Skip to content

Add test coverage for text functions#3570

Merged
robfrank merged 3 commits intomainfrom
imp/add-test-to-text-fuctions
Mar 3, 2026
Merged

Add test coverage for text functions#3570
robfrank merged 3 commits intomainfrom
imp/add-test-to-text-fuctions

Conversation

@robfrank
Copy link
Collaborator

@robfrank robfrank commented Mar 3, 2026

Summary

  • Add 49 new tests to OpenCypherTextFunctionsTest covering untested text.* functions (TextSnakeCase, TextUpperCamelCase, TextSlug, TextLevenshteinSimilarity, TextSorensenDiceSimilarity, TextRpad, TextRegexReplace, TextReplace) and edge cases for existing functions
  • Create new TextStatelessFunctionsTest with 50 tests covering all SQL-style text functions (ToUpper, ToLower, Trim, LTrim, RTrim, Left, Right, Substring, Split, Replace, CharLength, Normalize, Format) that had no test coverage

Test plan

  • All 133 tests pass (mvn test -Dtest="OpenCypherTextFunctionsTest,TextStatelessFunctionsTest")
  • Tests cover basic functionality, null handling, edge cases, and error conditions

🤖 Generated with Claude Code

Add 99 new tests across two files:
- OpenCypherTextFunctionsTest: tests for TextSnakeCase, TextUpperCamelCase,
  TextSlug, TextLevenshteinSimilarity, TextSorensenDiceSimilarity, TextRpad,
  TextRegexReplace, TextReplace, plus edge cases for existing functions
- TextStatelessFunctionsTest (new): tests for ToUpper, ToLower, Trim, LTrim,
  RTrim, Left, Right, Substring, Split, Replace, CharLength, Normalize, Format

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@gemini-code-assist
Copy link
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the robustness of the database engine's text manipulation capabilities by introducing a substantial number of new unit tests. The changes ensure that both OpenCypher-specific and general SQL-style text functions are thoroughly validated across various scenarios, including basic functionality, null handling, edge cases, and error conditions, thereby improving the overall reliability and correctness of these functions.

Highlights

  • Expanded OpenCypher Text Function Coverage: Added 49 new tests to OpenCypherTextFunctionsTest to cover previously untested functions such as TextSnakeCase, TextUpperCamelCase, TextSlug, TextLevenshteinSimilarity, TextSorensenDiceSimilarity, TextRpad, TextRegexReplace, and TextReplace, along with edge cases for existing functions.
  • New SQL-Style Text Function Test Suite: Created a new test file, TextStatelessFunctionsTest, containing 50 tests for SQL-style text functions including ToUpper, ToLower, Trim, LTrim, RTrim, Left, Right, Substring, Split, Replace, CharLength, Normalize, and Format, which previously lacked coverage.
  • Enhanced Edge Case Testing: Included additional edge case tests for various existing text functions like TextHammingDistance, TextByteCount, TextCharAt, TextCode, TextHexValue, TextFormat, TextCapitalizeAll, TextDecapitalizeAll, TextRandom, TextLpad, TextJaroWinklerDistance, and TextSplit to improve robustness.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog
  • engine/src/test/java/com/arcadedb/function/text/TextStatelessFunctionsTest.java
    • Added a new test file for SQL-style stateless text functions.
  • engine/src/test/java/com/arcadedb/query/opencypher/functions/OpenCypherTextFunctionsTest.java
    • Added tests for TextSnakeCase.
    • Added tests for TextUpperCamelCase.
    • Added tests for TextSlug.
    • Added tests for TextLevenshteinSimilarity.
    • Added tests for TextSorensenDiceSimilarity.
    • Added tests for TextRpad.
    • Added tests for TextRegexReplace.
    • Added tests for TextReplace.
    • Added additional edge case tests for various existing text functions.
Activity
  • The pull request was generated using Claude Code.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

@claude
Copy link

claude bot commented Mar 3, 2026

Code Review

Good addition of test coverage overall. The tests follow project conventions (AssertJ with assertThat, JUnit 5, final variables) and null handling is covered systematically. A few issues worth addressing.

Bug: FormatFunction tests exercise unintended behaviour

FormatFunction is a temporal formatting function — its signature is format(temporal[, pattern]) and passing a non-temporal value with a pattern throws CommandExecutionException (line 76 of FormatFunction.java).

The three tests in TextStatelessFunctionsTest pass a plain String ("hello"):

  • formatFunctionNoPattern: fn.execute(new Object[]{"hello"}, null)
  • formatFunctionNullPattern: fn.execute(new Object[]{"hello", null}, null)

These only pass accidentally: when no pattern is provided, the implementation falls back to args[0].toString() for any object (line 52 of FormatFunction.java). They are not testing the function's intended contract and could mislead future readers into thinking FormatFunction is a general string formatter.

Suggested fixes:

  1. Replace the string inputs with actual Cypher temporal objects (CypherDate, CypherLocalTime, etc.) to test the real use-case.
  2. Add a test verifying that a plain string with a pattern correctly throws CommandExecutionException.
  3. Add at least one test that verifies the function actually formats a temporal value with a pattern string.

Missing edge cases

TextRegexReplace – pattern length limit (ReDoS prevention)

The implementation rejects patterns longer than 500 characters, but there is no test for this boundary:

void textRegexReplacePatternTooLong() {
    final TextRegexReplace fn = new TextRegexReplace();
    final String longPattern = "a".repeat(501);
    assertThatThrownBy(() -> fn.execute(new Object[]{"test", longPattern, "x"}, null))
        .isInstanceOf(IllegalArgumentException.class);
}

TextRpad / TextLpad – maximum length guard

Both functions throw IllegalArgumentException above 10 MB. That limit is a security-relevant guard worth testing:

void textRpadExceedsMaxLength() {
    final TextRpad fn = new TextRpad();
    assertThatThrownBy(() -> fn.execute(new Object[]{"", 10_485_761, "x"}, null))
        .isInstanceOf(IllegalArgumentException.class);
}

Minor: surprising TextSnakeCase behaviour undocumented in test

assertThat(fn.execute(new Object[]{"HELLO_WORLD"}, null)).isEqualTo("h_e_l_l_o_w_o_r_l_d");

Each uppercase letter in "HELLO_WORLD" becomes its own underscore-prefixed token because the algorithm treats every uppercase letter as a word boundary. The result is correct per the implementation, but the expected string is non-obvious. A short comment would help future maintainers.

Minor: textRpadBasic no-truncation behaviour not explicit

assertThat(fn.execute(new Object[]{"test", 2, "0"}, null)).isEqualTo("test");

The implementation returns the original string unchanged when it is already longer than the target length (no truncation). A comment stating "no truncation when string length >= target" would make the intent clear.

Good things worth noting

  • Floating-point similarity comparisons correctly use isCloseTo(..., within(0.001)) rather than exact equality.
  • Null handling is tested consistently for all functions.
  • Unicode slug/normalize tests are appreciated.
  • The @SuppressWarnings("unchecked") annotations are placed appropriately for the cast from SplitFunction.
  • The test class is package-private (no public modifier) per modern JUnit 5 conventions.

Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request adds extensive test coverage for various text functions, which is a great improvement. The new tests cover a good range of scenarios, including edge cases. I've left a few comments with suggestions to improve the tests' maintainability by reducing code duplication. I also pointed out a specific test case for text.snakeCase that validates a counter-intuitive behavior, which may indicate an underlying implementation issue.

assertThat(fn.execute(new Object[]{"helloWorld"}, null)).isEqualTo("hello_world");
assertThat(fn.execute(new Object[]{"HelloWorld"}, null)).isEqualTo("hello_world");
assertThat(fn.execute(new Object[]{"hello-world"}, null)).isEqualTo("hello_world");
assertThat(fn.execute(new Object[]{"HELLO_WORLD"}, null)).isEqualTo("h_e_l_l_o_w_o_r_l_d");
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The asserted result h_e_l_l_o_w_o_r_l_d for the input HELLO_WORLD is highly counter-intuitive for a snakeCase function. The expected behavior would be to convert it to hello_world. The current test validates a behavior that is likely a bug in the TextSnakeCase implementation, where each uppercase letter is treated as a word separator even in an already underscore-separated string. I recommend changing the assertion to expect hello_world and adjusting the implementation if it fails.

Suggested change
assertThat(fn.execute(new Object[]{"HELLO_WORLD"}, null)).isEqualTo("h_e_l_l_o_w_o_r_l_d");
assertThat(fn.execute(new Object[]{"HELLO_WORLD"}, null)).isEqualTo("hello_world");

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The test documents the current implementation behavior. Changing the assertion to expect "hello_world" would make the test fail — the implementation hasn't changed. Whether this behavior is a bug is a valid question, but fixing TextSnakeCase's algorithm is out of scope for a test coverage PR. If it warrants a fix, it should be tracked separately.

* Unit tests for SQL-style text functions (ToUpper, ToLower, Trim, etc.)
* that directly implement StatelessFunction.
*/
class TextStatelessFunctionsTest {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

For better readability and to reduce code duplication, consider instantiating the stateless function objects as final fields in the test class instead of creating a new instance in each test method. Since these functions are stateless, a single instance can be reused across all tests for that function.

