ci(deps): bump the codeql group across 1 directory with 2 updates - #77
Merged
github-actions[bot] merged 1 commit intoSep 23, 2026
Merged
Conversation
dependabot
Bot
added
dependencies
github-actions
Bot
removed
the
dependencies
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/codeql-c83b7ed659
branch
from
September 22, 2026 15:29
57275be to
a00a6f8
Compare
4Luke4
added a commit
that referenced
this pull request
Sep 23, 2026
…hover prose (#84) * ci: remove the Dependabot rebase workflow Drop the scheduled workflow that commented "@dependabot rebase" on behind Dependabot pull requests, together with its unreleased changelog entry. Behind updates are brought current manually with the same comment. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(ci): keep duplicate Dependabot runs from failing required checks Dependabot pushes and edits a pull request within the same second. The Conventional Commits concurrency group cancelled one of the two runs after its check run existed, leaving a CANCELLED required context that fails the rollup (#69, #77). Let every run finish and validate the live PR title. The patch auto-merge picked whichever run gh listed first and failed on the cancelled duplicate (#77). It now awaits every run for the head and requires a success with nothing but superseded cancellations beside it. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(tools): generate every API section from pinned inputs with exact prose The required Pinned API regeneration job called the GitHub REST API anonymously and failed on main with "403 rate limit exceeded". A local composite action now checks out EEex-Docs and LuaJIT at pinned commits and downloads the Lua 5.2.4 archive, accepted only on its published SHA-256; the generator reads them from disk, verifies each checkout's HEAD, and no token reaches repository code. Lua 5.2 and LuaJIT, previously fetched live and never verified, are regenerated with the other four sections. The HTML converter keeps what the pages show: exact typographic characters, superscripts, tables, headings, line breaks, alternative call forms, and links resolved against their page. RST :ref: links resolve to the pinned line that defines the label across the whole checkout, instead of in-page fragments that lead nowhere in a hover. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(tools): show published EE signatures verbatim and drop entry separators Game function signatures replaced upstream's "..." vararg and "???" unknown-parameter markers with invented arg1/arg2 names and normalised the published spacing. They are now kept exactly, and any other unexpected token fails generation. The package audit accepts both markers. A trailing "----" transition only separates index entries (docutils never lets a section end in one), yet it rendered as a second rule before the hover's own source separator. Ref titles also drop the space docutils removes before "<target>". Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(shared): resolve EEex base types as inheritance, not baseclass fields EEex records structure inheritance as layout rows named baseclass_<n> typed with the base structure. They were offered and hovered as members, while the base structure's real members were unreachable on the derived usertype. Member completion, hover, chained resolution and typed method aliases now walk the documented lineage, nearest declaration first and cycle-safe, and never treat a baseclass_<n> row as a member. Also add parameterLabelOffsets for unambiguous signature-help ranges. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: render documentation HTML in hovers and send offset parameter labels vscode-languageclient leaves markdown.supportHtml off, so VS Code stripped the <br/>, <sup>, <u> and <pre> tags upstream documentation uses and table cells ran together. The client enables it; VS Code still sanitises the HTML and command links stay disabled. Signature help sends [start, end) parameter ranges to clients that support them, so verbatim signatures such as "(???,???)" stay unambiguous. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test: hold API hovers to the pinned upstream text in the feature gates The declared-feature job compares sixteen hovers covering all six sources and every formatting construct byte for byte with expectations written from the pinned upstream text, and audits every shipped hover for Markdown that would render differently from its source. The installed-extension suite checks the same expectations as VS Code receives them, including enabled documentation HTML and disabled command links. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * docs: record pinned documentation inputs, hover fidelity and inheritance Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(tools): parse :ref: targets that contain angle brackets Upstream links such as :ref:`uiItem\:\:bam<uiItem::<unnamed_type_bam>>` target labels that contain angle brackets themselves. The target is now the trailing "<...>" that balances the final ">", so these four links resolve to their pinned structure lines instead of degrading to text with a stray HTML-like tag. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(tools): keep list code blocks, bold spacing and literal angle brackets The shipped-hover audit found three rendering defects: - collectgarbage's "count" item embeds a <pre> block, which was flattened onto the bullet's line and broke the fence. List items now keep their paragraphs and code blocks indented under the bullet. - "<b>opt: </b>" became "**opt: **", which CommonMark does not close, so the asterisks showed. Surrounding spaces now sit outside the markers. - EEex_Resource_LoadIDS says "the range [0, <max id in .IDS>]"; the brackets were read as an HTML tag and stripped. Literal angle brackets in prose are escaped, while code spans and rendered tags are untouched. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test: cover a mid-entry rule and section heading in the EEex fixture EEex_Options_Option.new's entry continues past its "====" transition into "The Option Table" section it links to, exactly as the page reads. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test: treat backslash-escaped angle brackets as text in the hover audit Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(data): regenerate API data from pinned inputs with exact hover prose Applied from the reviewed generated-data-patch artifact of CI run 35852760547. Lua 5.2 now comes from the lua-5.2.4 release archive and LuaJIT from LuaJIT/LuaJIT at c6ffc141, both recorded in the manifest. Signatures, typography, tables, links and cross-references follow the pinned upstream text; symbol counts are unchanged. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * style: apply the Prettier formatting produced by the CI maintenance run Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(tools): escape Markdown without incomplete backslash handling CodeQL flagged three js/incomplete-sanitization alerts in the new converters: HTML table cells escaped "|" but not "\", and literal "<" was written as "\<" while the RST table escaper then had to skip those backslashes. A backslash in the text could undo either escape. Literal angle brackets in prose are now written as "<", which Markdown renders as "<" and which leaves the original RST table escaping intact. HTML table cells escape "\" and "|" in one pass. The hover audit accepts "<" as the deliberate form of a literal "<". Also carries the Prettier formatting from the CI maintenance run for these files. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(data): write literal angle brackets in EEex prose as < Applied from the reviewed generated-data-patch artifact of CI run 35853789501. Prose such as "Array<byte,16>" and "[0, <max id in .IDS>]" now carries the entity form instead of a backslash escape; the rendered text is unchanged. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Owner
|
@dependabot rebase |
Bumps the codeql group with 2 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.38.0 to 4.38.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b96794f...1c5b675) Updates `github/codeql-action/analyze` from 4.38.0 to 4.38.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b96794f...1c5b675) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql - dependency-name: github/codeql-action/init dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/codeql-c83b7ed659
branch
from
September 23, 2026 12:13
a00a6f8 to
e78237e
Compare
dependabot
Bot
deleted the
dependabot/github_actions/codeql-c83b7ed659
branch
September 23, 2026 12:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the codeql group with 2 updates in the / directory: github/codeql-action/init and github/codeql-action/analyze.
Updates
github/codeql-action/initfrom 4.38.0 to 4.38.1Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
1c5b675Merge pull request #4152 from github/update-v4.38.1-a65b83a73a97cdcaAdd changelog entry for #4146cc6c691Update changelog for v4.38.1a65b83aMerge pull request #4146 from github/henrymercer/per-language-bundles-pr07fa87dClarify the latest-nightly eligibility exceptionf18f353Describe the bundle URL resolverecec9b5Share per-language telemetry fields without renaming79fe3a1Move download telemetry into the status-report directoryead1f7dRename the platform module549d498Simplify per-language platform eligibility checksUpdates
github/codeql-action/analyzefrom 4.38.0 to 4.38.1Release notes
Sourced from github/codeql-action/analyze's releases.
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
1c5b675Merge pull request #4152 from github/update-v4.38.1-a65b83a73a97cdcaAdd changelog entry for #4146cc6c691Update changelog for v4.38.1a65b83aMerge pull request #4146 from github/henrymercer/per-language-bundles-pr07fa87dClarify the latest-nightly eligibility exceptionf18f353Describe the bundle URL resolverecec9b5Share per-language telemetry fields without renaming79fe3a1Move download telemetry into the status-report directoryead1f7dRename the platform module549d498Simplify per-language platform eligibility checks