)]}'
{
  "log": [
    {
      "commit": "1cc813ecb4f23619bc94d50d82b10ec0ad2b0a7e",
      "tree": "7f2389b3258b7c0ccb386b017ec09e0da3d4059a",
      "parents": [
        "ada7b950a7086c3f463f1bed94e0a619d408a24f"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Oct 09 18:59:56 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 09 18:59:56 2026"
      },
      "message": "[checks] Join nested collapsed subjects with \"that\" (#2783)\n\nA nesting context\u0027s `addPredicate` callback expects a noun phrase from the\nexpectation on its subject, such as `\u003c2\u003e` or `an empty iterable`. When the\nonly expectation on a nested subject was itself a further nested subject, the\ncollapsed predicate from the inner level was passed to `addPredicate` as if\nit were a noun. This produced descriptions which did not read as sentences,\nand lost detail from the label:\n\n    throws has message: \u0027foo\u0027\n    has value: has field: \u0027foo\u0027\n\nWhen the single clause on a nested context is another nested context, join\nits collapsed predicate to the label of the outer context with \"that\"\ninstead. This is the same structure as the \"\u003clabel\u003e that:\" line in the\nmulti-line format, placed on one line:\n\n    throws an error of type StateError that has message: \u0027foo\u0027\n    has value that has field: \u0027foo\u0027\n\nLeaf expectations are still passed to `addPredicate`. A context without an\n`addPredicate` callback, or with a multi-line label, still does not collapse,\nand the 80 character limit at the root still applies."
    },
    {
      "commit": "ada7b950a7086c3f463f1bed94e0a619d408a24f",
      "tree": "f650eecb48d164b2655d6269777a70fe5e3e6dcd",
      "parents": [
        "c4b165b384e13c7232c8fbb5fc4a278938bfd640"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Oct 08 19:03:42 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 08 19:03:42 2026"
      },
      "message": "Prepare to publish (#2780)"
    },
    {
      "commit": "c4b165b384e13c7232c8fbb5fc4a278938bfd640",
      "tree": "fb6cbd42b6c3c90d6cda4ad6b413c758ca9d929a",
      "parents": [
        "4a363d70b61562380b8cdfa3f9e9a09767502b4b"
      ],
      "author": {
        "name": "Kevin Moore",
        "email": "kevmoo@users.noreply.github.com",
        "time": "Wed Oct 07 18:29:08 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Oct 07 18:29:08 2026"
      },
      "message": "[checks] Require package:meta ^1.17.0 (#2779)\n\n`pkgs/checks/lib/src/extensions/async.dart` and\n`pkgs/checks/lib/src/extensions/function.dart` use `@awaitNotRequired`,\nwhich was introduced in `package:meta` `1.17.0`"
    },
    {
      "commit": "4a363d70b61562380b8cdfa3f9e9a09767502b4b",
      "tree": "92c227fe07cc5bc441801aa8b89bc21f5a0cf92e",
      "parents": [
        "465d66ab11d8c58a0eb63ef0d2b2f0e83ba20352"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Oct 06 17:46:31 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 17:46:31 2026"
      },
      "message": "Let Chrome choose its remote debugging port (#2778)\n\nWhen debugging or collecting coverage, the runner picked a probably-unused\nport with `getUnusedPort` and passed it to Chrome with\n`--remote-debugging-port`. Chrome gives no reliable signal that it bound\nthe port, so there was a window where another process could take it, and\n`tryPort` had to report the chosen port back through a completer for\n`_connect` to use.\n\nPass `--remote-debugging-port\u003d0` so Chrome binds an unused port itself,\nand read the port from the URL in the \"DevTools listening on\" line, which\n`_connect` already waits for. With no port to choose or pass along,\n`tryPort`, the port completer, and the private constructor go away, and\n`Chrome` has a plain generative constructor. `spawn` already falls back\nto the default Chrome settings.\n\nUpdate the fake Chrome test to report a fake DevTools server\u0027s port in its\nDevTools line, and check that connecting reaches that server and that\nChrome is started with `--remote-debugging-port\u003d0`."
    },
    {
      "commit": "465d66ab11d8c58a0eb63ef0d2b2f0e83ba20352",
      "tree": "b7488e21feead4f75d482fd492f43608e07dc0bd",
      "parents": [
        "d749b104edf2cb1428b08782830fc6bd2883e3dc"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Oct 06 16:35:22 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 16:35:22 2026"
      },
      "message": "Keep Chrome stderr in the browser output when debugging (#2777)\n\nWhen Chrome runs with a remote debugging port, which happens with\n`--debug`, `--pause-after-load`, and `--coverage`, `_connect` listened to\nthe process\u0027s stderr to wait for the \"DevTools listening\" line. The\n`Browser` base class listens to the same single-subscription stream to\ncollect the browser output, and that second listen threw a `StateError`\nwhich was silently caught. Once `firstWhere` found the line it cancelled\nthe subscription, which closes the pipe, so all of Chrome\u0027s stderr,\nincluding its console logging, was missing from the \"Browser output\" in\nload failures and timeouts.\n\nRename the `output` list on `Browser` to `accumulatedOutput`, and add an\n`output` stream built with `Stream.multi` which replays the accumulated\nlines to each new listener and then forwards new lines. It closes when\nboth stdout and stderr are done, when the browser is closed, or when\nstarting or running the browser fails.\n\nIn `Chrome`, `tryPort` now only reports which debugging port it used, and\n`_connect` is an instance method which reads that port and waits for the\nDevTools line on `output`. The tab connection and the remote debugger URL\ncome from a single lazy `_connection` future in place of the two\ncompleters, started by the first read of `remoteDebuggerUrl` or\n`gatherCoverage`. `BrowserManager` reads `remoteDebuggerUrl` before it\nloads any suites, so coverage collection still starts before tests run,\nand the replay means a late start still sees the DevTools line.\n\nDrop the `StateError` catch in `drainOutput`. Nothing else listens to the\nprocess streams now, and a future second listener should fail loudly\ninstead of losing output."
    },
    {
      "commit": "d749b104edf2cb1428b08782830fc6bd2883e3dc",
      "tree": "57e220dd00acf0775b13c66b5c37e03d70cba98d",
      "parents": [
        "da2157e9260bbd52f0bad7a6f4e63ad319a3e8e3"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon Oct 05 22:42:46 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 22:42:46 2026"
      },
      "message": "Fail isolate suites when the test isolate exits (#2775)\n\nWhen a VM test suite runs in an isolate, nothing noticed if the isolate\nexited. The isolate channel does not close when the isolate exits, so:\n\n- If the isolate exited while the suite was loading, loading waited\n  forever for the serialized suite. For example, a test file whose\n  `main` calls `Isolate.exit()` hung the run.\n- If the isolate exited while a test was running, that test never\n  completed. The run hung, and interrupting it hung again while it\n  waited for the test to finish.\n\nSpawn test isolates with an `onExit` port. When the isolate exits,\nclose the port the isolate channel receives from. The channel then ends\nonce it has delivered any messages the isolate sent before exiting:\n- An error the isolate reported while loading is still what fails the\n  load.\n- Otherwise loading fails with \"Connection closed before test suite\n  loaded.\", as it already does for `exe` and `cli` suites when the\n  socket closes.\n- Tests that haven\u0027t finished are reported as not completed.\n\nClosing the port doesn\u0027t end the channel if the isolate hasn\u0027t\nconnected yet, so waiting for the channel ID also races the exit\nmessage.\n\nOnly listen for data on the exit port, since it is also closed as part\nof the suite\u0027s normal cleanup."
    },
    {
      "commit": "da2157e9260bbd52f0bad7a6f4e63ad319a3e8e3",
      "tree": "d4fb5795592b4e8e9a9e40ef1aac4b27183e0dee",
      "parents": [
        "00bd0c994c007b05984ca7ed4ed0dda1667068f6"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon Oct 05 18:12:43 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 18:12:43 2026"
      },
      "message": "Wait longer for the Chrome test tab to appear (#2771)\n\nSince browsers are launched through a `redirect.html` file (#2703), the\ntest tab starts on a `file://` URL and only reports the test URL once\nthe navigation commits. `_connect`, used with `--debug` and\n`--coverage`, gave up after about 4 seconds, which is not always enough\non loaded CI runners. The Chrome coverage tests have failed with \"Could\nnot connect to test tab\" on Windows and macOS since that change landed.\n\nPoll for up to about 20 seconds, and include the URLs of the open tabs\nin the error to make any future failures easier to diagnose."
    },
    {
      "commit": "00bd0c994c007b05984ca7ed4ed0dda1667068f6",
      "tree": "ed5347faa7fd3503f3e695a1e5bef2b0a26f236d",
      "parents": [
        "3be2f547208fc569964973d6f13ec1985c4a9fdd"
      ],
      "author": {
        "name": "Yusuf İhsan Görgel",
        "email": "developeryusuf@icloud.com",
        "time": "Mon Oct 05 15:50:03 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 15:50:03 2026"
      },
      "message": "Fix broken links in architecture.md (#2774)\n\nMost links in `pkgs/test/doc/architecture.md` still pointed at paths from before the split into `test_api`, `test_core` and `test`. This points them at the current files with relative links. Link text and the surrounding prose are unchanged.\n\nThe `lib/src/frontend` link is left as it is. Its APIs are now spread over several directories in `test_api` and `matcher`, and picking one would change what the paragraph says. A broader update of the document is out of scope here.\n\nI checked that every new relative target exists and that the external links return 200.\n\nPart of #1967."
    },
    {
      "commit": "3be2f547208fc569964973d6f13ec1985c4a9fdd",
      "tree": "3ab8302d48e1839d26829a6189892e8432a62ea9",
      "parents": [
        "40a5ad90b3e5314fa28e3d4ca332eeb732c67dbb"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Oct 01 03:46:29 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 01 03:46:29 2026"
      },
      "message": "Bump the github-actions group with 4 updates (#2773)\n\nBumps the github-actions group with 4 updates: [dart-lang/ecosystem/.github/workflows/health.yaml](https://github.com/dart-lang/ecosystem), [dart-lang/ecosystem/.github/workflows/post_summaries.yaml](https://github.com/dart-lang/ecosystem), [dart-lang/ecosystem/.github/workflows/publish.yaml](https://github.com/dart-lang/ecosystem) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).\n\nUpdates `dart-lang/ecosystem/.github/workflows/health.yaml` from 848b3bf3b757d2e9ae4d60030eeed5756c87783f to 16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\"\u003e\u003ccode\u003e16dca7a\u003c/code\u003e\u003c/a\u003e fix(firehose): keep dart_apitool crash details in logs and sanitize breaking ...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/1bdafd85bb97b331ddd683577f48a5dfa7f4cb49\"\u003e\u003ccode\u003e1bdafd8\u003c/code\u003e\u003c/a\u003e Tighten workflow for posting PR comments (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/451\"\u003e#451\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/fc3dd9a17a8e18b3b4aa5abac8a0f4a679fe2d57\"\u003e\u003ccode\u003efc3dd9a\u003c/code\u003e\u003c/a\u003e fix(firehose): update existing publishing PR comments when no packages are re...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/e0a78b408ebab9547710a4b869e2e78b9d887fef\"\u003e\u003ccode\u003ee0a78b4\u003c/code\u003e\u003c/a\u003e fix(firehose): bump dependency_validator pinned hash to 5.0.6 (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/450\"\u003e#450\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/60fca9f1270a0819b3ee9caf74b08fb0a212e4cb\"\u003e\u003ccode\u003e60fca9f\u003c/code\u003e\u003c/a\u003e Condense firehose package publishing table in PR validation (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/445\"\u003e#445\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/b79f68c55d4a611e7ebf63091036f3f18b5d94b3\"\u003e\u003ccode\u003eb79f68c\u003c/code\u003e\u003c/a\u003e chore(health): remove 3rd-party coveralls action dependency (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/446\"\u003e#446\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/cda8bd535dfbcff45010bc3c843d325682f944b2\"\u003e\u003ccode\u003ecda8bd5\u003c/code\u003e\u003c/a\u003e Grant required permissions in want_lgtm_internal and canary_internal workflow...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/ed9c592c1d35106c0a8a52044426515017a60646\"\u003e\u003ccode\u003eed9c592\u003c/code\u003e\u003c/a\u003e Support pull requests from forks and custom branches in CI workflows (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/440\"\u003e#440\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/d8c8a4c2f96165be9764025e29fbfb2069558809\"\u003e\u003ccode\u003ed8c8a4c\u003c/code\u003e\u003c/a\u003e Support configurable tag prefix in firehose and publish.yaml (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/436\"\u003e#436\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/edfdb3b4063b9034b708144633a700204f865f43\"\u003e\u003ccode\u003eedfdb3b\u003c/code\u003e\u003c/a\u003e Add want-lgtm reusable workflow (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/432\"\u003e#432\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/dart-lang/ecosystem/compare/848b3bf3b757d2e9ae4d60030eeed5756c87783f...16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `dart-lang/ecosystem/.github/workflows/post_summaries.yaml` from 848b3bf3b757d2e9ae4d60030eeed5756c87783f to 16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\"\u003e\u003ccode\u003e16dca7a\u003c/code\u003e\u003c/a\u003e fix(firehose): keep dart_apitool crash details in logs and sanitize breaking ...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/1bdafd85bb97b331ddd683577f48a5dfa7f4cb49\"\u003e\u003ccode\u003e1bdafd8\u003c/code\u003e\u003c/a\u003e Tighten workflow for posting PR comments (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/451\"\u003e#451\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/fc3dd9a17a8e18b3b4aa5abac8a0f4a679fe2d57\"\u003e\u003ccode\u003efc3dd9a\u003c/code\u003e\u003c/a\u003e fix(firehose): update existing publishing PR comments when no packages are re...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/e0a78b408ebab9547710a4b869e2e78b9d887fef\"\u003e\u003ccode\u003ee0a78b4\u003c/code\u003e\u003c/a\u003e fix(firehose): bump dependency_validator pinned hash to 5.0.6 (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/450\"\u003e#450\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/60fca9f1270a0819b3ee9caf74b08fb0a212e4cb\"\u003e\u003ccode\u003e60fca9f\u003c/code\u003e\u003c/a\u003e Condense firehose package publishing table in PR validation (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/445\"\u003e#445\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/b79f68c55d4a611e7ebf63091036f3f18b5d94b3\"\u003e\u003ccode\u003eb79f68c\u003c/code\u003e\u003c/a\u003e chore(health): remove 3rd-party coveralls action dependency (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/446\"\u003e#446\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/cda8bd535dfbcff45010bc3c843d325682f944b2\"\u003e\u003ccode\u003ecda8bd5\u003c/code\u003e\u003c/a\u003e Grant required permissions in want_lgtm_internal and canary_internal workflow...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/ed9c592c1d35106c0a8a52044426515017a60646\"\u003e\u003ccode\u003eed9c592\u003c/code\u003e\u003c/a\u003e Support pull requests from forks and custom branches in CI workflows (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/440\"\u003e#440\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/d8c8a4c2f96165be9764025e29fbfb2069558809\"\u003e\u003ccode\u003ed8c8a4c\u003c/code\u003e\u003c/a\u003e Support configurable tag prefix in firehose and publish.yaml (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/436\"\u003e#436\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/edfdb3b4063b9034b708144633a700204f865f43\"\u003e\u003ccode\u003eedfdb3b\u003c/code\u003e\u003c/a\u003e Add want-lgtm reusable workflow (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/432\"\u003e#432\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/dart-lang/ecosystem/compare/848b3bf3b757d2e9ae4d60030eeed5756c87783f...16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `dart-lang/ecosystem/.github/workflows/publish.yaml` from 848b3bf3b757d2e9ae4d60030eeed5756c87783f to 16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\"\u003e\u003ccode\u003e16dca7a\u003c/code\u003e\u003c/a\u003e fix(firehose): keep dart_apitool crash details in logs and sanitize breaking ...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/1bdafd85bb97b331ddd683577f48a5dfa7f4cb49\"\u003e\u003ccode\u003e1bdafd8\u003c/code\u003e\u003c/a\u003e Tighten workflow for posting PR comments (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/451\"\u003e#451\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/fc3dd9a17a8e18b3b4aa5abac8a0f4a679fe2d57\"\u003e\u003ccode\u003efc3dd9a\u003c/code\u003e\u003c/a\u003e fix(firehose): update existing publishing PR comments when no packages are re...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/e0a78b408ebab9547710a4b869e2e78b9d887fef\"\u003e\u003ccode\u003ee0a78b4\u003c/code\u003e\u003c/a\u003e fix(firehose): bump dependency_validator pinned hash to 5.0.6 (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/450\"\u003e#450\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/60fca9f1270a0819b3ee9caf74b08fb0a212e4cb\"\u003e\u003ccode\u003e60fca9f\u003c/code\u003e\u003c/a\u003e Condense firehose package publishing table in PR validation (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/445\"\u003e#445\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/b79f68c55d4a611e7ebf63091036f3f18b5d94b3\"\u003e\u003ccode\u003eb79f68c\u003c/code\u003e\u003c/a\u003e chore(health): remove 3rd-party coveralls action dependency (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/446\"\u003e#446\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/cda8bd535dfbcff45010bc3c843d325682f944b2\"\u003e\u003ccode\u003ecda8bd5\u003c/code\u003e\u003c/a\u003e Grant required permissions in want_lgtm_internal and canary_internal workflow...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/ed9c592c1d35106c0a8a52044426515017a60646\"\u003e\u003ccode\u003eed9c592\u003c/code\u003e\u003c/a\u003e Support pull requests from forks and custom branches in CI workflows (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/440\"\u003e#440\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/d8c8a4c2f96165be9764025e29fbfb2069558809\"\u003e\u003ccode\u003ed8c8a4c\u003c/code\u003e\u003c/a\u003e Support configurable tag prefix in firehose and publish.yaml (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/436\"\u003e#436\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/edfdb3b4063b9034b708144633a700204f865f43\"\u003e\u003ccode\u003eedfdb3b\u003c/code\u003e\u003c/a\u003e Add want-lgtm reusable workflow (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/432\"\u003e#432\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/dart-lang/ecosystem/compare/848b3bf3b757d2e9ae4d60030eeed5756c87783f...16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.37.9 to 4.38.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href\u003d\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2\"\u003e\u003ccode\u003e2892aa5\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4168\"\u003e#4168\u003c/a\u003e from github/update-v4.38.2-a6ef2c96f\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/8ad03a333eb88de8ad6833eda208d0fc51a9c571\"\u003e\u003ccode\u003e8ad03a3\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/98af865db5041cee73c7185896319367f8c0adf2\"\u003e\u003ccode\u003e98af865\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.2\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/a6ef2c96fc0e37d0b44fb2bd0b32db4bcb89ae24\"\u003e\u003ccode\u003ea6ef2c9\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4156\"\u003e#4156\u003c/a\u003e from github/mario-campos/fix-validate-cmd\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/1ef28a1b7603ca158fd774d1ab328cbd6a40b84b\"\u003e\u003ccode\u003e1ef28a1\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4166\"\u003e#4166\u003c/a\u003e from github/dependabot/github_actions/dot-github/wor...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/26cb08bab0037de74cc66ad9ec0dca31d6d9e8a7\"\u003e\u003ccode\u003e26cb08b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4163\"\u003e#4163\u003c/a\u003e from github/mbg/fix-getCommitOid-stubs\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/f035ce3a985a1223a9f59fb719542598640160b2\"\u003e\u003ccode\u003ef035ce3\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4165\"\u003e#4165\u003c/a\u003e from github/dependabot/npm_and_yarn/npm-minor-8eaed9...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/5e4e2550b48d7f3de205c9d752eb5176bf07f6d9\"\u003e\u003ccode\u003e5e4e255\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/b13f5f47d5398d0fb982942ced6fdfc4e3951804\"\u003e\u003ccode\u003eb13f5f4\u003c/code\u003e\u003c/a\u003e Bump ruby/setup-ruby\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/c87fe5756c0c0bcd5e0005d2169945cfee9a232f\"\u003e\u003ccode\u003ec87fe57\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s major version (unless you unignore this specific dependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s minor version (unless you unignore this specific dependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\u003c/details\u003e"
