)]}'
{
  "log": [
    {
      "commit": "388f5af1a6d4a4df4ab9bf69a1817255952e6ef1",
      "tree": "2f716b6e6ded19957bddaf593658f93be1006585",
      "parents": [
        "28d05cf1a2591e05565d03435216cb6c19da0c43"
      ],
      "author": {
        "name": "Cosima Neidahl",
        "email": "opna2608@protonmail.com",
        "time": "Fri Aug 07 17:52:30 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 07 17:52:30 2026"
      },
      "message": "Use ASSERT_STREQ for testing ExtractSourceFromModule results (#6600)\n\nIn case of a mismatch,\n[`ASSERT_STREQ`](https://google.github.io/googletest/reference/assertions.html#EXPECT_STREQ)\nactually prints both strings. Example:\n\n```\n/build/source/test/tools/objdump/extract_source_test.cpp:223: Failure Expected equality of these values:\n  resStr.c_str()\n    Which is: \"diovmoc etup}{)(\"\n  \"void compute(){}\"\n```\n\n---\n\nThis makes it easier to see that SPIRV-Tools has a similar issue as\nhttps://github.com/KhronosGroup/glslang/issues/4145, where parsing on\nbig-endian gives either seemingly no/incomplete results, or results\nwhere strings are partially reversed."
    },
    {
      "commit": "28d05cf1a2591e05565d03435216cb6c19da0c43",
      "tree": "6d6ed795d6a0c0878ddc5c5d4d3a733be5e12757",
      "parents": [
        "5b5a25231a3543559b4f2cb27fe725a08b76b5d0"
      ],
      "author": {
        "name": "David Neto",
        "email": "dneto@google.com",
        "time": "Fri Aug 07 17:34:34 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 07 17:34:34 2026"
      },
      "message": "kokoro: fix linux-gcc-gn build (#6831)\n\n- fix creation of deep build dir\n- Generalize the chown in the wrapper script to cover all dirs\n      that might be generated during the build."
    },
    {
      "commit": "5b5a25231a3543559b4f2cb27fe725a08b76b5d0",
      "tree": "d4a9d46289b4b6a7aeabe85e6c88bd699d9aec75",
      "parents": [
        "f589ef005c49f6f19c8e78eb5269104ba293beb4"
      ],
      "author": {
        "name": "David Neto",
        "email": "dneto@google.com",
        "time": "Thu Aug 06 22:03:29 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 06 22:03:29 2026"
      },
      "message": "kokoro: set up a linux-gcc-gn build (#6829)\n\nUpdate .gitignore to ignore files generated during local GN builds\n\nUpdate DEPS, GN scripting, standalone gclient client file\n\nSupport manually testing the linux kokoro scripts with podman.\n- In kokoro/scripts/linux/build-docker.sh: Only set up the artifacts\nvolume mapping when the corresponding Kokoro environment variable is\nset. Otherwise podman will fail to launch the container.\n\ngit-sync-deps: understand enhanced DEPS file\n    \n    - Add --prefix argument to filter the subdirs we care about.\n      SPIRV-Tools Cmake builds will only want --prefix\u003dexternal\n    - Warn that git-sync-deps will not checkout cipd or gcs dependencies\n      Warn insted of erroring so that it\u0027s harmless to *not* supply\n      the --prefix option\n   \n\nIssue: #2810"
    },
    {
      "commit": "f589ef005c49f6f19c8e78eb5269104ba293beb4",
      "tree": "06f8dbd2c150a75c5eca4c4884858556e72a32ff",
      "parents": [
        "98098e9b977d7b3af73822a86f86447c8360eb50"
      ],
      "author": {
        "name": "Jeff Bolz",
        "email": "jbolz@nvidia.com",
        "time": "Wed Aug 05 20:10:24 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 05 20:10:24 2026"
      },
      "message": "Validate SPV_EXT_cooperative_matrix_maintenance1 (#6825)\n\n\n\nExtension spec: https://github.com/KhronosGroup/SPIRV-Registry/pull/443\nSPIRV-Headers: https://github.com/KhronosGroup/SPIRV-Headers/pull/621"
    },
    {
      "commit": "98098e9b977d7b3af73822a86f86447c8360eb50",
      "tree": "a0e5fbc7841e69ad8e52b4c7f1a3a9a597f26c56",
      "parents": [
        "1c336172641682bab6e066767d09fdff1d826467"
      ],
      "author": {
        "name": "Steven Perron",
        "email": "stevenperron@google.com",
        "time": "Wed Aug 05 20:09:22 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 05 20:09:22 2026"
      },
      "message": "opt: Filter duplicate decorations during serialization (#6828)\n\nAdd a mechanism to filter out duplicate decorations when writing the\nSPIR-V module back to binary in Module::ToBinary. This prevents\nvalidation\nerrors when optimization passes (like loop unrolling) duplicate\ndecorated\ninstructions.\n\nThe filtering uses a hash set of serialized instructions to identify and\nskip duplicates.\n\nA new parameter `filter_duplicates` is added to `Module::ToBinary` to\nallow disabling this behavior, which is used during the optimizer\u0027s\nintegrity check to prevent false positive assertion failures.\n\nAdded unit test in `module_test.cpp` to verify the behavior.\n\nAssisted by: Antigravity\n\nFixes: https://github.com/microsoft/DirectXShaderCompiler/issues/8609"
    },
    {
      "commit": "1c336172641682bab6e066767d09fdff1d826467",
      "tree": "10817ebf67a280968e7ff0fde72dcb1e7e3122a9",
      "parents": [
        "d993bcfafa3c6dd9c0ba0560ae1456a62fd78e07"
      ],
      "author": {
        "name": "Steven Perron",
        "email": "stevenperron@google.com",
        "time": "Wed Aug 05 18:11:27 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 05 18:11:27 2026"
      },
      "message": "opt: Fix invalid OpSelect folding in spirv-opt (#6827)\n\nMergeBinaryOpSelect rule was folding binary operations with select\ninstructions even when the result was a vector and the condition was\nscalar, which is only valid in SPIR-V 1.4+. This change restricts\nthis folding in SPIR-V versions prior to 1.4.\n\nAssisted by: Antigravity\n\nFixes https://github.com/microsoft/DirectXShaderCompiler/issues/8603"
    },
    {
      "commit": "d993bcfafa3c6dd9c0ba0560ae1456a62fd78e07",
      "tree": "88c59871e88a347c9ed42bc21225c0d8e26ff118",
      "parents": [
        "a9cdf5bdd25d516294b5c25502b67e6116ed7eb5"
      ],
      "author": {
        "name": "Spencer Fricke",
        "email": "115671160+spencer-lunarg@users.noreply.github.com",
        "time": "Mon Aug 03 15:44:28 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 03 15:44:28 2026"
      },
      "message": "spirv-val: Add extra Heap ArrayStride test (#6818)\n\ncloses https://github.com/KhronosGroup/SPIRV-Tools/issues/6739"
    },
    {
      "commit": "a9cdf5bdd25d516294b5c25502b67e6116ed7eb5",
      "tree": "cb12c4a2ee601552e307a7099d4ce1c692047f72",
      "parents": [
        "72bb45a352737ed691eb46b773a4685a63b4e047"
      ],
      "author": {
        "name": "alan-baker",
        "email": "alanbaker@google.com",
        "time": "Thu Jul 30 22:32:12 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 30 22:32:12 2026"
      },
      "message": "Tighten relaxed layout alignments (#6819)\n\nFixes #6817\n\n* Relaxed block layout only applies to vectors directly in the struct\nand not through matrices nor arrays\n\nTested against CTS, no unexpected failures."
    },
    {
      "commit": "72bb45a352737ed691eb46b773a4685a63b4e047",
      "tree": "2293e5fcec9840a0d58a55a3077c96bfc0e044d9",
      "parents": [
        "5f62f05f5f1dac09f81af9f207e7ab6c82b3722e"
      ],
      "author": {
        "name": "Arseniy Obolenskiy",
        "email": "arseniy.obolenskiy@amd.com",
        "time": "Thu Jul 30 20:38:34 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 30 20:38:34 2026"
      },
      "message": "[val] Fix crash evaluating \u003e64-bit integer constants in EvalConstantVal{Uint,Int}64 (#6816)"
    },
    {
      "commit": "5f62f05f5f1dac09f81af9f207e7ab6c82b3722e",
      "tree": "730d9d0924d3e312dff83f400ed33e74a9fb01e0",
      "parents": [
        "4d6dad6f8bf6ce5f12cf57d198b2fb817be7fb68"
      ],
      "author": {
        "name": "Arseniy Obolenskiy",
        "email": "arseniy.obolenskiy@amd.com",
        "time": "Tue Jul 28 20:48:42 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 28 20:48:42 2026"
      },
      "message": "[val] Restrict Workgroup scope to OpGroupNonUniformRotateKHR only (#6811)\n\nOther non-uniform group operations were incorrectly allowed to use\nWorkgroup execution scope in the general SPIR-V rule check, only\nOpGroupNonUniformRotateKHR permits it\n\nAlso fix the matching Vulkan execution scope check, which was missing\nthe same exclusion"
    },
    {
      "commit": "4d6dad6f8bf6ce5f12cf57d198b2fb817be7fb68",
      "tree": "bc1d47743371b7bf996bc8cbeefc5861aac5e630",
      "parents": [
        "a665e21f3061f34064b39937cf00fe8d8769f4ef"
      ],
      "author": {
        "name": "alan-baker",
        "email": "alanbaker@google.com",
        "time": "Tue Jul 28 19:39:10 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 28 19:39:10 2026"
      },
      "message": "[val] Explicit layout refactor (#6792)\n\nFixes #6780\n\n* Combine layout checks into a single pass to share logic\n  * checks both required explicit layouts and invalid layouts\n  * remove checks from validate_decorations.cpp\n* Introduce enums for layout modes and requirements\n* Centralize which instructions are examined for layouts\n* Add options to specify descriptor sizes to the validator (buffer,\nsampler, image, and tensor)"
    },
    {
      "commit": "a665e21f3061f34064b39937cf00fe8d8769f4ef",
      "tree": "d89db20fefe141eb08682d5cf807ee6584c156f6",
      "parents": [
        "3c96171c74ed289804c925b171b5234c73d5fdd0"
      ],
      "author": {
        "name": "Spencer Fricke",
        "email": "115671160+spencer-lunarg@users.noreply.github.com",
        "time": "Wed Jul 22 18:52:59 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 22 18:52:59 2026"
      },
      "message": "utils: Supress GCC array-bound warning (#6807)\n\ncloses https://github.com/KhronosGroup/SPIRV-Tools/issues/6805\n\nWe do this same-ish thing in `source/utils/hex_floats.h` \n\nI looked, there was no changes to `timer.h` or `pass_manager.cpp` so not\nsure what this suddenly is happening, seems to just be something the\nlatest GCC is catching"
    },
    {
      "commit": "3c96171c74ed289804c925b171b5234c73d5fdd0",
      "tree": "01a340eb160bc6c525ee219ab06b3924c2840034",
      "parents": [
        "0d6fd73ca73830ccab5fa1f00ed5ed40124e2c55"
      ],
      "author": {
        "name": "Lurie97",
        "email": "109333972+Lurie97@users.noreply.github.com",
        "time": "Wed Jul 22 11:07:14 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 22 11:07:14 2026"
      },
      "message": "linker: detect duplicate exported definitions without imports (#6750)\n\nThe duplicate-export check in GetImportExportPairs() only triggers when\niterating over imports. If no module imports a symbol, the linker never\nlooks up the export table for that name, so multiple modules can each\nexport the same function and spvtools::Link() silently accepts them\ninstead of reporting a One Definition Rule violation.\n\nAdd a standalone pass over the exports map before the import-matching\nloop to reject links where the same symbol name is exported by more than\none module. This correctly handles LinkOnceODR symbols because they are\nalready deduplicated into a single export entry by the preceding\nlinkonce processing.\n\nFixes the piglit clLinkProgram test where two modules each define\nget_number() with Export linkage but neither imports it.\n\nSigned-off-by: jiajia Qian \u003cjiajia.qian@nxp.com\u003e"
    },
    {
      "commit": "0d6fd73ca73830ccab5fa1f00ed5ed40124e2c55",
      "tree": "48263520317e68d84346a3b71af0800ef622ae88",
      "parents": [
        "470d6931c170dafe9feb5a808f58df1f94779355"
      ],
      "author": {
        "name": "David Gilhooley",
        "email": "dgilhooley@google.com",
        "time": "Fri Jul 17 17:33:54 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 17:33:54 2026"
      },
      "message": "Fix build for LLVM\u0027s remove transitive includes (#6802)\n\nIn the latest LLVM roll this file requires the iterator header for\nstd::back_inserter\n\nI believe LLVM has recently removed transitive includes by default, see:\n\n\nhttps://github.com/llvm/llvm-project/commit/ce5b2e876494cb95f02d9f915081e2b8781e74d1"
    },
    {
      "commit": "470d6931c170dafe9feb5a808f58df1f94779355",
      "tree": "e3d8713ab0c0b47d7c193011526284b5185b4870",
      "parents": [
        "b0adb9bb1f24dfe5ad7d82a3b9890400cca2dd3f"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Jul 17 16:12:36 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 16:12:36 2026"
      },
      "message": "build(deps): bump the github-actions group with 2 updates (#6801)\n\nBumps the github-actions group with 2 updates:\n[lukka/get-cmake](https://github.com/lukka/get-cmake) and\n[github/codeql-action/upload-sarif](https://github.com/github/codeql-action).\n\nUpdates `lukka/get-cmake` from 4.3.4 to 4.4.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/releases\"\u003elukka/get-cmake\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eCMake v4.4.0\u003c/h2\u003e\n\u003cp\u003eThe \u003ccode\u003eget-cmake\u003c/code\u003e action downloads and caches CMake and\nNinja on your workflows. Versions can be specified using \u003ca\nhref\u003d\"https://docs.npmjs.com/about-semantic-versioning\"\u003esemantic\nversioning ranges\u003c/a\u003e using \u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/blob/latest/action.yml#L13\"\u003e\u003ccode\u003ecmakeVersion\u003c/code\u003e\u003c/a\u003e\nand \u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/blob/latest/action.yml#L16\"\u003e\u003ccode\u003eninjaVersion\u003c/code\u003e\u003c/a\u003e\ninputs.\u003c/p\u003e\n\u003cp\u003eChanges:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003elatest\u003c/code\u003e is now using CMake version \u003ccode\u003ev4.4.0\u003c/code\u003e,\nuse this one-liner e.g.:\n\u003ccode\u003euses: lukka/get-cmake@latest\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eEnjoy!\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/commit/e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3\"\u003e\u003ccode\u003ee690607\u003c/code\u003e\u003c/a\u003e\nNew CMake version(s): cmake-v4.4.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/commit/80ed063af494e28dd56b85fb7a630f2f8f55ceed\"\u003e\u003ccode\u003e80ed063\u003c/code\u003e\u003c/a\u003e\nNew CMake version(s): cmake-rc-v4.4.0-rc3\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/compare/f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9...e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for\ncustomers using CodeQL version 2.20.6 and earlier. These versions of\nCodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise\nServer 3.16, and will be unsupported by the next minor release of the\nCodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases\npage\u003c/a\u003e for the relevant changes to the CodeQL CLI and language\npacks.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for\ncustomers using CodeQL version 2.20.6 and earlier. These versions of\nCodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise\nServer 3.16, and will be unsupported by the next minor release of the\nCodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.0 - 08 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIn addition to the existing input format, the\n\u003ccode\u003econfig-file\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e\nstep will soon support a new \u003ccode\u003e[owner/]repo[@ref][:path]\u003c/code\u003e\nformat. All components except the repository name are optional. If\nomitted, \u003ccode\u003eowner\u003c/code\u003e defaults to the same owner as the repository\nthe analysis is running for, \u003ccode\u003eref\u003c/code\u003e to \u003ccode\u003emain\u003c/code\u003e, and\n\u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003e.github/codeql-action.yaml\u003c/code\u003e. Support\nfor this format ships in this version of the CodeQL Action, but will\nonly be enabled over the coming weeks. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3973\"\u003e#3973\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.36.3 - 01 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.2 - 04 Jun 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCache CodeQL CLI version information across Actions steps. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3943\"\u003e#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReduce requests while waiting for analysis processing by using\nexponential backoff when polling SARIF processing status. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3937\"\u003e#3937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6\"\u003e2.25.6\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3948\"\u003e#3948\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.36.1 - 02 Jun 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.0 - 22 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle\nversion to 2.19.4. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.5 - 15 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action\nare generated to avoid duplication across bundles and reduce the size of\nthe repository by around 70%. This should have no effect on the runtime\nbehaviour of the CodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e will now only be enabled on a pull request when\ndiff-informed analysis is also enabled for that run. If diff-informed\nanalysis is unavailable (for example, because the PR diff ranges could\nnot be computed), the action will fall back to a full analysis. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal\n\u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will\nbe enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for\nGitHub-internal use only, and may change without notice at any time. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning\nanalysis for a PR with \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have\na cached overlay-base database for the configured languages. This speeds\nup analysis for a repository when there is not yet a cached overlay-base\ndatabase for the latest CLI version. We expect to roll this change out\nto everyone in May. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.4 - 07 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.3 - 01 May 2026\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/7188fc363630916deb702c7fdcf4e481b751f97a\"\u003e\u003ccode\u003e7188fc3\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/4020\"\u003e#4020\u003c/a\u003e\nfrom github/update-v4.37.1-9e7c07009\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/c8b5f69be686908c3dfd844428137d56fe80c936\"\u003e\u003ccode\u003ec8b5f69\u003c/code\u003e\u003c/a\u003e\nUpdate changelog for v4.37.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/9e7c070092090e89e8b3d62f977d4456e0732cd7\"\u003e\u003ccode\u003e9e7c070\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/4014\"\u003e#4014\u003c/a\u003e\nfrom github/mbg/explicit-remote-prefix\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/3492b7e9ab96e28b1d8b971345d30e929c6f8fee\"\u003e\u003ccode\u003e3492b7e\u003c/code\u003e\u003c/a\u003e\nChange \u003ccode\u003eREMOTE_PATH_PREFIX\u003c/code\u003e to \u003ccode\u003eremote\u003d\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/3654baa924bc6456db54002581cb7c1c877548c4\"\u003e\u003ccode\u003e3654baa\u003c/code\u003e\u003c/a\u003e\nMerge remote-tracking branch \u0027origin/main\u0027 into\nmbg/explicit-remote-prefix\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/2d682ac05f1b3588aaff3814826bede39b9ba6bb\"\u003e\u003ccode\u003e2d682ac\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/4017\"\u003e#4017\u003c/a\u003e\nfrom github/dependabot/github_actions/dot-github/wor...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/23f6a50753a88efd9b7ae8687b29f6bdb65f6250\"\u003e\u003ccode\u003e23f6a50\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/4009\"\u003e#4009\u003c/a\u003e\nfrom github/mbg/action-state/additions\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/1ee3c75d1988ab8621f01ebb165115c38d56df91\"\u003e\u003ccode\u003e1ee3c75\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/4018\"\u003e#4018\u003c/a\u003e\nfrom github/dependabot/github_actions/dot-github/wor...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/e053684dc500899b0b5520edc8549ac0f1ed730b\"\u003e\u003ccode\u003ee053684\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/4015\"\u003e#4015\u003c/a\u003e\nfrom github/dependabot/npm_and_yarn/npm-minor-fd2e83...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/6803c5671d2f87a83ed96e151c441b1cb3bdc66a\"\u003e\u003ccode\u003e6803c56\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/4019\"\u003e#4019\u003c/a\u003e\nfrom github/update-bundle/codeql-bundle-v2.26.1\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s major version (unless you unignore this specific\ndependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s minor version (unless you unignore this specific\ndependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR\nand stop Dependabot creating any more for the specific dependency\n(unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore\nconditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will\nremove the ignore condition of the specified dependency and ignore\nconditions\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "b0adb9bb1f24dfe5ad7d82a3b9890400cca2dd3f",
      "tree": "1774de765b08313263f59f81dc43ccb8c152ddb7",
      "parents": [
        "d34072656009319e6c39368121d6cba4a790b889"
      ],
      "author": {
        "name": "github-actions[bot]",
        "email": "41898282+github-actions[bot]@users.noreply.github.com",
        "time": "Fri Jul 17 15:30:23 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 15:30:23 2026"
      },
      "message": "Roll external/abseil_cpp/ cd1253229..c34b14912 (6 commits) (#6800)\n\nhttps://github.com/abseil/abseil-cpp/compare/cd1253229e7d...c34b1491291f\n\nCreated with:\n  roll-dep external/abseil_cpp\n\nCo-authored-by: GitHub Actions[bot] \u003c\u003e"
    },
    {
      "commit": "d34072656009319e6c39368121d6cba4a790b889",
      "tree": "97a4936cf351923aea5441ff023be7c4ee0a0d7d",
      "parents": [
        "70588424c5dee17893561734cfa470af115bcdd7"
      ],
      "author": {
        "name": "Steven Perron",
        "email": "stevenperron@google.com",
        "time": "Thu Jul 16 17:59:35 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 16 17:59:35 2026"
      },
      "message": "opt: Fix invalid vector constant folding size (#6798)\n\nUse the actual vector component count instead of hardcoding 4\ncomponents when folding self-division of vectors in\nGetConstantUniformValue and FoldFMix.\n\nFixes #6794"
    },
    {
      "commit": "70588424c5dee17893561734cfa470af115bcdd7",
      "tree": "898dfebb9aa571afb51d5cf8fd31b10e65a6ef15",
      "parents": [
        "19b6261c8ed42da0f48c4aa6e92d0a6c0ff8b868"
      ],
      "author": {
        "name": "Steven Perron",
        "email": "stevenperron@google.com",
        "time": "Thu Jul 16 17:09:12 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 16 17:09:12 2026"
      },
      "message": "Fix UAF in eliminate dead functions (#6799)\n\nDo not collect DebugLine instructions when collecting the non-semantic\ntree of instructions to kill."
    },
    {
      "commit": "19b6261c8ed42da0f48c4aa6e92d0a6c0ff8b868",
      "tree": "4c25f0478f8716e184be89ef482c0d3999b3102d",
      "parents": [
        "4f97d7dbadc0bd7344515042611c3fd4f381063e"
      ],
      "author": {
        "name": "Steven Perron",
        "email": "stevenperron@google.com",
        "time": "Thu Jul 16 17:00:56 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 16 17:00:56 2026"
      },
      "message": "opt: Fix crash in strip-debug with non-semantic info (#6797)\n\nClears the DebugScope of all instructions during StripDebugInfoPass to\nprevent out-of-bounds assertions when writing back instructions that\nreference dead debug instructions.\n\nAlso resets the FeatureManager when OpExtInstImport is killed to\nmaintain\ncontext consistency if imports are removed by other passes.\n\nAdds a unit test to verify the fix.\n\nFixes #6796\n\nAssisted-by: Antigravity"
    },
    {
      "commit": "4f97d7dbadc0bd7344515042611c3fd4f381063e",
      "tree": "95a5d94d16182a3526700257921693987c242376",
      "parents": [
        "58dc0b3eb014f6ad4677177ef7ed03214e647d8b"
      ],
      "author": {
        "name": "github-actions[bot]",
        "email": "41898282+github-actions[bot]@users.noreply.github.com",
        "time": "Thu Jul 16 12:49:10 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 16 12:49:10 2026"
      },
      "message": "roll deps (#6795)\n\n- **Roll external/abseil_cpp/ 49ea0f955..e6a287bfb (3 commits)**\n- **Roll external/mimalloc/ fef6b0dd7..76d3f8a93 (35 commits)**\n\n---------\n\nCo-authored-by: GitHub Actions[bot] \u003c\u003e"
    },
    {
      "commit": "58dc0b3eb014f6ad4677177ef7ed03214e647d8b",
      "tree": "9d08a071651d4cf2ad742d201dd01f0f18d2c551",
      "parents": [
        "6ab70dc1940e8d1272cb497ccfa832aaacf6afe8"
      ],
      "author": {
        "name": "Wooyoung Kim",
        "email": "wooykim@qti.qualcomm.com",
        "time": "Tue Jul 14 21:23:14 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 14 21:23:14 2026"
      },
      "message": "Add the VUID-StandaloneSpirv-OpControlBarrierArriveEXT-13553 check (#6782)\n\nAdd the VUID-StandaloneSpirv-OpControlBarrierArriveEXT-13553 check\n(#6771)"
    },
    {
      "commit": "6ab70dc1940e8d1272cb497ccfa832aaacf6afe8",
      "tree": "7449878040db7e89126c46569d268736ccf91055",
      "parents": [
        "a153275e548fcbbcfcb5fababd5025108571364e"
      ],
      "author": {
        "name": "Steve Urquhart",
        "email": "53908460+SteveUrquhart@users.noreply.github.com",
        "time": "Tue Jul 14 20:54:06 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 14 20:54:06 2026"
      },
      "message": "opt: dissolve OpCopyLogical of OpCompositeConstruct in simplification (#6746)\n\nAs described in\nhttps://github.com/microsoft/DirectXShaderCompiler/issues/8382, this PR\nadds a new folding rule to deal with the new SPIR-V the optimizer is\nreceiving from dxc since\nhttps://github.com/microsoft/DirectXShaderCompiler/pull/7530. By\nrewriting\n```\n %0 \u003d OpCompositeConstruct %SrcStruct c0 c1 ... cN\n %1 \u003d OpCopyLogical        %DstStruct %0\n```\nas\n```\n %1 \u003d OpCompositeConstruct %DstStruct c0\u0027 c1\u0027 ... cN\u0027\n```\n...we can continue to legalize the technically-invalid\n```\n%cc \u003d OpCompositeConstruct %ResHolder_block %resourceVar\n```\n...which dxc has always emitted."
    },
    {
      "commit": "a153275e548fcbbcfcb5fababd5025108571364e",
      "tree": "bfe54edd31a49781ef3adb175fd078d41c297666",
      "parents": [
        "2ccac9471c670b6ad555814de0dd750261ddc8ae"
      ],
      "author": {
        "name": "github-actions[bot]",
        "email": "41898282+github-actions[bot]@users.noreply.github.com",
        "time": "Tue Jul 14 16:00:11 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 14 16:00:11 2026"
      },
      "message": "roll deps (#6793)\n\n- **Roll external/googletest/ 8240fa7d6..f132c8931 (3 commits)**\n- **Roll external/abseil_cpp/ db1bdc86e..49ea0f955 (27 commits)**\n\n---------\n\nCo-authored-by: GitHub Actions[bot] \u003c\u003e"
    },
    {
      "commit": "2ccac9471c670b6ad555814de0dd750261ddc8ae",
      "tree": "9b3954da01a95de1725dcff27038a40427b4f0f6",
      "parents": [
        "3058f80e65b2cdfdfce62134087881ab222a08fb"
      ],
      "author": {
        "name": "Steven Perron",
        "email": "stevenperron@google.com",
        "time": "Tue Jul 14 14:47:40 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 14 14:47:40 2026"
      },
      "message": "Authenticate git push in autoroll (#6790)\n\nSetting persist-credentials to false broke git push in autoroll\nworkflow.\nThis is fixed by authenticate git push using GITHUB_TOKEN. Other changes\nwere made to clean up some warnings.\n\nTAG\u003dagy"
    },
    {
      "commit": "3058f80e65b2cdfdfce62134087881ab222a08fb",
      "tree": "fe7336363a5e45173e3a130093e1552ebbb4a995",
      "parents": [
        "85f222ec591863853ea603ce190ea508c7255568"
      ],
      "author": {
        "name": "Arseniy Obolenskiy",
        "email": "arseniy.obolenskiy@amd.com",
        "time": "Mon Jul 13 22:23:10 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 22:23:10 2026"
      },
      "message": "[val] Count AliasScopeINTELMask/NoAliasINTELMask memory access words (#6791)"
    },
    {
      "commit": "85f222ec591863853ea603ce190ea508c7255568",
      "tree": "971a639d7377f66945d4e60057ce910b06b0e115",
      "parents": [
        "48097f650a9e0f0437921debe2f396654c956cc7"
      ],
      "author": {
        "name": "Steven Perron",
        "email": "stevenperron@google.com",
        "time": "Fri Jul 10 16:28:32 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 10 16:28:32 2026"
      },
      "message": "spirv-opt: Fix IRContext analysis handling (#6765)\n\n1. Add more cases where invalidating on analysis imply invalidating\nothers.\n2. Remove early return limiting the consistenty checks. Tests are added\n   to catch issues like this again.\n3. Extend IRContext::IsConsistent() to verify kAnalysisDominatorAnalysis\nand\n   kAnalysisStructuredCFG analyses.\n\nAssisted by Antigravity"
    },
    {
      "commit": "48097f650a9e0f0437921debe2f396654c956cc7",
      "tree": "23ac02bc9d67e9aa5a628db44f5217069ccdbd85",
      "parents": [
        "502666433f77439bece5b4c5c7e67bff90af2350"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Jul 10 15:15:35 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 10 15:15:35 2026"
      },
      "message": "build(deps): bump the github-actions group across 1 directory with 2 updates (#6775)\n\nBumps the github-actions group with 2 updates in the / directory:\n[actions/cache](https://github.com/actions/cache) and\n[github/codeql-action/upload-sarif](https://github.com/github/codeql-action).\n\nUpdates `actions/cache` from 6.0.0 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/cache/releases\"\u003eactions/cache\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/cache\u003c/code\u003e to v6.1.0 - handle read-only cache\naccess by \u003ca\nhref\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/pull/1768\"\u003eactions/cache#1768\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/cache/compare/v6...v6.1.0\"\u003ehttps://github.com/actions/cache/compare/v6...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/cache/blob/main/RELEASES.md\"\u003eactions/cache\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleases\u003c/h1\u003e\n\u003ch2\u003eHow to prepare a release\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\nRelevant for maintainers with write access only.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003col\u003e\n\u003cli\u003eSwitch to a new branch from \u003ccode\u003emain\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003enpm test\u003c/code\u003e to ensure all tests are passing.\u003c/li\u003e\n\u003cli\u003eUpdate the version in \u003ca\nhref\u003d\"https://github.com/actions/cache/blob/main/package.json\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/package.json\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003enpm run build\u003c/code\u003e to update the compiled files.\u003c/li\u003e\n\u003cli\u003eUpdate this \u003ca\nhref\u003d\"https://github.com/actions/cache/blob/main/RELEASES.md\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/RELEASES.md\u003c/code\u003e\u003c/a\u003e\nwith the new version and changes in the \u003ccode\u003e## Changelog\u003c/code\u003e\nsection.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003elicensed cache\u003c/code\u003e to update the license report.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003elicensed status\u003c/code\u003e and resolve any warnings by\nupdating the \u003ca\nhref\u003d\"https://github.com/actions/cache/blob/main/.licensed.yml\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/.licensed.yml\u003c/code\u003e\u003c/a\u003e\nfile with the exceptions.\u003c/li\u003e\n\u003cli\u003eCommit your changes and push your branch upstream.\u003c/li\u003e\n\u003cli\u003eOpen a pull request against \u003ccode\u003emain\u003c/code\u003e and get it reviewed\nand merged.\u003c/li\u003e\n\u003cli\u003eDraft a new release \u003ca\nhref\u003d\"https://github.com/actions/cache/releases\"\u003ehttps://github.com/actions/cache/releases\u003c/a\u003e\nuse the same version number used in \u003ccode\u003epackage.json\u003c/code\u003e\n\u003col\u003e\n\u003cli\u003eCreate a new tag with the version number.\u003c/li\u003e\n\u003cli\u003eAuto generate release notes and update them to match the changes you\nmade in \u003ccode\u003eRELEASES.md\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eToggle the set as the latest release option.\u003c/li\u003e\n\u003cli\u003ePublish the release.\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/li\u003e\n\u003cli\u003eNavigate to \u003ca\nhref\u003d\"https://github.com/actions/cache/actions/workflows/release-new-action-version.yml\"\u003ehttps://github.com/actions/cache/actions/workflows/release-new-action-version.yml\u003c/a\u003e\n\u003col\u003e\n\u003cli\u003eThere should be a workflow run queued with the same version\nnumber.\u003c/li\u003e\n\u003cli\u003eApprove the run to publish the new version and update the major tags\nfor this action.\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2\u003eChangelog\u003c/h2\u003e\n\u003ch3\u003e6.1.0\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/cache\u003c/code\u003e to v6.1.0 to pick up \u003ca\nhref\u003d\"https://redirect.github.com/actions/toolkit/pull/2435\"\u003eactions/toolkit#2435\nHandle cache write error due to read-only token\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSwitch redundant \u0026quot;Cache save failed\u0026quot; warning to debug log\nin save-only\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e6.0.0\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated \u003ccode\u003e@actions/cache\u003c/code\u003e to ^6.0.1,\n\u003ccode\u003e@actions/core\u003c/code\u003e to ^3.0.1, \u003ccode\u003e@actions/exec\u003c/code\u003e to\n^3.0.0, \u003ccode\u003e@actions/io\u003c/code\u003e to ^3.0.2\u003c/li\u003e\n\u003cli\u003eMigrated to ESM module system\u003c/li\u003e\n\u003cli\u003eUpgraded Jest to v30 and test infrastructure to be ESM\ncompatible\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.4\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eminimatch\u003c/code\u003e to v3.1.5 (fixes ReDoS via globstar\npatterns)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to v6.24.1 (WebSocket decompression bomb\nprotection, header validation fixes)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003efast-xml-parser\u003c/code\u003e to v5.5.6\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.3\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/cache\u003c/code\u003e to v5.0.5 (Resolves: \u003ca\nhref\u003d\"https://github.com/actions/cache/security/dependabot/33\"\u003ehttps://github.com/actions/cache/security/dependabot/33\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/core\u003c/code\u003e to v2.0.3\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.2\u003c/h3\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9\"\u003e\u003ccode\u003e55cc834\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/issues/1768\"\u003e#1768\u003c/a\u003e\nfrom jasongin/readonly-cache\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337\"\u003e\u003ccode\u003ed8cd72f\u003c/code\u003e\u003c/a\u003e\nBump \u003ccode\u003e@​actions/cache\u003c/code\u003e to v6.1.0 - handle cache write error\ndue to RO token\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/actions/cache/compare/2c8a9bd7457de244a408f35966fab2fb45fda9c8...55cc8345863c7cc4c66a329aec7e433d2d1c52a9\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.36.2 to 4.37.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIn addition to the existing input format, the\n\u003ccode\u003econfig-file\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e\nstep will soon support a new \u003ccode\u003e[owner/]repo[@ref][:path]\u003c/code\u003e\nformat. All components except the repository name are optional. If\nomitted, \u003ccode\u003eowner\u003c/code\u003e defaults to the same owner as the repository\nthe analysis is running for, \u003ccode\u003eref\u003c/code\u003e to \u003ccode\u003emain\u003c/code\u003e, and\n\u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003e.github/codeql-action.yaml\u003c/code\u003e. Support\nfor this format ships in this version of the CodeQL Action, but will\nonly be enabled over the coming weeks. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3973\"\u003e#3973\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.36.3\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases\npage\u003c/a\u003e for the relevant changes to the CodeQL CLI and language\npacks.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for\ncustomers using CodeQL version 2.20.6 and earlier. These versions of\nCodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise\nServer 3.16, and will be unsupported by the next minor release of the\nCodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.0 - 08 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIn addition to the existing input format, the\n\u003ccode\u003econfig-file\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e\nstep will soon support a new \u003ccode\u003e[owner/]repo[@ref][:path]\u003c/code\u003e\nformat. All components except the repository name are optional. If\nomitted, \u003ccode\u003eowner\u003c/code\u003e defaults to the same owner as the repository\nthe analysis is running for, \u003ccode\u003eref\u003c/code\u003e to \u003ccode\u003emain\u003c/code\u003e, and\n\u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003e.github/codeql-action.yaml\u003c/code\u003e. Support\nfor this format ships in this version of the CodeQL Action, but will\nonly be enabled over the coming weeks. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3973\"\u003e#3973\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.36.3 - 01 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.2 - 04 Jun 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCache CodeQL CLI version information across Actions steps. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3943\"\u003e#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReduce requests while waiting for analysis processing by using\nexponential backoff when polling SARIF processing status. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3937\"\u003e#3937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6\"\u003e2.25.6\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3948\"\u003e#3948\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.36.1 - 02 Jun 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.0 - 22 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle\nversion to 2.19.4. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.5 - 15 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action\nare generated to avoid duplication across bundles and reduce the size of\nthe repository by around 70%. This should have no effect on the runtime\nbehaviour of the CodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e will now only be enabled on a pull request when\ndiff-informed analysis is also enabled for that run. If diff-informed\nanalysis is unavailable (for example, because the PR diff ranges could\nnot be computed), the action will fall back to a full analysis. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal\n\u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will\nbe enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for\nGitHub-internal use only, and may change without notice at any time. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning\nanalysis for a PR with \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have\na cached overlay-base database for the configured languages. This speeds\nup analysis for a repository when there is not yet a cached overlay-base\ndatabase for the latest CLI version. We expect to roll this change out\nto everyone in May. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.4 - 07 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.3 - 01 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for\ncustomers using CodeQL version 2.19.3 and earlier. These versions of\nCodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise\nServer 3.15, and will be unsupported by the next minor release of the\nCodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP\nOIDC are now accepted. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use\n\u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better\ncompatibility with various registry implementations. For NuGet feeds,\nthe test is now always performed against the service index. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same\nmillisecond could overwrite each other on disk, causing one of them to\nbe lost. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/99df26d4f13ea111d4ec1a7dddef6063f76b97e9\"\u003e\u003ccode\u003e99df26d\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3996\"\u003e#3996\u003c/a\u003e\nfrom github/update-v4.37.0-c7c896d71\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/31c27074fda95256cda077009907f8a6022dd7c0\"\u003e\u003ccode\u003e31c2707\u003c/code\u003e\u003c/a\u003e\nAdd changenote for \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3973\"\u003e#3973\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/72df2181aac054d1f4b44264399d2aac12cf11c6\"\u003e\u003ccode\u003e72df218\u003c/code\u003e\u003c/a\u003e\nUpdate changelog for v4.37.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/c7c896d71b3055d36f2aff93b16bcc6c69923b91\"\u003e\u003ccode\u003ec7c896d\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3995\"\u003e#3995\u003c/a\u003e\nfrom github/update-bundle/codeql-bundle-v2.26.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/3f34ff0ea3f5153c96071437b7cbf71ea3757146\"\u003e\u003ccode\u003e3f34ff0\u003c/code\u003e\u003c/a\u003e\nAdd changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/43bec09f1dc368b430cab4b5d69799bc904079d1\"\u003e\u003ccode\u003e43bec09\u003c/code\u003e\u003c/a\u003e\nUpdate default bundle to codeql-bundle-v2.26.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/f58f0d11ebf5dedd870fab2f999275f7602cfa46\"\u003e\u003ccode\u003ef58f0d1\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3973\"\u003e#3973\u003c/a\u003e\nfrom github/mbg/repo-props/config-file-shorthands\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/7dc37cbb5b3e37f0e1cd1f18b61e0ea849898fb8\"\u003e\u003ccode\u003e7dc37cb\u003c/code\u003e\u003c/a\u003e\nMerge remote-tracking branch \u0027origin/main\u0027 into\nmbg/repo-props/config-file-sh...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/8e22350a7e28c34c82a5a499fc241923301c2c4f\"\u003e\u003ccode\u003e8e22350\u003c/code\u003e\u003c/a\u003e\nThread \u003ccode\u003eActionState\u003c/code\u003e to \u003ccode\u003einitConfig\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/69c9e8c7d918cf2fee13b8b72fdde15883ff155b\"\u003e\u003ccode\u003e69c9e8c\u003c/code\u003e\u003c/a\u003e\nMark some \u003ccode\u003estatus-report\u003c/code\u003e imports as \u003ccode\u003etype\u003c/code\u003e-only\nto avoid circular dependencies\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "502666433f77439bece5b4c5c7e67bff90af2350",
      "tree": "ad88cb319004b79ce1ece4836318b35f3e3c869f",
      "parents": [
        "6ef84b5c64c698487e2fc28a397157f28eb8422f"
      ],
      "author": {
        "name": "Arseniy Obolenskiy",
        "email": "arseniy.obolenskiy@amd.com",
        "time": "Thu Jul 09 19:24:16 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 09 19:24:16 2026"
      },
      "message": "[val] Allow Generic casts to/from CodeSectionINTEL storage class (#6787)\n\nresolves https://github.com/KhronosGroup/SPIRV-Tools/issues/6700"
    },
    {
      "commit": "6ef84b5c64c698487e2fc28a397157f28eb8422f",
      "tree": "8019caaf5cfc29ce08ca6640af7e56ae0346f3a9",
      "parents": [
        "f877466a5d2a08685e746af5c859ed4ae469218f"
      ],
      "author": {
        "name": "Arseniy Obolenskiy",
        "email": "arseniy.obolenskiy@amd.com",
        "time": "Thu Jul 09 15:58:58 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 09 15:58:58 2026"
      },
      "message": "[val] Do not reject OpExtInst for BFloat16/FP8 result types (#6734)\n\nNeeded for https://github.com/llvm/llvm-project/pull/202859"
    },
    {
      "commit": "f877466a5d2a08685e746af5c859ed4ae469218f",
      "tree": "416fb6c23d050707ddb9443f9c83338c2f5f25f1",
      "parents": [
        "b707790a898e44038547df54580022fc1cf89c3d"
      ],
      "author": {
        "name": "Wooyoung Kim",
        "email": "wooykim@qti.qualcomm.com",
        "time": "Thu Jul 09 15:07:27 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 09 15:07:27 2026"
      },
      "message": "SPV_QCOM_image_processing3 (#6672)\n\nValidation support for SPV_QCOM_image_processing3"
    },
    {
      "commit": "b707790a898e44038547df54580022fc1cf89c3d",
      "tree": "7fd17032635fe47f2f2050827b27bb2e5b3becab",
      "parents": [
        "48bd3e9d0c91be4aac0aa5f44dba7e8b97dbc154"
      ],
      "author": {
        "name": "Natalie Chouinard",
        "email": "sudonatalie@google.com",
        "time": "Wed Jul 08 19:46:47 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 08 19:46:47 2026"
      },
      "message": "Prepare release v2026.3 (#6784)\n\nRoll external/googletest/ 8b5333659..8240fa7d6 (8 commits)\n\nhttps://github.com/google/googletest/compare/8b53336594cc...8240fa7d62f7\n\nCreated with:\n  roll-dep external/googletest\n\nRoll external/abseil_cpp/ 35b9f25ba..db1bdc86e (37 commits)\n\nhttps://github.com/abseil/abseil-cpp/compare/35b9f25ba74a...db1bdc86effd\n\nCreated with:\n  roll-dep external/abseil_cpp\n\nRoll external/spirv-headers/ 8d56066ee..29981f652 (3 commits)\n\n\nhttps://github.com/KhronosGroup/SPIRV-Headers/compare/8d56066eee52...29981f652416\n\nCreated with:\n  roll-dep external/spirv-headers"
    },
    {
      "commit": "48bd3e9d0c91be4aac0aa5f44dba7e8b97dbc154",
      "tree": "2e97d97d1dd7fa94f3d3eaeba1bf514439aa5b85",
      "parents": [
        "87a678a9c23b6ae5de8659d7f2639714e37b8b17"
      ],
      "author": {
        "name": "David Neto",
        "email": "dneto@google.com",
        "time": "Mon Jul 06 22:50:22 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 22:50:22 2026"
      },
      "message": "Use FloatEquals on one remaining float equality test (#6783)\n\nThis accommodates environments that warn on float point equality\ncomparisons."
    },
    {
      "commit": "87a678a9c23b6ae5de8659d7f2639714e37b8b17",
      "tree": "1b3b56e6bb22907b0c6105dbef006292cc71d14a",
      "parents": [
        "a14486e06742ee09bc7db68d3afa94ffe2d3f20c"
      ],
      "author": {
        "name": "Spencer Fricke",
        "email": "115671160+spencer-lunarg@users.noreply.github.com",
        "time": "Mon Jul 06 19:29:03 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 19:29:03 2026"
      },
      "message": "spirv-val: Fix OpBufferPointerEXT Explicit Layout (#6709)\n\nTaken out of https://github.com/KhronosGroup/SPIRV-Tools/pull/6701/files\nas we just approved\nhttps://gitlab.khronos.org/vulkan/vulkan/-/merge_requests/8305"
    },
    {
      "commit": "a14486e06742ee09bc7db68d3afa94ffe2d3f20c",
      "tree": "c8aaa0e9986a32295894ca923f831c8542f9ab1f",
      "parents": [
        "891df4cab0da905a9d22231b4e239552022911f0"
      ],
      "author": {
        "name": "Spencer Fricke",
        "email": "115671160+spencer-lunarg@users.noreply.github.com",
        "time": "Sat Jul 04 23:33:02 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Jul 04 23:33:02 2026"
      },
      "message": "spirv-val: Add VUID for SPV_EXT_ocp_microscaling_types (#6779)\n\ncloses https://github.com/KhronosGroup/SPIRV-Tools/issues/6774"
    },
    {
      "commit": "891df4cab0da905a9d22231b4e239552022911f0",
      "tree": "c1e353a2ca5a5cf1c561864d0754907c750841fd",
      "parents": [
        "114d39f512d4c551e9499b8f057cc6b4e879cdb0"
      ],
      "author": {
        "name": "alan-baker",
        "email": "alanbaker@google.com",
        "time": "Sat Jul 04 21:17:07 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Jul 04 21:17:07 2026"
      },
      "message": "Fix array length validation (#6777)\n\nFixes https://crbug.com/oss-fuzz/529845250\n\n* Fix a segfault from nullptr deref when an operand with no type id is\npassed as the pointer operand"
    },
    {
      "commit": "114d39f512d4c551e9499b8f057cc6b4e879cdb0",
      "tree": "d8e664b7f005d2310ff8131fd75e6db96508facf",
      "parents": [
        "62fee34702d5cf1f862f54c6c2b0bb3994c6a1f7"
      ],
      "author": {
        "name": "Wooyoung Kim",
        "email": "wooykim@qti.qualcomm.com",
        "time": "Sat Jul 04 14:58:51 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Jul 04 14:58:51 2026"
      },
      "message": "SPV_QCOM_multiple_wait_queues (#6671)"
    },
    {
      "commit": "62fee34702d5cf1f862f54c6c2b0bb3994c6a1f7",
      "tree": "8031bfe454d5d3cb189cae093f7b1b433ae784da",
      "parents": [
        "7fa1f024cf86890b2f9ac2aab19d0583cea59277"
      ],
      "author": {
        "name": "David Neto",
        "email": "dneto@google.com",
        "time": "Fri Jul 03 22:23:07 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 03 22:23:07 2026"
      },
      "message": "hex-float: adapt to strict fp compilation options (#6778)\n\n- avoid implicit conversions from float to double\n- guard floating point equality checks with pragmas"
    },
    {
      "commit": "7fa1f024cf86890b2f9ac2aab19d0583cea59277",
      "tree": "cf34ced72175a5e6a5eef36482bc25117bc2857b",
      "parents": [
        "667f063adc0236664519d72d3f6d9ffd08afc757"
      ],
      "author": {
        "name": "David Neto",
        "email": "dneto@google.com",
        "time": "Fri Jul 03 16:50:28 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 03 16:50:28 2026"
      },
      "message": "assembler, disassembler support fo SPV_QCOM_image_processing3 (#6776)\n\nAddes new operand type SPV_OPERAND_TYPE_GATHER_MODES. This is not\nactually used since the gather mode operand is provided as an ID."
    },
    {
      "commit": "667f063adc0236664519d72d3f6d9ffd08afc757",
      "tree": "3fc5940cde3eb79bab38a5fd4037ba66cc60c65a",
      "parents": [
        "f80351511e9c4672e284842c7b124315c511078a"
      ],
      "author": {
        "name": "David Neto",
        "email": "dneto@google.com",
        "time": "Thu Jul 02 20:10:39 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 02 20:10:39 2026"
      },
      "message": "bazel: bump bazel_dep versions to latest releases (#6773)"
    },
    {
      "commit": "f80351511e9c4672e284842c7b124315c511078a",
      "tree": "2d4f8c769fca1d8f154e3a93bc460fe8f67d430e",
      "parents": [
        "cbcd15add9bac4c652203f05f159a13cb7cd652d"
      ],
      "author": {
        "name": "Kévin Petit",
        "email": "kevin.petit@arm.com",
        "time": "Thu Jul 02 19:31:17 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 02 19:31:17 2026"
      },
      "message": "Add support for SPV_EXT_ocp_microscaling_types (#6772)\n\nCo-authored-by: Kevin Petit \u003ckevin.petit@arm.com\u003e\nCo-authored-by: Guillaume Trebuchet \u003cguillaume.trebuchet@arm.com\u003e\n\n---------\n\nSigned-off-by: Kevin Petit \u003ckevin.petit@arm.com\u003e\nSigned-off-by: Guillaume Trebuchet \u003cguillaume.trebuchet@arm.com\u003e\nCo-authored-by: David Neto \u003cdneto@google.com\u003e"
    },
    {
      "commit": "cbcd15add9bac4c652203f05f159a13cb7cd652d",
      "tree": "51d89401d68022a90b6d58d2c8c34573fe0c2db4",
      "parents": [
        "91e89a94297f63c81939023e03500031958df532"
      ],
      "author": {
        "name": "David Neto",
        "email": "dneto@google.com",
        "time": "Tue Jun 30 21:32:06 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 30 21:32:06 2026"
      },
      "message": "github workflows: tighten security (#6770)\n\n- don\u0027t persist credentials when using actions/checkout\n- use GITHUB_REF_NAME instead of github.ref_name expansion.\n\n\ncrbug.com/529861263"
    },
    {
      "commit": "91e89a94297f63c81939023e03500031958df532",
      "tree": "9923ae16a1fce74b63815e3d0ef401934deab29e",
      "parents": [
        "d5bbf95d87dd6d2694fbf09acfb42a00c93575e8"
      ],
      "author": {
        "name": "Viktoria Maximova",
        "email": "viktoria.maksimova@intel.com",
        "time": "Tue Jun 30 13:04:55 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 30 13:04:55 2026"
      },
      "message": "[val] Allow untyped access chains in OpSpecConstantOp (#6768)\n\nSPV_KHR_untyped_pointers allows the following opcodes to be used in\n`OpSpecConstantOp` with the `Kernel` capability:\n* `OpUntypedAccessChainKHR`\n* `OpUntypedInBoundsAccessChainKHR`\n* `OpUntypedPtrAccessChainKHR`\n* `OpUntypedInBoundsPtrAccessChainKHR`\n\nContributes to #6564"
    },
    {
      "commit": "d5bbf95d87dd6d2694fbf09acfb42a00c93575e8",
      "tree": "9383c2e74373c0ec141996dba93c0edf8e1ed518",
      "parents": [
        "f25a3b067eed21f6ce43186942eec3c407cade02"
      ],
      "author": {
        "name": "github-actions[bot]",
        "email": "41898282+github-actions[bot]@users.noreply.github.com",
        "time": "Mon Jun 29 13:21:29 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 13:21:29 2026"
      },
      "message": "Roll external/abseil_cpp/ 0300f0d67..35b9f25ba (6 commits) (#6766)\n\nhttps://github.com/abseil/abseil-cpp/compare/0300f0d679b2...35b9f25ba74a\n\nCreated with:\n  roll-dep external/abseil_cpp\n\nCo-authored-by: GitHub Actions[bot] \u003c\u003e"
    },
    {
      "commit": "f25a3b067eed21f6ce43186942eec3c407cade02",
      "tree": "0b2d2c23766f803d5b6923c22f0b0a8451d1969c",
      "parents": [
        "eb5b9970f54bdc56ee957cf4b1306ed8dcb7af4c"
      ],
      "author": {
        "name": "Steven Perron",
        "email": "stevenperron@google.com",
        "time": "Fri Jun 26 18:49:34 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 26 18:49:34 2026"
      },
      "message": "spirv-opt: Invalidate analyses in DeadBranchElimPass (#6764)\n\nInvalidate kAnalysisCFG, kAnalysisDominatorAnalysis, and\nkAnalysisStructuredCFG\nanalyses when DeadBranchElimPass makes changes to basic blocks. This\nforces\nFixBlockOrder() to rebuild them rather than using stale caches\ncontaining\ndeleted basic block references.\n\nFixes #6632"
    },
    {
      "commit": "eb5b9970f54bdc56ee957cf4b1306ed8dcb7af4c",
      "tree": "abf26f5f38e98d287c3cbb782161b9bc77683c56",
      "parents": [
        "74d3c74c919298b1a5b7f6f1083d0d4b28c7ac2d"
      ],
      "author": {
        "name": "Steven Perron",
        "email": "stevenperron@google.com",
        "time": "Fri Jun 26 17:34:50 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 26 17:34:50 2026"
      },
      "message": "Fix unbounded memory usage in FriendlyNameMapper (#6763)\n\nLimit the size of friendly names suggested by FriendlyNameMapper to a\nmaximum of 256 characters. Suggested names exceeding this limit will\nfall back to the string representation of the instruction ID to prevent\nOOM vulnerability caused by recursive OpTypeArray definitions.\n\nFixes #6756"
    },
    {
      "commit": "74d3c74c919298b1a5b7f6f1083d0d4b28c7ac2d",
      "tree": "c3a3bfda491434a29439d5e701da278d56942c87",
      "parents": [
        "a55f5cf60de9496372557836bc8ee5765ba7add1"
      ],
      "author": {
        "name": "jmestwa-coder",
        "email": "jmestwa@gmail.com",
        "time": "Fri Jun 26 13:36:13 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 26 13:36:13 2026"
      },
      "message": "cast to unsigned char before ctype calls on untrusted input (#6740)\n\nctype functions get a plain `char` that can be negative when the byte is\n\u003e\u003d 0x80, which is undefined for everything but unsigned char and EOF:\n- text.cpp `spvIsValidIDCharacter` and spirv_target_env.cpp version scan\nrun over raw assembly text\n- the spec-constant and sampled-image option parsers walk an arbitrary\n`const char*`\n- io.cpp hex tokenizer feeds file bytes straight into\nisspace/tolower/isxdigit\ncast each argument to unsigned char at the call site. hex_float.h\nalready does the right thing via istream::peek (returns int) so it is\nleft alone."
    },
    {
      "commit": "a55f5cf60de9496372557836bc8ee5765ba7add1",
      "tree": "3b452e775e3386df469109fa221b764d78f319b2",
      "parents": [
        "5befd211432adbde96c71b02037630b1e6ca1012"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Jun 26 13:31:19 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 26 13:31:19 2026"
      },
      "message": "build(deps): bump actions/cache from 5.0.5 to 6.0.0 in the github-actions group across 1 directory (#6760)\n\nBumps the github-actions group with 1 update in the / directory:\n[actions/cache](https://github.com/actions/cache).\n\nUpdates `actions/cache` from 5.0.5 to 6.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/cache/releases\"\u003eactions/cache\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate packages, migrate to ESM by \u003ca\nhref\u003d\"https://github.com/Samirat\"\u003e\u003ccode\u003e@​Samirat\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/pull/1760\"\u003eactions/cache#1760\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/cache/compare/v5...v6.0.0\"\u003ehttps://github.com/actions/cache/compare/v5...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/cache/blob/main/RELEASES.md\"\u003eactions/cache\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleases\u003c/h1\u003e\n\u003ch2\u003eHow to prepare a release\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\nRelevant for maintainers with write access only.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003col\u003e\n\u003cli\u003eSwitch to a new branch from \u003ccode\u003emain\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003enpm test\u003c/code\u003e to ensure all tests are passing.\u003c/li\u003e\n\u003cli\u003eUpdate the version in \u003ca\nhref\u003d\"https://github.com/actions/cache/blob/main/package.json\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/package.json\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003enpm run build\u003c/code\u003e to update the compiled files.\u003c/li\u003e\n\u003cli\u003eUpdate this \u003ca\nhref\u003d\"https://github.com/actions/cache/blob/main/RELEASES.md\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/RELEASES.md\u003c/code\u003e\u003c/a\u003e\nwith the new version and changes in the \u003ccode\u003e## Changelog\u003c/code\u003e\nsection.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003elicensed cache\u003c/code\u003e to update the license report.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003elicensed status\u003c/code\u003e and resolve any warnings by\nupdating the \u003ca\nhref\u003d\"https://github.com/actions/cache/blob/main/.licensed.yml\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/.licensed.yml\u003c/code\u003e\u003c/a\u003e\nfile with the exceptions.\u003c/li\u003e\n\u003cli\u003eCommit your changes and push your branch upstream.\u003c/li\u003e\n\u003cli\u003eOpen a pull request against \u003ccode\u003emain\u003c/code\u003e and get it reviewed\nand merged.\u003c/li\u003e\n\u003cli\u003eDraft a new release \u003ca\nhref\u003d\"https://github.com/actions/cache/releases\"\u003ehttps://github.com/actions/cache/releases\u003c/a\u003e\nuse the same version number used in \u003ccode\u003epackage.json\u003c/code\u003e\n\u003col\u003e\n\u003cli\u003eCreate a new tag with the version number.\u003c/li\u003e\n\u003cli\u003eAuto generate release notes and update them to match the changes you\nmade in \u003ccode\u003eRELEASES.md\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eToggle the set as the latest release option.\u003c/li\u003e\n\u003cli\u003ePublish the release.\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/li\u003e\n\u003cli\u003eNavigate to \u003ca\nhref\u003d\"https://github.com/actions/cache/actions/workflows/release-new-action-version.yml\"\u003ehttps://github.com/actions/cache/actions/workflows/release-new-action-version.yml\u003c/a\u003e\n\u003col\u003e\n\u003cli\u003eThere should be a workflow run queued with the same version\nnumber.\u003c/li\u003e\n\u003cli\u003eApprove the run to publish the new version and update the major tags\nfor this action.\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2\u003eChangelog\u003c/h2\u003e\n\u003ch3\u003e6.1.0\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/cache\u003c/code\u003e to v6.1.0 to pick up \u003ca\nhref\u003d\"https://redirect.github.com/actions/toolkit/pull/2435\"\u003eactions/toolkit#2435\nHandle cache write error due to read-only token\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSwitch redundant \u0026quot;Cache save failed\u0026quot; warning to debug log\nin save-only\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e6.0.0\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated \u003ccode\u003e@actions/cache\u003c/code\u003e to ^6.0.1,\n\u003ccode\u003e@actions/core\u003c/code\u003e to ^3.0.1, \u003ccode\u003e@actions/exec\u003c/code\u003e to\n^3.0.0, \u003ccode\u003e@actions/io\u003c/code\u003e to ^3.0.2\u003c/li\u003e\n\u003cli\u003eMigrated to ESM module system\u003c/li\u003e\n\u003cli\u003eUpgraded Jest to v30 and test infrastructure to be ESM\ncompatible\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.4\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eminimatch\u003c/code\u003e to v3.1.5 (fixes ReDoS via globstar\npatterns)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to v6.24.1 (WebSocket decompression bomb\nprotection, header validation fixes)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003efast-xml-parser\u003c/code\u003e to v5.5.6\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.3\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/cache\u003c/code\u003e to v5.0.5 (Resolves: \u003ca\nhref\u003d\"https://github.com/actions/cache/security/dependabot/33\"\u003ehttps://github.com/actions/cache/security/dependabot/33\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/core\u003c/code\u003e to v2.0.3\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.2\u003c/h3\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8\"\u003e\u003ccode\u003e2c8a9bd\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/issues/1760\"\u003e#1760\u003c/a\u003e\nfrom actions/samirat/esm_migration_and_package_update\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023\"\u003e\u003ccode\u003ee9b91fd\u003c/code\u003e\u003c/a\u003e\nPrettier fixes\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb\"\u003e\u003ccode\u003ee4884b8\u003c/code\u003e\u003c/a\u003e\nRebuild dist\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f\"\u003e\u003ccode\u003e10baf01\u003c/code\u003e\u003c/a\u003e\nFixed licenses\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37\"\u003e\u003ccode\u003ee39b386\u003c/code\u003e\u003c/a\u003e\nFix test mock return order\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06\"\u003e\u003ccode\u003eb692820\u003c/code\u003e\u003c/a\u003e\nPR feedback\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1\"\u003e\u003ccode\u003e6074912\u003c/code\u003e\u003c/a\u003e\nRebuild dist bundles as ESM to match type:module\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e\"\u003e\u003ccode\u003e5a912e8\u003c/code\u003e\u003c/a\u003e\nFix lint and jest issues\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/b9bf592b98b6a5d0cad9929c76247de1cac78abe\"\u003e\u003ccode\u003eb9bf592\u003c/code\u003e\u003c/a\u003e\nUpdate documentation for v6 release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/80f777761d0990932f64ed2740522d7226a49062\"\u003e\u003ccode\u003e80f7777\u003c/code\u003e\u003c/a\u003e\nUpdate packages, migrate to ESM\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...2c8a9bd7457de244a408f35966fab2fb45fda9c8\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "5befd211432adbde96c71b02037630b1e6ca1012",
      "tree": "d05eb676b889ad87624f3692b6e6e04a106c5c12",
      "parents": [
        "7db050bf022d203df651f8daa3e4542fdc2a8aea"
      ],
      "author": {
        "name": "github-actions[bot]",
        "email": "41898282+github-actions[bot]@users.noreply.github.com",
        "time": "Fri Jun 26 12:34:10 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 26 12:34:10 2026"
      },
      "message": "Roll external/abseil_cpp/ 3b33f7fd5..0300f0d67 (2 commits) (#6761)\n\nhttps://github.com/abseil/abseil-cpp/compare/3b33f7fd5c9b...0300f0d679b2\n\nCreated with:\n  roll-dep external/abseil_cpp\n\nCo-authored-by: GitHub Actions[bot] \u003c\u003e"
    },
    {
      "commit": "7db050bf022d203df651f8daa3e4542fdc2a8aea",
      "tree": "388e9aa6898bc3950be09654ea58f505128798fa",
      "parents": [
        "f014211c2d16408ff9673b052de90ac4b1602fdc"
      ],
      "author": {
        "name": "github-actions[bot]",
        "email": "41898282+github-actions[bot]@users.noreply.github.com",
        "time": "Thu Jun 25 20:20:12 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jun 25 20:20:12 2026"
      },
      "message": "roll deps (#6759)\n\n- **Roll external/googletest/ 1fc11dea1..8b5333659 (2 commits)**\n- **Roll external/abseil_cpp/ 41253e45e..de672d07f (5 commits)**\n\n---------\n\nCo-authored-by: GitHub Actions[bot] \u003c\u003e"
    },
    {
      "commit": "f014211c2d16408ff9673b052de90ac4b1602fdc",
      "tree": "e58db762e0e7a2e3a584ec40647bfebcfea0499f",
      "parents": [
        "12f9d942a7b19c039bbf2a18b84a36bb7b12664a"
      ],
      "author": {
        "name": "vperus",
        "email": "vperus@gmail.com",
        "time": "Tue Jun 23 19:02:22 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 23 19:02:22 2026"
      },
      "message": "disasm: Avoid copying string with passing by reference (#6757)\n\nChange from value to reference argument passing and store line string\nvalue in local value to avoid allocating memory twice."
    },
    {
      "commit": "12f9d942a7b19c039bbf2a18b84a36bb7b12664a",
      "tree": "32b21e04e75ea7cfac61a46ee6a8a4b7b108102a",
      "parents": [
        "58fe144fdc8847b303be51d4f8fcc9e7da17056e"
      ],
      "author": {
        "name": "github-actions[bot]",
        "email": "41898282+github-actions[bot]@users.noreply.github.com",
        "time": "Tue Jun 23 14:48:28 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 23 14:48:28 2026"
      },
      "message": "roll deps (#6758)\n\n- **Roll external/googletest/ 0b1e895ba..1fc11dea1 (1 commit)**\n- **Roll external/abseil_cpp/ ce2e0bc69..41253e45e (3 commits)**\n\n---------\n\nCo-authored-by: GitHub Actions[bot] \u003c\u003e"
    },
    {
      "commit": "58fe144fdc8847b303be51d4f8fcc9e7da17056e",
      "tree": "439ddb5950d1146c2c5a9d3274fbe7721c13ac7a",
      "parents": [
        "b9250830dd7aa056bb94464cd978a40564028cf2"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Jun 19 18:27:01 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 19 18:27:01 2026"
      },
      "message": "build(deps): bump the github-actions group with 2 updates (#6753)\n\nBumps the github-actions group with 2 updates:\n[actions/checkout](https://github.com/actions/checkout) and\n[lukka/get-cmake](https://github.com/lukka/get-cmake).\n\nUpdates `actions/checkout` from 6.0.3 to 7.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/checkout/releases\"\u003eactions/checkout\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eblock checking out fork pr for pull_request_target and workflow_run\nby \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the\nminor-actions-dependencies group across 1 directory by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2458\"\u003eactions/checkout#2458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.1 to 3.4.2 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2460\"\u003eactions/checkout#2460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.2.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2461\"\u003eactions/checkout#2461\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e and\n\u003ccode\u003e@​actions/tool-cache\u003c/code\u003e and Remove uuid by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2459\"\u003eactions/checkout#2459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade module to esm and update dependencies by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2463\"\u003eactions/checkout#2463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 3\nupdates by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2462\"\u003eactions/checkout#2462\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003egetting ready for checkout v7 release by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2464\"\u003eactions/checkout#2464\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate error wording by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2467\"\u003eactions/checkout#2467\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/checkout/compare/v6.0.3...v7.0.0\"\u003ehttps://github.com/actions/checkout/compare/v6.0.3...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock checking out fork PR for pull_request_target and workflow_run\nby \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the\nminor-actions-dependencies group across 1 directory by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2458\"\u003eactions/checkout#2458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.1 to 3.4.2 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2460\"\u003eactions/checkout#2460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.2.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2461\"\u003eactions/checkout#2461\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e and\n\u003ccode\u003e@​actions/tool-cache\u003c/code\u003e and Remove uuid by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2459\"\u003eactions/checkout#2459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade module to esm and update dependencies by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2463\"\u003eactions/checkout#2463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 3\nupdates by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2462\"\u003eactions/checkout#2462\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca\nhref\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca\nhref\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements\nby \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca\nhref\u003d\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca\nhref\u003d\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca\nhref\u003d\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca\nhref\u003d\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca\nhref\u003d\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca\nhref\u003d\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment\nvariables by \u003ca href\u003d\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca\nhref\u003d\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca\nhref\u003d\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0\"\u003e\u003ccode\u003e9c091bb\u003c/code\u003e\u003c/a\u003e\nupdate error wording (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2467\"\u003e#2467\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a\"\u003e\u003ccode\u003e1044a6d\u003c/code\u003e\u003c/a\u003e\ngetting ready for checkout v7 release (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2464\"\u003e#2464\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f\"\u003e\u003ccode\u003ef028218\u003c/code\u003e\u003c/a\u003e\nBump the minor-npm-dependencies group across 1 directory with 3 updates\n(\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2462\"\u003e#2462\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d\"\u003e\u003ccode\u003ed914b26\u003c/code\u003e\u003c/a\u003e\nupgrade module to esm and update dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2463\"\u003e#2463\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d\"\u003e\u003ccode\u003e537c7ef\u003c/code\u003e\u003c/a\u003e\nBump \u003ccode\u003e@​actions/core\u003c/code\u003e and \u003ccode\u003e@​actions/tool-cache\u003c/code\u003e\nand Remove uuid (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2459\"\u003e#2459\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6\"\u003e\u003ccode\u003e130a169\u003c/code\u003e\u003c/a\u003e\nBump js-yaml from 4.1.0 to 4.2.0 (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2461\"\u003e#2461\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3\"\u003e\u003ccode\u003e7d09575\u003c/code\u003e\u003c/a\u003e\nBump flatted from 3.3.1 to 3.4.2 (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2460\"\u003e#2460\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e\"\u003e\u003ccode\u003e0f9f3aa\u003c/code\u003e\u003c/a\u003e\nBump actions/publish-immutable-action (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2458\"\u003e#2458\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7\"\u003e\u003ccode\u003ef9e715a\u003c/code\u003e\u003c/a\u003e\nblock checking out fork pr for pull_request_target and workflow_run (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2454\"\u003e#2454\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `lukka/get-cmake` from 4.3.3 to 4.3.4\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/commit/f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9\"\u003e\u003ccode\u003ef5b8fbb\u003c/code\u003e\u003c/a\u003e\nNew CMake version(s): cmake-v4.3.4cmake-rc-v4.4.0-rc2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/commit/033b1fec76074854546b62b7082085c6c4666668\"\u003e\u003ccode\u003e033b1fe\u003c/code\u003e\u003c/a\u003e\nNew CMake version(s): cmake-rc-v4.4.0-rc1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/commit/6d69ef55f2a444126e5f212d09cd8b390149194b\"\u003e\u003ccode\u003e6d69ef5\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 7 to 8\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/compare/591817e96fcad43505fb4eae36172462abb3a42e...f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s major version (unless you unignore this specific\ndependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s minor version (unless you unignore this specific\ndependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR\nand stop Dependabot creating any more for the specific dependency\n(unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore\nconditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will\nremove the ignore condition of the specified dependency and ignore\nconditions\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "b9250830dd7aa056bb94464cd978a40564028cf2",
      "tree": "2070a96eecc95c9a1c949c66f442d390e6694d79",
      "parents": [
        "392a28049f42b7a44d5d4d16e1ddc5bae4df0dbb"
      ],
      "author": {
        "name": "github-actions[bot]",
        "email": "41898282+github-actions[bot]@users.noreply.github.com",
        "time": "Fri Jun 19 13:14:38 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 19 13:14:38 2026"
      },
      "message": "roll deps (#6751)\n\n- **Roll external/abseil_cpp/ cb9a36d73..2de04920e (2 commits)**\n- **Roll external/spirv-headers/ 8c5559c13..c63848ecf (2 commits)**\n\n---------\n\nCo-authored-by: GitHub Actions[bot] \u003c\u003e"
    },
    {
      "commit": "392a28049f42b7a44d5d4d16e1ddc5bae4df0dbb",
      "tree": "f1f0ffe2698d573b5a0f1a588594cc0b3cf3f393",
      "parents": [
        "113784c9cf103b775fdadb1ef194f6b963e24a7e"
      ],
      "author": {
        "name": "Kévin Petit",
        "email": "kevin.petit@arm.com",
        "time": "Fri Jun 19 13:14:00 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 19 13:14:00 2026"
      },
      "message": "spirv-val: forbid multiple graph entry points with the same name (#6754)\n\nSpecification update:\nhttps://github.com/KhronosGroup/SPIRV-Registry/pull/426\n\nSigned-off-by: Kevin Petit \u003ckevin.petit@arm.com\u003e"
    },
    {
      "commit": "113784c9cf103b775fdadb1ef194f6b963e24a7e",
      "tree": "69d261ddbdad1192623a628e8844c10efb11507b",
      "parents": [
        "ee4f6beddb14cf6e9259288b86625405b4cdc4e1"
      ],
      "author": {
        "name": "Spencer Fricke",
        "email": "115671160+spencer-lunarg@users.noreply.github.com",
        "time": "Wed Jun 17 21:49:36 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 17 21:49:36 2026"
      },
      "message": "spirv-val: Allow DebugInfoNone (#6749)\n\ncloses https://github.com/KhronosGroup/SPIRV-Tools/issues/6744"
    },
    {
      "commit": "ee4f6beddb14cf6e9259288b86625405b4cdc4e1",
      "tree": "3664cd66068f1b11faec3120dc15800f726cfb25",
      "parents": [
        "b0333e73bb549971c3dd4a811b87d4344a5ccd7f"
      ],
      "author": {
        "name": "Wooyoung Kim",
        "email": "wooykim@qti.qualcomm.com",
        "time": "Wed Jun 17 17:32:57 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 17 17:32:57 2026"
      },
      "message": "Add support for SPV_EXT_split_barrier (#6732)"
    },
    {
      "commit": "b0333e73bb549971c3dd4a811b87d4344a5ccd7f",
      "tree": "2be70aed360855bbdca8cdf7a08bb3c47ea8239f",
      "parents": [
        "34ef6a32d05e367f526c39e907176831d6b4a8e3"
      ],
      "author": {
        "name": "David Neto",
        "email": "dneto@google.com",
        "time": "Wed Jun 17 13:45:34 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 17 13:45:34 2026"
      },
      "message": "kokoro: test spirv-fuzz in cmake linux clang release configs (#6745)\n\nThis exercises the protobuf dependency.\n\nAlso, when building with cmake release builds, use Release instead of\nRelWithDebInfo to save time."
    },
    {
      "commit": "34ef6a32d05e367f526c39e907176831d6b4a8e3",
      "tree": "8583789416760d9ae0afc40b0733a48d414f1ebe",
      "parents": [
        "df5532b1581d5fe304400d0ad1273c8d4d788d03"
      ],
      "author": {
        "name": "github-actions[bot]",
        "email": "41898282+github-actions[bot]@users.noreply.github.com",
        "time": "Wed Jun 17 13:26:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 17 13:26:15 2026"
      },
      "message": "roll deps (#6747)\n\n- **Roll external/googletest/ 7140cd416..0b1e895ba (2 commits)**\n- **Roll external/abseil_cpp/ 1b2acc1a0..cb9a36d73 (3 commits)**\n\n---------\n\nCo-authored-by: GitHub Actions[bot] \u003c\u003e"
    },
    {
      "commit": "df5532b1581d5fe304400d0ad1273c8d4d788d03",
      "tree": "082fda5f5da56897e6fcdbd7c6c20f3c0b59c132",
      "parents": [
        "12a6f05b92753f1cbbbc9e13612adc4c7b1c0c72"
      ],
      "author": {
        "name": "David Neto",
        "email": "dneto@google.com",
        "time": "Tue Jun 16 20:24:05 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 16 20:24:05 2026"
      },
      "message": "update protobuf to recent release (#6743)\n\nIn the source/fuzz CMake rules, use a generator expression to hide the\nlink dependency on libprotobuf from exports. This seems to be needed\nnow."
    },
    {
      "commit": "12a6f05b92753f1cbbbc9e13612adc4c7b1c0c72",
      "tree": "6782d96066cd569fef6db80a06bc376138e88476",
      "parents": [
        "8189ae82087ab8289bfcda9ed30d940b9d0649f9"
      ],
      "author": {
        "name": "github-actions[bot]",
        "email": "41898282+github-actions[bot]@users.noreply.github.com",
        "time": "Tue Jun 16 03:56:10 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 16 03:56:10 2026"
      },
      "message": "Roll external/abseil_cpp/ dbf88f932..b6c181695 (1 commit) (#6737)\n\nhttps://github.com/abseil/abseil-cpp/compare/dbf88f932096...b6c181695973\n\nCreated with:\n  roll-dep external/abseil_cpp\n\nCo-authored-by: GitHub Actions[bot] \u003c\u003e"
    },
    {
      "commit": "8189ae82087ab8289bfcda9ed30d940b9d0649f9",
      "tree": "81414a74579b5fc334367f8f3ae19532b0a52e0c",
      "parents": [
        "aff64c5dfd79937ab28c7affa24b9d1c3438c033"
      ],
      "author": {
        "name": "David Neto",
        "email": "dneto@google.com",
        "time": "Mon Jun 15 22:25:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 15 22:25:15 2026"
      },
      "message": "bazel flow: force cache regeneration (#6742)\n\nUse a new cache key to force the cache to be regenerated.\n\nFixes: #6741"
    },
    {
      "commit": "aff64c5dfd79937ab28c7affa24b9d1c3438c033",
      "tree": "f20598ca6555c02447a0ae944152ff9577125fbd",
      "parents": [
        "27a67c82a9a573a1f34746b22da1d3ce85274dc3"
      ],
      "author": {
        "name": "Arseniy Obolenskiy",
        "email": "arseniy.obolenskiy@amd.com",
        "time": "Fri Jun 12 19:39:03 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 12 19:39:03 2026"
      },
      "message": "[val] Tie Int64ImageEXT requirement to R64 image format (#6735)\n\nThe capability is required by the R64i/R64ui Image Format operand, not\nby a 64-bit Sampled Type\n\nRelated SPIRV-LLVM-Translator PR that fixes this issue there:\nhttps://github.com/KhronosGroup/SPIRV-LLVM-Translator/pull/3773"
    },
    {
      "commit": "27a67c82a9a573a1f34746b22da1d3ce85274dc3",
      "tree": "3c56b34e4e76e3decf5e510959517fe5f0e1c144",
      "parents": [
        "15f3ee1075170c786e9846abe0eebe315691b843"
      ],
      "author": {
        "name": "github-actions[bot]",
        "email": "41898282+github-actions[bot]@users.noreply.github.com",
        "time": "Fri Jun 12 15:50:40 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 12 15:50:40 2026"
      },
      "message": "roll deps (#6682)\n\n- **Roll external/abseil_cpp/ 30bba8404..5704b72fe (3 commits)**\n- **Roll external/spirv-headers/ 58006c901..98c842bd5 (1 commit)**\n- **Roll external/effcee/ ae38e040c..63394054b (4 commits)**\n\n---------\n\nCo-authored-by: GitHub Actions[bot] \u003c\u003e"
    },
    {
      "commit": "15f3ee1075170c786e9846abe0eebe315691b843",
      "tree": "f66978c413c624b4297d0e950482062c025c089e",
      "parents": [
        "199cb207b911501ddd76dcddf100a6e21c15ef23"
      ],
      "author": {
        "name": "changhwipark-arm",
        "email": "chang-hwi.park@arm.com",
        "time": "Thu Jun 11 14:03:59 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jun 11 14:03:59 2026"
      },
      "message": "[val] Allow TileImageEXT variables to be arrays (#6733)\n\nHandle the case where \u0027tile image variables\u0027 in the following spec refer\nto an `OpTypeArray` to tile images, as pointed out in\nhttps://github.com/KhronosGroup/SPIRV-Tools/issues/6593#issuecomment-4659916241.\n\n\u003e The TileImageEXT Storage Class must only be used for declaring tile\nimage variables"
    },
    {
      "commit": "199cb207b911501ddd76dcddf100a6e21c15ef23",
      "tree": "073113dafb48e53c0bb2b8d61b22d98fa0b82842",
      "parents": [
        "0db9162641d9709c63c92a13e66fd88905180e89"
      ],
      "author": {
        "name": "alan-baker",
        "email": "alanbaker@google.com",
        "time": "Mon Jun 08 21:07:45 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 08 21:07:45 2026"
      },
      "message": "Improve OpSpecConstantOp failure message (#6731)\n\nFixes #6730\n\n* Add a path to suggest the correct opcode for the assembler"
    },
    {
      "commit": "0db9162641d9709c63c92a13e66fd88905180e89",
      "tree": "eb3487497081cbbda4e8b4b4379e0d971b8876e1",
      "parents": [
        "f3f1169512c713d979a7aa1bc0c6c0fd89f0a85f"
      ],
      "author": {
        "name": "alan-baker",
        "email": "alanbaker@google.com",
        "time": "Mon Jun 08 19:42:42 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 08 19:42:42 2026"
      },
      "message": "[opt] Fix folding rule for extract from copy logical (#6725)\n\nFixes #6712\n\n* Added missing vector cases for composite types"
    },
    {
      "commit": "f3f1169512c713d979a7aa1bc0c6c0fd89f0a85f",
      "tree": "4462c4c66ad170b459a3dfa22c312b134f913745",
      "parents": [
        "21605d2b4f2c78e041b07be1c1b76404ceb05a65"
      ],
      "author": {
        "name": "alan-baker",
        "email": "alanbaker@google.com",
        "time": "Fri Jun 05 22:39:38 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 05 22:39:38 2026"
      },
      "message": "[val] Fix ValidateMemory with descriptor heap cap (#6729)\n\nFixes #6728\n\n* FindUntypedBaseVariable didn\u0027t handle loading pointers from pointers\ncorrectly and had an infinite loop\n  * fix those cases\n* Additionally add a filter to the check so it is only checked in\npotentially problematic cases"
    },
    {
      "commit": "21605d2b4f2c78e041b07be1c1b76404ceb05a65",
      "tree": "f240a494346e1773f32f7b632235b841201a670a",
      "parents": [
        "744fe88e240a97b9741ac08be4bf71920f024c7a"
      ],
      "author": {
        "name": "alan-baker",
        "email": "alanbaker@google.com",
        "time": "Fri Jun 05 19:03:43 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 05 19:03:43 2026"
      },
      "message": "[val] Disallow duplicate targets for OpGroupDecorate (#6720)\n\nFix https://crbug.com/oss-fuzz/497811679\n\n* Check for duplicate targets in OpGroupDecorate"
    },
    {
      "commit": "744fe88e240a97b9741ac08be4bf71920f024c7a",
      "tree": "17cba39a571b0d26d1e3c59abeb92b194a2f2b56",
      "parents": [
        "902e360d8e82c4a0015a035b971a5402e23413ca"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Jun 05 18:09:27 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 05 18:09:27 2026"
      },
      "message": "build(deps): bump github/codeql-action from 4.36.1 to 4.36.2 in the github-actions group (#6726)\n\nBumps the github-actions group with 1 update:\n[github/codeql-action](https://github.com/github/codeql-action).\n\nUpdates `github/codeql-action` from 4.36.1 to 4.36.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.36.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCache CodeQL CLI version information across Actions steps. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3943\"\u003e#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReduce requests while waiting for analysis processing by using\nexponential backoff when polling SARIF processing status. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3937\"\u003e#3937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6\"\u003e2.25.6\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3948\"\u003e#3948\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases\npage\u003c/a\u003e for the relevant changes to the CodeQL CLI and language\npacks.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.2 - 04 Jun 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCache CodeQL CLI version information across Actions steps. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3943\"\u003e#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReduce requests while waiting for analysis processing by using\nexponential backoff when polling SARIF processing status. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3937\"\u003e#3937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6\"\u003e2.25.6\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3948\"\u003e#3948\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.36.1 - 02 Jun 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.0 - 22 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle\nversion to 2.19.4. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.5 - 15 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action\nare generated to avoid duplication across bundles and reduce the size of\nthe repository by around 70%. This should have no effect on the runtime\nbehaviour of the CodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e will now only be enabled on a pull request when\ndiff-informed analysis is also enabled for that run. If diff-informed\nanalysis is unavailable (for example, because the PR diff ranges could\nnot be computed), the action will fall back to a full analysis. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal\n\u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will\nbe enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for\nGitHub-internal use only, and may change without notice at any time. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning\nanalysis for a PR with \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have\na cached overlay-base database for the configured languages. This speeds\nup analysis for a repository when there is not yet a cached overlay-base\ndatabase for the latest CLI version. We expect to roll this change out\nto everyone in May. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.4 - 07 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.3 - 01 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for\ncustomers using CodeQL version 2.19.3 and earlier. These versions of\nCodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise\nServer 3.15, and will be unsupported by the next minor release of the\nCodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP\nOIDC are now accepted. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use\n\u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better\ncompatibility with various registry implementations. For NuGet feeds,\nthe test is now always performed against the service index. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same\nmillisecond could overwrite each other on disk, causing one of them to\nbe lost. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.2 - 15 Apr 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled\nusing the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment\nvariable is deprecated and will be removed in May 2026. If you are\naffected by this, we recommend disabling TRAP caching by passing the\n\u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis\nnow only applies to repositories that contain submodules. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library,\nrelying instead on models of the standard library. This should result in\nsignificantly faster extraction and analysis times, while the effect on\nalerts should be minimal. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private\nregistries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/8aad20d150bbac5944a9f9d289da16a4b0d87c1e\"\u003e\u003ccode\u003e8aad20d\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3949\"\u003e#3949\u003c/a\u003e\nfrom github/update-v4.36.2-dcb947ce1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/f521b08cd8f468ab193ea950a589cb2e9c869c6a\"\u003e\u003ccode\u003ef521b08\u003c/code\u003e\u003c/a\u003e\nAdd additional changelog notes\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/8aeff0ffb7b78582ee0d0e6eebb8140684400d08\"\u003e\u003ccode\u003e8aeff0f\u003c/code\u003e\u003c/a\u003e\nUpdate changelog for v4.36.2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/dcb947ce15976d40ea82935510b2db4872ec124c\"\u003e\u003ccode\u003edcb947c\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3948\"\u003e#3948\u003c/a\u003e\nfrom github/update-bundle/codeql-bundle-v2.25.6\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/c251bcefa178f7780f62f150002acffe3d07fde9\"\u003e\u003ccode\u003ec251bce\u003c/code\u003e\u003c/a\u003e\nAdd changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/62953c18b35f59e28351d2f1e806925aef8b1e3c\"\u003e\u003ccode\u003e62953c1\u003c/code\u003e\u003c/a\u003e\nUpdate default bundle to codeql-bundle-v2.25.6\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/423b570baf1976cd7a3daeba5d6e9f9b76432f37\"\u003e\u003ccode\u003e423b570\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3946\"\u003e#3946\u003c/a\u003e\nfrom github/dependabot/npm_and_yarn/npm-minor-5d507a...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/c35d1b164463ee62a100735382aaaa525c5d3496\"\u003e\u003ccode\u003ec35d1b1\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3947\"\u003e#3947\u003c/a\u003e\nfrom github/dependabot/github_actions/dot-github/wor...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/cb1a588b02755b176e7b9d033ed4b69312f0e1bd\"\u003e\u003ccode\u003ecb1a588\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3937\"\u003e#3937\u003c/a\u003e\nfrom github/robertbrignull/waitForProcessing_backoff\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/ba47406412c54532b5b4fcfbaf877c9e2382b206\"\u003e\u003ccode\u003eba47406\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3943\"\u003e#3943\u003c/a\u003e\nfrom github/henrymercer/cache-cli-version-info\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/github/codeql-action/compare/87557b9c84dde89fdd9b10e88954ac2f4248e463...8aad20d150bbac5944a9f9d289da16a4b0d87c1e\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dgithub/codeql-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d4.36.1\u0026new-version\u003d4.36.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s major version (unless you unignore this specific\ndependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s minor version (unless you unignore this specific\ndependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR\nand stop Dependabot creating any more for the specific dependency\n(unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore\nconditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will\nremove the ignore condition of the specified dependency and ignore\nconditions\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "902e360d8e82c4a0015a035b971a5402e23413ca",
      "tree": "f72905bb0e3a61081173476400b1b56abf38e9cc",
      "parents": [
        "9b51d3d78717e29efd75adf1856cdbcc644eda7a"
      ],
      "author": {
        "name": "Kévin Petit",
        "email": "kevin.petit@arm.com",
        "time": "Fri Jun 05 14:13:34 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 05 14:13:34 2026"
      },
      "message": "spirv-opt: clarify declaration of FindNumberOfIterations (#6727)\n\nThis function takes the branch instruction, not the condition\ninstruction as returned by GetConditionInst(). Rename the parameter in\nthe header (the implementation already uses the right name) and update\nthe comment to save the next person discovering this a bit of time.\n\n---------\n\nSigned-off-by: Kevin Petit \u003ckevin.petit@arm.com\u003e\nCo-authored-by: alan-baker \u003calanbaker@google.com\u003e"
    },
    {
      "commit": "9b51d3d78717e29efd75adf1856cdbcc644eda7a",
      "tree": "97df454facb277d2cb988ffa63f5ce58c55a4a83",
      "parents": [
        "62138e5bb72e73a202d2a10360367754f94a621d"
      ],
      "author": {
        "name": "Wooyoung Kim",
        "email": "wooykim@qti.qualcomm.com",
        "time": "Thu Jun 04 13:43:03 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jun 04 13:43:03 2026"
      },
      "message": "SPV_KHR_opacity_micromap (#6670)"
    },
    {
      "commit": "62138e5bb72e73a202d2a10360367754f94a621d",
      "tree": "1b3a5691f3f182a624d9863755d9fdf219e885ef",
      "parents": [
        "df032578c737d361b754fc569b70aa29b5f8c7d4"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Jun 04 13:13:00 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jun 04 13:13:00 2026"
      },
