msauth: isolate macOS user token cache - #2413
Closed
thomasaarholt wants to merge 36 commits into
Closed
Conversation
Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5.2.0 to 5.3.0. - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@v5.2.0...v5.3.0) --- updated-dependencies: - dependency-name: actions/setup-dotnet dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
According to actions/setup-dotnet#739, this is required if we want to upgrade to `actions/setup-dotnet@5.3.0`. Suggested by Marc Becker. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
The authorization code flow only handled the default 'query' response mode, where the loopback browser reads the response from the request query string and returns a URI for the client to parse. The 'fragment' and 'form_post' modes deliver the response over channels a URI cannot represent - the fragment is never transmitted to the server, and form_post arrives as a urlencoded POST body - so hosts that mandate those modes could not be used. Have the browser return the parsed response parameters regardless of transport and tell it which mode to expect. The system browser reads the POST body for form_post, and for fragment serves a small page that re-submits the parameters as a form POST to the loopback redirect - keeping the authorization code out of the URL, browser history, and server logs. The client sends 'response_mode' only when it is not the default, so existing query-mode requests are unchanged. Assisted-by: Claude Opus 4.8 Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
Now that the OAuth client can request non-query response modes, expose the choice to generic host configurations through a new optional setting (credential.<host>.oauthResponseMode, or the GCM_OAUTH_RESPONSE_MODE environment variable). The built-in providers target known hosts that use 'query', so the generic provider is the only place an arbitrary host's response mode needs to be configurable. The setting is optional and defaults to 'query', so existing configurations are unaffected. An unrecognised value is traced and falls back to the default rather than failing configuration outright. Assisted-by: Claude Opus 4.8 Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
Update our MSAL library packages to the current latest release, which is 4.82.2 at time of writing. Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
The "auto" Microsoft authentication flow type was resolved lazily, deep inside the interactive-token switch via `goto case`, after the MSAL public client application — and thus its redirect URI — had already been built. That entangled flow selection with app creation and made the effective flow hard to follow in traces. Resolve the flow up front in GetFlowType() instead, and drop the Auto pseudo-value from the enum so the method always returns a concrete flow (embedded web view, system web view, or device code). The resolved flow is traced before authentication starts. Knowing the flow up front also lets us choose the redirect URI. Only the system web view needs a real loopback redirect URI registered with the application; the other paths work with MSAL's default native-client redirect URI — "https://login.microsoftonline.com/common/oauth2/nativeclient" on .NET Framework, "http://localhost" on .NET Core. Forward the caller-provided redirect URI only when the system web view might be used and let MSAL supply the default otherwise via WithDefaultRedirectUri(). The Microsoft authentication diagnostic no longer calls GetFlowType() (which now needs a redirect URI and eagerly resolves auto); it reports the raw credential.msAuthFlow override instead. The now-unused IPublicClientApplication argument is dropped from the system web view capability checks. Assisted-by: Claude Opus 4.8 Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
…stem#2352) Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5.2.0 to 5.3.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-dotnet/releases">actions/setup-dotnet's releases</a>.</em></p> <blockquote> <h2>v5.3.0</h2> <h2>What's Changed</h2> <h3>Enhancements</h3> <ul> <li>Add dotnet-version: latest support with dotnet-channel input by <a href="https://github.com/mahabaleshwars"><code>@mahabaleshwars</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/730">actions/setup-dotnet#730</a></li> <li>Support global.json's rollForward latest* variants by <a href="https://github.com/js6pak"><code>@js6pak</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/538">actions/setup-dotnet#538</a></li> <li>Improve version resolution by <a href="https://github.com/akoeplinger"><code>@akoeplinger</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/560">actions/setup-dotnet#560</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Upgrade @actions/* and fast-xml-parser dependencies by <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/728">actions/setup-dotnet#728</a></li> <li>Update install scripts to v2026.05.19 (preserve archive links) by <a href="https://github.com/MichaelSimons"><code>@MichaelSimons</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/736">actions/setup-dotnet#736</a></li> <li>Add rollForward note in README, improve proxy health check in e2e tests and bump version to v5.3.0 by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/738">actions/setup-dotnet#738</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>Update Test Proxy job by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/703">actions/setup-dotnet#703</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/728">actions/setup-dotnet#728</a></li> <li><a href="https://github.com/akoeplinger"><code>@akoeplinger</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/560">actions/setup-dotnet#560</a></li> <li><a href="https://github.com/MichaelSimons"><code>@MichaelSimons</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/736">actions/setup-dotnet#736</a></li> <li><a href="https://github.com/js6pak"><code>@js6pak</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/538">actions/setup-dotnet#538</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-dotnet/compare/v5...v5.3.0">https://github.com/actions/setup-dotnet/compare/v5...v5.3.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-dotnet/commit/9a946fdbd5fb07b82b2f5a4466058b876ab72bb2"><code>9a946fd</code></a> Add rollForward note in README, improve proxy health check in e2e tests and b...</li> <li><a href="https://github.com/actions/setup-dotnet/commit/98af08bf649b02f9e94783278906d34780362f6f"><code>98af08b</code></a> Support global.json's rollForward latest* variants (<a href="https://redirect.github.com/actions/setup-dotnet/issues/538">#538</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/84042723628274fd730a70726fbf57ef89e586de"><code>8404272</code></a> Update install scripts to v2026.05.19 (<a href="https://redirect.github.com/actions/setup-dotnet/issues/736">#736</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/f1970f5ca30a3ba974274132e05c4bb012faac74"><code>f1970f5</code></a> Don't download releases-index.json to resolve major version (<a href="https://redirect.github.com/actions/setup-dotnet/issues/560">#560</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/af9211b1364d382bc386cd82c6386875ad2ad796"><code>af9211b</code></a> Add dotnet-version: latest support with dotnet-channel input (<a href="https://redirect.github.com/actions/setup-dotnet/issues/730">#730</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/df991aeaf2a76aae144b0b70ce23e455c66f061e"><code>df991ae</code></a> chore: bump @actions/* and fast-xml-parser dependencies (<a href="https://redirect.github.com/actions/setup-dotnet/issues/728">#728</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/a66eefa2bf2572fc311ea6ff65a7b6ecc4df96a6"><code>a66eefa</code></a> CI: remove manual PowerShell install from test-proxy job (e2e-tests.yml) (<a href="https://redirect.github.com/actions/setup-dotnet/issues/703">#703</a>)</li> <li>See full diff in <a href="https://github.com/actions/setup-dotnet/compare/v5.2.0...v5.3.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> <h2>v6.0.2</h2> <h2>What's Changed</h2> <ul> <li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.1...v6.0.2">https://github.com/actions/checkout/compare/v6.0.1...v6.0.2</a></p> <h2>v6.0.1</h2> <h2>What's Changed</h2> <ul> <li>Update all references from v5 and v4 to v6 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> <li>Clarify v6 README by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.1">https://github.com/actions/checkout/compare/v6...v6.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/v6...v7">compare view</a></li> </ul> </details> <br />
msal: update to latest MSAL 4.82.2
msauth: resolve auth flow before selecting redirect URI
Support non-query OAuth response modes (`fragment`, `form_post`)
Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5.3.0 to 5.4.0. - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@v5.3.0...v5.4.0) --- updated-dependencies: - dependency-name: actions/setup-dotnet dependency-version: 5.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…stem#2361) Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5.3.0 to 5.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-dotnet/releases">actions/setup-dotnet's releases</a>.</em></p> <blockquote> <h2>v5.4.0</h2> <h2>What's Changed</h2> <h3>Enhancements</h3> <ul> <li>Improve global.json SDK version validation for rollForward by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/742">actions/setup-dotnet#742</a></li> <li>Pin actions to commit SHAs in workflows by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/744">actions/setup-dotnet#744</a></li> <li>Expand the CSC problem matcher to light up more errors on GitHub. by <a href="https://github.com/StephenCleary"><code>@StephenCleary</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/717">actions/setup-dotnet#717</a></li> </ul> <h3>Documentation</h3> <ul> <li>Docs(action): Explicitly mark all optional inputs with required: false by <a href="https://github.com/kranthipoturaju"><code>@kranthipoturaju</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/737">actions/setup-dotnet#737</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>Fix global.json creation command by <a href="https://github.com/michal2612"><code>@michal2612</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/694">actions/setup-dotnet#694</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Upgrade <code>@actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/746">actions/setup-dotnet#746</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jasongin"><code>@jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/746">actions/setup-dotnet#746</a></li> <li><a href="https://github.com/michal2612"><code>@michal2612</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/694">actions/setup-dotnet#694</a></li> <li><a href="https://github.com/kranthipoturaju"><code>@kranthipoturaju</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/737">actions/setup-dotnet#737</a></li> <li><a href="https://github.com/StephenCleary"><code>@StephenCleary</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/717">actions/setup-dotnet#717</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-dotnet/compare/v5...v5.4.0">https://github.com/actions/setup-dotnet/compare/v5...v5.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-dotnet/commit/26b0ec14cb23fa6904739307f278c14f94c95bf1"><code>26b0ec1</code></a> Expand the CSC problem matcher to light up more errors on GitHub. (<a href="https://redirect.github.com/actions/setup-dotnet/issues/717">#717</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/da5e5482f2d0700168cff080da45b50da8b60f0e"><code>da5e548</code></a> docs(action): explicitly mark all optional inputs with required: false (<a href="https://redirect.github.com/actions/setup-dotnet/issues/737">#737</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/9bd3b44355ba7c500f3d2e029636c6d29ac5caab"><code>9bd3b44</code></a> Improve readability of global.json creation command (<a href="https://redirect.github.com/actions/setup-dotnet/issues/694">#694</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/4406a635cd2be9c92689ea22b2f74ea57297088c"><code>4406a63</code></a> Bump <code>@actions/cache</code> to 5.1.0, log cache write denied (<a href="https://redirect.github.com/actions/setup-dotnet/issues/746">#746</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/dc3262dda80e97f1c7865b3b122e99240e30b738"><code>dc3262d</code></a> pin actions to commit SHAs in workflows (<a href="https://redirect.github.com/actions/setup-dotnet/issues/744">#744</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/95a3f8b067437dc9b2027a437f5dc3b4569ddd49"><code>95a3f8b</code></a> Validate global.json SDK version before rollForward optimization (<a href="https://redirect.github.com/actions/setup-dotnet/issues/742">#742</a>)</li> <li>See full diff in <a href="https://github.com/actions/setup-dotnet/compare/v5.3.0...v5.4.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
The link to the Windows Credential Manager docs was broken - it used to point at: https://support.microsoft.com/en-us/windows/accessing-credential-manager-1b5c916a-6a16-889f-8581-fc16e8165ac0 ..but this now resolves instead to: https://support.microsoft.com/en-US/Windows/Security/credential-manager-in-windows ..so let's use that URL directly. Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
The link to the Windows Credential Manager docs was broken - it used to point at: https://support.microsoft.com/en-us/windows/accessing-credential-manager-1b5c916a-6a16-889f-8581-fc16e8165ac0 ..but this now resolves instead to: https://support.microsoft.com/en-US/Windows/Security/credential-manager-in-windows ..so let's use that URL directly.
We have been using an inappropriate key for our Debian package signing; let's use a more appropriate one. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
GCM launches the system browser for interactive OAuth by handing the authorization URL to the OS "shell execute" handler. On macOS that is /usr/bin/open, which validates the URL and, on finding any character that is not legal in a fully percent-encoded URL, re-encodes the whole query string. That step double-escapes parameters we had already encoded -- redirect_uri=http%3A%2F%2F... becomes redirect_uri=http%253A%252F%252F... -- and the authorization server rejects the redirect. Windows ShellExecuteEx forwards the string verbatim, so only macOS is affected. The trigger was a raw space in the query. Uri.ToString() is a display form that unescapes %20 back to a literal space (while leaving %2F alone), so building the launch string that way reintroduced spaces, most easily via the space-delimited scope parameter. This surfaced after MSAL began encoding spaces[1] as %20 rather than +; a literal + is left untouched by ToString(), which had masked the problem. Uri.AbsoluteUri keeps the query fully percent-encoded, so %20 stays %20 and macOS open accepts the URL unchanged. [1]: AzureAD/microsoft-authentication-library-for-dotnet#5128 Assisted-by: Claude Opus 4.8 Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
With the ESRP-signed packages, there is a slightly different process. Most notably, the PGP key to verify against has changed and needs to be obtained from elsewhere. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Most users will want to stick to Debian packages. Those who have to resort to the archive will want to download them from the correct location. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
With ESRP-based signing applied even to the Debian packages, we need to use the correct PGP key. This PR is a companion of microsoft/git#946.
browser: open AbsoluteUri to avoid double-escaping
Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
Explicitly use Central Feed Services (CFS) feeds for NuGet packages by replacing the normal, nuget.org, config file in the repo root at the start of the build jobs. This is required for compliance, and the auto-injected task that is supposed to do this automatically is flakey (it doesn't run sometimes?!) so do this manually. Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4 to 4.37.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4...v4.37.4) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) from 23.0.0 to 24.2.0. - [Release notes](https://github.com/davidanson/markdownlint-cli2-action/releases) - [Commits](DavidAnson/markdownlint-cli2-action@ce4853d...21c1be1) --- updated-dependencies: - dependency-name: DavidAnson/markdownlint-cli2-action dependency-version: 24.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
The pinned lychee-action downloads and executes a separate binary without verifying its digest (please find the relevant code here: https://github.com/lycheeverse/lychee-action/blob/e7477775783e/action.yml#L64-L117). But https://github.com/lycheeverse/lychee/releases/tag/lychee-v0.24.2, i.e. that binary's release, is mutable. This release-artifact gap is a relatively close analogue to the what https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 describes, and which has become known as "the XZ Utils backdoor". Let's close this gap at least as much as we can from our side, and hope that attacks like the now-finally-fixed Actions cache poisining (see https://github.com/AdnaneKhan/ActionsCacheBlasting/), i.e. attacks that work even in read-only mode as long as they are run on the repository's `main` branch, don't come back to bite us. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Bumps [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action) from 2.8.0 to 2.9.0. - [Release notes](https://github.com/lycheeverse/lychee-action/releases) - [Commits](lycheeverse/lychee-action@8646ba3...e747777) --- updated-dependencies: - dependency-name: lycheeverse/lychee-action dependency-version: 2.9.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…m#2399) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4 to 4.37.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.37.4</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>v4.37.3</h2> <p>No user facing changes.</p> <h2>v4.37.2</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>v4.37.1</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>v4.37.0</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>v4.36.3</h2> <p>No user facing changes.</p> <h2>v4.36.2</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>v4.36.1</h2> <p>No user facing changes.