    },
    {
      "commit": "40a5ad90b3e5314fa28e3d4ca332eeb732c67dbb",
      "tree": "ecb0221ffb94465b2cf3e78005f946fee7faf025",
      "parents": [
        "171ad0e529625b7a677121ffb34057bbad373c2a"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Sep 29 19:07:31 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 29 19:07:31 2026"
      },
      "message": "Delete compilation artifacts once they are no longer needed (#2764)\n\nFixes #2710\n\nThe runner kept every artifact it compiled until the end of the run: a kernel\nfile per suite for the default compiler, and a snapshot or bundle per suite for\nthe `exe` and `cli` compilers. On a large test suite that is a lot of temporary\ndisk space held for no reason, since nothing uses an artifact once its suite has\nfinished running.\n\n### Kernel files\n\n`TestCompiler` now tracks which per-language-version compiler produced each\nkernel file, so `release` can delete it as soon as its suite is done. The dill\nbeing considered for the incremental cache is kept, since it is still needed,\nand is deleted once a larger one supersedes it or the compiler is disposed.\n\n`VMPlatform` registers the release as a cleanup callback for the suite. The\nrequest to kill the isolate is ordered ahead of it, but `Isolate.kill` does not\nwait for the isolate to exit, so this is best effort; a file that can\u0027t be\ndeleted yet is removed along with the compiler\u0027s temp directory when it is\ndisposed.\n\n### `exe` and `cli` output\n\nEach suite is compiled into a directory of its own under the runner\u0027s temp\ndirectory, which also holds the unix socket. The executable can\u0027t be deleted\nwhile it is running, so deleting the directory waits for the test process to\nexit. That wait starts as soon as the process starts, so the directory is\ndeleted whenever the process exits, including before the suite has loaded.\n\n### Cleanup is tracked instead of discarded\n\nThe per-suite cleanup callbacks were `void Function()`, so futures from\ntear-offs like `serverSocket.close` were silently dropped, and nothing waited\nfor any cleanup to finish. They are now `FutureOr\u003cvoid\u003e Function()`, and every\ncleanup future is recorded on the platform.\n\nEach resource a suite acquires registers its cleanup as soon as it is acquired,\nand `load` runs those callbacks whenever loading fails, so every step shares one\ncleanup path. This also covers failures after an isolate is spawned, such as\nduring `--debug` setup, which previously left the isolate running.\n\nCleanup is still not awaited when a suite finishes, so a slow delete can\u0027t\ndelay it. Instead `VMPlatform.close` waits for all outstanding cleanup before\ndisposing the compiler and deleting its temp directory. Test processes are\ntracked from the moment they start, and any still running at that point are\nsent `SIGKILL`, so a process which ignores `SIGTERM`, or was never asked to\nexit because its suite failed to load, can\u0027t hang `close` or be left running.\nA process is not started once the platform is closing.\n\nEvery cleanup error is recorded as it happens, and `close` reports each one as\na warning with its stack trace rather than throwing. `Runner.close` now deletes\nthe runner\u0027s temp directory in a `finally`, so it is removed even if closing a\nplatform fails.\n\nThe suite\u0027s stream is now closed in a `finally`, so a failure while waiting for\nthe debugger after the tests can\u0027t leave the suite unfinished.\n\n### Load hang when the test process exits early\n\nLoading an `exe` or `cli` suite waited for the test process to connect with\nnothing else to end the wait. If the process exited first - a crash on\nstartup, or being killed while the platform closes - the load never finished,\nand a graceful shutdown hung on it too. The connection is now raced against\nthe process exiting, and the load fails with a `LoadException` naming the exit\ncode, or returns `null` if the platform is closing.\n\n### Not changed\n\nThe small bootstrap `.dart` files written per test file are still removed when\nthe platform is closed.\n\nNo public API changes; everything here is under `lib/src` and not exported.\n\n### Verification\n\nMeasured with a 6-suite project, sampling the temp directory during the run:\n\n| | before | after |\n|---|---|---|\n| kernel files retained | 6 | 1 |\n| `exe` artifacts retained at peak | 3 snapshots + 3 dirs | 1 dir |\n\nThe one retained kernel file is the incremental cache candidate, which is\nexpected.\n\n`test_compiler_test.dart` gains coverage for both release paths.\n`compiler_test.dart` and `signal_test.dart` pass.\n\nThe load hang has no automated test, since the native bootstrap connects before\nany test code runs. It was verified by temporarily making the bootstrap exit\nbefore connecting: the suite now fails to load with \"The test process exited\nwith code 3 before connecting to the test runner.\", where previously the run\nhung and did not exit on `SIGTERM`."
    },
    {
      "commit": "171ad0e529625b7a677121ffb34057bbad373c2a",
      "tree": "0c26f5a1bebe06a0addf3183b3cc8dd0f7f49b29",
      "parents": [
        "52b450642cbbff192988d7380c1173871f0a120b"
      ],
      "author": {
        "name": "Jacob MacDonald",
        "email": "jakemac@google.com",
        "time": "Tue Sep 29 00:29:48 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 29 00:29:48 2026"
      },
      "message": "export additional types from package:test_api/backend.dart (#2745)\n\nAdditional exports for flutter, https://github.com/flutter/flutter/issues/185016"
    },
    {
      "commit": "52b450642cbbff192988d7380c1173871f0a120b",
      "tree": "4b9c7a894f89569b5208e3e71d620ae8eb91bba4",
      "parents": [
        "4f92d530daf7e1c9e8a9acf518304a41408dbdc4"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon Sep 28 22:04:08 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 28 22:04:08 2026"
      },
      "message": "Tag browser and node tests, relax flaky timeouts (#2770)\n\nSeveral tests launch Chrome, Firefox, or Node without the matching tag,\nso they miss the longer timeout, and for browsers the CI retries,\nconfigured in `dart_test.yaml`. These account for most of the recent\nbrowser flakes in CI. Find them by running with `-x browser -x dart2js\n-x node` and nonexistent browser executables, and tag everything that\nstill launches a browser or node.\n\n- Tag browser and node groups in `compiler_runtime_matrix_test.dart`.\n- Tag the Chrome tests in `compiler_test.dart`,\n  `configuration/compiler_test.dart`, `coverage_test.dart`,\n  `github_reporter_test.dart`, and `line_and_col_test.dart`, and the\n  node test in `line_and_col_test.dart`.\n- Allow `node` tagged tests to run on macOS as well as linux.\n- Tag the coverage tests which run `pub get` with `pub`, and retry `pub`\n  tagged tests on CI since resolution sometimes stalls on the network.\n- Raise the `cross_compiler_hang` suite load timeout from 20s to 60s.\n  Chrome suites take 9-18s to load on the Windows runners while the exe\n  suites compile concurrently. A regression of the deadlock the package\n  reproduces hangs indefinitely, so a longer timeout still catches it."
    },
    {
      "commit": "4f92d530daf7e1c9e8a9acf518304a41408dbdc4",
      "tree": "79dfee3f79943d96fda4b9e5d703cd3cd0f1ada3",
      "parents": [
        "7fb848666f0d1c9c5e2cee233ab72d65ef3bd1be"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Sep 25 23:46:22 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 25 23:46:22 2026"
      },
      "message": "Unskip a test on windows (#2772)\n\nCloses #1615\n\nThis test was recently updated to use the `main()`\nentrypoint and is passing on windows."
    },
    {
      "commit": "7fb848666f0d1c9c5e2cee233ab72d65ef3bd1be",
      "tree": "a733929ec5cc01f9a1b722043976d619506a6009",
      "parents": [
        "603e5ec54e7bfd511b6729b4698bbec186489574"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Sep 25 21:52:39 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 25 21:52:39 2026"
      },
      "message": "Bundle skips at the end of the GitHub reporter (#2768)\n\nInstead of opening and closing skipped test groups as skipped tests\ncomplete (which splits passing test output into multiple groups),\ncollect skipped tests in `_skippedTests` during `_onComplete` and emit\nthem in a single collapsed `Skipped tests` group in `_onDone` before the\nfinal summary.\n\nSince skipped tests are no longer emitted as an active group during test\nexecution, passing tests are the only multi-test group that can remain\nopen. Remove the `_ReportGroup` enum and replace `_activeGroup` with a\nboolean `_inPassingGroup` field. Also extract a `_testName` helper to\nshare test name formatting across `_onComplete`, `_onError`, and\n`_onDone`."
    },
    {
      "commit": "603e5ec54e7bfd511b6729b4698bbec186489574",
      "tree": "a201cc98862b677234ae1c7943a588352a1804f3",
      "parents": [
        "4bf04d90f9b671af7bea068f822c01a96ee46d43"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Sep 24 21:00:41 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 24 21:00:41 2026"
      },
      "message": "Clean up the runner\u0027s temporary directories (#2763)\n\nTemporary directories were created all over the place - browser profiles,\ncompiler output, the VM platform\u0027s sockets - each with its own\n`Directory.systemTemp.createTempSync` call, and nothing deleted most of them. A\nrun leaves everything it created behind for the OS to clean up whenever it gets\naround to it.\n\nThey are now all created under a single `dart_test.` directory, so cleanup is\none recursive delete. `Runner.close` does that delete once every platform has\nbeen closed, which also covers a run interrupted with a single Control-C, since\nthat shuts down gracefully.\n\nA second signal skips the graceful shutdown, so the handler added in #2765\ndeletes the directory synchronously before it exits.\n\nThis also replaces `createTempDir`, which returned a path, with\n`createTempDirectory`, which returns a `Directory`. It takes a prefix so the\ndirectories nested under the shared root stay distinguishable, matching the\nnames the call sites passed when they used `dart:io` directly.\n\nThe VM platform\u0027s per-suite socket directory moves out from under the platform\u0027s\nown temp directory and becomes a sibling of it, which keeps the unix socket path\nwithin the ~104 byte limit it has on some platforms.\n\n\"Press Control-C again to terminate immediately\" now performs a synchronous\nrecursive delete before exiting, which is not free for the large directories\nthat motivated this."
    },
    {
      "commit": "4bf04d90f9b671af7bea068f822c01a96ee46d43",
      "tree": "c61b951839ed0f23d6de5a006a71d5a5ca13b047",
      "parents": [
        "2c660a840c6478fb25562765c455a4f66baf7d1c"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Sep 24 19:41:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 24 19:41:15 2026"
      },
      "message": "Refactor signal handling in executable.dart (#2765)\n\nKeep the signal subscription active during graceful shutdown so a second\nsignal can be handled explicitly in Dart before exiting with the signal\nexit code, and cancel the subscription in the finally block once the\nrunner closes. Add logic to determine the exit code that would have been\nused by the Dart VM when it was handling the second signal.\nThis prepares for an upcoming change which improves temporary directory\ncleanup during shutdown.\n\nThe `runTests` and `completeShutdown` methods are unused externally, so\nremove and inline them. Move the `signalSubscription` global variable to\na local variable in the main method. Drop the global `isShutdown`\nvariable. Reset `_stdinLines` in `cancelStdinLines` so it is safe to\ncall more than once."
    },
    {
      "commit": "2c660a840c6478fb25562765c455a4f66baf7d1c",
      "tree": "687c26bb58b3a754c73aab46b85fad541f781ffd",
      "parents": [
        "9946c9551ddaffd6092c22372b7e146600aa3264"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Sep 22 22:33:34 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 22 22:33:34 2026"
      },
      "message": "Regenerate mono_repo output (#2767)\n\nUpdate to the latest mono_repo which include `paths:` configuration to\nreduce unnecessary triggers of the large CI workflows."
    },
    {
      "commit": "9946c9551ddaffd6092c22372b7e146600aa3264",
      "tree": "81d20384d6636eb36bdfeffcc514430c1f1e633f",
      "parents": [
        "48c3fdf6f2fb91cb5e16ab32e637ac348e031d35"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon Sep 21 19:31:54 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 21 19:31:54 2026"
      },
      "message": "Fix a race in the frontend server client fake (#2762)\n\nThe `TestCompiler` implementation includes some file IO before it calls\n`FrontendServerClient.compile`. This was accounted for in the tests only\nwith `await pumpEventQueue();` which isn\u0027t guaranteed to complete after\nthe OS operations. Make the ordering explicit by adding a stream ofa\ncalls to the compiler and making that the only mechanism to communicate\nthe result.\n\nRemove the unused `compileCallCount` and `isCompileCalled` fields. Make\nthe test body responsible for completing with errors for the test where\nit\u0027s closed before the compile is finished."
    },
    {
      "commit": "48c3fdf6f2fb91cb5e16ab32e637ac348e031d35",
      "tree": "8b2a60d03c788c42a5736f2caea6e880f69ceeef",
      "parents": [
        "5d74864ba91cbc2778b3b479094de9660253d517"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Sat Sep 19 01:52:52 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 19 01:52:52 2026"
      },
      "message": "Fix race conditions during test load (#2761)\n\n`Engine._addLoadSuite` awaits `LoadSuite.suite`, whose completer is only\never completed from inside the load test\u0027s body: either when the body\nfinishes loading the suite, or by the `onComplete` handler the body\nregisters. If the load test is closed before its body runs at all,\nneither happens and nothing ever completes the suite.\n\nThat stalls the task `Engine.run` added for the suite, so it never\nreleases its resource from `_runPool`, so `_runPool.close()` never\ncompletes, so `Engine.close()` and in turn `Runner.close()` hang\nforever.\n\nToday this is masked in the runner: the signal handler cancels its\nsignal subscription immediately, so the VM exits once nothing else\nholds the event loop even though `close()` never completed. Anything\nthat keeps the isolate alive past that point turns it into a real hang.\n\nHold onto the completer in `LoadSuite` and add `completeWithoutSuite`,\nwhich completes it with a null suite if nothing else has. Call it once\nthe load test has finished running, from both `Engine._addLoadSuite`\nand `LoadSuite.getSuite`. It is a no-op in every normal path, since the\nbody holds an outstanding callback until it completes the completer.\n\nSkip running the load test when the engine is already closed. Nothing\nneeds to be loaded for a closed engine, and `completeWithoutSuite` still\nunblocks anything waiting on the suite."
    },
    {
      "commit": "5d74864ba91cbc2778b3b479094de9660253d517",
      "tree": "8be256c711d867d98d44d1ff50856ff11e2a90bc",
      "parents": [
        "5c4d9b25cec33bdbfc66317de87c1c5e68892afc"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Sep 18 23:25:57 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 23:25:57 2026"
      },
      "message": "Remove mentions of Travis (#2760)\n\nClean up stale comment references to travis.\n\nRemove some skips that date back to when we were using travis."
    },
    {
      "commit": "5c4d9b25cec33bdbfc66317de87c1c5e68892afc",
      "tree": "f7af9a6b91badff1d1505396ebcd40ee0815cbd3",
      "parents": [
        "f927df26f70f80592749b5b23a9d18152b500cd5"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Sep 18 19:49:00 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 19:49:00 2026"
      },
      "message": "Use consistent *Checks naming for prints (#2759)\n\nRename to `AsyncFunctionChecks` and `VoidFunctionChecks` with a comment\nexplaining that it exists for extension precedence."
    },
    {
      "commit": "f927df26f70f80592749b5b23a9d18152b500cd5",
      "tree": "d8912734877d815b98fd25b928a9779699878a4f",
      "parents": [
        "347a5af26026aebb28f01a6947b2ccaa11082ea0"
      ],
      "author": {
        "name": "Kevin Moore",
        "email": "kevmoo@users.noreply.github.com",
        "time": "Fri Sep 18 19:15:49 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 19:15:49 2026"
      },
      "message": "feat(checks): add prints expectations (#2742) (#2743)\n\nCloses #2742\n\nAdd `prints()` check extensions on `Subject\u003cvoid Function()\u003e`\n(`FunctionPrints`) and `Subject\u003cFuture\u003cvoid\u003e Function()\u003e`\n(`AsyncFunctionPrints`) to validate captured `print()` output from\nsynchronous and asynchronous callbacks.\n\n- Intercept `print()` via `ZoneSpecification` during function execution.\n- `FunctionPrints.prints()` (on `Subject\u003cvoid Function()\u003e`) returns\n  `Subject\u003cString\u003e` for synchronous checking on captured output and\n  asserts that the callback does not return a `Future` at runtime.\n- `AsyncFunctionPrints.prints()` (on `Subject\u003cFuture\u003cvoid\u003e Function()\u003e`)\n  awaits the returned `Future` before checking `Condition\u003cString\u003e` and\n  returning `Future\u003cSubject\u003cString\u003e\u003e`.\n- Add runnable `{@example}` files, update migration guide, and add tests\n  for output capture and error rejections."