      "message": "build(deps): bump the github-actions group with 2 updates (#6724)\n\nBumps the github-actions group with 2 updates:\n[actions/checkout](https://github.com/actions/checkout) and\n[github/codeql-action](https://github.com/github/codeql-action).\n\nUpdates `actions/checkout` from 6.0.2 to 6.0.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/checkout/releases\"\u003eactions/checkout\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate changelog by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2357\"\u003eactions/checkout#2357\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca\nhref\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca\nhref\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate changelog for v6.0.3 by \u003ca\nhref\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2446\"\u003eactions/checkout#2446\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/checkout/compare/v6...v6.0.3\"\u003ehttps://github.com/actions/checkout/compare/v6...v6.0.3\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca\nhref\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca\nhref\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements\nby \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca\nhref\u003d\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca\nhref\u003d\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca\nhref\u003d\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca\nhref\u003d\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca\nhref\u003d\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca\nhref\u003d\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment\nvariables by \u003ca href\u003d\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca\nhref\u003d\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca\nhref\u003d\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Ref and Commit outputs by \u003ca\nhref\u003d\"https://github.com/lucacome\"\u003e\u003ccode\u003e@​lucacome\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1180\"\u003eactions/checkout#1180\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDependency updates by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e- \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1777\"\u003eactions/checkout#1777\u003c/a\u003e,\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1872\"\u003eactions/checkout#1872\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.1.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 4\nupdates by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1739\"\u003eactions/checkout#1739\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 3 to 4 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1697\"\u003eactions/checkout#1697\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCheck out other refs/* by commit by \u003ca\nhref\u003d\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1774\"\u003eactions/checkout#1774\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10\"\u003e\u003ccode\u003edf4cb1c\u003c/code\u003e\u003c/a\u003e\nUpdate changelog for v6.0.3 (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2446\"\u003e#2446\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/1cce3390c2bfda521930d01229c073c7ff920824\"\u003e\u003ccode\u003e1cce339\u003c/code\u003e\u003c/a\u003e\nFix checkout init for SHA-256 repositories (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2439\"\u003e#2439\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/900f2210b1d28bbbd0bd22d17926b9e224e8f231\"\u003e\u003ccode\u003e900f221\u003c/code\u003e\u003c/a\u003e\nfix: expand merge commit SHA regex and add SHA-256 test cases (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2414\"\u003e#2414\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/0c366fd6a839edf440554fa01a7085ccba70ac98\"\u003e\u003ccode\u003e0c366fd\u003c/code\u003e\u003c/a\u003e\nUpdate changelog (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2357\"\u003e#2357\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 4.36.0 to 4.36.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.36.1\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases\npage\u003c/a\u003e for the relevant changes to the CodeQL CLI and language\npacks.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.1 - 02 Jun 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.0 - 22 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle\nversion to 2.19.4. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.5 - 15 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action\nare generated to avoid duplication across bundles and reduce the size of\nthe repository by around 70%. This should have no effect on the runtime\nbehaviour of the CodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e will now only be enabled on a pull request when\ndiff-informed analysis is also enabled for that run. If diff-informed\nanalysis is unavailable (for example, because the PR diff ranges could\nnot be computed), the action will fall back to a full analysis. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal\n\u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will\nbe enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for\nGitHub-internal use only, and may change without notice at any time. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning\nanalysis for a PR with \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have\na cached overlay-base database for the configured languages. This speeds\nup analysis for a repository when there is not yet a cached overlay-base\ndatabase for the latest CLI version. We expect to roll this change out\nto everyone in May. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.4 - 07 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.3 - 01 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for\ncustomers using CodeQL version 2.19.3 and earlier. These versions of\nCodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise\nServer 3.15, and will be unsupported by the next minor release of the\nCodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP\nOIDC are now accepted. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use\n\u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better\ncompatibility with various registry implementations. For NuGet feeds,\nthe test is now always performed against the service index. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same\nmillisecond could overwrite each other on disk, causing one of them to\nbe lost. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.2 - 15 Apr 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled\nusing the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment\nvariable is deprecated and will be removed in May 2026. If you are\naffected by this, we recommend disabling TRAP caching by passing the\n\u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis\nnow only applies to repositories that contain submodules. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library,\nrelying instead on models of the standard library. This should result in\nsignificantly faster extraction and analysis times, while the effect on\nalerts should be minimal. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private\nregistries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.1 - 27 Mar 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix incorrect minimum required Git version for \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e: it should have been 2.36.0, not 2.11.0. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3781\"\u003e#3781\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.0 - 27 Mar 2026\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/87557b9c84dde89fdd9b10e88954ac2f4248e463\"\u003e\u003ccode\u003e87557b9\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3940\"\u003e#3940\u003c/a\u003e\nfrom github/update-v4.36.1-2a1689ed4\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/94310119648b77e2153bf970fd244062806781de\"\u003e\u003ccode\u003e9431011\u003c/code\u003e\u003c/a\u003e\nUpdate changelog for v4.36.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/2a1689ed43ccdf7eea07e03a75371ce6801d28e6\"\u003e\u003ccode\u003e2a1689e\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3939\"\u003e#3939\u003c/a\u003e\nfrom github/henrymercer/skip-overlay-revert-when-exp...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/524532393a46071bdfc81527a811ffa69e16723a\"\u003e\u003ccode\u003e5245323\u003c/code\u003e\u003c/a\u003e\nDisable missing diff-ranges fallback when overlay enabled manually\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/d1eb1207b45130d2edf64a0aa1c93be23510592f\"\u003e\u003ccode\u003ed1eb120\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3933\"\u003e#3933\u003c/a\u003e\nfrom github/update-supported-enterprise-server-versions\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/115001ba8d0198846992657731666b08686c8ded\"\u003e\u003ccode\u003e115001b\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3934\"\u003e#3934\u003c/a\u003e\nfrom github/dependabot/npm_and_yarn/npm-minor-86fb5c...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/cef2e7a910879f4626a24b251504bde16bfe4e76\"\u003e\u003ccode\u003ecef2e7a\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3925\"\u003e#3925\u003c/a\u003e\nfrom github/dependabot/github_actions/dot-github/wor...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/5e6adf70ed0299cdf20f90e4e37ac5dd30ab7501\"\u003e\u003ccode\u003e5e6adf7\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3936\"\u003e#3936\u003c/a\u003e\nfrom github/dependabot/npm_and_yarn/tmp-0.2.7\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/ad170e6c4eaf671895978420267d6cb49b66b706\"\u003e\u003ccode\u003ead170e6\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027main\u0027 into\ndependabot/github_actions/dot-github/workflows/actio...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/6a37b3a57ac457a679b84930a67c233c15f5ac41\"\u003e\u003ccode\u003e6a37b3a\u003c/code\u003e\u003c/a\u003e\nRebuild\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...87557b9c84dde89fdd9b10e88954ac2f4248e463\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s major version (unless you unignore this specific\ndependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s minor version (unless you unignore this specific\ndependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR\nand stop Dependabot creating any more for the specific dependency\n(unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore\nconditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will\nremove the ignore condition of the specified dependency and ignore\nconditions\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "df032578c737d361b754fc569b70aa29b5f8c7d4",
      "tree": "bf9a890b69b59cc2c17b4a5f58db43dbcf5e594a",
      "parents": [
        "96545708d0fb060ec6d1e67e85de593bcf24dd21"
      ],
      "author": {
        "name": "diddily",
        "email": "diddily@gmail.com",
        "time": "Wed Jun 03 19:00:33 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 03 19:00:33 2026"
      },
      "message": "Fix missing optimization in CodeSinkingPass (#6703)\n\nSet `checked_for_uniform_sync_` after the first scan for uniform memory\nsync instructions in `HasUniformMemorySync`. Since this function is\ncalled for most instructions, this change makes the optimization pass\nO(N) instead of O(N^2). This drastically reduces how long it takes in\ncomplex binaries and fulfills what I assume was the original intent of\n`checked_for_uniform_sync_`."
    },
    {
      "commit": "96545708d0fb060ec6d1e67e85de593bcf24dd21",
      "tree": "ab8094a959c50201c1f3e4a8a7ea52841cabedfa",
      "parents": [
        "252d7d584c1ed8c069623c5a1b0dd994d0b363f4"
      ],
      "author": {
        "name": "Ignacio Castaño",
        "email": "castano@gmail.com",
        "time": "Tue Jun 02 19:13:06 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 02 19:13:06 2026"
      },
      "message": "spirv-opt: Avoid duplicate decorations on unrolled loops. (#6690)\n\nFixes issue: https://github.com/KhronosGroup/SPIRV-Tools/issues/6689\n\nAlso adds a test to reproduce and validate the result.\n\n*This PR is sponsored by [Ludicon](https://ludicon.com)*"
    },
    {
      "commit": "252d7d584c1ed8c069623c5a1b0dd994d0b363f4",
      "tree": "73bc71d3694867dd36ee092149c27af6a4b2d1df",
      "parents": [
        "605a0154c7743ed4239c0eb7f3c61f17ffde4fd0"
      ],
      "author": {
        "name": "David Neto",
        "email": "dneto@google.com",
        "time": "Tue Jun 02 17:33:04 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 02 17:33:04 2026"
      },
      "message": "optimizer: avoid writing instructions that have too many words (#6722)\n\nIf an instruction has too many words, in violation of the SPIR-V spec,\nthen when converting to a binary:\n- in a debug build, assert out\n- in a release build, write a nonsense instruction that has a word count\nof 0.\n\ncrbug.com/513916669"
    },
    {
      "commit": "605a0154c7743ed4239c0eb7f3c61f17ffde4fd0",
      "tree": "a095360676e59f374407b77c22d7c5d18e941dc4",
      "parents": [
        "b38c4f83024546d4000b2db8e2294cf81b7f26e0"
      ],
      "author": {
        "name": "Kévin Petit",
        "email": "kevin.petit@arm.com",
        "time": "Tue Jun 02 14:41:13 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 02 14:41:13 2026"
      },
      "message": "spirv-opt: fix handling of replicated TensorARM constants (#6721)\n\nType::NumberOfComponents() does not support TensorARM types and cannot\neasily because a TensorARM only stores the ID of the shape definition\ninstruction and Type does not have access to the IR context.\n\nThis change adds a special case for TensorARM to calculate the number of\ncomponents in the ConstantManager code directly.\n\nAlso add tests for all these cases as well as tensor types whose shape\nis defined with a replicated composite.\n\nCo-authored-by: Davide Grohmann \u003cdavide.grohmann@arm.com\u003e\nCo-authored-by: Kevin Petit \u003ckevin.petit@arm.com\u003e\n\nSigned-off-by: Davide Grohmann \u003cdavide.grohmann@arm.com\u003e\nSigned-off-by: Kevin Petit \u003ckevin.petit@arm.com\u003e\nCo-authored-by: Davide Grohmann \u003cdavide.grohmann@arm.com\u003e"
    },
    {
      "commit": "b38c4f83024546d4000b2db8e2294cf81b7f26e0",
      "tree": "84b385bd968c622f3cb3c092ea400a3216205323",
      "parents": [
        "39813baec458ada43263749757b15fbfbd6be107"
      ],
      "author": {
        "name": "Kévin Petit",
        "email": "kevin.petit@arm.com",
        "time": "Mon Jun 01 13:15:03 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 01 13:15:03 2026"
      },
      "message": "Add ArmExperimentalMLOperations instruction set (#6692)"
    },
    {
      "commit": "39813baec458ada43263749757b15fbfbd6be107",
      "tree": "71313dcf557e789209f12127e71bc86b320ec9f9",
      "parents": [
        "af15c1bd0e5ec2c3da9e6439bc262cd73c0d79f4"
      ],
      "author": {
        "name": "Song Li",
        "email": "sl5807@columbia.edu",
        "time": "Sun May 31 22:41:14 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun May 31 22:41:14 2026"
      },
      "message": "fix: skip ParseInstruction for retried-as-unknown instructions (#6675)\n\n## Summary\n\nFixes #6664.\n\n`spvBinaryToText` with `FRIENDLY_NAMES` + `HANDLE_UNKNOWN_OPCODES` reads\npast the instruction buffer at `name_mapper.cpp:268` when the module\ncontains a malformed known instruction (e.g. `OpTypePointer` with\ndeclared word count 3 and an invalid `StorageClass` enum 42). The\n`HANDLE_UNKNOWN_OPCODES` retry path (`emitAsUnknown`) bypasses the\nparser\u0027s mandatory-operand completeness check and dispatches the\ninstruction to `FriendlyNameMapper::ParseInstruction` with\n`inst.num_operands \u003d\u003d 0`, but the opcode switch arms unconditionally\nindex `inst.words[N]`.\n\n## Root cause\n\nWhen `parseOperand` fails on an invalid enum and\n`HANDLE_UNKNOWN_OPCODES` is set, `parseInstruction` retries via\n`emitAsUnknown()` (binary.cpp ~409-412). `emitAsUnknown` repopulates raw\nwords but clears the operand array and sets `inst.num_operands \u003d 0`\n(binary.cpp ~367-371) before invoking the callback.\n`FriendlyNameMapper::ParseInstruction` then enters its opcode switch\nwith a known opcode but no decoded operands, and direct `inst.words[N]`\nreads go out of bounds.\n\nThis affects not just `OpTypePointer` but all opcode arms that do direct\nword indexing: `OpTypeInt`, `OpTypeFloat`, `OpTypeVector`,\n`OpTypeMatrix`, `OpTypeArray`, `OpDecorate`, `OpTypeRuntimeArray`,\n`OpTypeNodePayloadArrayAMDX`, `OpTypeUntypedPointerKHR`, `OpTypePipe`,\netc.\n\n## Fix\n\nGuard `ParseInstruction` to return early when `inst.num_operands \u003d\u003d 0`:\n\n```cpp\nif (inst.num_operands \u003d\u003d 0) return SPV_SUCCESS;\n```\n\n`num_operands \u003d\u003d 0` is the parser\u0027s marker for instructions emitted via\nthe retry-as-unknown path. These instructions have no decoded operand\nmetadata and their raw word arrays may be truncated, so the mapper has\nnothing useful to extract from them. The early return lets the mapper\u0027s\ninternal parse continue past the instruction, so friendly names are\nstill collected from subsequent valid instructions.\n\nThis is a single central guard that covers all current and future opcode\narms, rather than per-case bounds checks scattered across the switch.\n\n## Previous iterations\n\nv1 added per-case `inst.num_words` bounds checks in the `OpTypePointer`\narm of `ParseInstruction`:\n\n```diff\n// source/name_mapper.cpp — v1\n  case spv::Op::OpTypePointer: {\n-   const auto storage_class \u003d spv::StorageClass(inst.words[2]);\n+   const auto storage_class \u003d inst.num_words \u003e 2\n+       ? spv::StorageClass(inst.words[2]) : spv::StorageClass::Max;\n    ...\n-   SaveName(result_id, ...);\n+   if (inst.num_words \u003e 3) SaveName(result_id, ...);\n+   else SaveName(result_id, \"unknown_pointer\");\n  }\n```\n\nAs @alan-baker pointed out, this fixed one type but left ~12 other cases\nexposed through the same `emitAsUnknown` path.\n\nv2 masked `HANDLE_UNKNOWN_OPCODES` from the `FriendlyNameMapper`\nconstruction in `disassemble.cpp`:\n\n```diff\n// source/disassemble.cpp — v2\n  if (options \u0026 SPV_BINARY_TO_TEXT_OPTION_FRIENDLY_NAMES) {\n+   const uint32_t mapper_options \u003d\n+       options \u0026 ~SPV_BINARY_TO_TEXT_OPTION_HANDLE_UNKNOWN_OPCODES;\n    friendly_mapper \u003d MakeUnique\u003cFriendlyNameMapper\u003e(\n-       context, code, wordCount, options);\n+       context, code, wordCount, mapper_options);\n  }\n```\n\nThis covered all cases centrally but introduced a regression: the\nmapper\u0027s pre-parse could no longer continue past legitimate unknown\nopcodes, so IDs declared after an unknown instruction lost their\nfriendly names (fell back to `%6`, `%7` instead of `%uint`, `%v2uint`).\n\nThe current fix uses the parser\u0027s own invariant (`emitAsUnknown` sets\n`num_operands \u003d 0`) to skip only the dangerous instructions while\nkeeping `HANDLE_UNKNOWN_OPCODES` active for the mapper\u0027s pre-parse. This\ncovers all cases like v2, but without the friendly-name regression.\n\n## Regression risk\n\nThe fix does not mask any disassembler options and does not change the\nmapper\u0027s pre-parse behavior for legitimate unknown opcodes.\n`HANDLE_UNKNOWN_OPCODES` remains active in the mapper\u0027s\n`spvBinaryParseWithOptions` call, so when the binary contains a genuine\nunknown opcode (e.g. a future extension), the parser retries it as\nunknown, `ParseInstruction` skips it (since `num_operands \u003d\u003d 0`), and\nparsing continues normally. Friendly names for IDs declared after the\nunknown opcode are preserved.\n\nTested by injecting unknown opcode 65000 between valid type definitions\nand verifying output:\n\n```\nOpUnknown(65000, 1)\n%void \u003d OpTypeVoid\n%uint \u003d OpTypeInt 32 0\n%v2uint \u003d OpTypeVector %uint 2\n```\n\nAll friendly names (`%void`, `%uint`, `%v2uint`) are present after the\nunknown instruction, identical to the unpatched baseline.\n\n## Verification\n\nTested with ASan-instrumented build (`-fsanitize\u003daddress`,\n`detect_leaks\u003d1`):\n- Before: `ERROR: AddressSanitizer: heap-buffer-overflow` at\n`name_mapper.cpp:268:47` in `FriendlyNameMapper::ParseInstruction`\n- After: no heap-buffer-overflow. Malformed instruction emitted as\n`OpUnknown(32, 3)` by the main disassembly path\n\nValgrind memcheck on post-patch binary: `ERROR SUMMARY: 0 errors`, all\nheap blocks freed.\n\nPost-patch process exits non-zero due to a pre-existing LeakSanitizer\nreport (74 bytes in `spvDiagnosticCreate`). This leak exists before and\nafter the patch and is unrelated to the OOB fix.\n\nValid SPIR-V sample disassembly: identical output pre/post patch."
    },
    {
      "commit": "af15c1bd0e5ec2c3da9e6439bc262cd73c0d79f4",
      "tree": "bdea786de409a7266759b4fc4e01a32159c7e942",
      "parents": [
        "5b418e58bd952be2bb13ec613359da64f1ed04ba"
      ],
      "author": {
        "name": "Song Li",
        "email": "songtli@outlook.com",
        "time": "Sat May 30 23:34:41 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat May 30 23:34:41 2026"
      },
      "message": "fix: SEGV in OrderBlocks via empty CFG when OpFunctionEnd has no preceding OpLabel (#6676)\n\n## Summary\n\nFixes #6663.\n\n`spvBinaryToText` with `REORDER_BLOCKS` or `NESTED_INDENT` crashes\n(SEGV, write to address `0x50`) at `source/disassemble.cpp:416` when the\ninput contains `OpFunctionEnd` with no preceding `OpLabel`. In deferred\nCFG mode, `Disassembler::HandleInstruction` unconditionally calls\n`EmitCFG()` on `OpFunctionEnd`, which forwards an empty\n`current_function_cfg_.blocks` to `OrderBlocks`. `OrderBlocks` then\nwrites to `cfg.blocks[0].nest_level` on an empty vector, hitting a\nNULL-region address.\n\n## Root cause\n\nIn deferred CFG mode (`nested_indent_ || reorder_blocks_`),\n`HandleInstruction` only accumulates blocks after seeing `OpLabel`. The\nPoC has `OpFunctionEnd` (opcode 56) without any prior `OpLabel`, so\n`current_function_cfg_.blocks` stays empty.\n\nI added some fprintf probes to trace the state transition and got:\n1. `HandleInstruction` entered with `opcode\u003d56` (OpFunctionEnd),\n`blocks\u003d0`\n2. `OpFunctionEnd` path called `EmitCFG` with `blocks\u003d0`\n3. `EmitCFG` entered with `blocks\u003d0`\n4. `BuildControlFlowGraph` entered/exited with `blocks\u003d0` and\n`id_to_index\u003d0`\n5. `OrderBlocks` consumed empty `cfg.blocks` and ASan SEGV fired\n\nASan points to `disassemble.cpp:416:28` in `OrderBlocks`, SEGV write to\naddress `0x50`.\n\nSo the actual problem is on the producer side: `HandleInstruction`\u0027s\n`OpFunctionEnd` case just forwards the empty CFG into `EmitCFG` without\nchecking. `OrderBlocks` is only consuming the bad state.\n\n## Fix\n\nAdded a guard in `HandleInstruction`\u0027s `OpFunctionEnd` case\n(`source/disassemble.cpp`): only call `EmitCFG()` when\n`!current_function_cfg_.blocks.empty()`. `OpFunctionEnd` still gets\nemitted through the existing `[[fallthrough]]` to the `default` path.\n\n## Why this approach\n\nI looked at three places to put the fix:\n- **Guard in `OrderBlocks`** (crash site): this just masks the symptom.\nIt would return an empty ordering on invalid state and could silently\nhide bugs in the future. Didn\u0027t go with this.\n- **Guard in `EmitCFG` entry**: would work, but it\u0027s one layer below\nwhere the problem actually starts.\n- **Guard at `HandleInstruction` `OpFunctionEnd`** (went with this):\nthis is where the empty CFG first gets forwarded. It\u0027s consistent with\nhow the deferred-mode contract already works, where non-block\ninstructions get emitted directly via the `default` path. No new error\nhandling needed since `OpFunctionEnd` still goes through\n`[[fallthrough]]`.\n\n## Verification\n\nTested with ASan-instrumented build (`-fsanitize\u003daddress`,\n`detect_leaks\u003d0`):\n- **Before**: `SUMMARY: AddressSanitizer: SEGV\n/src/spirv-tools/source/disassemble.cpp:416:28 in OrderBlocks` (both\n`--reorder-blocks` and `--nested-indent`, exit\u003d1)\n- **After**: no SEGV, both modes exit cleanly (exit\u003d0)\n\nControl path (no CFG options) produces valid disassembly output pre- and\npost-patch (exit\u003d0).\n\n---------\n\nCo-authored-by: SongTonyLi \u003csongtonyli@users.noreply.github.com\u003e"
    },
    {
      "commit": "5b418e58bd952be2bb13ec613359da64f1ed04ba",
      "tree": "a4c0dd379760171c0932ee1a737f8e05b3fa72c9",
      "parents": [
        "7fa421b3cb2db75c9c8a241fe674f467dd4d240b"
      ],
      "author": {
        "name": "Kévin Petit",
        "email": "kevin.petit@arm.com",
        "time": "Fri May 29 23:23:06 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri May 29 23:23:06 2026"
      },
      "message": "spirv-opt: fix handling of non-semantic instructions that succeed graphs (#6719)\n\nThey were moved to before graphs in modules with no functions which\nbroke round-trippability with no changes and also introduced illegal\nforward references.\n\nThe changes in ir_loader.cpp are mostly if/else nesting changes to\nreduce the number of nesting levels, improve readability and keep the\nlogic to handle non semantic instructions in one place.\n\nSigned-off-by: Kevin Petit \u003ckevin.petit@arm.com\u003e"
    },
    {
      "commit": "7fa421b3cb2db75c9c8a241fe674f467dd4d240b",
      "tree": "6342040c2a6bf980ec1f7ef6c252b7305a0ebbab",
      "parents": [
        "ffc5ea44c47d7ac363b0824fb3d6fba7a9523d30"
      ],
      "author": {
        "name": "ZZKQcom",
        "email": "zhikzhen@qti.qualcomm.com",
        "time": "Fri May 29 13:43:56 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri May 29 13:43:56 2026"
      },
      "message": "spirv-val: Add remaining VUID check and unit tests for VK_QCOM_tile_s… (#6660)\n\n# VUID check\n- `VUID-StandaloneSpirv-TileImageEXT-08723`\n- `VUID-StandaloneSpirv-TileAttachmentQCOM-10689`\n- `VUID-TileApronSizeQCOM-TileApronSizeQCOM-10632`\n- `VUID-TileApronSizeQCOM-TileApronSizeQCOM-10633`\n- `VUID-TileApronSizeQCOM-TileApronSizeQCOM-10634`\n- `VUID-TileOffsetQCOM-TileOffsetQCOM-10626`\n- `VUID-TileOffsetQCOM-TileOffsetQCOM-10627`\n- `VUID-TileOffsetQCOM-TileOffsetQCOM-10628`\n- `VUID-TileDimensionQCOM-TileDimensionQCOM-10629`\n- `VUID-TileDimensionQCOM-TileDimensionQCOM-10630`\n- `VUID-TileDimensionQCOM-TileDimensionQCOM-10631`\n- `VUID-WorkgroupSize-TileShadingRateQCOM-10635`\n\n# Unit tests\n`VUID-08723`\n`VUID-10633`\n`VUID-10634`\n`VUID-10627`\n`VUID-10628`\n`VUID-10630`\n`VUID-10631`\n\n# VUID check failed to reach, blocked by other VUID check\n`VUID-10689`\n`VUID-10632`\n`VUID-10626`\n`VUID-10629`\n`VUID-10635`"
    },
    {
      "commit": "ffc5ea44c47d7ac363b0824fb3d6fba7a9523d30",
      "tree": "501152a5922534d38bd3034856593bcabca5fa5a",
      "parents": [
        "d344926654a5bcf837479e9a7417b58a3ea19c74"
      ],
      "author": {
        "name": "V-Sarthou",
        "email": "valentin.sarthou@gmail.com",
        "time": "Fri May 29 13:15:59 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri May 29 13:15:59 2026"
      },
      "message": "enum_set: Bucket operator\u003d\u003d() link errors with Visual Studio 15 2017 (#6687)\n\nWith Visual Studio 2017, I\u0027m getting these link errors:\n```\nSPIRV-Tools-opt.lib(feature_manager.obj) : error LNK2019: unresolved external symbol \"bool __cdecl operator\u003d\u003d(struct spvtools::EnumSet\u003cenum spvtools::Extension\u003e::Bucket const \u0026,struct spvtools::EnumSet\u003cenum spvtools::Extension\u003e::Bucket const \u0026)\" (??8@YA_NAEBUBucket@?$EnumSet@W4Extension@spvtools@@@spvtools@@0@Z) referenced in function \"public: bool __cdecl std::equal_to\u003cvoid\u003e::operator()\u003cstruct spvtools::EnumSet\u003cenum spvtools::Extension\u003e::Bucket const \u0026,struct spvtools::EnumSet\u003cenum spvtools::Extension\u003e::Bucket const \u0026\u003e(struct spvtools::EnumSet\u003cenum spvtools::Extension\u003e::Bucket const \u0026,struct spvtools::EnumSet\u003cenum spvtools::Extension\u003e::Bucket const \u0026)const \" (??$?RAEBUBucket@?$EnumSet@W4Extension@spvtools@@@spvtools@@AEBU012@@?$equal_to@X@std@@QEBA_NAEBUBucket@?$EnumSet@W4Extension@spvtools@@@spvtools@@0@Z)\nSPIRV-Tools-opt.lib(feature_manager.obj) : error LNK2019: unresolved external symbol \"bool __cdecl operator\u003d\u003d(struct spvtools::EnumSet\u003cenum spv::Capability\u003e::Bucket const \u0026,struct spvtools::EnumSet\u003cenum spv::Capability\u003e::Bucket const \u0026)\" (??8@YA_NAEBUBucket@?$EnumSet@W4Capability@spv@@@spvtools@@0@Z) referenced in function \"public: bool __cdecl std::equal_to\u003cvoid\u003e::operator()\u003cstruct spvtools::EnumSet\u003cenum spv::Capability\u003e::Bucket const \u0026,struct spvtools::EnumSet\u003cenum spv::Capability\u003e::Bucket const \u0026\u003e(struct spvtools::EnumSet\u003cenum spv::Capability\u003e::Bucket const \u0026,struct spvtools::EnumSet\u003cenum spv::Capability\u003e::Bucket const \u0026)const \" (??$?RAEBUBucket@?$EnumSet@W4Capability@spv@@@spvtools@@AEBU012@@?$equal_to@X@std@@QEBA_NAEBUBucket@?$EnumSet@W4Capability@spv@@@spvtools@@0@Z)\n```\nIt looks like a compiler issue because these errors are not raised using\nmore recent versions of Visual Studio.\nNonetheless, changing the operator\u003d\u003d() from a friend function to a\nmember method fixes the issue, which is what this patch does."
    },
    {
      "commit": "d344926654a5bcf837479e9a7417b58a3ea19c74",
      "tree": "f7891805105ff9a2eec7a01acc856b14b485b353",
      "parents": [
        "d8cc2f82f8a1984e2ae7c24e133ac3847a88df56"
      ],
      "author": {
        "name": "changhwipark-arm",
        "email": "chang-hwi.park@arm.com",
        "time": "Thu May 28 20:02:32 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu May 28 20:02:32 2026"
      },
      "message": "spirv-val: Check for image declaration with TileImageEXT storage class (#6662)\n\nAddressing a missing check mentioned [here and\ncloses](https://github.com/KhronosGroup/SPIRV-Tools/issues/6593).\n\u003e The TileImageEXT Storage Class must only be used for declaring tile\nimage variables"
    },
    {
      "commit": "d8cc2f82f8a1984e2ae7c24e133ac3847a88df56",
      "tree": "fd7ab2c4203903f330187f7ee8e13ddbed73b128",
      "parents": [
        "b3d6ad90f5154b61764cddec32450640ec7d1f92"
      ],
      "author": {
        "name": "Kévin Petit",
        "email": "kevin.petit@arm.com",
        "time": "Thu May 28 18:48:01 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu May 28 18:48:01 2026"
      },
      "message": "spirv-opt: add support for tensor constants (#6684)\n\nSigned-off-by: Kevin Petit \u003ckevin.petit@arm.com\u003e"
    },
    {
      "commit": "b3d6ad90f5154b61764cddec32450640ec7d1f92",
      "tree": "e03aea70990249c2866c258066cd8ba23046b6ad",
      "parents": [
        "5b52551d80abd9c513b5e76bffee576ea5df6b8c"
      ],
      "author": {
        "name": "Ben Ashbaugh",
        "email": "ben.ashbaugh@intel.com",
        "time": "Wed May 27 20:48:11 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed May 27 20:48:11 2026"
      },
      "message": "update validator for SPV_INTEL_rounded_divide_sqrt (#6717)\n\nThe SPV_INTEL_rounded_divide_sqrt extension allows an FPRoundingMode\ndecoration on divide and square root instructions. This PR updates the\nvalidator so SPIR-V modules using this extension are not considered\ninvalid.\n\n---------\n\nSigned-off-by: Ben Ashbaugh \u003cben.ashbaugh@intel.com\u003e"
    },
    {
      "commit": "5b52551d80abd9c513b5e76bffee576ea5df6b8c",
      "tree": "6ccf70650a0ec41bb890ce9354ddf0c6780412c7",
      "parents": [
        "6cb64651ccd4ee8a1002b1f31fa7fc85acb31253"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed May 27 20:40:14 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed May 27 20:40:14 2026"
      },
      "message": "build(deps): bump the github-actions group across 1 directory with 2 updates (#6715)\n\nBumps the github-actions group with 2 updates in the / directory:\n[lukka/get-cmake](https://github.com/lukka/get-cmake) and\n[github/codeql-action](https://github.com/github/codeql-action).\n\nUpdates `lukka/get-cmake` from 4.3.2 to 4.3.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/releases\"\u003elukka/get-cmake\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eCMake v4.3.3\u003c/h2\u003e\n\u003cp\u003eThe \u003ccode\u003eget-cmake\u003c/code\u003e action downloads and caches CMake and\nNinja on your workflows. Versions can be specified using \u003ca\nhref\u003d\"https://docs.npmjs.com/about-semantic-versioning\"\u003esemantic\nversioning ranges\u003c/a\u003e using \u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/blob/latest/action.yml#L13\"\u003e\u003ccode\u003ecmakeVersion\u003c/code\u003e\u003c/a\u003e\nand \u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/blob/latest/action.yml#L16\"\u003e\u003ccode\u003eninjaVersion\u003c/code\u003e\u003c/a\u003e\ninputs.\u003c/p\u003e\n\u003cp\u003eChanges:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003elatest\u003c/code\u003e is now using CMake version \u003ccode\u003ev4.3.3\u003c/code\u003e,\nuse this one-liner e.g.:\n\u003ccode\u003euses: lukka/get-cmake@latest\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eEnjoy!\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/commit/591817e96fcad43505fb4eae36172462abb3a42e\"\u003e\u003ccode\u003e591817e\u003c/code\u003e\u003c/a\u003e\nNew CMake version(s): cmake-v4.3.3\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/commit/f7930c8b220c781c656b68f5a370361d0fb3c9ac\"\u003e\u003ccode\u003ef7930c8\u003c/code\u003e\u003c/a\u003e\nfix: upgrade \u003ccode\u003e@​actions/cache\u003c/code\u003e to v5 to remove url.parse()\ndeprecation warning\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/lukka/get-cmake/compare/7bfc9baacbbdcb5e37957ad05c3546b3e222be3c...591817e96fcad43505fb4eae36172462abb3a42e\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 4.35.3 to 4.36.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.36.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle\nversion to 2.19.4. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action\nare generated to avoid duplication across bundles and reduce the size of\nthe repository by around 70%. This should have no effect on the runtime\nbehaviour of the CodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e will now only be enabled on a pull request when\ndiff-informed analysis is also enabled for that run. If diff-informed\nanalysis is unavailable (for example, because the PR diff ranges could\nnot be computed), the action will fall back to a full analysis. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal\n\u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will\nbe enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for\nGitHub-internal use only, and may change without notice at any time. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning\nanalysis for a PR with \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have\na cached overlay-base database for the configured languages. This speeds\nup analysis for a repository when there is not yet a cached overlay-base\ndatabase for the latest CLI version. We expect to roll this change out\nto everyone in May. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases\npage\u003c/a\u003e for the relevant changes to the CodeQL CLI and language\npacks.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.0 - 22 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle\nversion to 2.19.4. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.5 - 15 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action\nare generated to avoid duplication across bundles and reduce the size of\nthe repository by around 70%. This should have no effect on the runtime\nbehaviour of the CodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e will now only be enabled on a pull request when\ndiff-informed analysis is also enabled for that run. If diff-informed\nanalysis is unavailable (for example, because the PR diff ranges could\nnot be computed), the action will fall back to a full analysis. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal\n\u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will\nbe enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for\nGitHub-internal use only, and may change without notice at any time. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning\nanalysis for a PR with \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have\na cached overlay-base database for the configured languages. This speeds\nup analysis for a repository when there is not yet a cached overlay-base\ndatabase for the latest CLI version. We expect to roll this change out\nto everyone in May. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.4 - 07 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.3 - 01 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for\ncustomers using CodeQL version 2.19.3 and earlier. These versions of\nCodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise\nServer 3.15, and will be unsupported by the next minor release of the\nCodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP\nOIDC are now accepted. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use\n\u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better\ncompatibility with various registry implementations. For NuGet feeds,\nthe test is now always performed against the service index. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same\nmillisecond could overwrite each other on disk, causing one of them to\nbe lost. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.2 - 15 Apr 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled\nusing the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment\nvariable is deprecated and will be removed in May 2026. If you are\naffected by this, we recommend disabling TRAP caching by passing the\n\u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis\nnow only applies to repositories that contain submodules. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library,\nrelying instead on models of the standard library. This should result in\nsignificantly faster extraction and analysis times, while the effect on\nalerts should be minimal. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private\nregistries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.1 - 27 Mar 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix incorrect minimum required Git version for \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e: it should have been 2.36.0, not 2.11.0. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3781\"\u003e#3781\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.0 - 27 Mar 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReduced the minimum Git version required for \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e from 2.38.0 to 2.11.0. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3767\"\u003e#3767\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1\"\u003e2.25.1\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3773\"\u003e#3773\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/7211b7c8077ea37d8641b6271f6a365a22a5fbfa\"\u003e\u003ccode\u003e7211b7c\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3927\"\u003e#3927\u003c/a\u003e\nfrom github/update-v4.36.0-ebc2d9e2b\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/7740f2fb21add1d46278215acea47540db22f022\"\u003e\u003ccode\u003e7740f2f\u003c/code\u003e\u003c/a\u003e\nUpdate changelog for v4.36.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/ebc2d9e2bc247eec51bee8d4df806c4030eb0761\"\u003e\u003ccode\u003eebc2d9e\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3926\"\u003e#3926\u003c/a\u003e\nfrom github/update-bundle/codeql-bundle-v2.25.5\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/d1f74b777c95c777bf4f42ce4b250bc916e745c7\"\u003e\u003ccode\u003ed1f74b7\u003c/code\u003e\u003c/a\u003e\nAdd changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/2dc40cec39bdc63d3561d74fa6100cebb0418ff4\"\u003e\u003ccode\u003e2dc40ce\u003c/code\u003e\u003c/a\u003e\nUpdate default bundle to codeql-bundle-v2.25.5\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/84498526a009a99c875e83ef4821a8ba52de7c22\"\u003e\u003ccode\u003e8449852\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3910\"\u003e#3910\u003c/a\u003e\nfrom github/henrymercer/repo-size-diff-check\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/72ac23c6d16b29fbe801e87e3439941558c53094\"\u003e\u003ccode\u003e72ac23c\u003c/code\u003e\u003c/a\u003e\nUpdate excluded required check list\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/c5297a28a2c3e6a8062041b58858bd7117cebe37\"\u003e\u003ccode\u003ec5297a2\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3919\"\u003e#3919\u003c/a\u003e\nfrom github/henrymercer/workflow-concurrency\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/8ffeae7d05bc1b914a009d197e64e4f5c9e14503\"\u003e\u003ccode\u003e8ffeae7\u003c/code\u003e\u003c/a\u003e\nCI: Automatically cancel non-generated workflows\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/f3f52bf568dc44a1069faafa538caa6b1fec40c9\"\u003e\u003ccode\u003ef3f52bf\u003c/code\u003e\u003c/a\u003e\nRevert \u003ccode\u003egetErrorMessage\u003c/code\u003e import\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/github/codeql-action/compare/e46ed2cbd01164d986452f91f178727624ae40d7...7211b7c8077ea37d8641b6271f6a365a22a5fbfa\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "6cb64651ccd4ee8a1002b1f31fa7fc85acb31253",
      "tree": "de6ee3859bc41f5d6b2cad10547386e24b23bd77",
      "parents": [
        "236bf64c0853d024b5739b16e1da294e3e672067"
      ],
      "author": {
        "name": "Guang-035",
        "email": "xuguang035@gmail.com",
        "time": "Wed May 27 03:02:11 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed May 27 03:02:11 2026"
      },
      "message": "spirv-val: Allow ArrayStrideIdEXT on structs with descriptors (#6705)\n\nPer `SPV_EXT_descriptor_heap`, `ArrayStrideIdEXT` must be allowed on\narrays containing descriptor types. This includes composites that\ncontain descriptors, not only arrays whose element type is directly a\ndescriptor.\n\n**Root Cause**:\nThe validator only checked whether the array element type itself was a\ndescriptor type.\nFor\n[RuntimeArray\u003cMaterial\u003e](https://github.com/KhronosGroup/glslang/pull/4272/changes#diff-3142250076641bab8379f6637d480636190a14c9f31e0f7915cb4e76fc1d840e),\nthe direct element type is `OpTypeStruct`, so validation rejected it\neven though `Material` contains `OpTypeBufferEXT`.\n\n**Solution**:\nRecursively inspect the array element type when validating\n`ArrayStrideIdEXT`, so structs and other composites containing\ndescriptor types are accepted.\n\n**Test**:\nAdded a validator regression test covering a runtime array of a struct\ncontaining `OpTypeBufferEXT`.\n\nCo-authored-by: guangxu2 \u003cguangxu2@amd.com\u003e"
    },
    {
      "commit": "236bf64c0853d024b5739b16e1da294e3e672067",
      "tree": "37c8eeadf3292ac5976681b33d2ef8e24b8e3200",
      "parents": [
        "bf3ad6e795df95455c206452ce78a6c0277a5dd3"
      ],
      "author": {
        "name": "Dmitry Sidorov",
        "email": "dmitrii.s.sidorov@gmail.com",
        "time": "Tue May 26 20:48:34 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue May 26 20:48:34 2026"
      },
      "message": "Allow OpPoisonKHR as a constituent (#6713)\n\nSpec change:\nhttps://github.com/KhronosGroup/SPIRV-Registry/pull/417"
    },
    {
      "commit": "bf3ad6e795df95455c206452ce78a6c0277a5dd3",
      "tree": "be590dc849b4582aa16d79709896b309e390fa3f",
      "parents": [
        "2e40a1133e73686d84c39482346a713bfd7234f9"
      ],
      "author": {
        "name": "Ricardo Garcia",
        "email": "47594367+rg3igalia@users.noreply.github.com",
        "time": "Thu May 21 18:55:33 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu May 21 18:55:33 2026"
      },
      "message": "spirv-val: Make it legal to use OpInBoundsAccessChain with ray queries (#6710)\n\nWe had allowed OpAccessChain in the past but missed the\nOpInBoundsAccessChain case.\n\nThis will be needed for some upcoming CTS tests."
    },
    {
      "commit": "2e40a1133e73686d84c39482346a713bfd7234f9",
      "tree": "76bc32b96a378a31b14227a9d66a39451345d27c",
      "parents": [
        "c2bafae51eb16d0c71cc08e296690f4002ca7307"
      ],
      "author": {
        "name": "Spencer Fricke",
        "email": "115671160+spencer-lunarg@users.noreply.github.com",
        "time": "Thu May 21 13:18:57 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu May 21 13:18:57 2026"
      },
      "message": "spirv-val: Fix OffsetIdEXT not checking if in struct (#6708)\n\nPulled the `OffsetIdEXT` part out of\nhttps://github.com/KhronosGroup/SPIRV-Tools/pull/6701 until I resolve\nhttps://gitlab.khronos.org/spirv/SPIR-V/-/issues/937\n\nThis is mainly because people are bringing up `SPV_EXT_descriptor_heap`\nin dxc/slang and want to not have this waste time hitting the \"driver\nbug\" which is actually [not a driver\nbug](https://gitlab.khronos.org/Tracker/vk-gl-cts/-/issues/6505)"
    },
    {
      "commit": "c2bafae51eb16d0c71cc08e296690f4002ca7307",
      "tree": "45f5736e0e253725fb0b31da9c4a5508ac1de6e0",
      "parents": [
        "21c81e0a649fdfc14f35a3eb243e42adff9e40bf"
      ],
      "author": {
        "name": "Jeff Bolz",
        "email": "jbolz@nvidia.com",
        "time": "Thu May 21 13:16:19 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu May 21 13:16:19 2026"
      },
      "message": "Treat version and operand_kinds as optional in generate_language_headers (#6706)\n\nGrammars such as NonSemantic.Graph.DebugInfo omit operand_kinds and\nversion. Match SPIRV-Headers optional-field handling so GN header\ngeneration succeeds.\n\nThis should fix the CI error I\u0027m seeing here:\nhttps://github.com/KhronosGroup/glslang/pull/4275\n```\npython3 ../../External/spirv-tools/utils/generate_language_headers.py --extinst-grammar ../../External/spirv-tools/external/spirv-headers/include/spirv/unified1/extinst.nonsemantic.graph.debuginfo.grammar.json --extinst-output-path gen/External/spirv-tools/NonSemanticGraphDebugInfo.h\nTraceback (most recent call last):\n  File \"/tmpfs/src/github/glslang/out/Default-hlsl-false/../../External/spirv-tools/utils/generate_language_headers.py\", line 185, in \n    main()\n  File \"/tmpfs/src/github/glslang/out/Default-hlsl-false/../../External/spirv-tools/utils/generate_language_headers.py\", line 176, in main\n    operand_kinds \u003d grammar_json[\u0027operand_kinds\u0027],\n                    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^\nKeyError: \u0027operand_kinds\u0027\n```\n\nThis change was mostly debugged/written using Cursor."
    },
    {
      "commit": "21c81e0a649fdfc14f35a3eb243e42adff9e40bf",
      "tree": "8762fd619a0d356cef7df3c8367d1c389ac6608b",
      "parents": [
        "5418da0861732e64024033f479161de99ff648da"
      ],
      "author": {
        "name": "Jeff Bolz",
        "email": "jbolz@nvidia.com",
        "time": "Wed May 20 19:01:43 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed May 20 19:01:43 2026"
      },
      "message": "val: Detect additional unsupported arithmetic ops in invalid_type_pass (#6707)\n\n@0cc4m reported OpMatrixTimesScalar with bf16 coopmat slipping through\nthe cracks. I asked codex to fill any remaining gaps in the arithmetic\ninstructions."
    },
    {
      "commit": "5418da0861732e64024033f479161de99ff648da",
      "tree": "7dc68d447dc4f5cf6bc6feda2e0be523ba24746b",
      "parents": [
        "2acb87f86d6906847d5f4c0c805c54604abb1b01"
      ],
      "author": {
        "name": "Spencer Fricke",
        "email": "115671160+spencer-lunarg@users.noreply.github.com",
        "time": "Tue May 19 13:17:14 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue May 19 13:17:14 2026"
      },
      "message": "spirv-val: Remove std::move of DiagnosticStream (#6704)\n\nJust the nit fixes I found in\nhttps://github.com/KhronosGroup/SPIRV-Tools/pull/6702\n\nBasically calling\n\n```c++\nDiagnosticStream ds \u003d std::move(...);\nreturn ds;\n```\n\ndoesn\u0027t an implicit clear and would not print the ShaderDebugInfo out\nand it was very subtle and annoying to debug, so rather just upstream\nthis small fix first"
    },
    {
      "commit": "2acb87f86d6906847d5f4c0c805c54604abb1b01",
      "tree": "5a9a852cb009f23abcd686de4eebf7f48937d5cc",
      "parents": [
        "3c042c509786feb4c7aa7164f2c7c224d386ebfc"
      ],
      "author": {
        "name": "Spencer Fricke",
        "email": "115671160+spencer-lunarg@users.noreply.github.com",
        "time": "Sun May 17 18:31:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun May 17 18:31:15 2026"
      },
      "message": "spirv-val: Add DebugInfo to ReturnValue/FunctionParameter (#6698)\n\nPart of https://github.com/KhronosGroup/SPIRV-Tools/issues/6617\n\nFor things like `OpReturnValue` and `OpFunctionParameter` it is valuable\nto print both the line it occured and the function definition as its\nrelated\n\n```\n  --\u003e a.comp:4:0\n  |\n4 |    return 4;\n  |\n  --\u003e a.comp:3:0\n  |\n3 | uint foo() {\n  |\n```"
    },
    {
      "commit": "3c042c509786feb4c7aa7164f2c7c224d386ebfc",
      "tree": "f290ca86a22fd29ff8cb4b9cf3ee26fcc9c316de",
      "parents": [
        "6aa5c1df74d682618e857f55203d786d656251d6"
      ],
      "author": {
        "name": "Dmitry Sidorov",
        "email": "dsidorov@amd.com",
        "time": "Sun May 17 18:28:59 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun May 17 18:28:59 2026"
      },
      "message": "Allow OpPoisonKHR definition on the top of the module (#6699)\n\nCurrently it\u0027s not allowed by the spec, but it\u0027s arguably a\nspecification bug."
    },
    {
      "commit": "6aa5c1df74d682618e857f55203d786d656251d6",
      "tree": "eb9b2f0801e3738efafea7e3fb1ae17f8fc74964",
      "parents": [
        "2d7060be5d8e529ce74e07cba03e13887c9126aa"
      ],
      "author": {
        "name": "Kévin Petit",
        "email": "kevin.petit@arm.com",
        "time": "Fri May 15 20:25:52 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri May 15 20:25:52 2026"
      },
      "message": "Add validation for Vulkan standalone env rules for SPV_ARM_graph (#6694)\n\nSigned-off-by: Kevin Petit \u003ckevin.petit@arm.com\u003e"
    },
    {
      "commit": "2d7060be5d8e529ce74e07cba03e13887c9126aa",
      "tree": "57f55ba61b3a7b830619a20ff7034f87d2973ecd",
      "parents": [
        "8b5f796733ba5385832a13757d0c67cba601a0a5"
      ],
      "author": {
        "name": "Jeff Bolz",
        "email": "jbolz@nvidia.com",
        "time": "Fri May 15 20:21:31 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri May 15 20:21:31 2026"
      },
      "message": "Validate SPV_NV_cooperative_matrix_decode_vector (#6693)"
    },
    {
      "commit": "8b5f796733ba5385832a13757d0c67cba601a0a5",
      "tree": "113e22058a8e24acbcc52821da856874fcfe4cf0",
      "parents": [
        "860c90a8bbd9b4233daadb3667d81f69d20f7541"
      ],
      "author": {
        "name": "Spencer Fricke",
        "email": "115671160+spencer-lunarg@users.noreply.github.com",
        "time": "Fri May 15 20:09:39 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri May 15 20:09:39 2026"
      },
      "message": "spirv-val: Add ShaderDebugInfo EntryPoint (#6691)\n\nPart of #6617 \n\n- Add proper `DebugNoLine` support\n- For things that point to the Entry point functions, print the\nfunctions out\n\n```\nerror: 6: Local Size execution mode must not have a product of zero (X \u003d 0, Y \u003d 1, Z \u003d 1).\n  OpExecutionMode %2 LocalSize 0 1 1\n\n  --\u003e a.comp:3:0\n  |\n3 | void main() {\n  |\n\nerror: 5: [VUID-StandaloneSpirv-None-04633] OpEntryPoint Entry Point \u003cid\u003e \u00272[%2]\u0027s function return type is not void.\n  OpEntryPoint GLCompute %2 \"main\"\n\n  --\u003e a.comp:3:0\n  |\n3 | void main() {\n  |\n```"
    },
    {
      "commit": "860c90a8bbd9b4233daadb3667d81f69d20f7541",
      "tree": "3888fef46df488a6785f31519dc78efb40afa3b0",
      "parents": [
        "83876d92207829cc16f1c93d7354ee376d9c8241"
      ],
      "author": {
        "name": "Spencer Fricke",
        "email": "115671160+spencer-lunarg@users.noreply.github.com",
        "time": "Thu May 14 19:59:42 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu May 14 19:59:42 2026"
      },
      "message": "build: Fix Build.gn with Graph.DebugInfo (#6688)\n\nhttps://github.com/KhronosGroup/SPIRV-Tools/pull/6666#issuecomment-4453463445\nis breaking the `build.gn` for VVL... I just grabbed the commit before,\nso VVL is good\n\nI tried to copy-and-paste a fix, zero idea how to actually test it, but\nseems like it should work for someone who knows GN better"
    },
    {
      "commit": "83876d92207829cc16f1c93d7354ee376d9c8241",
      "tree": "18b269a70162a4c1b2009d4157dbb0b36ffaebec",
      "parents": [
        "18b08af19b08515d5a1749adbdb05bc4369a57ed"
      ],
      "author": {
        "name": "Kévin Petit",
        "email": "kevin.petit@arm.com",
        "time": "Wed May 13 19:35:00 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed May 13 19:35:00 2026"
      },
      "message": "Add NonSemantic.Graph.DebugInfo instruction set (#6666)\n\nSigned-off-by: Kevin Petit \u003ckevin.petit@arm.com\u003e"
    }
  ],
  "next": "18b08af19b08515d5a1749adbdb05bc4369a57ed"
}