Bump the major-minor-patch group with 2 updates by dependabot[bot] · Pull Request #82 · AAS-TwinEngine/AAS.TwinEngine.DataEngine

dependabot · 2026-03-24T20:38:04Z

Bumps the major-minor-patch group with 2 updates: github/codeql-action and dorny/test-reporter.

Updates github/codeql-action from 4.31.6 to 4.34.1

Release notes

Sourced from github/codeql-action's releases.

v4.34.1

Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

v4.34.0

Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569

We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584

Update default CodeQL bundle version to 2.25.0. #3585

v4.33.0

Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562

To opt out of this change:

Repositories owned by an organization: Create a custom repository property with the name github-codeql-file-coverage-on-prs and the type "True/false", then set this property to true in the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

User-owned repositories using default setup: Switch to an advanced setup workflow and set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

User-owned repositories using advanced setup: Set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #3557

The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as github-codeql-disable-overlay that was previously only available on GitHub.com. #3559

Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #3563

Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #3564

A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. #3570

v4.32.6

Update default CodeQL bundle version to 2.24.3. #3548

v4.32.5

Repositories owned by an organization can now set up the github-codeql-disable-overlay custom repository property to disable improved incremental analysis for CodeQL. First, create a custom repository property with the name github-codeql-disable-overlay and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to true to disable improved incremental analysis. For more information, see Managing custom properties for repositories in your organization. This feature is not yet available on GitHub Enterprise Server. #3507

Added an experimental change so that when improved incremental analysis fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. #3487

The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. #3515

Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. #3516

Added an experimental change which lowers the minimum disk space requirement for improved incremental analysis, enabling it to run on standard GitHub Actions runners. We expect to roll this change out to everyone in March. #3498

Added an experimental change which allows the start-proxy action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. #3512

The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. #3503, #3504

v4.32.4

Update default CodeQL bundle version to 2.24.2. #3493

Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when private package registries are configured. This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. #3473

When the CodeQL Action is run with debugging enabled in Default Setup and private package registries are configured, the "Setup proxy for registries" step will output additional diagnostic information that can be used for troubleshooting. #3486

Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. #3485

Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a nightly CodeQL CLI release instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. #3484

v4.32.3

Added experimental support for testing connections to private package registries. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. #3466

v4.32.2

Update default CodeQL bundle version to 2.24.1. #3460

v4.32.1

A warning is now shown in Default Setup workflow logs if a private package registry is configured using a GitHub Personal Access Token (PAT), but no username is configured. #3422

Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. #3421

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

Reduced the minimum Git version required for improved incremental analysis from 2.38.0 to 2.11.0. #3767

4.34.1 - 20 Mar 2026

Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

4.34.0 - 20 Mar 2026

Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569

We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584

Update default CodeQL bundle version to 2.25.0. #3585

4.33.0 - 16 Mar 2026

Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562

To opt out of this change:

Repositories owned by an organization: Create a custom repository property with the name github-codeql-file-coverage-on-prs and the type "True/false", then set this property to true in the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

User-owned repositories using default setup: Switch to an advanced setup workflow and set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

User-owned repositories using advanced setup: Set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #3557

The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as github-codeql-disable-overlay that was previously only available on GitHub.com. #3559

Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #3563

Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #3564

A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. #3570

4.32.6 - 05 Mar 2026

Update default CodeQL bundle version to 2.24.3. #3548

4.32.5 - 02 Mar 2026

Repositories owned by an organization can now set up the github-codeql-disable-overlay custom repository property to disable improved incremental analysis for CodeQL. First, create a custom repository property with the name github-codeql-disable-overlay and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to true to disable improved incremental analysis. For more information, see Managing custom properties for repositories in your organization. This feature is not yet available on GitHub Enterprise Server. #3507

Added an experimental change so that when improved incremental analysis fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. #3487

The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. #3515

Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. #3516

Added an experimental change which lowers the minimum disk space requirement for improved incremental analysis, enabling it to run on standard GitHub Actions runners. We expect to roll this change out to everyone in March. #3498

Added an experimental change which allows the start-proxy action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. #3512

The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. #3503, #3504

4.32.4 - 20 Feb 2026

Update default CodeQL bundle version to 2.24.2. #3493

Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when private package registries are configured. This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. #3473

... (truncated)

Commits

3869755 Merge pull request #3763 from github/update-v4.34.1-095e0fe50
20e68ac Update changelog for v4.34.1
095e0fe Merge pull request #3762 from github/henrymercer/downgrade-default-bundle
47b94fe Add changelog note
51a1d69 Downgrade default bundle to codeql-bundle-v2.24.3
510cf73 Merge pull request #3589 from github/mergeback/v4.34.0-to-main-c6f93110
89f0c86 Rebuild
c3f90ba Update changelog and version after v4.34.0
c6f9311 Merge pull request #3588 from github/update-v4.34.0-30c555a52
eeb9b3f Update changelog for v4.34.0
Additional commits viewable in compare view

Updates dorny/test-reporter from 2.6.0 to 3.0.0

Release notes

Sourced from dorny/test-reporter's releases.

v3.0.0

Note: The v3 release requires NodeJS 24 runtime on GitHub Actions runners.