    },
    {
      "commit": "347a5af26026aebb28f01a6947b2ccaa11082ea0",
      "tree": "5f78dba1938e0d16c8a1f488e9e5b51eeb99b784",
      "parents": [
        "6358dbb3c5dfb414e3e8ed2fd0fd131974e5a97e"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Sep 18 19:09:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 19:09:15 2026"
      },
      "message": "Add an example for every matcher (#2757)\n\nAdds a runnable example under `pkgs/matcher/example/` for each of the 93\npublic matchers and expect layer helpers, and links each one from its member\u0027s\ndartdoc with `{@example /example/\u003cgroup\u003e/\u003cmember\u003e.dart}`. This mirrors the\nexamples added for `package:checks` in #2756.\n\nEvery example is a `package:test` test file with at least one expectation that\npasses, and the failure that a failing expectation produces is recorded\nverbatim in a comment immediately following it. Members with a single failing\ncase use one test for both the passing and the failing expectation; members\nwith more than one failing case use a test per case. The examples are\ntherefore expected to fail when run directly, which is how the failure\nmessages stay visible. The exception is `anything`, which matches every value\nand so has no failing case; its example shows the placeholder use it is\nactually for. Deprecated members are skipped.\n\n`test/example_test.dart` checks that the failures each example produces equal\nthe output recorded in its comments, so the documented failure messages cannot\ndrift from the real ones. All of the examples are run together in a single\n`dart test` invocation with the JSON reporter, which associates each failure\nwith the suite it came from, and the whole suite takes about nine seconds.\n\nUnlike the `package:checks` messages, not every matcher failure begins with\n`Expected:`. `fail`, `neverCalled` and the future matchers report a bare\nmessage. A recorded failure is therefore identified by its position - the run\nof comment lines that ends a test body - rather than by its first line.\n\nThe examples for the `throws` matchers demonstrate the failure where the\nfunction returns instead of throwing. The failure for a function that throws\nthe wrong type embeds a stack trace whose line numbers refer to the example\nitself, so recording it would invalidate the recording on every edit. That\nmessage also contains a whitespace only line, which `dart format` strips from\na comment and which therefore cannot be recorded at all.\n\nRecorded output cannot be reflowed, and some messages are longer than 80\ncharacters at the indentation a test body requires, so `example/` carries an\nanalysis options file that turns off `lines_longer_than_80_chars` for the\nexamples only. The rest of the package keeps the rule. The repository root\nalready disables it, but `pkgs/matcher/analysis_options.yaml` includes\n`dart_flutter_team_lints` directly rather than the root options, so the rule is\non for this package.\n\nWriting the examples also surfaced that the documentation for\n`stringContainsInOrder` was separated from its declaration by a blank line, so\nit was a plain comment rather than a doc comment and did not appear in the\ngenerated documentation. The blank line is removed."
    },
    {
      "commit": "6358dbb3c5dfb414e3e8ed2fd0fd131974e5a97e",
      "tree": "690b3347a96ea191b73f2d3b62d4600e6baf0e0b",
      "parents": [
        "88202adcd58c0b9f1c2ec9fca6a603bb337e5a45"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Sep 17 22:10:08 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 17 22:10:08 2026"
      },
      "message": "Add an example for every checks expectation, and fix the bugs they exposed (#2756)\n\nAdds a runnable example under `pkgs/checks/example/` for each of the 79\npublic members of the expectation extensions in\n`pkgs/checks/lib/src/extensions/`, and links each one from its member\u0027s\ndartdoc with `{@example /example/\u003csource\u003e/\u003csubject\u003e/\u003cmember\u003e.dart}`.\n\nEvery example is a `package:test` test file with at least one check that\npasses and at least one that fails, and the failure that a failing check\nproduces is recorded verbatim in a comment immediately following it.\nMembers with a single failing case use one test for both the passing and\nthe failing check; members with more than one failing case use a test\nper case, including for the passing checks. The examples are therefore\nexpected to fail when run directly, which is how the failure messages\nstay visible. The two deprecated members,\n`IterableChecks.containsInOrder` and\n`IterableChecks.pairwiseComparesTo`, are skipped.\n\nExamples are written as tests rather than plain scripts because\nasynchronous expectations call `TestHandle.current` and throw\n`OutsideTestException` outside a running test. Examples that would\notherwise report a stack trace construct their errors with\n`Future.error`, `Stream.error`, or `Error.throwWithStackTrace(...,\nStackTrace.empty)` so that the recorded output does not contain machine\nspecific paths.\n\n`test/example_test.dart` checks that the failures each example produces\nequal the output recorded in its comments, so the documented failure\nmessages cannot drift from the real ones. All of the examples are run\ntogether in a single `dart test` invocation with the JSON reporter,\nwhich associates each failure with the suite it came from. Running them\none invocation apiece instead costs about 2.5s each, since every\ninvocation pays the runner startup and spawns a new `frontend_server`\nprocess initialized from `.dart_tool/test/incremental_kernel.*`;\nbatching them lets the runner compile all suites incrementally against\none live `frontend_server` instance and run them concurrently, which\ntakes the suite from 3m25s to 9s.\n\nRecording the real output instead of the plausible output exposed five\ndefects in the failure messages. Each is fixed here, along with its test\nexpectations and the recorded output of the affected examples.\n\n`MapChecks.isNotEmpty` described the wrong condition. Rejecting an empty\nmap reported `Which: is not empty`, which repeats the expectation\u0027s own\nwording instead of saying what was wrong with the value.\n`IterableChecks.isNotEmpty` and `StringChecks.isNotEmpty` both correctly\nsay `is empty`. Two existing tests asserted the incorrect string rather\nthan catching it.\n\n`not` emitted a trailing space. The clause was built as `\u0027is a value\nthat: \u0027`, while the matching clause for the expectation is `\u0027is not a\nvalue that:\u0027` with no trailing space. Besides being inconsistent,\ntrailing whitespace is stripped by `dart format`, so the message could\nnot be recorded in an example comment.\n\n`pairwiseMatches` did not indent its nested detail. The `Actual element\nat index N:` and `Which:` lines were emitted at the same level as the\n`does not have an element at index N that:` line that introduces them,\nso they read as unrelated top level clauses instead of as the detail of\nthe element that failed. `every` already indents the equivalent lines.\n\n`equalsIgnoringWhitespace` reported offsets that did not line up with\nthe value it displayed. The difference is computed between the two\nstrings after their whitespace is collapsed, so the reported offset and\nthe caret are positions in the collapsed value, but the message showed\nthe original value on the `Actual:` line. For `check(\u0027hello   wide\nworld\u0027)` against `\u0027hello world\u0027` the message pointed at offset 7, which\nis a different character in the original than in the collapsed string.\nThe difference is now reported beneath a line naming the collapsed value\nit was computed from, so the offset and caret can be matched up with the\nstring they refer to.\n\n`isA`, `IterableChecks.any`, `MapChecks.containsKeyThat`, and\n`MapChecks.containsValueThat` began their `Which:` clause with a capital\nletter, unlike every other rejection in the package. They are now lower\ncase."
    },
    {
      "commit": "88202adcd58c0b9f1c2ec9fca6a603bb337e5a45",
      "tree": "3c6190de3c2ebb640c04eb729d3f2f0d4a43c8b0",
      "parents": [
        "c80d53dbd489d61e0481fc484cd6f9a3b53603fb"
      ],
      "author": {
        "name": "Sigurd Meldgaard",
        "email": "sigurdm@google.com",
        "time": "Thu Sep 17 12:13:30 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 17 12:13:30 2026"
      },
      "message": "New flag --shard-by-suite\n\nRunning all setupAll hooks is expensive when what we are trying to do is to minimize the time spent for each shard.\n\nThis allows choosing a less fine-grained strategy of sharding by individual test files.\n\nFixes https://github.com/dart-lang/test/issues/2614"
    },
    {
      "commit": "c80d53dbd489d61e0481fc484cd6f9a3b53603fb",
      "tree": "c63a1a01d09166c9e0ccb34c4dcebda62df2dc98",
      "parents": [
        "62b31331d972677e8189c317f733ff4384b77787"
      ],
      "author": {
        "name": "XananasX",
        "email": "cihbank069@gmail.com",
        "time": "Wed Sep 09 02:43:41 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 09 02:43:41 2026"
      },
      "message": "ci: pin dart-lang/ecosystem reusable workflows to commit SHA to prevent supply-chain attacks (#2687)\n\nCo-authored-by: XananasX7 \u003cXananasX7@users.noreply.github.com\u003e\nCo-authored-by: Nate Bosch \u003cnbosch@google.com\u003e"
    },
    {
      "commit": "62b31331d972677e8189c317f733ff4384b77787",
      "tree": "15047f4ea3fab292e74805d9e541b9f8332bf26a",
      "parents": [
        "d983b56db60ad589f6fdae71ca00d3520874695e"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Sep 09 00:32:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 09 00:32:15 2026"
      },
      "message": "Make zero-arg expectations getters (#2752)\n\nCloses #1943\n\nDon\u0027t require parenthesis for extensions that will never take arguments."
    },
    {
      "commit": "d983b56db60ad589f6fdae71ca00d3520874695e",
      "tree": "b51a100d9478ecb244c8e4d75d54e6055ce850a9",
      "parents": [
        "20d248fbc7d19e7dda9613e78d12117c7b64b9ae"
      ],
      "author": {
        "name": "Kevin Moore",
        "email": "kevmoo@users.noreply.github.com",
        "time": "Sat Sep 05 01:09:22 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 05 01:09:22 2026"
      },
      "message": "Move to Safari drive to try to make safari testing less flaky (#2598)"
    },
    {
      "commit": "20d248fbc7d19e7dda9613e78d12117c7b64b9ae",
      "tree": "ee81e3e318f57fb4237a173ef8dc42c76dba3e41",
      "parents": [
        "31cb6bdd449b2c480489cd62e24aceaa594bb884"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Sat Sep 05 01:06:31 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 05 01:06:31 2026"
      },
      "message": "Make FAQ more prominent in migration guide (#2753)"
    },
    {
      "commit": "31cb6bdd449b2c480489cd62e24aceaa594bb884",
      "tree": "862083190ff2d770df0776d1fa9d269376b59725",
      "parents": [
        "21a02b7319e72e99d742b37f05160e7c5a3a017a"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Sat Sep 05 00:18:04 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 05 00:18:04 2026"
      },
      "message": "Restore Condition as a class (#2697)\n\nCloses #2694\n\nReintroduce `Condition\u003cT\u003e` as a class in place of callback typedefs\n(`void Function(Subject\u003cT\u003e)` / `FutureOr\u003cvoid\u003e Function(Subject\u003cT\u003e)`).\n\nPreviously, the `Condition` class was dropped in favor of callback\nfunctions, in part to avoid `it()` appearing like a language feature.\nHowever, using callback functions introduced type inference limitations.\n\n- Callbacks required declaring explicit parameters, introducing\n  unnecessary boilerplate across expectation calls.\n- When explicit types are required it takes a full `Subject\u003cSomeType\u003e`\n  as the argument type annotation, mixing the details of the\n  implementation with the goal of passing a type argument.\n- When type inference failed (such as in collection matching or\n  heterogeneous checks), callbacks resulted in cryptic runtime errors\n  regarding missing extension methods on `Subject` with no static\n  assistance.\n\nReintroducing `Condition\u003cT\u003e` with a `Condition.it\u003cT\u003e()` static helper.\n\n- Dot shorthands provide a terse, readable syntax\n  (`.it()..isGreaterThan(0)`) without polluting the top-level namespace.\n- When inference fails `Condition.it\u003cSomeType\u003e()` is more explicit and\n  readable than `(Subject\u003cSomeType\u003e it) \u003d\u003e`.\n- Consolidating `softCheck`, `softCheckSync`, `describe`, and\n  `describeSync` as instance methods on `Condition\u003cT\u003e` (and eliminating\n  standalone top-level functions `softCheck`, `softCheckAsync`,\n  `describe`, `describeAsync`) improves overall API discoverability and\n  ergonomics, despite being a breaking change.\n\nExample Migration:\n\nBefore:\n```dart\ncheck(numbers).any((it) \u003d\u003e it.isGreaterThan(5));\n\ncheck(map).containsKeyThat((key) \u003d\u003e key\n  ..startsWith(\u0027a\u0027)\n  ..has((s) \u003d\u003e s.length, \u0027length\u0027).isGreaterThan(2));\n```\n\nAfter:\n```dart\ncheck(numbers).any(.it()..isGreaterThan(5));\n\ncheck(map).containsKeyThat(.it()\n  ..startsWith(\u0027a\u0027)\n  ..has((s) \u003d\u003e s.length, \u0027length\u0027).isGreaterThan(2));\n```"
    },
    {
      "commit": "21a02b7319e72e99d742b37f05160e7c5a3a017a",
      "tree": "e6f0f581354f5fd9312cd3666886491e2c1feba6",
      "parents": [
        "2c431ed79e6d2c74ae88555584ce28b679899606"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Sep 04 23:10:08 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 04 23:10:08 2026"
      },
      "message": "Allow similar use between sync and async checks (#2683)\n\nCloses #2695\n\nOriginally async expectations which extract a value also returned a\n`Subject` like synchronous extensions still do, but they were changed to\naccept `AsyncCondition` callback arguments for ergonomics. Add support\nfor synchronous `Condition` callbacks on a few expectations that return\nsubjects for authors who prefer to use the async style for synchronous\nchecks too.\n\nAffected APIs:\n- `Subject.isA`\n- `Subject.isNotNull`\n- `Subject\u003cT Function()\u003e.throws`\n- `Subject\u003cT Function()\u003e.returnsNormally`\n\nRestore the `Future\u003cSubject\u003e` return value from async check extensions\nthat accept an optional `AsyncCondition` argument. This allows usage of\nother patterns which some authors may feel are better aligned with the\nsync checks of the original pattern.\n\nAffected APIs:\n- `Subject\u003cFuture\u003e.completes`\n- `Subject\u003cFuture\u003e.throws`\n- `Subject\u003cStreamQueue\u003e.emits`\n- `Subject\u003cStreamQueue\u003e.emitsError`\n\nRefactor tests into finer grained cases and add cases for the new\narguments."
    },
    {
      "commit": "2c431ed79e6d2c74ae88555584ce28b679899606",
      "tree": "6a106adcedae681ddd22f33e3e37f1da8a68c89c",
      "parents": [
        "18ef597883dc6bc61f763e3600a7179975b490dd"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Sep 04 21:08:23 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 04 21:08:23 2026"
      },
      "message": "Prepare to publish package:checks (#2748)\n\nPublish with a number of quality of life improvements before landing\nchanges planned for release with a breaking version bump.\n\nIncrease timeout for new socket hang test.\nThis is a new test that appears to have been too close to the limit\nwhen it landed."
    },
    {
      "commit": "18ef597883dc6bc61f763e3600a7179975b490dd",
      "tree": "087759aacd1c99c166f9e6ba04e824a4f1bb4a00",
      "parents": [
        "6783445c2ec0d34372bd75a1655729693ecd216a"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Sep 04 17:13:39 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 04 17:13:39 2026"
      },
      "message": "Add support for collapsed error messages (#2651)\n\nChecks against a subject are commonly nested against some other subject,\nfor example the check for an exact list length is in practice an\n`equals` expectation checked against an integer which is the \"has\nlength\" subject, nested under the subject holding the list instance.\nFailure messages have a rigid structure that represents this nesting\npattern and always indent the \"clauses\" (the descriptions of what was\nchecked in expectations) following the \"label\" which describes the\nsubject.\n\nFor very simple conditions the noise of the structure is greater than\nthe signal of the description output by the specific failing\nexpectation. For instance a trivial check for a future completing to an\nexpected value looks like:\n\n```\n  Expected: a Future\u003cList\u003cint\u003e\u003e that:\n    completes to a value that:\n      is not empty\n  Actual: a Future\u003cList\u003cint\u003e\u003e that:\n    completes to a value that:\n    Actual: []\n    Which: is empty\n```\n\nAdd support for collapsing this to:\n\n```\n  Expected: a Future\u003cList\u003cint\u003e\u003e that completes to a non-empty iterable\n  Actual: a Future\u003cList\u003cint\u003e\u003e that completes to []\n  Which: is empty\n```\n\nAdd a `predicateNoun` callback argument to `expect`, `expectAsync`, and\n`expectUnawaited`. Extensions must pass a callback which provides the\n\"clause\" representation like \"is empty\". Now they may also pass a\ncallback which provides a predicate noun formed by combining the clause\nwith a noun for the subject like \"an empty iterable\".\n\nAdd an `addPredicate` callback argument to `nest`, and `nestAsync`.\nExtensions must pass a callback which provides a label for the value\nthey are deriving from the original subject like \"completes to a value\".\nNow they may also pass a callback which takes a collapsed form of the\nnoun as described by nested conditions, and attaches the predicate it\ncontributes.\n\nCheck for possibilities to collapse failure messages down to predicate\nnouns when generating failure messages. When full single-line collapsing\nis not possible, child clauses and `Actual:` lines still collapse where\nsupported within the multi-line format.\n\nAdd predicate noun callbacks to existing extensions where sensible.\nTweak some wording where I noticed inconsistencies.\n\nUse of these new arguments is completely optional for extension\nimplementations and impacts only the failure message formatting which is\nnot considered a breaking change.\n\nThe user impact is that many simple expectation failures will be more\ncompact and readable, but the position of the failing expectation in a\nseries of cascaded expectations may cause a significantly different\noutput for the same checks usage. It has always been the case that\nexpectations which follow a failure have no impact on the output,\nbecause they are never reached to run. Now when the first expectation in\na series has a collapsible representation, its failure triggers an\noverall collapsed format which will read differently from the expanded\nformat if any condition other than the first fails."