For example:

class TextStatelessFunctionsTest {
  private final ToUpperFunction toUpperFn = new ToUpperFunction();
  private final ToLowerFunction toLowerFn = new ToLowerFunction();
  // ... and so on

  @Test
  void toUpperBasic() {
    assertThat(toUpperFn.execute(new Object[]{"hello"}, null)).isEqualTo("HELLO");
    // ...
  }

  // ...
}

This would make the test class more concise and maintainable.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The existing tests in this file (the original 34 tests before this PR) all use per-method instantiation — e.g. final TextIndexOf fn = new TextIndexOf();. Keeping the same pattern for consistency.

assertThat(fn.getDescription()).contains("Levenshtein");
}

// ============ TextSnakeCase tests ============
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Similar to TextStatelessFunctionsTest, many test methods in this file re-instantiate the function object. To improve code clarity and reduce repetition, you could define these stateless function objects as final fields at the class level and reuse them in the tests. This applies to all the new test sections added in this file.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as above — per-method instantiation is the established pattern in this test file. Consistent with the existing 34 tests.

- Fix FormatFunction tests to use CypherDate temporal objects instead of
  plain strings, testing the actual temporal formatting contract
- Add test for CypherDuration with pattern correctly throwing
- Add test for non-temporal with pattern correctly throwing
- Add security boundary tests: regex pattern length limit (500 chars),
  lpad/rpad max length guard (10MB)
- Add clarifying comments for non-obvious TextSnakeCase and TextRpad behavior

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@claude
Copy link

claude bot commented Mar 3, 2026

Updated Review

(This supersedes my earlier comment, which contained inaccuracies — I had described test cases that are not present in the actual diff. Apologies for the confusion.)

Summary

The PR is a solid test-only addition. After reading the implementations against the tests, the coverage is accurate and the assertions are correct. A few observations below.


Bug revealed by missing test: SplitFunction NPE on null delimiter

SplitFunction (SQL-style, com.arcadedb.function.text.SplitFunction) calls:

final String delimiter = args[1].toString();   // line 44 — NPE if args[1] is null

There is a null-check for args[0] but not for args[1]. Passing a null delimiter will throw an unguarded NullPointerException rather than a meaningful error or graceful fallback.

By contrast, the OpenCypher counterpart TextSplit handles null/empty delimiter correctly (splits into individual characters).

The new tests cover splitFunctionNullReturnsNull (null string) but there is no test for a null delimiter, so this divergence goes undetected. Adding such a test would expose the implementation gap:

@Test
void splitFunctionNullDelimiterThrows() {
    final SplitFunction fn = new SplitFunction();
    // Documents that null delimiter causes NPE — implementation should be fixed
    assertThatThrownBy(() -> fn.execute(new Object[]{"abc", null}, null))
        .isInstanceOf(CommandExecutionException.class); // currently throws NPE
}

Ideally the implementation should also be fixed to match TextSplit's null handling, or at least throw CommandExecutionException instead of NPE.


Things done well

  • FormatFunction tests: correctly use CypherDate / CypherDuration temporal objects, not plain strings. The distinction between no-pattern (toString fallback) and pattern-with-duration (throws) is both tested and accurate.
  • Security boundary tests for regex pattern length (501-char → IllegalArgumentException) and lpad/rpad memory limit (10,485,761 → IllegalArgumentException) are present and correctly set one byte above the documented limits.
  • TextSnakeCase: the non-obvious behaviour for "HELLO_WORLD" is documented with an inline comment — good.
  • TextRpad no-truncation: the intent of fn.execute(new Object[]{"test", 2, "0"}, null) returning "test" is clarified with a comment — good.
  • TextSplit null delimiter (textSplitNullDelimiter): verified against the implementation — TextSplit deliberately splits into individual characters when delimiter is null/empty, so the assertion is correct.
  • Floating-point similarity assertions use isCloseTo(..., within(0.001)) — correct.
  • Consistent use of final on local variables, assertThat style, package-private test class — all match project conventions.

SplitFunction.execute() has no null guard on args[1], unlike TextSplit
which handles null delimiter gracefully by splitting into individual
characters. The test documents the current NPE behavior.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@robfrank
Copy link
Collaborator Author

robfrank commented Mar 3, 2026

Good catch on SplitFunction's null delimiter NPE. Added a test documenting the current behavior (throws NullPointerException). The comment in the test notes the divergence from TextSplit, which handles it gracefully. Fixing the implementation is a separate concern.

@mergify
Copy link
Contributor

mergify bot commented Mar 3, 2026

🧪 CI Insights

Here's what we observed from your CI run for f367a95.

🟢 All jobs passed!

But CI Insights is watching 👀

@claude
Copy link

claude bot commented Mar 3, 2026

Code Review

Good increase in test coverage. The tests follow project conventions correctly: final variables, AssertJ assertions (assertThat/assertThatThrownBy), JUnit 5, and package-private class access where appropriate for unit tests. Null handling and error conditions are covered systematically. A few items worth addressing below.


Bug documented but not fixed: SplitFunction NPE on null delimiter

splitFunctionNullDelimiterThrowsNpe tests an actual null-pointer bug in SplitFunction:

// SplitFunction.java
final String delimiter = args[1].toString(); // NPE when args[1] is null

The test comment explicitly notes the inconsistency with TextSplit, which handles null gracefully by splitting into characters. Adding a test that documents a known bug without fixing it means the bug ships. The fix is straightforward — add a null guard to SplitFunction matching TextSplit's behaviour, then update the test to verify the fallback rather than the NPE.


Surprising TextSnakeCase behaviour for ALL_CAPS input

textSnakeCaseBasic asserts:

assertThat(fn.execute(new Object[]{"HELLO_WORLD"}, null)).isEqualTo("h_e_l_l_o_w_o_r_l_d");

The comment explains this is because every uppercase letter triggers an underscore. The issue is that the existing underscore separator in the input is swallowed — the function cannot round-trip through its own output. Consider also testing with already-snake-cased input:

assertThat(fn.execute(new Object[]{"hello_world"}, null)).isEqualTo("hello_world");

If that assertion fails, it reveals a more serious issue worth flagging separately.


Missing boundary confirmation for security limits

The security boundary tests only verify the failure side. Adding a test just below each limit confirms the boundary is exactly where expected:

// Confirm exactly 500-char pattern is accepted
assertThat(fn.execute(new Object[]{"test", "a".repeat(500), "x"}, null)).isEqualTo("test");

// Confirm exactly 10MB padding is accepted
assertThat(fn.execute(new Object[]{"", 10_485_760, "x"}, null)).hasSize(10_485_760);

Without these, a bug that set the limit to 499 or 10MB-2 would not be caught.


Multi-character padChar behaviour not tested

TextRpad and TextLpad accept a pad string. The implementation uses only the first character when the pad string has multiple characters. This is undocumented truncation. A test like:

assertThat(fn.execute(new Object[]{"test", 8, "ab"}, null)).isEqualTo("testaaaa"); // only 'a' used

...would document the actual behaviour and catch any future change to it.


TextCamelCase (lower camelCase) has no coverage

TextUpperCamelCase is tested but its sibling TextCamelCase (text.camelCase) is not. The PR description lists functions covered but text.camelCase is absent from the new tests despite being in the same directory.


Minor: textHexValueFromByteArray skips string input path

TextHexValue likely has two code paths — byte array and string. The test only exercises the byte array path. Adding a test with a plain string would give fuller coverage.


No integration-level smoke test

All new tests call function objects directly. Since these functions are also reachable through SQL/Cypher queries (e.g. RETURN text.slug('Hello World')), one or two query-level tests would guard against registration or dispatch regressions that pure unit tests would miss. Existing tests in OpenCypherTextFunctionsTest already use this pattern for older functions — consider adding at least one query-path smoke test per newly covered function group.

@robfrank robfrank merged commit 687b972 into main Mar 3, 2026
11 of 12 checks passed
@codacy-production
Copy link

codacy-production bot commented Mar 3, 2026

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation Diff coverage
-9.21%
Coverage variation details
Coverable lines Covered lines Coverage
Common ancestor commit (6dd0a35) 103053 76331 74.07%
Head commit (f367a95) 133602 (+30549) 86660 (+10329) 64.86% (-9.21%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details
Coverable lines Covered lines Diff coverage
Pull request (#3570) 0 0 ∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings    Change summary preferences

@codecov
Copy link

codecov bot commented Mar 3, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.82%. Comparing base (6dd0a35) to head (f367a95).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #3570      +/-   ##
==========================================
+ Coverage   65.12%   65.82%   +0.70%     
==========================================
  Files        1506     1506              
  Lines      103053   103053              
  Branches    21366    21366              
==========================================
+ Hits        67109    67837     +728     
+ Misses      26751    26003     -748     
- Partials     9193     9213      +20     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

robfrank added a commit that referenced this pull request Mar 5, 2026
mergify bot added a commit that referenced this pull request Mar 23, 2026
Bumps the github-actions group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.72` | `1.0.76` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.32.6` | `4.34.1` |
| [zgosalvez/github-actions-ensure-sha-pinned-actions](https://github.com/zgosalvez/github-actions-ensure-sha-pinned-actions) | `5.0.2` | `5.0.3` |
| [actions/cache](https://github.com/actions/cache) | `5.0.3` | `5.0.4` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.5.2` | `5.5.3` |
Updates `anthropics/claude-code-action` from 1.0.72 to 1.0.76
Release notes

*Sourced from [anthropics/claude-code-action's releases](https://github.com/anthropics/claude-code-action/releases).*

> v1.0.76
> -------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.76>
>
> v1.0.75
> -------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.75>
>
> v1.0.74
> -------
>
> What's Changed
> --------------
>
> * Restore .claude/ and .mcp.json from PR base branch before CLI runs by [`@​km-anthropic`](https://github.com/km-anthropic) in [anthropics/claude-code-action#1066](https://github.com/anthropics/claude-code-action/pull/1066)
> * Remove redundant git status/diff/log from tag mode allowlist by [`@​ddworken`](https://github.com/ddworken) in [anthropics/claude-code-action#1075](https://github.com/anthropics/claude-code-action/pull/1075)
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.74>
>
> v1.0.73
> -------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.73>


Commits

* [`6062f37`](anthropics/claude-code-action@6062f37) chore: bump Claude Code to 2.1.81 and Agent SDK to 0.2.81
* [`df37d2f`](anthropics/claude-code-action@df37d2f) chore: bump Claude Code to 2.1.79 and Agent SDK to 0.2.79
* [`1ba15be`](anthropics/claude-code-action@1ba15be) Remove redundant git status/diff/log from tag mode allowlist ([#1075](https://github.com/anthropics/claude-code-action/issues/1075))
* [`9ddce40`](anthropics/claude-code-action@9ddce40) Restore .claude/ and .mcp.json from PR base branch before CLI runs ([#1066](https://github.com/anthropics/claude-code-action/issues/1066))
* [`1b422b3`](anthropics/claude-code-action@1b422b3) chore: bump Claude Code to 2.1.78 and Agent SDK to 0.2.77
* [`4c044bb`](anthropics/claude-code-action@4c044bb) chore: bump Claude Code to 2.1.77 and Agent SDK to 0.2.77
* See full diff in [compare view](anthropics/claude-code-action@cd77b50...6062f37)
  
Updates `github/codeql-action` from 4.32.6 to 4.34.1
Release notes

*Sourced from [github/codeql-action's releases](https://github.com/github/codeql-action/releases).*

> v4.34.1
> -------
>
> * Downgrade default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3) due to issues with a small percentage of Actions and JavaScript analyses. [#3762](https://github.com/github/codeql-action/pull/3762)
>
> v4.34.0
> -------
>
> * Added an experimental change which disables TRAP caching when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. [#3569](https://github.com/github/codeql-action/pull/3569)
> * We are rolling out improved incremental analysis to C/C++ analyses that use build mode `none`. We expect this rollout to be complete by the end of April 2026. [#3584](https://github.com/github/codeql-action/pull/3584)
> * Update default CodeQL bundle version to [2.25.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0). [#3585](https://github.com/github/codeql-action/pull/3585)
>
> v4.33.0
> -------
>
> * Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. [#3562](https://github.com/github/codeql-action/pull/3562)
>
>   To opt out of this change:
>
>   + **Repositories owned by an organization:** Create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository's settings. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). Alternatively, if you are using an advanced setup workflow, you can set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow.
>   + **User-owned repositories using default setup:** Switch to an advanced setup workflow and set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow.
>   + **User-owned repositories using advanced setup:** Set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow.
> * Fixed [a bug](https://github.com/github/codeql-action/issues/3555) which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. [#3557](https://github.com/github/codeql-action/pull/3557)
> * The CodeQL Action now loads [custom repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) on GitHub Enterprise Server, enabling the customization of features such as `github-codeql-disable-overlay` that was previously only available on GitHub.com. [#3559](https://github.com/github/codeql-action/pull/3559)
> * Once [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. [#3563](https://github.com/github/codeql-action/pull/3563)
> * Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". [#3564](https://github.com/github/codeql-action/pull/3564)
> * A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. [#3570](https://github.com/github/codeql-action/pull/3570)


Changelog

*Sourced from [github/codeql-action's changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md).*

> CodeQL Action Changelog
> =======================
>
> See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
>
> [UNRELEASED]
> ------------
>
> No user facing changes.
>
> 4.34.1 - 20 Mar 2026
> --------------------
>
> * Downgrade default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3) due to issues with a small percentage of Actions and JavaScript analyses. [#3762](https://github.com/github/codeql-action/pull/3762)
>
> 4.34.0 - 20 Mar 2026
> --------------------
>
> * Added an experimental change which disables TRAP caching when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. [#3569](https://github.com/github/codeql-action/pull/3569)
> * We are rolling out improved incremental analysis to C/C++ analyses that use build mode `none`. We expect this rollout to be complete by the end of April 2026. [#3584](https://github.com/github/codeql-action/pull/3584)
> * Update default CodeQL bundle version to [2.25.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0). [#3585](https://github.com/github/codeql-action/pull/3585)
>
> 4.33.0 - 16 Mar 2026
> --------------------
>
> * Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. [#3562](https://github.com/github/codeql-action/pull/3562)
>
>   To opt out of this change:
>
>   + **Repositories owned by an organization:** Create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository's settings. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). Alternatively, if you are using an advanced setup workflow, you can set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow.
>   + **User-owned repositories using default setup:** Switch to an advanced setup workflow and set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow.
>   + **User-owned repositories using advanced setup:** Set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow.
> * Fixed [a bug](https://github.com/github/codeql-action/issues/3555) which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. [#3557](https://github.com/github/codeql-action/pull/3557)
> * The CodeQL Action now loads [custom repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) on GitHub Enterprise Server, enabling the customization of features such as `github-codeql-disable-overlay` that was previously only available on GitHub.com. [#3559](https://github.com/github/codeql-action/pull/3559)
> * Once [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. [#3563](https://github.com/github/codeql-action/pull/3563)
> * Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". [#3564](https://github.com/github/codeql-action/pull/3564)
> * A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. [#3570](https://github.com/github/codeql-action/pull/3570)
>
> 4.32.6 - 05 Mar 2026
> --------------------
>
> * Update default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3). [#3548](https://github.com/github/codeql-action/pull/3548)
>
> 4.32.5 - 02 Mar 2026
> --------------------
>
> * Repositories owned by an organization can now set up the `github-codeql-disable-overlay` custom repository property to disable [improved incremental analysis for CodeQL](https://github.com/github/roadmap/issues/1158). First, create a custom repository property with the name `github-codeql-disable-overlay` and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to `true` to disable improved incremental analysis. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature is not yet available on GitHub Enterprise Server. [#3507](https://github.com/github/codeql-action/pull/3507)
> * Added an experimental change so that when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. [#3487](https://github.com/github/codeql-action/pull/3487)
> * The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. [#3515](https://github.com/github/codeql-action/pull/3515)
> * Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. [#3516](https://github.com/github/codeql-action/pull/3516)
> * Added an experimental change which lowers the minimum disk space requirement for [improved incremental analysis](https://github.com/github/roadmap/issues/1158), enabling it to run on standard GitHub Actions runners. We expect to roll this change out to everyone in March. [#3498](https://github.com/github/codeql-action/pull/3498)
> * Added an experimental change which allows the `start-proxy` action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. [#3512](https://github.com/github/codeql-action/pull/3512)
> * The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. [#3503](https://github.com/github/codeql-action/pull/3503), [#3504](https://github.com/github/codeql-action/pull/3504)
>
> 4.32.4 - 20 Feb 2026
> --------------------
>
> * Update default CodeQL bundle version to [2.24.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2). [#3493](https://github.com/github/codeql-action/pull/3493)
> * Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. [#3473](https://github.com/github/codeql-action/pull/3473)

... (truncated)


Commits

* [`3869755`](github/codeql-action@3869755) Merge pull request [#3763](https://github.com/github/codeql-action/issues/3763) from github/update-v4.34.1-095e0fe50
* [`20e68ac`](github/codeql-action@20e68ac) Update changelog for v4.34.1
* [`095e0fe`](github/codeql-action@095e0fe) Merge pull request [#3762](https://github.com/github/codeql-action/issues/3762) from github/henrymercer/downgrade-default-bundle
* [`47b94fe`](github/codeql-action@47b94fe) Add changelog note
* [`51a1d69`](github/codeql-action@51a1d69) Downgrade default bundle to codeql-bundle-v2.24.3
* [`510cf73`](github/codeql-action@510cf73) Merge pull request [#3589](https://github.com/github/codeql-action/issues/3589) from github/mergeback/v4.34.0-to-main-c6f93110
* [`89f0c86`](github/codeql-action@89f0c86) Rebuild
* [`c3f90ba`](github/codeql-action@c3f90ba) Update changelog and version after v4.34.0
* [`c6f9311`](github/codeql-action@c6f9311) Merge pull request [#3588](https://github.com/github/codeql-action/issues/3588) from github/update-v4.34.0-30c555a52
* [`eeb9b3f`](github/codeql-action@eeb9b3f) Update changelog for v4.34.0
* Additional commits viewable in [compare view](github/codeql-action@0d579ff...3869755)
  
Updates `zgosalvez/github-actions-ensure-sha-pinned-actions` from 5.0.2 to 5.0.3
Release notes

*Sourced from [zgosalvez/github-actions-ensure-sha-pinned-actions's releases](https://github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/releases).*

> v5.0.3
> ------
>
> What's Changed
> --------------
>
> * Bump flatted from 3.3.1 to 3.4.2 by [`@​dependabot`](https://github.com/dependabot)[bot] in [zgosalvez/github-actions-ensure-sha-pinned-actions#299](https://github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/pull/299)
>
> **Full Changelog**: <zgosalvez/github-actions-ensure-sha-pinned-actions@v5...v5.0.3>


Commits

* [`471d5ac`](zgosalvez/github-actions-ensure-sha-pinned-actions@471d5ac) Bump flatted from 3.3.1 to 3.4.2 ([#299](https://github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/issues/299))
* See full diff in [compare view](zgosalvez/github-actions-ensure-sha-pinned-actions@cc9ffdc...471d5ac)
  
Updates `actions/cache` from 5.0.3 to 5.0.4
Release notes

*Sourced from [actions/cache's releases](https://github.com/actions/cache/releases).*

> v5.0.4
> ------
>
> What's Changed
> --------------
>
> * Add release instructions and update maintainer docs by [`@​Link`](https://github.com/Link)- in [actions/cache#1696](https://github.com/actions/cache/pull/1696)
> * Potential fix for code scanning alert no. 52: Workflow does not contain permissions by [`@​Link`](https://github.com/Link)- in [actions/cache#1697](https://github.com/actions/cache/pull/1697)
> * Fix workflow permissions and cleanup workflow names / formatting by [`@​Link`](https://github.com/Link)- in [actions/cache#1699](https://github.com/actions/cache/pull/1699)
> * docs: Update examples to use the latest version by [`@​XZTDean`](https://github.com/XZTDean) in [actions/cache#1690](https://github.com/actions/cache/pull/1690)
> * Fix proxy integration tests by [`@​Link`](https://github.com/Link)- in [actions/cache#1701](https://github.com/actions/cache/pull/1701)
> * Fix cache key in examples.md for bun.lock by [`@​RyPeck`](https://github.com/RyPeck) in [actions/cache#1722](https://github.com/actions/cache/pull/1722)
> * Update dependencies & patch security vulnerabilities by [`@​Link`](https://github.com/Link)- in [actions/cache#1738](https://github.com/actions/cache/pull/1738)
>
> New Contributors
> ----------------
>
> * [`@​XZTDean`](https://github.com/XZTDean) made their first contribution in [actions/cache#1690](https://github.com/actions/cache/pull/1690)
> * [`@​RyPeck`](https://github.com/RyPeck) made their first contribution in [actions/cache#1722](https://github.com/actions/cache/pull/1722)
>
> **Full Changelog**: <actions/cache@v5...v5.0.4>


Changelog

*Sourced from [actions/cache's changelog](https://github.com/actions/cache/blob/main/RELEASES.md).*

> Releases
> ========
>
> How to prepare a release
> ------------------------
>
> > [!NOTE]  
> > Relevant for maintainers with write access only.
>
> 1. Switch to a new branch from `main`.
> 2. Run `npm test` to ensure all tests are passing.
> 3. Update the version in [`https://github.com/actions/cache/blob/main/package.json`](https://github.com/actions/cache/blob/main/package.json).
> 4. Run `npm run build` to update the compiled files.
> 5. Update this [`https://github.com/actions/cache/blob/main/RELEASES.md`](https://github.com/actions/cache/blob/main/RELEASES.md) with the new version and changes in the `## Changelog` section.
> 6. Run `licensed cache` to update the license report.
> 7. Run `licensed status` and resolve any warnings by updating the [`https://github.com/actions/cache/blob/main/.licensed.yml`](https://github.com/actions/cache/blob/main/.licensed.yml) file with the exceptions.
> 8. Commit your changes and push your branch upstream.
> 9. Open a pull request against `main` and get it reviewed and merged.
> 10. Draft a new release <https://github.com/actions/cache/releases> use the same version number used in `package.json`
>     1. Create a new tag with the version number.
>     2. Auto generate release notes and update them to match the changes you made in `RELEASES.md`.
>     3. Toggle the set as the latest release option.
>     4. Publish the release.
> 11. Navigate to <https://github.com/actions/cache/actions/workflows/release-new-action-version.yml>
>     1. There should be a workflow run queued with the same version number.
>     2. Approve the run to publish the new version and update the major tags for this action.
>
> Changelog
> ---------
>
> ### 5.0.4
>
> * Bump `minimatch` to v3.1.5 (fixes ReDoS via globstar patterns)
> * Bump `undici` to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
> * Bump `fast-xml-parser` to v5.5.6
>
> ### 5.0.3
>
> * Bump `@actions/cache` to v5.0.5 (Resolves: <https://github.com/actions/cache/security/dependabot/33>)
> * Bump `@actions/core` to v2.0.3
>
> ### 5.0.2
>
> * Bump `@actions/cache` to v5.0.3 [#1692](https://github.com/actions/cache/pull/1692)
>
> ### 5.0.1
>
> * Update `@azure/storage-blob` to `^12.29.1` via `@actions/cache@5.0.1` [#1685](https://github.com/actions/cache/pull/1685)
>
> ### 5.0.0
>
> > [!IMPORTANT]
> > `actions/cache@v5` runs on the Node.js 24 runtime and requires a minimum Actions Runner version of `2.327.1`.

... (truncated)


Commits

* [`6682284`](actions/cache@6682284) Merge pull request [#1738](https://github.com/actions/cache/issues/1738) from actions/prepare-v5.0.4
* [`e340396`](actions/cache@e340396) Update RELEASES
* [`8a67110`](actions/cache@8a67110) Add licenses
* [`1865903`](actions/cache@1865903) Update dependencies & patch security vulnerabilities
* [`5656298`](actions/cache@5656298) Merge pull request [#1722](https://github.com/actions/cache/issues/1722) from RyPeck/patch-1
* [`4e380d1`](actions/cache@4e380d1) Fix cache key in examples.md for bun.lock
* [`b7e8d49`](actions/cache@b7e8d49) Merge pull request [#1701](https://github.com/actions/cache/issues/1701) from actions/Link-/fix-proxy-integration-tests
* [`984a21b`](actions/cache@984a21b) Add traffic sanity check step
* [`acf2f1f`](actions/cache@acf2f1f) Fix resolution
* [`95a07c5`](actions/cache@95a07c5) Add wait for proxy
* Additional commits viewable in [compare view](actions/cache@cdf6c1f...6682284)
  
Updates `codecov/codecov-action` from 5.5.2 to 5.5.3
Release notes

*Sourced from [codecov/codecov-action's releases](https://github.com/codecov/codecov-action/releases).*

> v5.5.3
> ------
>
> What's Changed
> --------------
>
> * build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by [`@​dependabot`](https://github.com/dependabot)[bot] in [codecov/codecov-action#1874](https://github.com/codecov/codecov-action/pull/1874)
> * chore(release): bump to 5.5.3 by [`@​thomasrockhu-codecov`](https://github.com/thomasrockhu-codecov) in [codecov/codecov-action#1922](https://github.com/codecov/codecov-action/pull/1922)
>
> **Full Changelog**: <codecov/codecov-action@v5.5.2...v5.5.3>


Changelog

*Sourced from [codecov/codecov-action's changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md).*

> v5.5.2
> ------
>
> ### What's Changed
>
> **Full Changelog**: <https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2>
>
> v5.5.1
> ------
>
> ### What's Changed
>
> * fix: overwrite pr number on fork by [`@​thomasrockhu-codecov`](https://github.com/thomasrockhu-codecov) in [codecov/codecov-action#1871](https://github.com/codecov/codecov-action/pull/1871)
> * build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by `@​app/dependabot` in [codecov/codecov-action#1868](https://github.com/codecov/codecov-action/pull/1868)
> * build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by `@​app/dependabot` in [codecov/codecov-action#1867](https://github.com/codecov/codecov-action/pull/1867)
> * fix: update to use local app/ dir by [`@​thomasrockhu-codecov`](https://github.com/thomasrockhu-codecov) in [codecov/codecov-action#1872](https://github.com/codecov/codecov-action/pull/1872)
> * docs: fix typo in README by [`@​datalater`](https://github.com/datalater) in [codecov/codecov-action#1866](https://github.com/codecov/codecov-action/pull/1866)
> * Document a `codecov-cli` version reference example by [`@​webknjaz`](https://github.com/webknjaz) in [codecov/codecov-action#1774](https://github.com/codecov/codecov-action/pull/1774)
> * build(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by `@​app/dependabot` in [codecov/codecov-action#1861](https://github.com/codecov/codecov-action/pull/1861)
> * build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by `@​app/dependabot` in [codecov/codecov-action#1833](https://github.com/codecov/codecov-action/pull/1833)
>
> **Full Changelog**: <https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1>
>
> v5.5.0
> ------
>
> ### What's Changed
>
> * feat: upgrade wrapper to 0.2.4 by [`@​jviall`](https://github.com/jviall) in [codecov/codecov-action#1864](https://github.com/codecov/codecov-action/pull/1864)
> * Pin actions/github-script by Git SHA by [`@​martincostello`](https://github.com/martincostello) in [codecov/codecov-action#1859](https://github.com/codecov/codecov-action/pull/1859)
> * fix: check reqs exist by [`@​joseph-sentry`](https://github.com/joseph-sentry) in [codecov/codecov-action#1835](https://github.com/codecov/codecov-action/pull/1835)
> * fix: Typo in README by [`@​spalmurray`](https://github.com/spalmurray) in [codecov/codecov-action#1838](https://github.com/codecov/codecov-action/pull/1838)
> * docs: Refine OIDC docs by [`@​spalmurray`](https://github.com/spalmurray) in [codecov/codecov-action#1837](https://github.com/codecov/codecov-action/pull/1837)
> * build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by `@​app/dependabot` in [codecov/codecov-action#1829](https://github.com/codecov/codecov-action/pull/1829)
>
> **Full Changelog**: <https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0>
>
> v5.4.3
> ------
>
> ### What's Changed
>
> * build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by `@​app/dependabot` in [codecov/codecov-action#1822](https://github.com/codecov/codecov-action/pull/1822)
> * fix: OIDC on forks by [`@​joseph-sentry`](https://github.com/joseph-sentry) in [codecov/codecov-action#1823](https://github.com/codecov/codecov-action/pull/1823)
>
> **Full Changelog**: <https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3>
>
> v5.4.2
> ------

... (truncated)


Commits

* [`1af5884`](codecov/codecov-action@1af5884) chore(release): bump to 5.5.3 ([#1922](https://github.com/codecov/codecov-action/issues/1922))
* [`c143300`](codecov/codecov-action@c143300) build(deps): bump actions/github-script from 7.0.1 to 8.0.0 ([#1874](https://github.com/codecov/codecov-action/issues/1874))
* See full diff in [compare view](codecov/codecov-action@671740a...1af5884)
  
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore  major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore  minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore  ` will remove the ignore condition of the specified dependency and ignore conditions
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant