compliance workflow options for suite selection, SDK type, and blocking failures — Thanks @marandaneto!
0.8.0 — 2026-06-04
Minor changes
baad3c3 Switch the release flow to Sampo with a gated Release GitHub environment. Docker image publishes now require explicit human approval via Slack before they go out, addressing the supply-chain concern that any merge to main could push a new image consumed by every PostHog SDK. Contributors now write sampo add changesets instead of editing pyproject.toml and CHANGELOG.md by hand. — Thanks @ioannisj!
0.7.0 - 2026-05-29
Changed
Removed error_response_has_structured_body and error_response_has_correct_tag tests from response_format_validation -- these tested mock fidelity, not SDK behavior
Clarified in test_actions.yaml that assert_v1_error_response_format, assert_v1_error_tag, and assert_v1_per_event_result are infrastructure for integration tests, not used in the base SDK compliance suite
assert_events_in_batch_count now accepts a request_index param (default -1, the most recent request) so partial-batch retry tests can inspect the retried batch instead of the original. Fixes retries_only_retry_events_from_partial, which previously asserted against the original 3-event batch rather than the 1-event retry
Added
unknown_result_treated_as_terminal test: SDK does not retry events with unrecognized per-event result strings (forward compatibility)
respects_retry_after_on_retryable_error test: SDK honors Retry-After header on 503 error responses
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
Request Payload.Disable Geoip False Propagates As Geoip Disable False
✅
107ms
Request Payload.Disable Geoip Omitted Defaults To False
✅
107ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key
✅
107ms
Request Lifecycle.No Flags Request On Init Alone
✅
3ms
Request Lifecycle.No Flags Request On Normal Capture
✅
105ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests
✅
111ms
Request Lifecycle.Mock Response Value Is Returned To Caller
✅
107ms
Retry Behavior.Retries Flags On 502
✅
210ms
Retry Behavior.Retries Flags On 504
✅
255ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event
✅
109ms
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filegithub_actionsPull requests that update GitHub Actions code
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions group with 4 updates: github/codeql-action/init, github/codeql-action/analyze, pnpm/setup and PostHog/posthog-sdk-test-harness/.github/workflows/test-sdk-action.yml.
Updates
github/codeql-action/initfrom 4.37.6 to 4.37.7Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
ff2f1c6Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8951a133Update changelog for v4.37.7be7a3dbMerge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...9310334Merge pull request #4086 from github/mbg/thread-action-state-to-codeqlb4d8a54Rebuildab5db25Bump the npm-minor group across 1 directory with 8 updates38055a3DroploggerfromdatabaseInitClusterin interface1f87aedMerge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3dc1b98aMakeloggeravailable togetCodeQLForCmd6f0220eMerge pull request #4084 from github/navntoft/bump-undiciUpdates
github/codeql-action/analyzefrom 4.37.6 to 4.37.7Release notes
Sourced from github/codeql-action/analyze's releases.
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
ff2f1c6Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8951a133Update changelog for v4.37.7be7a3dbMerge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...9310334Merge pull request #4086 from github/mbg/thread-action-state-to-codeqlb4d8a54Rebuildab5db25Bump the npm-minor group across 1 directory with 8 updates38055a3DroploggerfromdatabaseInitClusterin interface1f87aedMerge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3dc1b98aMakeloggeravailable togetCodeQLForCmd6f0220eMerge pull request #4084 from github/navntoft/bump-undiciUpdates
pnpm/setupfrom 1.0.0 to 2.0.2Release notes
Sourced from pnpm/setup's releases.
... (truncated)
Commits
84cb39bfix: keep the installed runtime authoritative against context-aware shims (#25)ed0c46dfeat: install pnpm from the npm registry, verified against npm's signature (#24)4700d73README: bump versions (node, actions/setup) (#20)34ec361fix: normalize Windows cache store paths (#22)c9883ccdocs: reference v2 in examples; update pnpm to v12.0.0-beta.4 (#16)4f13ee5refactor: introduce restore keys for cache (#14)6523ce9feat: support pnpm v11 by downloading from GitHub releases (#12)6bfbb82feat!: install pnpm v12 as a standalone native executable (#11)77cf068docs: update version in examplesUpdates
PostHog/posthog-sdk-test-harness/.github/workflows/test-sdk-action.ymlfrom 0.10.0 to 1.0.0Release notes
Sourced from PostHog/posthog-sdk-test-harness/.github/workflows/test-sdk-action.yml's releases.
Changelog
Sourced from PostHog/posthog-sdk-test-harness/.github/workflows/test-sdk-action.yml's changelog.
... (truncated)
Commits
6d19abbchore: Release v1.0.0 [skip ci]4a7e606fix: require UTC timestamps in SDK contracts (#47)8d9cadfchore: Release v0.11.0 [skip ci]c8c78d3feat: capture_ai suite (#46)78074c3chore: group Dependabot updates (#45)e9ecc8cchore(deps): bump actions/cache from 5.0.5 to 6.1.0 (#42)0c1e9bcchore(deps): bump actions/github-script from 7.1.0 to 9.0.0 (#41)1e9c058chore(deps): bump docker/login-action from 3.7.0 to 4.6.0 (#43)405dc8cchore(deps): bump actions/checkout from 6.0.2 to 7.0.1 (#44)707b76dchore(deps-dev): update setuptools requirement from >=61.0 to >=83.0.0 (#40)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions