[jira] [Resolved] (DIRAPI-401) Unhandled Exception (NegativeArraySizeException) in Asn1Decoder
[ https://issues.apache.org/jira/browse/DIRAPI-401?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Emmanuel Lécharny resolved DIRAPI-401. -- Fix Version/s: 2.1.7 Resolution: Fixed Just pushed the fix, with the associated test. > Unhandled Exception (NegativeArraySizeException) in Asn1Decoder > --- > > Key: DIRAPI-401 > URL: https://issues.apache.org/jira/browse/DIRAPI-401 > Project: Directory Client API > Issue Type: Bug >Affects Versions: 2.1.6 >Reporter: Andrey Slepykh >Priority: Major > Fix For: 2.1.7 > > Attachments: NegativeSizeReproducer.java > > > Hello, we think we have found a problem in Asn1Decoder implementation for > LDAP messages while fuzzing in version 2.1.6. This problem is unhandled > exception (NegativeArraySizeException). > Steps to reproduce: > 1. Download Apache Directory LDAP API v2.1.6: > ``` > wget wget > [https://github.com/apache/directory-ldap-api/archive/refs/tags/2.1.6.tar.gz] > tar xf 2.1.6.tar.gz && rm 2.1.6.tar.gz > ``` > 2. Compile the project (we used jdk-11 and mvn-3.9.6): > ``` > cd directory-ldap-api-2.1.6 > mvn clean package > ``` > 3. Get the reproducer: > ``` > mkdir fuzz && cd fuzz > mv /NegativeSizeReproducer.java . > ``` > 4. Compile the reproducer > ``` > javac -cp > .:../asn1/ber/target/classes/:../asn1/api/target/classes/:../ldap/codec/core/target/classes/:../ldap/model/target/classes/:../ldap/codec/core/target/classes/ > ./NegativeSizeReproducer.java > ``` > 5. Reproduce the exception: > ``` > java -cp > .:../asn1/ber/target/classes/:../asn1/api/target/classes/:../ldap/codec/core/target/classes/:../ldap/model/target/classes/:../ldap/codec/core/target/classes/:../util/target/classes/:../util/target/classes/:../integ-osgi/target/dependency/slf4j-api-1.7.36.jar:../i18n/target/classes/:../integ-osgi/target/dependency/mina-core-2.2.3.jar > NegativeSizeReproducer > ``` > Found by Linux Verification Center (portal.linuxtesting.ru) with jazzer. > Author L.Reviakin (l.revia...@fobos-nt.ru) -- This message was sent by Atlassian Jira (v8.20.10#820010) - To unsubscribe, e-mail: dev-unsubscr...@directory.apache.org For additional commands, e-mail: dev-h...@directory.apache.org
[jira] [Commented] (DIRAPI-401) Unhandled Exception (NegativeArraySizeException) in Asn1Decoder
[ https://issues.apache.org/jira/browse/DIRAPI-401?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17849833#comment-17849833 ] Emmanuel Lécharny commented on DIRAPI-401: -- I confirm the current code is not checking for negative values... A fix is being brewed. Thanks! > Unhandled Exception (NegativeArraySizeException) in Asn1Decoder > --- > > Key: DIRAPI-401 > URL: https://issues.apache.org/jira/browse/DIRAPI-401 > Project: Directory Client API > Issue Type: Bug >Affects Versions: 2.1.6 >Reporter: Andrey Slepykh >Priority: Major > Attachments: NegativeSizeReproducer.java > > > Hello, we think we have found a problem in Asn1Decoder implementation for > LDAP messages while fuzzing in version 2.1.6. This problem is unhandled > exception (NegativeArraySizeException). > Steps to reproduce: > 1. Download Apache Directory LDAP API v2.1.6: > ``` > wget wget > [https://github.com/apache/directory-ldap-api/archive/refs/tags/2.1.6.tar.gz] > tar xf 2.1.6.tar.gz && rm 2.1.6.tar.gz > ``` > 2. Compile the project (we used jdk-11 and mvn-3.9.6): > ``` > cd directory-ldap-api-2.1.6 > mvn clean package > ``` > 3. Get the reproducer: > ``` > mkdir fuzz && cd fuzz > mv /NegativeSizeReproducer.java . > ``` > 4. Compile the reproducer > ``` > javac -cp > .:../asn1/ber/target/classes/:../asn1/api/target/classes/:../ldap/codec/core/target/classes/:../ldap/model/target/classes/:../ldap/codec/core/target/classes/ > ./NegativeSizeReproducer.java > ``` > 5. Reproduce the exception: > ``` > java -cp > .:../asn1/ber/target/classes/:../asn1/api/target/classes/:../ldap/codec/core/target/classes/:../ldap/model/target/classes/:../ldap/codec/core/target/classes/:../util/target/classes/:../util/target/classes/:../integ-osgi/target/dependency/slf4j-api-1.7.36.jar:../i18n/target/classes/:../integ-osgi/target/dependency/mina-core-2.2.3.jar > NegativeSizeReproducer > ``` > Found by Linux Verification Center (portal.linuxtesting.ru) with jazzer. > Author L.Reviakin (l.revia...@fobos-nt.ru) -- This message was sent by Atlassian Jira (v8.20.10#820010) - To unsubscribe, e-mail: dev-unsubscr...@directory.apache.org For additional commands, e-mail: dev-h...@directory.apache.org
[jira] [Comment Edited] (DIRAPI-400) Hang in LDAP URL parser
[
https://issues.apache.org/jira/browse/DIRAPI-400?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17849829#comment-17849829
]
Emmanuel Lécharny edited comment on DIRAPI-400 at 5/27/24 8:53 PM:
---
The LDAP URl you use is perfectly valid, why would you expect it to throw a
{{LdapURLEncodingException}}?
RFC 4516 grammar for LDAP URL is pretty clear:
{code:java}
ldapurl = scheme COLON SLASH SLASH [host [COLON port]]
[SLASH dn [QUESTION [attributes]
[QUESTION [scope] [QUESTION [filter]
[QUESTION extensions]
; and are defined
; in Sections 3.2.2 and 3.2.3
; of [RFC3986].
; is from Section 3 of
; [RFC4515], subject to the
; provisions of the
; "Percent-Encoding" section
; below.
scheme = "ldap"
{code}
Everything after {{ldap://}} and the (optionnal) host - {{lenix}} in your case
- is also optional.
was (Author: elecharny):
The LDAP URl you use is perfectly valid, why would you expect it to throw a
{{LdapURLEncodingException}}?
> Hang in LDAP URL parser
> ---
>
> Key: DIRAPI-400
> URL: https://issues.apache.org/jira/browse/DIRAPI-400
> Project: Directory Client API
> Issue Type: Bug
>Affects Versions: 2.1.6
>Reporter: Andrey Slepykh
>Priority: Major
> Attachments: Reproducer.java
>
>
> Hello, we have found a problem in LDAP URL parser in version 2.1.6 while
> fuzzing. The problem is that LDAP parser can not properly handle specially
> crafted inputs and just hangs.
> {{Steps to reproduce:}}
> ~1. Download Apache Directory LDAP API v2.1.6:~
> ^wget wget
> [https://github.com/apache/directory-ldap-api/archive/refs/tags/2.1.6.tar.gz]^
> ^tar xf 2.1.6.tar.gz && rm 2.1.6.tar.gz^
> {{2. Compile the project (we used jdk-11 and mvn-3.9.6):}}
> {{^cd directory-ldap-api-2.1.6^}}
> {{^mvn clean package^}}
> {{3. Get the reproducer:}}
> {{^mkdir fuzz && cd fuzz^}}
> {{^mv /Reproducer.java .^}}
> {{4. Compile the reproducer:}}
> {{^javac -cp ../ldap/model/target/classes/ ./Reproducer.java^}}
> {{5. Reproduce the hang:}}
> {{^java -cp
> ../ldap/model/target/classes/:.:../util/target/classes/:../integ-osgi/target/dependency/slf4j-api-1.7.26.jar:../i18n/target/classes/
> Reproducer^}}
> We decided to fuzz this function, because it is used in Apache Directory
> Server
> Found by Linux Verification Center (portal.linuxtesting.ru) with Jazzer.
> Author L.Reviakin (l.revia...@fobos-nt.ru)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
-
To unsubscribe, e-mail: dev-unsubscr...@directory.apache.org
For additional commands, e-mail: dev-h...@directory.apache.org
[jira] [Comment Edited] (DIRAPI-400) Hang in LDAP URL parser
[
https://issues.apache.org/jira/browse/DIRAPI-400?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17849829#comment-17849829
]
Emmanuel Lécharny edited comment on DIRAPI-400 at 5/27/24 8:51 PM:
---
The LDAP URl you use is perfectly valid, why would you expect it to throw a
{{LdapURLEncodingException}}?
was (Author: elecharny):
The LDAP URUl you use is perfectly valid, why would you expect it to throw a
{{LdapURLEncodingException}}?
> Hang in LDAP URL parser
> ---
>
> Key: DIRAPI-400
> URL: https://issues.apache.org/jira/browse/DIRAPI-400
> Project: Directory Client API
> Issue Type: Bug
>Affects Versions: 2.1.6
>Reporter: Andrey Slepykh
>Priority: Major
> Attachments: Reproducer.java
>
>
> Hello, we have found a problem in LDAP URL parser in version 2.1.6 while
> fuzzing. The problem is that LDAP parser can not properly handle specially
> crafted inputs and just hangs.
> {{Steps to reproduce:}}
> ~1. Download Apache Directory LDAP API v2.1.6:~
> ^wget wget
> [https://github.com/apache/directory-ldap-api/archive/refs/tags/2.1.6.tar.gz]^
> ^tar xf 2.1.6.tar.gz && rm 2.1.6.tar.gz^
> {{2. Compile the project (we used jdk-11 and mvn-3.9.6):}}
> {{^cd directory-ldap-api-2.1.6^}}
> {{^mvn clean package^}}
> {{3. Get the reproducer:}}
> {{^mkdir fuzz && cd fuzz^}}
> {{^mv /Reproducer.java .^}}
> {{4. Compile the reproducer:}}
> {{^javac -cp ../ldap/model/target/classes/ ./Reproducer.java^}}
> {{5. Reproduce the hang:}}
> {{^java -cp
> ../ldap/model/target/classes/:.:../util/target/classes/:../integ-osgi/target/dependency/slf4j-api-1.7.26.jar:../i18n/target/classes/
> Reproducer^}}
> We decided to fuzz this function, because it is used in Apache Directory
> Server
> Found by Linux Verification Center (portal.linuxtesting.ru) with Jazzer.
> Author L.Reviakin (l.revia...@fobos-nt.ru)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
-
To unsubscribe, e-mail: dev-unsubscr...@directory.apache.org
For additional commands, e-mail: dev-h...@directory.apache.org
[jira] [Commented] (DIRAPI-400) Hang in LDAP URL parser
[
https://issues.apache.org/jira/browse/DIRAPI-400?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17849829#comment-17849829
]
Emmanuel Lécharny commented on DIRAPI-400:
--
The LDAP URUl you use is perfectly valid, why would you expect it to throw a
{{LdapURLEncodingException}}?
> Hang in LDAP URL parser
> ---
>
> Key: DIRAPI-400
> URL: https://issues.apache.org/jira/browse/DIRAPI-400
> Project: Directory Client API
> Issue Type: Bug
>Affects Versions: 2.1.6
>Reporter: Andrey Slepykh
>Priority: Major
> Attachments: Reproducer.java
>
>
> Hello, we have found a problem in LDAP URL parser in version 2.1.6 while
> fuzzing. The problem is that LDAP parser can not properly handle specially
> crafted inputs and just hangs.
> {{Steps to reproduce:}}
> ~1. Download Apache Directory LDAP API v2.1.6:~
> ^wget wget
> [https://github.com/apache/directory-ldap-api/archive/refs/tags/2.1.6.tar.gz]^
> ^tar xf 2.1.6.tar.gz && rm 2.1.6.tar.gz^
> {{2. Compile the project (we used jdk-11 and mvn-3.9.6):}}
> {{^cd directory-ldap-api-2.1.6^}}
> {{^mvn clean package^}}
> {{3. Get the reproducer:}}
> {{^mkdir fuzz && cd fuzz^}}
> {{^mv /Reproducer.java .^}}
> {{4. Compile the reproducer:}}
> {{^javac -cp ../ldap/model/target/classes/ ./Reproducer.java^}}
> {{5. Reproduce the hang:}}
> {{^java -cp
> ../ldap/model/target/classes/:.:../util/target/classes/:../integ-osgi/target/dependency/slf4j-api-1.7.26.jar:../i18n/target/classes/
> Reproducer^}}
> We decided to fuzz this function, because it is used in Apache Directory
> Server
> Found by Linux Verification Center (portal.linuxtesting.ru) with Jazzer.
> Author L.Reviakin (l.revia...@fobos-nt.ru)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
-
To unsubscribe, e-mail: dev-unsubscr...@directory.apache.org
For additional commands, e-mail: dev-h...@directory.apache.org
Re: [PR] Bump com.gradle:develocity-maven-extension from 1.21.1 to 1.21.3 [directory-scimple]
dependabot[bot] commented on PR #582: URL: https://github.com/apache/directory-scimple/pull/582#issuecomment-2133877634 Superseded by #585. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: dev-unsubscr...@directory.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org - To unsubscribe, e-mail: dev-unsubscr...@directory.apache.org For additional commands, e-mail: dev-h...@directory.apache.org
[PR] Bump com.gradle:develocity-maven-extension from 1.21.1 to 1.21.4 [directory-scimple]
dependabot[bot] opened a new pull request, #585: URL: https://github.com/apache/directory-scimple/pull/585 Bumps com.gradle:develocity-maven-extension from 1.21.1 to 1.21.4. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: dev-unsubscr...@directory.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org - To unsubscribe, e-mail: dev-unsubscr...@directory.apache.org For additional commands, e-mail: dev-h...@directory.apache.org
Re: [PR] Bump com.gradle:develocity-maven-extension from 1.21.1 to 1.21.3 [directory-scimple]
dependabot[bot] closed pull request #582: Bump com.gradle:develocity-maven-extension from 1.21.1 to 1.21.3 URL: https://github.com/apache/directory-scimple/pull/582 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: dev-unsubscr...@directory.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org - To unsubscribe, e-mail: dev-unsubscr...@directory.apache.org For additional commands, e-mail: dev-h...@directory.apache.org
[jira] [Created] (DIRAPI-401) Unhandled Exception (NegativeArraySizeException) in Asn1Decoder
Andrey Slepykh created DIRAPI-401: - Summary: Unhandled Exception (NegativeArraySizeException) in Asn1Decoder Key: DIRAPI-401 URL: https://issues.apache.org/jira/browse/DIRAPI-401 Project: Directory Client API Issue Type: Bug Affects Versions: 2.1.6 Reporter: Andrey Slepykh Attachments: NegativeSizeReproducer.java Hello, we think we have found a problem in Asn1Decoder implementation for LDAP messages while fuzzing in version 2.1.6. This problem is unhandled exception (NegativeArraySizeException). Steps to reproduce: 1. Download Apache Directory LDAP API v2.1.6: ``` wget wget [https://github.com/apache/directory-ldap-api/archive/refs/tags/2.1.6.tar.gz] tar xf 2.1.6.tar.gz && rm 2.1.6.tar.gz ``` 2. Compile the project (we used jdk-11 and mvn-3.9.6): ``` cd directory-ldap-api-2.1.6 mvn clean package ``` 3. Get the reproducer: ``` mkdir fuzz && cd fuzz mv /NegativeSizeReproducer.java . ``` 4. Compile the reproducer ``` javac -cp .:../asn1/ber/target/classes/:../asn1/api/target/classes/:../ldap/codec/core/target/classes/:../ldap/model/target/classes/:../ldap/codec/core/target/classes/ ./NegativeSizeReproducer.java ``` 5. Reproduce the exception: ``` java -cp .:../asn1/ber/target/classes/:../asn1/api/target/classes/:../ldap/codec/core/target/classes/:../ldap/model/target/classes/:../ldap/codec/core/target/classes/:../util/target/classes/:../util/target/classes/:../integ-osgi/target/dependency/slf4j-api-1.7.36.jar:../i18n/target/classes/:../integ-osgi/target/dependency/mina-core-2.2.3.jar NegativeSizeReproducer ``` Found by Linux Verification Center (portal.linuxtesting.ru) with jazzer. Author L.Reviakin (l.revia...@fobos-nt.ru) -- This message was sent by Atlassian Jira (v8.20.10#820010) - To unsubscribe, e-mail: dev-unsubscr...@directory.apache.org For additional commands, e-mail: dev-h...@directory.apache.org
[jira] [Created] (DIRAPI-400) Hang in LDAP URL parser
Andrey Slepykh created DIRAPI-400:
-
Summary: Hang in LDAP URL parser
Key: DIRAPI-400
URL: https://issues.apache.org/jira/browse/DIRAPI-400
Project: Directory Client API
Issue Type: Bug
Affects Versions: 2.1.6
Reporter: Andrey Slepykh
Attachments: Reproducer.java
Hello, we have found a problem in LDAP URL parser in version 2.1.6 while
fuzzing. The problem is that LDAP parser can not properly handle specially
crafted inputs and just hangs.
{{Steps to reproduce:}}
~1. Download Apache Directory LDAP API v2.1.6:~
^wget wget
[https://github.com/apache/directory-ldap-api/archive/refs/tags/2.1.6.tar.gz]^
^tar xf 2.1.6.tar.gz && rm 2.1.6.tar.gz^
{{2. Compile the project (we used jdk-11 and mvn-3.9.6):}}
{{^cd directory-ldap-api-2.1.6^}}
{{^mvn clean package^}}
{{3. Get the reproducer:}}
{{^mkdir fuzz && cd fuzz^}}
{{^mv /Reproducer.java .^}}
{{4. Compile the reproducer:}}
{{^javac -cp ../ldap/model/target/classes/ ./Reproducer.java^}}
{{5. Reproduce the hang:}}
{{^java -cp
../ldap/model/target/classes/:.:../util/target/classes/:../integ-osgi/target/dependency/slf4j-api-1.7.26.jar:../i18n/target/classes/
Reproducer^}}
We decided to fuzz this function, because it is used in Apache Directory Server
Found by Linux Verification Center (portal.linuxtesting.ru) with Jazzer.
Author L.Reviakin (l.revia...@fobos-nt.ru)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
-
To unsubscribe, e-mail: dev-unsubscr...@directory.apache.org
For additional commands, e-mail: dev-h...@directory.apache.org
[PR] Bump org.jboss.xnio:xnio-api from 3.8.14.Final to 3.8.15.Final [directory-kerby]
dependabot[bot] opened a new pull request, #383: URL: https://github.com/apache/directory-kerby/pull/383 Bumps org.jboss.xnio:xnio-api from 3.8.14.Final to 3.8.15.Final. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: dev-unsubscr...@directory.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org - To unsubscribe, e-mail: dev-unsubscr...@directory.apache.org For additional commands, e-mail: dev-h...@directory.apache.org
[PR] Bump github/codeql-action from 3.25.5 to 3.25.6 [directory-kerby]
dependabot[bot] opened a new pull request, #382: URL: https://github.com/apache/directory-kerby/pull/382 Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.25.5 to 3.25.6. Changelog Sourced from https://github.com/github/codeql-action/blob/main/CHANGELOG.md;>github/codeql-action's changelog. CodeQL Action Changelog See the https://github.com/github/codeql-action/releases;>releases page for the relevant changes to the CodeQL CLI and language packs. Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers. [UNRELEASED] We are rolling out a feature in May/June 2024 that will reduce the Actions cache usage of the Action by keeping only the newest TRAP cache for each language. https://redirect.github.com/github/codeql-action/pull/2306;>#2306 3.25.6 - 20 May 2024 Update default CodeQL bundle version to 2.17.3. https://redirect.github.com/github/codeql-action/pull/2295;>#2295 3.25.5 - 13 May 2024 Add a compatibility matrix of supported CodeQL Action, CodeQL CLI, and GitHub Enterprise Server versions to the https://github.com/github/codeql-action/blob/main/README.md;>https://github.com/github/codeql-action/blob/main/README.md. https://redirect.github.com/github/codeql-action/pull/2273;>#2273 Avoid printing out a warning for a missing on.push trigger when the CodeQL Action is triggered via a workflow_call event. https://redirect.github.com/github/codeql-action/pull/2274;>#2274 The tools: latest input to the init Action has been renamed to tools: linked. This option specifies that the Action should use the tools shipped at the same time as the Action. The old name will continue to work for backwards compatibility, but we recommend that new workflows use the new name. https://redirect.github.com/github/codeql-action/pull/2281;>#2281 3.25.4 - 08 May 2024 Update default CodeQL bundle version to 2.17.2. https://redirect.github.com/github/codeql-action/pull/2270;>#2270 3.25.3 - 25 Apr 2024 Update default CodeQL bundle version to 2.17.1. https://redirect.github.com/github/codeql-action/pull/2247;>#2247 Workflows running on macos-latest using CodeQL CLI versions before v2.15.1 will need to either upgrade their CLI version to v2.15.1 or newer, or change the platform to an Intel MacOS runner, such as macos-12. ARM machines with SIP disabled, including the newest macos-latest image, are unsupported for CLI versions before 2.15.1. https://redirect.github.com/github/codeql-action/pull/2261;>#2261 3.25.2 - 22 Apr 2024 No user facing changes. 3.25.1 - 17 Apr 2024 We are rolling out a feature in April/May 2024 that improves the reliability and performance of analyzing code when analyzing a compiled language with the autobuild https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#codeql-build-modes;>build mode. https://redirect.github.com/github/codeql-action/pull/2235;>#2235 Fix a bug where the init Action would fail if --overwrite was specified in CODEQL_ACTION_EXTRA_OPTIONS. https://redirect.github.com/github/codeql-action/pull/2245;>#2245 3.25.0 - 15 Apr 2024 The deprecated feature for extracting dependencies for a Python analysis has been removed. https://redirect.github.com/github/codeql-action/pull/2224;>#2224 As a result, the following inputs and environment variables are now ignored: The setup-python-dependencies input to the init Action The CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION environment variable We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0. Automatically overwrite an existing database if found on the filesystem. https://redirect.github.com/github/codeql-action/pull/2229;>#2229 Bump the minimum CodeQL bundle version to 2.12.6. https://redirect.github.com/github/codeql-action/pull/2232;>#2232 ... (truncated) Commits https://github.com/github/codeql-action/commit/9fdb3e49720b44c48891d036bb502feb25684276;>9fdb3e4 Merge pull request https://redirect.github.com/github/codeql-action/issues/2300;>#2300 from github/update-v3.25.6-63d519c0a https://github.com/github/codeql-action/commit/00792ab1e0a5e45d2ff0c2426424bf7044bb27d0;>00792ab Update changelog for v3.25.6 https://github.com/github/codeql-action/commit/63d519c0ae6a4b739e3377a517400c352a7d829b;>63d519c Merge