What's Changed

Upgrade action runtime to Node.js 24 by @dav-tb in dorny/test-reporter#738

Explicitly use lowest permissions required to run workflow by @jozefizso in dorny/test-reporter#745

Other Changes

Bump @typescript-eslint/parser from 8.57.0 to 8.57.1 by @dependabot[bot] in dorny/test-reporter#742

Bump @types/adm-zip from 0.5.7 to 0.5.8 by @dependabot[bot] in dorny/test-reporter#743

Bump flatted from 3.4.1 to 3.4.2 by @dependabot[bot] in dorny/test-reporter#744

New Contributors

@dav-tb made their first contribution in dorny/test-reporter#738

Full Changelog: dorny/test-reporter@v2.7.0...v3.0.0

v2.7.0

What's Changed

Feature: Add slug-prefix output for link anchors dorny/test-reporter#731

Feature: Report jest-junit testsuite errors as failures dorny/test-reporter#155

Security: Update dependencies to fix reported security vulnerabilities

Other Changes

Bump eslint from 9.39.3 to 9.39.4 by @dependabot[bot] in dorny/test-reporter#732

Bump @typescript-eslint/parser from 8.56.1 to 8.57.0 by @dependabot[bot] in dorny/test-reporter#733

Bump jest from 30.2.0 to 30.3.0 by @dependabot[bot] in dorny/test-reporter#734

Bump undici from 6.23.0 to 6.24.1 by @dependabot[bot] in dorny/test-reporter#736

Update flatted package to v3.4.1 to fix a vulnerability by @jozefizso in dorny/test-reporter#739

New Contributors

@dt-thomas-durand made their first contribution in dorny/test-reporter#731

@johnbartholomew made their first contribution in dorny/test-reporter#155

Full Changelog: dorny/test-reporter@v2.6.0...v2.7.0

Changelog

Sourced from dorny/test-reporter's changelog.

Changelog

3.0.0

Feature: Use NodeJS 24 LTS as default runtime dorny/test-reporter#738

2.7.0

Feature: Add slug-prefix output for link anchors dorny/test-reporter#731

Feature: Report jest-junit testsuite errors as failures dorny/test-reporter#155

Security: Update dependencies to fix reported security vulnerabilities

2.6.0

Fix: For workflow_run events, resolve the commit of the check run from related pull request head commits first (matching workflow_run.head_branch, then first PR), and fall back to workflow_run.head_sha for non-PR runs dorny/test-reporter#673

Change: The test-reporter action will listed all artifacts associated with the build run dorny/test-reporter#693

Maintenance: Upgrade to ESLint v9 dorny/test-reporter#629

2.5.0

Feature: Add Nette Tester support with tester-junit reporter dorny/test-reporter#707

Maintenance: Bump actions/upload-artifact from 5 to 6 dorny/test-reporter#695

2.4.0

Feature: Add PHPUnit support with JUnit XML dialect parser dorny/test-reporter#422

Feature: Add JUnit XML sample files and tests for validation dorny/test-reporter#701

Fix: Refactor deprecated String.substr() function to use String.substring() dorny/test-reporter#704

2.3.0

Feature: Add Python support with python-xunit reporter (pytest) dorny/test-reporter#643

Feature: Add pytest traceback parsing and directory-mapping option dorny/test-reporter#238

Performance: Update sax.js to fix large XML file parsing dorny/test-reporter#681

Documentation: Complete documentation for all supported reporters dorny/test-reporter#691

Security: Bump js-yaml and mocha in /reports/mocha (fixes prototype pollution) dorny/test-reporter#682

2.2.0

Feature: Add collapsed option to control report summary visibility dorny/test-reporter#664

Fix badge encoding for values including underscore and hyphens dorny/test-reporter#672

Fix missing report-title attribute in action definition dorny/test-reporter#637

Refactor variable names to fix shadowing issues dorny/test-reporter#630

2.1.1

Fix error when a TestMethod element does not have a className attribute in a trx file dorny/test-reporter#623

