Sandbox::https://redirect.github.com/anthropics/claude-code-action/pull/1588

ashwin-ant · 2026-08-03T23:16:24Z

Summary

downloadCommentImages now pairs each image URL extracted from the markdown/HTML with the signed download URL that refers to the same asset identifier, instead of pairing the two lists by array position.
The two lists come from separate representations of the body (the markdown text vs. the rendered body_html), so their order and count aren't guaranteed to line up — e.g. an <img> tag before a ![]() image, or a repeated image URL, previously shifted every subsequent pairing. Matching on the identifier keeps each downloaded file tied to the URL it belongs to.
URLs whose identifier isn't present in the rendered body are skipped with a warning rather than being paired positionally.
The signed URL's identifier is taken from the parsed URL's filename on the expected host, not from anywhere in the raw string.

Test plan

bun test (809 pass) — added cases for out-of-order signed URLs, mismatched assets, URLs without an identifier, and case-insensitive matching
bun run typecheck
bun run format:check

claude

LGTM — a well-scoped correctness fix that replaces fragile positional pairing with asset-identifier matching, backed by thorough new tests; the one inline note is a pre-existing nit, not a regression from this PR.

Extended reasoning...

Overview

The PR touches two files: src/github/utils/image-downloader.ts and its test file. It changes how downloadCommentImages pairs image URLs extracted from a comment's markdown body with signed download URLs extracted from the rendered body_html. Previously the two lists were zipped by array index, which silently mispaired every subsequent image whenever order or count diverged (e.g. an <img> tag preceding a []() image, or a repeated URL). The new code indexes signed URLs by the asset GUID taken from the parsed URL's filename on the expected host, and looks up each original URL's GUID in that map, skipping with a warning when no match exists.

Security risks

Low. The code only fetches from URLs already present in GitHub's own rendered body_html on the private-user-images.githubusercontent.com host, and the new extractSignedUrlAssetGuid actually tightens matching: it requires the GUID to come from the resolved pathname's filename via new URL() (so .. traversal or a GUID embedded elsewhere in the string cannot claim another asset — there is a dedicated test for this). No auth, token, or permission code is involved. The one inline finding (greedy SIGNED_URL_REGEX tail can capture a garbage-polluted match when a signed URL appears in unquoted text) is pre-existing behavior; under the old positional pairing the same polluted match would have been fetched anyway, and this PR confines the failure to a single asset instead of shifting all subsequent pairings.

Level of scrutiny

Moderate. This is a logic change in the prompt-construction pipeline (the sole caller is src/github/data/fetcher.ts), but the failure mode is benign: an unmatched or failed image is skipped with a console warning and the prompt simply retains the original URL — no crash and no wrong-data path. The change is small (~50 lines of implementation), self-contained, and the intent matches the implementation exactly.

Other factors

Test coverage is strong: the PR adds cases for out-of-order signed URLs, mismatched assets, case-insensitive GUID matching, URLs without an identifier, and the .. path-resolution edge, alongside updating all existing tests to realistic GUID-based fixtures. A finder candidate — that extractAssetGuid matching a GUID anywhere in the original URL defeats the positional hardening — was examined and refuted this run: original URLs are constrained by the extraction regexes to user-attachments/assets/ paths where the GUID is the asset id. The author's test plan reports 809 passing tests, typecheck, and format check. Given the narrow scope, defensive parsing, graceful degradation, and that the only finding is a non-blocking pre-existing nit, this does not need a human gate.

claude · 2026-08-03T23:45:30Z

+      // Index the signed URLs by the asset GUID they reference. The signed
+      // URLs come from a separate render of the body, so their order and
+      // count are not guaranteed to line up with the URLs extracted from the
+      // markdown; pairing by asset identifier keeps each download tied to the
+      // URL it actually belongs to.
+      const signedUrlByGuid = new Map<string, string>();
+      for (const signedUrl of signedUrls) {
+        const guid = extractSignedUrlAssetGuid(signedUrl);
+        if (guid && !signedUrlByGuid.has(guid)) {
+          signedUrlByGuid.set(guid, signedUrl);
        }
+      }



🟡 The greedy tail of SIGNED_URL_REGEX ([^"]+\?jwt=[^"]+ only stops at a double quote) can produce a garbage-polluted match when a signed URL appears outside a quoted attribute (e.g. in a backticked code span), and the new first-wins signedUrlByGuid registration then pins that polluted URL over the clean href/src candidates for the same asset — so the fetch sends a corrupted jwt and the download fails even though a valid signed URL was available. Tightening the regex tail to [^"\s<]+ (or letting a clean candidate replace a polluted one for the same GUID) fixes it.