</p> <h2>v4.36.0</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>v4.35.5</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> <li>For performance and accuracy reasons, <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. <a href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li> <li>If multiple inputs are provided for the GitHub-internal <code>analysis-kinds</code> input, only <code>code-scanning</code> will be enabled. The <code>analysis-kinds</code> input is experimental, for GitHub-internal use only, and may change without notice at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li> <li>Added an experimental change which, when running a Code Scanning analysis for a PR with <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. <a href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li> </ul> <h2>v4.35.4</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li> </ul> <h2>v4.35.3</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li> <li>Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. <a href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li> <li>Best-effort connection tests for private registries now use <code>GET</code> requests instead of <code>HEAD</code> for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. <a href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li> <li>Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. <a href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/18420e3271f74589575af831a523c833acda327f"><code>18420e3</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4043">#4043</a> from github/mbg/ts/changelog</li> <li><a href="https://github.com/github/codeql-action/commit/7e8d8970f03ec5a78ab372fc0778e8e4194111a5"><code>7e8d897</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4046">#4046</a> from github/mbg/repo-prop/code-quality</li> <li><a href="https://github.com/github/codeql-action/commit/2d4c474c2ca5ea2965b9e53fabb7b67b0100016c"><code>2d4c474</code></a> Log <code>!analysisKindSupported</code> case</li> <li><a href="https://github.com/github/codeql-action/commit/98c05a17d327d7c4055fca83114434ab56baacf6"><code>98c05a1</code></a> Fix argument validation in <code>rollback-changelog.ts</code></li> <li><a href="https://github.com/github/codeql-action/commit/8289a49271cbb335d374e7e2e7a50c1576be0afe"><code>8289a49</code></a> Ignore repository property for unsupported analysis kinds</li> <li><a href="https://github.com/github/codeql-action/commit/2a8731cc0636c612147a349ccc88166bd482a9e1"><code>2a8731c</code></a> Move <code>config-file</code> computation after determining the <code>analysisKinds</code></li> <li><a href="https://github.com/github/codeql-action/commit/3434fbbc53af0fe47685ef3897703b39ef77b5cb"><code>3434fbb</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4044">#4044</a> from github/mbg/ff/promote-toolcache</li> <li><a href="https://github.com/github/codeql-action/commit/3013ac07bdb913cf5b7a1a8a63fe51422ce5a91e"><code>3013ac0</code></a> Promote <code>AllowToolcacheInput</code> feature</li> <li><a href="https://github.com/github/codeql-action/commit/74b15aa2c6c649153cb2e5f7a9d3bd2f0c8f82d1"><code>74b15aa</code></a> Install JS deps if needed in <code>post-release-mergeback</code> workflow</li> <li><a href="https://github.com/github/codeql-action/commit/f00f809405a0571f02079a483378ba1102bd3d1e"><code>f00f809</code></a> Fix checking keys rather than values</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/v4...v4.37.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
…24.2.0 (git-ecosystem#2400) Bumps [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) from 23.0.0 to 24.2.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/21c1be1b93ad9ed58fa840aacc3f279cde2a72ff"><code>21c1be1</code></a> Update to version 24.2.0.</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/cb5282d62ceb01cf9ed9f24c23675d95a1aa0b06"><code>cb5282d</code></a> Freshen generated package-lock.json file, freshen generated index.js file.</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/d36517c02f0ca87b17baeb4fabee83cd48490f38"><code>d36517c</code></a> Add eslint-package-json/all to lint script, address new issues.</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/57b7f618e76408c4f7861015e5f0e0ac07985c18"><code>57b7f61</code></a> Refactor eslint.config.mjs to use defineConfig, change eslint-plugin-n from "...</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/fe75d07fdb84c7ad9ff784bd5b63745d172c6ec6"><code>fe75d07</code></a> Address new lint error from previous commit, freshen generated index.js file.</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/cea0e19b34dbe39c35833f585399255cb1b5ee8d"><code>cea0e19</code></a> Bump eslint-plugin-unicorn from 71.1.0 to 72.0.0</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/5137af3b1518ab092d3aa1c946881297643df019"><code>5137af3</code></a> Freshen generated index.js file.</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/ab8971b4890335d9e552a310d43bbaa1e68c52cd"><code>ab8971b</code></a> Bump markdownlint-cli2 from 0.23.1 to 0.23.2</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/92a0fc4bfcca7cda90e73e14c0c17568b057574e"><code>92a0fc4</code></a> Bump actions/setup-node from 6 to 7</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/03ca1e440e033e6cff1e838d3fb4749dea9d9284"><code>03ca1e4</code></a> Bump eslint from 10.6.0 to 10.7.0</li> <li>Additional commits viewable in <a href="https://github.com/davidanson/markdownlint-cli2-action/compare/ce4853d43830c74c1753b39f3cf40f71c2031eb9...21c1be1b93ad9ed58fa840aacc3f279cde2a72ff">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
…ecosystem#2374) Bumps [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action) from 2.8.0 to 2.9.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lycheeverse/lychee-action/releases">lycheeverse/lychee-action's releases</a>.</em></p> <blockquote> <h2>v2.9.0</h2> <h2>Summary</h2> <p>This release updates the default lychee version from <code>v0.23.0</code> to <code>v0.24.2</code>.</p> <p>The main reason for this release is compatibility with the new lychee <code>0.24.x</code> release artifacts. Starting with lychee <code>v0.24.0</code>, the archive layout changed, and the <code>lychee</code> binary may now be packaged inside a subdirectory. <code>lychee-action</code> now detects that layout automatically, so users can upgrade without changing their workflows.</p> <p>If you use:</p> <pre lang="yaml"><code>uses: lycheeverse/lychee-action@v2 </code></pre> <p>you will get the new version once the floating <code>v2</code> tag has been updated. If you pin exact versions, update to:</p> <pre lang="yaml"><code>uses: lycheeverse/lychee-action@v2.9.0 </code></pre> <h2>What’s new from lychee <code>v0.24.x</code></h2> <h3>Better diagnostics</h3> <p>lychee now reports line and column numbers for detected links. This makes broken link reports easier to act on, especially in larger documentation sites or generated reports.</p> <h3>Text fragment checking</h3> <p>lychee can now check URL text fragments, such as links containing <code>#:~:text=...</code>. This helps catch links that point to a valid page but no longer points to the intended highlighted text.</p> <h3>Sitemap support</h3> <p>lychee can now read <code>sitemap.xml</code> inputs. This is useful for checking published websites or generated documentation sites where the sitemap is the easiest source of URLs to validate.</p> <h3>JUnit output</h3> <p>lychee now supports JUnit output. This makes it easier to integrate link checking results with CI systems and test reporting tools that understand JUnit XML.</p> <h3>Redirect and remap visibility</h3> <p>lychee can now show redirects and remaps more clearly. This helps explain why a URL was checked as a different final URL and makes debugging link-checking behavior easier.</p> <h3>Multiple config files</h3> <p>lychee now supports multiple configuration files and expanded config handling. This is useful for repositories that split documentation, website, or package-specific link-checking settings.</p> <h3>Timeout handling</h3> <p>lychee can now accept timeouts explicitly. This gives users more control over how strict their link checks should be for flaky or slow endpoints.</p> <h2>Fixes and reliability improvements</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lycheeverse/lychee-action/commit/e7477775783ea5526144ba13e8db5eec57747ce8"><code>e747777</code></a> Bump actions/cache from 5 to 6 (<a href="https://redirect.github.com/lycheeverse/lychee-action/issues/340">#340</a>)</li> <li><a href="https://github.com/lycheeverse/lychee-action/commit/39066c6d1f0de280863a3760160617e188b607ad"><code>39066c6</code></a> Bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/lycheeverse/lychee-action/issues/339">#339</a>)</li> <li><a href="https://github.com/lycheeverse/lychee-action/commit/6da1d14f3a43098a294b7696d93d938aa8d20fc0"><code>6da1d14</code></a> Install into $RUNNER_TEMP instead of $HOME (<a href="https://redirect.github.com/lycheeverse/lychee-action/issues/338">#338</a>)</li> <li><a href="https://github.com/lycheeverse/lychee-action/commit/a63497c75a5435b151e800818e2286764b6e119a"><code>a63497c</code></a> fixes <a href="https://redirect.github.com/lycheeverse/lychee-action/issues/322">#322</a> check for null (<a href="https://redirect.github.com/lycheeverse/lychee-action/issues/336">#336</a>)</li> <li><a href="https://github.com/lycheeverse/lychee-action/commit/b40e218fdac9481d3c13098d4e1ee56f3b589356"><code>b40e218</code></a> [create-pull-request] automated change</li> <li><a href="https://github.com/lycheeverse/lychee-action/commit/faea714062690f6c2e6f7f388469ec4fa6d9c4e1"><code>faea714</code></a> bump default to 0.24.1 and auto-detect lychee bin in subfolder (<a href="https://redirect.github.com/lycheeverse/lychee-action/issues/330">#330</a>)</li> <li>See full diff in <a href="https://github.com/lycheeverse/lychee-action/compare/8646ba30535128ac92d33dfc9133794bfdd9b411...e7477775783ea5526144ba13e8db5eec57747ce8">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days.
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.37.4 to 4.37.6. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.37.4...v4.37.6) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…system#2409) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.37.4 to 4.37.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.37.6</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>v4.37.5</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/5595ccaf912efad79be6eef63a5619ff05969be3"><code>5595cca</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4071">#4071</a> from github/update-v4.37.6-6a9359a1b</li> <li><a href="https://github.com/github/codeql-action/commit/ec9c75796a7f2cee5af0c5ffa0b81dc3bb58754b"><code>ec9c757</code></a> Add change note for PR 4070</li> <li><a href="https://github.com/github/codeql-action/commit/45c8742e17cbd668814137f95e605d925b8722a2"><code>45c8742</code></a> Update changelog for v4.37.6</li> <li><a href="https://github.com/github/codeql-action/commit/6a9359a1bd054c53cae7bb737bd8d796cfbf3014"><code>6a9359a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4070">#4070</a> from github/mbg/remote-address/change-file-default</li> <li><a href="https://github.com/github/codeql-action/commit/065cdc0394d424981db720df63ebc570e41b775f"><code>065cdc0</code></a> Change <code>DEFAULT_CONFIG_FILE_NAME</code></li> <li><a href="https://github.com/github/codeql-action/commit/f99dd5aeee9cf92e92d0c700cb0aa7afd7bbf431"><code>f99dd5a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4066">#4066</a> from github/dependabot/npm_and_yarn/js-yaml-5.2.2</li> <li><a href="https://github.com/github/codeql-action/commit/1804b211a343d69a6584d26fb3a68a8fe6ca39d4"><code>1804b21</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4068">#4068</a> from github/mergeback/v4.37.5-to-main-d1ba80a1</li> <li><a href="https://github.com/github/codeql-action/commit/3020a2f46286abb1704269b22ada83bd0e81c64f"><code>3020a2f</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/93c3a5a40b7affbf8ea6a480767ed0db8e8d3c5c"><code>93c3a5a</code></a> Update changelog and version after v4.37.5</li> <li><a href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a> from github/update-v4.37.5-1cd4d01d5</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/v4.37.4...v4.37.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
Use a GCM-owned Keychain item on macOS so other Microsoft developer tools cannot replace the shared cache item and discard GCM's access control entry. Preserve shared cache behavior on Windows and Linux. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
Hello @thomasaarholt! Thanks for you pull request here. Rather than just always opting out GCM on Mac from using the shared Microsoft developer tools MSAL cache, we would rather prefer to make this an option that users could configure, with the default still being 'true'. If we could figure out what was happening with the Keychain ACLs that is resulting in these prompts that would be the preferred option. Until then, disabling the cache integration via option is reasonable. Please see this PR that should hopefully provide you with the required option to avoid this issue on macOS: #2415 |
Author
|
Awesome! Thanks, I'll take a look at the PR! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The problem
On macOS, GCM shares the
Microsoft.Developer.IdentityServiceMSAL Keychain item with other Microsoft developer tools. When another tool recreates this item, its access-control list can lose GCM's entry, causing repeated Keychain password prompts even after selecting Always Allow.The solution
Use a GCM-owned Keychain item and cache file for the macOS user-token cache. This prevents other applications from changing GCM's Keychain permissions while retaining persistent authentication between GCM processes.
Windows and Linux continue using the shared Microsoft developer cache. macOS users may need to authenticate once after upgrading to populate the new cache.
Fixes #2079.
Testing
dotnet test src/shared/Core.Tests/Core.Tests.csproj --no-restore --nologodotnet build -c MacDebug --no-restore --nologo