)]}'
{
  "log": [
    {
      "commit": "269bdfdea30accc5ec3cd8e41012b024a0a88910",
      "tree": "5dddd9951a55e08397137a6b46b400bb3c4755e3",
      "parents": [
        "3533ae1e81fdf9aab93f1d579cddeb5c5b3a2839"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Nov 13 01:06:39 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Nov 13 01:06:39 2026"
      },
      "message": "Swap the arguments to `has` (#2758)\n\nTowards #2616\n\nThese were originally written with the callback argument first because\nit adds a slight convenience in an IDE where the fields can be\nautocompleted before having to type the name argument. It\u0027s more common\nin Dart for the callback argument to be trailing, and it reads nicer\nwith the name argument first.\n\nAdd fix data to correct use sites. Migrate `has2` call sites in `checks`\nand `checks_codegen` back to `has`, and keep `has2` forwarding to `has`\nuntil downstream `has2` callers are migrated."
    },
    {
      "commit": "3533ae1e81fdf9aab93f1d579cddeb5c5b3a2839",
      "tree": "e15fa49073cc337a02b8c1c764493539d4d74aa1",
      "parents": [
        "5680b0b16e3ba11fbee2dc4772c31a662ef29aed"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Nov 10 23:06:08 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Nov 10 23:06:08 2026"
      },
      "message": "Never retry tearDownAll (#2815)\n\nA retried `tearDownAll` didn\u0027t run any of its callbacks again.\n`Invoker.runTearDowns` removes each callback from the declarer\u0027s list\nbefore running it, so by the time a retry started the list was empty. The\nretry always passed, which hid the original failure.\n\nGive the synthetic `(tearDownAll)` test `retry: 0` so a failure fails the\nrun, whatever `retry` the group, suite, or tags configure.\nPlatform-specific metadata, such as `on_platform` in `dart_test.yaml`, is\nmerged into the test\u0027s metadata later by `forPlatform`, so clear the retry\nin those entries too. `setUpAll` still retries.\n\nWe chose not to make `tearDownAll` retries work. Re-running cleanup\ncorrectly means tracking which callbacks failed, including ones that time\nout or fail asynchronously, and the complexity cost is higher than the\nutility. Teardown callbacks are often not safe to run twice anyway. A\n`tearDownAll` callback that can fail on flaky cleanup should handle that\nfailure itself, for example by retrying within the callback.\n\nThis only surfaces failures that a retry was already hiding.\n\nFixes #2800"
    },
    {
      "commit": "5680b0b16e3ba11fbee2dc4772c31a662ef29aed",
      "tree": "43ce8d133b08fba984b9ab673d705f7e8da558ae",
      "parents": [
        "b8dc888aefaa9bd5c4969b39bb7a7baa5cb37e14"
      ],
      "author": {
        "name": "Sigurd Meldgaard",
        "email": "sigurdm@google.com",
        "time": "Fri Nov 06 11:52:11 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Nov 06 11:52:11 2026"
      },
      "message": "Add globalSetup and addGlobalTearDown APIs for cross-suite setup and teardown (#2714)\n\nAdds `globalSetup()` and `addGlobalTearDown()` APIs in `package:test_api` / `package:test` to execute shared global setup scripts once on the host test runner, memoizing results across all test suites and executing registered teardowns when the test runner closes.\n\nAddresses #2225\n\nThe main motivation is to support setup shared across multiple test suites (`_test.dart` files). Examples include:\n* Precompiling a binary used by multiple end-to-end tests\n* Provisioning test databases or starting local test servers\n\n### Example\n```dart\n// test/setup_server.dart\nimport \u0027dart:io\u0027;\nimport \u0027package:test/global.dart\u0027;\n\nFuture\u003cMap\u003cString, dynamic\u003e\u003e setUp() async {\n  var server \u003d await HttpServer.bind(\u0027localhost\u0027, 0);\n  addGlobalTearDown(() async \u003d\u003e await server.close(force: true));\n  return {\u0027port\u0027: server.port};\n}\n\n// test/service_test.dart\nimport \u0027package:test/test.dart\u0027;\n\nvoid main() {\n  test(\u0027connects to server\u0027, () async {\n    final config \u003d await globalSetup(\n      Uri(path: \u0027/test/setup_server.dart\u0027),\n    ) as Map;\n    final port \u003d config[\u0027port\u0027] as int;\n    // ...\n  });\n}\n```\n\n### Key Features\n* **`globalSetup(Uri uri)`**:\n  * Runs the Dart file at `uri` in an isolate on the host runner and returns its JSON-encodable result.\n  * Memoizes the JSON-encoded result so the script only executes once per canonical URI, while returning an independent decoded value to each caller.\n  * Must be called from within a running test or a `setUp()` / `setUpAll()` callback.\n  * Bootstraps isolates via an in-memory `data:` URI using `Isolate.spawnUri` (sharing architecture with `spawnHybridUri`), avoiding filesystem compilation or runner-specific compiler hooks.\n* **`addGlobalTearDown(FutureOr\u003cvoid\u003e Function() callback)`** (exported from `package:test/global.dart`):\n  * Called from within a setup script to register cleanup tasks.\n  * Executed in reverse registration order (LIFO) when the test runner closes.\n  * Best-effort cleanup: all registered teardowns run even if an earlier teardown throws, with errors reported to stderr and runner exiting with code 1.\n  * 30-second per-isolate timeout to prevent hanging teardowns.\n* **URI Resolution**:\n  * **Root-relative** (`Uri(path: \u0027/test/setup.dart\u0027)`): Resolved relative to package root (`pubspec.yaml`).\n  * **`package:` URIs** (`Uri.parse(\u0027package:my_pkg/test_helpers.dart\u0027)`): Resolved synchronously via package config.\n  * **Relative URIs** (`Uri(path: \u0027setup.dart\u0027)` or `Uri(path: \u0027../setup.dart\u0027)`): Resolved relative to the executing test suite\u0027s directory.\n  * **`file:` URIs**: Resolved as absolute filesystem paths.\n  * Fragments are automatically removed for consistent compilation caching. Relative, root-relative, and file URIs strictly prohibit query parameters.\n* **Cross-Platform Support**:\n  * Dispatches over `test_channel`, allowing browser, Node, and VM tests alike to trigger host-side setup.\n* **Standalone Execution Support**:\n  * Tests run directly via `dart \u003ctest_file\u003e.dart` execute setup scripts using a standalone scaffolding fallback and run teardowns on process exit.\n* **Flutter Compatibility**:\n  * Works out of the box with `flutter test` without runner-level code changes."
    },
    {
      "commit": "b8dc888aefaa9bd5c4969b39bb7a7baa5cb37e14",
      "tree": "6711ba5e05fdd3a1553eb8423bb0a26297f49eaa",
      "parents": [
        "66e062c4b101b841dd53c9e0555e85a203a5edfd"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Nov 06 02:11:37 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Nov 06 02:11:37 2026"
      },
      "message": "[checks_codegen] Skip private fields and fields referencing private types (#2782)\n\nThe generated extension is written to a separate `.checks.dart` library, so it\ncannot access private members or private types from other libraries. Generating\na getter for a private member or for a public member whose type mentions a\nprivate type produced code which failed to compile, for example:\n\n    _i1.Subject\u003cint\u003e get _privateField \u003d\u003e\n        has2(\u0027_privateField\u0027, (v) \u003d\u003e v._privateField);\n\nor a return type referencing `_i2._Private`.\n\nSkip private fields and fields whose getter return type references any private\ninterface element—including in type arguments, function return/parameter/bound\ntypes, record fields, and instantiated class type parameter bounds—before\ncollecting referenced elements for import resolution.\n\nAlso fail with `InvalidGenerationSourceError` when `@CheckExtensions` directly\nlists a private class."
    },
    {
      "commit": "66e062c4b101b841dd53c9e0555e85a203a5edfd",
      "tree": "0bbe5a0532e17d68724a28e1fa889e081b4644e9",
      "parents": [
        "2a9e01756f42123102a34faf2964130ba7e0f77a"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Nov 06 00:05:36 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Nov 06 00:05:36 2026"
      },
      "message": "[checks_codegen] Generate full field types with imports (#2781)\n\nGenerated getters referenced the field type by the name of its element\nonly, so type arguments were never imported and function typed fields\nwere skipped entirely. Imports were also searched only among the test\nlibrary\u0027s direct imports, so types reached by the checked class through\na re-export fell back to `src/` libraries or uncompilable `dart:_*` SDK\nlibraries.\n\nFirst walk the checked classes and their field types to collect every\nreferenced interface element and resolve an import URI for each, then\nemit type references synchronously from the analyzer `DartType`:\n\n- Interface types import the library for each element, including within\n  type arguments.\n- Function types, including generic function types with bounds, and\n  record types are emitted structurally.\n- `dynamic`, `void`, and `Never` are emitted directly.\n- Type parameters of the checked class are replaced with their bounds by\n  reading getter types from the class instantiated to bounds. The\n  extension is on the raw type, so this matches the static type of\n  `v.field`.\n- Unresolvable types (`InvalidType`) fail naming the class and field,\n  with a source span on the field and a hint to check for a missing\n  build dependency.\n\nFunction typed fields now get getters. Fields without a getter, such as\nthose introduced by a lone setter, are skipped.\n\nImport resolution searches for a library exporting each non-public-SDK\nelement in order:\n\n1. The imports of the test library.\n2. The imports of every library declaring a referenced element.\n3. For elements declared in `dart:_*` libraries, public SDK libraries:\n   first those reachable through imports and exports from the test and\n   declaring libraries (so e.g. `HttpStatus` prefers `dart:io` over\n   `dart:html` in a VM program), then any remaining public SDK\n   libraries, each sorted by URI.\n\nThe first two groups prefer libraries outside `src/`. If no library\nexports an element, fall back to its declaring library (which may be in\n`src/`), or fail if that is a `dart:_*` library.\n\nNote on conditional directives: `build_runner` resolves code with empty\n`DeclaredVariables`, so conditional `import`/`export` directives always\nfollow their default URI during codegen, never an `if (dart.library.*)`\nbranch. When a barrel conditionally exports `src/` implementations,\ncodegen now imports the barrel rather than the default `src/` stub, so\ntest compilation evaluates the condition for the target platform. When a\ndeclaring library uses a conditional `import` directly, codegen still\nsees only the default branch: a stub default yields the stub\u0027s types as\nbefore, while an IO default exposing types like `HttpHeaders` or\n`HttpStatus` now emits `dart:io` (compiling on VM, instead of emitting\n`dart:_http`/`dart:_internal` which failed everywhere) but still will\nnot compile for web unless the test library imports a compatible\nexporter."
    },
    {
      "commit": "2a9e01756f42123102a34faf2964130ba7e0f77a",
      "tree": "659b91f7b6d4994afb9369bbc7aec75ad1bd5ba9",
      "parents": [
        "55cd5cd521877c15fe09721974a2150e182b14a9"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Nov 01 03:47:24 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Nov 01 03:47:24 2026"
      },
      "message": "Bump the github-actions group with 6 updates (#2813)\n\nBumps the github-actions group with 6 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [dart-lang/ecosystem/.github/workflows/health.yaml](https://github.com/dart-lang/ecosystem) | `78abf72b3cfcc7c6c822032d8915153019fe79b7` | `27c2fc841818cce349e1f424af51cca9ea381f47` |\n| [dart-lang/ecosystem/.github/workflows/post_summaries.yaml](https://github.com/dart-lang/ecosystem) | `78abf72b3cfcc7c6c822032d8915153019fe79b7` | `27c2fc841818cce349e1f424af51cca9ea381f47` |\n| [dart-lang/setup-dart/.github/workflows/publish.yml](https://github.com/dart-lang/setup-dart) | `a5bff6576dfc51b47eb77d4b7084bba6a4daf8d2` | `a1d8526c926344e01ba48a7368788c05ac98cb29` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |\n| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.39.1` |\n\nUpdates `dart-lang/ecosystem/.github/workflows/health.yaml` from 78abf72b3cfcc7c6c822032d8915153019fe79b7 to 27c2fc841818cce349e1f424af51cca9ea381f47\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/27c2fc841818cce349e1f424af51cca9ea381f47\"\u003e\u003ccode\u003e27c2fc8\u003c/code\u003e\u003c/a\u003e Fix publish workflow pins, add tag_prefix to health, and update docs (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/480\"\u003e#480\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/05641a9209256ce1c828324b5dc62d5d509f0e08\"\u003e\u003ccode\u003e05641a9\u003c/code\u003e\u003c/a\u003e Restore deprecated publish.yaml workflow and firehose CLI entrypoint (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/479\"\u003e#479\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/dart-lang/ecosystem/compare/78abf72b3cfcc7c6c822032d8915153019fe79b7...27c2fc841818cce349e1f424af51cca9ea381f47\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `dart-lang/ecosystem/.github/workflows/post_summaries.yaml` from 78abf72b3cfcc7c6c822032d8915153019fe79b7 to 27c2fc841818cce349e1f424af51cca9ea381f47\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/27c2fc841818cce349e1f424af51cca9ea381f47\"\u003e\u003ccode\u003e27c2fc8\u003c/code\u003e\u003c/a\u003e Fix publish workflow pins, add tag_prefix to health, and update docs (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/480\"\u003e#480\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/05641a9209256ce1c828324b5dc62d5d509f0e08\"\u003e\u003ccode\u003e05641a9\u003c/code\u003e\u003c/a\u003e Restore deprecated publish.yaml workflow and firehose CLI entrypoint (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/479\"\u003e#479\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/dart-lang/ecosystem/compare/78abf72b3cfcc7c6c822032d8915153019fe79b7...27c2fc841818cce349e1f424af51cca9ea381f47\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `dart-lang/setup-dart/.github/workflows/publish.yml` from a5bff6576dfc51b47eb77d4b7084bba6a4daf8d2 to a1d8526c926344e01ba48a7368788c05ac98cb29\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/dart-lang/setup-dart/blob/main/CHANGELOG.md\"\u003edart-lang/setup-dart/.github/workflows/publish.yml\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.8.2-wip\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003epublish.yml\u003c/code\u003e to a three-job workflow (\u003ccode\u003evalidate\u003c/code\u003e, \u003ccode\u003epackage\u003c/code\u003e, \u003ccode\u003epublish\u003c/code\u003e) supporting hermetic package archiving (\u003ccode\u003e--to-archive\u003c/code\u003e / \u003ccode\u003e--from-archive\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003esdk\u003c/code\u003e input to \u003ccode\u003epublish.yml\u003c/code\u003e to support publishing packages that require a non-stable Dart SDK (e.g., \u003ccode\u003ebeta\u003c/code\u003e or \u003ccode\u003edev\u003c/code\u003e).\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.8.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate workflows to pin \u003ccode\u003eactions/checkout\u003c/code\u003e to a commit SHA.\u003c/li\u003e\n\u003cli\u003eHarden workflow permissions to \u003ccode\u003econtents: read\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003epublish.yml\u003c/code\u003e reusable workflow to reference \u003ccode\u003esetup-dart@v1.8.0\u003c/code\u003e and latest \u003ccode\u003esetup-flutter\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to \u003ccode\u003e6.28.0\u003c/code\u003e and \u003ccode\u003e@vercel/ncc\u003c/code\u003e to \u003ccode\u003e0.44.1\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.8.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a problem matcher for \u003ccode\u003edart analyze\u003c/code\u003e to automatically create inline annotations on GitHub pull requests.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003epublish.yml\u003c/code\u003e reusable workflow to reference \u003ccode\u003esetup-dart@v1.7.2\u003c/code\u003e (running on Node 24) (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/188\"\u003e#188\u003c/a\u003e[]).\u003c/li\u003e\n\u003cli\u003eUpdate GitHub Action dependencies (\u003ccode\u003eactions/checkout\u003c/code\u003e v7).\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to \u003ccode\u003e6.27.0\u003c/code\u003e and update npm dependencies.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/188\"\u003e#188\u003c/a\u003e: \u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/188\"\u003edart-lang/setup-dart#188\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.7.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Node.js requirement to Node 24.\u003c/li\u003e\n\u003cli\u003eFix open Dependabot alerts by bumping \u003ccode\u003eundici\u003c/code\u003e to \u003ccode\u003e\u0026gt;\u003d6.24.0\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUpdate GitHub Action dependencies (\u003ccode\u003e@actions/core\u003c/code\u003e, \u003ccode\u003e@actions/exec\u003c/code\u003e, \u003ccode\u003e@actions/tool-cache\u003c/code\u003e, \u003ccode\u003e@actions/http-client\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eUpdate workflow actions to their latest versions (\u003ccode\u003eactions/checkout\u003c/code\u003e v6, \u003ccode\u003esetup-flutter\u003c/code\u003e).\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.7.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRoll \u003ccode\u003eundici\u003c/code\u003e dependency to address \u003ca href\u003d\"https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975\"\u003eCVE-2025-22150\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eUpdate to the latest npm dependencies.\u003c/li\u003e\n\u003cli\u003eRecompile the action using the new Dart / JavaScript interop.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.7.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eInstall flutter sdk in publishing step, allowing Flutter packages to be\npublished (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/68\"\u003e#68\u003c/a\u003e[])\u003c/p\u003e\n\u003cp\u003e\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/68\"\u003e#68\u003c/a\u003e: \u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/68\"\u003edart-lang/setup-dart#68\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix zip path handling on Windows 11 (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/118\"\u003e#118\u003c/a\u003e[])\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/118\"\u003e#118\u003c/a\u003e: \u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/118\"\u003edart-lang/setup-dart#118\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.6.4\u003c/h2\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/a1d8526c926344e01ba48a7368788c05ac98cb29\"\u003e\u003ccode\u003ea1d8526\u003c/code\u003e\u003c/a\u003e Add sdk input to publish.yml reusable workflow (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/206\"\u003e#206\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/dart-lang/setup-dart/compare/a5bff6576dfc51b47eb77d4b7084bba6a4daf8d2...a1d8526c926344e01ba48a7368788c05ac98cb29\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.4 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cp\u003eThis release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted\nservices moved to new infrastructure.\u003c/p\u003e\n\u003cp\u003eFor changes to checks and results, and what the infrastructure move means for you, see the\n\u003ca href\u003d\"https://github.com/ossf/scorecard/releases/tag/v5.6.0\"\u003eScorecard v5.6.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe action\u0027s container image is built with Go 1.27.2 on a refreshed distroless base. by\n\u003ca href\u003d\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe installer (\u003ccode\u003ecmd/installer\u003c/code\u003e) now creates \u003ccode\u003e.github/workflows/scorecard.yml\u003c/code\u003e, and still\nrecognizes existing \u003ccode\u003escorecards.yml\u003c/code\u003e and \u003ccode\u003escorecards-analysis.yml\u003c/code\u003e workflows. by \u003ca href\u003d\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Scorecard version in results now always matches the Scorecard release the action is built\nwith. by \u003ca href\u003d\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ossf/scorecard-action/pull/1718\"\u003eossf/scorecard-action#1718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe action no longer prints the GitHub token variable while validating its options. by\n\u003ca href\u003d\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eresults_format\u003c/code\u003e accepts \u003ccode\u003eintoto\u003c/code\u003e, which wraps the JSON results in an in-toto attestation\nstatement. by \u003ca href\u003d\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a daily canary against Scorecard main by \u003ca href\u003d\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ossf/scorecard-action/pull/1711\"\u003eossf/scorecard-action#1711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to the v5.6.0 candidate and fix the canary toolchain by \u003ca href\u003d\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ossf/scorecard-action/pull/1714\"\u003eossf/scorecard-action#1714\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update\nRELEASE.md by \u003ca href\u003d\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ossf/scorecard-action/pull/1716\"\u003eossf/scorecard-action#1716\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump Scorecard to v5.6.0 by \u003ca href\u003d\"https://github.com/justaugustus\"\u003e\u003ccode\u003e@​justaugustus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ossf/scorecard-action/pull/1719\"\u003eossf/scorecard-action#1719\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/arpitjain099\"\u003e\u003ccode\u003e@​arpitjain099\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/ossf/scorecard-action/pull/1709\"\u003eossf/scorecard-action#1709\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/puerco\"\u003e\u003ccode\u003e@​puerco\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/ossf/scorecard-action/pull/1702\"\u003eossf/scorecard-action#1702\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e\"\u003e\u003ccode\u003efa7117d\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.5.0 release (\u003ca href\u003d\"https://redirect.github.com/ossf/scorecard-action/issues/1720\"\u003e#1720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c\"\u003e\u003ccode\u003ecef4eb5\u003c/code\u003e\u003c/a\u003e :seedling: Bump Scorecard to v5.6.0 (\u003ca href\u003d\"https://redirect.github.com/ossf/scorecard-action/issues/1719\"\u003e#1719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe\"\u003e\u003ccode\u003ebedb16e\u003c/code\u003e\u003c/a\u003e :sparkles: Add intoto results format (\u003ca href\u003d\"https://redirect.github.com/ossf/scorecard-action/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77\"\u003e\u003ccode\u003ede70347\u003c/code\u003e\u003c/a\u003e Remove the leftover debug print of the auth token (\u003ca href\u003d\"https://redirect.github.com/ossf/scorecard-action/issues/1709\"\u003e#1709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a\"\u003e\u003ccode\u003e950873d\u003c/code\u003e\u003c/a\u003e :seedling: Derive the reported Scorecard version from go.mod (\u003ca href\u003d\"https://redirect.github.com/ossf/scorecard-action/issues/1718\"\u003e#1718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7\"\u003e\u003ccode\u003e2ce8ee4\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (\u003ca href\u003d\"https://redirect.github.com/ossf/scorecard-action/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9\"\u003e\u003ccode\u003eaabdf5a\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group across 1 directory with 7 updates (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f\"\u003e\u003ccode\u003eb4b9adf\u003c/code\u003e\u003c/a\u003e :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04\"\u003e\u003ccode\u003e4e9f2a2\u003c/code\u003e\u003c/a\u003e :book: RELEASE.md: Document drafting release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea\"\u003e\u003ccode\u003ef618e8b\u003c/code\u003e\u003c/a\u003e :seedling: Build the image with Go 1.27.2 and refresh distroless\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-artifact` from 7.0.1 to 7.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdates \u003ccode\u003e@​actions/artifact\u003c/code\u003e to v6.3.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/pull/821\"\u003eactions/upload-artifact#821\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\"\u003ehttps://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003e\u003ccode\u003ecf430e0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/issues/822\"\u003e#822\u003c/a\u003e from actions/tunc-d-prepare-upload-v7-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469\"\u003e\u003ccode\u003ec2acded\u003c/code\u003e\u003c/a\u003e chore: prepare v7.0.2 release\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a\"\u003e\u003ccode\u003e4687c1b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/issues/821\"\u003e#821\u003c/a\u003e from actions/tunc-d-upload-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719\"\u003e\u003ccode\u003e8cbe1be\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.2 to 4.39.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.39.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.39.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.39.1 - 21 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3\"\u003e2.27.3\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4256\"\u003e#4256\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.39.0 - 15 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.20.7. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4205\"\u003e#4205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/analyze\u003c/code\u003e step now validates that a correct argument for the \u003ccode\u003echeckout_path\u003c/code\u003e input has been provided. The \u003ccode\u003echeckout_path\u003c/code\u003e input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by \u003ccode\u003ecodeql-action/init\u003c/code\u003e, then the CodeQL Action now produces a warning. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4148\"\u003e#4148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolved an issue with third-party caching implementations that prevented caches from being restored correctly. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4206\"\u003e#4206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as \u003ccode\u003ecodeql-action/init\u003c/code\u003e. This primarily benefits customers who are using GitHub instances other than \u003ccode\u003egithub.com\u003c/code\u003e where the \u003ccode\u003ecodeql-action/start-proxy\u003c/code\u003e step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4198\"\u003e#4198\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.3 - 08 Oct 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4188\"\u003e#4188\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2\"\u003e2.27.2\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4203\"\u003e#4203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4184\"\u003e#4184\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/9b3254085494b55a0f7c4c2b3d2d52cc712ce370\"\u003e\u003ccode\u003e9b32540\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4257\"\u003e#4257\u003c/a\u003e from github/update-v4.39.1-c5a2f4b0f\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/b5e1ed9574dcfa81c88c318140f3b3e5c199bfb3\"\u003e\u003ccode\u003eb5e1ed9\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/20f5ec39109073afe1789b098456b2be0164f4ee\"\u003e\u003ccode\u003e20f5ec3\u003c/code\u003e\u003c/a\u003e Update changelog for v4.39.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/c5a2f4b0fe28ca06eaaeb86fb05a5f612ae293f9\"\u003e\u003ccode\u003ec5a2f4b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4245\"\u003e#4245\u003c/a\u003e from github/henrymercer/graduate-overlay-trap-caching\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/61a5a80dd98ad1b9679010141a46cace51065761\"\u003e\u003ccode\u003e61a5a80\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4256\"\u003e#4256\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.27.3\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/3dd33f8b69588bd9591684b2dca169eb612f5ed5\"\u003e\u003ccode\u003e3dd33f8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4249\"\u003e#4249\u003c/a\u003e from github/mbg/upload-improvements-for-4223\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/b96e3390db93dc46c2c3753a94b87c0d734b0b61\"\u003e\u003ccode\u003eb96e339\u003c/code\u003e\u003c/a\u003e Change comment for \u003ccode\u003egetConfig\u003c/code\u003e call in \u003ccode\u003eupload-sarif\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/7fa45180db8d657b23ded3636b5d8583aec6ddfe\"\u003e\u003ccode\u003e7fa4518\u003c/code\u003e\u003c/a\u003e Use \u003ccode\u003eshouldSkipSarifUpload\u003c/code\u003e in \u003ccode\u003eanalyze-action.ts\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/a69c7cb332d56f616fcadef002884523c71e8d1c\"\u003e\u003ccode\u003ea69c7cb\u003c/code\u003e\u003c/a\u003e Document that setting the env vars to \u003ccode\u003efalse\u003c/code\u003e takes precedence\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/74ddcd9f65683791ab07eccd074b4ba145d89ea6\"\u003e\u003ccode\u003e74ddcd9\u003c/code\u003e\u003c/a\u003e Fix typo in comment\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...9b3254085494b55a0f7c4c2b3d2d52cc712ce370\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s major version (unless you unignore this specific dependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s minor version (unless you unignore this specific dependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\u003c/details\u003e"
    },
    {
      "commit": "55cd5cd521877c15fe09721974a2150e182b14a9",
      "tree": "5bffedff51051f3abf6d5e279fad7d2fbd562b39",
      "parents": [
        "10dc78c0ea5e7279f783ed1c75638df97d158c26"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Oct 30 20:43:47 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 30 20:43:47 2026"
      },
      "message": "Migrate publishing workflows from firehose to setup-dart (#2812)\n\nMove PR publish validation into health.yaml (enabled in fail_on to preserve\nblocking validation errors) and remove Publish from post_summaries.yaml.\n\nUpdate publish.yaml to extract the package directory from the tag and call\ndart-lang/setup-dart\u0027s publish.yml workflow.\n\nResolve CI failures with the prior publish workflow which is no longer\nsupported by firehose."
    },
    {
      "commit": "10dc78c0ea5e7279f783ed1c75638df97d158c26",
      "tree": "66edbc24d237835e99c473de5cffc787beabe3c2",
      "parents": [
        "c11ad06d03e07d4bfa5a7032f04054381b8bb497"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Oct 30 18:21:53 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 30 18:21:53 2026"
      },
      "message": "[checks] Describe what the stream did in failures (#2811)"
    },
    {
      "commit": "c11ad06d03e07d4bfa5a7032f04054381b8bb497",
      "tree": "3b73d33cf78a03531d79844364cbb1c0078eb58a",
      "parents": [
        "0137b43e02ee024d4e10f435621d794fa00964ea"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Oct 30 15:59:57 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 30 15:59:57 2026"
      },
      "message": "[checks] Add CheckFailure.describeNested (#2793)\n\nExpectations which soft check a condition against part of their value,\nsuch as `IterableChecks.every`, describe the failure within the `which` of\ntheir own rejection. Each of `every`, `IterableChecks.deepEquals`,\n`StreamChecks.inOrder`, `StreamChecks.anyOf`, and\n`IterableChecks.pairwiseMatches` formatted the nested failure by hand, each\nslightly differently, and each dropped detail in some cases. Two bugs in\n`every` were reported in\nhttps://github.com/dart-lang/test/pull/2784#pullrequestreview-5470590715.\n\nAdd `CheckFailure.describeNested`, which describes a failure in the same\nformat as a failure message from `check`. A soft checked condition has no\nlabel for its root subject, so the caller provides its own line describing\nthe value, such as `has an element at index 0 that:`. When the actual does\nnot collapse to a single line, a line with only `Actual:` takes the place\nof the `Actual: \u003clabel\u003e that:` line from `check`. `check` and\n`describeNested` share a private method which produces the \"Actual:\" and\n\"Which:\" lines, so the two formats agree by construction. `CheckFailure` is\nexported only from `package:checks/context.dart`, so the method is\navailable to authors of expectations without being part of the API for\nwriting checks.\n\nUse `describeNested` from `every`, `deepEquals`, `inOrder`, `anyOf`, and\n`pairwiseMatches`.\n\n- `every` and `deepEquals` lost the property name when the nested failure\n  collapsed:\n\n      Which: has an element at index 0 that:\n        Actual: \u0027foo\u0027\n\n  It now reads `Actual: has field: \u0027foo\u0027`. `deepEquals` also uses `Which:`\n  in place of `which`.\n- `inOrder` and `anyOf` dropped the actual description entirely when a\n  condition failed without collapsing, including when the actual collapsed\n  to the root. They now always include an `Actual:` line, and no longer\n  repeat an `Expected:` line for a collapsed failure since the outer\n  description already lists each condition.\n- `pairwiseMatches` keeps the description of the condition for the element,\n  followed by `Actual:` in place of `Actual element at index N:`, so the\n  expected and actual descriptions are separated:\n\n      does not have an element at index 0 that:\n        has field: \u0027foo\u0027\n        has field that has length: \u003c4\u003e\n        Actual:\n          has field: \u0027foo\u0027\n          has field that has length: \u003c3\u003e\n          Which: is not equal\n\nFix the failure details when a soft check rejects a precondition such as\n`isA\u003cT\u003e()` and further expectations follow it, which also affected `every`:\n\n    check([Wrapper(123)])\n        .every(.it()..value.isA\u003cFoo\u003e().field.equals(\u0027bar\u0027));\n\n    Failed assertion: \u0027foundDepth \u003d\u003d -1\u0027: is not true.\n\n`_fullDetails` assumed that when a subject itself failed, the failing clause\nwas the last one added to it. That holds for `check`, where a failure\nthrows before anything else is added, but not for a soft check, where the\nfollowing nested clauses are still added, nor for an unawaited expectation,\nwhich can fail after later clauses are added. Pass the rejected clause from\neach failure through to `_fullDetails` instead of relying on\n`_clauses.last`. A rejected guard is also no longer added a second time as\na `_GuardClause`, since the failing expectation clause already describes\nit, so the precondition appears once in the description.\n\nOmit the clauses after the failing one from the failure details. They were\ndescribed under `Actual:` as if the value satisfied them, and when the\nfailing clause came first the actual collapsed onto the root line with the\nlater clauses printed as its children.\n\nKeep asynchronous expectations in the order they were made, and leave out\nany which have not finished when another expectation fails. Nested\nasynchronous expectations such as `completes` and `emits` added their clause\nonly once the value arrived, so an expectation made after them was described\nbefore them. An expectation from\n`Context.expectAsync` added its clause before its predicate finished, so it\nwas described as satisfied if a later expectation failed first. Both now\nadd a placeholder which keeps their place and is not described until they\nfinish. Expectations from `Context.expectUnawaited`, such as\n`doesNotComplete`, are never awaited by the check and are still described\nas satisfied until they fail.\n\nMake the `CheckFailure` and `FailureDetail` constructors private. Failures\nonly come from soft checking a `Condition`, since `Condition` and `Context`\nare `abstract final`, and no API accepts a failure constructed outside the\npackage. The public `FailureDetail` constructor also recorded that any\ncustom `actual` started with the root label line, so `describeNested`\ndropped its first line."
    },
    {
      "commit": "0137b43e02ee024d4e10f435621d794fa00964ea",
      "tree": "40d66e329415b41b5eb401a90af7c423c2e79cdb",
      "parents": [
        "50c9f454da0f9abd5aa708c81b94f02e3f511836"
      ],
      "author": {
        "name": "Shriraj Jadhav",
        "email": "shreerajjadhav19@gmail.com",
        "time": "Fri Oct 30 00:10:43 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 30 00:10:43 2026"
      },
      "message": "[checks] Use the Iterable.last member for the last expectation (#2807)\n\nFixes #2746\n\nThe `last` expectation iterated with the iterator to find the final\nelement, which skips any `last` implementation on the iterable. Check\n`isEmpty` to keep the same \"has no elements\" rejection, then read\n`actual.last`."
    },
    {
      "commit": "50c9f454da0f9abd5aa708c81b94f02e3f511836",
      "tree": "90a2cda348325c6000f8c46f3f619e35d2fa62b0",
      "parents": [
        "6d747209b2565e648f1c8d36ecb99d206a3f1e0e"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Oct 29 22:11:39 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 29 22:11:39 2026"
      },
      "message": "[checks] Collapse clauses for described conditions (#2794)\n\n`IterableChecks.any`, `IterableChecks.every`,\n`MapChecks.containsKeyThat`, and `MapChecks.containsValueThat` embed the\ndescription of a condition. They collapse to a single line at the root,\nthrough a predicate noun such as `an iterable containing a value that is\ngreater than \u003c7\u003e`, but their clause always used the multi-line form of a\nlabel followed by the indented description. Where the clause itself is\nshown, such as when one of these expectations is nested inside the\ncondition of another, the description never collapsed, while the same\ncheck reached through `has` did. Reported in\nhttps://github.com/dart-lang/test/pull/2784#discussion_r4230540680:\n\n    check([[1]]).any(.it()..any(.it()..isGreaterThan(1)));\n\n    Expected: a List\u003cList\u003cint\u003e\u003e that:\n      contains a value that:\n        contains a value that:\n          is greater than \u003c1\u003e\n\nAdd an internal `describedClause` helper next to\n`describedPredicateNoun`. It joins the label to the description of the\ncondition on a single line when the condition describes in a single line\nand the result fits within 80 columns, and otherwise keeps the label\nfollowed by the indented description. Both helpers share the logic for\njoining and the length limit. Use it for the clauses of all four\nexpectations. The inner `any` above now describes itself as a single\nline, so the outer `any` collapses to a single `Expected:` line at the\nroot:\n\n    an iterable containing a value that contains a value that is\n    greater than \u003c1\u003e\n\nJoining the label of `every`, `only has values that`, to a description\nsuch as `is less than \u003c10\u003e` reads as `only has values that is less than\n\u003c10\u003e`. Describe the condition as `only has elements where each` instead,\nwhich reads as `only has elements where each is less than \u003c10\u003e` on one\nline, and `only has elements where each:` followed by the description\notherwise. The label is a predicate over the iterable ending with a\nsingular noun, so it also reads as a sentence when `every` is nested in\nanother condition, such as `an iterable where every element only has\nelements where each is less than \u003c10\u003e`. Change the predicate noun to\nmatch the wording: `an iterable where every element is less than \u003c10\u003e`."
    },
    {
      "commit": "6d747209b2565e648f1c8d36ecb99d206a3f1e0e",
      "tree": "4c2184e6fc3d90373357c774a4b48e6e744b70f1",
      "parents": [
        "434cf2fc155c7cc3a9b03ab656680fc107e7e70d"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Oct 28 22:12:45 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Oct 28 22:12:45 2026"
      },
      "message": "Fix a race in an expanded reporter retry test (#2810)\n\nFixes a flake in `expanded_reporter_test.dart` \"retry: does not report an\nattempt for errors after completion\", added in #2801. It failed on master\nin https://github.com/dart-lang/test/actions/runs/40722683531/job/122938155175:\nthe `+1: second test ...` line was missing and the output went straight to\n`+0 -1: second test ...`.\n\nThe first test scheduled its error with `Future(() { ... })`, so the test\nisolate raised it right after the test completed. The runner starts the\nnext test one event-loop turn after it receives the `complete` message. If\nthe error message was already queued by then, the first test moved to\nfailed before the second test started. Both orders are correct output, so\nthis changes the test rather than the runner.\n\nThe second test now triggers the first test\u0027s error, using the same\n`Completer` pattern as `retry_test.dart`. Only the stack trace lines in the\nexpected output change.\n\nLocally, the old fixture reproduced the CI output in 1 of 40 runs. The new\nfixture produced identical output in 60 of 60 runs."
    },
    {
      "commit": "434cf2fc155c7cc3a9b03ab656680fc107e7e70d",
      "tree": "ebdb13519cbd521027899b7710b91fd325050ec9",
      "parents": [
        "5967927edd6a632c853647358d396bfc2cde03a6"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Oct 28 16:06:26 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Oct 28 16:06:26 2026"
      },
      "message": "Enable incremental migration for argument swap (#2806)\n\nTowards #2616\n\nLanding ahead of #2758\n\nAdd a `has2` extension method on `Subject` which takes the `name`\nargument before the `extract` callback. This is the argument order that\n`has` will eventually use. It\u0027s more common in Dart for a callback\nargument to be trailing, and it reads better with the name first.\n\nThis package needs to roll to mono repos where an atomic fix to usage\nsites is more brittle than incremental fixes. Instead of swapping the\narguments to `has` in one breaking change, roll this version and migrate\nusages to `has2`. Then swap the arguments to `has`, migrate usages back,\nand remove `has2`. All of these steps will land before the next publish\nto pub.\n\nMigrate usages in this repo to `has2`, and update the `checks_codegen`\nbuilder to generate `has2` calls."
    },
    {
      "commit": "5967927edd6a632c853647358d396bfc2cde03a6",
      "tree": "a8bf47dbea8c68e135704386f91c3d958bf6a97d",
      "parents": [
        "0692e8ae904487fafbf92f60b4763e782172d2a9"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Oct 27 00:50:52 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 27 00:50:52 2026"
      },
      "message": "Diagnose browser connection failures and time them out with the suite load timeout (#2788)\n\nA wasm integration test failed with \"Timed out waiting for Firefox to\nconnect.\" and an empty \"Browser output:\"\n(https://github.com/dart-lang/test/actions/runs/37977193562/job/113978908374).\nAll three connection attempts had failed, but the error only showed the last\nattempt\u0027s output, and Firefox writes almost nothing to stdout or stderr, so\nthere was no way to tell how far the browser got.\n\n### Diagnostics\n\nWhen a browser fails to connect, describe each attempt: how long it waited,\nwhether the browser process was still running or its exit code, the command\nused to start it, its output, and the requests it made to the test server. A\nnew `BrowserRequestLog` wraps each compiler\u0027s server and records the host\npage, the resources it loads, and WebSocket upgrades, matched to the browser\nmanager by the `managerUrl` query parameter or the `Referer` header. Requests\nare labeled by file name so the server secret is not printed.\n\nSet Firefox preferences that print page console output and `dump()` calls to\nstdout, so errors in the host page show up in the browser output.\n\n### Connect timeout\n\nA browser had 30 seconds to connect, and one that didn\u0027t was replaced, up to\n3 attempts, regardless of `suite_load_timeout`. Following #2786, give the\nconnection until shortly before the suite load timeout instead, or no limit\nwithout one. Connecting and then loading the suite are consecutive steps of\nloading a suite, so they share that deadline, and loading gets whatever time\nconnecting left. A browser that times out uses the whole budget, so it isn\u0027t\nreplaced. Timeouts were the only failure that was retried; instead, retry a\nbrowser that starts and then exits before connecting, up to 3 attempts while\ntime remains. A process that fails to start, such as one with a missing\nexecutable, isn\u0027t retried.\n\nWithout a suite load timeout a browser that never connects now hangs the run\ninstead of failing, so add `suite_load_timeout: 2m` to the wasm and\nspawn_hybrid integration tests, which run in browsers on CI."
    },
    {
      "commit": "0692e8ae904487fafbf92f60b4763e782172d2a9",
      "tree": "a7c5de11ab9afc717fc14522c4ef167829888b27",
      "parents": [
        "da21f85a842c0a8fc79bfba66bffd6623190a7fb"
      ],
      "author": {
        "name": "Kevin Moore",
        "email": "kevmoo@users.noreply.github.com",
        "time": "Mon Oct 26 23:29:27 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 26 23:29:27 2026"
      },
      "message": "Remove mirror_matchers.dart from package:matcher (#2802)"
    },
    {
      "commit": "da21f85a842c0a8fc79bfba66bffd6623190a7fb",
      "tree": "42c075e30219df5c5743895c097512a26d5dae6c",
      "parents": [
        "e18fd1127794e02af2bb91b408573194e48ab5e2"
      ],
      "author": {
        "name": "Kevin Moore",
        "email": "kevmoo@users.noreply.github.com",
        "time": "Fri Oct 23 18:13:38 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 23 18:13:38 2026"
      },
      "message": "Tighten pull_request_label workflow permissions (#2804)"
    },
    {
      "commit": "e18fd1127794e02af2bb91b408573194e48ab5e2",
      "tree": "dcda45187408d2153768be077a2d46858a65805e",
      "parents": [
        "b4ef80c04637d3e10e8fabbb57c8bed28544003b"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Oct 22 22:38:51 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 22 22:38:51 2026"
      },
      "message": "Report tests that pass on retry as flaky (#2801)\n\nA test that failed and then passed on retry was reported inconsistently.\nA `setUpAll` or `tearDownAll` stayed in `Engine.failed` because the code\nthat removes a test from `failed` when a later attempt passes was skipped\nfor callbacks that are modeled as tests in the runner, but aren\u0027t what the\nuser considers a test case. These can cause failures when there is an\nerror, but don\u0027t count as success when they run without exception.\n\nThe summaries then reported a failure even though the overall run\nsucceeded, for example `::error::2 tests passed, 1 failed.` from the\nGitHub reporter or `+2 -1: All tests passed!` from the compact and\nexpanded reporters. Regular tests that passed on retry were counted as\npassed with no indication that they had failed.\n\n- Always remove a test from `failed` when it completes successfully, and\n  track tests that passed after a failed attempt in new\n  `LiveSuite.flaky` and `Engine.flaky` sets. A test that fails and is\n  then skipped on retry moves from `failed` to `skipped` instead of\n  being counted in both.\n- Add an `AttemptCounter` utility for reporters to track attempts\n  without changing `LiveTest` or the protocol between the runner and\n  test isolates.\n- compact, expanded, failures-only: show `[E] (attempt N of M)` for\n  tests with `retry`, except for errors after the final attempt, and add\n  `(N flaky)` to the final line. The expanded reporter also lists flaky\n  tests.\n- github: title flaky test groups `⚠️ \u003cname\u003e (passed on attempt N of M)`\n  and tests that failed every attempt `(failed after N attempts)`. Print\n  output and errors in the order they were emitted for all tests, add a\n  flaky count to the summary, and use a `::warning::` annotation when\n  the only problems are flaky tests.\n- json: add `testDone.retried` and bump the protocol to 0.1.2. A\n  synthetic test that passes on retry is now hidden, as the protocol\n  documents.\n\nA retried `tearDownAll` doesn\u0027t re-run its callbacks, so it always\npasses on retry; that is tracked separately in\nhttps://github.com/dart-lang/test/issues/2800."
    },
    {
      "commit": "b4ef80c04637d3e10e8fabbb57c8bed28544003b",
      "tree": "99c1603bc39807b9342e3f77af54eef1a50c5688",
      "parents": [
        "e3a7f2b66e4f4a12c3959820ae6071e87b517c85"
      ],
      "author": {
        "name": "Pranta Dutta",
        "email": "44747303+theprantadutta@users.noreply.github.com",
        "time": "Thu Oct 22 20:44:25 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 22 20:44:25 2026"
      },
      "message": "Fix compact reporter crash when the terminal is too narrow (#2799)\n\nResolves the crash reported in flutter/flutter#194569\n\nTruncate to just an ellipsis when the width is very small."
    },
    {
      "commit": "e3a7f2b66e4f4a12c3959820ae6071e87b517c85",
      "tree": "1c5d94c2b6cc8fe022c92aad161576ad7057020a",
      "parents": [
        "d1afeb14cc57a0487227f9c4e9485eece327b2af"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Oct 20 22:51:34 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 20 22:51:34 2026"
      },
      "message": "Check that web entrypoints don\u0027t import VM-only libraries (#2797)\n\nAdd a test that `package:test/test.dart`, `package:test/scaffolding.dart`,\nand `package:test/expect.dart` do not transitively import `dart:io`,\n`dart:isolate`, or other VM-only core libraries when conditional imports are\nresolved for the web. Platform-specific code must be behind a conditional\nimport with a stub, as with `coverage_stub.dart`.\n\nGeneralize `findPathToPackage` into `findPath`, which takes the platform to\nresolve conditional imports for and a predicate for the target URI.\n`_findImports` now keeps `dart:` URIs so they can be matched."
    },
    {
      "commit": "d1afeb14cc57a0487227f9c4e9485eece327b2af",
      "tree": "9a4149169cf9772f1d3037db408c5fe86ace580c",
      "parents": [
        "3f6c2f14410e2fa048456c24ddfc7ae339a22a15"
      ],
      "author": {
        "name": "Mouad Debbar",
        "email": "mouad.debbar@gmail.com",
        "time": "Sat Oct 17 00:41:51 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Oct 17 00:41:51 2026"
      },
      "message": "Confirmation that `tearDown` is called on timeout (#2798)\n\nAdd an end-to-end test that mirrors the repro and asserts\nthat `tearDown` output shows up after the timeout error.\n\nCloses #897"
    },
    {
      "commit": "3f6c2f14410e2fa048456c24ddfc7ae339a22a15",
      "tree": "02f29a606d5417ed4a8395e7f257111f1ae1060b",
      "parents": [
        "9bf69a88002d96855abf0a27ff09ca28ce087332"
      ],
      "author": {
        "name": "Jacob MacDonald",
        "email": "jakemac@google.com",
        "time": "Fri Oct 16 01:21:35 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 16 01:21:35 2026"
      },
      "message": "Enable asserts in the cli compiler (#2795)\n\nFixes #2718"
    },
    {
      "commit": "9bf69a88002d96855abf0a27ff09ca28ce087332",
      "tree": "22644d801356f85a4358651f44c0ae0cb0c58618",
      "parents": [
        "30acb69eb30369a1b9ad2adc4a86224393c197ef"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Oct 13 21:33:18 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 13 21:33:18 2026"
      },
      "message": "Reject asynchronous matchers inside isNot and anyOf (#2792)\n\nCloses #1637\n\nAsynchronous matchers report a pending result as a synchronous match and\nfail the test later. `isNot` inverts that placeholder into an immediate\nfailure, and `anyOf` short-circuits on it, so neither operator can combine\nasynchronous results correctly. For example `anyOf([completes, throwsA(x)])`\npasses synchronously no matter how the future completes, and the test may\nfail later even when one of the matchers would have matched.\n\n`isNot` and `anyOf` now match their operands in a zone that marks\nasynchronous matchers as disallowed. `AsyncMatcher.matches` and\n`doesNotComplete` throw an `ArgumentError` in that zone before starting any\nasynchronous work, which also catches asynchronous matchers nested under\nother operators. `expect` and `expectLater` clear the restriction, so\nexpectations made in callbacks run by an operator are unaffected.\n\n`AsyncMatcher` subclasses can override `mayMatchSynchronously` to defer the\ncheck until `matchAsync` returns a `Future`. The `throws` matchers opt in, so\ncommon patterns like `isNot(throwsA(...))` with a synchronous callback keep\nworking, while a `Future` or a callback returning a `Future` is still\nrejected."
    },
    {
      "commit": "30acb69eb30369a1b9ad2adc4a86224393c197ef",
      "tree": "94e4fe3af6f068b9a199e2a8784d440bbae6c1d9",
      "parents": [
        "597a032690f388b781fc26fbb8ecdf6cdb8e9874"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon Oct 12 19:42:54 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 12 19:42:54 2026"
      },
      "message": "Time out browser loads just before the suite load timeout (#2786)\n\nFixes #2691\n\nThe browser platform gave up waiting for a browser to load a compiled\nsuite after the test timeout, or 30 seconds if that was longer. This\ntimeout was added in #2080, before `suite_load_timeout` existed, to get\nbetter diagnostics for browser loads that never completed. The test\ntimeout has nothing to do with loading, and `suite_load_timeout` had no\neffect on this limit, so the only way to give a slow browser more time\nwas to raise the timeout for every test.\n\nStart a stopwatch in the load suite\u0027s body, right after the invoker\nstarts the load test\u0027s timeout, and expose the time left before that\ntimeout through a static `PlatformPlugin.remainingLoadTime` getter that\nplatforms can read during `load`. It reads a zone value set by the load\nsuite, so platforms need no new imports, and it is static so classes\nimplementing `PlatformPlugin` don\u0027t need to change. It is `null` when\nloading can\u0027t time out because the suite load timeout is `none` or\ntimeouts are ignored. The value is only meaningful during `load`;\ncallbacks registered while loading run in the same zone and may see a\nstale value later.\n\nHave the browser platform give up 1 second before the remaining load\ntime runs out, so its error, which includes the browser output, wins\nover the generic timeout on the load test. Retries in the loader share\nthe same budget. When there is no remaining load time, don\u0027t time out\nthe browser, matching how other platforms load suites without a suite\nload timeout. Configuring `suite_load_timeout` restores a limit along\nwith the more detailed error.\n\nBump test_core to 0.6.22-wip for the new API and pin it from test."
    },
    {
      "commit": "597a032690f388b781fc26fbb8ecdf6cdb8e9874",
      "tree": "54a016530a677629f898415d7ccb89b91a60bd06",
      "parents": [
        "0b6efee8c526d962f196025184a927d524c94c3e"
      ],
      "author": {
        "name": "Kevin Moore",
        "email": "kevmoo@users.noreply.github.com",
        "time": "Mon Oct 12 19:22:53 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 12 19:22:53 2026"
      },
      "message": "Fix misplaced changelog entries and remove no-op health check (#2789)\n\n- **`pkgs/matcher/CHANGELOG.md`**: Move `* Require Dart 3.11` (added in https://github.com/dart-lang/test/pull/2676 after [`matcher-v0.12.20`](https://github.com/dart-lang/test/releases/tag/matcher-v0.12.20) was published) from `## 0.12.20` to `## 0.12.21-wip`.\n- **`pkgs/test/CHANGELOG.md` \u0026 `pkgs/test_core/CHANGELOG.md`**: Move `* Add flag --shard-by-suite to control sharding strategy.` (merged in https://github.com/dart-lang/test/pull/2655 on 2026-09-17 after `test-v1.32.0` / `test_core-v0.6.20` and shipped in [`test-v1.33.0`](https://github.com/dart-lang/test/releases/tag/test-v1.33.0) / [`test_core-v0.6.21`](https://github.com/dart-lang/test/releases/tag/test_core-v0.6.21)) from `1.31.2` / `0.6.19` to `1.33.0` / `0.6.21`.\n- **`.github/workflows/health.yaml`**: Remove the non-existent `version` check name from `checks` (valid `firehose` health check names are `license`, `changelog`, `coverage`, `breaking`, `leaking`, `do-not-submit`, `unused-dependencies`)."
    },
    {
      "commit": "0b6efee8c526d962f196025184a927d524c94c3e",
      "tree": "6bbccfb5625eab80876a25a710eb4fe39e8c43a6",
      "parents": [
        "17c984933f3581e721acfb63c0e7faffc254efa6"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon Oct 12 19:16:29 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 12 19:16:29 2026"
      },
      "message": "[checks] Collapse nested subjects in condition descriptions (#2784)\n\nFailure messages collapse a nested subject with a single expectation to one\nline, for example `has length: \u003c1\u003e`, but `Condition.describe` always used the\nexpanded multi-line form. Expectations which embed the description of a\ncondition, such as `IterableChecks.any`, showed every nested subject\nexpanded even where the same check made directly would collapse:\n\n    Expected: a List\u003cBaz\u003e that:\n      contains a value that:\n        has qux that:\n          equals \u0027expected\u0027\n\nThere were two causes in `_TestContext._fullDetails`:\n\n- Passing nested clauses were only collapsed when formatting a rejection, and\n  `describe` never has one. Collapse them without a rejection as well.\n- `describe` passes the root context as the failing context, so the last root\n  clause was treated as the failing clause and always expanded. Only treat a\n  clause as failing when there is a rejection.\n\nCollapsing without a rejection also affects ordinary failure messages. A\npassing sibling with multiple expectations is formatted without a rejection,\nso its own nested subjects now collapse like those at any other depth, for\nexample `has length: \u003c3\u003e` instead of `has length that:` followed by\n`equals \u003c3\u003e`.\n\nCollapsing skips the guard clauses added by `atSameLevel` nesting, such as\n`isA\u003cT\u003e()` and `isNotNull()`, because a guard that let its value through is a\nsatisfied precondition. Within `describe` there is no value, so a guard is\nnever evaluated. Record on each guard whether its value was extracted, and\nonly skip satisfied guards. An unevaluated or rejected guard counts as an\nexpectation, so a described condition keeps the precondition:\n\n    Expected: a List\u003cWrapper\u003e that:\n      contains a value that:\n        has value that:\n          is a Foo\n          has someField: \u0027bar\u0027\n\nWith descriptions collapsing, add a predicate noun to `any`, `every`,\n`containsKeyThat`, and `containsValueThat` when the condition describes in a\nsingle line, so these failures also collapse at the root:\n\n    Expected: an iterable containing a value that has qux: \u0027expected\u0027\n    Actual: [Instance of \u0027Baz\u0027]\n    Which: contains no matching element\n\nThe predicate nouns use a new internal `describedPredicateNoun` helper in\n`describe.dart`. It returns `null` when the condition describes over multiple\nlines, or when the combined noun is longer than 80 characters, matching the\nlimit used when a collapsed description is joined to a root label. Those\nexpectations then keep the multi-line format."
    },
    {
      "commit": "17c984933f3581e721acfb63c0e7faffc254efa6",
      "tree": "e306e17e22a874a9b745ca5394ecf8751c5f6eaa",
      "parents": [
        "1cc813ecb4f23619bc94d50d82b10ec0ad2b0a7e"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon Oct 12 19:08:23 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 12 19:08:23 2026"
      },
      "message": "Follow symlinks in precompiled browser test directories (#2787)\n\nFixes https://github.com/dart-lang/test/issues/2766\n\n#2724 removed `serveFilesOutsidePath: true` from the precompiled static\nhandler to stop requests from reading files outside the precompiled\ndirectory. Without that flag `shelf_static` also refuses to serve any\nsymlink whose target resolves outside the root. `build_runner test`\ndefaults to `--symlink` on non-Windows platforms. That creates a merged\noutput directory where every file is a symlink into `.dart_tool/build` or\nthe package sources, so every request for a compiled test returned 404 and\ntests failed to load with \"Failed to load script at ...\".\n\nCheck containment on the requested path instead of the symlink-resolved\npath. The new `createSymlinkFollowingStaticHandler` joins the request path\nsegments onto the root the same way `shelf_static` does, rejects the\nrequest if the normalized result is outside the root, and otherwise\ndelegates to a static handler with `serveFilesOutsidePath: true`. Symlinks\nplaced inside the precompiled directory are followed. Traversal through\nthe request path, such as `..%2F` segments or an encoded absolute path,\nis still rejected.\n\nAdd unit tests that send raw HTTP requests to cover symlinked files and\ndirectories and several traversal forms. With the containment check\ndisabled, the encoded-slash and absolute-path cases serve the outside\nfile. Add a Chrome integration test that runs a precompiled test from a\ndirectory of symlinks; it fails with the previous handler."
    },
    {
      "commit": "1cc813ecb4f23619bc94d50d82b10ec0ad2b0a7e",
      "tree": "7f2389b3258b7c0ccb386b017ec09e0da3d4059a",
      "parents": [
        "ada7b950a7086c3f463f1bed94e0a619d408a24f"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Oct 09 18:59:56 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 09 18:59:56 2026"
      },
      "message": "[checks] Join nested collapsed subjects with \"that\" (#2783)\n\nA nesting context\u0027s `addPredicate` callback expects a noun phrase from the\nexpectation on its subject, such as `\u003c2\u003e` or `an empty iterable`. When the\nonly expectation on a nested subject was itself a further nested subject, the\ncollapsed predicate from the inner level was passed to `addPredicate` as if\nit were a noun. This produced descriptions which did not read as sentences,\nand lost detail from the label:\n\n    throws has message: \u0027foo\u0027\n    has value: has field: \u0027foo\u0027\n\nWhen the single clause on a nested context is another nested context, join\nits collapsed predicate to the label of the outer context with \"that\"\ninstead. This is the same structure as the \"\u003clabel\u003e that:\" line in the\nmulti-line format, placed on one line:\n\n    throws an error of type StateError that has message: \u0027foo\u0027\n    has value that has field: \u0027foo\u0027\n\nLeaf expectations are still passed to `addPredicate`. A context without an\n`addPredicate` callback, or with a multi-line label, still does not collapse,\nand the 80 character limit at the root still applies."
    },
    {
      "commit": "ada7b950a7086c3f463f1bed94e0a619d408a24f",
      "tree": "f650eecb48d164b2655d6269777a70fe5e3e6dcd",
      "parents": [
        "c4b165b384e13c7232c8fbb5fc4a278938bfd640"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Oct 08 19:03:42 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 08 19:03:42 2026"
      },
      "message": "Prepare to publish (#2780)"
    },
    {
      "commit": "c4b165b384e13c7232c8fbb5fc4a278938bfd640",
      "tree": "fb6cbd42b6c3c90d6cda4ad6b413c758ca9d929a",
      "parents": [
        "4a363d70b61562380b8cdfa3f9e9a09767502b4b"
      ],
      "author": {
        "name": "Kevin Moore",
        "email": "kevmoo@users.noreply.github.com",
        "time": "Wed Oct 07 18:29:08 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Oct 07 18:29:08 2026"
      },
      "message": "[checks] Require package:meta ^1.17.0 (#2779)\n\n`pkgs/checks/lib/src/extensions/async.dart` and\n`pkgs/checks/lib/src/extensions/function.dart` use `@awaitNotRequired`,\nwhich was introduced in `package:meta` `1.17.0`"
    },
    {
      "commit": "4a363d70b61562380b8cdfa3f9e9a09767502b4b",
      "tree": "92c227fe07cc5bc441801aa8b89bc21f5a0cf92e",
      "parents": [
        "465d66ab11d8c58a0eb63ef0d2b2f0e83ba20352"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Oct 06 17:46:31 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 17:46:31 2026"
      },
      "message": "Let Chrome choose its remote debugging port (#2778)\n\nWhen debugging or collecting coverage, the runner picked a probably-unused\nport with `getUnusedPort` and passed it to Chrome with\n`--remote-debugging-port`. Chrome gives no reliable signal that it bound\nthe port, so there was a window where another process could take it, and\n`tryPort` had to report the chosen port back through a completer for\n`_connect` to use.\n\nPass `--remote-debugging-port\u003d0` so Chrome binds an unused port itself,\nand read the port from the URL in the \"DevTools listening on\" line, which\n`_connect` already waits for. With no port to choose or pass along,\n`tryPort`, the port completer, and the private constructor go away, and\n`Chrome` has a plain generative constructor. `spawn` already falls back\nto the default Chrome settings.\n\nUpdate the fake Chrome test to report a fake DevTools server\u0027s port in its\nDevTools line, and check that connecting reaches that server and that\nChrome is started with `--remote-debugging-port\u003d0`."
    },
    {
      "commit": "465d66ab11d8c58a0eb63ef0d2b2f0e83ba20352",
      "tree": "b7488e21feead4f75d482fd492f43608e07dc0bd",
      "parents": [
        "d749b104edf2cb1428b08782830fc6bd2883e3dc"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Oct 06 16:35:22 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 16:35:22 2026"
      },
      "message": "Keep Chrome stderr in the browser output when debugging (#2777)\n\nWhen Chrome runs with a remote debugging port, which happens with\n`--debug`, `--pause-after-load`, and `--coverage`, `_connect` listened to\nthe process\u0027s stderr to wait for the \"DevTools listening\" line. The\n`Browser` base class listens to the same single-subscription stream to\ncollect the browser output, and that second listen threw a `StateError`\nwhich was silently caught. Once `firstWhere` found the line it cancelled\nthe subscription, which closes the pipe, so all of Chrome\u0027s stderr,\nincluding its console logging, was missing from the \"Browser output\" in\nload failures and timeouts.\n\nRename the `output` list on `Browser` to `accumulatedOutput`, and add an\n`output` stream built with `Stream.multi` which replays the accumulated\nlines to each new listener and then forwards new lines. It closes when\nboth stdout and stderr are done, when the browser is closed, or when\nstarting or running the browser fails.\n\nIn `Chrome`, `tryPort` now only reports which debugging port it used, and\n`_connect` is an instance method which reads that port and waits for the\nDevTools line on `output`. The tab connection and the remote debugger URL\ncome from a single lazy `_connection` future in place of the two\ncompleters, started by the first read of `remoteDebuggerUrl` or\n`gatherCoverage`. `BrowserManager` reads `remoteDebuggerUrl` before it\nloads any suites, so coverage collection still starts before tests run,\nand the replay means a late start still sees the DevTools line.\n\nDrop the `StateError` catch in `drainOutput`. Nothing else listens to the\nprocess streams now, and a future second listener should fail loudly\ninstead of losing output."
    },
    {
      "commit": "d749b104edf2cb1428b08782830fc6bd2883e3dc",
      "tree": "57e220dd00acf0775b13c66b5c37e03d70cba98d",
      "parents": [
        "da2157e9260bbd52f0bad7a6f4e63ad319a3e8e3"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon Oct 05 22:42:46 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 22:42:46 2026"
      },
      "message": "Fail isolate suites when the test isolate exits (#2775)\n\nWhen a VM test suite runs in an isolate, nothing noticed if the isolate\nexited. The isolate channel does not close when the isolate exits, so:\n\n- If the isolate exited while the suite was loading, loading waited\n  forever for the serialized suite. For example, a test file whose\n  `main` calls `Isolate.exit()` hung the run.\n- If the isolate exited while a test was running, that test never\n  completed. The run hung, and interrupting it hung again while it\n  waited for the test to finish.\n\nSpawn test isolates with an `onExit` port. When the isolate exits,\nclose the port the isolate channel receives from. The channel then ends\nonce it has delivered any messages the isolate sent before exiting:\n- An error the isolate reported while loading is still what fails the\n  load.\n- Otherwise loading fails with \"Connection closed before test suite\n  loaded.\", as it already does for `exe` and `cli` suites when the\n  socket closes.\n- Tests that haven\u0027t finished are reported as not completed.\n\nClosing the port doesn\u0027t end the channel if the isolate hasn\u0027t\nconnected yet, so waiting for the channel ID also races the exit\nmessage.\n\nOnly listen for data on the exit port, since it is also closed as part\nof the suite\u0027s normal cleanup."
    },
    {
      "commit": "da2157e9260bbd52f0bad7a6f4e63ad319a3e8e3",
      "tree": "d4fb5795592b4e8e9a9e40ef1aac4b27183e0dee",
      "parents": [
        "00bd0c994c007b05984ca7ed4ed0dda1667068f6"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon Oct 05 18:12:43 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 18:12:43 2026"
      },
      "message": "Wait longer for the Chrome test tab to appear (#2771)\n\nSince browsers are launched through a `redirect.html` file (#2703), the\ntest tab starts on a `file://` URL and only reports the test URL once\nthe navigation commits. `_connect`, used with `--debug` and\n`--coverage`, gave up after about 4 seconds, which is not always enough\non loaded CI runners. The Chrome coverage tests have failed with \"Could\nnot connect to test tab\" on Windows and macOS since that change landed.\n\nPoll for up to about 20 seconds, and include the URLs of the open tabs\nin the error to make any future failures easier to diagnose."
    },
    {
      "commit": "00bd0c994c007b05984ca7ed4ed0dda1667068f6",
      "tree": "ed5347faa7fd3503f3e695a1e5bef2b0a26f236d",
      "parents": [
        "3be2f547208fc569964973d6f13ec1985c4a9fdd"
      ],
      "author": {
        "name": "Yusuf İhsan Görgel",
        "email": "developeryusuf@icloud.com",
        "time": "Mon Oct 05 15:50:03 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 15:50:03 2026"
      },
      "message": "Fix broken links in architecture.md (#2774)\n\nMost links in `pkgs/test/doc/architecture.md` still pointed at paths from before the split into `test_api`, `test_core` and `test`. This points them at the current files with relative links. Link text and the surrounding prose are unchanged.\n\nThe `lib/src/frontend` link is left as it is. Its APIs are now spread over several directories in `test_api` and `matcher`, and picking one would change what the paragraph says. A broader update of the document is out of scope here.\n\nI checked that every new relative target exists and that the external links return 200.\n\nPart of #1967."
    },
    {
      "commit": "3be2f547208fc569964973d6f13ec1985c4a9fdd",
      "tree": "3ab8302d48e1839d26829a6189892e8432a62ea9",
      "parents": [
        "40a5ad90b3e5314fa28e3d4ca332eeb732c67dbb"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Oct 01 03:46:29 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 01 03:46:29 2026"
      },
      "message": "Bump the github-actions group with 4 updates (#2773)\n\nBumps the github-actions group with 4 updates: [dart-lang/ecosystem/.github/workflows/health.yaml](https://github.com/dart-lang/ecosystem), [dart-lang/ecosystem/.github/workflows/post_summaries.yaml](https://github.com/dart-lang/ecosystem), [dart-lang/ecosystem/.github/workflows/publish.yaml](https://github.com/dart-lang/ecosystem) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).\n\nUpdates `dart-lang/ecosystem/.github/workflows/health.yaml` from 848b3bf3b757d2e9ae4d60030eeed5756c87783f to 16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\"\u003e\u003ccode\u003e16dca7a\u003c/code\u003e\u003c/a\u003e fix(firehose): keep dart_apitool crash details in logs and sanitize breaking ...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/1bdafd85bb97b331ddd683577f48a5dfa7f4cb49\"\u003e\u003ccode\u003e1bdafd8\u003c/code\u003e\u003c/a\u003e Tighten workflow for posting PR comments (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/451\"\u003e#451\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/fc3dd9a17a8e18b3b4aa5abac8a0f4a679fe2d57\"\u003e\u003ccode\u003efc3dd9a\u003c/code\u003e\u003c/a\u003e fix(firehose): update existing publishing PR comments when no packages are re...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/e0a78b408ebab9547710a4b869e2e78b9d887fef\"\u003e\u003ccode\u003ee0a78b4\u003c/code\u003e\u003c/a\u003e fix(firehose): bump dependency_validator pinned hash to 5.0.6 (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/450\"\u003e#450\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/60fca9f1270a0819b3ee9caf74b08fb0a212e4cb\"\u003e\u003ccode\u003e60fca9f\u003c/code\u003e\u003c/a\u003e Condense firehose package publishing table in PR validation (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/445\"\u003e#445\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/b79f68c55d4a611e7ebf63091036f3f18b5d94b3\"\u003e\u003ccode\u003eb79f68c\u003c/code\u003e\u003c/a\u003e chore(health): remove 3rd-party coveralls action dependency (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/446\"\u003e#446\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/cda8bd535dfbcff45010bc3c843d325682f944b2\"\u003e\u003ccode\u003ecda8bd5\u003c/code\u003e\u003c/a\u003e Grant required permissions in want_lgtm_internal and canary_internal workflow...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/ed9c592c1d35106c0a8a52044426515017a60646\"\u003e\u003ccode\u003eed9c592\u003c/code\u003e\u003c/a\u003e Support pull requests from forks and custom branches in CI workflows (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/440\"\u003e#440\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/d8c8a4c2f96165be9764025e29fbfb2069558809\"\u003e\u003ccode\u003ed8c8a4c\u003c/code\u003e\u003c/a\u003e Support configurable tag prefix in firehose and publish.yaml (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/436\"\u003e#436\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/edfdb3b4063b9034b708144633a700204f865f43\"\u003e\u003ccode\u003eedfdb3b\u003c/code\u003e\u003c/a\u003e Add want-lgtm reusable workflow (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/432\"\u003e#432\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/dart-lang/ecosystem/compare/848b3bf3b757d2e9ae4d60030eeed5756c87783f...16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `dart-lang/ecosystem/.github/workflows/post_summaries.yaml` from 848b3bf3b757d2e9ae4d60030eeed5756c87783f to 16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\"\u003e\u003ccode\u003e16dca7a\u003c/code\u003e\u003c/a\u003e fix(firehose): keep dart_apitool crash details in logs and sanitize breaking ...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/1bdafd85bb97b331ddd683577f48a5dfa7f4cb49\"\u003e\u003ccode\u003e1bdafd8\u003c/code\u003e\u003c/a\u003e Tighten workflow for posting PR comments (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/451\"\u003e#451\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/fc3dd9a17a8e18b3b4aa5abac8a0f4a679fe2d57\"\u003e\u003ccode\u003efc3dd9a\u003c/code\u003e\u003c/a\u003e fix(firehose): update existing publishing PR comments when no packages are re...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/e0a78b408ebab9547710a4b869e2e78b9d887fef\"\u003e\u003ccode\u003ee0a78b4\u003c/code\u003e\u003c/a\u003e fix(firehose): bump dependency_validator pinned hash to 5.0.6 (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/450\"\u003e#450\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/60fca9f1270a0819b3ee9caf74b08fb0a212e4cb\"\u003e\u003ccode\u003e60fca9f\u003c/code\u003e\u003c/a\u003e Condense firehose package publishing table in PR validation (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/445\"\u003e#445\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/b79f68c55d4a611e7ebf63091036f3f18b5d94b3\"\u003e\u003ccode\u003eb79f68c\u003c/code\u003e\u003c/a\u003e chore(health): remove 3rd-party coveralls action dependency (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/446\"\u003e#446\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/cda8bd535dfbcff45010bc3c843d325682f944b2\"\u003e\u003ccode\u003ecda8bd5\u003c/code\u003e\u003c/a\u003e Grant required permissions in want_lgtm_internal and canary_internal workflow...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/ed9c592c1d35106c0a8a52044426515017a60646\"\u003e\u003ccode\u003eed9c592\u003c/code\u003e\u003c/a\u003e Support pull requests from forks and custom branches in CI workflows (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/440\"\u003e#440\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/d8c8a4c2f96165be9764025e29fbfb2069558809\"\u003e\u003ccode\u003ed8c8a4c\u003c/code\u003e\u003c/a\u003e Support configurable tag prefix in firehose and publish.yaml (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/436\"\u003e#436\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/edfdb3b4063b9034b708144633a700204f865f43\"\u003e\u003ccode\u003eedfdb3b\u003c/code\u003e\u003c/a\u003e Add want-lgtm reusable workflow (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/432\"\u003e#432\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/dart-lang/ecosystem/compare/848b3bf3b757d2e9ae4d60030eeed5756c87783f...16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `dart-lang/ecosystem/.github/workflows/publish.yaml` from 848b3bf3b757d2e9ae4d60030eeed5756c87783f to 16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\"\u003e\u003ccode\u003e16dca7a\u003c/code\u003e\u003c/a\u003e fix(firehose): keep dart_apitool crash details in logs and sanitize breaking ...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/1bdafd85bb97b331ddd683577f48a5dfa7f4cb49\"\u003e\u003ccode\u003e1bdafd8\u003c/code\u003e\u003c/a\u003e Tighten workflow for posting PR comments (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/451\"\u003e#451\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/fc3dd9a17a8e18b3b4aa5abac8a0f4a679fe2d57\"\u003e\u003ccode\u003efc3dd9a\u003c/code\u003e\u003c/a\u003e fix(firehose): update existing publishing PR comments when no packages are re...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/e0a78b408ebab9547710a4b869e2e78b9d887fef\"\u003e\u003ccode\u003ee0a78b4\u003c/code\u003e\u003c/a\u003e fix(firehose): bump dependency_validator pinned hash to 5.0.6 (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/450\"\u003e#450\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/60fca9f1270a0819b3ee9caf74b08fb0a212e4cb\"\u003e\u003ccode\u003e60fca9f\u003c/code\u003e\u003c/a\u003e Condense firehose package publishing table in PR validation (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/445\"\u003e#445\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/b79f68c55d4a611e7ebf63091036f3f18b5d94b3\"\u003e\u003ccode\u003eb79f68c\u003c/code\u003e\u003c/a\u003e chore(health): remove 3rd-party coveralls action dependency (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/446\"\u003e#446\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/cda8bd535dfbcff45010bc3c843d325682f944b2\"\u003e\u003ccode\u003ecda8bd5\u003c/code\u003e\u003c/a\u003e Grant required permissions in want_lgtm_internal and canary_internal workflow...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/ed9c592c1d35106c0a8a52044426515017a60646\"\u003e\u003ccode\u003eed9c592\u003c/code\u003e\u003c/a\u003e Support pull requests from forks and custom branches in CI workflows (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/440\"\u003e#440\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/d8c8a4c2f96165be9764025e29fbfb2069558809\"\u003e\u003ccode\u003ed8c8a4c\u003c/code\u003e\u003c/a\u003e Support configurable tag prefix in firehose and publish.yaml (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/436\"\u003e#436\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/ecosystem/commit/edfdb3b4063b9034b708144633a700204f865f43\"\u003e\u003ccode\u003eedfdb3b\u003c/code\u003e\u003c/a\u003e Add want-lgtm reusable workflow (\u003ca href\u003d\"https://redirect.github.com/dart-lang/ecosystem/issues/432\"\u003e#432\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/dart-lang/ecosystem/compare/848b3bf3b757d2e9ae4d60030eeed5756c87783f...16dca7ae5d3ff896a4db47e1ed6cd50f7ebbf115\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.37.9 to 4.38.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.38.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.38.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.38.2 - 24 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1\"\u003e2.27.1\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4160\"\u003e#4160\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.1 - 18 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4146\"\u003e#4146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href\u003d\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2\"\u003e\u003ccode\u003e2892aa5\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4168\"\u003e#4168\u003c/a\u003e from github/update-v4.38.2-a6ef2c96f\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/8ad03a333eb88de8ad6833eda208d0fc51a9c571\"\u003e\u003ccode\u003e8ad03a3\u003c/code\u003e\u003c/a\u003e Trigger workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/98af865db5041cee73c7185896319367f8c0adf2\"\u003e\u003ccode\u003e98af865\u003c/code\u003e\u003c/a\u003e Update changelog for v4.38.2\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/a6ef2c96fc0e37d0b44fb2bd0b32db4bcb89ae24\"\u003e\u003ccode\u003ea6ef2c9\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4156\"\u003e#4156\u003c/a\u003e from github/mario-campos/fix-validate-cmd\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/1ef28a1b7603ca158fd774d1ab328cbd6a40b84b\"\u003e\u003ccode\u003e1ef28a1\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4166\"\u003e#4166\u003c/a\u003e from github/dependabot/github_actions/dot-github/wor...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/26cb08bab0037de74cc66ad9ec0dca31d6d9e8a7\"\u003e\u003ccode\u003e26cb08b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4163\"\u003e#4163\u003c/a\u003e from github/mbg/fix-getCommitOid-stubs\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/f035ce3a985a1223a9f59fb719542598640160b2\"\u003e\u003ccode\u003ef035ce3\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4165\"\u003e#4165\u003c/a\u003e from github/dependabot/npm_and_yarn/npm-minor-8eaed9...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/5e4e2550b48d7f3de205c9d752eb5176bf07f6d9\"\u003e\u003ccode\u003e5e4e255\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/b13f5f47d5398d0fb982942ced6fdfc4e3951804\"\u003e\u003ccode\u003eb13f5f4\u003c/code\u003e\u003c/a\u003e Bump ruby/setup-ruby\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/c87fe5756c0c0bcd5e0005d2169945cfee9a232f\"\u003e\u003ccode\u003ec87fe57\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s major version (unless you unignore this specific dependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s minor version (unless you unignore this specific dependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\u003c/details\u003e"
    },
    {
      "commit": "40a5ad90b3e5314fa28e3d4ca332eeb732c67dbb",
      "tree": "ecb0221ffb94465b2cf3e78005f946fee7faf025",
      "parents": [
        "171ad0e529625b7a677121ffb34057bbad373c2a"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Sep 29 19:07:31 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 29 19:07:31 2026"
      },
      "message": "Delete compilation artifacts once they are no longer needed (#2764)\n\nFixes #2710\n\nThe runner kept every artifact it compiled until the end of the run: a kernel\nfile per suite for the default compiler, and a snapshot or bundle per suite for\nthe `exe` and `cli` compilers. On a large test suite that is a lot of temporary\ndisk space held for no reason, since nothing uses an artifact once its suite has\nfinished running.\n\n### Kernel files\n\n`TestCompiler` now tracks which per-language-version compiler produced each\nkernel file, so `release` can delete it as soon as its suite is done. The dill\nbeing considered for the incremental cache is kept, since it is still needed,\nand is deleted once a larger one supersedes it or the compiler is disposed.\n\n`VMPlatform` registers the release as a cleanup callback for the suite. The\nrequest to kill the isolate is ordered ahead of it, but `Isolate.kill` does not\nwait for the isolate to exit, so this is best effort; a file that can\u0027t be\ndeleted yet is removed along with the compiler\u0027s temp directory when it is\ndisposed.\n\n### `exe` and `cli` output\n\nEach suite is compiled into a directory of its own under the runner\u0027s temp\ndirectory, which also holds the unix socket. The executable can\u0027t be deleted\nwhile it is running, so deleting the directory waits for the test process to\nexit. That wait starts as soon as the process starts, so the directory is\ndeleted whenever the process exits, including before the suite has loaded.\n\n### Cleanup is tracked instead of discarded\n\nThe per-suite cleanup callbacks were `void Function()`, so futures from\ntear-offs like `serverSocket.close` were silently dropped, and nothing waited\nfor any cleanup to finish. They are now `FutureOr\u003cvoid\u003e Function()`, and every\ncleanup future is recorded on the platform.\n\nEach resource a suite acquires registers its cleanup as soon as it is acquired,\nand `load` runs those callbacks whenever loading fails, so every step shares one\ncleanup path. This also covers failures after an isolate is spawned, such as\nduring `--debug` setup, which previously left the isolate running.\n\nCleanup is still not awaited when a suite finishes, so a slow delete can\u0027t\ndelay it. Instead `VMPlatform.close` waits for all outstanding cleanup before\ndisposing the compiler and deleting its temp directory. Test processes are\ntracked from the moment they start, and any still running at that point are\nsent `SIGKILL`, so a process which ignores `SIGTERM`, or was never asked to\nexit because its suite failed to load, can\u0027t hang `close` or be left running.\nA process is not started once the platform is closing.\n\nEvery cleanup error is recorded as it happens, and `close` reports each one as\na warning with its stack trace rather than throwing. `Runner.close` now deletes\nthe runner\u0027s temp directory in a `finally`, so it is removed even if closing a\nplatform fails.\n\nThe suite\u0027s stream is now closed in a `finally`, so a failure while waiting for\nthe debugger after the tests can\u0027t leave the suite unfinished.\n\n### Load hang when the test process exits early\n\nLoading an `exe` or `cli` suite waited for the test process to connect with\nnothing else to end the wait. If the process exited first - a crash on\nstartup, or being killed while the platform closes - the load never finished,\nand a graceful shutdown hung on it too. The connection is now raced against\nthe process exiting, and the load fails with a `LoadException` naming the exit\ncode, or returns `null` if the platform is closing.\n\n### Not changed\n\nThe small bootstrap `.dart` files written per test file are still removed when\nthe platform is closed.\n\nNo public API changes; everything here is under `lib/src` and not exported.\n\n### Verification\n\nMeasured with a 6-suite project, sampling the temp directory during the run:\n\n| | before | after |\n|---|---|---|\n| kernel files retained | 6 | 1 |\n| `exe` artifacts retained at peak | 3 snapshots + 3 dirs | 1 dir |\n\nThe one retained kernel file is the incremental cache candidate, which is\nexpected.\n\n`test_compiler_test.dart` gains coverage for both release paths.\n`compiler_test.dart` and `signal_test.dart` pass.\n\nThe load hang has no automated test, since the native bootstrap connects before\nany test code runs. It was verified by temporarily making the bootstrap exit\nbefore connecting: the suite now fails to load with \"The test process exited\nwith code 3 before connecting to the test runner.\", where previously the run\nhung and did not exit on `SIGTERM`."
    },
    {
      "commit": "171ad0e529625b7a677121ffb34057bbad373c2a",
      "tree": "0c26f5a1bebe06a0addf3183b3cc8dd0f7f49b29",
      "parents": [
        "52b450642cbbff192988d7380c1173871f0a120b"
      ],
      "author": {
        "name": "Jacob MacDonald",
        "email": "jakemac@google.com",
        "time": "Tue Sep 29 00:29:48 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 29 00:29:48 2026"
      },
      "message": "export additional types from package:test_api/backend.dart (#2745)\n\nAdditional exports for flutter, https://github.com/flutter/flutter/issues/185016"
    },
    {
      "commit": "52b450642cbbff192988d7380c1173871f0a120b",
      "tree": "4b9c7a894f89569b5208e3e71d620ae8eb91bba4",
      "parents": [
        "4f92d530daf7e1c9e8a9acf518304a41408dbdc4"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon Sep 28 22:04:08 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 28 22:04:08 2026"
      },
      "message": "Tag browser and node tests, relax flaky timeouts (#2770)\n\nSeveral tests launch Chrome, Firefox, or Node without the matching tag,\nso they miss the longer timeout, and for browsers the CI retries,\nconfigured in `dart_test.yaml`. These account for most of the recent\nbrowser flakes in CI. Find them by running with `-x browser -x dart2js\n-x node` and nonexistent browser executables, and tag everything that\nstill launches a browser or node.\n\n- Tag browser and node groups in `compiler_runtime_matrix_test.dart`.\n- Tag the Chrome tests in `compiler_test.dart`,\n  `configuration/compiler_test.dart`, `coverage_test.dart`,\n  `github_reporter_test.dart`, and `line_and_col_test.dart`, and the\n  node test in `line_and_col_test.dart`.\n- Allow `node` tagged tests to run on macOS as well as linux.\n- Tag the coverage tests which run `pub get` with `pub`, and retry `pub`\n  tagged tests on CI since resolution sometimes stalls on the network.\n- Raise the `cross_compiler_hang` suite load timeout from 20s to 60s.\n  Chrome suites take 9-18s to load on the Windows runners while the exe\n  suites compile concurrently. A regression of the deadlock the package\n  reproduces hangs indefinitely, so a longer timeout still catches it."
    },
    {
      "commit": "4f92d530daf7e1c9e8a9acf518304a41408dbdc4",
      "tree": "79dfee3f79943d96fda4b9e5d703cd3cd0f1ada3",
      "parents": [
        "7fb848666f0d1c9c5e2cee233ab72d65ef3bd1be"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Sep 25 23:46:22 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 25 23:46:22 2026"
      },
      "message": "Unskip a test on windows (#2772)\n\nCloses #1615\n\nThis test was recently updated to use the `main()`\nentrypoint and is passing on windows."
    },
    {
      "commit": "7fb848666f0d1c9c5e2cee233ab72d65ef3bd1be",
      "tree": "a733929ec5cc01f9a1b722043976d619506a6009",
      "parents": [
        "603e5ec54e7bfd511b6729b4698bbec186489574"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Sep 25 21:52:39 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 25 21:52:39 2026"
      },
      "message": "Bundle skips at the end of the GitHub reporter (#2768)\n\nInstead of opening and closing skipped test groups as skipped tests\ncomplete (which splits passing test output into multiple groups),\ncollect skipped tests in `_skippedTests` during `_onComplete` and emit\nthem in a single collapsed `Skipped tests` group in `_onDone` before the\nfinal summary.\n\nSince skipped tests are no longer emitted as an active group during test\nexecution, passing tests are the only multi-test group that can remain\nopen. Remove the `_ReportGroup` enum and replace `_activeGroup` with a\nboolean `_inPassingGroup` field. Also extract a `_testName` helper to\nshare test name formatting across `_onComplete`, `_onError`, and\n`_onDone`."
    },
    {
      "commit": "603e5ec54e7bfd511b6729b4698bbec186489574",
      "tree": "a201cc98862b677234ae1c7943a588352a1804f3",
      "parents": [
        "4bf04d90f9b671af7bea068f822c01a96ee46d43"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Sep 24 21:00:41 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 24 21:00:41 2026"
      },
      "message": "Clean up the runner\u0027s temporary directories (#2763)\n\nTemporary directories were created all over the place - browser profiles,\ncompiler output, the VM platform\u0027s sockets - each with its own\n`Directory.systemTemp.createTempSync` call, and nothing deleted most of them. A\nrun leaves everything it created behind for the OS to clean up whenever it gets\naround to it.\n\nThey are now all created under a single `dart_test.` directory, so cleanup is\none recursive delete. `Runner.close` does that delete once every platform has\nbeen closed, which also covers a run interrupted with a single Control-C, since\nthat shuts down gracefully.\n\nA second signal skips the graceful shutdown, so the handler added in #2765\ndeletes the directory synchronously before it exits.\n\nThis also replaces `createTempDir`, which returned a path, with\n`createTempDirectory`, which returns a `Directory`. It takes a prefix so the\ndirectories nested under the shared root stay distinguishable, matching the\nnames the call sites passed when they used `dart:io` directly.\n\nThe VM platform\u0027s per-suite socket directory moves out from under the platform\u0027s\nown temp directory and becomes a sibling of it, which keeps the unix socket path\nwithin the ~104 byte limit it has on some platforms.\n\n\"Press Control-C again to terminate immediately\" now performs a synchronous\nrecursive delete before exiting, which is not free for the large directories\nthat motivated this."
    },
    {
      "commit": "4bf04d90f9b671af7bea068f822c01a96ee46d43",
      "tree": "c61b951839ed0f23d6de5a006a71d5a5ca13b047",
      "parents": [
        "2c660a840c6478fb25562765c455a4f66baf7d1c"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Sep 24 19:41:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 24 19:41:15 2026"
      },
      "message": "Refactor signal handling in executable.dart (#2765)\n\nKeep the signal subscription active during graceful shutdown so a second\nsignal can be handled explicitly in Dart before exiting with the signal\nexit code, and cancel the subscription in the finally block once the\nrunner closes. Add logic to determine the exit code that would have been\nused by the Dart VM when it was handling the second signal.\nThis prepares for an upcoming change which improves temporary directory\ncleanup during shutdown.\n\nThe `runTests` and `completeShutdown` methods are unused externally, so\nremove and inline them. Move the `signalSubscription` global variable to\na local variable in the main method. Drop the global `isShutdown`\nvariable. Reset `_stdinLines` in `cancelStdinLines` so it is safe to\ncall more than once."
    },
    {
      "commit": "2c660a840c6478fb25562765c455a4f66baf7d1c",
      "tree": "687c26bb58b3a754c73aab46b85fad541f781ffd",
      "parents": [
        "9946c9551ddaffd6092c22372b7e146600aa3264"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Sep 22 22:33:34 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 22 22:33:34 2026"
      },
      "message": "Regenerate mono_repo output (#2767)\n\nUpdate to the latest mono_repo which include `paths:` configuration to\nreduce unnecessary triggers of the large CI workflows."
    },
    {
      "commit": "9946c9551ddaffd6092c22372b7e146600aa3264",
      "tree": "81d20384d6636eb36bdfeffcc514430c1f1e633f",
      "parents": [
        "48c3fdf6f2fb91cb5e16ab32e637ac348e031d35"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon Sep 21 19:31:54 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 21 19:31:54 2026"
      },
      "message": "Fix a race in the frontend server client fake (#2762)\n\nThe `TestCompiler` implementation includes some file IO before it calls\n`FrontendServerClient.compile`. This was accounted for in the tests only\nwith `await pumpEventQueue();` which isn\u0027t guaranteed to complete after\nthe OS operations. Make the ordering explicit by adding a stream ofa\ncalls to the compiler and making that the only mechanism to communicate\nthe result.\n\nRemove the unused `compileCallCount` and `isCompileCalled` fields. Make\nthe test body responsible for completing with errors for the test where\nit\u0027s closed before the compile is finished."
    },
    {
      "commit": "48c3fdf6f2fb91cb5e16ab32e637ac348e031d35",
      "tree": "8b2a60d03c788c42a5736f2caea6e880f69ceeef",
      "parents": [
        "5d74864ba91cbc2778b3b479094de9660253d517"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Sat Sep 19 01:52:52 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 19 01:52:52 2026"
      },
      "message": "Fix race conditions during test load (#2761)\n\n`Engine._addLoadSuite` awaits `LoadSuite.suite`, whose completer is only\never completed from inside the load test\u0027s body: either when the body\nfinishes loading the suite, or by the `onComplete` handler the body\nregisters. If the load test is closed before its body runs at all,\nneither happens and nothing ever completes the suite.\n\nThat stalls the task `Engine.run` added for the suite, so it never\nreleases its resource from `_runPool`, so `_runPool.close()` never\ncompletes, so `Engine.close()` and in turn `Runner.close()` hang\nforever.\n\nToday this is masked in the runner: the signal handler cancels its\nsignal subscription immediately, so the VM exits once nothing else\nholds the event loop even though `close()` never completed. Anything\nthat keeps the isolate alive past that point turns it into a real hang.\n\nHold onto the completer in `LoadSuite` and add `completeWithoutSuite`,\nwhich completes it with a null suite if nothing else has. Call it once\nthe load test has finished running, from both `Engine._addLoadSuite`\nand `LoadSuite.getSuite`. It is a no-op in every normal path, since the\nbody holds an outstanding callback until it completes the completer.\n\nSkip running the load test when the engine is already closed. Nothing\nneeds to be loaded for a closed engine, and `completeWithoutSuite` still\nunblocks anything waiting on the suite."
    },
    {
      "commit": "5d74864ba91cbc2778b3b479094de9660253d517",
      "tree": "8be256c711d867d98d44d1ff50856ff11e2a90bc",
      "parents": [
        "5c4d9b25cec33bdbfc66317de87c1c5e68892afc"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Sep 18 23:25:57 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 23:25:57 2026"
      },
      "message": "Remove mentions of Travis (#2760)\n\nClean up stale comment references to travis.\n\nRemove some skips that date back to when we were using travis."
    },
    {
      "commit": "5c4d9b25cec33bdbfc66317de87c1c5e68892afc",
      "tree": "f7af9a6b91badff1d1505396ebcd40ee0815cbd3",
      "parents": [
        "f927df26f70f80592749b5b23a9d18152b500cd5"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Sep 18 19:49:00 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 19:49:00 2026"
      },
      "message": "Use consistent *Checks naming for prints (#2759)\n\nRename to `AsyncFunctionChecks` and `VoidFunctionChecks` with a comment\nexplaining that it exists for extension precedence."
    },
    {
      "commit": "f927df26f70f80592749b5b23a9d18152b500cd5",
      "tree": "d8912734877d815b98fd25b928a9779699878a4f",
      "parents": [
        "347a5af26026aebb28f01a6947b2ccaa11082ea0"
      ],
      "author": {
        "name": "Kevin Moore",
        "email": "kevmoo@users.noreply.github.com",
        "time": "Fri Sep 18 19:15:49 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 19:15:49 2026"
      },
      "message": "feat(checks): add prints expectations (#2742) (#2743)\n\nCloses #2742\n\nAdd `prints()` check extensions on `Subject\u003cvoid Function()\u003e`\n(`FunctionPrints`) and `Subject\u003cFuture\u003cvoid\u003e Function()\u003e`\n(`AsyncFunctionPrints`) to validate captured `print()` output from\nsynchronous and asynchronous callbacks.\n\n- Intercept `print()` via `ZoneSpecification` during function execution.\n- `FunctionPrints.prints()` (on `Subject\u003cvoid Function()\u003e`) returns\n  `Subject\u003cString\u003e` for synchronous checking on captured output and\n  asserts that the callback does not return a `Future` at runtime.\n- `AsyncFunctionPrints.prints()` (on `Subject\u003cFuture\u003cvoid\u003e Function()\u003e`)\n  awaits the returned `Future` before checking `Condition\u003cString\u003e` and\n  returning `Future\u003cSubject\u003cString\u003e\u003e`.\n- Add runnable `{@example}` files, update migration guide, and add tests\n  for output capture and error rejections."
    },
    {
      "commit": "347a5af26026aebb28f01a6947b2ccaa11082ea0",
      "tree": "5f78dba1938e0d16c8a1f488e9e5b51eeb99b784",
      "parents": [
        "6358dbb3c5dfb414e3e8ed2fd0fd131974e5a97e"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Sep 18 19:09:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 19:09:15 2026"
      },
      "message": "Add an example for every matcher (#2757)\n\nAdds a runnable example under `pkgs/matcher/example/` for each of the 93\npublic matchers and expect layer helpers, and links each one from its member\u0027s\ndartdoc with `{@example /example/\u003cgroup\u003e/\u003cmember\u003e.dart}`. This mirrors the\nexamples added for `package:checks` in #2756.\n\nEvery example is a `package:test` test file with at least one expectation that\npasses, and the failure that a failing expectation produces is recorded\nverbatim in a comment immediately following it. Members with a single failing\ncase use one test for both the passing and the failing expectation; members\nwith more than one failing case use a test per case. The examples are\ntherefore expected to fail when run directly, which is how the failure\nmessages stay visible. The exception is `anything`, which matches every value\nand so has no failing case; its example shows the placeholder use it is\nactually for. Deprecated members are skipped.\n\n`test/example_test.dart` checks that the failures each example produces equal\nthe output recorded in its comments, so the documented failure messages cannot\ndrift from the real ones. All of the examples are run together in a single\n`dart test` invocation with the JSON reporter, which associates each failure\nwith the suite it came from, and the whole suite takes about nine seconds.\n\nUnlike the `package:checks` messages, not every matcher failure begins with\n`Expected:`. `fail`, `neverCalled` and the future matchers report a bare\nmessage. A recorded failure is therefore identified by its position - the run\nof comment lines that ends a test body - rather than by its first line.\n\nThe examples for the `throws` matchers demonstrate the failure where the\nfunction returns instead of throwing. The failure for a function that throws\nthe wrong type embeds a stack trace whose line numbers refer to the example\nitself, so recording it would invalidate the recording on every edit. That\nmessage also contains a whitespace only line, which `dart format` strips from\na comment and which therefore cannot be recorded at all.\n\nRecorded output cannot be reflowed, and some messages are longer than 80\ncharacters at the indentation a test body requires, so `example/` carries an\nanalysis options file that turns off `lines_longer_than_80_chars` for the\nexamples only. The rest of the package keeps the rule. The repository root\nalready disables it, but `pkgs/matcher/analysis_options.yaml` includes\n`dart_flutter_team_lints` directly rather than the root options, so the rule is\non for this package.\n\nWriting the examples also surfaced that the documentation for\n`stringContainsInOrder` was separated from its declaration by a blank line, so\nit was a plain comment rather than a doc comment and did not appear in the\ngenerated documentation. The blank line is removed."
    },
    {
      "commit": "6358dbb3c5dfb414e3e8ed2fd0fd131974e5a97e",
      "tree": "690b3347a96ea191b73f2d3b62d4600e6baf0e0b",
      "parents": [
        "88202adcd58c0b9f1c2ec9fca6a603bb337e5a45"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Sep 17 22:10:08 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 17 22:10:08 2026"
      },
      "message": "Add an example for every checks expectation, and fix the bugs they exposed (#2756)\n\nAdds a runnable example under `pkgs/checks/example/` for each of the 79\npublic members of the expectation extensions in\n`pkgs/checks/lib/src/extensions/`, and links each one from its member\u0027s\ndartdoc with `{@example /example/\u003csource\u003e/\u003csubject\u003e/\u003cmember\u003e.dart}`.\n\nEvery example is a `package:test` test file with at least one check that\npasses and at least one that fails, and the failure that a failing check\nproduces is recorded verbatim in a comment immediately following it.\nMembers with a single failing case use one test for both the passing and\nthe failing check; members with more than one failing case use a test\nper case, including for the passing checks. The examples are therefore\nexpected to fail when run directly, which is how the failure messages\nstay visible. The two deprecated members,\n`IterableChecks.containsInOrder` and\n`IterableChecks.pairwiseComparesTo`, are skipped.\n\nExamples are written as tests rather than plain scripts because\nasynchronous expectations call `TestHandle.current` and throw\n`OutsideTestException` outside a running test. Examples that would\notherwise report a stack trace construct their errors with\n`Future.error`, `Stream.error`, or `Error.throwWithStackTrace(...,\nStackTrace.empty)` so that the recorded output does not contain machine\nspecific paths.\n\n`test/example_test.dart` checks that the failures each example produces\nequal the output recorded in its comments, so the documented failure\nmessages cannot drift from the real ones. All of the examples are run\ntogether in a single `dart test` invocation with the JSON reporter,\nwhich associates each failure with the suite it came from. Running them\none invocation apiece instead costs about 2.5s each, since every\ninvocation pays the runner startup and spawns a new `frontend_server`\nprocess initialized from `.dart_tool/test/incremental_kernel.*`;\nbatching them lets the runner compile all suites incrementally against\none live `frontend_server` instance and run them concurrently, which\ntakes the suite from 3m25s to 9s.\n\nRecording the real output instead of the plausible output exposed five\ndefects in the failure messages. Each is fixed here, along with its test\nexpectations and the recorded output of the affected examples.\n\n`MapChecks.isNotEmpty` described the wrong condition. Rejecting an empty\nmap reported `Which: is not empty`, which repeats the expectation\u0027s own\nwording instead of saying what was wrong with the value.\n`IterableChecks.isNotEmpty` and `StringChecks.isNotEmpty` both correctly\nsay `is empty`. Two existing tests asserted the incorrect string rather\nthan catching it.\n\n`not` emitted a trailing space. The clause was built as `\u0027is a value\nthat: \u0027`, while the matching clause for the expectation is `\u0027is not a\nvalue that:\u0027` with no trailing space. Besides being inconsistent,\ntrailing whitespace is stripped by `dart format`, so the message could\nnot be recorded in an example comment.\n\n`pairwiseMatches` did not indent its nested detail. The `Actual element\nat index N:` and `Which:` lines were emitted at the same level as the\n`does not have an element at index N that:` line that introduces them,\nso they read as unrelated top level clauses instead of as the detail of\nthe element that failed. `every` already indents the equivalent lines.\n\n`equalsIgnoringWhitespace` reported offsets that did not line up with\nthe value it displayed. The difference is computed between the two\nstrings after their whitespace is collapsed, so the reported offset and\nthe caret are positions in the collapsed value, but the message showed\nthe original value on the `Actual:` line. For `check(\u0027hello   wide\nworld\u0027)` against `\u0027hello world\u0027` the message pointed at offset 7, which\nis a different character in the original than in the collapsed string.\nThe difference is now reported beneath a line naming the collapsed value\nit was computed from, so the offset and caret can be matched up with the\nstring they refer to.\n\n`isA`, `IterableChecks.any`, `MapChecks.containsKeyThat`, and\n`MapChecks.containsValueThat` began their `Which:` clause with a capital\nletter, unlike every other rejection in the package. They are now lower\ncase."
    },
    {
      "commit": "88202adcd58c0b9f1c2ec9fca6a603bb337e5a45",
      "tree": "3c6190de3c2ebb640c04eb729d3f2f0d4a43c8b0",
      "parents": [
        "c80d53dbd489d61e0481fc484cd6f9a3b53603fb"
      ],
      "author": {
        "name": "Sigurd Meldgaard",
        "email": "sigurdm@google.com",
        "time": "Thu Sep 17 12:13:30 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 17 12:13:30 2026"
      },
      "message": "New flag --shard-by-suite\n\nRunning all setupAll hooks is expensive when what we are trying to do is to minimize the time spent for each shard.\n\nThis allows choosing a less fine-grained strategy of sharding by individual test files.\n\nFixes https://github.com/dart-lang/test/issues/2614"
    },
    {
      "commit": "c80d53dbd489d61e0481fc484cd6f9a3b53603fb",
      "tree": "c63a1a01d09166c9e0ccb34c4dcebda62df2dc98",
      "parents": [
        "62b31331d972677e8189c317f733ff4384b77787"
      ],
      "author": {
        "name": "XananasX",
        "email": "cihbank069@gmail.com",
        "time": "Wed Sep 09 02:43:41 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 09 02:43:41 2026"
      },
      "message": "ci: pin dart-lang/ecosystem reusable workflows to commit SHA to prevent supply-chain attacks (#2687)\n\nCo-authored-by: XananasX7 \u003cXananasX7@users.noreply.github.com\u003e\nCo-authored-by: Nate Bosch \u003cnbosch@google.com\u003e"
    },
    {
      "commit": "62b31331d972677e8189c317f733ff4384b77787",
      "tree": "15047f4ea3fab292e74805d9e541b9f8332bf26a",
      "parents": [
        "d983b56db60ad589f6fdae71ca00d3520874695e"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Sep 09 00:32:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 09 00:32:15 2026"
      },
      "message": "Make zero-arg expectations getters (#2752)\n\nCloses #1943\n\nDon\u0027t require parenthesis for extensions that will never take arguments."
    },
    {
      "commit": "d983b56db60ad589f6fdae71ca00d3520874695e",
      "tree": "b51a100d9478ecb244c8e4d75d54e6055ce850a9",
      "parents": [
        "20d248fbc7d19e7dda9613e78d12117c7b64b9ae"
      ],
      "author": {
        "name": "Kevin Moore",
        "email": "kevmoo@users.noreply.github.com",
        "time": "Sat Sep 05 01:09:22 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 05 01:09:22 2026"
      },
      "message": "Move to Safari drive to try to make safari testing less flaky (#2598)"
    },
    {
      "commit": "20d248fbc7d19e7dda9613e78d12117c7b64b9ae",
      "tree": "ee81e3e318f57fb4237a173ef8dc42c76dba3e41",
      "parents": [
        "31cb6bdd449b2c480489cd62e24aceaa594bb884"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Sat Sep 05 01:06:31 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 05 01:06:31 2026"
      },
      "message": "Make FAQ more prominent in migration guide (#2753)"
    },
    {
      "commit": "31cb6bdd449b2c480489cd62e24aceaa594bb884",
      "tree": "862083190ff2d770df0776d1fa9d269376b59725",
      "parents": [
        "21a02b7319e72e99d742b37f05160e7c5a3a017a"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Sat Sep 05 00:18:04 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 05 00:18:04 2026"
      },
      "message": "Restore Condition as a class (#2697)\n\nCloses #2694\n\nReintroduce `Condition\u003cT\u003e` as a class in place of callback typedefs\n(`void Function(Subject\u003cT\u003e)` / `FutureOr\u003cvoid\u003e Function(Subject\u003cT\u003e)`).\n\nPreviously, the `Condition` class was dropped in favor of callback\nfunctions, in part to avoid `it()` appearing like a language feature.\nHowever, using callback functions introduced type inference limitations.\n\n- Callbacks required declaring explicit parameters, introducing\n  unnecessary boilerplate across expectation calls.\n- When explicit types are required it takes a full `Subject\u003cSomeType\u003e`\n  as the argument type annotation, mixing the details of the\n  implementation with the goal of passing a type argument.\n- When type inference failed (such as in collection matching or\n  heterogeneous checks), callbacks resulted in cryptic runtime errors\n  regarding missing extension methods on `Subject` with no static\n  assistance.\n\nReintroducing `Condition\u003cT\u003e` with a `Condition.it\u003cT\u003e()` static helper.\n\n- Dot shorthands provide a terse, readable syntax\n  (`.it()..isGreaterThan(0)`) without polluting the top-level namespace.\n- When inference fails `Condition.it\u003cSomeType\u003e()` is more explicit and\n  readable than `(Subject\u003cSomeType\u003e it) \u003d\u003e`.\n- Consolidating `softCheck`, `softCheckSync`, `describe`, and\n  `describeSync` as instance methods on `Condition\u003cT\u003e` (and eliminating\n  standalone top-level functions `softCheck`, `softCheckAsync`,\n  `describe`, `describeAsync`) improves overall API discoverability and\n  ergonomics, despite being a breaking change.\n\nExample Migration:\n\nBefore:\n```dart\ncheck(numbers).any((it) \u003d\u003e it.isGreaterThan(5));\n\ncheck(map).containsKeyThat((key) \u003d\u003e key\n  ..startsWith(\u0027a\u0027)\n  ..has((s) \u003d\u003e s.length, \u0027length\u0027).isGreaterThan(2));\n```\n\nAfter:\n```dart\ncheck(numbers).any(.it()..isGreaterThan(5));\n\ncheck(map).containsKeyThat(.it()\n  ..startsWith(\u0027a\u0027)\n  ..has((s) \u003d\u003e s.length, \u0027length\u0027).isGreaterThan(2));\n```"
    },
    {
      "commit": "21a02b7319e72e99d742b37f05160e7c5a3a017a",
      "tree": "e6f0f581354f5fd9312cd3666886491e2c1feba6",
      "parents": [
        "2c431ed79e6d2c74ae88555584ce28b679899606"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Sep 04 23:10:08 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 04 23:10:08 2026"
      },
      "message": "Allow similar use between sync and async checks (#2683)\n\nCloses #2695\n\nOriginally async expectations which extract a value also returned a\n`Subject` like synchronous extensions still do, but they were changed to\naccept `AsyncCondition` callback arguments for ergonomics. Add support\nfor synchronous `Condition` callbacks on a few expectations that return\nsubjects for authors who prefer to use the async style for synchronous\nchecks too.\n\nAffected APIs:\n- `Subject.isA`\n- `Subject.isNotNull`\n- `Subject\u003cT Function()\u003e.throws`\n- `Subject\u003cT Function()\u003e.returnsNormally`\n\nRestore the `Future\u003cSubject\u003e` return value from async check extensions\nthat accept an optional `AsyncCondition` argument. This allows usage of\nother patterns which some authors may feel are better aligned with the\nsync checks of the original pattern.\n\nAffected APIs:\n- `Subject\u003cFuture\u003e.completes`\n- `Subject\u003cFuture\u003e.throws`\n- `Subject\u003cStreamQueue\u003e.emits`\n- `Subject\u003cStreamQueue\u003e.emitsError`\n\nRefactor tests into finer grained cases and add cases for the new\narguments."
    },
    {
      "commit": "2c431ed79e6d2c74ae88555584ce28b679899606",
      "tree": "6a106adcedae681ddd22f33e3e37f1da8a68c89c",
      "parents": [
        "18ef597883dc6bc61f763e3600a7179975b490dd"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Sep 04 21:08:23 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 04 21:08:23 2026"
      },
      "message": "Prepare to publish package:checks (#2748)\n\nPublish with a number of quality of life improvements before landing\nchanges planned for release with a breaking version bump.\n\nIncrease timeout for new socket hang test.\nThis is a new test that appears to have been too close to the limit\nwhen it landed."
    },
    {
      "commit": "18ef597883dc6bc61f763e3600a7179975b490dd",
      "tree": "087759aacd1c99c166f9e6ba04e824a4f1bb4a00",
      "parents": [
        "6783445c2ec0d34372bd75a1655729693ecd216a"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Sep 04 17:13:39 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 04 17:13:39 2026"
      },
      "message": "Add support for collapsed error messages (#2651)\n\nChecks against a subject are commonly nested against some other subject,\nfor example the check for an exact list length is in practice an\n`equals` expectation checked against an integer which is the \"has\nlength\" subject, nested under the subject holding the list instance.\nFailure messages have a rigid structure that represents this nesting\npattern and always indent the \"clauses\" (the descriptions of what was\nchecked in expectations) following the \"label\" which describes the\nsubject.\n\nFor very simple conditions the noise of the structure is greater than\nthe signal of the description output by the specific failing\nexpectation. For instance a trivial check for a future completing to an\nexpected value looks like:\n\n```\n  Expected: a Future\u003cList\u003cint\u003e\u003e that:\n    completes to a value that:\n      is not empty\n  Actual: a Future\u003cList\u003cint\u003e\u003e that:\n    completes to a value that:\n    Actual: []\n    Which: is empty\n```\n\nAdd support for collapsing this to:\n\n```\n  Expected: a Future\u003cList\u003cint\u003e\u003e that completes to a non-empty iterable\n  Actual: a Future\u003cList\u003cint\u003e\u003e that completes to []\n  Which: is empty\n```\n\nAdd a `predicateNoun` callback argument to `expect`, `expectAsync`, and\n`expectUnawaited`. Extensions must pass a callback which provides the\n\"clause\" representation like \"is empty\". Now they may also pass a\ncallback which provides a predicate noun formed by combining the clause\nwith a noun for the subject like \"an empty iterable\".\n\nAdd an `addPredicate` callback argument to `nest`, and `nestAsync`.\nExtensions must pass a callback which provides a label for the value\nthey are deriving from the original subject like \"completes to a value\".\nNow they may also pass a callback which takes a collapsed form of the\nnoun as described by nested conditions, and attaches the predicate it\ncontributes.\n\nCheck for possibilities to collapse failure messages down to predicate\nnouns when generating failure messages. When full single-line collapsing\nis not possible, child clauses and `Actual:` lines still collapse where\nsupported within the multi-line format.\n\nAdd predicate noun callbacks to existing extensions where sensible.\nTweak some wording where I noticed inconsistencies.\n\nUse of these new arguments is completely optional for extension\nimplementations and impacts only the failure message formatting which is\nnot considered a breaking change.\n\nThe user impact is that many simple expectation failures will be more\ncompact and readable, but the position of the failing expectation in a\nseries of cascaded expectations may cause a significantly different\noutput for the same checks usage. It has always been the case that\nexpectations which follow a failure have no impact on the output,\nbecause they are never reached to run. Now when the first expectation in\na series has a collapsible representation, its failure triggers an\noverall collapsed format which will read differently from the expanded\nformat if any condition other than the first fails."
    },
    {
      "commit": "6783445c2ec0d34372bd75a1655729693ecd216a",
      "tree": "53b9f0188a144f49c849ddb042dd0555cadc23f2",
      "parents": [
        "8de693e1be8e8da99c02e60eecc645054f90acf3"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Sep 02 23:46:04 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 02 23:46:04 2026"
      },
      "message": "Prepare to publish (#2737)"
    },
    {
      "commit": "8de693e1be8e8da99c02e60eecc645054f90acf3",
      "tree": "7ea94c33a13699cd7db77c63bcbc78db677930b3",
      "parents": [
        "575e4dad8db2864224a407af43bfc46ce9c045c8"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Sep 01 03:54:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 01 03:54:15 2026"
      },
      "message": "Bump the github-actions group with 2 updates (#2744)\n\nBumps the github-actions group with 2 updates: [dart-lang/setup-dart](https://github.com/dart-lang/setup-dart) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).\n\nUpdates `dart-lang/setup-dart` from 1.7.2 to 1.8.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/dart-lang/setup-dart/releases\"\u003edart-lang/setup-dart\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.8.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate workflows to pin \u003ccode\u003eactions/checkout\u003c/code\u003e to a commit SHA.\u003c/li\u003e\n\u003cli\u003eHarden workflow permissions to \u003ccode\u003econtents: read\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003epublish.yml\u003c/code\u003e reusable workflow to reference \u003ccode\u003esetup-dart@v1.8.0\u003c/code\u003e and latest \u003ccode\u003esetup-flutter\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to \u003ccode\u003e6.28.0\u003c/code\u003e and \u003ccode\u003e@vercel/ncc\u003c/code\u003e to \u003ccode\u003e0.44.1\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.8.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a problem matcher for \u003ccode\u003edart analyze\u003c/code\u003e to automatically create inline annotations on GitHub pull requests.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003epublish.yml\u003c/code\u003e reusable workflow to reference \u003ccode\u003esetup-dart@v1.7.2\u003c/code\u003e (running on Node 24) (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/188\"\u003e#188\u003c/a\u003e[]).\u003c/li\u003e\n\u003cli\u003eUpdate GitHub Action dependencies (\u003ccode\u003eactions/checkout\u003c/code\u003e v7).\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to \u003ccode\u003e6.27.0\u003c/code\u003e and update npm dependencies.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/188\"\u003e#188\u003c/a\u003e: \u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/188\"\u003edart-lang/setup-dart#188\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/dart-lang/setup-dart/blob/main/CHANGELOG.md\"\u003edart-lang/setup-dart\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.8.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate workflows to pin \u003ccode\u003eactions/checkout\u003c/code\u003e to a commit SHA.\u003c/li\u003e\n\u003cli\u003eHarden workflow permissions to \u003ccode\u003econtents: read\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003epublish.yml\u003c/code\u003e reusable workflow to reference \u003ccode\u003esetup-dart@v1.8.0\u003c/code\u003e and latest \u003ccode\u003esetup-flutter\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to \u003ccode\u003e6.28.0\u003c/code\u003e and \u003ccode\u003e@vercel/ncc\u003c/code\u003e to \u003ccode\u003e0.44.1\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.8.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a problem matcher for \u003ccode\u003edart analyze\u003c/code\u003e to automatically create inline annotations on GitHub pull requests.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003epublish.yml\u003c/code\u003e reusable workflow to reference \u003ccode\u003esetup-dart@v1.7.2\u003c/code\u003e (running on Node 24) (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/188\"\u003e#188\u003c/a\u003e[]).\u003c/li\u003e\n\u003cli\u003eUpdate GitHub Action dependencies (\u003ccode\u003eactions/checkout\u003c/code\u003e v7).\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to \u003ccode\u003e6.27.0\u003c/code\u003e and update npm dependencies.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/188\"\u003e#188\u003c/a\u003e: \u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/188\"\u003edart-lang/setup-dart#188\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.7.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Node.js requirement to Node 24.\u003c/li\u003e\n\u003cli\u003eFix open Dependabot alerts by bumping \u003ccode\u003eundici\u003c/code\u003e to \u003ccode\u003e\u0026gt;\u003d6.24.0\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUpdate GitHub Action dependencies (\u003ccode\u003e@actions/core\u003c/code\u003e, \u003ccode\u003e@actions/exec\u003c/code\u003e, \u003ccode\u003e@actions/tool-cache\u003c/code\u003e, \u003ccode\u003e@actions/http-client\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eUpdate workflow actions to their latest versions (\u003ccode\u003eactions/checkout\u003c/code\u003e v6, \u003ccode\u003esetup-flutter\u003c/code\u003e).\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.7.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRoll \u003ccode\u003eundici\u003c/code\u003e dependency to address \u003ca href\u003d\"https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975\"\u003eCVE-2025-22150\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eUpdate to the latest npm dependencies.\u003c/li\u003e\n\u003cli\u003eRecompile the action using the new Dart / JavaScript interop.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.7.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eInstall flutter sdk in publishing step, allowing Flutter packages to be\npublished (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/68\"\u003e#68\u003c/a\u003e[])\u003c/p\u003e\n\u003cp\u003e\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/68\"\u003e#68\u003c/a\u003e: \u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/68\"\u003edart-lang/setup-dart#68\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix zip path handling on Windows 11 (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/118\"\u003e#118\u003c/a\u003e[])\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/118\"\u003e#118\u003c/a\u003e: \u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/118\"\u003edart-lang/setup-dart#118\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.6.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRebuild JS code.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.3\u003c/h2\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/6afc89df92d6eb3834022f73cd65adc8cdfcb92d\"\u003e\u003ccode\u003e6afc89d\u003c/code\u003e\u003c/a\u003e Pin actions/checkout to a commit SHA and harden workflow permissions (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/196\"\u003e#196\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/b653b3cfefb8a28264680eac1d50028789184290\"\u003e\u003ccode\u003eb653b3c\u003c/code\u003e\u003c/a\u003e Prepare v1.8.1 release (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/195\"\u003e#195\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/45165d2ee1360cec3b96db808cfed1ac276dd71a\"\u003e\u003ccode\u003e45165d2\u003c/code\u003e\u003c/a\u003e Bump the github-actions group across 1 directory with 2 updates (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/194\"\u003e#194\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/9af6bba6fc903c8d3427e54f6bef88b1cb519a77\"\u003e\u003ccode\u003e9af6bba\u003c/code\u003e\u003c/a\u003e Pin actions/checkout to a commit SHA in publish.yml (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/193\"\u003e#193\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/ddca5d2081d05961010a263feb54fba5a01e4fb8\"\u003e\u003ccode\u003eddca5d2\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​vercel/ncc\u003c/code\u003e in the npm-dependencies group across 1 directory (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/185\"\u003e#185\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/5c116a34f6a4c3b222192b56c5440d03fc813d96\"\u003e\u003ccode\u003e5c116a3\u003c/code\u003e\u003c/a\u003e Bump undici from 6.27.0 to 6.28.0 (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/190\"\u003e#190\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/7654d458321ee25acccccfdb86cd48bd95768ff1\"\u003e\u003ccode\u003e7654d45\u003c/code\u003e\u003c/a\u003e chore: prepare v1.8.0 release (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/188\"\u003e#188\u003c/a\u003e) (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/189\"\u003e#189\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/43c102f4dc9b9829c862401f0b64c7c9184eab4e\"\u003e\u003ccode\u003e43c102f\u003c/code\u003e\u003c/a\u003e Bump actions/checkout from 6 to 7 in the github-actions group (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/184\"\u003e#184\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/10b57efefac07722403c8b9c95fa68bb09276def\"\u003e\u003ccode\u003e10b57ef\u003c/code\u003e\u003c/a\u003e Bump the npm-dependencies group across 1 directory with 2 updates (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/179\"\u003e#179\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/dart-lang/setup-dart/commit/a73965b3c99b30eb092908ce56c429eff91f9634\"\u003e\u003ccode\u003ea73965b\u003c/code\u003e\u003c/a\u003e Bump undici from 6.24.1 to 6.27.0 (\u003ca href\u003d\"https://redirect.github.com/dart-lang/setup-dart/issues/182\"\u003e#182\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/dart-lang/setup-dart/compare/65eb853c7ba17dde3be364c3d2858773e7144260...6afc89df92d6eb3834022f73cd65adc8cdfcb92d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.37.4 to 4.37.9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.9\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.8\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href\u003d\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.2 - 21 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote\u003d\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href\u003d\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.0 - 08 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003e\u003ccode\u003ecdf488f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4107\"\u003e#4107\u003c/a\u003e from github/update-v4.37.9-920ba7cd1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306\"\u003e\u003ccode\u003e7243f38\u003c/code\u003e\u003c/a\u003e Update changelog for v4.37.9\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e\"\u003e\u003ccode\u003e920ba7c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4106\"\u003e#4106\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2\"\u003e\u003ccode\u003eecfa6e1\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1\"\u003e\u003ccode\u003eadcdf4a\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e\"\u003e\u003ccode\u003e486fec2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4099\"\u003e#4099\u003c/a\u003e from github/update-supported-enterprise-server-versions\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76\"\u003e\u003ccode\u003e134624c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4101\"\u003e#4101\u003c/a\u003e from github/dependabot/npm_and_yarn/npm-minor-457d82...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c\"\u003e\u003ccode\u003eff43db8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/4103\"\u003e#4103\u003c/a\u003e from github/mergeback/v4.37.8-to-main-db488dde\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816\"\u003e\u003ccode\u003e4605e03\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d\"\u003e\u003ccode\u003e099c869\u003c/code\u003e\u003c/a\u003e Update changelog and version after v4.37.8\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s major version (unless you unignore this specific dependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s minor version (unless you unignore this specific dependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\u003c/details\u003e"
    },
    {
      "commit": "575e4dad8db2864224a407af43bfc46ce9c045c8",
      "tree": "c9c771baa247c30d9eef02ce0920522393984790",
      "parents": [
        "bd9acf32c983dde41b94e9c75eab45136408c065"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Sep 01 00:01:46 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 01 00:01:46 2026"
      },
      "message": "Fix deadlock waiting on serverSocket (#2740)\n\nWork around, and reduce the odds of triggering, a bug in the Dart SDK\nimplementation of unix domain sockets on windows.\n\nhttps://github.com/dart-lang/sdk/issues/64166\n\nOn windows in Dart sockets are being inherited by subprocesses, so\nspawned test processes (like the chrome browser) would inherit them, and\nsubsequently after receiving a connection the socket cancel would never\ncomplete (waiting on subprocess which inherited the socket to exit) so\nthe `Stream.first` future would also never complete. This surfaced as a\ndeadlock only in the case where a browser startup happens while the\nsocket server is waiting for the first connection.\n\nDrastically reduce the odds of this situation by waiting to bind the\nsocket server until the subprocess is about to start, instead of\nlistening on the socket during the compilation process as well.\n\nWork around the situation in case it still happens with a `fastFirst`\nextension which behaves like `first` except it explicitly does not await\nthe Future returned from `cancel`.\n\nAdd an integration test which demonstrates the conditions required to\ntrigger the bug. We can remove this after the SDK is fixed."
    },
    {
      "commit": "bd9acf32c983dde41b94e9c75eab45136408c065",
      "tree": "ab6500922f9243294e40eb4a88db260cfa6e88f9",
      "parents": [
        "b575eda93383390f15b5f0cb4243a097867a82f8"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Aug 28 05:53:54 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 28 05:53:54 2026"
      },
      "message": "Unskip a test on windows (#2741)\n\nI noticed it was working when testing a fix for a process hang."
    },
    {
      "commit": "b575eda93383390f15b5f0cb4243a097867a82f8",
      "tree": "48bbb9ed614667a272e252309088b60cd45cde83",
      "parents": [
        "d21b06cb526356ee41949fc984827b3ba4f532d2"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Aug 28 00:16:16 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 28 00:16:16 2026"
      },
      "message": "Remove redundant tag (#2738)\n\nThis tag was added along with support for VM debugging, but it was\nalways redundant and likely introduced because of confusion over whether\nit would impact whether this test case runs for VM tests. There is no\nconfiguration in `dart_test.yaml` associated with this tag.\n\nRemoves a warning to make the test output be more fully grouped in the\ngithub reporter output."
    },
    {
      "commit": "d21b06cb526356ee41949fc984827b3ba4f532d2",
      "tree": "4d33ec37eedcebb6b1d9aef8f417249202411218",
      "parents": [
        "773bc56c7514ab161e15ad48088b2627c4939f4b"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Aug 27 23:38:17 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 27 23:38:17 2026"
      },
      "message": "Bump the github-actions group across 1 directory with 5 updates (#2709)\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: Nate Bosch \u003cnbosch@google.com\u003e"
    },
    {
      "commit": "773bc56c7514ab161e15ad48088b2627c4939f4b",
      "tree": "acb6f9d45b00c9008ac1ea49b97f4eafeb024a4b",
      "parents": [
        "73e85f1befa5315711763fa3d097656dc53ecfb5"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Aug 27 23:11:00 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 27 23:11:00 2026"
      },
      "message": "Use read permissions in test_descriptor and test_process workflows (#2736)"
    },
    {
      "commit": "73e85f1befa5315711763fa3d097656dc53ecfb5",
      "tree": "a3b31a47e2b51fe6e15197d444f50e80d2853f04",
      "parents": [
        "bbe8f9bf5ee392ed2d80813b7faa892ab36da3e3"
      ],
      "author": {
        "name": "herdiyanitdev",
        "email": "82978131+herdiyana256@users.noreply.github.com",
        "time": "Tue Aug 25 23:36:41 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 25 23:36:41 2026"
      },
      "message": "Precompiled browser tests: stop serving files from outside the precompiled root (#2724)\n\nThe precompiled browser-test server serves files from outside its root because it disables shelf_static\u0027s path containment. `pkgs/test/lib/src/runner/browser/compilers/precompiled.dart` builds its static handler as:\n\n```dart\n.add(createStaticHandler(_root, serveFilesOutsidePath: true))\n```\n\nThe two sibling compilers in the same directory build the same handler without that flag:\n\n```dart\n// dart2js.dart and dart2wasm.dart\n.add(createStaticHandler(_root))\n```\n\nWith `serveFilesOutsidePath: true`, shelf_static stops rejecting requests whose path resolves outside `_root`, so a `..`-bearing request to the precompiled server is served a file from anywhere on disk the runner can read. Precompiled is the only one of the three that does this.\n\nRemoving the flag does not change what the browser can load. In precompiled mode `_root` is the precompiled output directory itself (`platform.dart` passes `root: _config.suiteDefaults.precompiledPath`), so the compiled `.js` bundles and their bootstrap `.html` already live under it. `/packages/` requests are served by the separate `packagesDirHandler` already in the cascade. Source maps are never fetched by the browser: `compileSuite` reads the `.js.map` server-side with `File(mapPath).readAsStringSync()` and builds a `JSStackTraceMapper` in the runner process. Nothing the browser requests needs a path outside `_root`, which is why dart2js and dart2wasm already serve an equivalent root with containment on.\n\nThe server binds to loopback and nests every handler under a per-run secret URL segment, and the comment on that secret says its job is to keep other users on the same machine from snooping on what the server serves. The secret does not actually hide from a co-located user: the full server URL is passed to the browser on its command line, so another local user can read it from `/proc/\u003cpid\u003e/cmdline`. With containment on that only lets them read within `_root`; with `serveFilesOutsidePath: true` it lets them read any file the runner user can read, for example `/\u003csecret\u003e/../../../home/\u003cuser\u003e/.ssh/id_rsa`. Removing the flag restores the boundary the secret is meant to enforce.\n\nThe fix drops the flag so precompiled matches the other two compilers:\n\n```dart\n// before\n.add(createStaticHandler(_root, serveFilesOutsidePath: true))\n// after\n.add(createStaticHandler(_root))\n```"
    },
    {
      "commit": "bbe8f9bf5ee392ed2d80813b7faa892ab36da3e3",
      "tree": "2d97b4ae75534542bf42adf52e4b2edc86aefb68",
      "parents": [
        "55b186ddcad50fe4808226e0b681875dda6dd123"
      ],
      "author": {
        "name": "Kevin Moore",
        "email": "kevmoo@users.noreply.github.com",
        "time": "Tue Aug 18 16:02:24 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 18 16:02:24 2026"
      },
      "message": "Export TestFailure from package:test_api/scaffolding.dart (#2723)\n\nRe-export `TestFailure` in `package:test_api/scaffolding.dart` (which in turn\nexports it in `package:test/scaffolding.dart`).\n\nThis allows users migrating from `package:test/test.dart` to\n`package:test/scaffolding.dart` (such as when using `package:checks`) to\nthrow or handle `TestFailure` exceptions without needing an explicit import\nof `package:test_api/hooks.dart`.\n\nCloses #2073"
    },
    {
      "commit": "55b186ddcad50fe4808226e0b681875dda6dd123",
      "tree": "0bba2dc36574a39354aba7c6302b93992cac84d2",
      "parents": [
        "51463b0e38b45fa3849c302bdea7a4e585ad0764"
      ],
      "author": {
        "name": "Sigurd Meldgaard",
        "email": "sigurdm@google.com",
        "time": "Mon Aug 10 20:18:01 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 10 20:18:01 2026"
      },
      "message": "Fix race conditions in Chrome coverage collection (#2715)\n\nFixes race conditions causing intermittent empty coverage results in\nchrome tests (such as in `coverage_test.dart`).\n\n- in `browsermanager`: await `_environment` during startup before\n  completing initialization. this ensures the devtools connection and\n  profiler are ready before test suites begin executing.\n- in `chrome`:\n  - register the `onscriptparsed` listener before calling\n    `tabconnection.debugger.enable()` to avoid dropping initial\n    `debugger.scriptparsed` events emitted during initialization.\n  - establish the remote debugger url and tab connection together in\n    `_connect`, returning both as a record.\n  - safely handle null tab connections in `gathercoverage`."
    },
    {
      "commit": "51463b0e38b45fa3849c302bdea7a4e585ad0764",
      "tree": "0c4f39a0176e0dee8ed1247958ad464e435e1b31",
      "parents": [
        "b87a24924c1d167d848ac36ec0ad4c74752026bf"
      ],
      "author": {
        "name": "Yusuf İhsan Görgel",
        "email": "developeryusuf@icloud.com",
        "time": "Mon Aug 10 18:59:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 10 18:59:15 2026"
      },
      "message": "Keep the browser executable env override through a settings merge (#2722)\n\nFixes #2609\n\nUpdate `README.md` and `configuration.md` to document the four\nenvironment variables and the precedence of configuration. Fix broken\nanchor links.\n\nFix configuration merging to include the environment overrides to\nresolve the bug where using browser configuration would cause the runner\nto ignore the environment variables. Add a test in\n`cutsom_platform_test.dart` to configure chrome arguments and use an\noverride environment variable."
    },
    {
      "commit": "b87a24924c1d167d848ac36ec0ad4c74752026bf",
      "tree": "3fb24630adae43ced65f784578d43488c90a107d",
      "parents": [
        "dd426d439da9d399975a3455d4d507bce9fec01b"
      ],
      "author": {
        "name": "Jacob MacDonald",
        "email": "jakemac@google.com",
        "time": "Fri Aug 07 19:07:52 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 07 19:07:52 2026"
      },
      "message": "Enable asserts (#2719)\n\nFixes #2718"
    },
    {
      "commit": "dd426d439da9d399975a3455d4d507bce9fec01b",
      "tree": "cd045c023bd65eefa3b6c81c4b697d5a2fc77fe0",
      "parents": [
        "4838365e7fb3a2d0302cdbbd8330b7884f7d3c0d"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Aug 04 22:46:52 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 04 22:46:52 2026"
      },
      "message": "Obfuscate the test runner connection for VM and Node tests (#2704)\n\nUnix domain sockets (using a file in a freshly created temp directory)\nare more secure by default than server sockets. Since Dart 3.11.0 (and\nwindows 10) we have the ability to use unix domain sockets on windows,\nso use them for VM tests now.\n\nNode on windows still does not support unix domain sockets, so add a\nsecret token shared in a freshly created temp directory."
    },
    {
      "commit": "4838365e7fb3a2d0302cdbbd8330b7884f7d3c0d",
      "tree": "853d6342d9bd413c2f92f655a999894b45ceaf21",
      "parents": [
        "70ac3ff48fe0ff6198b69ffc309554eaf2713a53"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Aug 04 21:22:07 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 04 21:22:07 2026"
      },
      "message": "Avoid transitive imports to package:analyzer (#2712)\n\nCloses https://github.com/dart-lang/sdk/issues/63923\n\nThe analyzer package sources dominate the compile time for small tests.\nAvoid importing the analyzer transitively from `package:test/test.dart`.\n\nMove the tests of the `test_api` import restrictions to the integration\ntest directory so it\u0027s easier to reuse for tests across the packages.\nAdd a test that `package:test/test.dart` does not transitively import\nany library under the analyzer package.\n\nUse a more narrow import of the parts of the `Platform` library which\nare needed in the JSON reporter implementation."
    },
    {
      "commit": "70ac3ff48fe0ff6198b69ffc309554eaf2713a53",
      "tree": "f7b956b9591b027211bdfe54396ac462a2668be3",
      "parents": [
        "bdc372215035729467c10d37293a18f7a42038bc"
      ],
      "author": {
        "name": "HamdaanAliQuatil",
        "email": "96776914+HamdaanAliQuatil@users.noreply.github.com",
        "time": "Tue Aug 04 06:50:07 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 04 06:50:07 2026"
      },
      "message": "[test] Support CLI compiler for sanitizer runtimes (#2708)"
    },
    {
      "commit": "bdc372215035729467c10d37293a18f7a42038bc",
      "tree": "78039aa36e8be85c57c3a7d7c2b64e56ad417419",
      "parents": [
        "a9a4442708cc61b7d1169812b3938fb9c64e444d"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Aug 04 01:01:34 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 04 01:01:34 2026"
      },
      "message": "Avoid read-all permissions in dart.yml CI action (#2713)\n\nResolves a zizmor warning."
    },
    {
      "commit": "a9a4442708cc61b7d1169812b3938fb9c64e444d",
      "tree": "f7c6c8161499c124a65b31e1cf52f28282107310",
      "parents": [
        "5fcd6f405cc4a9c503f0eafa476d675f63a91bb8"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Sat Aug 01 01:45:09 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 01 01:45:09 2026"
      },
      "message": "Annotate async expectations with awaitNotRequired (#2700)\n\nCloses #2139\n\nAsynchronous expectations which return a `Future` already use\n`TestHandle.current.markPending()` so that test cases are not considered\ncomplete until after the expectations are complete. Some uses will want\nto `await` anyway to maintain execution order in tests, but it\u0027s valid\nto \"fire and forget\" asynchronous expectations when execution order\ndoesn\u0027t matter. Annotate with `@awaitNotRequired` so this is explicit\nand the `unawaited_futures` lint is suppressed at call sites."
    },
    {
      "commit": "5fcd6f405cc4a9c503f0eafa476d675f63a91bb8",
      "tree": "6bdd304d9dd28f4668540f3c2a3d623848d638f2",
      "parents": [
        "72d6dfcc9a8ad7df52315ecc589a04584d160235"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Jul 23 23:01:06 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 23:01:06 2026"
      },
      "message": "Remove unnecessary remote debugging flag (#2705)\n\nThe comment above the argument is outdated - chromium based browsers\nlaunched with the arguments we are using, including a unique user\nprofile directory not associated with any running browser instance, will\nwork without also opening a debugging port."
    },
    {
      "commit": "72d6dfcc9a8ad7df52315ecc589a04584d160235",
      "tree": "5eac335e7aabd0a906ff29f4894072aa165b7e16",
      "parents": [
        "8ab388460a1dbe87991b1bc500e221317840d53f"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Jul 23 21:02:30 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 21:02:30 2026"
      },
      "message": "Launch browsers with redirecting files (#2703)\n\nThe test runner creates a secret key used for communication with the\nbrowsers to prevent third party processes from connecting as if they\nwere running test suites, but this key is current leaking through the\ncommand arguments when starting the browser process. We are already\nusing temp directories which should prevent external reads and the\nsafari browser launcher already used this pattern. Extend the\n`redirect.html` pattern to chromium and firefox browsers."
    },
    {
      "commit": "8ab388460a1dbe87991b1bc500e221317840d53f",
      "tree": "19c112f7d388b78e6d68bec8068103dbf0c26587",
      "parents": [
        "d835f706cfb62d09df445c464ec5a7cfa22a1f69"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Jul 23 20:50:10 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 20:50:10 2026"
      },
      "message": "Disable more backgrounding features on chromium (#2680)\n\nAdd more flags to disable backgrounding when launching chromium based\nbrowsers. These came up in an internal CL but should be helpful to\ninclude externally."
    },
    {
      "commit": "d835f706cfb62d09df445c464ec5a7cfa22a1f69",
      "tree": "0b2e07b4a51c09f15a80d43d92f8652ca784d3e0",
      "parents": [
        "9abe202a42014f8127ac31c4c6440a336ec15502"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Jul 22 23:30:46 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 22 23:30:46 2026"
      },
      "message": "Only print debug URL when debugging (#2702)\n\nEither `--coverage` or `--pause-after-load` is sufficient to enable\nthe `debug` state for the test runner, but in the case of `--coverage`\nwithout interactive debugging the VM debugger URL is not relevant to the\nuser. Change the condition used to decide whether to include this URL in\nthe JSON reporter output to only when `--pause-after-load` is used."
    },
    {
      "commit": "9abe202a42014f8127ac31c4c6440a336ec15502",
      "tree": "c9c6532ec59d496bb8e6821f5730aef0e59ff784",
      "parents": [
        "ce557ba1bf935ca8dbf199fc4b3b9c4b486806e7"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Tue Jul 21 18:56:41 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 21 18:56:41 2026"
      },
      "message": "Ignore dart2js output for successful compiles (#2701)\n\nFollowup to #2699\n\nThe compiler output had some utility when dart2js could be slow for some\ntest runs, but it\u0027s likely ignored nearly always today.\n\nDrop the output from successful compiles and output only when the exit\ncode indicates an error. Update test expectations accordingly."
    },
    {
      "commit": "ce557ba1bf935ca8dbf199fc4b3b9c4b486806e7",
      "tree": "25f1a07c905e5204dcb41a1e9cf45ff647b0cde5",
      "parents": [
        "d79747cd5dff76ea53f8e4d722a1bc69d468b550"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Mon Jul 20 23:25:56 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 20 23:25:56 2026"
      },
      "message": "Group messages with passing tests (#2699)\n\nCloses #2636\n\nWeb tests (currently) unconditionally print information about the compile, so\ntreating messages during loading as separate output from passing tests\ncauses significantly longer output when web and VM tests are\ninterleaved.\n\nAvoid closing groups for tests that print messages. This will impact\nmore than loading tests, but won\u0027t impact errors which are the important\noutput."
    },
    {
      "commit": "d79747cd5dff76ea53f8e4d722a1bc69d468b550",
      "tree": "659ce948e967d419f6e06352d04b4a199cd50bc0",
      "parents": [
        "91ca13f0d38155e5b3a7e5ec1dc6f2904ced1f4f"
      ],
      "author": {
        "name": "Jacob MacDonald",
        "email": "jakemac@google.com",
        "time": "Fri Jul 17 20:10:12 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 20:10:12 2026"
      },
      "message": "Make workflow files more secure (#2698)\n\nThis is just a result of running `zizmore --fix\u003dall` on this package"
    },
    {
      "commit": "91ca13f0d38155e5b3a7e5ec1dc6f2904ced1f4f",
      "tree": "ab81966d3664ab261886f30021015f99d0e80236",
      "parents": [
        "dcb06ac7b2c26a8e4aa9139e45d56c07c00be7c0"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Jul 08 21:17:45 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 08 21:17:45 2026"
      },
      "message": "Support DART_TEST_REPORTER environment variable (#2692)\n\nAllow configuring the test reporter using the `DART_TEST_REPORTER`\nenvironment variable.\n\nThis variable is honored by:\n- Test suites run directly (when `dart:io` is available).\n- The test runner (when `--reporter` CLI flag is not used).\n\nThe order of precedence for the test runner is:\n1. `dart_test.yaml`\n2. `DART_TEST_REPORTER` environment variable\n3. `--reporter` CLI argument (highest priority)"
    },
    {
      "commit": "dcb06ac7b2c26a8e4aa9139e45d56c07c00be7c0",
      "tree": "57f074e9930c9a9181336c395d2893fd1dc1c05c",
      "parents": [
        "bd92e633e7f05edc3301865bdc00d1ae181cb1f1"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jul 01 03:50:42 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 01 03:50:42 2026"
      },
      "message": "Bump the github-actions group with 3 updates (#2689)\n\nBumps the github-actions group with 3 updates: [actions/cache](https://github.com/actions/cache), [actions/checkout](https://github.com/actions/checkout) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).\n\nUpdates `actions/cache` from 5.0.5 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/cache/releases\"\u003eactions/cache\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/cache\u003c/code\u003e to v6.1.0 - handle read-only cache access by \u003ca href\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1768\"\u003eactions/cache#1768\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/cache/compare/v6...v6.1.0\"\u003ehttps://github.com/actions/cache/compare/v6...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate packages, migrate to ESM by \u003ca href\u003d\"https://github.com/Samirat\"\u003e\u003ccode\u003e@​Samirat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1760\"\u003eactions/cache#1760\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/cache/compare/v5...v6.0.0\"\u003ehttps://github.com/actions/cache/compare/v5...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/cache\u003c/code\u003e to v5.1.0 - handle read-only cache access by \u003ca href\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1775\"\u003eactions/cache#1775\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/cache/compare/v5...v5.1.0\"\u003ehttps://github.com/actions/cache/compare/v5...v5.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/cache/blob/main/RELEASES.md\"\u003eactions/cache\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleases\u003c/h1\u003e\n\u003ch2\u003eHow to prepare a release\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\nRelevant for maintainers with write access only.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003col\u003e\n\u003cli\u003eSwitch to a new branch from \u003ccode\u003emain\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003enpm test\u003c/code\u003e to ensure all tests are passing.\u003c/li\u003e\n\u003cli\u003eUpdate the version in \u003ca href\u003d\"https://github.com/actions/cache/blob/main/package.json\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/package.json\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003enpm run build\u003c/code\u003e to update the compiled files.\u003c/li\u003e\n\u003cli\u003eUpdate this \u003ca href\u003d\"https://github.com/actions/cache/blob/main/RELEASES.md\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/RELEASES.md\u003c/code\u003e\u003c/a\u003e with the new version and changes in the \u003ccode\u003e## Changelog\u003c/code\u003e section.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003elicensed cache\u003c/code\u003e to update the license report.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003elicensed status\u003c/code\u003e and resolve any warnings by updating the \u003ca href\u003d\"https://github.com/actions/cache/blob/main/.licensed.yml\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/.licensed.yml\u003c/code\u003e\u003c/a\u003e file with the exceptions.\u003c/li\u003e\n\u003cli\u003eCommit your changes and push your branch upstream.\u003c/li\u003e\n\u003cli\u003eOpen a pull request against \u003ccode\u003emain\u003c/code\u003e and get it reviewed and merged.\u003c/li\u003e\n\u003cli\u003eDraft a new release \u003ca href\u003d\"https://github.com/actions/cache/releases\"\u003ehttps://github.com/actions/cache/releases\u003c/a\u003e use the same version number used in \u003ccode\u003epackage.json\u003c/code\u003e\n\u003col\u003e\n\u003cli\u003eCreate a new tag with the version number.\u003c/li\u003e\n\u003cli\u003eAuto generate release notes and update them to match the changes you made in \u003ccode\u003eRELEASES.md\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eToggle the set as the latest release option.\u003c/li\u003e\n\u003cli\u003ePublish the release.\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/li\u003e\n\u003cli\u003eNavigate to \u003ca href\u003d\"https://github.com/actions/cache/actions/workflows/release-new-action-version.yml\"\u003ehttps://github.com/actions/cache/actions/workflows/release-new-action-version.yml\u003c/a\u003e\n\u003col\u003e\n\u003cli\u003eThere should be a workflow run queued with the same version number.\u003c/li\u003e\n\u003cli\u003eApprove the run to publish the new version and update the major tags for this action.\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2\u003eChangelog\u003c/h2\u003e\n\u003ch3\u003e6.1.0\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/cache\u003c/code\u003e to v6.1.0 to pick up \u003ca href\u003d\"https://redirect.github.com/actions/toolkit/pull/2435\"\u003eactions/toolkit#2435 Handle cache write error due to read-only token\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSwitch redundant \u0026quot;Cache save failed\u0026quot; warning to debug log in save-only\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e6.0.0\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated \u003ccode\u003e@actions/cache\u003c/code\u003e to ^6.0.1, \u003ccode\u003e@actions/core\u003c/code\u003e to ^3.0.1, \u003ccode\u003e@actions/exec\u003c/code\u003e to ^3.0.0, \u003ccode\u003e@actions/io\u003c/code\u003e to ^3.0.2\u003c/li\u003e\n\u003cli\u003eMigrated to ESM module system\u003c/li\u003e\n\u003cli\u003eUpgraded Jest to v30 and test infrastructure to be ESM compatible\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.4\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eminimatch\u003c/code\u003e to v3.1.5 (fixes ReDoS via globstar patterns)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003efast-xml-parser\u003c/code\u003e to v5.5.6\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.3\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/cache\u003c/code\u003e to v5.0.5 (Resolves: \u003ca href\u003d\"https://github.com/actions/cache/security/dependabot/33\"\u003ehttps://github.com/actions/cache/security/dependabot/33\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/core\u003c/code\u003e to v2.0.3\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.2\u003c/h3\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9\"\u003e\u003ccode\u003e55cc834\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/cache/issues/1768\"\u003e#1768\u003c/a\u003e from jasongin/readonly-cache\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337\"\u003e\u003ccode\u003ed8cd72f\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to v6.1.0 - handle cache write error due to RO token\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8\"\u003e\u003ccode\u003e2c8a9bd\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/cache/issues/1760\"\u003e#1760\u003c/a\u003e from actions/samirat/esm_migration_and_package_update\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023\"\u003e\u003ccode\u003ee9b91fd\u003c/code\u003e\u003c/a\u003e Prettier fixes\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb\"\u003e\u003ccode\u003ee4884b8\u003c/code\u003e\u003c/a\u003e Rebuild dist\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f\"\u003e\u003ccode\u003e10baf01\u003c/code\u003e\u003c/a\u003e Fixed licenses\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37\"\u003e\u003ccode\u003ee39b386\u003c/code\u003e\u003c/a\u003e Fix test mock return order\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06\"\u003e\u003ccode\u003eb692820\u003c/code\u003e\u003c/a\u003e PR feedback\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1\"\u003e\u003ccode\u003e6074912\u003c/code\u003e\u003c/a\u003e Rebuild dist bundles as ESM to match type:module\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e\"\u003e\u003ccode\u003e5a912e8\u003c/code\u003e\u003c/a\u003e Fix lint and jest issues\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/checkout` from 6.0.2 to 7.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/checkout/releases\"\u003eactions/checkout\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eblock checking out fork pr for pull_request_target and workflow_run by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2458\"\u003eactions/checkout#2458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.1 to 3.4.2 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2460\"\u003eactions/checkout#2460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.2.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2461\"\u003eactions/checkout#2461\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e and \u003ccode\u003e@​actions/tool-cache\u003c/code\u003e and Remove uuid by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2459\"\u003eactions/checkout#2459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade module to esm and update dependencies by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2463\"\u003eactions/checkout#2463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 3 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2462\"\u003eactions/checkout#2462\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003egetting ready for checkout v7 release by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2464\"\u003eactions/checkout#2464\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate error wording by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2467\"\u003eactions/checkout#2467\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/checkout/compare/v6.0.3...v7.0.0\"\u003ehttps://github.com/actions/checkout/compare/v6.0.3...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate changelog by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2357\"\u003eactions/checkout#2357\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate changelog for v6.0.3 by \u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2446\"\u003eactions/checkout#2446\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/checkout/compare/v6...v6.0.3\"\u003ehttps://github.com/actions/checkout/compare/v6...v6.0.3\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock checking out fork PR for pull_request_target and workflow_run by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2458\"\u003eactions/checkout#2458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.1 to 3.4.2 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2460\"\u003eactions/checkout#2460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.2.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2461\"\u003eactions/checkout#2461\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e and \u003ccode\u003e@​actions/tool-cache\u003c/code\u003e and Remove uuid by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2459\"\u003eactions/checkout#2459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade module to esm and update dependencies by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2463\"\u003eactions/checkout#2463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 3 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2462\"\u003eactions/checkout#2462\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca href\u003d\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca href\u003d\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca href\u003d\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca href\u003d\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca href\u003d\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca href\u003d\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment variables by \u003ca href\u003d\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca href\u003d\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca href\u003d\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0\"\u003e\u003ccode\u003e9c091bb\u003c/code\u003e\u003c/a\u003e update error wording (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2467\"\u003e#2467\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a\"\u003e\u003ccode\u003e1044a6d\u003c/code\u003e\u003c/a\u003e getting ready for checkout v7 release (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2464\"\u003e#2464\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f\"\u003e\u003ccode\u003ef028218\u003c/code\u003e\u003c/a\u003e Bump the minor-npm-dependencies group across 1 directory with 3 updates (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2462\"\u003e#2462\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d\"\u003e\u003ccode\u003ed914b26\u003c/code\u003e\u003c/a\u003e upgrade module to esm and update dependencies (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2463\"\u003e#2463\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d\"\u003e\u003ccode\u003e537c7ef\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/core\u003c/code\u003e and \u003ccode\u003e@​actions/tool-cache\u003c/code\u003e and Remove uuid (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2459\"\u003e#2459\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6\"\u003e\u003ccode\u003e130a169\u003c/code\u003e\u003c/a\u003e Bump js-yaml from 4.1.0 to 4.2.0 (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2461\"\u003e#2461\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3\"\u003e\u003ccode\u003e7d09575\u003c/code\u003e\u003c/a\u003e Bump flatted from 3.3.1 to 3.4.2 (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2460\"\u003e#2460\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e\"\u003e\u003ccode\u003e0f9f3aa\u003c/code\u003e\u003c/a\u003e Bump actions/publish-immutable-action (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2458\"\u003e#2458\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7\"\u003e\u003ccode\u003ef9e715a\u003c/code\u003e\u003c/a\u003e block checking out fork pr for pull_request_target and workflow_run (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2454\"\u003e#2454\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10\"\u003e\u003ccode\u003edf4cb1c\u003c/code\u003e\u003c/a\u003e Update changelog for v6.0.3 (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2446\"\u003e#2446\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.36.0 to 4.36.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.36.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCache CodeQL CLI version information across Actions steps. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3943\"\u003e#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3937\"\u003e#3937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6\"\u003e2.25.6\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3948\"\u003e#3948\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.36.1\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.2 - 04 Jun 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCache CodeQL CLI version information across Actions steps. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3943\"\u003e#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3937\"\u003e#3937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6\"\u003e2.25.6\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3948\"\u003e#3948\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.36.1 - 02 Jun 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.0 - 22 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.19.4. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.5 - 15 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca href\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal \u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will be enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for GitHub-internal use only, and may change without notice at any time. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning analysis for a PR with \u003ca href\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.4 - 07 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.3 - 01 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP OIDC are now accepted. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use \u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.2 - 15 Apr 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled using the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the \u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e. \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/8aad20d150bbac5944a9f9d289da16a4b0d87c1e\"\u003e\u003ccode\u003e8aad20d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3949\"\u003e#3949\u003c/a\u003e from github/update-v4.36.2-dcb947ce1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/f521b08cd8f468ab193ea950a589cb2e9c869c6a\"\u003e\u003ccode\u003ef521b08\u003c/code\u003e\u003c/a\u003e Add additional changelog notes\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/8aeff0ffb7b78582ee0d0e6eebb8140684400d08\"\u003e\u003ccode\u003e8aeff0f\u003c/code\u003e\u003c/a\u003e Update changelog for v4.36.2\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/dcb947ce15976d40ea82935510b2db4872ec124c\"\u003e\u003ccode\u003edcb947c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3948\"\u003e#3948\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.25.6\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/c251bcefa178f7780f62f150002acffe3d07fde9\"\u003e\u003ccode\u003ec251bce\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/62953c18b35f59e28351d2f1e806925aef8b1e3c\"\u003e\u003ccode\u003e62953c1\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.25.6\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/423b570baf1976cd7a3daeba5d6e9f9b76432f37\"\u003e\u003ccode\u003e423b570\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3946\"\u003e#3946\u003c/a\u003e from github/dependabot/npm_and_yarn/npm-minor-5d507a...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/c35d1b164463ee62a100735382aaaa525c5d3496\"\u003e\u003ccode\u003ec35d1b1\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3947\"\u003e#3947\u003c/a\u003e from github/dependabot/github_actions/dot-github/wor...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/cb1a588b02755b176e7b9d033ed4b69312f0e1bd\"\u003e\u003ccode\u003ecb1a588\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3937\"\u003e#3937\u003c/a\u003e from github/robertbrignull/waitForProcessing_backoff\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/github/codeql-action/commit/ba47406412c54532b5b4fcfbaf877c9e2382b206\"\u003e\u003ccode\u003eba47406\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/github/codeql-action/issues/3943\"\u003e#3943\u003c/a\u003e from github/henrymercer/cache-cli-version-info\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...8aad20d150bbac5944a9f9d289da16a4b0d87c1e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s major version (unless you unignore this specific dependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency\u0027s minor version (unless you unignore this specific dependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\u003c/details\u003e"
    },
    {
      "commit": "bd92e633e7f05edc3301865bdc00d1ae181cb1f1",
      "tree": "9ff664f7cef2fb308e27cec60f2993f4db4c37a7",
      "parents": [
        "4724c3e7f11b4353581f669f74474c9543c259cb"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Sat Jun 27 01:31:05 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Jun 27 01:31:05 2026"
      },
      "message": "Prepare to publish (#2686)"
    },
    {
      "commit": "4724c3e7f11b4353581f669f74474c9543c259cb",
      "tree": "6badf9c8e1f77203d2f08b49483516ce302ecf54",
      "parents": [
        "7ec7891273cd7940d247a6f0ee32c39972854ef5"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Fri Jun 26 17:40:41 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 26 17:40:41 2026"
      },
      "message": "Use compact reporters by default for direct runs (#2685)\n\nSince we cannot import `dart:io` for tests running on the web we\nhistorically defaulted to the expanded reporter as the only alternative\nto the compact reporter. This doesn\u0027t match most users preferences since\nit makes a verbose output in all cases.\n\nDefault instead to the failures only reporter which is quieter, and add\na platform specific library to automatically switch to the compact\nreporter when it\u0027s supported by both the Dart platform and the runtime\nenvironment."
    },
    {
      "commit": "7ec7891273cd7940d247a6f0ee32c39972854ef5",
      "tree": "a7ef3453645debac590fd88fd5d11e0fdab9040c",
      "parents": [
        "4ba65bdd5e3bf4c98eb869aa81f2c55254275578"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Jun 25 23:49:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jun 25 23:49:15 2026"
      },
      "message": "Add `isNotA\u003cR\u003e()` extension (#2681)\n\nCloses #2673\n\nIn a negative type check context it is not sensible to perform further\nchecks, but that may be tempting (potentially with autocomplete) in an\nexpression like `not((it) \u003d\u003e it.isA\u003cFoo\u003e()`. Add an `isNotA\u003cR\u003e`\nextension which does not return a subject."
    },
    {
      "commit": "4ba65bdd5e3bf4c98eb869aa81f2c55254275578",
      "tree": "f4f109fd4d939fd8dac217c6b73707a2cadf12c2",
      "parents": [
        "3d8c1f7379cf7fe68135622ef0496fdca72f1118"
      ],
      "author": {
        "name": "Daco Harkes",
        "email": "dacoharkes@google.com",
        "time": "Thu Jun 25 17:51:01 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jun 25 17:51:01 2026"
      },
      "message": "[test] More `dart test -c cli` fixes (#2677)\n\nMore fixes to make `dart --enable-experiment\u003drecord-use test -c cli` work:\r\n\r\n* Fix forwarding experiment flags to the Dart compiler.\r\n* Fix concurrency issues:\r\n  * Don\u0027t override compiled app bundles, dir otherwise only `-j 1` succeeds.\r\n  * https://dart-review.googlesource.com/c/sdk/+/515600/3/pkg/dartdev/lib/src/commands/build.dart also for `-j` more than 1.\r\n* Fix pub workspace behavior: Specify the correct root package when running tests in workspaces.\r\n* Fix windows (the bundle executable ends with `.exe`).\r\n\r\nAfter this PR and https://dart-review.googlesource.com/c/sdk/+/515600, the test project in https://github.com/dart-lang/native/pull/3424 works as expected.\r\n\r\n~~A release to pub.dev. Should it be 1.33 instead because we add a new feature? Any in flight changes that block a release @natebosch @jakemac53 ?~~ Edit: First landing the changes before bumping the versions."
    },
    {
      "commit": "3d8c1f7379cf7fe68135622ef0496fdca72f1118",
      "tree": "6ce17847dd3bff2c8a1641b48025932a4d0deee1",
      "parents": [
        "e768f8d9abc037bd47a1ad7d349baf14dee767d6"
      ],
      "author": {
        "name": "Kevin Moore",
        "email": "kevmoo@users.noreply.github.com",
        "time": "Tue Jun 23 00:14:11 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 23 00:14:11 2026"
      },
      "message": "fix(node): update dart2wasm runner for new instantiation API (#2682)"
    },
    {
      "commit": "e768f8d9abc037bd47a1ad7d349baf14dee767d6",
      "tree": "ff88e064b4de604fafe047da125ed69bddfcec75",
      "parents": [
        "1020c783adbebea6dc64627e2418cc6f7576fde6"
      ],
      "author": {
        "name": "Jacob MacDonald",
        "email": "jakemac@google.com",
        "time": "Mon Jun 22 22:00:08 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 22 22:00:08 2026"
      },
      "message": "fix package:test CI jobs (#2678)\n\nFix windows edge test expectations.\n\nSkip Node+WASM tests and link issue https://github.com/dart-lang/test/issues/2679"
    },
    {
      "commit": "1020c783adbebea6dc64627e2418cc6f7576fde6",
      "tree": "cf174a435a948ee20e3feb969401d1e5126f777b",
      "parents": [
        "113123d9e6bb624c568d19a706df2bf0c6961b04"
      ],
      "author": {
        "name": "Konstantin Scheglov",
        "email": "scheglov@google.com",
        "time": "Fri Jun 19 16:25:42 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 19 16:25:42 2026"
      },
      "message": "Require \u0027analyzer \u003e\u003d13.0.0 \u003c15.0.0\u0027 (#2676)"
    },
    {
      "commit": "113123d9e6bb624c568d19a706df2bf0c6961b04",
      "tree": "69c76cdc689c3c46afae26ca1248e31e8738d436",
      "parents": [
        "2283825c186d3c4e025b0d9ba084ca9eeeb3bd23"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Thu Jun 11 00:48:48 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jun 11 00:48:48 2026"
      },
      "message": "Add package:checks_codegen (#2632)\n\nInitial open sourcing of the code generation companion to\n`package:checks`. This generates extension using the `.has()` utility\nfor each field in the classes specified for generation.\n\nAdd an annotation to mark imports of the generated libraries as a\ntrigger for the codegen as configuration for which types to generate\nfor. Add the builder using `package:source_gen` to target the\nannotation. Add tests using `package:build_test`. Add an example with a\nchecked in generated file."
    },
    {
      "commit": "2283825c186d3c4e025b0d9ba084ca9eeeb3bd23",
      "tree": "0898229f1bcba4bbe0572b4e132739a6461fa1c0",
      "parents": [
        "2adf8b546d878cb7f6534653d0a821ac7e1f5753"
      ],
      "author": {
        "name": "Jacob MacDonald",
        "email": "jakemac@google.com",
        "time": "Mon Jun 08 18:29:44 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 08 18:29:44 2026"
      },
      "message": "allow package_config version 3.x.x (#2667)"
    },
    {
      "commit": "2adf8b546d878cb7f6534653d0a821ac7e1f5753",
      "tree": "e0263429f0de869f9f70830f4ca1045522177711",
      "parents": [
        "e3df43cff88de1da8fc076561bf4a3fdaa167c07"
      ],
      "author": {
        "name": "Daco Harkes",
        "email": "dacoharkes@google.com",
        "time": "Mon Jun 08 17:20:54 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 08 17:20:54 2026"
      },
      "message": "[test] Add compiler `dart test -c cli` to run hooks (#2660)\n\nBug:\r\n\r\n* https://github.com/dart-lang/sdk/issues/63372\r\n\r\nThis PR uses `dart build cli` under the `-c cli` flag.\r\n\r\nImplementation:\r\n\r\n* The wrapper Dart script around the test that package test creates is the new entry-point and **must** be within the package root to run the correct hooks.\r\n  * So, this PR updates the temp dir to be in `.dart_tool/test/temp/\u003c...\u003e` rather than in the system temp.\r\n* Gates the implementation on the next dev release after https://dart-review.googlesource.com/c/sdk/+/506242.\r\n\r\nTesting:\r\n\r\n* The integration tests run with the `cli` compiler\r\n* The integration tests must run on a valid package with a valid pubspec and package_config.json (otherwise the hooks-runner cannot determine which hooks to run).\r\n* The integration tests do _not_ actually run a hook and include c code. `dart build cli` bundles are already properly tested in the dartdev tests for `dart build cli` in the SDK. If you feel we should add an integration test running native code here, I\u0027m happy to add one.\r\n* Skips the tests before the next dev release.\r\n  * **TODO**: Rerun tests on Tuesday after new dev release has come out."
    },
    {
      "commit": "e3df43cff88de1da8fc076561bf4a3fdaa167c07",
      "tree": "b14dff4843f4f46657e32ff84d7a9e2a2c3b1103",
      "parents": [
        "f7a6b6271e3b8fcc8a452330e2a0434439c10f96"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Jun 03 23:40:03 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 03 23:40:03 2026"
      },
      "message": "Disable chrome throttling options (#2666)\n\nI don\u0027t expect this to have an effect in typical tests, but in case a\ntest opens a new tab or similar it\u0027s a good idea to disable throttling\nwhen the browser is controlled by automation."
    },
    {
      "commit": "f7a6b6271e3b8fcc8a452330e2a0434439c10f96",
      "tree": "594a5c20f66083a67147a189140a9be5e0b901ca",
      "parents": [
        "d270d51aa590f69a92fc76dec985eaeeaf6a0a87"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Jun 03 22:39:08 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 03 22:39:08 2026"
      },
      "message": "Recompile host.dart with 3.12.1 SDK (#2645)"
    },
    {
      "commit": "d270d51aa590f69a92fc76dec985eaeeaf6a0a87",
      "tree": "ba5a50740f15a176f809e9761b31e7a93381d51b",
      "parents": [
        "5a897b2ff53d681a5fd1e4b86e94252970f7b719"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Jun 03 16:26:37 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 03 16:26:37 2026"
      },
      "message": "Handle objects with empty toString (#2662)\n\nThe approach to building text descriptions involves appending and\nprepending text to string iterables. If the \"base\" of the string\ndescription is an empty iterable it propagates through as empty, which\ncan cause missing lines from the failure output.\n\nAdd a fallback of `\u0027empty toString()\u0027` in the case any object returns a\ncompletely empty string representation."
    },
    {
      "commit": "5a897b2ff53d681a5fd1e4b86e94252970f7b719",
      "tree": "c415b0f2dca71cdd17838fc3db5bcb079303a29f",
      "parents": [
        "74a9aaf330fd86a9b5dbcf7b8172c445af42e8fe"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Jun 03 15:49:26 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 03 15:49:26 2026"
      },
      "message": "Resolve process leak in test compiler (#2664)\n\nCheck for early closure after async operations and resolve a deadlock\nduring close where the frontend server is busy and is holding a pool\nresource during shutdown.\n\nAdd a mechanism for injecting a fake `FrontendServerClient` to allow\ncontrolling timing during a test without arbitrary delays trying line up\nwith the external process."
    },
    {
      "commit": "74a9aaf330fd86a9b5dbcf7b8172c445af42e8fe",
      "tree": "b6fdcdc22bf7de00a19a7073e6ba56716f16c216",
      "parents": [
        "5d1c8bd07c4d77959b6a0434ed8e947213fcddf3"
      ],
      "author": {
        "name": "Nate Bosch",
        "email": "nbosch@google.com",
        "time": "Wed Jun 03 15:31:12 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 03 15:31:12 2026"
      },
      "message": "Close receive port in VM platform on null isolate (#2665)\n\nThis resolves flakiness in top_level_configuration_test.dart"
    }
  ],
  "next": "5d1c8bd07c4d77959b6a0434ed8e947213fcddf3"
}