    },
    {
      "commit": "6783445c2ec0d34372bd75a1655729693ecd216a",
      "tree": "53b9f0188a144f49c849ddb042dd0555cadc23f2",
      "parents": [
        "8de693e1be8e8da99c02e60eecc645054f90acf3"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Sep 02 23:46:04 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 02 23:46:04 2026"
      },
      "message": "Prepare to publish (#2737)"
    },
    {
      "commit": "8de693e1be8e8da99c02e60eecc645054f90acf3",
      "tree": "7ea94c33a13699cd7db77c63bcbc78db677930b3",
      "parents": [
        "575e4dad8db2864224a407af43bfc46ce9c045c8"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Sep 01 03:54:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 01 03:54:15 2026"
      },
      "message": "Bump the github-actions group with 2 updates (#2744)\n\nBumps the github-actions group with 2 updates: [dart-lang/setup-dart](https://github.com/dart-lang/setup-dart) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).\n\nUpdates `dart-lang/setup-dart` from 1.7.2 to 1.8.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/dart-lang/setup-dart/releases\"\u003edart-lang/setup-dart\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.8.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate workflows to pin \u003ccode\u003eactions/checkout\u003c/code\u003e to a commit SHA.\u003c/li\u003e\n\u003cli\u003eHarden workflow permissions to \u003ccode\u003econtents: read\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003epublish.yml\u003c/code\u003e reusable workflow to reference \u003ccode\u003esetup-dart@v1.8.0\u003c/code\u003e and latest \u003ccode\u003esetup-flutter\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to \u003ccode\u003e6.28.0\u003c/code\u003e and \u003ccode\u003e@vercel/ncc\u003c/code\u003e to \u003ccode\u003e0.44.1\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.8.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a problem matcher for \u003ccode\u003edart analyze\u003c/code\u003e to automatically create inline annotations on GitHub pull requests.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003epublish.yml\u003c/code\u003e reusable workflow to reference \u003ccode\u003esetup-dart@v1.7.2\u003c/code\u003e (running on Node 24) (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/188\"\u003e#188\u003c/a\u003e[]).\u003c/li\u003e\n\u003cli\u003eUpdate GitHub Action dependencies (\u003ccode\u003eactions/checkout\u003c/code\u003e v7).\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to \u003ccode\u003e6.27.0\u003c/code\u003e and update npm dependencies.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/188\"\u003e#188\u003c/a\u003e: \u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/188\"\u003edart-lang/setup-dart#188\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/dart-lang/setup-dart/blob/main/CHANGELOG.md\"\u003edart-lang/setup-dart\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.8.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate workflows to pin \u003ccode\u003eactions/checkout\u003c/code\u003e to a commit SHA.\u003c/li\u003e\n\u003cli\u003eHarden workflow permissions to \u003ccode\u003econtents: read\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003epublish.yml\u003c/code\u003e reusable workflow to reference \u003ccode\u003esetup-dart@v1.8.0\u003c/code\u003e and latest \u003ccode\u003esetup-flutter\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to \u003ccode\u003e6.28.0\u003c/code\u003e and \u003ccode\u003e@vercel/ncc\u003c/code\u003e to \u003ccode\u003e0.44.1\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.8.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a problem matcher for \u003ccode\u003edart analyze\u003c/code\u003e to automatically create inline annotations on GitHub pull requests.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003epublish.yml\u003c/code\u003e reusable workflow to reference \u003ccode\u003esetup-dart@v1.7.2\u003c/code\u003e (running on Node 24) (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/188\"\u003e#188\u003c/a\u003e[]).\u003c/li\u003e\n\u003cli\u003eUpdate GitHub Action dependencies (\u003ccode\u003eactions/checkout\u003c/code\u003e v7).\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to \u003ccode\u003e6.27.0\u003c/code\u003e and update npm dependencies.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/188\"\u003e#188\u003c/a\u003e: \u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/188\"\u003edart-lang/setup-dart#188\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.7.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Node.js requirement to Node 24.\u003c/li\u003e\n\u003cli\u003eFix open Dependabot alerts by bumping \u003ccode\u003eundici\u003c/code\u003e to \u003ccode\u003e\u0026gt;\u003d6.24.0\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUpdate GitHub Action dependencies (\u003ccode\u003e@actions/core\u003c/code\u003e, \u003ccode\u003e@actions/exec\u003c/code\u003e, \u003ccode\u003e@actions/tool-cache\u003c/code\u003e, \u003ccode\u003e@actions/http-client\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eUpdate workflow actions to their latest versions (\u003ccode\u003eactions/checkout\u003c/code\u003e v6, \u003ccode\u003esetup-flutter\u003c/code\u003e).\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.7.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRoll \u003ccode\u003eundici\u003c/code\u003e dependency to address \u003ca href\u003d\"https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975\"\u003eCVE-2025-22150\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eUpdate to the latest npm dependencies.\u003c/li\u003e\n\u003cli\u003eRecompile the action using the new Dart / JavaScript interop.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.7.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eInstall flutter sdk in publishing step, allowing Flutter packages to be\npublished (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/68\"\u003e#68\u003c/a\u003e[])\u003c/p\u003e\n\u003cp\u003e\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/68\"\u003e#68\u003c/a\u003e: \u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/68\"\u003edart-lang/setup-dart#68\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix zip path handling on Windows 11 (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/118\"\u003e#118\u003c/a\u003e[])\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/118\"\u003e#118\u003c/a\u003e: \u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/118\"\u003edart-lang/setup-dart#118\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.6.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRebuild JS code.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.3\u003c/h2\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/6afc89df92d6eb3834022f73cd65adc8cdfcb92d\"\u003e\u003ccode\u003e6afc89d\u003c/code\u003e\u003c/a\u003e Pin actions/checkout to a commit SHA and harden workflow permissions (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/196\"\u003e#196\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/b653b3cfefb8a28264680eac1d50028789184290\"\u003e\u003ccode\u003eb653b3c\u003c/code\u003e\u003c/a\u003e Prepare v1.8.1 release (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/195\"\u003e#195\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/45165d2ee1360cec3b96db808cfed1ac276dd71a\"\u003e\u003ccode\u003e45165d2\u003c/code\u003e\u003c/a\u003e Bump the github-actions group across 1 directory with 2 updates (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/194\"\u003e#194\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/9af6bba6fc903c8d3427e54f6bef88b1cb519a77\"\u003e\u003ccode\u003e9af6bba\u003c/code\u003e\u003c/a\u003e Pin actions/checkout to a commit SHA in publish.yml (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/193\"\u003e#193\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/ddca5d2081d05961010a263feb54fba5a01e4fb8\"\u003e\u003ccode\u003eddca5d2\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​vercel/ncc\u003c/code\u003e in the npm-dependencies group across 1 directory (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/185\"\u003e#185\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/5c116a34f6a4c3b222192b56c5440d03fc813d96\"\u003e\u003ccode\u003e5c116a3\u003c/code\u003e\u003c/a\u003e Bump undici from 6.27.0 to 6.28.0 (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/190\"\u003e#190\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/7654d458321ee25acccccfdb86cd48bd95768ff1\"\u003e\u003ccode\u003e7654d45\u003c/code\u003e\u003c/a\u003e chore: prepare v1.8.0 release (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/188\"\u003e#188\u003c/a\u003e) (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/189\"\u003e#189\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/43c102f4dc9b9829c862401f0b64c7c9184eab4e\"\u003e\u003ccode\u003e43c102f\u003c/code\u003e\u003c/a\u003e Bump actions/checkout from 6 to 7 in the github-actions group (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/184\"\u003e#184\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/10b57efefac07722403c8b9c95fa68bb09276def\"\u003e\u003ccode\u003e10b57ef\u003c/code\u003e\u003c/a\u003e Bump the npm-dependencies group across 1 directory with 2 updates (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/179\"\u003e#179\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/a73965b3c99b30eb092908ce56c429eff91f9634\"\u003e\u003ccode\u003ea73965b\u003c/code\u003e\u003c/a\u003e Bump undici from 6.24.1 to 6.27.0 (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/182\"\u003e#182\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/dart-lang/setup-dart/compare/65eb853c7ba17dde3be364c3d2858773e7144260...6afc89df92d6eb3834022f73cd65adc8cdfcb92d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.37.4 to 4.37.9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.9\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.8\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href\u003d\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.2 - 21 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote\u003d\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href\u003d\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.0 - 08 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003e\u003ccode\u003ecdf488f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4107\"\u003e#4107\u003c/a\u003e from github/update-v4.37.9-920ba7cd1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306\"\u003e\u003ccode\u003e7243f38\u003c/code\u003e\u003c/a\u003e Update changelog for v4.37.9\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e\"\u003e\u003ccode\u003e920ba7c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4106\"\u003e#4106\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2\"\u003e\u003ccode\u003eecfa6e1\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1\"\u003e\u003ccode\u003eadcdf4a\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e\"\u003e\u003ccode\u003e486fec2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4099\"\u003e#4099\u003c/a\u003e from github/update-supported-enterprise-server-versions\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76\"\u003e\u003ccode\u003e134624c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4101\"\u003e#4101\u003c/a\u003e from github/dependabot/npm_and_yarn/npm-minor-457d82...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c\"\u003e\u003ccode\u003eff43db8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4103\"\u003e#4103\u003c/a\u003e from github/mergeback/v4.37.8-to-main-db488dde\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816\"\u003e\u003ccode\u003e4605e03\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d\"\u003e\u003ccode\u003e099c869\u003c/code\u003e\u003c/a\u003e Update changelog and version after v4.37.8\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s major version (unless you unignore this specific dependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s minor version (unless you unignore this specific dependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\u003c/details\u003e"
    },
    {
      "commit": "575e4dad8db2864224a407af43bfc46ce9c045c8",
      "tree": "c9c771baa247c30d9eef02ce0920522393984790",
      "parents": [
        "bd9acf32c983dde41b94e9c75eab45136408c065"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Sep 01 00:01:46 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 01 00:01:46 2026"
      },
      "message": "Fix deadlock waiting on serverSocket (#2740)\n\nWork around, and reduce the odds of triggering, a bug in the Dart SDK\nimplementation of unix domain sockets on windows.\n\nhttps://github.com/dart-lang/sdk/issues/64166\n\nOn windows in Dart sockets are being inherited by subprocesses, so\nspawned test processes (like the chrome browser) would inherit them, and\nsubsequently after receiving a connection the socket cancel would never\ncomplete (waiting on subprocess which inherited the socket to exit) so\nthe `Stream.first` future would also never complete. This surfaced as a\ndeadlock only in the case where a browser startup happens while the\nsocket server is waiting for the first connection.\n\nDrastically reduce the odds of this situation by waiting to bind the\nsocket server until the subprocess is about to start, instead of\nlistening on the socket during the compilation process as well.\n\nWork around the situation in case it still happens with a `fastFirst`\nextension which behaves like `first` except it explicitly does not await\nthe Future returned from `cancel`.\n\nAdd an integration test which demonstrates the conditions required to\ntrigger the bug. We can remove this after the SDK is fixed."
    },
    {
      "commit": "bd9acf32c983dde41b94e9c75eab45136408c065",
      "tree": "ab6500922f9243294e40eb4a88db260cfa6e88f9",
      "parents": [
        "b575eda93383390f15b5f0cb4243a097867a82f8"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Aug 28 05:53:54 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 28 05:53:54 2026"
      },
      "message": "Unskip a test on windows (#2741)\n\nI noticed it was working when testing a fix for a process hang."
    },
    {
      "commit": "b575eda93383390f15b5f0cb4243a097867a82f8",
      "tree": "48bbb9ed614667a272e252309088b60cd45cde83",
      "parents": [
        "d21b06cb526356ee41949fc984827b3ba4f532d2"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Aug 28 00:16:16 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 28 00:16:16 2026"
      },
      "message": "Remove redundant tag (#2738)\n\nThis tag was added along with support for VM debugging, but it was\nalways redundant and likely introduced because of confusion over whether\nit would impact whether this test case runs for VM tests. There is no\nconfiguration in `dart_test.yaml` associated with this tag.\n\nRemoves a warning to make the test output be more fully grouped in the\ngithub reporter output."
    },
    {
      "commit": "d21b06cb526356ee41949fc984827b3ba4f532d2",
      "tree": "4d33ec37eedcebb6b1d9aef8f417249202411218",
      "parents": [
        "773bc56c7514ab161e15ad48088b2627c4939f4b"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Aug 27 23:38:17 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 27 23:38:17 2026"
      },
      "message": "Bump the github-actions group across 1 directory with 5 updates (#2709)\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: Nate Bosch \u003cnbosch@google.com\u003e"
    },
    {
      "commit": "773bc56c7514ab161e15ad48088b2627c4939f4b",
      "tree": "acb6f9d45b00c9008ac1ea49b97f4eafeb024a4b",
      "parents": [
        "73e85f1befa5315711763fa3d097656dc53ecfb5"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Aug 27 23:11:00 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 27 23:11:00 2026"
      },
      "message": "Use read permissions in test_descriptor and test_process workflows (#2736)"
    },
    {
      "commit": "73e85f1befa5315711763fa3d097656dc53ecfb5",
      "tree": "a3b31a47e2b51fe6e15197d444f50e80d2853f04",
      "parents": [
        "bbe8f9bf5ee392ed2d80813b7faa892ab36da3e3"
      ],
      "author": {
        "name": "herdiyanitdev",
        "email": "82978131+herdiyana256@users.noreply.github.com",
        "time": "Tue Aug 25 23:36:41 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 25 23:36:41 2026"
      },
      "message": "Precompiled browser tests: stop serving files from outside the precompiled root (#2724)\n\nThe precompiled browser-test server serves files from outside its root because it disables shelf_static\u0027s path containment. `pkgs/test/lib/src/runner/browser/compilers/precompiled.dart` builds its static handler as:\n\n```dart\n.add(createStaticHandler(_root, serveFilesOutsidePath: true))\n```\n\nThe two sibling compilers in the same directory build the same handler without that flag:\n\n```dart\n// dart2js.dart and dart2wasm.dart\n.add(createStaticHandler(_root))\n```\n\nWith `serveFilesOutsidePath: true`, shelf_static stops rejecting requests whose path resolves outside `_root`, so a `..`-bearing request to the precompiled server is served a file from anywhere on disk the runner can read. Precompiled is the only one of the three that does this.\n\nRemoving the flag does not change what the browser can load. In precompiled mode `_root` is the precompiled output directory itself (`platform.dart` passes `root: _config.suiteDefaults.precompiledPath`), so the compiled `.js` bundles and their bootstrap `.html` already live under it. `/packages/` requests are served by the separate `packagesDirHandler` already in the cascade. Source maps are never fetched by the browser: `compileSuite` reads the `.js.map` server-side with `File(mapPath).readAsStringSync()` and builds a `JSStackTraceMapper` in the runner process. Nothing the browser requests needs a path outside `_root`, which is why dart2js and dart2wasm already serve an equivalent root with containment on.\n\nThe server binds to loopback and nests every handler under a per-run secret URL segment, and the comment on that secret says its job is to keep other users on the same machine from snooping on what the server serves. The secret does not actually hide from a co-located user: the full server URL is passed to the browser on its command line, so another local user can read it from `/proc/\u003cpid\u003e/cmdline`. With containment on that only lets them read within `_root`; with `serveFilesOutsidePath: true` it lets them read any file the runner user can read, for example `/\u003csecret\u003e/../../../home/\u003cuser\u003e/.ssh/id_rsa`. Removing the flag restores the boundary the secret is meant to enforce.\n\nThe fix drops the flag so precompiled matches the other two compilers:\n\n```dart\n// before\n.add(createStaticHandler(_root, serveFilesOutsidePath: true))\n// after\n.add(createStaticHandler(_root))\n```"
    },
    {
      "commit": "bbe8f9bf5ee392ed2d80813b7faa892ab36da3e3",
      "tree": "2d97b4ae75534542bf42adf52e4b2edc86aefb68",
      "parents": [
        "55b186ddcad50fe4808226e0b681875dda6dd123"
      ],
      "author": {
        "name": "Kevin Moore",
        "email": "kevmoo@users.noreply.github.com",
        "time": "Tue Aug 18 16:02:24 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 18 16:02:24 2026"
      },
      "message": "Export TestFailure from package:test_api/scaffolding.dart (#2723)\n\nRe-export `TestFailure` in `package:test_api/scaffolding.dart` (which in turn\nexports it in `package:test/scaffolding.dart`).\n\nThis allows users migrating from `package:test/test.dart` to\n`package:test/scaffolding.dart` (such as when using `package:checks`) to\nthrow or handle `TestFailure` exceptions without needing an explicit import\nof `package:test_api/hooks.dart`.\n\nCloses #2073"
    },
    {
      "commit": "55b186ddcad50fe4808226e0b681875dda6dd123",
      "tree": "0bba2dc36574a39354aba7c6302b93992cac84d2",
      "parents": [
        "51463b0e38b45fa3849c302bdea7a4e585ad0764"
      ],
      "author": {
        "name": "Sigurd Meldgaard",
        "email": "sigurdm@google.com",
        "time": "Mon Aug 10 20:18:01 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 10 20:18:01 2026"
      },
      "message": "Fix race conditions in Chrome coverage collection (#2715)\n\nFixes race conditions causing intermittent empty coverage results in\nchrome tests (such as in `coverage_test.dart`).\n\n- in `browsermanager`: await `_environment` during startup before\n  completing initialization. this ensures the devtools connection and\n  profiler are ready before test suites begin executing.\n- in `chrome`:\n  - register the `onscriptparsed` listener before calling\n    `tabconnection.debugger.enable()` to avoid dropping initial\n    `debugger.scriptparsed` events emitted during initialization.\n  - establish the remote debugger url and tab connection together in\n    `_connect`, returning both as a record.\n  - safely handle null tab connections in `gathercoverage`."
    },
    {
      "commit": "51463b0e38b45fa3849c302bdea7a4e585ad0764",
      "tree": "0c4f39a0176e0dee8ed1247958ad464e435e1b31",
      "parents": [
        "b87a24924c1d167d848ac36ec0ad4c74752026bf"
      ],
      "author": {
        "name": "Yusuf İhsan Görgel",
        "email": "developeryusuf@icloud.com",
        "time": "Mon Aug 10 18:59:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 10 18:59:15 2026"
      },
      "message": "Keep the browser executable env override through a settings merge (#2722)\n\nFixes #2609\n\nUpdate `README.md` and `configuration.md` to document the four\nenvironment variables and the precedence of configuration. Fix broken\nanchor links.\n\nFix configuration merging to include the environment overrides to\nresolve the bug where using browser configuration would cause the runner\nto ignore the environment variables. Add a test in\n`cutsom_platform_test.dart` to configure chrome arguments and use an\noverride environment variable."
    },
    {
      "commit": "b87a24924c1d167d848ac36ec0ad4c74752026bf",
      "tree": "3fb24630adae43ced65f784578d43488c90a107d",
      "parents": [
        "dd426d439da9d399975a3455d4d507bce9fec01b"
      ],
      "author": {
        "name": "Jacob MacDonald",
        "email": "jakemac@google.com",
        "time": "Fri Aug 07 19:07:52 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 07 19:07:52 2026"
      },
      "message": "Enable asserts (#2719)\n\nFixes #2718"
    },
    {
      "commit": "dd426d439da9d399975a3455d4d507bce9fec01b",
      "tree": "cd045c023bd65eefa3b6c81c4b697d5a2fc77fe0",
      "parents": [
        "4838365e7fb3a2d0302cdbbd8330b7884f7d3c0d"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Aug 04 22:46:52 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 04 22:46:52 2026"
      },
      "message": "Obfuscate the test runner connection for VM and Node tests (#2704)\n\nUnix domain sockets (using a file in a freshly created temp directory)\nare more secure by default than server sockets. Since Dart 3.11.0 (and\nwindows 10) we have the ability to use unix domain sockets on windows,\nso use them for VM tests now.\n\nNode on windows still does not support unix domain sockets, so add a\nsecret token shared in a freshly created temp directory."
    },
    {
      "commit": "4838365e7fb3a2d0302cdbbd8330b7884f7d3c0d",
      "tree": "853d6342d9bd413c2f92f655a999894b45ceaf21",
      "parents": [
        "70ac3ff48fe0ff6198b69ffc309554eaf2713a53"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Aug 04 21:22:07 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 04 21:22:07 2026"
      },
      "message": "Avoid transitive imports to package:analyzer (#2712)\n\nCloses https://github.com/dart-lang/sdk/issues/63923\n\nThe analyzer package sources dominate the compile time for small tests.\nAvoid importing the analyzer transitively from `package:test/test.dart`.\n\nMove the tests of the `test_api` import restrictions to the integration\ntest directory so it\u0027s easier to reuse for tests across the packages.\nAdd a test that `package:test/test.dart` does not transitively import\nany library under the analyzer package.\n\nUse a more narrow import of the parts of the `Platform` library which\nare needed in the JSON reporter implementation."
    },
    {
      "commit": "70ac3ff48fe0ff6198b69ffc309554eaf2713a53",
      "tree": "f7b956b9591b027211bdfe54396ac462a2668be3",
      "parents": [
        "bdc372215035729467c10d37293a18f7a42038bc"
      ],
      "author": {
        "name": "HamdaanAliQuatil",
        "email": "96776914+HamdaanAliQuatil@users.noreply.github.com",
        "time": "Tue Aug 04 06:50:07 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 04 06:50:07 2026"
      },
      "message": "[test] Support CLI compiler for sanitizer runtimes (#2708)"
    },
    {
      "commit": "bdc372215035729467c10d37293a18f7a42038bc",
      "tree": "78039aa36e8be85c57c3a7d7c2b64e56ad417419",
      "parents": [
        "a9a4442708cc61b7d1169812b3938fb9c64e444d"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Aug 04 01:01:34 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 04 01:01:34 2026"
      },
      "message": "Avoid read-all permissions in dart.yml CI action (#2713)\n\nResolves a zizmor warning."
    },
    {
      "commit": "a9a4442708cc61b7d1169812b3938fb9c64e444d",
      "tree": "f7c6c8161499c124a65b31e1cf52f28282107310",
      "parents": [
        "5fcd6f405cc4a9c503f0eafa476d675f63a91bb8"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Sat Aug 01 01:45:09 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 01 01:45:09 2026"
      },
      "message": "Annotate async expectations with awaitNotRequired (#2700)\n\nCloses #2139\n\nAsynchronous expectations which return a `Future` already use\n`TestHandle.current.markPending()` so that test cases are not considered\ncomplete until after the expectations are complete. Some uses will want\nto `await` anyway to maintain execution order in tests, but it\u0027s valid\nto \"fire and forget\" asynchronous expectations when execution order\ndoesn\u0027t matter. Annotate with `@awaitNotRequired` so this is explicit\nand the `unawaited_futures` lint is suppressed at call sites."
    },
    {
      "commit": "5fcd6f405cc4a9c503f0eafa476d675f63a91bb8",
      "tree": "6bdd304d9dd28f4668540f3c2a3d623848d638f2",
      "parents": [
        "72d6dfcc9a8ad7df52315ecc589a04584d160235"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Jul 23 23:01:06 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 23:01:06 2026"
      },
      "message": "Remove unnecessary remote debugging flag (#2705)\n\nThe comment above the argument is outdated - chromium based browsers\nlaunched with the arguments we are using, including a unique user\nprofile directory not associated with any running browser instance, will\nwork without also opening a debugging port."
    },
    {
      "commit": "72d6dfcc9a8ad7df52315ecc589a04584d160235",
      "tree": "5eac335e7aabd0a906ff29f4894072aa165b7e16",
      "parents": [
        "8ab388460a1dbe87991b1bc500e221317840d53f"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Jul 23 21:02:30 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 21:02:30 2026"
      },
      "message": "Launch browsers with redirecting files (#2703)\n\nThe test runner creates a secret key used for communication with the\nbrowsers to prevent third party processes from connecting as if they\nwere running test suites, but this key is current leaking through the\ncommand arguments when starting the browser process. We are already\nusing temp directories which should prevent external reads and the\nsafari browser launcher already used this pattern. Extend the\n`redirect.html` pattern to chromium and firefox browsers."
    },
    {
      "commit": "8ab388460a1dbe87991b1bc500e221317840d53f",
      "tree": "19c112f7d388b78e6d68bec8068103dbf0c26587",
      "parents": [
        "d835f706cfb62d09df445c464ec5a7cfa22a1f69"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Jul 23 20:50:10 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 20:50:10 2026"
      },
      "message": "Disable more backgrounding features on chromium (#2680)\n\nAdd more flags to disable backgrounding when launching chromium based\nbrowsers. These came up in an internal CL but should be helpful to\ninclude externally."
    },
    {
      "commit": "d835f706cfb62d09df445c464ec5a7cfa22a1f69",
      "tree": "0b2e07b4a51c09f15a80d43d92f8652ca784d3e0",
      "parents": [
        "9abe202a42014f8127ac31c4c6440a336ec15502"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Jul 22 23:30:46 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 22 23:30:46 2026"
      },
      "message": "Only print debug URL when debugging (#2702)\n\nEither `--coverage` or `--pause-after-load` is sufficient to enable\nthe `debug` state for the test runner, but in the case of `--coverage`\nwithout interactive debugging the VM debugger URL is not relevant to the\nuser. Change the condition used to decide whether to include this URL in\nthe JSON reporter output to only when `--pause-after-load` is used."
    },
    {
      "commit": "9abe202a42014f8127ac31c4c6440a336ec15502",
      "tree": "c9c6532ec59d496bb8e6821f5730aef0e59ff784",
      "parents": [
        "ce557ba1bf935ca8dbf199fc4b3b9c4b486806e7"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Jul 21 18:56:41 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 21 18:56:41 2026"
      },
      "message": "Ignore dart2js output for successful compiles (#2701)\n\nFollowup to #2699\n\nThe compiler output had some utility when dart2js could be slow for some\ntest runs, but it\u0027s likely ignored nearly always today.\n\nDrop the output from successful compiles and output only when the exit\ncode indicates an error. Update test expectations accordingly."
    },
    {
      "commit": "ce557ba1bf935ca8dbf199fc4b3b9c4b486806e7",
      "tree": "25f1a07c905e5204dcb41a1e9cf45ff647b0cde5",
      "parents": [
        "d79747cd5dff76ea53f8e4d722a1bc69d468b550"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon Jul 20 23:25:56 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 20 23:25:56 2026"
      },
      "message": "Group messages with passing tests (#2699)\n\nCloses #2636\n\nWeb tests (currently) unconditionally print information about the compile, so\ntreating messages during loading as separate output from passing tests\ncauses significantly longer output when web and VM tests are\ninterleaved.\n\nAvoid closing groups for tests that print messages. This will impact\nmore than loading tests, but won\u0027t impact errors which are the important\noutput."
    },
    {
      "commit": "d79747cd5dff76ea53f8e4d722a1bc69d468b550",
      "tree": "659ce948e967d419f6e06352d04b4a199cd50bc0",
      "parents": [
        "91ca13f0d38155e5b3a7e5ec1dc6f2904ced1f4f"
      ],
      "author": {
        "name": "Jacob MacDonald",
        "email": "jakemac@google.com",
        "time": "Fri Jul 17 20:10:12 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 20:10:12 2026"
      },
      "message": "Make workflow files more secure (#2698)\n\nThis is just a result of running `zizmore --fix\u003dall` on this package"
    },
    {
      "commit": "91ca13f0d38155e5b3a7e5ec1dc6f2904ced1f4f",
      "tree": "ab81966d3664ab261886f30021015f99d0e80236",
      "parents": [
        "dcb06ac7b2c26a8e4aa9139e45d56c07c00be7c0"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Jul 08 21:17:45 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 08 21:17:45 2026"
      },
      "message": "Support DART_TEST_REPORTER environment variable (#2692)\n\nAllow configuring the test reporter using the `DART_TEST_REPORTER`\nenvironment variable.\n\nThis variable is honored by:\n- Test suites run directly (when `dart:io` is available).\n- The test runner (when `--reporter` CLI flag is not used).\n\nThe order of precedence for the test runner is:\n1. `dart_test.yaml`\n2. `DART_TEST_REPORTER` environment variable\n3. `--reporter` CLI argument (highest priority)"
    },
    {
      "commit": "dcb06ac7b2c26a8e4aa9139e45d56c07c00be7c0",
      "tree": "57f074e9930c9a9181336c395d2893fd1dc1c05c",
      "parents": [
        "bd92e633e7f05edc3301865bdc00d1ae181cb1f1"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jul 01 03:50:42 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 01 03:50:42 2026"
      },
      "message": "Bump the github-actions group with 3 updates (#2689)\n\nBumps the github-actions group with 3 updates: [actions/cache](https://github.com/actions/cache), [actions/checkout](https://github.com/actions/checkout) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).\n\nUpdates `actions/cache` from 5.0.5 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/cache/releases\"\u003eactions/cache\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/cache\u003c/code\u003e to v6.1.0 - handle read-only cache access by \u003ca href\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1768\"\u003eactions/cache#1768\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/cache/compare/v6...v6.1.0\"\u003ehttps://github.com/actions/cache/compare/v6...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate packages, migrate to ESM by \u003ca href\u003d\"https://github.com/Samirat\"\u003e\u003ccode\u003e@​Samirat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1760\"\u003eactions/cache#1760\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/cache/compare/v5...v6.0.0\"\u003ehttps://github.com/actions/cache/compare/v5...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/cache\u003c/code\u003e to v5.1.0 - handle read-only cache access by \u003ca href\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1775\"\u003eactions/cache#1775\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/cache/compare/v5...v5.1.0\"\u003ehttps://github.com/actions/cache/compare/v5...v5.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/cache/blob/main/RELEASES.md\"\u003eactions/cache\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleases\u003c/h1\u003e\n\u003ch2\u003eHow to prepare a release\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\nRelevant for maintainers with write access only.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003col\u003e\n\u003cli\u003eSwitch to a new branch from \u003ccode\u003emain\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003enpm test\u003c/code\u003e to ensure all tests are passing.\u003c/li\u003e\n\u003cli\u003eUpdate the version in \u003ca href\u003d\"https://github.com/actions/cache/blob/main/package.json\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/package.json\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003enpm run build\u003c/code\u003e to update the compiled files.\u003c/li\u003e\n\u003cli\u003eUpdate this \u003ca href\u003d\"https://github.com/actions/cache/blob/main/RELEASES.md\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/RELEASES.md\u003c/code\u003e\u003c/a\u003e with the new version and changes in the \u003ccode\u003e## Changelog\u003c/code\u003e section.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003elicensed cache\u003c/code\u003e to update the license report.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003elicensed status\u003c/code\u003e and resolve any warnings by updating the \u003ca href\u003d\"https://github.com/actions/cache/blob/main/.licensed.yml\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/.licensed.yml\u003c/code\u003e\u003c/a\u003e file with the exceptions.\u003c/li\u003e\n\u003cli\u003eCommit your changes and push your branch upstream.\u003c/li\u003e\n\u003cli\u003eOpen a pull request against \u003ccode\u003emain\u003c/code\u003e and get it reviewed and merged.\u003c/li\u003e\n\u003cli\u003eDraft a new release \u003ca href\u003d\"https://github.com/actions/cache/releases\"\u003ehttps://github.com/actions/cache/releases\u003c/a\u003e use the same version number used in \u003ccode\u003epackage.json\u003c/code\u003e\n\u003col\u003e\n\u003cli\u003eCreate a new tag with the version number.\u003c/li\u003e\n\u003cli\u003eAuto generate release notes and update them to match the changes you made in \u003ccode\u003eRELEASES.md\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eToggle the set as the latest release option.\u003c/li\u003e\n\u003cli\u003ePublish the release.\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/li\u003e\n\u003cli\u003eNavigate to \u003ca href\u003d\"https://github.com/actions/cache/actions/workflows/release-new-action-version.yml\"\u003ehttps://github.com/actions/cache/actions/workflows/release-new-action-version.yml\u003c/a\u003e\n\u003col\u003e\n\u003cli\u003eThere should be a workflow run queued with the same version number.\u003c/li\u003e\n\u003cli\u003eApprove the run to publish the new version and update the major tags for this action.\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2\u003eChangelog\u003c/h2\u003e\n\u003ch3\u003e6.1.0\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/cache\u003c/code\u003e to v6.1.0 to pick up \u003ca href\u003d\"https://redirect.github.com/actions/toolkit/pull/2435\"\u003eactions/toolkit#2435 Handle cache write error due to read-only token\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSwitch redundant \u0026quot;Cache save failed\u0026quot; warning to debug log in save-only\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e6.0.0\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated \u003ccode\u003e@actions/cache\u003c/code\u003e to ^6.0.1, \u003ccode\u003e@actions/core\u003c/code\u003e to ^3.0.1, \u003ccode\u003e@actions/exec\u003c/code\u003e to ^3.0.0, \u003ccode\u003e@actions/io\u003c/code\u003e to ^3.0.2\u003c/li\u003e\n\u003cli\u003eMigrated to ESM module system\u003c/li\u003e\n\u003cli\u003eUpgraded Jest to v30 and test infrastructure to be ESM compatible\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.4\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eminimatch\u003c/code\u003e to v3.1.5 (fixes ReDoS via globstar patterns)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003efast-xml-parser\u003c/code\u003e to v5.5.6\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.3\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/cache\u003c/code\u003e to v5.0.5 (Resolves: \u003ca href\u003d\"https://github.com/actions/cache/security/dependabot/33\"\u003ehttps://github.com/actions/cache/security/dependabot/33\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/core\u003c/code\u003e to v2.0.3\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.2\u003c/h3\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9\"\u003e\u003ccode\u003e55cc834\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/cache/issues/1768\"\u003e#1768\u003c/a\u003e from jasongin/readonly-cache\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337\"\u003e\u003ccode\u003ed8cd72f\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to v6.1.0 - handle cache write error due to RO token\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8\"\u003e\u003ccode\u003e2c8a9bd\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/cache/issues/1760\"\u003e#1760\u003c/a\u003e from actions/samirat/esm_migration_and_package_update\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023\"\u003e\u003ccode\u003ee9b91fd\u003c/code\u003e\u003c/a\u003e Prettier fixes\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb\"\u003e\u003ccode\u003ee4884b8\u003c/code\u003e\u003c/a\u003e Rebuild dist\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f\"\u003e\u003ccode\u003e10baf01\u003c/code\u003e\u003c/a\u003e Fixed licenses\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37\"\u003e\u003ccode\u003ee39b386\u003c/code\u003e\u003c/a\u003e Fix test mock return order\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06\"\u003e\u003ccode\u003eb692820\u003c/code\u003e\u003c/a\u003e PR feedback\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1\"\u003e\u003ccode\u003e6074912\u003c/code\u003e\u003c/a\u003e Rebuild dist bundles as ESM to match type:module\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e\"\u003e\u003ccode\u003e5a912e8\u003c/code\u003e\u003c/a\u003e Fix lint and jest issues\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/checkout` from 6.0.2 to 7.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/checkout/releases\"\u003eactions/checkout\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eblock checking out fork pr for pull_request_target and workflow_run by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2458\"\u003eactions/checkout#2458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.1 to 3.4.2 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2460\"\u003eactions/checkout#2460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.2.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2461\"\u003eactions/checkout#2461\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e and \u003ccode\u003e@​actions/tool-cache\u003c/code\u003e and Remove uuid by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2459\"\u003eactions/checkout#2459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade module to esm and update dependencies by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2463\"\u003eactions/checkout#2463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 3 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2462\"\u003eactions/checkout#2462\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003egetting ready for checkout v7 release by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2464\"\u003eactions/checkout#2464\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate error wording by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2467\"\u003eactions/checkout#2467\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/checkout/compare/v6.0.3...v7.0.0\"\u003ehttps://github.com/actions/checkout/compare/v6.0.3...