Add stack trace from trx to summary dorny/test-reporter#615

List only failed tests dorny/test-reporter#606

Add type definitions to github-utils.ts dorny/test-reporter#604

Avoid split on undefined dorny/test-reporter#258

Return links to summary report dorny/test-reporter#588

Add step summary short summary dorny/test-reporter#589

Fix for empty TRX TestDefinitions dorny/test-reporter#582

Increase step summary limit to 1MiB dorny/test-reporter#581

Fix input description for list options dorny/test-reporter#572

2.1.0

... (truncated)

Commits

a43b3a5 test-reporter release v3.0.0
79216dc Merge pull request #744 from dorny/dependabot/npm_and_yarn/flatted-3.4.2
62c3873 Merge pull request #745 from dorny/feature/workflow_permissions
bd74ca6 Explicitly use lowest permissions required to run workflow
0c2b2aa Merge pull request #738 from dav-tb/feature/node24-runtime
f7eee30 Use the @types/node definitions for NodeJS 24 runtime
ad0a96f Upgrade action runtime to Node.js 24
543415c Merge pull request #741 from dorny/release/v2.7.0
f1284d0 Bump flatted from 3.4.1 to 3.4.2
3c1b53f Merge pull request #743 from dorny/dependabot/npm_and_yarn/types/adm-zip-0.5.8
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the major-minor-patch group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [dorny/test-reporter](https://github.com/dorny/test-reporter). Updates `github/codeql-action` from 4.31.6 to 4.34.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.31.6...3869755) Updates `dorny/test-reporter` from 2.6.0 to 3.0.0 - [Release notes](https://github.com/dorny/test-reporter/releases) - [Changelog](https://github.com/dorny/test-reporter/blob/main/CHANGELOG.md) - [Commits](dorny/test-reporter@3d76b34...a43b3a5) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.34.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: major-minor-patch - dependency-name: dorny/test-reporter dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

sonarqubecloud · 2026-03-24T20:39:11Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2026-03-24T20:39:18Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA d860f37.

Ensure that dependencies are being submitted on PR branches. Re-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
actions/github/codeql-action/upload-sarif	38697555549f1db7851b81482ff19f1fa5c4fedc	Unknown	Unknown

Scanned Files

.github/workflows/scorecard.yml

github-actions · 2026-03-24T20:39:41Z

Test & Coverage Report

Test Results Summary

Metric	Count
✅ Passed	1020
❌ Failed	0
⏭️ Skipped	0

View Detailed Test Results

Code Coverage

Unit Tests Coverage

Package	Line Rate	Branch Rate	Complexity	Health
AAS.TwinEngine.DataEngine	91%	83%	1507	✔
Summary	91% (2560 / 2811)	83% (1075 / 1299)	1507	✔

Minimum allowed line rate is 80%

Module Tests Coverage

Package	Line Rate	Branch Rate	Complexity	Health
AAS.TwinEngine.DataEngine	55%	42%	1507	➖
Summary	55% (1559 / 2811)	42% (540 / 1299)	1507	➖

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 24, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the major-minor-patch group with 2 updates#82

Bump the major-minor-patch group with 2 updates#82
dependabot[bot] wants to merge 1 commit intodevelopfrom
dependabot/github_actions/develop/major-minor-patch-f105e35cd4

dependabot bot commented on behalf of github Mar 24, 2026

Uh oh!

sonarqubecloud bot commented Mar 24, 2026

Uh oh!

github-actions bot commented Mar 24, 2026

Uh oh!

github-actions bot commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 24, 2026

v4.34.1

v4.34.0

v4.33.0

v4.32.6

v4.32.5

v4.32.4

v4.32.3

v4.32.2

v4.32.1

CodeQL Action Changelog

[UNRELEASED]

4.34.1 - 20 Mar 2026

4.34.0 - 20 Mar 2026

4.33.0 - 16 Mar 2026

4.32.6 - 05 Mar 2026

4.32.5 - 02 Mar 2026

4.32.4 - 20 Feb 2026

v3.0.0

What's Changed

Other Changes

New Contributors

v2.7.0

What's Changed

Other Changes

New Contributors

Changelog

3.0.0

2.7.0

2.6.0

2.5.0

2.4.0

2.3.0

2.2.0

2.1.1

2.1.0

Uh oh!

sonarqubecloud bot commented Mar 24, 2026

Quality Gate passed

Uh oh!

github-actions bot commented Mar 24, 2026

Dependency Review

Snapshot Warnings

OpenSSF Scorecard

Scanned Files

Uh oh!

github-actions bot commented Mar 24, 2026

Test & Coverage Report

Test Results Summary

Code Coverage

Unit Tests Coverage

Module Tests Coverage

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants