build(deps): bump github/codeql-action/analyze from 4.36.2 to 4.37.3 by dependabot[bot] · Pull Request #361 · twcclegg/libphonenumber-csharp

dependabot · 2026-08-01T22:44:00Z

Bumps github/codeql-action/analyze from 4.36.2 to 4.37.3.

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.3

No user facing changes.

v4.37.2

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v4.37.1

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037

Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

... (truncated)

Commits

e4fba86 Merge pull request #4031 from github/update-v4.37.3-72f6a9da0
fb50ab5 Update changelog for v4.37.3
72f6a9d Merge pull request #4030 from github/mbg/fix/no-proxy
3b5ee58 Use default request options instead of undefined
bfb6be4 Merge pull request #4028 from github/mergeback/v4.37.2-to-main-e0647621
526ab84 Rebuild
d6217b9 Update changelog and version after v4.37.2
e064762 Merge pull request #4027 from github/update-v4.37.2-385bcdc5a
e0faed8 Add a couple of change notes
73aad0e Update changelog for v4.37.2
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.2 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@8aad20d...e4fba86) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-08-01T22:50:38Z

📊 Benchmark Results

Commit: 1574d64 · Full run · Windows windows-latest

PR branch


BenchmarkDotNet v0.15.8, Windows 11 (10.0.26100.32995/24H2/2024Update/HudsonValley) (Hyper-V)
AMD EPYC 7763 2.44GHz, 1 CPU, 4 logical and 2 physical cores
.NET SDK 10.0.302
  [Host]    : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3
  .NET 10.0 : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3

Job=.NET 10.0  Runtime=.NET 10.0

Method	PhoneNumberCount	Mean	Error	StdDev	Gen0	Gen1	Allocated
InputDigitPerKeystroke	1000	4.664 ms	0.0907 ms	0.0849 ms	242.1875	7.8125	3.9 MB


BenchmarkDotNet v0.15.8, Windows 11 (10.0.26100.32995/24H2/2024Update/HudsonValley) (Hyper-V)
AMD EPYC 7763 2.44GHz, 1 CPU, 4 logical and 2 physical cores
.NET SDK 10.0.302
  [Host]     : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3
  Job-AMQORM : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3

Runtime=.NET 10.0  InvocationCount=1  IterationCount=20  
LaunchCount=1  RunStrategy=ColdStart  UnrollFactor=1  
WarmupCount=1

Method	Mean	Error	StdDev	Allocated
CreateInstance	324.9 μs	98.27 μs	113.2 μs	75.05 KB
CreateInstanceAndLoadAllRegions	8,594.4 μs	376.00 μs	433.0 μs	1575.89 KB
FirstRegionLookup	372.0 μs	139.86 μs	161.1 μs	80.11 KB


BenchmarkDotNet v0.15.8, Windows 11 (10.0.26100.32995/24H2/2024Update/HudsonValley) (Hyper-V)
AMD EPYC 7763 2.44GHz, 1 CPU, 4 logical and 2 physical cores
.NET SDK 10.0.302
  [Host]    : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3
  .NET 10.0 : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3

Job=.NET 10.0  Runtime=.NET 10.0

Method	PhoneNumberCount	Mean	Error	StdDev	Gen0	Allocated
ExtractPossibleNumber_CleanInput	1000	22.88 μs	0.257 μs	0.240 μs	-	-
ExtractPossibleNumber_WithLeadingJunk	1000	35.65 μs	0.393 μs	0.368 μs	2.8687	48360 B


BenchmarkDotNet v0.15.8, Windows 11 (10.0.26100.32995/24H2/2024Update/HudsonValley) (Hyper-V)
AMD EPYC 7763 2.44GHz, 1 CPU, 4 logical and 2 physical cores
.NET SDK 10.0.302
  [Host]    : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3
  .NET 10.0 : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3

Job=.NET 10.0  Runtime=.NET 10.0

Method	PhoneNumberCount	Mean	Error	StdDev	Gen0	Allocated
FindNumbers_Valid	100	165.8 μs	1.58 μs	1.40 μs	4.1504	69.93 KB
FindNumbers_StrictGrouping	100	349.4 μs	6.81 μs	7.57 μs	7.3242	123.3 KB


BenchmarkDotNet v0.15.8, Windows 11 (10.0.26100.32995/24H2/2024Update/HudsonValley) (Hyper-V)
AMD EPYC 7763 2.44GHz, 1 CPU, 4 logical and 2 physical cores
.NET SDK 10.0.302
  [Host]    : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3
  .NET 10.0 : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3

Job=.NET 10.0  Runtime=.NET 10.0

Method	PhoneNumberCount	Mean	Error	StdDev	Gen0	Allocated
ParseValidateAndFormatPhoneNumbers	1000	2.553 ms	0.0410 ms	0.0383 ms	35.1563	582.49 KB
ParseValidateAndFormatPhoneNumbers	10000	27.635 ms	0.5472 ms	1.1301 ms	343.7500	5818.97 KB

main branch


BenchmarkDotNet v0.15.8, Windows 11 (10.0.26100.32995/24H2/2024Update/HudsonValley) (Hyper-V)
AMD EPYC 7763 2.44GHz, 1 CPU, 4 logical and 2 physical cores
.NET SDK 10.0.302
  [Host]    : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3
  .NET 10.0 : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3

Job=.NET 10.0  Runtime=.NET 10.0

Method	PhoneNumberCount	Mean	Error	StdDev	Gen0	Gen1	Allocated
InputDigitPerKeystroke	1000	4.681 ms	0.0506 ms	0.0474 ms	242.1875	7.8125	3.9 MB


BenchmarkDotNet v0.15.8, Windows 11 (10.0.26100.32995/24H2/2024Update/HudsonValley) (Hyper-V)
AMD EPYC 7763 2.44GHz, 1 CPU, 4 logical and 2 physical cores
.NET SDK 10.0.302
  [Host]     : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3
  Job-AMQORM : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3

Runtime=.NET 10.0  InvocationCount=1  IterationCount=20  
LaunchCount=1  RunStrategy=ColdStart  UnrollFactor=1  
WarmupCount=1

Method	Mean	Error	StdDev	Allocated
CreateInstance	316.4 μs	103.4 μs	119.1 μs	75.05 KB
CreateInstanceAndLoadAllRegions	8,664.4 μs	467.8 μs	538.8 μs	1575.89 KB
FirstRegionLookup	361.8 μs	129.7 μs	149.4 μs	80.11 KB


BenchmarkDotNet v0.15.8, Windows 11 (10.0.26100.32995/24H2/2024Update/HudsonValley) (Hyper-V)
AMD EPYC 7763 2.44GHz, 1 CPU, 4 logical and 2 physical cores
.NET SDK 10.0.302
  [Host]    : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3
  .NET 10.0 : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3

Job=.NET 10.0  Runtime=.NET 10.0

Method	PhoneNumberCount	Mean	Error	StdDev	Gen0	Allocated
ExtractPossibleNumber_CleanInput	1000	22.73 μs	0.133 μs	0.124 μs	-	-
ExtractPossibleNumber_WithLeadingJunk	1000	35.91 μs	0.396 μs	0.351 μs	2.8687	48360 B


BenchmarkDotNet v0.15.8, Windows 11 (10.0.26100.32995/24H2/2024Update/HudsonValley) (Hyper-V)
AMD EPYC 7763 2.44GHz, 1 CPU, 4 logical and 2 physical cores
.NET SDK 10.0.302
  [Host]    : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3
  .NET 10.0 : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3

Job=.NET 10.0  Runtime=.NET 10.0

Method	PhoneNumberCount	Mean	Error	StdDev	Gen0	Allocated
FindNumbers_Valid	100	157.2 μs	1.65 μs	1.54 μs	4.1504	69.93 KB
FindNumbers_StrictGrouping	100	336.8 μs	2.79 μs	2.61 μs	7.3242	123.3 KB


BenchmarkDotNet v0.15.8, Windows 11 (10.0.26100.32995/24H2/2024Update/HudsonValley) (Hyper-V)
AMD EPYC 7763 2.44GHz, 1 CPU, 4 logical and 2 physical cores
.NET SDK 10.0.302
  [Host]    : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3
  .NET 10.0 : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3

Job=.NET 10.0  Runtime=.NET 10.0

Method	PhoneNumberCount	Mean	Error	StdDev	Gen0	Allocated
ParseValidateAndFormatPhoneNumbers	1000	2.682 ms	0.0239 ms	0.0224 ms	35.1563	582.48 KB
ParseValidateAndFormatPhoneNumbers	10000	26.380 ms	0.3603 ms	0.3008 ms	343.7500	5818.97 KB

codecov · 2026-08-02T00:40:02Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.06%. Comparing base (4678853) to head (1574d64).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #361   +/-   ##
=======================================
  Coverage   98.06%   98.06%           
=======================================
  Files          40       40           
  Lines       52972    52972           
  Branches     1126     1126           
=======================================
  Hits        51948    51948           
  Misses        779      779           
  Partials      245      245

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

…ingBuilder - 9 spots created a match-iterator with manual .Dispose() after assertions that can throw on failure, leaking the enumerator on the failure path. Switched to using/using-var, in some cases splitting a method into scoped blocks so each of two sequential enumerators is still disposed promptly, matching the original ordering (cs/dispose-not-called-on-throw, alerts #361-#369). - FindMatchesInContexts: two foreach loops that immediately mapped context -> text and never used context again, rewritten as .Select() (cs/linq/missed-select, alerts #19/#20). - EnsureTermination: the per-iteration StringBuilder was write-only — appended to but never read, returned, or asserted against. The method's whole point (per its doc comment) is forcing full enumeration to confirm it terminates; the StringBuilder was dead weight, not an allocation to hoist out of the loop (cs/stringbuilder-creation-in-loop, alert #24). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 1, 2026

dependabot Bot requested a review from twcclegg as a code owner August 1, 2026 22:44

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 1, 2026

fix dependabot

1574d64

twcclegg merged commit e52e9de into main Aug 2, 2026
9 checks passed

twcclegg deleted the dependabot/github_actions/github/codeql-action/analyze-4.37.3 branch August 2, 2026 00:41

This was referenced Aug 25, 2026

Bump libphonenumber-csharp and 46 others codeforamerica/sebt-self-service-portal#626

Closed

Bump the nuget-minor-patch group with 50 updates codeforamerica/sebt-self-service-portal#627

Closed

dependabot Bot mentioned this pull request Sep 4, 2026

Bump the dotnet-deps group with 16 updates vodongha/vodongha-personal#321

Open

Navigation Menu

build(deps): bump github/codeql-action/analyze from 4.36.2 to 4.37.3 - #361

build(deps): bump github/codeql-action/analyze from 4.36.2 to 4.37.3#361
twcclegg merged 2 commits into
mainfrom
dependabot/github_actions/github/codeql-action/analyze-4.37.3

dependabot Bot commented on behalf of github Aug 1, 2026

Uh oh!

github-actions Bot commented Aug 1, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Aug 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Aug 1, 2026

v4.37.3

v4.37.2

v4.37.1

v4.37.0

v4.36.3

CodeQL Action Changelog

[UNRELEASED]

4.37.4 - 29 Jul 2026

4.37.3 - 22 Jul 2026

4.37.2 - 21 Jul 2026

4.37.1 - 16 Jul 2026

4.37.0 - 08 Jul 2026

4.36.3 - 01 Jul 2026

4.36.2 - 04 Jun 2026

4.36.1 - 02 Jun 2026

4.36.0 - 22 May 2026

Uh oh!

github-actions Bot commented Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📊 Benchmark Results

Uh oh!

codecov Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Aug 1, 2026 •

edited

Loading

codecov Bot commented Aug 2, 2026 •

edited

Loading