Merge remote-tracking branch 'origin/main' into henrymercer/record-all-builtin-languages

# Conflicts:
#	lib/start-proxy-action.js
#	src/known-language-aliases.json

.github/workflows/__rubocop-multi-language.yml

@@ -59,7 +59,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Set up Ruby
-        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
+        uses: ruby/setup-ruby@4c56a21280b36d862b5fc31348f463d60bdc55d5 # v1.301.0
         with:
           ruby-version: 2.6
       - name: Install Code Scanning integration

.github/workflows/post-release-mergeback.yml

@@ -131,7 +131,7 @@ jobs:
           echo "::endgroup::"
 
       - name: Generate token
-        uses: actions/create-github-app-token@v3.0.0
+        uses: actions/create-github-app-token@v3.1.1
         id: app-token
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}

.github/workflows/rollback-release.yml

@@ -136,7 +136,7 @@ jobs:
 
       - name: Generate token
         if: github.event_name == 'workflow_dispatch'
-        uses: actions/create-github-app-token@v3.0.0
+        uses: actions/create-github-app-token@v3.1.1
         id: app-token
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}

.github/workflows/update-release-branch.yml

@@ -93,7 +93,7 @@ jobs:
       pull-requests: write # needed to create pull request
     steps:
     - name: Generate token
-      uses: actions/create-github-app-token@v3.0.0
+      uses: actions/create-github-app-token@v3.1.1
       id: app-token
       with:
         app-id: ${{ vars.AUTOMATION_APP_ID }}

CHANGELOG.md

@@ -4,10 +4,15 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 ## [UNRELEASED]
 
+No user facing changes.
+
+## 4.35.2 - 15 Apr 2026
+
 - The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#3795](https://github.com/github/codeql-action/pull/3795)
 - The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. [#3789](https://github.com/github/codeql-action/pull/3789)
 - Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. [#3794](https://github.com/github/codeql-action/pull/3794)
 - Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. [#3807](https://github.com/github/codeql-action/pull/3807)
+- Update default CodeQL bundle version to [2.25.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2). [#3823](https://github.com/github/codeql-action/pull/3823)
 
 ## 4.35.1 - 27 Mar 2026
 

lib/analyze-action-post.js

@@ -47304,7 +47304,6 @@ var require_light = __commonJS({
 var require_helpers = __commonJS({
   "node_modules/jsonschema/lib/helpers.js"(exports2, module2) {
     "use strict";
-    var uri = require("url");
     var ValidationError = exports2.ValidationError = function ValidationError2(message, instance, schema2, path9, name, argument) {
       if (Array.isArray(path9)) {
         this.path = path9;
@@ -47379,7 +47378,7 @@ var require_helpers = __commonJS({
     } });
     module2.exports.ValidatorResultError = ValidatorResultError;
     function ValidatorResultError(result) {
-      if (Error.captureStackTrace) {
+      if (typeof Error.captureStackTrace === "function") {
         Error.captureStackTrace(this, ValidatorResultError);
       }
       this.instance = result.instance;
@@ -47394,7 +47393,9 @@ var require_helpers = __commonJS({
       this.message = msg;
       this.schema = schema2;
       Error.call(this, msg);
-      Error.captureStackTrace(this, SchemaError2);
+      if (typeof Error.captureStackTrace === "function") {
+        Error.captureStackTrace(this, SchemaError2);
+      }
     };
     SchemaError.prototype = Object.create(
       Error.prototype,
@@ -47418,12 +47419,12 @@ var require_helpers = __commonJS({
       this.schemas = schemas;
     };
     SchemaContext.prototype.resolve = function resolve6(target) {
-      return uri.resolve(this.base, target);
+      return (() => resolveUrl(this.base, target))();
     };
     SchemaContext.prototype.makeChild = function makeChild(schema2, propertyName) {
       var path9 = propertyName === void 0 ? this.path : this.path.concat([propertyName]);
       var id = schema2.$id || schema2.id;
-      var base = uri.resolve(this.base, id || "");
+      let base = (() => resolveUrl(this.base, id || ""))();
       var ctx = new SchemaContext(schema2, this.options, path9, base, Object.create(this.schemas));
       if (id && !ctx.schemas[base]) {
         ctx.schemas[base] = schema2;
@@ -47617,6 +47618,14 @@ var require_helpers = __commonJS({
     exports2.isSchema = function isSchema(val) {
       return typeof val === "object" && val || typeof val === "boolean";
     };
+    var resolveUrl = exports2.resolveUrl = function resolveUrl2(from, to) {
+      const resolvedUrl = new URL(to, new URL(from, "resolve://"));
+      if (resolvedUrl.protocol === "resolve:") {
+        const { pathname, search, hash } = resolvedUrl;
+        return pathname + search + hash;
+      }
+      return resolvedUrl.toString();
+    };
   }
 });
 
@@ -48292,7 +48301,6 @@ var require_attribute = __commonJS({
 var require_scan = __commonJS({
   "node_modules/jsonschema/lib/scan.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var helpers = require_helpers();
     module2.exports.SchemaScanResult = SchemaScanResult;
     function SchemaScanResult(found, ref) {
@@ -48303,12 +48311,13 @@ var require_scan = __commonJS({
       function scanSchema(baseuri, schema3) {
         if (!schema3 || typeof schema3 != "object") return;
         if (schema3.$ref) {
-          var resolvedUri = urilib.resolve(baseuri, schema3.$ref);
+          let resolvedUri = helpers.resolveUrl(baseuri, schema3.$ref);
           ref[resolvedUri] = ref[resolvedUri] ? ref[resolvedUri] + 1 : 0;
           return;
         }
         var id = schema3.$id || schema3.id;
-        var ourBase = id ? urilib.resolve(baseuri, id) : baseuri;
+        let resolvedBase = helpers.resolveUrl(baseuri, id);
+        var ourBase = id ? resolvedBase : baseuri;
         if (ourBase) {
           if (ourBase.indexOf("#") < 0) ourBase += "#";
           if (found[ourBase]) {
@@ -48360,7 +48369,6 @@ var require_scan = __commonJS({
 var require_validator = __commonJS({
   "node_modules/jsonschema/lib/validator.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var attribute = require_attribute();
     var helpers = require_helpers();
     var scanSchema = require_scan().scan;
@@ -48425,7 +48433,7 @@ var require_validator = __commonJS({
         options = {};
       }
       var id = schema2.$id || schema2.id;
-      var base = urilib.resolve(options.base || anonymousBase, id || "");
+      let base = helpers.resolveUrl(options.base, id || "");
       if (!ctx) {
         ctx = new SchemaContext(schema2, options, [], base, Object.create(this.schemas));
         if (!ctx.schemas[base]) {
@@ -48520,8 +48528,8 @@ var require_validator = __commonJS({
       if (ctx.schemas[switchSchema]) {
         return { subschema: ctx.schemas[switchSchema], switchSchema };
       }
-      var parsed = urilib.parse(switchSchema);
-      var fragment = parsed && parsed.hash;
+      let parsed = new URL(switchSchema, "thismessage::/");
+      let fragment = parsed.hash;
       var document2 = fragment && fragment.length && switchSchema.substr(0, switchSchema.length - fragment.length);
       if (!document2 || !ctx.schemas[document2]) {
         throw new SchemaError("no such schema <" + switchSchema + ">", schema2);
@@ -100155,6 +100163,11 @@ var require_follow_redirects = __commonJS({
     } catch (error3) {
       useNativeURL = error3.code === "ERR_INVALID_URL";
     }
+    var sensitiveHeaders = [
+      "Authorization",
+      "Proxy-Authorization",
+      "Cookie"
+    ];
     var preservedUrlFields = [
       "auth",
       "host",
@@ -100219,6 +100232,7 @@ var require_follow_redirects = __commonJS({
           self2.emit("error", cause instanceof RedirectionError ? cause : new RedirectionError({ cause }));
         }
       };
+      this._headerFilter = new RegExp("^(?:" + sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join("|") + ")$", "i");
       this._performRequest();
     }
     RedirectableRequest.prototype = Object.create(Writable.prototype);
@@ -100356,6 +100370,9 @@ var require_follow_redirects = __commonJS({
       if (!options.headers) {
         options.headers = {};
       }
+      if (!isArray(options.sensitiveHeaders)) {
+        options.sensitiveHeaders = [];
+      }
       if (options.host) {
         if (!options.hostname) {
           options.hostname = options.host;
@@ -100461,7 +100478,7 @@ var require_follow_redirects = __commonJS({
       this._isRedirect = true;
       spreadUrlObject(redirectUrl, this._options);
       if (redirectUrl.protocol !== currentUrlParts.protocol && redirectUrl.protocol !== "https:" || redirectUrl.host !== currentHost && !isSubdomain(redirectUrl.host, currentHost)) {
-        removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
+        removeMatchingHeaders(this._headerFilter, this._options.headers);
       }
       if (isFunction(beforeRedirect)) {
         var responseDetails = {
@@ -100610,6 +100627,9 @@ var require_follow_redirects = __commonJS({
       var dot = subdomain.length - domain.length - 1;
       return dot > 0 && subdomain[dot] === "." && subdomain.endsWith(domain);
     }
+    function isArray(value) {
+      return value instanceof Array;
+    }
     function isString2(value) {
       return typeof value === "string" || value instanceof String;
     }
@@ -100622,6 +100642,9 @@ var require_follow_redirects = __commonJS({
     function isURL(value) {
       return URL2 && value instanceof URL2;
     }
+    function escapeRegex(regex) {
+      return regex.replace(/[\]\\/()*+?.$]/g, "\\$&");
+    }
     module2.exports = wrap({ http, https: https2 });
     module2.exports.wrap = wrap;
   }
@@ -161551,7 +161574,7 @@ function getDiffRangesJsonFilePath() {
   return path2.join(getTemporaryDirectory(), PR_DIFF_RANGE_JSON_FILENAME);
 }
 function getActionVersion() {
-  return "4.35.2";
+  return "4.35.3";
 }
 function getWorkflowEventName() {
   return getRequiredEnvParam("GITHUB_EVENT_NAME");
@@ -161584,6 +161607,11 @@ var CommandInvocationError = class extends Error {
     this.stderr = stderr;
     this.stdout = stdout;
   }
+  cmd;
+  args;
+  exitCode;
+  stderr;
+  stdout;
 };
 function ensureEndsInPeriod(text) {
   return text[text.length - 1] === "." ? text : `${text}.`;
@@ -161640,8 +161668,11 @@ var githubUtils = __toESM(require_utils5());
 var import_light = __toESM(require_light(), 1);
 init_dist_src();
 var VERSION7 = "0.0.0-development";
+function isRequestError(error3) {
+  return error3.request !== void 0;
+}
 async function errorRequest(state, octokit, error3, options) {
-  if (!error3.request || !error3.request.request) {
+  if (!isRequestError(error3) || !error3?.request.request) {
     throw error3;
   }
   if (error3.status >= 400 && !state.doNotRetry.includes(error3.status)) {
@@ -161654,8 +161685,8 @@ async function errorRequest(state, octokit, error3, options) {
 async function wrapRequest(state, octokit, request2, options) {
   const limiter = new import_light.default();
   limiter.on("failed", function(error3, info7) {
-    const maxRetries = ~~error3.request.request.retries;
-    const after = ~~error3.request.request.retryAfter;
+    const maxRetries = ~~error3.request.request?.retries;
+    const after = ~~error3.request.request?.retryAfter;
     options.request.retryCount = info7.retryCount + 1;
     if (maxRetries > info7.retryCount) {
       return after * state.retryAfterBaseValue;
@@ -161667,7 +161698,7 @@ async function wrapRequest(state, octokit, request2, options) {
   );
 }
 async function requestWithGraphqlErrorHandling(state, octokit, request2, options) {
-  const response = await request2(request2, options);
+  const response = await request2(options);
   if (response.data && response.data.errors && response.data.errors.length > 0 && /Something went wrong while executing your query/.test(
     response.data.errors[0].message
   )) {
@@ -161689,11 +161720,7 @@ function retry(octokit, octokitOptions) {
     },
     octokitOptions.retry
   );
-  if (state.enabled) {
-    octokit.hook.error("request", errorRequest.bind(null, state, octokit));
-    octokit.hook.wrap("request", wrapRequest.bind(null, state, octokit));
-  }
-  return {
+  const retryPlugin = {
     retry: {
       retryRequest: (error3, retries, retryAfter) => {
         error3.request.request = Object.assign({}, error3.request.request, {
@@ -161704,6 +161731,11 @@ function retry(octokit, octokitOptions) {
       }
     }
   };
+  if (state.enabled) {
+    octokit.hook.error("request", errorRequest.bind(null, state, retryPlugin));
+    octokit.hook.wrap("request", wrapRequest.bind(null, state, retryPlugin));
+  }
+  return retryPlugin;
 }
 retry.VERSION = VERSION7;
 

lib/analyze-action.js

@@ -47304,7 +47304,6 @@ var require_light = __commonJS({
 var require_helpers = __commonJS({
   "node_modules/jsonschema/lib/helpers.js"(exports2, module2) {
     "use strict";
-    var uri = require("url");
     var ValidationError = exports2.ValidationError = function ValidationError2(message, instance, schema2, path16, name, argument) {
       if (Array.isArray(path16)) {
         this.path = path16;
@@ -47379,7 +47378,7 @@ var require_helpers = __commonJS({
     } });
     module2.exports.ValidatorResultError = ValidatorResultError;
     function ValidatorResultError(result) {
-      if (Error.captureStackTrace) {
+      if (typeof Error.captureStackTrace === "function") {
         Error.captureStackTrace(this, ValidatorResultError);
       }
       this.instance = result.instance;
@@ -47394,7 +47393,9 @@ var require_helpers = __commonJS({
       this.message = msg;
       this.schema = schema2;
       Error.call(this, msg);
-      Error.captureStackTrace(this, SchemaError2);
+      if (typeof Error.captureStackTrace === "function") {
+        Error.captureStackTrace(this, SchemaError2);
+      }
     };
     SchemaError.prototype = Object.create(
       Error.prototype,
@@ -47418,12 +47419,12 @@ var require_helpers = __commonJS({
       this.schemas = schemas;
     };
     SchemaContext.prototype.resolve = function resolve8(target) {
-      return uri.resolve(this.base, target);
+      return (() => resolveUrl(this.base, target))();
     };
     SchemaContext.prototype.makeChild = function makeChild(schema2, propertyName) {
       var path16 = propertyName === void 0 ? this.path : this.path.concat([propertyName]);
       var id = schema2.$id || schema2.id;
-      var base = uri.resolve(this.base, id || "");
+      let base = (() => resolveUrl(this.base, id || ""))();
       var ctx = new SchemaContext(schema2, this.options, path16, base, Object.create(this.schemas));
       if (id && !ctx.schemas[base]) {
         ctx.schemas[base] = schema2;
@@ -47617,6 +47618,14 @@ var require_helpers = __commonJS({
     exports2.isSchema = function isSchema(val) {
       return typeof val === "object" && val || typeof val === "boolean";
     };
+    var resolveUrl = exports2.resolveUrl = function resolveUrl2(from, to) {
+      const resolvedUrl = new URL(to, new URL(from, "resolve://"));
+      if (resolvedUrl.protocol === "resolve:") {
+        const { pathname, search, hash: hash2 } = resolvedUrl;
+        return pathname + search + hash2;
+      }
+      return resolvedUrl.toString();
+    };
   }
 });
 
@@ -48292,7 +48301,6 @@ var require_attribute = __commonJS({
 var require_scan = __commonJS({
   "node_modules/jsonschema/lib/scan.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var helpers = require_helpers();
     module2.exports.SchemaScanResult = SchemaScanResult;
     function SchemaScanResult(found, ref) {
@@ -48303,12 +48311,13 @@ var require_scan = __commonJS({
       function scanSchema(baseuri, schema3) {
         if (!schema3 || typeof schema3 != "object") return;
         if (schema3.$ref) {
-          var resolvedUri = urilib.resolve(baseuri, schema3.$ref);
+          let resolvedUri = helpers.resolveUrl(baseuri, schema3.$ref);
           ref[resolvedUri] = ref[resolvedUri] ? ref[resolvedUri] + 1 : 0;
           return;
         }
         var id = schema3.$id || schema3.id;
-        var ourBase = id ? urilib.resolve(baseuri, id) : baseuri;
+        let resolvedBase = helpers.resolveUrl(baseuri, id);
+        var ourBase = id ? resolvedBase : baseuri;
         if (ourBase) {
           if (ourBase.indexOf("#") < 0) ourBase += "#";
           if (found[ourBase]) {
@@ -48360,7 +48369,6 @@ var require_scan = __commonJS({
 var require_validator = __commonJS({
   "node_modules/jsonschema/lib/validator.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var attribute = require_attribute();
     var helpers = require_helpers();
     var scanSchema = require_scan().scan;
@@ -48425,7 +48433,7 @@ var require_validator = __commonJS({
         options = {};
       }
       var id = schema2.$id || schema2.id;
-      var base = urilib.resolve(options.base || anonymousBase, id || "");
+      let base = helpers.resolveUrl(options.base, id || "");
       if (!ctx) {
         ctx = new SchemaContext(schema2, options, [], base, Object.create(this.schemas));
         if (!ctx.schemas[base]) {
@@ -48520,8 +48528,8 @@ var require_validator = __commonJS({
       if (ctx.schemas[switchSchema]) {
         return { subschema: ctx.schemas[switchSchema], switchSchema };
       }
-      var parsed = urilib.parse(switchSchema);
-      var fragment = parsed && parsed.hash;
+      let parsed = new URL(switchSchema, "thismessage::/");
+      let fragment = parsed.hash;
       var document2 = fragment && fragment.length && switchSchema.substr(0, switchSchema.length - fragment.length);
       if (!document2 || !ctx.schemas[document2]) {
         throw new SchemaError("no such schema <" + switchSchema + ">", schema2);
@@ -100155,6 +100163,11 @@ var require_follow_redirects = __commonJS({
     } catch (error3) {
       useNativeURL = error3.code === "ERR_INVALID_URL";
     }
+    var sensitiveHeaders = [
+      "Authorization",
+      "Proxy-Authorization",
+      "Cookie"
+    ];
     var preservedUrlFields = [
       "auth",
       "host",
@@ -100219,6 +100232,7 @@ var require_follow_redirects = __commonJS({
           self2.emit("error", cause instanceof RedirectionError ? cause : new RedirectionError({ cause }));
         }
       };
+      this._headerFilter = new RegExp("^(?:" + sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join("|") + ")$", "i");
       this._performRequest();
     }
     RedirectableRequest.prototype = Object.create(Writable.prototype);
@@ -100356,6 +100370,9 @@ var require_follow_redirects = __commonJS({
       if (!options.headers) {
         options.headers = {};
       }
+      if (!isArray(options.sensitiveHeaders)) {
+        options.sensitiveHeaders = [];
+      }
       if (options.host) {
         if (!options.hostname) {
           options.hostname = options.host;
@@ -100461,7 +100478,7 @@ var require_follow_redirects = __commonJS({
       this._isRedirect = true;
       spreadUrlObject(redirectUrl, this._options);
       if (redirectUrl.protocol !== currentUrlParts.protocol && redirectUrl.protocol !== "https:" || redirectUrl.host !== currentHost && !isSubdomain(redirectUrl.host, currentHost)) {
-        removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
+        removeMatchingHeaders(this._headerFilter, this._options.headers);
       }
       if (isFunction(beforeRedirect)) {
         var responseDetails = {
@@ -100610,6 +100627,9 @@ var require_follow_redirects = __commonJS({
       var dot = subdomain.length - domain.length - 1;
       return dot > 0 && subdomain[dot] === "." && subdomain.endsWith(domain);
     }
+    function isArray(value) {
+      return value instanceof Array;
+    }
     function isString2(value) {
       return typeof value === "string" || value instanceof String;
     }
@@ -100622,6 +100642,9 @@ var require_follow_redirects = __commonJS({
     function isURL(value) {
       return URL2 && value instanceof URL2;
     }
+    function escapeRegex(regex) {
+      return regex.replace(/[\]\\/()*+?.$]/g, "\\$&");
+    }
     module2.exports = wrap({ http, https: https2 });
     module2.exports.wrap = wrap;
   }
@@ -106452,6 +106475,7 @@ var ExhaustivityCheckingError = class extends Error {
     super("Internal error: exhaustivity checking failure");
     this.expectedExhaustiveValue = expectedExhaustiveValue;
   }
+  expectedExhaustiveValue;
 };
 function assertNever(value) {
   throw new ExhaustivityCheckingError(value);
@@ -106719,7 +106743,7 @@ function getDiffRangesJsonFilePath() {
   return path2.join(getTemporaryDirectory(), PR_DIFF_RANGE_JSON_FILENAME);
 }
 function getActionVersion() {
-  return "4.35.2";
+  return "4.35.3";
 }
 function getWorkflowEventName() {
   return getRequiredEnvParam("GITHUB_EVENT_NAME");
@@ -106818,6 +106842,11 @@ var CommandInvocationError = class extends Error {
     this.stderr = stderr;
     this.stdout = stdout;
   }
+  cmd;
+  args;
+  exitCode;
+  stderr;
+  stdout;
 };
 function ensureEndsInPeriod(text) {
   return text[text.length - 1] === "." ? text : `${text}.`;
@@ -106975,8 +107004,11 @@ var githubUtils = __toESM(require_utils5());
 var import_light = __toESM(require_light(), 1);
 init_dist_src();
 var VERSION7 = "0.0.0-development";
+function isRequestError(error3) {
+  return error3.request !== void 0;
+}
 async function errorRequest(state, octokit, error3, options) {
-  if (!error3.request || !error3.request.request) {
+  if (!isRequestError(error3) || !error3?.request.request) {
     throw error3;
   }
   if (error3.status >= 400 && !state.doNotRetry.includes(error3.status)) {
@@ -106989,8 +107021,8 @@ async function errorRequest(state, octokit, error3, options) {
 async function wrapRequest(state, octokit, request2, options) {
   const limiter = new import_light.default();
   limiter.on("failed", function(error3, info6) {
-    const maxRetries = ~~error3.request.request.retries;
-    const after = ~~error3.request.request.retryAfter;
+    const maxRetries = ~~error3.request.request?.retries;
+    const after = ~~error3.request.request?.retryAfter;
     options.request.retryCount = info6.retryCount + 1;
     if (maxRetries > info6.retryCount) {
       return after * state.retryAfterBaseValue;
@@ -107002,7 +107034,7 @@ async function wrapRequest(state, octokit, request2, options) {
   );
 }
 async function requestWithGraphqlErrorHandling(state, octokit, request2, options) {
-  const response = await request2(request2, options);
+  const response = await request2(options);
   if (response.data && response.data.errors && response.data.errors.length > 0 && /Something went wrong while executing your query/.test(
     response.data.errors[0].message
   )) {
@@ -107024,11 +107056,7 @@ function retry(octokit, octokitOptions) {
     },
     octokitOptions.retry
   );
-  if (state.enabled) {
-    octokit.hook.error("request", errorRequest.bind(null, state, octokit));
-    octokit.hook.wrap("request", wrapRequest.bind(null, state, octokit));
-  }
-  return {
+  const retryPlugin = {
     retry: {
       retryRequest: (error3, retries, retryAfter) => {
         error3.request.request = Object.assign({}, error3.request.request, {
@@ -107039,6 +107067,11 @@ function retry(octokit, octokitOptions) {
       }
     }
   };
+  if (state.enabled) {
+    octokit.hook.error("request", errorRequest.bind(null, state, retryPlugin));
+    octokit.hook.wrap("request", wrapRequest.bind(null, state, retryPlugin));
+  }
+  return retryPlugin;
 }
 retry.VERSION = VERSION7;
 
@@ -107641,8 +107674,8 @@ var path6 = __toESM(require("path"));
 var semver5 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.25.1";
-var cliVersion = "2.25.1";
+var bundleVersion = "codeql-bundle-v2.25.2";
+var cliVersion = "2.25.2";
 
 // src/overlay/index.ts
 var fs4 = __toESM(require("fs"));
@@ -108201,6 +108234,7 @@ var OfflineFeatures = class {
   constructor(logger) {
     this.logger = logger;
   }
+  logger;
   async getDefaultCliVersion(_variant) {
     return {
       cliVersion,
@@ -108349,6 +108383,9 @@ var GitHubFeatureFlags = class {
     this.logger = logger;
     this.hasAccessedRemoteFeatureFlags = false;
   }
+  repositoryNwo;
+  featureFlagsFile;
+  logger;
   cachedApiResponse;
   // We cache whether the feature flags were accessed or not in order to accurately report whether flags were
   // incorrectly configured vs. inaccessible in our telemetry.
@@ -110641,6 +110678,9 @@ var CodeQLAnalysisError = class extends Error {
     this.error = error3;
     this.name = "CodeQLAnalysisError";
   }
+  queriesStatusReport;
+  message;
+  error;
 };
 async function setupPythonExtractor(logger) {
   const codeqlPython = process.env["CODEQL_PYTHON"];

lib/autobuild-action.js

@@ -47304,7 +47304,6 @@ var require_light = __commonJS({
 var require_helpers = __commonJS({
   "node_modules/jsonschema/lib/helpers.js"(exports2, module2) {
     "use strict";
-    var uri = require("url");
     var ValidationError = exports2.ValidationError = function ValidationError2(message, instance, schema2, path9, name, argument) {
       if (Array.isArray(path9)) {
         this.path = path9;
@@ -47379,7 +47378,7 @@ var require_helpers = __commonJS({
     } });
     module2.exports.ValidatorResultError = ValidatorResultError;
     function ValidatorResultError(result) {
-      if (Error.captureStackTrace) {
+      if (typeof Error.captureStackTrace === "function") {
         Error.captureStackTrace(this, ValidatorResultError);
       }
       this.instance = result.instance;
@@ -47394,7 +47393,9 @@ var require_helpers = __commonJS({
       this.message = msg;
       this.schema = schema2;
       Error.call(this, msg);
-      Error.captureStackTrace(this, SchemaError2);
+      if (typeof Error.captureStackTrace === "function") {
+        Error.captureStackTrace(this, SchemaError2);
+      }
     };
     SchemaError.prototype = Object.create(
       Error.prototype,
@@ -47418,12 +47419,12 @@ var require_helpers = __commonJS({
       this.schemas = schemas;
     };
     SchemaContext.prototype.resolve = function resolve6(target) {
-      return uri.resolve(this.base, target);
+      return (() => resolveUrl(this.base, target))();
     };
     SchemaContext.prototype.makeChild = function makeChild(schema2, propertyName) {
       var path9 = propertyName === void 0 ? this.path : this.path.concat([propertyName]);
       var id = schema2.$id || schema2.id;
-      var base = uri.resolve(this.base, id || "");
+      let base = (() => resolveUrl(this.base, id || ""))();
       var ctx = new SchemaContext(schema2, this.options, path9, base, Object.create(this.schemas));
       if (id && !ctx.schemas[base]) {
         ctx.schemas[base] = schema2;
@@ -47617,6 +47618,14 @@ var require_helpers = __commonJS({
     exports2.isSchema = function isSchema(val) {
       return typeof val === "object" && val || typeof val === "boolean";
     };
+    var resolveUrl = exports2.resolveUrl = function resolveUrl2(from, to) {
+      const resolvedUrl = new URL(to, new URL(from, "resolve://"));
+      if (resolvedUrl.protocol === "resolve:") {
+        const { pathname, search, hash } = resolvedUrl;
+        return pathname + search + hash;
+      }
+      return resolvedUrl.toString();
+    };
   }
 });
 
@@ -48292,7 +48301,6 @@ var require_attribute = __commonJS({
 var require_scan = __commonJS({
   "node_modules/jsonschema/lib/scan.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var helpers = require_helpers();
     module2.exports.SchemaScanResult = SchemaScanResult;
     function SchemaScanResult(found, ref) {
@@ -48303,12 +48311,13 @@ var require_scan = __commonJS({
       function scanSchema(baseuri, schema3) {
         if (!schema3 || typeof schema3 != "object") return;
         if (schema3.$ref) {
-          var resolvedUri = urilib.resolve(baseuri, schema3.$ref);
+          let resolvedUri = helpers.resolveUrl(baseuri, schema3.$ref);
           ref[resolvedUri] = ref[resolvedUri] ? ref[resolvedUri] + 1 : 0;
           return;
         }
         var id = schema3.$id || schema3.id;
-        var ourBase = id ? urilib.resolve(baseuri, id) : baseuri;
+        let resolvedBase = helpers.resolveUrl(baseuri, id);
+        var ourBase = id ? resolvedBase : baseuri;
         if (ourBase) {
           if (ourBase.indexOf("#") < 0) ourBase += "#";
           if (found[ourBase]) {
@@ -48360,7 +48369,6 @@ var require_scan = __commonJS({
 var require_validator = __commonJS({
   "node_modules/jsonschema/lib/validator.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var attribute = require_attribute();
     var helpers = require_helpers();
     var scanSchema = require_scan().scan;
@@ -48425,7 +48433,7 @@ var require_validator = __commonJS({
         options = {};
       }
       var id = schema2.$id || schema2.id;
-      var base = urilib.resolve(options.base || anonymousBase, id || "");
+      let base = helpers.resolveUrl(options.base, id || "");
       if (!ctx) {
         ctx = new SchemaContext(schema2, options, [], base, Object.create(this.schemas));
         if (!ctx.schemas[base]) {
@@ -48520,8 +48528,8 @@ var require_validator = __commonJS({
       if (ctx.schemas[switchSchema]) {
         return { subschema: ctx.schemas[switchSchema], switchSchema };
       }
-      var parsed = urilib.parse(switchSchema);
-      var fragment = parsed && parsed.hash;
+      let parsed = new URL(switchSchema, "thismessage::/");
+      let fragment = parsed.hash;
       var document2 = fragment && fragment.length && switchSchema.substr(0, switchSchema.length - fragment.length);
       if (!document2 || !ctx.schemas[document2]) {
         throw new SchemaError("no such schema <" + switchSchema + ">", schema2);
@@ -100155,6 +100163,11 @@ var require_follow_redirects = __commonJS({
     } catch (error3) {
       useNativeURL = error3.code === "ERR_INVALID_URL";
     }
+    var sensitiveHeaders = [
+      "Authorization",
+      "Proxy-Authorization",
+      "Cookie"
+    ];
     var preservedUrlFields = [
       "auth",
       "host",
@@ -100219,6 +100232,7 @@ var require_follow_redirects = __commonJS({
           self2.emit("error", cause instanceof RedirectionError ? cause : new RedirectionError({ cause }));
         }
       };
+      this._headerFilter = new RegExp("^(?:" + sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join("|") + ")$", "i");
       this._performRequest();
     }
     RedirectableRequest.prototype = Object.create(Writable.prototype);
@@ -100356,6 +100370,9 @@ var require_follow_redirects = __commonJS({
       if (!options.headers) {
         options.headers = {};
       }
+      if (!isArray(options.sensitiveHeaders)) {
+        options.sensitiveHeaders = [];
+      }
       if (options.host) {
         if (!options.hostname) {
           options.hostname = options.host;
@@ -100461,7 +100478,7 @@ var require_follow_redirects = __commonJS({
       this._isRedirect = true;
       spreadUrlObject(redirectUrl, this._options);
       if (redirectUrl.protocol !== currentUrlParts.protocol && redirectUrl.protocol !== "https:" || redirectUrl.host !== currentHost && !isSubdomain(redirectUrl.host, currentHost)) {
-        removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
+        removeMatchingHeaders(this._headerFilter, this._options.headers);
       }
       if (isFunction(beforeRedirect)) {
         var responseDetails = {
@@ -100610,6 +100627,9 @@ var require_follow_redirects = __commonJS({
       var dot = subdomain.length - domain.length - 1;
       return dot > 0 && subdomain[dot] === "." && subdomain.endsWith(domain);
     }
+    function isArray(value) {
+      return value instanceof Array;
+    }
     function isString2(value) {
       return typeof value === "string" || value instanceof String;
     }
@@ -100622,6 +100642,9 @@ var require_follow_redirects = __commonJS({
     function isURL(value) {
       return URL2 && value instanceof URL2;
     }
+    function escapeRegex(regex) {
+      return regex.replace(/[\]\\/()*+?.$]/g, "\\$&");
+    }
     module2.exports = wrap({ http, https: https2 });
     module2.exports.wrap = wrap;
   }
@@ -103525,7 +103548,7 @@ function getDiffRangesJsonFilePath() {
   return path2.join(getTemporaryDirectory(), PR_DIFF_RANGE_JSON_FILENAME);
 }
 function getActionVersion() {
-  return "4.35.2";
+  return "4.35.3";
 }
 function getWorkflowEventName() {
   return getRequiredEnvParam("GITHUB_EVENT_NAME");
@@ -103591,6 +103614,11 @@ var CommandInvocationError = class extends Error {
     this.stderr = stderr;
     this.stdout = stdout;
   }
+  cmd;
+  args;
+  exitCode;
+  stderr;
+  stdout;
 };
 function ensureEndsInPeriod(text) {
   return text[text.length - 1] === "." ? text : `${text}.`;
@@ -103638,8 +103666,11 @@ var githubUtils = __toESM(require_utils5());
 var import_light = __toESM(require_light(), 1);
 init_dist_src();
 var VERSION7 = "0.0.0-development";
+function isRequestError(error3) {
+  return error3.request !== void 0;
+}
 async function errorRequest(state, octokit, error3, options) {
-  if (!error3.request || !error3.request.request) {
+  if (!isRequestError(error3) || !error3?.request.request) {
     throw error3;
   }
   if (error3.status >= 400 && !state.doNotRetry.includes(error3.status)) {
@@ -103652,8 +103683,8 @@ async function errorRequest(state, octokit, error3, options) {
 async function wrapRequest(state, octokit, request2, options) {
   const limiter = new import_light.default();
   limiter.on("failed", function(error3, info6) {
-    const maxRetries = ~~error3.request.request.retries;
-    const after = ~~error3.request.request.retryAfter;
+    const maxRetries = ~~error3.request.request?.retries;
+    const after = ~~error3.request.request?.retryAfter;
     options.request.retryCount = info6.retryCount + 1;
     if (maxRetries > info6.retryCount) {
       return after * state.retryAfterBaseValue;
@@ -103665,7 +103696,7 @@ async function wrapRequest(state, octokit, request2, options) {
   );
 }
 async function requestWithGraphqlErrorHandling(state, octokit, request2, options) {
-  const response = await request2(request2, options);
+  const response = await request2(options);
   if (response.data && response.data.errors && response.data.errors.length > 0 && /Something went wrong while executing your query/.test(
     response.data.errors[0].message
   )) {
@@ -103687,11 +103718,7 @@ function retry(octokit, octokitOptions) {
     },
     octokitOptions.retry
   );
-  if (state.enabled) {
-    octokit.hook.error("request", errorRequest.bind(null, state, octokit));
-    octokit.hook.wrap("request", wrapRequest.bind(null, state, octokit));
-  }
-  return {
+  const retryPlugin = {
     retry: {
       retryRequest: (error3, retries, retryAfter) => {
         error3.request.request = Object.assign({}, error3.request.request, {
@@ -103702,6 +103729,11 @@ function retry(octokit, octokitOptions) {
       }
     }
   };
+  if (state.enabled) {
+    octokit.hook.error("request", errorRequest.bind(null, state, retryPlugin));
+    octokit.hook.wrap("request", wrapRequest.bind(null, state, retryPlugin));
+  }
+  return retryPlugin;
 }
 retry.VERSION = VERSION7;
 
@@ -104134,8 +104166,8 @@ var path5 = __toESM(require("path"));
 var semver5 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.25.1";
-var cliVersion = "2.25.1";
+var bundleVersion = "codeql-bundle-v2.25.2";
+var cliVersion = "2.25.2";
 
 // src/overlay/index.ts
 var fs3 = __toESM(require("fs"));
@@ -104659,6 +104691,7 @@ var OfflineFeatures = class {
   constructor(logger) {
     this.logger = logger;
   }
+  logger;
   async getDefaultCliVersion(_variant) {
     return {
       cliVersion,
@@ -104807,6 +104840,9 @@ var GitHubFeatureFlags = class {
     this.logger = logger;
     this.hasAccessedRemoteFeatureFlags = false;
   }
+  repositoryNwo;
+  featureFlagsFile;
+  logger;
   cachedApiResponse;
   // We cache whether the feature flags were accessed or not in order to accurately report whether flags were
   // incorrectly configured vs. inaccessible in our telemetry.

lib/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.25.1",
-  "cliVersion": "2.25.1",
-  "priorBundleVersion": "codeql-bundle-v2.24.3",
-  "priorCliVersion": "2.24.3"
+  "bundleVersion": "codeql-bundle-v2.25.2",
+  "cliVersion": "2.25.2",
+  "priorBundleVersion": "codeql-bundle-v2.25.1",
+  "priorCliVersion": "2.25.1"
 }

lib/init-action-post.js

@@ -47304,7 +47304,6 @@ var require_light = __commonJS({
 var require_helpers = __commonJS({
   "node_modules/jsonschema/lib/helpers.js"(exports2, module2) {
     "use strict";
-    var uri = require("url");
     var ValidationError = exports2.ValidationError = function ValidationError2(message, instance, schema2, path19, name, argument) {
       if (Array.isArray(path19)) {
         this.path = path19;
@@ -47379,7 +47378,7 @@ var require_helpers = __commonJS({
     } });
     module2.exports.ValidatorResultError = ValidatorResultError;
     function ValidatorResultError(result) {
-      if (Error.captureStackTrace) {
+      if (typeof Error.captureStackTrace === "function") {
         Error.captureStackTrace(this, ValidatorResultError);
       }
       this.instance = result.instance;
@@ -47394,7 +47393,9 @@ var require_helpers = __commonJS({
       this.message = msg;
       this.schema = schema2;
       Error.call(this, msg);
-      Error.captureStackTrace(this, SchemaError2);
+      if (typeof Error.captureStackTrace === "function") {
+        Error.captureStackTrace(this, SchemaError2);
+      }
     };
     SchemaError.prototype = Object.create(
       Error.prototype,
@@ -47418,12 +47419,12 @@ var require_helpers = __commonJS({
       this.schemas = schemas;
     };
     SchemaContext.prototype.resolve = function resolve8(target) {
-      return uri.resolve(this.base, target);
+      return (() => resolveUrl(this.base, target))();
     };
     SchemaContext.prototype.makeChild = function makeChild(schema2, propertyName) {
       var path19 = propertyName === void 0 ? this.path : this.path.concat([propertyName]);
       var id = schema2.$id || schema2.id;
-      var base = uri.resolve(this.base, id || "");
+      let base = (() => resolveUrl(this.base, id || ""))();
       var ctx = new SchemaContext(schema2, this.options, path19, base, Object.create(this.schemas));
       if (id && !ctx.schemas[base]) {
         ctx.schemas[base] = schema2;
@@ -47617,6 +47618,14 @@ var require_helpers = __commonJS({
     exports2.isSchema = function isSchema(val) {
       return typeof val === "object" && val || typeof val === "boolean";
     };
+    var resolveUrl = exports2.resolveUrl = function resolveUrl2(from, to) {
+      const resolvedUrl = new URL(to, new URL(from, "resolve://"));
+      if (resolvedUrl.protocol === "resolve:") {
+        const { pathname, search, hash: hash2 } = resolvedUrl;
+        return pathname + search + hash2;
+      }
+      return resolvedUrl.toString();
+    };
   }
 });
 
@@ -48292,7 +48301,6 @@ var require_attribute = __commonJS({
 var require_scan = __commonJS({
   "node_modules/jsonschema/lib/scan.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var helpers = require_helpers();
     module2.exports.SchemaScanResult = SchemaScanResult;
     function SchemaScanResult(found, ref) {
@@ -48303,12 +48311,13 @@ var require_scan = __commonJS({
       function scanSchema(baseuri, schema3) {
         if (!schema3 || typeof schema3 != "object") return;
         if (schema3.$ref) {
-          var resolvedUri = urilib.resolve(baseuri, schema3.$ref);
+          let resolvedUri = helpers.resolveUrl(baseuri, schema3.$ref);
           ref[resolvedUri] = ref[resolvedUri] ? ref[resolvedUri] + 1 : 0;
           return;
         }
         var id = schema3.$id || schema3.id;
-        var ourBase = id ? urilib.resolve(baseuri, id) : baseuri;
+        let resolvedBase = helpers.resolveUrl(baseuri, id);
+        var ourBase = id ? resolvedBase : baseuri;
         if (ourBase) {
           if (ourBase.indexOf("#") < 0) ourBase += "#";
           if (found[ourBase]) {
@@ -48360,7 +48369,6 @@ var require_scan = __commonJS({
 var require_validator = __commonJS({
   "node_modules/jsonschema/lib/validator.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var attribute = require_attribute();
     var helpers = require_helpers();
     var scanSchema = require_scan().scan;
@@ -48425,7 +48433,7 @@ var require_validator = __commonJS({
         options = {};
       }
       var id = schema2.$id || schema2.id;
-      var base = urilib.resolve(options.base || anonymousBase, id || "");
+      let base = helpers.resolveUrl(options.base, id || "");
       if (!ctx) {
         ctx = new SchemaContext(schema2, options, [], base, Object.create(this.schemas));
         if (!ctx.schemas[base]) {
@@ -48520,8 +48528,8 @@ var require_validator = __commonJS({
       if (ctx.schemas[switchSchema]) {
         return { subschema: ctx.schemas[switchSchema], switchSchema };
       }
-      var parsed = urilib.parse(switchSchema);
-      var fragment = parsed && parsed.hash;
+      let parsed = new URL(switchSchema, "thismessage::/");
+      let fragment = parsed.hash;
       var document2 = fragment && fragment.length && switchSchema.substr(0, switchSchema.length - fragment.length);
       if (!document2 || !ctx.schemas[document2]) {
         throw new SchemaError("no such schema <" + switchSchema + ">", schema2);
@@ -100155,6 +100163,11 @@ var require_follow_redirects = __commonJS({
     } catch (error3) {
       useNativeURL = error3.code === "ERR_INVALID_URL";
     }
+    var sensitiveHeaders = [
+      "Authorization",
+      "Proxy-Authorization",
+      "Cookie"
+    ];
     var preservedUrlFields = [
       "auth",
       "host",
@@ -100219,6 +100232,7 @@ var require_follow_redirects = __commonJS({
           self2.emit("error", cause instanceof RedirectionError ? cause : new RedirectionError({ cause }));
         }
       };
+      this._headerFilter = new RegExp("^(?:" + sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join("|") + ")$", "i");
       this._performRequest();
     }
     RedirectableRequest.prototype = Object.create(Writable.prototype);
@@ -100356,6 +100370,9 @@ var require_follow_redirects = __commonJS({
       if (!options.headers) {
         options.headers = {};
       }
+      if (!isArray(options.sensitiveHeaders)) {
+        options.sensitiveHeaders = [];
+      }
       if (options.host) {
         if (!options.hostname) {
           options.hostname = options.host;
@@ -100461,7 +100478,7 @@ var require_follow_redirects = __commonJS({
       this._isRedirect = true;
       spreadUrlObject(redirectUrl, this._options);
       if (redirectUrl.protocol !== currentUrlParts.protocol && redirectUrl.protocol !== "https:" || redirectUrl.host !== currentHost && !isSubdomain(redirectUrl.host, currentHost)) {
-        removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
+        removeMatchingHeaders(this._headerFilter, this._options.headers);
       }
       if (isFunction(beforeRedirect)) {
         var responseDetails = {
@@ -100610,6 +100627,9 @@ var require_follow_redirects = __commonJS({
       var dot = subdomain.length - domain.length - 1;
       return dot > 0 && subdomain[dot] === "." && subdomain.endsWith(domain);
     }
+    function isArray(value) {
+      return value instanceof Array;
+    }
     function isString2(value) {
       return typeof value === "string" || value instanceof String;
     }
@@ -100622,6 +100642,9 @@ var require_follow_redirects = __commonJS({
     function isURL(value) {
       return URL2 && value instanceof URL2;
     }
+    function escapeRegex(regex) {
+      return regex.replace(/[\]\\/()*+?.$]/g, "\\$&");
+    }
     module2.exports = wrap({ http, https: https2 });
     module2.exports.wrap = wrap;
   }
@@ -164394,6 +164417,7 @@ var ExhaustivityCheckingError = class extends Error {
     super("Internal error: exhaustivity checking failure");
     this.expectedExhaustiveValue = expectedExhaustiveValue;
   }
+  expectedExhaustiveValue;
 };
 function assertNever(value) {
   throw new ExhaustivityCheckingError(value);
@@ -164612,6 +164636,7 @@ var Success = class {
   constructor(value) {
     this.value = value;
   }
+  value;
   isSuccess() {
     return true;
   }
@@ -164626,6 +164651,7 @@ var Failure = class {
   constructor(value) {
     this.value = value;
   }
+  value;
   isSuccess() {
     return false;
   }
@@ -164658,7 +164684,7 @@ function getDiffRangesJsonFilePath() {
   return path2.join(getTemporaryDirectory(), PR_DIFF_RANGE_JSON_FILENAME);
 }
 function getActionVersion() {
-  return "4.35.2";
+  return "4.35.3";
 }
 function getWorkflowEventName() {
   return getRequiredEnvParam("GITHUB_EVENT_NAME");
@@ -164786,6 +164812,11 @@ var CommandInvocationError = class extends Error {
     this.stderr = stderr;
     this.stdout = stdout;
   }
+  cmd;
+  args;
+  exitCode;
+  stderr;
+  stdout;
 };
 function ensureEndsInPeriod(text) {
   return text[text.length - 1] === "." ? text : `${text}.`;
@@ -164866,8 +164897,11 @@ var githubUtils = __toESM(require_utils5());
 var import_light = __toESM(require_light(), 1);
 init_dist_src();
 var VERSION7 = "0.0.0-development";
+function isRequestError(error3) {
+  return error3.request !== void 0;
+}
 async function errorRequest(state, octokit, error3, options) {
-  if (!error3.request || !error3.request.request) {
+  if (!isRequestError(error3) || !error3?.request.request) {
     throw error3;
   }
   if (error3.status >= 400 && !state.doNotRetry.includes(error3.status)) {
@@ -164880,8 +164914,8 @@ async function errorRequest(state, octokit, error3, options) {
 async function wrapRequest(state, octokit, request2, options) {
   const limiter = new import_light.default();
   limiter.on("failed", function(error3, info7) {
-    const maxRetries = ~~error3.request.request.retries;
-    const after = ~~error3.request.request.retryAfter;
+    const maxRetries = ~~error3.request.request?.retries;
+    const after = ~~error3.request.request?.retryAfter;
     options.request.retryCount = info7.retryCount + 1;
     if (maxRetries > info7.retryCount) {
       return after * state.retryAfterBaseValue;
@@ -164893,7 +164927,7 @@ async function wrapRequest(state, octokit, request2, options) {
   );
 }
 async function requestWithGraphqlErrorHandling(state, octokit, request2, options) {
-  const response = await request2(request2, options);
+  const response = await request2(options);
   if (response.data && response.data.errors && response.data.errors.length > 0 && /Something went wrong while executing your query/.test(
     response.data.errors[0].message
   )) {
@@ -164915,11 +164949,7 @@ function retry(octokit, octokitOptions) {
     },
     octokitOptions.retry
   );
-  if (state.enabled) {
-    octokit.hook.error("request", errorRequest.bind(null, state, octokit));
-    octokit.hook.wrap("request", wrapRequest.bind(null, state, octokit));
-  }
-  return {
+  const retryPlugin = {
     retry: {
       retryRequest: (error3, retries, retryAfter) => {
         error3.request.request = Object.assign({}, error3.request.request, {
@@ -164930,6 +164960,11 @@ function retry(octokit, octokitOptions) {
       }
     }
   };
+  if (state.enabled) {
+    octokit.hook.error("request", errorRequest.bind(null, state, retryPlugin));
+    octokit.hook.wrap("request", wrapRequest.bind(null, state, retryPlugin));
+  }
+  return retryPlugin;
 }
 retry.VERSION = VERSION7;
 
@@ -165558,8 +165593,8 @@ var path6 = __toESM(require("path"));
 var semver5 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.25.1";
-var cliVersion = "2.25.1";
+var bundleVersion = "codeql-bundle-v2.25.2";
+var cliVersion = "2.25.2";
 
 // src/overlay/index.ts
 var fs4 = __toESM(require("fs"));
@@ -166122,6 +166157,7 @@ var OfflineFeatures = class {
   constructor(logger) {
     this.logger = logger;
   }
+  logger;
   async getDefaultCliVersion(_variant) {
     return {
       cliVersion,
@@ -166270,6 +166306,9 @@ var GitHubFeatureFlags = class {
     this.logger = logger;
     this.hasAccessedRemoteFeatureFlags = false;
   }
+  repositoryNwo;
+  featureFlagsFile;
+  logger;
   cachedApiResponse;
   // We cache whether the feature flags were accessed or not in order to accurately report whether flags were
   // incorrectly configured vs. inaccessible in our telemetry.

lib/init-action.js

@@ -47304,7 +47304,6 @@ var require_light = __commonJS({
 var require_helpers = __commonJS({
   "node_modules/jsonschema/lib/helpers.js"(exports2, module2) {
     "use strict";
-    var uri = require("url");
     var ValidationError = exports2.ValidationError = function ValidationError2(message, instance, schema2, path18, name, argument) {
       if (Array.isArray(path18)) {
         this.path = path18;
@@ -47379,7 +47378,7 @@ var require_helpers = __commonJS({
     } });
     module2.exports.ValidatorResultError = ValidatorResultError;
     function ValidatorResultError(result) {
-      if (Error.captureStackTrace) {
+      if (typeof Error.captureStackTrace === "function") {
         Error.captureStackTrace(this, ValidatorResultError);
       }
       this.instance = result.instance;
@@ -47394,7 +47393,9 @@ var require_helpers = __commonJS({
       this.message = msg;
       this.schema = schema2;
       Error.call(this, msg);
-      Error.captureStackTrace(this, SchemaError2);
+      if (typeof Error.captureStackTrace === "function") {
+        Error.captureStackTrace(this, SchemaError2);
+      }
     };
     SchemaError.prototype = Object.create(
       Error.prototype,
@@ -47418,12 +47419,12 @@ var require_helpers = __commonJS({
       this.schemas = schemas;
     };
     SchemaContext.prototype.resolve = function resolve9(target) {
-      return uri.resolve(this.base, target);
+      return (() => resolveUrl(this.base, target))();
     };
     SchemaContext.prototype.makeChild = function makeChild(schema2, propertyName) {
       var path18 = propertyName === void 0 ? this.path : this.path.concat([propertyName]);
       var id = schema2.$id || schema2.id;
-      var base = uri.resolve(this.base, id || "");
+      let base = (() => resolveUrl(this.base, id || ""))();
       var ctx = new SchemaContext(schema2, this.options, path18, base, Object.create(this.schemas));
       if (id && !ctx.schemas[base]) {
         ctx.schemas[base] = schema2;
@@ -47617,6 +47618,14 @@ var require_helpers = __commonJS({
     exports2.isSchema = function isSchema(val) {
       return typeof val === "object" && val || typeof val === "boolean";
     };
+    var resolveUrl = exports2.resolveUrl = function resolveUrl2(from, to) {
+      const resolvedUrl = new URL(to, new URL(from, "resolve://"));
+      if (resolvedUrl.protocol === "resolve:") {
+        const { pathname, search, hash } = resolvedUrl;
+        return pathname + search + hash;
+      }
+      return resolvedUrl.toString();
+    };
   }
 });
 
@@ -48292,7 +48301,6 @@ var require_attribute = __commonJS({
 var require_scan = __commonJS({
   "node_modules/jsonschema/lib/scan.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var helpers = require_helpers();
     module2.exports.SchemaScanResult = SchemaScanResult;
     function SchemaScanResult(found, ref) {
@@ -48303,12 +48311,13 @@ var require_scan = __commonJS({
       function scanSchema(baseuri, schema3) {
         if (!schema3 || typeof schema3 != "object") return;
         if (schema3.$ref) {
-          var resolvedUri = urilib.resolve(baseuri, schema3.$ref);
+          let resolvedUri = helpers.resolveUrl(baseuri, schema3.$ref);
           ref[resolvedUri] = ref[resolvedUri] ? ref[resolvedUri] + 1 : 0;
           return;
         }
         var id = schema3.$id || schema3.id;
-        var ourBase = id ? urilib.resolve(baseuri, id) : baseuri;
+        let resolvedBase = helpers.resolveUrl(baseuri, id);
+        var ourBase = id ? resolvedBase : baseuri;
         if (ourBase) {
           if (ourBase.indexOf("#") < 0) ourBase += "#";
           if (found[ourBase]) {
@@ -48360,7 +48369,6 @@ var require_scan = __commonJS({
 var require_validator = __commonJS({
   "node_modules/jsonschema/lib/validator.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var attribute = require_attribute();
     var helpers = require_helpers();
     var scanSchema = require_scan().scan;
@@ -48425,7 +48433,7 @@ var require_validator = __commonJS({
         options = {};
       }
       var id = schema2.$id || schema2.id;
-      var base = urilib.resolve(options.base || anonymousBase, id || "");
+      let base = helpers.resolveUrl(options.base, id || "");
       if (!ctx) {
         ctx = new SchemaContext(schema2, options, [], base, Object.create(this.schemas));
         if (!ctx.schemas[base]) {
@@ -48520,8 +48528,8 @@ var require_validator = __commonJS({
       if (ctx.schemas[switchSchema]) {
         return { subschema: ctx.schemas[switchSchema], switchSchema };
       }
-      var parsed = urilib.parse(switchSchema);
-      var fragment = parsed && parsed.hash;
+      let parsed = new URL(switchSchema, "thismessage::/");
+      let fragment = parsed.hash;
       var document2 = fragment && fragment.length && switchSchema.substr(0, switchSchema.length - fragment.length);
       if (!document2 || !ctx.schemas[document2]) {
         throw new SchemaError("no such schema <" + switchSchema + ">", schema2);
@@ -100306,6 +100314,11 @@ var require_follow_redirects = __commonJS({
     } catch (error3) {
       useNativeURL = error3.code === "ERR_INVALID_URL";
     }
+    var sensitiveHeaders = [
+      "Authorization",
+      "Proxy-Authorization",
+      "Cookie"
+    ];
     var preservedUrlFields = [
       "auth",
       "host",
@@ -100370,6 +100383,7 @@ var require_follow_redirects = __commonJS({
           self2.emit("error", cause instanceof RedirectionError ? cause : new RedirectionError({ cause }));
         }
       };
+      this._headerFilter = new RegExp("^(?:" + sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join("|") + ")$", "i");
       this._performRequest();
     }
     RedirectableRequest.prototype = Object.create(Writable.prototype);
@@ -100507,6 +100521,9 @@ var require_follow_redirects = __commonJS({
       if (!options.headers) {
         options.headers = {};
       }
+      if (!isArray(options.sensitiveHeaders)) {
+        options.sensitiveHeaders = [];
+      }
       if (options.host) {
         if (!options.hostname) {
           options.hostname = options.host;
@@ -100612,7 +100629,7 @@ var require_follow_redirects = __commonJS({
       this._isRedirect = true;
       spreadUrlObject(redirectUrl, this._options);
       if (redirectUrl.protocol !== currentUrlParts.protocol && redirectUrl.protocol !== "https:" || redirectUrl.host !== currentHost && !isSubdomain(redirectUrl.host, currentHost)) {
-        removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
+        removeMatchingHeaders(this._headerFilter, this._options.headers);
       }
       if (isFunction(beforeRedirect)) {
         var responseDetails = {
@@ -100761,6 +100778,9 @@ var require_follow_redirects = __commonJS({
       var dot = subdomain.length - domain.length - 1;
       return dot > 0 && subdomain[dot] === "." && subdomain.endsWith(domain);
     }
+    function isArray(value) {
+      return value instanceof Array;
+    }
     function isString3(value) {
       return typeof value === "string" || value instanceof String;
     }
@@ -100773,6 +100793,9 @@ var require_follow_redirects = __commonJS({
     function isURL(value) {
       return URL2 && value instanceof URL2;
     }
+    function escapeRegex(regex) {
+      return regex.replace(/[\]\\/()*+?.$]/g, "\\$&");
+    }
     module2.exports = wrap({ http, https: https2 });
     module2.exports.wrap = wrap;
   }
@@ -103796,6 +103819,7 @@ var ExhaustivityCheckingError = class extends Error {
     super("Internal error: exhaustivity checking failure");
     this.expectedExhaustiveValue = expectedExhaustiveValue;
   }
+  expectedExhaustiveValue;
 };
 function assertNever(value) {
   throw new ExhaustivityCheckingError(value);
@@ -104040,6 +104064,7 @@ var Success = class {
   constructor(value) {
     this.value = value;
   }
+  value;
   isSuccess() {
     return true;
   }
@@ -104054,6 +104079,7 @@ var Failure = class {
   constructor(value) {
     this.value = value;
   }
+  value;
   isSuccess() {
     return false;
   }
@@ -104086,7 +104112,7 @@ function getDiffRangesJsonFilePath() {
   return path2.join(getTemporaryDirectory(), PR_DIFF_RANGE_JSON_FILENAME);
 }
 function getActionVersion() {
-  return "4.35.2";
+  return "4.35.3";
 }
 function getWorkflowEventName() {
   return getRequiredEnvParam("GITHUB_EVENT_NAME");
@@ -104204,6 +104230,11 @@ var CommandInvocationError = class extends Error {
     this.stderr = stderr;
     this.stdout = stdout;
   }
+  cmd;
+  args;
+  exitCode;
+  stderr;
+  stdout;
 };
 function ensureEndsInPeriod(text) {
   return text[text.length - 1] === "." ? text : `${text}.`;
@@ -104345,8 +104376,11 @@ var githubUtils = __toESM(require_utils5());
 var import_light = __toESM(require_light(), 1);
 init_dist_src();
 var VERSION7 = "0.0.0-development";
+function isRequestError(error3) {
+  return error3.request !== void 0;
+}
 async function errorRequest(state, octokit, error3, options) {
-  if (!error3.request || !error3.request.request) {
+  if (!isRequestError(error3) || !error3?.request.request) {
     throw error3;
   }
   if (error3.status >= 400 && !state.doNotRetry.includes(error3.status)) {
@@ -104359,8 +104393,8 @@ async function errorRequest(state, octokit, error3, options) {
 async function wrapRequest(state, octokit, request2, options) {
   const limiter = new import_light.default();
   limiter.on("failed", function(error3, info6) {
-    const maxRetries = ~~error3.request.request.retries;
-    const after = ~~error3.request.request.retryAfter;
+    const maxRetries = ~~error3.request.request?.retries;
+    const after = ~~error3.request.request?.retryAfter;
     options.request.retryCount = info6.retryCount + 1;
     if (maxRetries > info6.retryCount) {
       return after * state.retryAfterBaseValue;
@@ -104372,7 +104406,7 @@ async function wrapRequest(state, octokit, request2, options) {
   );
 }
 async function requestWithGraphqlErrorHandling(state, octokit, request2, options) {
-  const response = await request2(request2, options);
+  const response = await request2(options);
   if (response.data && response.data.errors && response.data.errors.length > 0 && /Something went wrong while executing your query/.test(
     response.data.errors[0].message
   )) {
@@ -104394,11 +104428,7 @@ function retry(octokit, octokitOptions) {
     },
     octokitOptions.retry
   );
-  if (state.enabled) {
-    octokit.hook.error("request", errorRequest.bind(null, state, octokit));
-    octokit.hook.wrap("request", wrapRequest.bind(null, state, octokit));
-  }
-  return {
+  const retryPlugin = {
     retry: {
       retryRequest: (error3, retries, retryAfter) => {
         error3.request.request = Object.assign({}, error3.request.request, {
@@ -104409,6 +104439,11 @@ function retry(octokit, octokitOptions) {
       }
     }
   };
+  if (state.enabled) {
+    octokit.hook.error("request", errorRequest.bind(null, state, retryPlugin));
+    octokit.hook.wrap("request", wrapRequest.bind(null, state, retryPlugin));
+  }
+  return retryPlugin;
 }
 retry.VERSION = VERSION7;
 
@@ -105189,8 +105224,8 @@ var path7 = __toESM(require("path"));
 var semver5 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.25.1";
-var cliVersion = "2.25.1";
+var bundleVersion = "codeql-bundle-v2.25.2";
+var cliVersion = "2.25.2";
 
 // src/overlay/index.ts
 var fs4 = __toESM(require("fs"));
@@ -105210,6 +105245,8 @@ var GitVersionInfo = class {
     this.truncatedVersion = truncatedVersion;
     this.fullVersion = fullVersion;
   }
+  truncatedVersion;
+  fullVersion;
   isAtLeast(minVersion) {
     return semver3.gte(this.truncatedVersion, minVersion);
   }
@@ -105764,6 +105801,7 @@ var OfflineFeatures = class {
   constructor(logger) {
     this.logger = logger;
   }
+  logger;
   async getDefaultCliVersion(_variant) {
     return {
       cliVersion,
@@ -105912,6 +105950,9 @@ var GitHubFeatureFlags = class {
     this.logger = logger;
     this.hasAccessedRemoteFeatureFlags = false;
   }
+  repositoryNwo;
+  featureFlagsFile;
+  logger;
   cachedApiResponse;
   // We cache whether the feature flags were accessed or not in order to accurately report whether flags were
   // incorrectly configured vs. inaccessible in our telemetry.

lib/resolve-environment-action.js

@@ -47304,7 +47304,6 @@ var require_light = __commonJS({
 var require_helpers = __commonJS({
   "node_modules/jsonschema/lib/helpers.js"(exports2, module2) {
     "use strict";
-    var uri = require("url");
     var ValidationError = exports2.ValidationError = function ValidationError2(message, instance, schema2, path7, name, argument) {
       if (Array.isArray(path7)) {
         this.path = path7;
@@ -47379,7 +47378,7 @@ var require_helpers = __commonJS({
     } });
     module2.exports.ValidatorResultError = ValidatorResultError;
     function ValidatorResultError(result) {
-      if (Error.captureStackTrace) {
+      if (typeof Error.captureStackTrace === "function") {
         Error.captureStackTrace(this, ValidatorResultError);
       }
       this.instance = result.instance;
@@ -47394,7 +47393,9 @@ var require_helpers = __commonJS({
       this.message = msg;
       this.schema = schema2;
       Error.call(this, msg);
-      Error.captureStackTrace(this, SchemaError2);
+      if (typeof Error.captureStackTrace === "function") {
+        Error.captureStackTrace(this, SchemaError2);
+      }
     };
     SchemaError.prototype = Object.create(
       Error.prototype,
@@ -47418,12 +47419,12 @@ var require_helpers = __commonJS({
       this.schemas = schemas;
     };
     SchemaContext.prototype.resolve = function resolve5(target) {
-      return uri.resolve(this.base, target);
+      return (() => resolveUrl(this.base, target))();
     };
     SchemaContext.prototype.makeChild = function makeChild(schema2, propertyName) {
       var path7 = propertyName === void 0 ? this.path : this.path.concat([propertyName]);
       var id = schema2.$id || schema2.id;
-      var base = uri.resolve(this.base, id || "");
+      let base = (() => resolveUrl(this.base, id || ""))();
       var ctx = new SchemaContext(schema2, this.options, path7, base, Object.create(this.schemas));
       if (id && !ctx.schemas[base]) {
         ctx.schemas[base] = schema2;
@@ -47617,6 +47618,14 @@ var require_helpers = __commonJS({
     exports2.isSchema = function isSchema(val) {
       return typeof val === "object" && val || typeof val === "boolean";
     };
+    var resolveUrl = exports2.resolveUrl = function resolveUrl2(from, to) {
+      const resolvedUrl = new URL(to, new URL(from, "resolve://"));
+      if (resolvedUrl.protocol === "resolve:") {
+        const { pathname, search, hash } = resolvedUrl;
+        return pathname + search + hash;
+      }
+      return resolvedUrl.toString();
+    };
   }
 });
 
@@ -48292,7 +48301,6 @@ var require_attribute = __commonJS({
 var require_scan = __commonJS({
   "node_modules/jsonschema/lib/scan.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var helpers = require_helpers();
     module2.exports.SchemaScanResult = SchemaScanResult;
     function SchemaScanResult(found, ref) {
@@ -48303,12 +48311,13 @@ var require_scan = __commonJS({
       function scanSchema(baseuri, schema3) {
         if (!schema3 || typeof schema3 != "object") return;
         if (schema3.$ref) {
-          var resolvedUri = urilib.resolve(baseuri, schema3.$ref);
+          let resolvedUri = helpers.resolveUrl(baseuri, schema3.$ref);
           ref[resolvedUri] = ref[resolvedUri] ? ref[resolvedUri] + 1 : 0;
           return;
         }
         var id = schema3.$id || schema3.id;
-        var ourBase = id ? urilib.resolve(baseuri, id) : baseuri;
+        let resolvedBase = helpers.resolveUrl(baseuri, id);
+        var ourBase = id ? resolvedBase : baseuri;
         if (ourBase) {
           if (ourBase.indexOf("#") < 0) ourBase += "#";
           if (found[ourBase]) {
@@ -48360,7 +48369,6 @@ var require_scan = __commonJS({
 var require_validator = __commonJS({
   "node_modules/jsonschema/lib/validator.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var attribute = require_attribute();
     var helpers = require_helpers();
     var scanSchema = require_scan().scan;
@@ -48425,7 +48433,7 @@ var require_validator = __commonJS({
         options = {};
       }
       var id = schema2.$id || schema2.id;
-      var base = urilib.resolve(options.base || anonymousBase, id || "");
+      let base = helpers.resolveUrl(options.base, id || "");
       if (!ctx) {
         ctx = new SchemaContext(schema2, options, [], base, Object.create(this.schemas));
         if (!ctx.schemas[base]) {
@@ -48520,8 +48528,8 @@ var require_validator = __commonJS({
       if (ctx.schemas[switchSchema]) {
         return { subschema: ctx.schemas[switchSchema], switchSchema };
       }
-      var parsed = urilib.parse(switchSchema);
-      var fragment = parsed && parsed.hash;
+      let parsed = new URL(switchSchema, "thismessage::/");
+      let fragment = parsed.hash;
       var document2 = fragment && fragment.length && switchSchema.substr(0, switchSchema.length - fragment.length);
       if (!document2 || !ctx.schemas[document2]) {
         throw new SchemaError("no such schema <" + switchSchema + ">", schema2);
@@ -100155,6 +100163,11 @@ var require_follow_redirects = __commonJS({
     } catch (error3) {
       useNativeURL = error3.code === "ERR_INVALID_URL";
     }
+    var sensitiveHeaders = [
+      "Authorization",
+      "Proxy-Authorization",
+      "Cookie"
+    ];
     var preservedUrlFields = [
       "auth",
       "host",
@@ -100219,6 +100232,7 @@ var require_follow_redirects = __commonJS({
           self2.emit("error", cause instanceof RedirectionError ? cause : new RedirectionError({ cause }));
         }
       };
+      this._headerFilter = new RegExp("^(?:" + sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join("|") + ")$", "i");
       this._performRequest();
     }
     RedirectableRequest.prototype = Object.create(Writable.prototype);
@@ -100356,6 +100370,9 @@ var require_follow_redirects = __commonJS({
       if (!options.headers) {
         options.headers = {};
       }
+      if (!isArray(options.sensitiveHeaders)) {
+        options.sensitiveHeaders = [];
+      }
       if (options.host) {
         if (!options.hostname) {
           options.hostname = options.host;
@@ -100461,7 +100478,7 @@ var require_follow_redirects = __commonJS({
       this._isRedirect = true;
       spreadUrlObject(redirectUrl, this._options);
       if (redirectUrl.protocol !== currentUrlParts.protocol && redirectUrl.protocol !== "https:" || redirectUrl.host !== currentHost && !isSubdomain(redirectUrl.host, currentHost)) {
-        removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
+        removeMatchingHeaders(this._headerFilter, this._options.headers);
       }
       if (isFunction(beforeRedirect)) {
         var responseDetails = {
@@ -100610,6 +100627,9 @@ var require_follow_redirects = __commonJS({
       var dot = subdomain.length - domain.length - 1;
       return dot > 0 && subdomain[dot] === "." && subdomain.endsWith(domain);
     }
+    function isArray(value) {
+      return value instanceof Array;
+    }
     function isString2(value) {
       return typeof value === "string" || value instanceof String;
     }
@@ -100622,6 +100642,9 @@ var require_follow_redirects = __commonJS({
     function isURL(value) {
       return URL2 && value instanceof URL2;
     }
+    function escapeRegex(regex) {
+      return regex.replace(/[\]\\/()*+?.$]/g, "\\$&");
+    }
     module2.exports = wrap({ http, https: https2 });
     module2.exports.wrap = wrap;
   }
@@ -103533,7 +103556,7 @@ function getDiffRangesJsonFilePath() {
   return path2.join(getTemporaryDirectory(), PR_DIFF_RANGE_JSON_FILENAME);
 }
 function getActionVersion() {
-  return "4.35.2";
+  return "4.35.3";
 }
 function getWorkflowEventName() {
   return getRequiredEnvParam("GITHUB_EVENT_NAME");
@@ -103599,6 +103622,11 @@ var CommandInvocationError = class extends Error {
     this.stderr = stderr;
     this.stdout = stdout;
   }
+  cmd;
+  args;
+  exitCode;
+  stderr;
+  stdout;
 };
 function ensureEndsInPeriod(text) {
   return text[text.length - 1] === "." ? text : `${text}.`;
@@ -103646,8 +103674,11 @@ var githubUtils = __toESM(require_utils5());
 var import_light = __toESM(require_light(), 1);
 init_dist_src();
 var VERSION7 = "0.0.0-development";
+function isRequestError(error3) {
+  return error3.request !== void 0;
+}
 async function errorRequest(state, octokit, error3, options) {
-  if (!error3.request || !error3.request.request) {
+  if (!isRequestError(error3) || !error3?.request.request) {
     throw error3;
   }
   if (error3.status >= 400 && !state.doNotRetry.includes(error3.status)) {
@@ -103660,8 +103691,8 @@ async function errorRequest(state, octokit, error3, options) {
 async function wrapRequest(state, octokit, request2, options) {
   const limiter = new import_light.default();
   limiter.on("failed", function(error3, info6) {
-    const maxRetries = ~~error3.request.request.retries;
-    const after = ~~error3.request.request.retryAfter;
+    const maxRetries = ~~error3.request.request?.retries;
+    const after = ~~error3.request.request?.retryAfter;
     options.request.retryCount = info6.retryCount + 1;
     if (maxRetries > info6.retryCount) {
       return after * state.retryAfterBaseValue;
@@ -103673,7 +103704,7 @@ async function wrapRequest(state, octokit, request2, options) {
   );
 }
 async function requestWithGraphqlErrorHandling(state, octokit, request2, options) {
-  const response = await request2(request2, options);
+  const response = await request2(options);
   if (response.data && response.data.errors && response.data.errors.length > 0 && /Something went wrong while executing your query/.test(
     response.data.errors[0].message
   )) {
@@ -103695,11 +103726,7 @@ function retry(octokit, octokitOptions) {
     },
     octokitOptions.retry
   );
-  if (state.enabled) {
-    octokit.hook.error("request", errorRequest.bind(null, state, octokit));
-    octokit.hook.wrap("request", wrapRequest.bind(null, state, octokit));
-  }
-  return {
+  const retryPlugin = {
     retry: {
       retryRequest: (error3, retries, retryAfter) => {
         error3.request.request = Object.assign({}, error3.request.request, {
@@ -103710,6 +103737,11 @@ function retry(octokit, octokitOptions) {
       }
     }
   };
+  if (state.enabled) {
+    octokit.hook.error("request", errorRequest.bind(null, state, retryPlugin));
+    octokit.hook.wrap("request", wrapRequest.bind(null, state, retryPlugin));
+  }
+  return retryPlugin;
 }
 retry.VERSION = VERSION7;
 

lib/setup-codeql-action.js

@@ -47304,7 +47304,6 @@ var require_light = __commonJS({
 var require_helpers = __commonJS({
   "node_modules/jsonschema/lib/helpers.js"(exports2, module2) {
     "use strict";
-    var uri = require("url");
     var ValidationError = exports2.ValidationError = function ValidationError2(message, instance, schema2, path10, name, argument) {
       if (Array.isArray(path10)) {
         this.path = path10;
@@ -47379,7 +47378,7 @@ var require_helpers = __commonJS({
     } });
     module2.exports.ValidatorResultError = ValidatorResultError;
     function ValidatorResultError(result) {
-      if (Error.captureStackTrace) {
+      if (typeof Error.captureStackTrace === "function") {
         Error.captureStackTrace(this, ValidatorResultError);
       }
       this.instance = result.instance;
@@ -47394,7 +47393,9 @@ var require_helpers = __commonJS({
       this.message = msg;
       this.schema = schema2;
       Error.call(this, msg);
-      Error.captureStackTrace(this, SchemaError2);
+      if (typeof Error.captureStackTrace === "function") {
+        Error.captureStackTrace(this, SchemaError2);
+      }
     };
     SchemaError.prototype = Object.create(
       Error.prototype,
@@ -47418,12 +47419,12 @@ var require_helpers = __commonJS({
       this.schemas = schemas;
     };
     SchemaContext.prototype.resolve = function resolve4(target) {
-      return uri.resolve(this.base, target);
+      return (() => resolveUrl(this.base, target))();
     };
     SchemaContext.prototype.makeChild = function makeChild(schema2, propertyName) {
       var path10 = propertyName === void 0 ? this.path : this.path.concat([propertyName]);
       var id = schema2.$id || schema2.id;
-      var base = uri.resolve(this.base, id || "");
+      let base = (() => resolveUrl(this.base, id || ""))();
       var ctx = new SchemaContext(schema2, this.options, path10, base, Object.create(this.schemas));
       if (id && !ctx.schemas[base]) {
         ctx.schemas[base] = schema2;
@@ -47617,6 +47618,14 @@ var require_helpers = __commonJS({
     exports2.isSchema = function isSchema(val) {
       return typeof val === "object" && val || typeof val === "boolean";
     };
+    var resolveUrl = exports2.resolveUrl = function resolveUrl2(from, to) {
+      const resolvedUrl = new URL(to, new URL(from, "resolve://"));
+      if (resolvedUrl.protocol === "resolve:") {
+        const { pathname, search, hash } = resolvedUrl;
+        return pathname + search + hash;
+      }
+      return resolvedUrl.toString();
+    };
   }
 });
 
@@ -48292,7 +48301,6 @@ var require_attribute = __commonJS({
 var require_scan = __commonJS({
   "node_modules/jsonschema/lib/scan.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var helpers = require_helpers();
     module2.exports.SchemaScanResult = SchemaScanResult;
     function SchemaScanResult(found, ref) {
@@ -48303,12 +48311,13 @@ var require_scan = __commonJS({
       function scanSchema(baseuri, schema3) {
         if (!schema3 || typeof schema3 != "object") return;
         if (schema3.$ref) {
-          var resolvedUri = urilib.resolve(baseuri, schema3.$ref);
+          let resolvedUri = helpers.resolveUrl(baseuri, schema3.$ref);
           ref[resolvedUri] = ref[resolvedUri] ? ref[resolvedUri] + 1 : 0;
           return;
         }
         var id = schema3.$id || schema3.id;
-        var ourBase = id ? urilib.resolve(baseuri, id) : baseuri;
+        let resolvedBase = helpers.resolveUrl(baseuri, id);
+        var ourBase = id ? resolvedBase : baseuri;
         if (ourBase) {
           if (ourBase.indexOf("#") < 0) ourBase += "#";
           if (found[ourBase]) {
@@ -48360,7 +48369,6 @@ var require_scan = __commonJS({
 var require_validator = __commonJS({
   "node_modules/jsonschema/lib/validator.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var attribute = require_attribute();
     var helpers = require_helpers();
     var scanSchema = require_scan().scan;
@@ -48425,7 +48433,7 @@ var require_validator = __commonJS({
         options = {};
       }
       var id = schema2.$id || schema2.id;
-      var base = urilib.resolve(options.base || anonymousBase, id || "");
+      let base = helpers.resolveUrl(options.base, id || "");
       if (!ctx) {
         ctx = new SchemaContext(schema2, options, [], base, Object.create(this.schemas));
         if (!ctx.schemas[base]) {
@@ -48520,8 +48528,8 @@ var require_validator = __commonJS({
       if (ctx.schemas[switchSchema]) {
         return { subschema: ctx.schemas[switchSchema], switchSchema };
       }
-      var parsed = urilib.parse(switchSchema);
-      var fragment = parsed && parsed.hash;
+      let parsed = new URL(switchSchema, "thismessage::/");
+      let fragment = parsed.hash;
       var document2 = fragment && fragment.length && switchSchema.substr(0, switchSchema.length - fragment.length);
       if (!document2 || !ctx.schemas[document2]) {
         throw new SchemaError("no such schema <" + switchSchema + ">", schema2);
@@ -100155,6 +100163,11 @@ var require_follow_redirects = __commonJS({
     } catch (error3) {
       useNativeURL = error3.code === "ERR_INVALID_URL";
     }
+    var sensitiveHeaders = [
+      "Authorization",
+      "Proxy-Authorization",
+      "Cookie"
+    ];
     var preservedUrlFields = [
       "auth",
       "host",
@@ -100219,6 +100232,7 @@ var require_follow_redirects = __commonJS({
           self2.emit("error", cause instanceof RedirectionError ? cause : new RedirectionError({ cause }));
         }
       };
+      this._headerFilter = new RegExp("^(?:" + sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join("|") + ")$", "i");
       this._performRequest();
     }
     RedirectableRequest.prototype = Object.create(Writable.prototype);
@@ -100356,6 +100370,9 @@ var require_follow_redirects = __commonJS({
       if (!options.headers) {
         options.headers = {};
       }
+      if (!isArray(options.sensitiveHeaders)) {
+        options.sensitiveHeaders = [];
+      }
       if (options.host) {
         if (!options.hostname) {
           options.hostname = options.host;
@@ -100461,7 +100478,7 @@ var require_follow_redirects = __commonJS({
       this._isRedirect = true;
       spreadUrlObject(redirectUrl, this._options);
       if (redirectUrl.protocol !== currentUrlParts.protocol && redirectUrl.protocol !== "https:" || redirectUrl.host !== currentHost && !isSubdomain(redirectUrl.host, currentHost)) {
-        removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
+        removeMatchingHeaders(this._headerFilter, this._options.headers);
       }
       if (isFunction(beforeRedirect)) {
         var responseDetails = {
@@ -100610,6 +100627,9 @@ var require_follow_redirects = __commonJS({
       var dot = subdomain.length - domain.length - 1;
       return dot > 0 && subdomain[dot] === "." && subdomain.endsWith(domain);
     }
+    function isArray(value) {
+      return value instanceof Array;
+    }
     function isString2(value) {
       return typeof value === "string" || value instanceof String;
     }
@@ -100622,6 +100642,9 @@ var require_follow_redirects = __commonJS({
     function isURL(value) {
       return URL2 && value instanceof URL2;
     }
+    function escapeRegex(regex) {
+      return regex.replace(/[\]\\/()*+?.$]/g, "\\$&");
+    }
     module2.exports = wrap({ http, https: https2 });
     module2.exports.wrap = wrap;
   }
@@ -103444,6 +103467,7 @@ var ExhaustivityCheckingError = class extends Error {
     super("Internal error: exhaustivity checking failure");
     this.expectedExhaustiveValue = expectedExhaustiveValue;
   }
+  expectedExhaustiveValue;
 };
 function assertNever(value) {
   throw new ExhaustivityCheckingError(value);
@@ -103629,7 +103653,7 @@ function getDiffRangesJsonFilePath() {
   return path2.join(getTemporaryDirectory(), PR_DIFF_RANGE_JSON_FILENAME);
 }
 function getActionVersion() {
-  return "4.35.2";
+  return "4.35.3";
 }
 function getWorkflowEventName() {
   return getRequiredEnvParam("GITHUB_EVENT_NAME");
@@ -103707,6 +103731,11 @@ var CommandInvocationError = class extends Error {
     this.stderr = stderr;
     this.stdout = stdout;
   }
+  cmd;
+  args;
+  exitCode;
+  stderr;
+  stdout;
 };
 function ensureEndsInPeriod(text) {
   return text[text.length - 1] === "." ? text : `${text}.`;
@@ -103754,8 +103783,11 @@ var githubUtils = __toESM(require_utils5());
 var import_light = __toESM(require_light(), 1);
 init_dist_src();
 var VERSION7 = "0.0.0-development";
+function isRequestError(error3) {
+  return error3.request !== void 0;
+}
 async function errorRequest(state, octokit, error3, options) {
-  if (!error3.request || !error3.request.request) {
+  if (!isRequestError(error3) || !error3?.request.request) {
     throw error3;
   }
   if (error3.status >= 400 && !state.doNotRetry.includes(error3.status)) {
@@ -103768,8 +103800,8 @@ async function errorRequest(state, octokit, error3, options) {
 async function wrapRequest(state, octokit, request2, options) {
   const limiter = new import_light.default();
   limiter.on("failed", function(error3, info6) {
-    const maxRetries = ~~error3.request.request.retries;
-    const after = ~~error3.request.request.retryAfter;
+    const maxRetries = ~~error3.request.request?.retries;
+    const after = ~~error3.request.request?.retryAfter;
     options.request.retryCount = info6.retryCount + 1;
     if (maxRetries > info6.retryCount) {
       return after * state.retryAfterBaseValue;
@@ -103781,7 +103813,7 @@ async function wrapRequest(state, octokit, request2, options) {
   );
 }
 async function requestWithGraphqlErrorHandling(state, octokit, request2, options) {
-  const response = await request2(request2, options);
+  const response = await request2(options);
   if (response.data && response.data.errors && response.data.errors.length > 0 && /Something went wrong while executing your query/.test(
     response.data.errors[0].message
   )) {
@@ -103803,11 +103835,7 @@ function retry(octokit, octokitOptions) {
     },
     octokitOptions.retry
   );
-  if (state.enabled) {
-    octokit.hook.error("request", errorRequest.bind(null, state, octokit));
-    octokit.hook.wrap("request", wrapRequest.bind(null, state, octokit));
-  }
-  return {
+  const retryPlugin = {
     retry: {
       retryRequest: (error3, retries, retryAfter) => {
         error3.request.request = Object.assign({}, error3.request.request, {
@@ -103818,6 +103846,11 @@ function retry(octokit, octokitOptions) {
       }
     }
   };
+  if (state.enabled) {
+    octokit.hook.error("request", errorRequest.bind(null, state, retryPlugin));
+    octokit.hook.wrap("request", wrapRequest.bind(null, state, retryPlugin));
+  }
+  return retryPlugin;
 }
 retry.VERSION = VERSION7;
 
@@ -103984,8 +104017,8 @@ var path5 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.25.1";
-var cliVersion = "2.25.1";
+var bundleVersion = "codeql-bundle-v2.25.2";
+var cliVersion = "2.25.2";
 
 // src/overlay/index.ts
 var fs4 = __toESM(require("fs"));
@@ -104510,6 +104543,7 @@ var OfflineFeatures = class {
   constructor(logger) {
     this.logger = logger;
   }
+  logger;
   async getDefaultCliVersion(_variant) {
     return {
       cliVersion,
@@ -104658,6 +104692,9 @@ var GitHubFeatureFlags = class {
     this.logger = logger;
     this.hasAccessedRemoteFeatureFlags = false;
   }
+  repositoryNwo;
+  featureFlagsFile;
+  logger;
   cachedApiResponse;
   // We cache whether the feature flags were accessed or not in order to accurately report whether flags were
   // incorrectly configured vs. inaccessible in our telemetry.

lib/start-proxy-action-post.js

@@ -47304,7 +47304,6 @@ var require_light = __commonJS({
 var require_helpers = __commonJS({
   "node_modules/jsonschema/lib/helpers.js"(exports2, module2) {
     "use strict";
-    var uri = require("url");
     var ValidationError = exports2.ValidationError = function ValidationError2(message, instance, schema2, path4, name, argument) {
       if (Array.isArray(path4)) {
         this.path = path4;
@@ -47379,7 +47378,7 @@ var require_helpers = __commonJS({
     } });
     module2.exports.ValidatorResultError = ValidatorResultError;
     function ValidatorResultError(result) {
-      if (Error.captureStackTrace) {
+      if (typeof Error.captureStackTrace === "function") {
         Error.captureStackTrace(this, ValidatorResultError);
       }
       this.instance = result.instance;
@@ -47394,7 +47393,9 @@ var require_helpers = __commonJS({
       this.message = msg;
       this.schema = schema2;
       Error.call(this, msg);
-      Error.captureStackTrace(this, SchemaError2);
+      if (typeof Error.captureStackTrace === "function") {
+        Error.captureStackTrace(this, SchemaError2);
+      }
     };
     SchemaError.prototype = Object.create(
       Error.prototype,
@@ -47418,12 +47419,12 @@ var require_helpers = __commonJS({
       this.schemas = schemas;
     };
     SchemaContext.prototype.resolve = function resolve3(target) {
-      return uri.resolve(this.base, target);
+      return (() => resolveUrl(this.base, target))();
     };
     SchemaContext.prototype.makeChild = function makeChild(schema2, propertyName) {
       var path4 = propertyName === void 0 ? this.path : this.path.concat([propertyName]);
       var id = schema2.$id || schema2.id;
-      var base = uri.resolve(this.base, id || "");
+      let base = (() => resolveUrl(this.base, id || ""))();
       var ctx = new SchemaContext(schema2, this.options, path4, base, Object.create(this.schemas));
       if (id && !ctx.schemas[base]) {
         ctx.schemas[base] = schema2;
@@ -47617,6 +47618,14 @@ var require_helpers = __commonJS({
     exports2.isSchema = function isSchema(val) {
       return typeof val === "object" && val || typeof val === "boolean";
     };
+    var resolveUrl = exports2.resolveUrl = function resolveUrl2(from, to) {
+      const resolvedUrl = new URL(to, new URL(from, "resolve://"));
+      if (resolvedUrl.protocol === "resolve:") {
+        const { pathname, search, hash } = resolvedUrl;
+        return pathname + search + hash;
+      }
+      return resolvedUrl.toString();
+    };
   }
 });
 
@@ -48292,7 +48301,6 @@ var require_attribute = __commonJS({
 var require_scan = __commonJS({
   "node_modules/jsonschema/lib/scan.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var helpers = require_helpers();
     module2.exports.SchemaScanResult = SchemaScanResult;
     function SchemaScanResult(found, ref) {
@@ -48303,12 +48311,13 @@ var require_scan = __commonJS({
       function scanSchema(baseuri, schema3) {
         if (!schema3 || typeof schema3 != "object") return;
         if (schema3.$ref) {
-          var resolvedUri = urilib.resolve(baseuri, schema3.$ref);
+          let resolvedUri = helpers.resolveUrl(baseuri, schema3.$ref);
           ref[resolvedUri] = ref[resolvedUri] ? ref[resolvedUri] + 1 : 0;
           return;
         }
         var id = schema3.$id || schema3.id;
-        var ourBase = id ? urilib.resolve(baseuri, id) : baseuri;
+        let resolvedBase = helpers.resolveUrl(baseuri, id);
+        var ourBase = id ? resolvedBase : baseuri;
         if (ourBase) {
           if (ourBase.indexOf("#") < 0) ourBase += "#";
           if (found[ourBase]) {
@@ -48360,7 +48369,6 @@ var require_scan = __commonJS({
 var require_validator = __commonJS({
   "node_modules/jsonschema/lib/validator.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var attribute = require_attribute();
     var helpers = require_helpers();
     var scanSchema = require_scan().scan;
@@ -48425,7 +48433,7 @@ var require_validator = __commonJS({
         options = {};
       }
       var id = schema2.$id || schema2.id;
-      var base = urilib.resolve(options.base || anonymousBase, id || "");
+      let base = helpers.resolveUrl(options.base, id || "");
       if (!ctx) {
         ctx = new SchemaContext(schema2, options, [], base, Object.create(this.schemas));
         if (!ctx.schemas[base]) {
@@ -48520,8 +48528,8 @@ var require_validator = __commonJS({
       if (ctx.schemas[switchSchema]) {
         return { subschema: ctx.schemas[switchSchema], switchSchema };
       }
-      var parsed = urilib.parse(switchSchema);
-      var fragment = parsed && parsed.hash;
+      let parsed = new URL(switchSchema, "thismessage::/");
+      let fragment = parsed.hash;
       var document2 = fragment && fragment.length && switchSchema.substr(0, switchSchema.length - fragment.length);
       if (!document2 || !ctx.schemas[document2]) {
         throw new SchemaError("no such schema <" + switchSchema + ">", schema2);
@@ -158263,6 +158271,11 @@ var require_follow_redirects = __commonJS({
     } catch (error3) {
       useNativeURL = error3.code === "ERR_INVALID_URL";
     }
+    var sensitiveHeaders = [
+      "Authorization",
+      "Proxy-Authorization",
+      "Cookie"
+    ];
     var preservedUrlFields = [
       "auth",
       "host",
@@ -158327,6 +158340,7 @@ var require_follow_redirects = __commonJS({
           self2.emit("error", cause instanceof RedirectionError ? cause : new RedirectionError({ cause }));
         }
       };
+      this._headerFilter = new RegExp("^(?:" + sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join("|") + ")$", "i");
       this._performRequest();
     }
     RedirectableRequest.prototype = Object.create(Writable.prototype);
@@ -158464,6 +158478,9 @@ var require_follow_redirects = __commonJS({
       if (!options.headers) {
         options.headers = {};
       }
+      if (!isArray(options.sensitiveHeaders)) {
+        options.sensitiveHeaders = [];
+      }
       if (options.host) {
         if (!options.hostname) {
           options.hostname = options.host;
@@ -158569,7 +158586,7 @@ var require_follow_redirects = __commonJS({
       this._isRedirect = true;
       spreadUrlObject(redirectUrl, this._options);
       if (redirectUrl.protocol !== currentUrlParts.protocol && redirectUrl.protocol !== "https:" || redirectUrl.host !== currentHost && !isSubdomain(redirectUrl.host, currentHost)) {
-        removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
+        removeMatchingHeaders(this._headerFilter, this._options.headers);
       }
       if (isFunction(beforeRedirect)) {
         var responseDetails = {
@@ -158718,6 +158735,9 @@ var require_follow_redirects = __commonJS({
       var dot = subdomain.length - domain.length - 1;
       return dot > 0 && subdomain[dot] === "." && subdomain.endsWith(domain);
     }
+    function isArray(value) {
+      return value instanceof Array;
+    }
     function isString2(value) {
       return typeof value === "string" || value instanceof String;
     }
@@ -158730,6 +158750,9 @@ var require_follow_redirects = __commonJS({
     function isURL(value) {
       return URL2 && value instanceof URL2;
     }
+    function escapeRegex(regex) {
+      return regex.replace(/[\]\\/()*+?.$]/g, "\\$&");
+    }
     module2.exports = wrap({ http, https: https2 });
     module2.exports.wrap = wrap;
   }
@@ -161498,7 +161521,7 @@ function getTemporaryDirectory() {
   return value !== void 0 && value !== "" ? value : getRequiredEnvParam("RUNNER_TEMP");
 }
 function getActionVersion() {
-  return "4.35.2";
+  return "4.35.3";
 }
 var persistedInputsKey = "persisted_inputs";
 var restoreInputs = function() {
@@ -161518,8 +161541,11 @@ var githubUtils = __toESM(require_utils5());
 var import_light = __toESM(require_light(), 1);
 init_dist_src();
 var VERSION7 = "0.0.0-development";
+function isRequestError(error3) {
+  return error3.request !== void 0;
+}
 async function errorRequest(state, octokit, error3, options) {
-  if (!error3.request || !error3.request.request) {
+  if (!isRequestError(error3) || !error3?.request.request) {
     throw error3;
   }
   if (error3.status >= 400 && !state.doNotRetry.includes(error3.status)) {
@@ -161532,8 +161558,8 @@ async function errorRequest(state, octokit, error3, options) {
 async function wrapRequest(state, octokit, request2, options) {
   const limiter = new import_light.default();
   limiter.on("failed", function(error3, info7) {
-    const maxRetries = ~~error3.request.request.retries;
-    const after = ~~error3.request.request.retryAfter;
+    const maxRetries = ~~error3.request.request?.retries;
+    const after = ~~error3.request.request?.retryAfter;
     options.request.retryCount = info7.retryCount + 1;
     if (maxRetries > info7.retryCount) {
       return after * state.retryAfterBaseValue;
@@ -161545,7 +161571,7 @@ async function wrapRequest(state, octokit, request2, options) {
   );
 }
 async function requestWithGraphqlErrorHandling(state, octokit, request2, options) {
-  const response = await request2(request2, options);
+  const response = await request2(options);
   if (response.data && response.data.errors && response.data.errors.length > 0 && /Something went wrong while executing your query/.test(
     response.data.errors[0].message
   )) {
@@ -161567,11 +161593,7 @@ function retry(octokit, octokitOptions) {
     },
     octokitOptions.retry
   );
-  if (state.enabled) {
-    octokit.hook.error("request", errorRequest.bind(null, state, octokit));
-    octokit.hook.wrap("request", wrapRequest.bind(null, state, octokit));
-  }
-  return {
+  const retryPlugin = {
     retry: {
       retryRequest: (error3, retries, retryAfter) => {
         error3.request.request = Object.assign({}, error3.request.request, {
@@ -161582,6 +161604,11 @@ function retry(octokit, octokitOptions) {
       }
     }
   };
+  if (state.enabled) {
+    octokit.hook.error("request", errorRequest.bind(null, state, retryPlugin));
+    octokit.hook.wrap("request", wrapRequest.bind(null, state, retryPlugin));
+  }
+  return retryPlugin;
 }
 retry.VERSION = VERSION7;
 

lib/start-proxy-action.js

@@ -48126,7 +48126,6 @@ var require_tool_cache = __commonJS({
 var require_helpers = __commonJS({
   "node_modules/jsonschema/lib/helpers.js"(exports2, module2) {
     "use strict";
-    var uri = require("url");
     var ValidationError = exports2.ValidationError = function ValidationError2(message, instance, schema2, path5, name, argument) {
       if (Array.isArray(path5)) {
         this.path = path5;
@@ -48201,7 +48200,7 @@ var require_helpers = __commonJS({
     } });
     module2.exports.ValidatorResultError = ValidatorResultError;
     function ValidatorResultError(result) {
-      if (Error.captureStackTrace) {
+      if (typeof Error.captureStackTrace === "function") {
         Error.captureStackTrace(this, ValidatorResultError);
       }
       this.instance = result.instance;
@@ -48216,7 +48215,9 @@ var require_helpers = __commonJS({
       this.message = msg;
       this.schema = schema2;
       Error.call(this, msg);
-      Error.captureStackTrace(this, SchemaError2);
+      if (typeof Error.captureStackTrace === "function") {
+        Error.captureStackTrace(this, SchemaError2);
+      }
     };
     SchemaError.prototype = Object.create(
       Error.prototype,
@@ -48240,12 +48241,12 @@ var require_helpers = __commonJS({
       this.schemas = schemas;
     };
     SchemaContext.prototype.resolve = function resolve2(target) {
-      return uri.resolve(this.base, target);
+      return (() => resolveUrl(this.base, target))();
     };
     SchemaContext.prototype.makeChild = function makeChild(schema2, propertyName) {
       var path5 = propertyName === void 0 ? this.path : this.path.concat([propertyName]);
       var id = schema2.$id || schema2.id;
-      var base = uri.resolve(this.base, id || "");
+      let base = (() => resolveUrl(this.base, id || ""))();
       var ctx = new SchemaContext(schema2, this.options, path5, base, Object.create(this.schemas));
       if (id && !ctx.schemas[base]) {
         ctx.schemas[base] = schema2;
@@ -48439,6 +48440,14 @@ var require_helpers = __commonJS({
     exports2.isSchema = function isSchema(val) {
       return typeof val === "object" && val || typeof val === "boolean";
     };
+    var resolveUrl = exports2.resolveUrl = function resolveUrl2(from, to) {
+      const resolvedUrl = new URL(to, new URL(from, "resolve://"));
+      if (resolvedUrl.protocol === "resolve:") {
+        const { pathname, search, hash } = resolvedUrl;
+        return pathname + search + hash;
+      }
+      return resolvedUrl.toString();
+    };
   }
 });
 
@@ -49114,7 +49123,6 @@ var require_attribute = __commonJS({
 var require_scan = __commonJS({
   "node_modules/jsonschema/lib/scan.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var helpers = require_helpers();
     module2.exports.SchemaScanResult = SchemaScanResult;
     function SchemaScanResult(found, ref) {
@@ -49125,12 +49133,13 @@ var require_scan = __commonJS({
       function scanSchema(baseuri, schema3) {
         if (!schema3 || typeof schema3 != "object") return;
         if (schema3.$ref) {
-          var resolvedUri = urilib.resolve(baseuri, schema3.$ref);
+          let resolvedUri = helpers.resolveUrl(baseuri, schema3.$ref);
           ref[resolvedUri] = ref[resolvedUri] ? ref[resolvedUri] + 1 : 0;
           return;
         }
         var id = schema3.$id || schema3.id;
-        var ourBase = id ? urilib.resolve(baseuri, id) : baseuri;
+        let resolvedBase = helpers.resolveUrl(baseuri, id);
+        var ourBase = id ? resolvedBase : baseuri;
         if (ourBase) {
           if (ourBase.indexOf("#") < 0) ourBase += "#";
           if (found[ourBase]) {
@@ -49182,7 +49191,6 @@ var require_scan = __commonJS({
 var require_validator = __commonJS({
   "node_modules/jsonschema/lib/validator.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var attribute = require_attribute();
     var helpers = require_helpers();
     var scanSchema = require_scan().scan;
@@ -49247,7 +49255,7 @@ var require_validator = __commonJS({
         options = {};
       }
       var id = schema2.$id || schema2.id;
-      var base = urilib.resolve(options.base || anonymousBase, id || "");
+      let base = helpers.resolveUrl(options.base, id || "");
       if (!ctx) {
         ctx = new SchemaContext(schema2, options, [], base, Object.create(this.schemas));
         if (!ctx.schemas[base]) {
@@ -49342,8 +49350,8 @@ var require_validator = __commonJS({
       if (ctx.schemas[switchSchema]) {
         return { subschema: ctx.schemas[switchSchema], switchSchema };
       }
-      var parsed = urilib.parse(switchSchema);
-      var fragment = parsed && parsed.hash;
+      let parsed = new URL(switchSchema, "thismessage::/");
+      let fragment = parsed.hash;
       var document2 = fragment && fragment.length && switchSchema.substr(0, switchSchema.length - fragment.length);
       if (!document2 || !ctx.schemas[document2]) {
         throw new SchemaError("no such schema <" + switchSchema + ">", schema2);
@@ -120718,7 +120726,7 @@ function getTemporaryDirectory() {
   return value !== void 0 && value !== "" ? value : getRequiredEnvParam("RUNNER_TEMP");
 }
 function getActionVersion() {
-  return "4.35.2";
+  return "4.35.3";
 }
 function getWorkflowEventName() {
   return getRequiredEnvParam("GITHUB_EVENT_NAME");
@@ -120772,8 +120780,11 @@ var githubUtils = __toESM(require_utils5());
 var import_light = __toESM(require_light(), 1);
 init_dist_src();
 var VERSION7 = "0.0.0-development";
+function isRequestError(error3) {
+  return error3.request !== void 0;
+}
 async function errorRequest(state, octokit, error3, options) {
-  if (!error3.request || !error3.request.request) {
+  if (!isRequestError(error3) || !error3?.request.request) {
     throw error3;
   }
   if (error3.status >= 400 && !state.doNotRetry.includes(error3.status)) {
@@ -120786,8 +120797,8 @@ async function errorRequest(state, octokit, error3, options) {
 async function wrapRequest(state, octokit, request3, options) {
   const limiter = new import_light.default();
   limiter.on("failed", function(error3, info6) {
-    const maxRetries = ~~error3.request.request.retries;
-    const after = ~~error3.request.request.retryAfter;
+    const maxRetries = ~~error3.request.request?.retries;
+    const after = ~~error3.request.request?.retryAfter;
     options.request.retryCount = info6.retryCount + 1;
     if (maxRetries > info6.retryCount) {
       return after * state.retryAfterBaseValue;
@@ -120799,7 +120810,7 @@ async function wrapRequest(state, octokit, request3, options) {
   );
 }
 async function requestWithGraphqlErrorHandling(state, octokit, request3, options) {
-  const response = await request3(request3, options);
+  const response = await request3(options);
   if (response.data && response.data.errors && response.data.errors.length > 0 && /Something went wrong while executing your query/.test(
     response.data.errors[0].message
   )) {
@@ -120821,11 +120832,7 @@ function retry(octokit, octokitOptions) {
     },
     octokitOptions.retry
   );
-  if (state.enabled) {
-    octokit.hook.error("request", errorRequest.bind(null, state, octokit));
-    octokit.hook.wrap("request", wrapRequest.bind(null, state, octokit));
-  }
-  return {
+  const retryPlugin = {
     retry: {
       retryRequest: (error3, retries, retryAfter) => {
         error3.request.request = Object.assign({}, error3.request.request, {
@@ -120836,6 +120843,11 @@ function retry(octokit, octokitOptions) {
       }
     }
   };
+  if (state.enabled) {
+    octokit.hook.error("request", errorRequest.bind(null, state, retryPlugin));
+    octokit.hook.wrap("request", wrapRequest.bind(null, state, retryPlugin));
+  }
+  return retryPlugin;
 }
 retry.VERSION = VERSION7;
 
@@ -120965,8 +120977,8 @@ var path = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.25.1";
-var cliVersion = "2.25.1";
+var bundleVersion = "codeql-bundle-v2.25.2";
+var cliVersion = "2.25.2";
 
 // src/git-utils.ts
 var core6 = __toESM(require_core());
@@ -121291,6 +121303,7 @@ var OfflineFeatures = class {
   constructor(logger) {
     this.logger = logger;
   }
+  logger;
   async getDefaultCliVersion(_variant) {
     return {
       cliVersion,
@@ -121439,6 +121452,9 @@ var GitHubFeatureFlags = class {
     this.logger = logger;
     this.hasAccessedRemoteFeatureFlags = false;
   }
+  repositoryNwo;
+  featureFlagsFile;
+  logger;
   cachedApiResponse;
   // We cache whether the feature flags were accessed or not in order to accurately report whether flags were
   // incorrectly configured vs. inaccessible in our telemetry.
@@ -122629,12 +122645,14 @@ var ReachabilityError = class extends Error {
     super();
     this.statusCode = statusCode;
   }
+  statusCode;
 };
 var NetworkReachabilityBackend = class {
   constructor(proxy) {
     this.proxy = proxy;
     this.agent = new import_https_proxy_agent.HttpsProxyAgent(`http://${proxy.host}:${proxy.port}`);
   }
+  proxy;
   agent;
   async checkConnection(url) {
     return new Promise((resolve2, reject) => {

lib/upload-lib.js

@@ -21494,7 +21494,6 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``);
 var require_helpers = __commonJS({
   "node_modules/jsonschema/lib/helpers.js"(exports2, module2) {
     "use strict";
-    var uri = require("url");
     var ValidationError = exports2.ValidationError = function ValidationError2(message, instance, schema2, path12, name, argument) {
       if (Array.isArray(path12)) {
         this.path = path12;
@@ -21569,7 +21568,7 @@ var require_helpers = __commonJS({
     } });
     module2.exports.ValidatorResultError = ValidatorResultError;
     function ValidatorResultError(result) {
-      if (Error.captureStackTrace) {
+      if (typeof Error.captureStackTrace === "function") {
         Error.captureStackTrace(this, ValidatorResultError);
       }
       this.instance = result.instance;
@@ -21584,7 +21583,9 @@ var require_helpers = __commonJS({
       this.message = msg;
       this.schema = schema2;
       Error.call(this, msg);
-      Error.captureStackTrace(this, SchemaError2);
+      if (typeof Error.captureStackTrace === "function") {
+        Error.captureStackTrace(this, SchemaError2);
+      }
     };
     SchemaError.prototype = Object.create(
       Error.prototype,
@@ -21608,12 +21609,12 @@ var require_helpers = __commonJS({
       this.schemas = schemas;
     };
     SchemaContext.prototype.resolve = function resolve6(target) {
-      return uri.resolve(this.base, target);
+      return (() => resolveUrl(this.base, target))();
     };
     SchemaContext.prototype.makeChild = function makeChild(schema2, propertyName) {
       var path12 = propertyName === void 0 ? this.path : this.path.concat([propertyName]);
       var id = schema2.$id || schema2.id;
-      var base = uri.resolve(this.base, id || "");
+      let base = (() => resolveUrl(this.base, id || ""))();
       var ctx = new SchemaContext(schema2, this.options, path12, base, Object.create(this.schemas));
       if (id && !ctx.schemas[base]) {
         ctx.schemas[base] = schema2;
@@ -21807,6 +21808,14 @@ var require_helpers = __commonJS({
     exports2.isSchema = function isSchema(val) {
       return typeof val === "object" && val || typeof val === "boolean";
     };
+    var resolveUrl = exports2.resolveUrl = function resolveUrl2(from, to) {
+      const resolvedUrl = new URL(to, new URL(from, "resolve://"));
+      if (resolvedUrl.protocol === "resolve:") {
+        const { pathname, search, hash: hash2 } = resolvedUrl;
+        return pathname + search + hash2;
+      }
+      return resolvedUrl.toString();
+    };
   }
 });
 
@@ -22482,7 +22491,6 @@ var require_attribute = __commonJS({
 var require_scan = __commonJS({
   "node_modules/jsonschema/lib/scan.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var helpers = require_helpers();
     module2.exports.SchemaScanResult = SchemaScanResult;
     function SchemaScanResult(found, ref) {
@@ -22493,12 +22501,13 @@ var require_scan = __commonJS({
       function scanSchema(baseuri, schema3) {
         if (!schema3 || typeof schema3 != "object") return;
         if (schema3.$ref) {
-          var resolvedUri = urilib.resolve(baseuri, schema3.$ref);
+          let resolvedUri = helpers.resolveUrl(baseuri, schema3.$ref);
           ref[resolvedUri] = ref[resolvedUri] ? ref[resolvedUri] + 1 : 0;
           return;
         }
         var id = schema3.$id || schema3.id;
-        var ourBase = id ? urilib.resolve(baseuri, id) : baseuri;
+        let resolvedBase = helpers.resolveUrl(baseuri, id);
+        var ourBase = id ? resolvedBase : baseuri;
         if (ourBase) {
           if (ourBase.indexOf("#") < 0) ourBase += "#";
           if (found[ourBase]) {
@@ -22550,7 +22559,6 @@ var require_scan = __commonJS({
 var require_validator = __commonJS({
   "node_modules/jsonschema/lib/validator.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var attribute = require_attribute();
     var helpers = require_helpers();
     var scanSchema = require_scan().scan;
@@ -22615,7 +22623,7 @@ var require_validator = __commonJS({
         options = {};
       }
       var id = schema2.$id || schema2.id;
-      var base = urilib.resolve(options.base || anonymousBase, id || "");
+      let base = helpers.resolveUrl(options.base, id || "");
       if (!ctx) {
         ctx = new SchemaContext(schema2, options, [], base, Object.create(this.schemas));
         if (!ctx.schemas[base]) {
@@ -22710,8 +22718,8 @@ var require_validator = __commonJS({
       if (ctx.schemas[switchSchema]) {
         return { subschema: ctx.schemas[switchSchema], switchSchema };
       }
-      var parsed = urilib.parse(switchSchema);
-      var fragment = parsed && parsed.hash;
+      let parsed = new URL(switchSchema, "thismessage::/");
+      let fragment = parsed.hash;
       var document2 = fragment && fragment.length && switchSchema.substr(0, switchSchema.length - fragment.length);
       if (!document2 || !ctx.schemas[document2]) {
         throw new SchemaError("no such schema <" + switchSchema + ">", schema2);
@@ -100155,6 +100163,11 @@ var require_follow_redirects = __commonJS({
     } catch (error3) {
       useNativeURL = error3.code === "ERR_INVALID_URL";
     }
+    var sensitiveHeaders = [
+      "Authorization",
+      "Proxy-Authorization",
+      "Cookie"
+    ];
     var preservedUrlFields = [
       "auth",
       "host",
@@ -100219,6 +100232,7 @@ var require_follow_redirects = __commonJS({
           self2.emit("error", cause instanceof RedirectionError ? cause : new RedirectionError({ cause }));
         }
       };
+      this._headerFilter = new RegExp("^(?:" + sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join("|") + ")$", "i");
       this._performRequest();
     }
     RedirectableRequest.prototype = Object.create(Writable.prototype);
@@ -100356,6 +100370,9 @@ var require_follow_redirects = __commonJS({
       if (!options.headers) {
         options.headers = {};
       }
+      if (!isArray(options.sensitiveHeaders)) {
+        options.sensitiveHeaders = [];
+      }
       if (options.host) {
         if (!options.hostname) {
           options.hostname = options.host;
@@ -100461,7 +100478,7 @@ var require_follow_redirects = __commonJS({
       this._isRedirect = true;
       spreadUrlObject(redirectUrl, this._options);
       if (redirectUrl.protocol !== currentUrlParts.protocol && redirectUrl.protocol !== "https:" || redirectUrl.host !== currentHost && !isSubdomain(redirectUrl.host, currentHost)) {
-        removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
+        removeMatchingHeaders(this._headerFilter, this._options.headers);
       }
       if (isFunction(beforeRedirect)) {
         var responseDetails = {
@@ -100610,6 +100627,9 @@ var require_follow_redirects = __commonJS({
       var dot = subdomain.length - domain.length - 1;
       return dot > 0 && subdomain[dot] === "." && subdomain.endsWith(domain);
     }
+    function isArray(value) {
+      return value instanceof Array;
+    }
     function isString2(value) {
       return typeof value === "string" || value instanceof String;
     }
@@ -100622,6 +100642,9 @@ var require_follow_redirects = __commonJS({
     function isURL(value) {
       return URL2 && value instanceof URL2;
     }
+    function escapeRegex(regex) {
+      return regex.replace(/[\]\\/()*+?.$]/g, "\\$&");
+    }
     module2.exports = wrap({ http, https: https2 });
     module2.exports.wrap = wrap;
   }
@@ -106275,6 +106298,7 @@ var ExhaustivityCheckingError = class extends Error {
     super("Internal error: exhaustivity checking failure");
     this.expectedExhaustiveValue = expectedExhaustiveValue;
   }
+  expectedExhaustiveValue;
 };
 function assertNever(value) {
   throw new ExhaustivityCheckingError(value);
@@ -106425,7 +106449,7 @@ function getDiffRangesJsonFilePath() {
   return path2.join(getTemporaryDirectory(), PR_DIFF_RANGE_JSON_FILENAME);
 }
 function getActionVersion() {
-  return "4.35.2";
+  return "4.35.3";
 }
 function getWorkflowEventName() {
   return getRequiredEnvParam("GITHUB_EVENT_NAME");
@@ -106503,6 +106527,11 @@ var CommandInvocationError = class extends Error {
     this.stderr = stderr;
     this.stdout = stdout;
   }
+  cmd;
+  args;
+  exitCode;
+  stderr;
+  stdout;
 };
 function ensureEndsInPeriod(text) {
   return text[text.length - 1] === "." ? text : `${text}.`;
@@ -106633,8 +106662,11 @@ var githubUtils = __toESM(require_utils5());
 var import_light = __toESM(require_light(), 1);
 init_dist_src();
 var VERSION7 = "0.0.0-development";
+function isRequestError(error3) {
+  return error3.request !== void 0;
+}
 async function errorRequest(state, octokit, error3, options) {
-  if (!error3.request || !error3.request.request) {
+  if (!isRequestError(error3) || !error3?.request.request) {
     throw error3;
   }
   if (error3.status >= 400 && !state.doNotRetry.includes(error3.status)) {
@@ -106647,8 +106679,8 @@ async function errorRequest(state, octokit, error3, options) {
 async function wrapRequest(state, octokit, request2, options) {
   const limiter = new import_light.default();
   limiter.on("failed", function(error3, info6) {
-    const maxRetries = ~~error3.request.request.retries;
-    const after = ~~error3.request.request.retryAfter;
+    const maxRetries = ~~error3.request.request?.retries;
+    const after = ~~error3.request.request?.retryAfter;
     options.request.retryCount = info6.retryCount + 1;
     if (maxRetries > info6.retryCount) {
       return after * state.retryAfterBaseValue;
@@ -106660,7 +106692,7 @@ async function wrapRequest(state, octokit, request2, options) {
   );
 }
 async function requestWithGraphqlErrorHandling(state, octokit, request2, options) {
-  const response = await request2(request2, options);
+  const response = await request2(options);
   if (response.data && response.data.errors && response.data.errors.length > 0 && /Something went wrong while executing your query/.test(
     response.data.errors[0].message
   )) {
@@ -106682,11 +106714,7 @@ function retry(octokit, octokitOptions) {
     },
     octokitOptions.retry
   );
-  if (state.enabled) {
-    octokit.hook.error("request", errorRequest.bind(null, state, octokit));
-    octokit.hook.wrap("request", wrapRequest.bind(null, state, octokit));
-  }
-  return {
+  const retryPlugin = {
     retry: {
       retryRequest: (error3, retries, retryAfter) => {
         error3.request.request = Object.assign({}, error3.request.request, {
@@ -106697,6 +106725,11 @@ function retry(octokit, octokitOptions) {
       }
     }
   };
+  if (state.enabled) {
+    octokit.hook.error("request", errorRequest.bind(null, state, retryPlugin));
+    octokit.hook.wrap("request", wrapRequest.bind(null, state, retryPlugin));
+  }
+  return retryPlugin;
 }
 retry.VERSION = VERSION7;
 
@@ -107249,8 +107282,8 @@ var fs5 = __toESM(require("fs"));
 var semver5 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.25.1";
-var cliVersion = "2.25.1";
+var bundleVersion = "codeql-bundle-v2.25.2";
+var cliVersion = "2.25.2";
 
 // src/overlay/index.ts
 var fs4 = __toESM(require("fs"));

lib/upload-sarif-action-post.js

@@ -149550,7 +149550,6 @@ var require_artifact_client2 = __commonJS({
 var require_helpers3 = __commonJS({
   "node_modules/jsonschema/lib/helpers.js"(exports2, module2) {
     "use strict";
-    var uri = require("url");
     var ValidationError = exports2.ValidationError = function ValidationError2(message, instance, schema2, path3, name, argument) {
       if (Array.isArray(path3)) {
         this.path = path3;
@@ -149625,7 +149624,7 @@ var require_helpers3 = __commonJS({
     } });
     module2.exports.ValidatorResultError = ValidatorResultError;
     function ValidatorResultError(result) {
-      if (Error.captureStackTrace) {
+      if (typeof Error.captureStackTrace === "function") {
         Error.captureStackTrace(this, ValidatorResultError);
       }
       this.instance = result.instance;
@@ -149640,7 +149639,9 @@ var require_helpers3 = __commonJS({
       this.message = msg;
       this.schema = schema2;
       Error.call(this, msg);
-      Error.captureStackTrace(this, SchemaError2);
+      if (typeof Error.captureStackTrace === "function") {
+        Error.captureStackTrace(this, SchemaError2);
+      }
     };
     SchemaError.prototype = Object.create(
       Error.prototype,
@@ -149664,12 +149665,12 @@ var require_helpers3 = __commonJS({
       this.schemas = schemas;
     };
     SchemaContext.prototype.resolve = function resolve2(target) {
-      return uri.resolve(this.base, target);
+      return (() => resolveUrl(this.base, target))();
     };
     SchemaContext.prototype.makeChild = function makeChild(schema2, propertyName) {
       var path3 = propertyName === void 0 ? this.path : this.path.concat([propertyName]);
       var id = schema2.$id || schema2.id;
-      var base = uri.resolve(this.base, id || "");
+      let base = (() => resolveUrl(this.base, id || ""))();
       var ctx = new SchemaContext(schema2, this.options, path3, base, Object.create(this.schemas));
       if (id && !ctx.schemas[base]) {
         ctx.schemas[base] = schema2;
@@ -149863,6 +149864,14 @@ var require_helpers3 = __commonJS({
     exports2.isSchema = function isSchema(val) {
       return typeof val === "object" && val || typeof val === "boolean";
     };
+    var resolveUrl = exports2.resolveUrl = function resolveUrl2(from, to) {
+      const resolvedUrl = new URL(to, new URL(from, "resolve://"));
+      if (resolvedUrl.protocol === "resolve:") {
+        const { pathname, search, hash } = resolvedUrl;
+        return pathname + search + hash;
+      }
+      return resolvedUrl.toString();
+    };
   }
 });
 
@@ -150538,7 +150547,6 @@ var require_attribute = __commonJS({
 var require_scan = __commonJS({
   "node_modules/jsonschema/lib/scan.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var helpers = require_helpers3();
     module2.exports.SchemaScanResult = SchemaScanResult;
     function SchemaScanResult(found, ref) {
@@ -150549,12 +150557,13 @@ var require_scan = __commonJS({
       function scanSchema(baseuri, schema3) {
         if (!schema3 || typeof schema3 != "object") return;
         if (schema3.$ref) {
-          var resolvedUri = urilib.resolve(baseuri, schema3.$ref);
+          let resolvedUri = helpers.resolveUrl(baseuri, schema3.$ref);
           ref[resolvedUri] = ref[resolvedUri] ? ref[resolvedUri] + 1 : 0;
           return;
         }
         var id = schema3.$id || schema3.id;
-        var ourBase = id ? urilib.resolve(baseuri, id) : baseuri;
+        let resolvedBase = helpers.resolveUrl(baseuri, id);
+        var ourBase = id ? resolvedBase : baseuri;
         if (ourBase) {
           if (ourBase.indexOf("#") < 0) ourBase += "#";
           if (found[ourBase]) {
@@ -150606,7 +150615,6 @@ var require_scan = __commonJS({
 var require_validator = __commonJS({
   "node_modules/jsonschema/lib/validator.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var attribute = require_attribute();
     var helpers = require_helpers3();
     var scanSchema = require_scan().scan;
@@ -150671,7 +150679,7 @@ var require_validator = __commonJS({
         options = {};
       }
       var id = schema2.$id || schema2.id;
-      var base = urilib.resolve(options.base || anonymousBase, id || "");
+      let base = helpers.resolveUrl(options.base, id || "");
       if (!ctx) {
         ctx = new SchemaContext(schema2, options, [], base, Object.create(this.schemas));
         if (!ctx.schemas[base]) {
@@ -150766,8 +150774,8 @@ var require_validator = __commonJS({
       if (ctx.schemas[switchSchema]) {
         return { subschema: ctx.schemas[switchSchema], switchSchema };
       }
-      var parsed = urilib.parse(switchSchema);
-      var fragment = parsed && parsed.hash;
+      let parsed = new URL(switchSchema, "thismessage::/");
+      let fragment = parsed.hash;
       var document2 = fragment && fragment.length && switchSchema.substr(0, switchSchema.length - fragment.length);
       if (!document2 || !ctx.schemas[document2]) {
         throw new SchemaError("no such schema <" + switchSchema + ">", schema2);
@@ -158263,6 +158271,11 @@ var require_follow_redirects = __commonJS({
     } catch (error3) {
       useNativeURL = error3.code === "ERR_INVALID_URL";
     }
+    var sensitiveHeaders = [
+      "Authorization",
+      "Proxy-Authorization",
+      "Cookie"
+    ];
     var preservedUrlFields = [
       "auth",
       "host",
@@ -158327,6 +158340,7 @@ var require_follow_redirects = __commonJS({
           self2.emit("error", cause instanceof RedirectionError ? cause : new RedirectionError({ cause }));
         }
       };
+      this._headerFilter = new RegExp("^(?:" + sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join("|") + ")$", "i");
       this._performRequest();
     }
     RedirectableRequest.prototype = Object.create(Writable.prototype);
@@ -158464,6 +158478,9 @@ var require_follow_redirects = __commonJS({
       if (!options.headers) {
         options.headers = {};
       }
+      if (!isArray(options.sensitiveHeaders)) {
+        options.sensitiveHeaders = [];
+      }
       if (options.host) {
         if (!options.hostname) {
           options.hostname = options.host;
@@ -158569,7 +158586,7 @@ var require_follow_redirects = __commonJS({
       this._isRedirect = true;
       spreadUrlObject(redirectUrl, this._options);
       if (redirectUrl.protocol !== currentUrlParts.protocol && redirectUrl.protocol !== "https:" || redirectUrl.host !== currentHost && !isSubdomain(redirectUrl.host, currentHost)) {
-        removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
+        removeMatchingHeaders(this._headerFilter, this._options.headers);
       }
       if (isFunction(beforeRedirect)) {
         var responseDetails = {
@@ -158718,6 +158735,9 @@ var require_follow_redirects = __commonJS({
       var dot = subdomain.length - domain.length - 1;
       return dot > 0 && subdomain[dot] === "." && subdomain.endsWith(domain);
     }
+    function isArray(value) {
+      return value instanceof Array;
+    }
     function isString2(value) {
       return typeof value === "string" || value instanceof String;
     }
@@ -158730,6 +158750,9 @@ var require_follow_redirects = __commonJS({
     function isURL(value) {
       return URL2 && value instanceof URL2;
     }
+    function escapeRegex(regex) {
+      return regex.replace(/[\]\\/()*+?.$]/g, "\\$&");
+    }
     module2.exports = wrap({ http, https: https2 });
     module2.exports.wrap = wrap;
   }
@@ -161498,7 +161521,7 @@ function getTemporaryDirectory() {
   return value !== void 0 && value !== "" ? value : getRequiredEnvParam("RUNNER_TEMP");
 }
 function getActionVersion() {
-  return "4.35.2";
+  return "4.35.3";
 }
 var persistedInputsKey = "persisted_inputs";
 var restoreInputs = function() {
@@ -161518,8 +161541,11 @@ var githubUtils = __toESM(require_utils5());
 var import_light = __toESM(require_light(), 1);
 init_dist_src();
 var VERSION7 = "0.0.0-development";
+function isRequestError(error3) {
+  return error3.request !== void 0;
+}
 async function errorRequest(state, octokit, error3, options) {
-  if (!error3.request || !error3.request.request) {
+  if (!isRequestError(error3) || !error3?.request.request) {
     throw error3;
   }
   if (error3.status >= 400 && !state.doNotRetry.includes(error3.status)) {
@@ -161532,8 +161558,8 @@ async function errorRequest(state, octokit, error3, options) {
 async function wrapRequest(state, octokit, request2, options) {
   const limiter = new import_light.default();
   limiter.on("failed", function(error3, info7) {
-    const maxRetries = ~~error3.request.request.retries;
-    const after = ~~error3.request.request.retryAfter;
+    const maxRetries = ~~error3.request.request?.retries;
+    const after = ~~error3.request.request?.retryAfter;
     options.request.retryCount = info7.retryCount + 1;
     if (maxRetries > info7.retryCount) {
       return after * state.retryAfterBaseValue;
@@ -161545,7 +161571,7 @@ async function wrapRequest(state, octokit, request2, options) {
   );
 }
 async function requestWithGraphqlErrorHandling(state, octokit, request2, options) {
-  const response = await request2(request2, options);
+  const response = await request2(options);
   if (response.data && response.data.errors && response.data.errors.length > 0 && /Something went wrong while executing your query/.test(
     response.data.errors[0].message
   )) {
@@ -161567,11 +161593,7 @@ function retry(octokit, octokitOptions) {
     },
     octokitOptions.retry
   );
-  if (state.enabled) {
-    octokit.hook.error("request", errorRequest.bind(null, state, octokit));
-    octokit.hook.wrap("request", wrapRequest.bind(null, state, octokit));
-  }
-  return {
+  const retryPlugin = {
     retry: {
       retryRequest: (error3, retries, retryAfter) => {
         error3.request.request = Object.assign({}, error3.request.request, {
@@ -161582,6 +161604,11 @@ function retry(octokit, octokitOptions) {
       }
     }
   };
+  if (state.enabled) {
+    octokit.hook.error("request", errorRequest.bind(null, state, retryPlugin));
+    octokit.hook.wrap("request", wrapRequest.bind(null, state, retryPlugin));
+  }
+  return retryPlugin;
 }
 retry.VERSION = VERSION7;
 

lib/upload-sarif-action.js

@@ -47304,7 +47304,6 @@ var require_light = __commonJS({
 var require_helpers = __commonJS({
   "node_modules/jsonschema/lib/helpers.js"(exports2, module2) {
     "use strict";
-    var uri = require("url");
     var ValidationError = exports2.ValidationError = function ValidationError2(message, instance, schema2, path13, name, argument) {
       if (Array.isArray(path13)) {
         this.path = path13;
@@ -47379,7 +47378,7 @@ var require_helpers = __commonJS({
     } });
     module2.exports.ValidatorResultError = ValidatorResultError;
     function ValidatorResultError(result) {
-      if (Error.captureStackTrace) {
+      if (typeof Error.captureStackTrace === "function") {
         Error.captureStackTrace(this, ValidatorResultError);
       }
       this.instance = result.instance;
@@ -47394,7 +47393,9 @@ var require_helpers = __commonJS({
       this.message = msg;
       this.schema = schema2;
       Error.call(this, msg);
-      Error.captureStackTrace(this, SchemaError2);
+      if (typeof Error.captureStackTrace === "function") {
+        Error.captureStackTrace(this, SchemaError2);
+      }
     };
     SchemaError.prototype = Object.create(
       Error.prototype,
@@ -47418,12 +47419,12 @@ var require_helpers = __commonJS({
       this.schemas = schemas;
     };
     SchemaContext.prototype.resolve = function resolve6(target) {
-      return uri.resolve(this.base, target);
+      return (() => resolveUrl(this.base, target))();
     };
     SchemaContext.prototype.makeChild = function makeChild(schema2, propertyName) {
       var path13 = propertyName === void 0 ? this.path : this.path.concat([propertyName]);
       var id = schema2.$id || schema2.id;
-      var base = uri.resolve(this.base, id || "");
+      let base = (() => resolveUrl(this.base, id || ""))();
       var ctx = new SchemaContext(schema2, this.options, path13, base, Object.create(this.schemas));
       if (id && !ctx.schemas[base]) {
         ctx.schemas[base] = schema2;
@@ -47617,6 +47618,14 @@ var require_helpers = __commonJS({
     exports2.isSchema = function isSchema(val) {
       return typeof val === "object" && val || typeof val === "boolean";
     };
+    var resolveUrl = exports2.resolveUrl = function resolveUrl2(from, to) {
+      const resolvedUrl = new URL(to, new URL(from, "resolve://"));
+      if (resolvedUrl.protocol === "resolve:") {
+        const { pathname, search, hash: hash2 } = resolvedUrl;
+        return pathname + search + hash2;
+      }
+      return resolvedUrl.toString();
+    };
   }
 });
 
@@ -48292,7 +48301,6 @@ var require_attribute = __commonJS({
 var require_scan = __commonJS({
   "node_modules/jsonschema/lib/scan.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var helpers = require_helpers();
     module2.exports.SchemaScanResult = SchemaScanResult;
     function SchemaScanResult(found, ref) {
@@ -48303,12 +48311,13 @@ var require_scan = __commonJS({
       function scanSchema(baseuri, schema3) {
         if (!schema3 || typeof schema3 != "object") return;
         if (schema3.$ref) {
-          var resolvedUri = urilib.resolve(baseuri, schema3.$ref);
+          let resolvedUri = helpers.resolveUrl(baseuri, schema3.$ref);
           ref[resolvedUri] = ref[resolvedUri] ? ref[resolvedUri] + 1 : 0;
           return;
         }
         var id = schema3.$id || schema3.id;
-        var ourBase = id ? urilib.resolve(baseuri, id) : baseuri;
+        let resolvedBase = helpers.resolveUrl(baseuri, id);
+        var ourBase = id ? resolvedBase : baseuri;
         if (ourBase) {
           if (ourBase.indexOf("#") < 0) ourBase += "#";
           if (found[ourBase]) {
@@ -48360,7 +48369,6 @@ var require_scan = __commonJS({
 var require_validator = __commonJS({
   "node_modules/jsonschema/lib/validator.js"(exports2, module2) {
     "use strict";
-    var urilib = require("url");
     var attribute = require_attribute();
     var helpers = require_helpers();
     var scanSchema = require_scan().scan;
@@ -48425,7 +48433,7 @@ var require_validator = __commonJS({
         options = {};
       }
       var id = schema2.$id || schema2.id;
-      var base = urilib.resolve(options.base || anonymousBase, id || "");
+      let base = helpers.resolveUrl(options.base, id || "");
       if (!ctx) {
         ctx = new SchemaContext(schema2, options, [], base, Object.create(this.schemas));
         if (!ctx.schemas[base]) {
@@ -48520,8 +48528,8 @@ var require_validator = __commonJS({
       if (ctx.schemas[switchSchema]) {
         return { subschema: ctx.schemas[switchSchema], switchSchema };
       }
-      var parsed = urilib.parse(switchSchema);
-      var fragment = parsed && parsed.hash;
+      let parsed = new URL(switchSchema, "thismessage::/");
+      let fragment = parsed.hash;
       var document2 = fragment && fragment.length && switchSchema.substr(0, switchSchema.length - fragment.length);
       if (!document2 || !ctx.schemas[document2]) {
         throw new SchemaError("no such schema <" + switchSchema + ">", schema2);
@@ -100155,6 +100163,11 @@ var require_follow_redirects = __commonJS({
     } catch (error3) {
       useNativeURL = error3.code === "ERR_INVALID_URL";
     }
+    var sensitiveHeaders = [
+      "Authorization",
+      "Proxy-Authorization",
+      "Cookie"
+    ];
     var preservedUrlFields = [
       "auth",
       "host",
@@ -100219,6 +100232,7 @@ var require_follow_redirects = __commonJS({
           self2.emit("error", cause instanceof RedirectionError ? cause : new RedirectionError({ cause }));
         }
       };
+      this._headerFilter = new RegExp("^(?:" + sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join("|") + ")$", "i");
       this._performRequest();
     }
     RedirectableRequest.prototype = Object.create(Writable.prototype);
@@ -100356,6 +100370,9 @@ var require_follow_redirects = __commonJS({
       if (!options.headers) {
         options.headers = {};
       }
+      if (!isArray(options.sensitiveHeaders)) {
+        options.sensitiveHeaders = [];
+      }
       if (options.host) {
         if (!options.hostname) {
           options.hostname = options.host;
@@ -100461,7 +100478,7 @@ var require_follow_redirects = __commonJS({
       this._isRedirect = true;
       spreadUrlObject(redirectUrl, this._options);
       if (redirectUrl.protocol !== currentUrlParts.protocol && redirectUrl.protocol !== "https:" || redirectUrl.host !== currentHost && !isSubdomain(redirectUrl.host, currentHost)) {
-        removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
+        removeMatchingHeaders(this._headerFilter, this._options.headers);
       }
       if (isFunction(beforeRedirect)) {
         var responseDetails = {
@@ -100610,6 +100627,9 @@ var require_follow_redirects = __commonJS({
       var dot = subdomain.length - domain.length - 1;
       return dot > 0 && subdomain[dot] === "." && subdomain.endsWith(domain);
     }
+    function isArray(value) {
+      return value instanceof Array;
+    }
     function isString2(value) {
       return typeof value === "string" || value instanceof String;
     }
@@ -100622,6 +100642,9 @@ var require_follow_redirects = __commonJS({
     function isURL(value) {
       return URL2 && value instanceof URL2;
     }
+    function escapeRegex(regex) {
+      return regex.replace(/[\]\\/()*+?.$]/g, "\\$&");
+    }
     module2.exports = wrap({ http, https: https2 });
     module2.exports.wrap = wrap;
   }
@@ -106249,6 +106272,7 @@ var ExhaustivityCheckingError = class extends Error {
     super("Internal error: exhaustivity checking failure");
     this.expectedExhaustiveValue = expectedExhaustiveValue;
   }
+  expectedExhaustiveValue;
 };
 function assertNever(value) {
   throw new ExhaustivityCheckingError(value);
@@ -106453,7 +106477,7 @@ function getDiffRangesJsonFilePath() {
   return path2.join(getTemporaryDirectory(), PR_DIFF_RANGE_JSON_FILENAME);
 }
 function getActionVersion() {
-  return "4.35.2";
+  return "4.35.3";
 }
 function getWorkflowEventName() {
   return getRequiredEnvParam("GITHUB_EVENT_NAME");
@@ -106534,6 +106558,11 @@ var CommandInvocationError = class extends Error {
     this.stderr = stderr;
     this.stdout = stdout;
   }
+  cmd;
+  args;
+  exitCode;
+  stderr;
+  stdout;
 };
 function ensureEndsInPeriod(text) {
   return text[text.length - 1] === "." ? text : `${text}.`;
@@ -106681,8 +106710,11 @@ var githubUtils = __toESM(require_utils5());
 var import_light = __toESM(require_light(), 1);
 init_dist_src();
 var VERSION7 = "0.0.0-development";
+function isRequestError(error3) {
+  return error3.request !== void 0;
+}
 async function errorRequest(state, octokit, error3, options) {
-  if (!error3.request || !error3.request.request) {
+  if (!isRequestError(error3) || !error3?.request.request) {
     throw error3;
   }
   if (error3.status >= 400 && !state.doNotRetry.includes(error3.status)) {
@@ -106695,8 +106727,8 @@ async function errorRequest(state, octokit, error3, options) {
 async function wrapRequest(state, octokit, request2, options) {
   const limiter = new import_light.default();
   limiter.on("failed", function(error3, info6) {
-    const maxRetries = ~~error3.request.request.retries;
-    const after = ~~error3.request.request.retryAfter;
+    const maxRetries = ~~error3.request.request?.retries;
+    const after = ~~error3.request.request?.retryAfter;
     options.request.retryCount = info6.retryCount + 1;
     if (maxRetries > info6.retryCount) {
       return after * state.retryAfterBaseValue;
@@ -106708,7 +106740,7 @@ async function wrapRequest(state, octokit, request2, options) {
   );
 }
 async function requestWithGraphqlErrorHandling(state, octokit, request2, options) {
-  const response = await request2(request2, options);
+  const response = await request2(options);
   if (response.data && response.data.errors && response.data.errors.length > 0 && /Something went wrong while executing your query/.test(
     response.data.errors[0].message
   )) {
@@ -106730,11 +106762,7 @@ function retry(octokit, octokitOptions) {
     },
     octokitOptions.retry
   );
-  if (state.enabled) {
-    octokit.hook.error("request", errorRequest.bind(null, state, octokit));
-    octokit.hook.wrap("request", wrapRequest.bind(null, state, octokit));
-  }
-  return {
+  const retryPlugin = {
     retry: {
       retryRequest: (error3, retries, retryAfter) => {
         error3.request.request = Object.assign({}, error3.request.request, {
@@ -106745,6 +106773,11 @@ function retry(octokit, octokitOptions) {
       }
     }
   };
+  if (state.enabled) {
+    octokit.hook.error("request", errorRequest.bind(null, state, retryPlugin));
+    octokit.hook.wrap("request", wrapRequest.bind(null, state, retryPlugin));
+  }
+  return retryPlugin;
 }
 retry.VERSION = VERSION7;
 
@@ -106925,8 +106958,8 @@ var path5 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.25.1";
-var cliVersion = "2.25.1";
+var bundleVersion = "codeql-bundle-v2.25.2";
+var cliVersion = "2.25.2";
 
 // src/overlay/index.ts
 var fs4 = __toESM(require("fs"));
@@ -107485,6 +107518,7 @@ var OfflineFeatures = class {
   constructor(logger) {
     this.logger = logger;
   }
+  logger;
   async getDefaultCliVersion(_variant) {
     return {
       cliVersion,
@@ -107633,6 +107667,9 @@ var GitHubFeatureFlags = class {
     this.logger = logger;
     this.hasAccessedRemoteFeatureFlags = false;
   }
+  repositoryNwo;
+  featureFlagsFile;
+  logger;
   cachedApiResponse;
   // We cache whether the feature flags were accessed or not in order to accurately report whether flags were
   // incorrectly configured vs. inaccessible in our telemetry.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "4.35.2",
+  "version": "4.35.3",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
@@ -29,14 +29,14 @@
     "@actions/http-client": "^3.0.0",
     "@actions/io": "^2.0.0",
     "@actions/tool-cache": "^3.0.1",
-    "@octokit/plugin-retry": "^8.0.0",
+    "@octokit/plugin-retry": "^8.1.0",
     "archiver": "^7.0.1",
     "fast-deep-equal": "^3.1.3",
-    "follow-redirects": "^1.15.11",
+    "follow-redirects": "^1.16.0",
     "get-folder-size": "^5.0.0",
     "https-proxy-agent": "^7.0.6",
     "js-yaml": "^4.1.1",
-    "jsonschema": "1.4.1",
+    "jsonschema": "1.5.0",
     "long": "^5.3.2",
     "node-forge": "^1.4.0",
     "semver": "^7.7.4",
@@ -44,7 +44,7 @@
   },
   "devDependencies": {
     "@ava/typescript": "6.0.0",
-    "@eslint/compat": "^2.0.3",
+    "@eslint/compat": "^2.0.4",
     "@microsoft/eslint-formatter-sarif": "^3.1.0",
     "@octokit/types": "^16.0.0",
     "@types/archiver": "^7.0.0",
@@ -54,9 +54,9 @@
     "@types/node-forge": "^1.3.14",
     "@types/sarif": "^2.1.7",
     "@types/semver": "^7.7.1",
-    "@types/sinon": "^21.0.0",
+    "@types/sinon": "^21.0.1",
     "ava": "^7.0.0",
-    "esbuild": "^0.27.4",
+    "esbuild": "^0.28.0",
     "eslint": "^9.39.2",
     "eslint-import-resolver-typescript": "^3.8.7",
     "eslint-plugin-github": "^6.0.0",
@@ -65,7 +65,7 @@
     "eslint-plugin-no-async-foreach": "^0.1.1",
     "glob": "^11.1.0",
     "globals": "^17.4.0",
-    "nock": "^14.0.11",
+    "nock": "^14.0.12",
     "sinon": "^21.0.3",
     "typescript": "^6.0.2",
     "typescript-eslint": "^8.58.0"

pr-checks/checks/rubocop-multi-language.yml

@@ -5,7 +5,7 @@ versions:
   - default
 steps:
   - name: Set up Ruby
-    uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
+    uses: ruby/setup-ruby@4c56a21280b36d862b5fc31348f463d60bdc55d5 # v1.301.0
     with:
       ruby-version: 2.6
   - name: Install Code Scanning integration

src/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.25.1",
-  "cliVersion": "2.25.1",
-  "priorBundleVersion": "codeql-bundle-v2.24.3",
-  "priorCliVersion": "2.24.3"
+  "bundleVersion": "codeql-bundle-v2.25.2",
+  "cliVersion": "2.25.2",
+  "priorBundleVersion": "codeql-bundle-v2.25.1",
+  "priorCliVersion": "2.25.1"
 }