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate changelog by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2357\"\u003eactions/checkout#2357\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate changelog for v6.0.3 by \u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2446\"\u003eactions/checkout#2446\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/checkout/compare/v6...v6.0.3\"\u003ehttps://github.com/actions/checkout/compare/v6...v6.0.3\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock checking out fork PR for pull_request_target and workflow_run by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2458\"\u003eactions/checkout#2458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.1 to 3.4.2 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2460\"\u003eactions/checkout#2460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.2.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2461\"\u003eactions/checkout#2461\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e and \u003ccode\u003e@​actions/tool-cache\u003c/code\u003e and Remove uuid by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2459\"\u003eactions/checkout#2459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade module to esm and update dependencies by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2463\"\u003eactions/checkout#2463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 3 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2462\"\u003eactions/checkout#2462\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca href\u003d\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca href\u003d\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca href\u003d\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca href\u003d\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca href\u003d\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca href\u003d\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment variables by \u003ca href\u003d\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca href\u003d\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca href\u003d\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0\"\u003e\u003ccode\u003e9c091bb\u003c/code\u003e\u003c/a\u003e update error wording (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2467\"\u003e#2467\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a\"\u003e\u003ccode\u003e1044a6d\u003c/code\u003e\u003c/a\u003e getting ready for checkout v7 release (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2464\"\u003e#2464\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f\"\u003e\u003ccode\u003ef028218\u003c/code\u003e\u003c/a\u003e Bump the minor-npm-dependencies group across 1 directory with 3 updates (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2462\"\u003e#2462\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d\"\u003e\u003ccode\u003ed914b26\u003c/code\u003e\u003c/a\u003e upgrade module to esm and update dependencies (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2463\"\u003e#2463\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d\"\u003e\u003ccode\u003e537c7ef\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/core\u003c/code\u003e and \u003ccode\u003e@​actions/tool-cache\u003c/code\u003e and Remove uuid (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2459\"\u003e#2459\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6\"\u003e\u003ccode\u003e130a169\u003c/code\u003e\u003c/a\u003e Bump js-yaml from 4.1.0 to 4.2.0 (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2461\"\u003e#2461\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3\"\u003e\u003ccode\u003e7d09575\u003c/code\u003e\u003c/a\u003e Bump flatted from 3.3.1 to 3.4.2 (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2460\"\u003e#2460\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e\"\u003e\u003ccode\u003e0f9f3aa\u003c/code\u003e\u003c/a\u003e Bump actions/publish-immutable-action (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2458\"\u003e#2458\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7\"\u003e\u003ccode\u003ef9e715a\u003c/code\u003e\u003c/a\u003e block checking out fork pr for pull_request_target and workflow_run (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2454\"\u003e#2454\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10\"\u003e\u003ccode\u003edf4cb1c\u003c/code\u003e\u003c/a\u003e Update changelog for v6.0.3 (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2446\"\u003e#2446\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.36.0 to 4.36.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.36.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCache CodeQL CLI version information across Actions steps. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3943\"\u003e#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3937\"\u003e#3937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6\"\u003e2.25.6\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3948\"\u003e#3948\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.36.1\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.2 - 04 Jun 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCache CodeQL CLI version information across Actions steps. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3943\"\u003e#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3937\"\u003e#3937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6\"\u003e2.25.6\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3948\"\u003e#3948\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.36.1 - 02 Jun 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.0 - 22 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.19.4. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.5 - 15 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca href\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal \u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will be enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for GitHub-internal use only, and may change without notice at any time. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning analysis for a PR with \u003ca href\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.4 - 07 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.3 - 01 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP OIDC are now accepted. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use \u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.2 - 15 Apr 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled using the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the \u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/8aad20d150bbac5944a9f9d289da16a4b0d87c1e\"\u003e\u003ccode\u003e8aad20d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3949\"\u003e#3949\u003c/a\u003e from github/update-v4.36.2-dcb947ce1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/f521b08cd8f468ab193ea950a589cb2e9c869c6a\"\u003e\u003ccode\u003ef521b08\u003c/code\u003e\u003c/a\u003e Add additional changelog notes\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/8aeff0ffb7b78582ee0d0e6eebb8140684400d08\"\u003e\u003ccode\u003e8aeff0f\u003c/code\u003e\u003c/a\u003e Update changelog for v4.36.2\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/dcb947ce15976d40ea82935510b2db4872ec124c\"\u003e\u003ccode\u003edcb947c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3948\"\u003e#3948\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.25.6\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/c251bcefa178f7780f62f150002acffe3d07fde9\"\u003e\u003ccode\u003ec251bce\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/62953c18b35f59e28351d2f1e806925aef8b1e3c\"\u003e\u003ccode\u003e62953c1\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.25.6\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/423b570baf1976cd7a3daeba5d6e9f9b76432f37\"\u003e\u003ccode\u003e423b570\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3946\"\u003e#3946\u003c/a\u003e from github/dependabot/npm_and_yarn/npm-minor-5d507a...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/c35d1b164463ee62a100735382aaaa525c5d3496\"\u003e\u003ccode\u003ec35d1b1\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3947\"\u003e#3947\u003c/a\u003e from github/dependabot/github_actions/dot-github/wor...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/cb1a588b02755b176e7b9d033ed4b69312f0e1bd\"\u003e\u003ccode\u003ecb1a588\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3937\"\u003e#3937\u003c/a\u003e from github/robertbrignull/waitForProcessing_backoff\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/ba47406412c54532b5b4fcfbaf877c9e2382b206\"\u003e\u003ccode\u003eba47406\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3943\"\u003e#3943\u003c/a\u003e from github/henrymercer/cache-cli-version-info\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...8aad20d150bbac5944a9f9d289da16a4b0d87c1e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s major version (unless you unignore this specific dependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s minor version (unless you unignore this specific dependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\u003c/details\u003e"
    },
    {
      "commit": "bd92e633e7f05edc3301865bdc00d1ae181cb1f1",
      "tree": "9ff664f7cef2fb308e27cec60f2993f4db4c37a7",
      "parents": [
        "4724c3e7f11b4353581f669f74474c9543c259cb"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Sat Jun 27 01:31:05 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Jun 27 01:31:05 2026"
      },
      "message": "Prepare to publish (#2686)"
    },
    {
      "commit": "4724c3e7f11b4353581f669f74474c9543c259cb",
      "tree": "6badf9c8e1f77203d2f08b49483516ce302ecf54",
      "parents": [
        "7ec7891273cd7940d247a6f0ee32c39972854ef5"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Jun 26 17:40:41 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 26 17:40:41 2026"
      },
      "message": "Use compact reporters by default for direct runs (#2685)\n\nSince we cannot import `dart:io` for tests running on the web we\nhistorically defaulted to the expanded reporter as the only alternative\nto the compact reporter. This doesn\u0027t match most users preferences since\nit makes a verbose output in all cases.\n\nDefault instead to the failures only reporter which is quieter, and add\na platform specific library to automatically switch to the compact\nreporter when it\u0027s supported by both the Dart platform and the runtime\nenvironment."
    },
    {
      "commit": "7ec7891273cd7940d247a6f0ee32c39972854ef5",
      "tree": "a7ef3453645debac590fd88fd5d11e0fdab9040c",
      "parents": [
        "4ba65bdd5e3bf4c98eb869aa81f2c55254275578"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Jun 25 23:49:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jun 25 23:49:15 2026"
      },
      "message": "Add `isNotA\u003cR\u003e()` extension (#2681)\n\nCloses #2673\n\nIn a negative type check context it is not sensible to perform further\nchecks, but that may be tempting (potentially with autocomplete) in an\nexpression like `not((it) \u003d\u003e it.isA\u003cFoo\u003e()`. Add an `isNotA\u003cR\u003e`\nextension which does not return a subject."
    },
    {
      "commit": "4ba65bdd5e3bf4c98eb869aa81f2c55254275578",
      "tree": "f4f109fd4d939fd8dac217c6b73707a2cadf12c2",
      "parents": [
        "3d8c1f7379cf7fe68135622ef0496fdca72f1118"
      ],
      "author": {
        "name": "Daco Harkes",
        "email": "dacoharkes@google.com",
        "time": "Thu Jun 25 17:51:01 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jun 25 17:51:01 2026"
      },
      "message": "[test] More `dart test -c cli` fixes (#2677)\n\nMore fixes to make `dart --enable-experiment\u003drecord-use test -c cli` work:\r\n\r\n* Fix forwarding experiment flags to the Dart compiler.\r\n* Fix concurrency issues:\r\n  * Don\u0027t override compiled app bundles, dir otherwise only `-j 1` succeeds.\r\n  * https://dart-review.googlesource.com/c/sdk/+/515600/3/pkg/dartdev/lib/src/commands/build.dart also for `-j` more than 1.\r\n* Fix pub workspace behavior: Specify the correct root package when running tests in workspaces.\r\n* Fix windows (the bundle executable ends with `.exe`).\r\n\r\nAfter this PR and https://dart-review.googlesource.com/c/sdk/+/515600, the test project in https://github.com/dart-lang/native/pull/3424 works as expected.\r\n\r\n~~A release to pub.dev. Should it be 1.33 instead because we add a new feature? Any in flight changes that block a release @natebosch @jakemac53 ?~~ Edit: First landing the changes before bumping the versions."
    },
    {
      "commit": "3d8c1f7379cf7fe68135622ef0496fdca72f1118",
      "tree": "6ce17847dd3bff2c8a1641b48025932a4d0deee1",
      "parents": [
        "e768f8d9abc037bd47a1ad7d349baf14dee767d6"
      ],
      "author": {
        "name": "Kevin Moore",
        "email": "kevmoo@users.noreply.github.com",
        "time": "Tue Jun 23 00:14:11 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 23 00:14:11 2026"
      },
      "message": "fix(node): update dart2wasm runner for new instantiation API (#2682)"
    },
    {
      "commit": "e768f8d9abc037bd47a1ad7d349baf14dee767d6",
      "tree": "ff88e064b4de604fafe047da125ed69bddfcec75",
      "parents": [
        "1020c783adbebea6dc64627e2418cc6f7576fde6"
      ],
      "author": {
        "name": "Jacob MacDonald",
        "email": "jakemac@google.com",
        "time": "Mon Jun 22 22:00:08 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 22 22:00:08 2026"
      },
      "message": "fix package:test CI jobs (#2678)\n\nFix windows edge test expectations.\n\nSkip Node+WASM tests and link issue https://github.com/dart-lang/test/issues/2679"
    },
    {
      "commit": "1020c783adbebea6dc64627e2418cc6f7576fde6",
      "tree": "cf174a435a948ee20e3feb969401d1e5126f777b",
      "parents": [
        "113123d9e6bb624c568d19a706df2bf0c6961b04"
      ],
      "author": {
        "name": "Konstantin Scheglov",
        "email": "scheglov@google.com",
        "time": "Fri Jun 19 16:25:42 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 19 16:25:42 2026"
      },
      "message": "Require \u0027analyzer \u003e\u003d13.0.0 \u003c15.0.0\u0027 (#2676)"
    },
    {
      "commit": "113123d9e6bb624c568d19a706df2bf0c6961b04",
      "tree": "69c76cdc689c3c46afae26ca1248e31e8738d436",
      "parents": [
        "2283825c186d3c4e025b0d9ba084ca9eeeb3bd23"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Jun 11 00:48:48 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jun 11 00:48:48 2026"
      },
      "message": "Add package:checks_codegen (#2632)\n\nInitial open sourcing of the code generation companion to\n`package:checks`. This generates extension using the `.has()` utility\nfor each field in the classes specified for generation.\n\nAdd an annotation to mark imports of the generated libraries as a\ntrigger for the codegen as configuration for which types to generate\nfor. Add the builder using `package:source_gen` to target the\nannotation. Add tests using `package:build_test`. Add an example with a\nchecked in generated file."
    },
    {
      "commit": "2283825c186d3c4e025b0d9ba084ca9eeeb3bd23",
      "tree": "0898229f1bcba4bbe0572b4e132739a6461fa1c0",
      "parents": [
        "2adf8b546d878cb7f6534653d0a821ac7e1f5753"
      ],
      "author": {
        "name": "Jacob MacDonald",
        "email": "jakemac@google.com",
        "time": "Mon Jun 08 18:29:44 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 08 18:29:44 2026"
      },
      "message": "allow package_config version 3.x.x (#2667)"
    },
    {
      "commit": "2adf8b546d878cb7f6534653d0a821ac7e1f5753",
      "tree": "e0263429f0de869f9f70830f4ca1045522177711",
      "parents": [
        "e3df43cff88de1da8fc076561bf4a3fdaa167c07"
      ],
      "author": {
        "name": "Daco Harkes",
        "email": "dacoharkes@google.com",
        "time": "Mon Jun 08 17:20:54 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 08 17:20:54 2026"
      },
      "message": "[test] Add compiler `dart test -c cli` to run hooks (#2660)\n\nBug:\r\n\r\n* https://github.com/dart-lang/sdk/issues/63372\r\n\r\nThis PR uses `dart build cli` under the `-c cli` flag.\r\n\r\nImplementation:\r\n\r\n* The wrapper Dart script around the test that package test creates is the new entry-point and **must** be within the package root to run the correct hooks.\r\n  * So, this PR updates the temp dir to be in `.dart_tool/test/temp/\u003c...\u003e` rather than in the system temp.\r\n* Gates the implementation on the next dev release after https://dart-review.googlesource.com/c/sdk/+/506242.\r\n\r\nTesting:\r\n\r\n* The integration tests run with the `cli` compiler\r\n* The integration tests must run on a valid package with a valid pubspec and package_config.json (otherwise the hooks-runner cannot determine which hooks to run).\r\n* The integration tests do _not_ actually run a hook and include c code. `dart build cli` bundles are already properly tested in the dartdev tests for `dart build cli` in the SDK. If you feel we should add an integration test running native code here, I\u0027m happy to add one.\r\n* Skips the tests before the next dev release.\r\n  * **TODO**: Rerun tests on Tuesday after new dev release has come out."
    },
    {
      "commit": "e3df43cff88de1da8fc076561bf4a3fdaa167c07",
      "tree": "b14dff4843f4f46657e32ff84d7a9e2a2c3b1103",
      "parents": [
        "f7a6b6271e3b8fcc8a452330e2a0434439c10f96"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Jun 03 23:40:03 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 03 23:40:03 2026"
      },
      "message": "Disable chrome throttling options (#2666)\n\nI don\u0027t expect this to have an effect in typical tests, but in case a\ntest opens a new tab or similar it\u0027s a good idea to disable throttling\nwhen the browser is controlled by automation."
    },
    {
      "commit": "f7a6b6271e3b8fcc8a452330e2a0434439c10f96",
      "tree": "594a5c20f66083a67147a189140a9be5e0b901ca",
      "parents": [
        "d270d51aa590f69a92fc76dec985eaeeaf6a0a87"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Jun 03 22:39:08 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 03 22:39:08 2026"
      },
      "message": "Recompile host.dart with 3.12.1 SDK (#2645)"
    },
    {
      "commit": "d270d51aa590f69a92fc76dec985eaeeaf6a0a87",
      "tree": "ba5a50740f15a176f809e9761b31e7a93381d51b",
      "parents": [
        "5a897b2ff53d681a5fd1e4b86e94252970f7b719"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Jun 03 16:26:37 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 03 16:26:37 2026"
      },
      "message": "Handle objects with empty toString (#2662)\n\nThe approach to building text descriptions involves appending and\nprepending text to string iterables. If the \"base\" of the string\ndescription is an empty iterable it propagates through as empty, which\ncan cause missing lines from the failure output.\n\nAdd a fallback of `\u0027empty toString()\u0027` in the case any object returns a\ncompletely empty string representation."
    },
    {
      "commit": "5a897b2ff53d681a5fd1e4b86e94252970f7b719",
      "tree": "c415b0f2dca71cdd17838fc3db5bcb079303a29f",
      "parents": [
        "74a9aaf330fd86a9b5dbcf7b8172c445af42e8fe"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Jun 03 15:49:26 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 03 15:49:26 2026"
      },
      "message": "Resolve process leak in test compiler (#2664)\n\nCheck for early closure after async operations and resolve a deadlock\nduring close where the frontend server is busy and is holding a pool\nresource during shutdown.\n\nAdd a mechanism for injecting a fake `FrontendServerClient` to allow\ncontrolling timing during a test without arbitrary delays trying line up\nwith the external process."
    },
    {
      "commit": "74a9aaf330fd86a9b5dbcf7b8172c445af42e8fe",
      "tree": "b6fdcdc22bf7de00a19a7073e6ba56716f16c216",
      "parents": [
        "5d1c8bd07c4d77959b6a0434ed8e947213fcddf3"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Jun 03 15:31:12 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 03 15:31:12 2026"
      },
      "message": "Close receive port in VM platform on null isolate (#2665)\n\nThis resolves flakiness in top_level_configuration_test.dart"
    },
    {
      "commit": "5d1c8bd07c4d77959b6a0434ed8e947213fcddf3",
      "tree": "83e172935304b5c1fe07a8d59123379c85e41ac5",
      "parents": [
        "1ba4b68f6cd36f09d7a640136ac149a2aa5d6aef"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 01 06:48:22 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 01 06:48:22 2026"
      },
      "message": "Bump the github-actions group with 3 updates (#2659)\n\nBumps the github-actions group with 3 updates: [actions/stale](https://github.com/actions/stale), [actions/labeler](https://github.com/actions/labeler) and [github/codeql-action](https://github.com/github/codeql-action).\n\nUpdates `actions/stale` from 10.2.0 to 10.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/stale/releases\"\u003eactions/stale\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev10.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eBug Fix\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEnhancement: ignore stale labeling events by \u003ca href\u003d\"https://github.com/shamoon\"\u003e\u003ccode\u003e@​shamoon\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1311\"\u003eactions/stale#1311\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency Updates\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​octokit/plugin-retry\u003c/code\u003e, \u003ca href\u003d\"https://github.com/typescript-eslint\"\u003e\u003ccode\u003e@​typescript-eslint\u003c/code\u003e\u003c/a\u003e) by \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1335\"\u003eactions/stale#1335\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/shamoon\"\u003e\u003ccode\u003e@​shamoon\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1311\"\u003eactions/stale#1311\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/stale/compare/v10...v10.3.0\"\u003ehttps://github.com/actions/stale/compare/v10...v10.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/stale/commit/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899\"\u003e\u003ccode\u003eeb5cf3a\u003c/code\u003e\u003c/a\u003e chore: upgrade dependencies and bump version to 10.3.0 (\u003ca href\u003d\"https://redirect.github.com/actions/stale/issues/1335\"\u003e#1335\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/stale/commit/db5d06a4c82d5e94513c09c406638111df61f63e\"\u003e\u003ccode\u003edb5d06a\u003c/code\u003e\u003c/a\u003e Enhancement: ignore stale labeling events (\u003ca href\u003d\"https://redirect.github.com/actions/stale/issues/1311\"\u003e#1311\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/actions/stale/compare/b5d41d4e1d5dceea10e7104786b73624c18a190f...eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/labeler` from 6.0.1 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/labeler/releases\"\u003eactions/labeler\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eEnhancements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd changed-files-labels-limit and max-files-changed configuration options to cap the number of labels added by \u003ca href\u003d\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImprove Labeler Action documentation and permission error handling by \u003ca href\u003d\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePreserve manually added labels during workflow runs and refine label synchronization logic by \u003ca href\u003d\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/917\"\u003eactions/labeler#917\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependency Updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v6 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/877\"\u003eactions/labeler#877\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade minimatch from 10.0.1 to 10.2.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/926\"\u003eactions/labeler#926\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimatch, \u003ca href\u003d\"https://github.com/typescript-eslint\"\u003e\u003ccode\u003e@​typescript-eslint\u003c/code\u003e\u003c/a\u003e) by \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/labeler/compare/v6...v6.1.0\"\u003ehttps://github.com/actions/labeler/compare/v6...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/labeler/commit/f27b608878404679385c85cfa523b85ccb86e213\"\u003e\u003ccode\u003ef27b608\u003c/code\u003e\u003c/a\u003e chore: upgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimat...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/labeler/commit/c5dadc2a45784a4b6adfcd20fea3465da3a5f904\"\u003e\u003ccode\u003ec5dadc2\u003c/code\u003e\u003c/a\u003e Add \u0027changed-files-labels-limit\u0027 and \u0027max-files-changed\u0027 configs to allow cap...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/labeler/commit/e52e4fb63ed5cd0e07abaad9826b2a893ccb921f\"\u003e\u003ccode\u003ee52e4fb\u003c/code\u003e\u003c/a\u003e Bump minimatch from 10.0.1 to 10.2.3 (\u003ca href\u003d\"https://redirect.github.com/actions/labeler/issues/926\"\u003e#926\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/labeler/commit/77a4082b841706ac431479b7e2bb11216ffef250\"\u003e\u003ccode\u003e77a4082\u003c/code\u003e\u003c/a\u003e Fix: Preserve manually added labels during workflow run and refine label sync...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/labeler/commit/25abb3cad4f14b7ac27968a495c37798860a5a1a\"\u003e\u003ccode\u003e25abb3c\u003c/code\u003e\u003c/a\u003e Improve Labeler Action Documentation and Error Handling for Permissions (\u003ca href\u003d\"https://redirect.github.com/actions/labeler/issues/897\"\u003e#897\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/labeler/commit/395c8cfdb1e1e691cc4bad0dd315820af8eb67fd\"\u003e\u003ccode\u003e395c8cf\u003c/code\u003e\u003c/a\u003e Bump brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v...\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/actions/labeler/compare/634933edcd8ababfe52f92936142cc22ac488b1b...f27b608878404679385c85cfa523b85ccb86e213\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 4.35.2 to 4.36.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.36.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.19.4. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca href\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal \u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will be enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for GitHub-internal use only, and may change without notice at any time. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning analysis for a PR with \u003ca href\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP OIDC are now accepted. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use \u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.0 - 22 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.19.4. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.5 - 15 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca href\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal \u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will be enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for GitHub-internal use only, and may change without notice at any time. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning analysis for a PR with \u003ca href\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.4 - 07 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.3 - 01 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP OIDC are now accepted. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use \u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.2 - 15 Apr 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled using the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the \u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.1 - 27 Mar 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix incorrect minimum required Git version for \u003ca href\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e: it should have been 2.36.0, not 2.11.0. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3781\"\u003e#3781\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.0 - 27 Mar 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReduced the minimum Git version required for \u003ca href\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e from 2.38.0 to 2.11.0. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3767\"\u003e#3767\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1\"\u003e2.25.1\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3773\"\u003e#3773\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/7211b7c8077ea37d8641b6271f6a365a22a5fbfa\"\u003e\u003ccode\u003e7211b7c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3927\"\u003e#3927\u003c/a\u003e from github/update-v4.36.0-ebc2d9e2b\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/7740f2fb21add1d46278215acea47540db22f022\"\u003e\u003ccode\u003e7740f2f\u003c/code\u003e\u003c/a\u003e Update changelog for v4.36.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/ebc2d9e2bc247eec51bee8d4df806c4030eb0761\"\u003e\u003ccode\u003eebc2d9e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3926\"\u003e#3926\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.25.5\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/d1f74b777c95c777bf4f42ce4b250bc916e745c7\"\u003e\u003ccode\u003ed1f74b7\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/2dc40cec39bdc63d3561d74fa6100cebb0418ff4\"\u003e\u003ccode\u003e2dc40ce\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.25.5\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/84498526a009a99c875e83ef4821a8ba52de7c22\"\u003e\u003ccode\u003e8449852\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3910\"\u003e#3910\u003c/a\u003e from github/henrymercer/repo-size-diff-check\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/72ac23c6d16b29fbe801e87e3439941558c53094\"\u003e\u003ccode\u003e72ac23c\u003c/code\u003e\u003c/a\u003e Update excluded required check list\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/c5297a28a2c3e6a8062041b58858bd7117cebe37\"\u003e\u003ccode\u003ec5297a2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3919\"\u003e#3919\u003c/a\u003e from github/henrymercer/workflow-concurrency\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/8ffeae7d05bc1b914a009d197e64e4f5c9e14503\"\u003e\u003ccode\u003e8ffeae7\u003c/code\u003e\u003c/a\u003e CI: Automatically cancel non-generated workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/f3f52bf568dc44a1069faafa538caa6b1fec40c9\"\u003e\u003ccode\u003ef3f52bf\u003c/code\u003e\u003c/a\u003e Revert \u003ccode\u003egetErrorMessage\u003c/code\u003e import\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...7211b7c8077ea37d8641b6271f6a365a22a5fbfa\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s major version (unless you unignore this specific dependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s minor version (unless you unignore this specific dependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\u003c/details\u003e"
    },
    {
      "commit": "1ba4b68f6cd36f09d7a640136ac149a2aa5d6aef",
      "tree": "2c3536ef57dd6ff9d52911d6b720513fa2952ed5",
      "parents": [
        "fe9e65866919d28364f2c1bdd806a0a3d5cb101a"
      ],
      "author": {
        "name": "Daco Harkes",
        "email": "dacoharkes@google.com",
        "time": "Fri May 22 20:28:30 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri May 22 20:28:30 2026"
      },
      "message": "Fix unawaited_return_in_try_block (#2654)\n\nIn preparation for new diagnostics, fix existing violations."
    },
    {
      "commit": "fe9e65866919d28364f2c1bdd806a0a3d5cb101a",
      "tree": "d28b4fd59f8ee12a0e2ce8018fc4d77e0f811567",
      "parents": [
        "27e640ad480c35118024cd1679f12000484f220b"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed May 20 23:31:36 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed May 20 23:31:36 2026"
      },
      "message": "Revert \"Disallow exiting from VM tests (#2640)\" (#2652)\n\nThis reverts commit 86fcce24d18be9bcbd3f387681dcfc24d1517acd.\n\nUsing `IOOverrides` can cause observable behavior changes so this is a\nbreaking change. We will need to wait for a fix we can rely on in the\nSDK before it\u0027s safe to roll this out.\n\nhttps://github.com/dart-lang/sdk/issues/63418"
    },
    {
      "commit": "27e640ad480c35118024cd1679f12000484f220b",
      "tree": "022ab970bcdec5791d20501ae7f97f3379929d87",
      "parents": [
        "44a8e78fd0eaa84b1fed89ad810eb2e5e476f11c"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed May 20 14:41:52 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed May 20 14:41:52 2026"
      },
      "message": "Use dev tools URL when debugging (#2283)\n\nTowards #2185\n\nThe Observatory UI is no longer served and the current URL does not\nwork. Dev Tools does not support deep linking to a particular isolate or\nlibrary, so link to the overall devtools app for now."
    },
    {
      "commit": "44a8e78fd0eaa84b1fed89ad810eb2e5e476f11c",
      "tree": "e2f516e2702446bf7ff9db7704bda136e92e98c2",
      "parents": [
        "64081690f8b48c987d1a4fb59b5f55836a2df145"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed May 20 01:53:54 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed May 20 01:53:54 2026"
      },
      "message": "Fix output for multiline clauses in failures (#2646)\n\nIn a failure message the parts of the expectation which were checked and\nsatisfied are represented in both the \"Expected\" and \"Actual\" portions.\nThis is handled by tracking how many lines of the text overlaps.\nPreviously this tracked the depth of nesting and assumed each level\ncontributed only a single line, but this assumption is violated by some\nexpectations which print with multiple lines. Correct the overlap\naccounting to include the actual number of lines added by a label."
    },
    {
      "commit": "64081690f8b48c987d1a4fb59b5f55836a2df145",
      "tree": "68327bde069eebe6713e1d0a2126753d86819d9b",
      "parents": [
        "2da017871a982fffc77b85c26400052997b8ecd6"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed May 20 01:52:51 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed May 20 01:52:51 2026"
      },
      "message": "Indent string diffs lines (#2648)\n\nI noticed that the failure messages are a little easier to read if the\nlines showing the point in the string that deviates are indented\nrelative to the \"Which\" header.\n\nBefore\n\n    Expected: a String that:\n      equals \u0027some other String\u0027\n    Actual: \u0027some String\u0027\n    Which: differs at offset 5:\n    some other Stri ...\n    some String\n         ^\n\nAfter\n\n    Expected: a String that:\n      equals \u0027some other String\u0027\n    Actual: \u0027some String\u0027\n    Which: differs at offset 5:\n      some other Stri ...\n      some String\n           ^"
    },
    {
      "commit": "2da017871a982fffc77b85c26400052997b8ecd6",
      "tree": "6b2dff7249ab455a44dad85c69703c4b468b53c3",
      "parents": [
        "376443b9fcf12bd72bb3e7f48265ef2a42a807e0"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue May 19 22:29:43 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue May 19 22:29:43 2026"
      },
      "message": "Shorten failure message for NaN/not NaN (#2649)\n\nThe \"expected\" and \"actual\" here already clearly express the \"NaN\"\nconcept and every time I see failure output with this `which` phrase in\npractice it feels redundant."
    },
    {
      "commit": "376443b9fcf12bd72bb3e7f48265ef2a42a807e0",
      "tree": "9819c9a502b315a0127c06393dfe274b6035c8ec",
      "parents": [
        "b3f92fa9fa9309d7e070f3604b170874ccaaaee1"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue May 19 18:58:50 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue May 19 18:58:50 2026"
      },
      "message": "Handle async conditions in mayEmit (#2647)\n\nFix a bug where the allowed `AsyncCondition` is used with `softCheck`\ninstead of `softCheckAsync`. Make it feasible to catch the exception for\nusing an asynchronous condition in `describe`, and use that exception to\ndetect when to fallback on a more general clause description for\n`mayEmit` and `mayEmitMultiple`.\n\nNote that callers of `nestAsync` and `expectAsync` should synchronously\nsurface a potential synchronous exception and update all existing\ncallers to do so."
    },
    {
      "commit": "b3f92fa9fa9309d7e070f3604b170874ccaaaee1",
      "tree": "88c0a67199dc999435b8e5b3ee80edbd22ef8425",
      "parents": [
        "86fcce24d18be9bcbd3f387681dcfc24d1517acd"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon May 18 20:40:13 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon May 18 20:40:13 2026"
      },
      "message": "More consistent unexpected error formatting (#2644)\n\n- Include stack traces in the rejection output for more extensions which\n  have catch blocks for unexpected exceptions.\n- Use more consistent phrasing and formatting with a line ending in\n  `at:` before the stack trace.\n- Add indentation to all outputs that include stack traces.\n- Use the `LineSplitter.split` utility method everywhere lines are split."
    },
    {
      "commit": "86fcce24d18be9bcbd3f387681dcfc24d1517acd",
      "tree": "f30462701456ae763299ef7e0a597351d4c6292f",
      "parents": [
        "a5374bf2fe9cb5a193a8b8e61d0b9e32bcb220e8"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri May 15 21:50:34 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri May 15 21:50:34 2026"
      },
      "message": "Disallow exiting from VM tests (#2640)\n\nAs suggested in #2577\n\nTests exiting early with a hard exit is an infrequent but persistent\nsource of confusion. Use `IOOverrides` to treat any call to `exit` as a\ntest failure instead of a VM exit."
    },
    {
      "commit": "a5374bf2fe9cb5a193a8b8e61d0b9e32bcb220e8",
      "tree": "09abe9c95cf653bad4283ada935587f7db96575c",
      "parents": [
        "14f99ecdcb74778654d936ce26c70798a3b6649f"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri May 15 19:01:50 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri May 15 19:01:50 2026"
      },
      "message": "Reformat with latest dev SDK (#2641)"
    },
    {
      "commit": "14f99ecdcb74778654d936ce26c70798a3b6649f",
      "tree": "0c762f4a9fbcf6609a849a12f4bb2ff0381b5edc",
      "parents": [
        "fd2b4be610fb75837e217db7c18b8e74a08b5534"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri May 01 23:18:32 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri May 01 23:18:32 2026"
      },
      "message": "Track the OS for browser platforms (#2449)\n\nWe currently do not allow making configuration using tools like\n`OnPlatform` that is specific to an OS and browser combination. So if\nthere is a situation where tests don\u0027t work on firefox on windows, but\nwork everywhere else, we cannot express an intent to skip just the\nfailing tests.\n\nIn a usage like `OnPlatform({\u0027windows \u0026\u0026 firefox\u0027})` the selector will\nnever be true because `firefox` and `windows` are mutually exclusive.\nIt does allow cases like `\u0027windows || firefox\u0027` which matches windows VM\ntests and firefox everywhere.\n\nChanging this means a change to how existing selectors are evaluated. CI\nmay be impacted if a package is configuring a skip for an OS expecting\nonly the VM tests to be skipped on that OS with the browser tests still\nrunning.\n\nUse the new capability to skip a test that is failing on windows firefox\nbrowser."
    },
    {
      "commit": "fd2b4be610fb75837e217db7c18b8e74a08b5534",
      "tree": "c451a8e868ebdfd996643a5acb51447d055086ec",
      "parents": [
        "a1b82f18d73b07d8c9cb1ceb2217b2757135e02e"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri May 01 23:08:03 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri May 01 23:08:03 2026"
      },
      "message": "Override test packages in coverage tests (#2638)\n\nThese tests use the `runTest` test utility which uses a precompiled test\nrunner built from the repo sources. They also use `runPub`  to run fetch\npublished versions of the test packages using a pubspec it creates. This\ncauses a version mismatch between the runner and the version of the test\npackages the test file is importing when it is compiled.\n\nAdd a `dependency_overrides` section to each generated pubspec in the\ncoverage tests. Override all 3 test runner implementation packages to\nuse the repo sources."
    },
    {
      "commit": "a1b82f18d73b07d8c9cb1ceb2217b2757135e02e",
      "tree": "6e5f74829e135823b66a26d5f4edee462cb38976",
      "parents": [
        "d5da9229e3dd3da95194c79f0b929c08432e6ec5"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri May 01 04:03:25 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri May 01 04:03:25 2026"
      },
      "message": "Bump the github-actions group with 3 updates (#2637)\n\nBumps the github-actions group with 3 updates: [actions/cache](https://github.com/actions/cache), [actions/upload-artifact](https://github.com/actions/upload-artifact) and [github/codeql-action](https://github.com/github/codeql-action).\n\nUpdates `actions/cache` from 5.0.4 to 5.0.5\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/cache/releases\"\u003eactions/cache\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.0.5\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate ts-http-runtime dependency by \u003ca href\u003d\"https://github.com/yacaovsnc\"\u003e\u003ccode\u003e@​yacaovsnc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1747\"\u003eactions/cache#1747\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/cache/compare/v5...v5.0.5\"\u003ehttps://github.com/actions/cache/compare/v5...v5.0.5\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/cache/blob/main/RELEASES.md\"\u003eactions/cache\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleases\u003c/h1\u003e\n\u003ch2\u003eHow to prepare a release\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\u003cbr /\u003e\nRelevant for maintainers with write access only.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003col\u003e\n\u003cli\u003eSwitch to a new branch from \u003ccode\u003emain\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003enpm test\u003c/code\u003e to ensure all tests are passing.\u003c/li\u003e\n\u003cli\u003eUpdate the version in \u003ca href\u003d\"https://github.com/actions/cache/blob/main/package.json\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/package.json\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003enpm run build\u003c/code\u003e to update the compiled files.\u003c/li\u003e\n\u003cli\u003eUpdate this \u003ca href\u003d\"https://github.com/actions/cache/blob/main/RELEASES.md\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/RELEASES.md\u003c/code\u003e\u003c/a\u003e with the new version and changes in the \u003ccode\u003e## Changelog\u003c/code\u003e section.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003elicensed cache\u003c/code\u003e to update the license report.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003elicensed status\u003c/code\u003e and resolve any warnings by updating the \u003ca href\u003d\"https://github.com/actions/cache/blob/main/.licensed.yml\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/.licensed.yml\u003c/code\u003e\u003c/a\u003e file with the exceptions.\u003c/li\u003e\n\u003cli\u003eCommit your changes and push your branch upstream.\u003c/li\u003e\n\u003cli\u003eOpen a pull request against \u003ccode\u003emain\u003c/code\u003e and get it reviewed and merged.\u003c/li\u003e\n\u003cli\u003eDraft a new release \u003ca href\u003d\"https://github.com/actions/cache/releases\"\u003ehttps://github.com/actions/cache/releases\u003c/a\u003e use the same version number used in \u003ccode\u003epackage.json\u003c/code\u003e\n\u003col\u003e\n\u003cli\u003eCreate a new tag with the version number.\u003c/li\u003e\n\u003cli\u003eAuto generate release notes and update them to match the changes you made in \u003ccode\u003eRELEASES.md\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eToggle the set as the latest release option.\u003c/li\u003e\n\u003cli\u003ePublish the release.\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/li\u003e\n\u003cli\u003eNavigate to \u003ca href\u003d\"https://github.com/actions/cache/actions/workflows/release-new-action-version.yml\"\u003ehttps://github.com/actions/cache/actions/workflows/release-new-action-version.yml\u003c/a\u003e\n\u003col\u003e\n\u003cli\u003eThere should be a workflow run queued with the same version number.\u003c/li\u003e\n\u003cli\u003eApprove the run to publish the new version and update the major tags for this action.\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2\u003eChangelog\u003c/h2\u003e\n\u003ch3\u003e5.0.4\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eminimatch\u003c/code\u003e to v3.1.5 (fixes ReDoS via globstar patterns)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003efast-xml-parser\u003c/code\u003e to v5.5.6\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.3\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/cache\u003c/code\u003e to v5.0.5 (Resolves: \u003ca href\u003d\"https://github.com/actions/cache/security/dependabot/33\"\u003ehttps://github.com/actions/cache/security/dependabot/33\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/core\u003c/code\u003e to v2.0.3\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.2\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/cache\u003c/code\u003e to v5.0.3 \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1692\"\u003e#1692\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.1\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@azure/storage-blob\u003c/code\u003e to \u003ccode\u003e^12.29.1\u003c/code\u003e via \u003ccode\u003e@actions/cache@5.0.1\u003c/code\u003e \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1685\"\u003e#1685\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.0\u003c/h3\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\n\u003ccode\u003eactions/cache@v5\u003c/code\u003e runs on the Node.js 24 runtime and requires a minimum Actions Runner version of \u003ccode\u003e2.327.1\u003c/code\u003e.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/27d5ce7f107fe9357f9df03efb73ab90386fccae\"\u003e\u003ccode\u003e27d5ce7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/cache/issues/1747\"\u003e#1747\u003c/a\u003e from actions/yacaovsnc/update-dependency\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/f280785d7b6e1884c7d12b9136eb0f4a1574fcfd\"\u003e\u003ccode\u003ef280785\u003c/code\u003e\u003c/a\u003e licensed changes\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/619aeb1606e195be0b36fd0ff68dcf1aff6b65a7\"\u003e\u003ccode\u003e619aeb1\u003c/code\u003e\u003c/a\u003e npm run build generated dist files\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/bcf16c2893940a4899761e55c7ac3c1cf88a04f6\"\u003e\u003ccode\u003ebcf16c2\u003c/code\u003e\u003c/a\u003e Update ts-http-runtime to 0.3.5\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/actions/cache/compare/668228422ae6a00e4ad889ee87cd7109ec5666a7...27d5ce7f107fe9357f9df03efb73ab90386fccae\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-artifact` from 7.0.0 to 7.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the readme with direct upload details by \u003ca href\u003d\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/pull/795\"\u003eactions/upload-artifact#795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReadme: bump all the example versions to v7 by \u003ca href\u003d\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/pull/796\"\u003eactions/upload-artifact#796\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eInclude changes in typespec/ts-http-runtime 0.3.5 by \u003ca href\u003d\"https://github.com/yacaovsnc\"\u003e\u003ccode\u003e@​yacaovsnc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/pull/797\"\u003eactions/upload-artifact#797\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/upload-artifact/compare/v7...v7.0.1\"\u003ehttps://github.com/actions/upload-artifact/compare/v7...v7.0.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a\"\u003e\u003ccode\u003e043fb46\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/issues/797\"\u003e#797\u003c/a\u003e from actions/yacaovsnc/update-dependency\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/634250c1388765ea7ed0f053e636f1f399000b94\"\u003e\u003ccode\u003e634250c\u003c/code\u003e\u003c/a\u003e Include changes in typespec/ts-http-runtime 0.3.5\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/e454baaac2be505c9450e11b8f3215c6fc023ce8\"\u003e\u003ccode\u003ee454baa\u003c/code\u003e\u003c/a\u003e Readme: bump all the example versions to v7 (\u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/issues/796\"\u003e#796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/74fad66b98a6d799dc004d3353ccd0e6f6b2530e\"\u003e\u003ccode\u003e74fad66\u003c/code\u003e\u003c/a\u003e Update the readme with direct upload details (\u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/issues/795\"\u003e#795\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 4.35.1 to 4.35.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.35.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled using the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the \u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP OIDC are now accepted. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.2 - 15 Apr 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled using the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the \u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.1 - 27 Mar 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix incorrect minimum required Git version for \u003ca href\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e: it should have been 2.36.0, not 2.11.0. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3781\"\u003e#3781\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.0 - 27 Mar 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReduced the minimum Git version required for \u003ca href\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e from 2.38.0 to 2.11.0. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3767\"\u003e#3767\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1\"\u003e2.25.1\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3773\"\u003e#3773\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.34.1 - 20 Mar 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDowngrade default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3\"\u003e2.24.3\u003c/a\u003e due to issues with a small percentage of Actions and JavaScript analyses. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3762\"\u003e#3762\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.34.0 - 20 Mar 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded an experimental change which disables TRAP caching when \u003ca href\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3569\"\u003e#3569\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eWe are rolling out improved incremental analysis to C/C++ analyses that use build mode \u003ccode\u003enone\u003c/code\u003e. We expect this rollout to be complete by the end of April 2026. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3584\"\u003e#3584\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0\"\u003e2.25.0\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3585\"\u003e#3585\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.33.0 - 16 Mar 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3562\"\u003e#3562\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eTo opt out of this change:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eRepositories owned by an organization:\u003c/strong\u003e Create a custom repository property with the name \u003ccode\u003egithub-codeql-file-coverage-on-prs\u003c/code\u003e and the type \u0026quot;True/false\u0026quot;, then set this property to \u003ccode\u003etrue\u003c/code\u003e in the repository\u0027s settings. For more information, see \u003ca href\u003d\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003eManaging custom properties for repositories in your organization\u003c/a\u003e. Alternatively, if you are using an advanced setup workflow, you can set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUser-owned repositories using default setup:\u003c/strong\u003e Switch to an advanced setup workflow and set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUser-owned repositories using advanced setup:\u003c/strong\u003e Set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3555\"\u003ea bug\u003c/a\u003e which caused the CodeQL Action to fail loading repository properties if a \u0026quot;Multi select\u0026quot; repository property was configured for the repository. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3557\"\u003e#3557\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe CodeQL Action now loads \u003ca href\u003d\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003ecustom repository properties\u003c/a\u003e on GitHub Enterprise Server, enabling the customization of features such as \u003ccode\u003egithub-codeql-disable-overlay\u003c/code\u003e that was previously only available on GitHub.com. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3559\"\u003e#3559\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eOnce \u003ca href\u003d\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003eprivate package registries\u003c/a\u003e can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3563\"\u003e#3563\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed the retry mechanism for database uploads. Previously this would fail with the error \u0026quot;Response body object should not be disturbed or locked\u0026quot;. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3564\"\u003e#3564\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/95e58e9a2cdfd71adc6e0353d5c52f41a045d225\"\u003e\u003ccode\u003e95e58e9\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3824\"\u003e#3824\u003c/a\u003e from github/update-v4.35.2-d2e135a73\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/6f31bfe060e817d81e938dbec767969d20031e25\"\u003e\u003ccode\u003e6f31bfe\u003c/code\u003e\u003c/a\u003e Update changelog for v4.35.2\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/d2e135a73a39154e3a231aeb49163c4661c5b8b1\"\u003e\u003ccode\u003ed2e135a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3823\"\u003e#3823\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.25.2\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/60abb65df09fcf213c398e064c8a80db1f15cdaf\"\u003e\u003ccode\u003e60abb65\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/5a0a562209255e956ad8aafcee303294e64eefa2\"\u003e\u003ccode\u003e5a0a562\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.25.2\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/65216971a11ded447a6b76263d5a144519e5eee1\"\u003e\u003ccode\u003e6521697\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3820\"\u003e#3820\u003c/a\u003e from github/dependabot/github_actions/dot-github/wor...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/3c45af2dd258e1623af1898da5c86545b514e028\"\u003e\u003ccode\u003e3c45af2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3821\"\u003e#3821\u003c/a\u003e from github/dependabot/npm_and_yarn/npm-minor-345b93...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/f1c339364c12f922998186ed897e45e3b4ae8874\"\u003e\u003ccode\u003ef1c3393\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/1024fc496c87e944a93e98d8cf2c09e2c7602a30\"\u003e\u003ccode\u003e1024fc4\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/9dd4cfed96030ccdfe1af4daf7a7964322704fed\"\u003e\u003ccode\u003e9dd4cfe\u003c/code\u003e\u003c/a\u003e Bump the npm-minor group across 1 directory with 6 updates\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/github/codeql-action/compare/c10b8064de6f491fea524254123dbe5e09572f13...95e58e9a2cdfd71adc6e0353d5c52f41a045d225\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s major version (unless you unignore this specific dependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s minor version (unless you unignore this specific dependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\u003c/details\u003e"
    },
    {
      "commit": "d5da9229e3dd3da95194c79f0b929c08432e6ec5",
      "tree": "fadbea1942f2cc283149bf97ae4d776705b369b5",
      "parents": [
        "c8c76f457bbe64f8707b3c7c7259790f593d8c72"
      ],
      "author": {
        "name": "Jacob MacDonald",
        "email": "jakemac@google.com",
        "time": "Tue Apr 28 00:32:33 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Apr 28 00:32:33 2026"
      },
      "message": "Expose the backend APIs used by flutter_test from test_api (#2635)\n\nThis will allow `test_api` to be unpinned from the flutter SDK.\n\nIncreases package surface area, perhaps further than we would like in\nthe long run. Makes the current dependencies visible.\n\nPart of https://github.com/flutter/flutter/issues/185016"
    },
    {
      "commit": "c8c76f457bbe64f8707b3c7c7259790f593d8c72",
      "tree": "471efb0fc745d6772ead043564832be2d0a4f7d6",
      "parents": [
        "8bbb8474e3ff85aa9450c2b00f9476b34ebdd679"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon Apr 27 20:38:25 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Apr 27 20:38:25 2026"
      },
      "message": "Prepare to publish (#2634)"
    },
    {
      "commit": "8bbb8474e3ff85aa9450c2b00f9476b34ebdd679",
      "tree": "992773e1705d4d60b3b3ce91b5efd2a4bb432602",
      "parents": [
        "bd401482a19620c4521547af793f007bfebc599a"
      ],
      "author": {
        "name": "Jonas Finnemann Jensen",
        "email": "jonasfj@google.com",
        "time": "Fri Apr 17 19:47:38 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Apr 17 19:47:38 2026"
      },
      "message": "Example of how to use `has` (#2631)\n\nDemonstrate the extension pattern in the docs."
    },
    {
      "commit": "bd401482a19620c4521547af793f007bfebc599a",
      "tree": "dea6c8a53001b5fc4fdc2fb1c47345a6f38c96c9",
      "parents": [
        "d20671c1eff6318224cfb538460ef4a18f9cd248"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon Apr 13 23:58:35 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Apr 13 23:58:35 2026"
      },
      "message": "Remove extra version info (#2539)\n\nFollow up to https://github.com/dart-lang/test/pull/2538\n\nThis is only relevant when using the test runner as a git or path\ndependency. In these cases the version will already end in `-WIP` with\nour current development practices and in the places where it may come up\nthe users don\u0027t need help understanding where the code is coming from."
    },
    {
      "commit": "d20671c1eff6318224cfb538460ef4a18f9cd248",
      "tree": "940ba9becaf60b5ef0e33eebb07770f1e83677d2",
      "parents": [
        "17efdc2f8316c71cc9c8630274ae05e284b74595"
      ],
      "author": {
        "name": "Kevin Moore",
        "email": "kevmoo@users.noreply.github.com",
        "time": "Mon Apr 13 22:52:53 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Apr 13 22:52:53 2026"
      },
      "message": "Fix dart2wasm tests with custom HTML files (#2626)\n\nWhen running tests with `dart2wasm` and a custom HTML file, the JS bootstrap file `run_wasm_chrome.js` failed because it tried to read `dataset` from a DOM element with ID `WasmBootstrapInfo`, which is not present in custom HTML files.\n\nThis commit updates `run_wasm_chrome.js` to fallback to inferring the `.wasm` and `.mjs` URLs from `document.currentScript.src` if the `WasmBootstrapInfo` element is not found.\n\nAdded a regression test to verify the fix.\n\nFixes #2625"
    },
    {
      "commit": "17efdc2f8316c71cc9c8630274ae05e284b74595",
      "tree": "348b6779e6a749e684b4b554a3eff958dca610d0",
      "parents": [
        "c21233e9e93bd46c90c7e4785ca2b02ec3b2aba5"
      ],
      "author": {
        "name": "Kevin Moore",
        "email": "kevmoo@users.noreply.github.com",
        "time": "Mon Apr 13 22:20:24 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Apr 13 22:20:24 2026"
      },
      "message": "fix: improve error reporting on GitHub (#2629)\n\nGroup success and skip so it\u0027s easy to see the failures!\nUpdate skip icon to ⏭️ so they are easier to scan\n\nFixes https://github.com/dart-lang/test/issues/2628"
    },
    {
      "commit": "c21233e9e93bd46c90c7e4785ca2b02ec3b2aba5",
      "tree": "dfd7c93deb57f67e2e2446757871e44294599583",
      "parents": [
        "e8012f71a5569fe604fc5ddbad3817a70e178bf2"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon Apr 13 21:56:39 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Apr 13 21:56:39 2026"
      },
      "message": "Ignore test pid on windows (#2630)\n\nThe tests are flaky or always failing due to inconsistencies with PID\nbehavior on windows. Change the PID expectation argument to take a\nmatcher and use `anything` on windows."
    },
    {
      "commit": "e8012f71a5569fe604fc5ddbad3817a70e178bf2",
      "tree": "90e9f3570f29693c9ec5f72d8ed2d4685321b4de",
      "parents": [
        "cfdd7d26f128517934610ff22179217ecad489b0"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon Apr 13 21:40:53 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Apr 13 21:40:53 2026"
      },
      "message": "Bump to language version 3.10 (#2624)\n\nCloses #2623"
    },
    {
      "commit": "cfdd7d26f128517934610ff22179217ecad489b0",
      "tree": "011aee4640e34370f1bd9ca20ed99046a94b2c64",
      "parents": [
        "d0d5ccd037cb0eaea8e4dad900946ac54a4286c6"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Apr 13 17:37:56 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Apr 13 17:37:56 2026"
      },
      "message": "Bump the github-actions group with 3 updates (#2619)\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "d0d5ccd037cb0eaea8e4dad900946ac54a4286c6",
      "tree": "b791bd197d2034e8b36d82aaf677491af42a9e55",
      "parents": [
        "bcc5228370ba909e5774441398b8585ba9874423"
      ],
      "author": {
        "name": "Konstantin Scheglov",
        "email": "scheglov@google.com",
        "time": "Mon Apr 13 17:31:58 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Apr 13 17:31:58 2026"
      },
      "message": "Allow analyzer ^13.0.0, with breaking changes. (#2622)"
    },
    {
      "commit": "bcc5228370ba909e5774441398b8585ba9874423",
      "tree": "0f1b0abe40e534e376cd3778525796f0bc9c2df3",
      "parents": [
        "2b8c256a6320435dc8c9dbb1303fb6540e617846"
      ],
      "author": {
        "name": "Jacob MacDonald",
        "email": "jakemac@google.com",
        "time": "Tue Mar 31 22:02:44 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Mar 31 22:02:44 2026"
      },
      "message": "Fix hang on windows with multiple exe tests (#2618)\n\nFixes #2617\n\nReorder the callbacks to clocks the socket and the server.\n\nEnable `-c exe` tests for test_api to help get better coverage of these\nkinds of tests."
    },
    {
      "commit": "2b8c256a6320435dc8c9dbb1303fb6540e617846",
      "tree": "82692af4869170693bdb2785d5174f511baf79e3",
      "parents": [
        "2baa37c0a8bc96feb17e8721641c4ee1dd4aa7aa"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Mar 24 23:45:02 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Mar 24 23:45:02 2026"
      },
      "message": "Allow exceptions from operator \u003d\u003d (#2543)\n\nIt\u0027s confusing to treat an object that throws from `operator \u003d\u003d`\nidentically to one that returns `false` normally. Intentional exceptions\nin `operator \u003d\u003d` are very unlikely, so this change is not likely to\ncause too many spurious failures."
    }
  ],
  "next": "2baa37c0a8bc96feb17e8721641c4ee1dd4aa7aa"
}