Extended reasoning...

What the bug is

SIGNED_URL_REGEX (src/github/utils/image-downloader.ts:17-18) matches signed download URLs in body_html with the tail [^"]+\?jwt=[^"]+. That character class stops only at a double quote, so it behaves correctly when the URL sits inside a quoted attribute (href="...", src="...") but runs greedily past the end of the URL when the URL appears as plain text — most realistically inside a backticked code span, which GitHub renders as <code>...</code> with no quotes. The match then swallows everything up to the next double quote in the document.

The new pairing logic (lines 212-224) indexes candidates first-wins: if (guid && !signedUrlByGuid.has(guid)). Because the polluted match appears earliest in document order, it gets registered for the GUID and the clean href/src matches for the same asset are silently discarded.

Code path / concrete proof (verified by executing the module's exact regexes)

Consider a comment like:

The URL https://private-user-images.githubusercontent.com/123/456-<GUID>.png?jwt=TOKEN fails to load:

GitHub renders this to body_html roughly as:

<code>https://private-user-images...?jwt=TOKEN</code> fails to load:</p> <p><a href="https://...?jwt=TOKEN">``<img src="https://...?jwt=TOKEN">``</a>

Step by step:

SIGNED_URL_REGEX yields three matches, in order: (1) https://...png?jwt=TOKEN</code> fails to load:</p> <p><a href= (polluted — the [^"]+ tail runs to the next "), (2) the clean href URL, (3) the clean src URL.

extractSignedUrlAssetGuid calls new URL() on the polluted string — it parses successfully, because the trailing garbage lands in the query string. The pathname is therefore clean, so both the host check and SIGNED_URL_PATH_REGEX pass and the correct GUID is extracted.

The first-wins guard registers the polluted string for the GUID; the has(guid) check then drops matches (2) and (3).

fetch(signedUrl) sends jwt=TOKEN%3C/code%3E%20fails... — an invalid JWT — so GitHub returns 4xx, the download throws, and the image is skipped with only a console.error, despite a valid signed URL for that exact asset being present in the candidate list.

All three verifiers reproduced this mechanically with the module's actual regexes. (The bare-pasted/autolinked URL case is safe, since GitHub's quoted href match comes first there.)

Why nothing in the PR prevents it

extractSignedUrlAssetGuid deliberately validates only host + resolved pathname — query-string pollution is invisible to it. And the first-wins policy always prefers the earliest (polluted) candidate.

Why this is a nit, not blocking

No regression: the greedy regex predates this PR, and the old positional pairing would have picked the same polluted index-0 match and failed identically in the single-image case. In multi-image cases the PR is strictly better — the failure is confined to one asset instead of shifting every subsequent pairing.

Narrow trigger: requires a comment that both backticks a live signed URL and embeds the same asset in the same comment.

Graceful degradation: one image missing from the prompt plus a logged error — no crash, no wrong data.

Still worth fixing here since this PR's stated purpose is robust pairing and a clean candidate present in the list loses to a polluted one.

Fix

Either tighten the regex tail to exclude whitespace and < — e.g. /https:\/\/private-user-images\.githubusercontent\.com\/[^"\s<]+\?jwt=[^"\s<]+/g — or, when registering candidates in signedUrlByGuid, let a clean candidate (no whitespace/<) replace a polluted one for the same GUID.

@ref

Bumps the github-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.183` | `1.0.187` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.4` | `4.37.6` | | [graalvm/setup-graalvm](https://github.com/graalvm/setup-graalvm) | `1.6.3` | `1.6.4` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.4` | `4.37.6` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.4` | `4.37.6` | Updates `anthropics/claude-code-action` from 1.0.183 to 1.0.187 Release notes *Sourced from [anthropics/claude-code-action's releases](https://github.com/anthropics/claude-code-action/releases).* > v1.0.187 > -------- > > What's Changed > -------------- > > * Redact common credential patterns from published run output by [`@ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#1595](https://redirect.github.com/anthropics/claude-code-action/pull/1595) > * Scope the config snapshot to files inside the working tree by [`@ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#1596](https://redirect.github.com/anthropics/claude-code-action/pull/1596) > * Run checkout auth cleanup when API commit signing is enabled by [`@ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#1597](https://redirect.github.com/anthropics/claude-code-action/pull/1597) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.187> > > v1.0.186 > -------- > > What's Changed > -------------- > > * Invoke the formatter directly from the format hook by [`@ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#1594](https://redirect.github.com/anthropics/claude-code-action/pull/1594) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.186> > > v1.0.185 > -------- > > What's Changed > -------------- > > * Derive trigger timestamps for issues and pull\_request events by [`@ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#1592](https://redirect.github.com/anthropics/claude-code-action/pull/1592) > * Pin bun config for MCP server processes by [`@ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#1589](https://redirect.github.com/anthropics/claude-code-action/pull/1589) > * Match downloaded images to their source URLs by asset identifier by [`@ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#1588](https://redirect.github.com/anthropics/claude-code-action/pull/1588) > * Check collaborator permissions for workflow\_run events by [`@ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#1590](https://redirect.github.com/anthropics/claude-code-action/pull/1590) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.185> > > v1.0.184 > -------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.184> Commits * [`1623c36`](anthropics/claude-code-action@1623c36) chore: bump Claude Code to 2.1.224 and Agent SDK to 0.3.224 * [`96e281f`](anthropics/claude-code-action@96e281f) Run checkout auth cleanup when API commit signing is enabled ([#1597](https://redirect.github.com/anthropics/claude-code-action/issues/1597)) * [`e1fc925`](anthropics/claude-code-action@e1fc925) Scope the config snapshot to files inside the working tree ([#1596](https://redirect.github.com/anthropics/claude-code-action/issues/1596)) * [`0aee57a`](anthropics/claude-code-action@0aee57a) Redact common credential patterns from published run output ([#1595](https://redirect.github.com/anthropics/claude-code-action/issues/1595)) * [`c038e4d`](anthropics/claude-code-action@c038e4d) chore: bump Claude Code to 2.1.223 and Agent SDK to 0.3.223 * [`4c04887`](anthropics/claude-code-action@4c04887) Invoke the formatter directly from the format hook ([#1594](https://redirect.github.com/anthropics/claude-code-action/issues/1594)) * [`9db594c`](anthropics/claude-code-action@9db594c) chore: bump Claude Code to 2.1.222 and Agent SDK to 0.3.222 * [`acb0385`](anthropics/claude-code-action@acb0385) Check collaborator permissions for workflow\_run events ([#1590](https://redirect.github.com/anthropics/claude-code-action/issues/1590)) * [`b80a0f0`](anthropics/claude-code-action@b80a0f0) Match downloaded images to their source URLs by asset identifier ([#1588](https://redirect.github.com/anthropics/claude-code-action/issues/1588)) * [`6fb6bb6`](anthropics/claude-code-action@6fb6bb6) Pin bun config for MCP server processes ([#1589](https://redirect.github.com/anthropics/claude-code-action/issues/1589)) * Additional commits viewable in [compare view](anthropics/claude-code-action@be7b93b...1623c36) Updates `github/codeql-action/upload-sarif` from 4.37.4 to 4.37.6 Release notes *Sourced from [github/codeql-action/upload-sarif's releases](https://github.com/github/codeql-action/releases).* > v4.37.6 > ------- > > * Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://redirect.github.com/github/codeql-action/pull/4070) > > v4.37.5 > ------- > > * Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://redirect.github.com/github/codeql-action/pull/4061) Changelog *Sourced from [github/codeql-action/upload-sarif's changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md).* > CodeQL Action Changelog > ======================= > > See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. > > [UNRELEASED] > ------------ > > No user facing changes. > > 4.37.6 - 04 Aug 2026 > -------------------- > > * Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://redirect.github.com/github/codeql-action/pull/4070) > > 4.37.5 - 03 Aug 2026 > -------------------- > > * Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://redirect.github.com/github/codeql-action/pull/4061) > > 4.37.4 - 29 Jul 2026 > -------------------- > > * This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://redirect.github.com/github/codeql-action/pull/4037) > * Update default CodeQL bundle version to [2.26.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://redirect.github.com/github/codeql-action/pull/4051) > > 4.37.3 - 22 Jul 2026 > -------------------- > > No user facing changes. > > 4.37.2 - 21 Jul 2026 > -------------------- > > * The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://redirect.github.com/github/codeql-action/pull/4023) > * The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://redirect.github.com/github/codeql-action/pull/4007) > > 4.37.1 - 16 Jul 2026 > -------------------- > > * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956) > * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019) > > 4.37.0 - 08 Jul 2026 > -------------------- > > * Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://redirect.github.com/github/codeql-action/pull/3995) > * In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://redirect.github.com/github/codeql-action/pull/3973) > > 4.36.3 - 01 Jul 2026 > -------------------- > > No user facing changes. > > 4.36.2 - 04 Jun 2026 > -------------------- > > * Cache CodeQL CLI version information across Actions steps. [#3943](https://redirect.github.com/github/codeql-action/pull/3943) > * Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://redirect.github.com/github/codeql-action/pull/3937) > * Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://redirect.github.com/github/codeql-action/pull/3948) ... (truncated) Commits * [`5595cca`](github/codeql-action@5595cca) Merge pull request [#4071](https://redirect.github.com/github/codeql-action/issues/4071) from github/update-v4.37.6-6a9359a1b * [`ec9c757`](github/codeql-action@ec9c757) Add change note for PR 4070 * [`45c8742`](github/codeql-action@45c8742) Update changelog for v4.37.6 * [`6a9359a`](github/codeql-action@6a9359a) Merge pull request [#4070](https://redirect.github.com/github/codeql-action/issues/4070) from github/mbg/remote-address/change-file-default * [`065cdc0`](github/codeql-action@065cdc0) Change `DEFAULT_CONFIG_FILE_NAME` * [`f99dd5a`](github/codeql-action@f99dd5a) Merge pull request [#4066](https://redirect.github.com/github/codeql-action/issues/4066) from github/dependabot/npm\_and\_yarn/js-yaml-5.2.2 * [`1804b21`](github/codeql-action@1804b21) Merge pull request [#4068](https://redirect.github.com/github/codeql-action/issues/4068) from github/mergeback/v4.37.5-to-main-d1ba80a1 * [`3020a2f`](github/codeql-action@3020a2f) Rebuild * [`93c3a5a`](github/codeql-action@93c3a5a) Update changelog and version after v4.37.5 * [`d1ba80a`](github/codeql-action@d1ba80a) Merge pull request [#4067](https://redirect.github.com/github/codeql-action/issues/4067) from github/update-v4.37.5-1cd4d01d5 * Additional commits viewable in [compare view](github/codeql-action@f205ea1...5595cca) Updates `graalvm/setup-graalvm` from 1.6.3 to 1.6.4 Release notes *Sourced from [graalvm/setup-graalvm's releases](https://github.com/graalvm/setup-graalvm/releases).* > v1.6.4 > ------ > > What's Changed > -------------- > > * Bump js-yaml from 5.2.0 to 5.2.2 by [`@dependabot`](https://github.com/dependabot)[bot] in [graalvm/setup-graalvm#230](https://redirect.github.com/graalvm/setup-graalvm/pull/230) > * Bump the "all" group with 2 updates across multiple ecosystems by [`@dependabot`](https://github.com/dependabot)[bot] in [graalvm/setup-graalvm#232](https://redirect.github.com/graalvm/setup-graalvm/pull/232) > > **Full Changelog**: <graalvm/setup-graalvm@v1.6.3...v1.6.4> Commits * [`5298d94`](graalvm/setup-graalvm@5298d94) Bump version to `1.6.4`. * [`fdb7cac`](graalvm/setup-graalvm@fdb7cac) Stay on typescript `6.0.3`. * [`ecfa7c7`](graalvm/setup-graalvm@ecfa7c7) Bump the all group with 3 updates * [`4b14c74`](graalvm/setup-graalvm@4b14c74) Drop build jobs of outdated `22.3.3`. * [`1f08baa`](graalvm/setup-graalvm@1f08baa) Drop `native-image` gu component. * [`fe57852`](graalvm/setup-graalvm@fe57852) Update dependencies. * [`785f14e`](graalvm/setup-graalvm@785f14e) Use `17.0.20` instead of `17.0.8`. * [`33fc590`](graalvm/setup-graalvm@33fc590) Bump js-yaml from 5.2.0 to 5.2.2 * See full diff in [compare view](graalvm/setup-graalvm@0def53c...5298d94) Updates `github/codeql-action/init` from 4.37.4 to 4.37.6 Release notes *Sourced from [github/codeql-action/init's releases](https://github.com/github/codeql-action/releases).* > v4.37.6 > ------- > > * Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://redirect.github.com/github/codeql-action/pull/4070) > > v4.37.5 > ------- > > * Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://redirect.github.com/github/codeql-action/pull/4061) Changelog *Sourced from [github/codeql-action/init's changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md).* > CodeQL Action Changelog > ======================= > > See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. > > [UNRELEASED] > ------------ > > No user facing changes. > > 4.37.6 - 04 Aug 2026 > -------------------- > > * Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://redirect.github.com/github/codeql-action/pull/4070) > > 4.37.5 - 03 Aug 2026 > -------------------- > > * Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://redirect.github.com/github/codeql-action/pull/4061) > > 4.37.4 - 29 Jul 2026 > -------------------- > > * This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://redirect.github.com/github/codeql-action/pull/4037) > * Update default CodeQL bundle version to [2.26.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://redirect.github.com/github/codeql-action/pull/4051) > > 4.37.3 - 22 Jul 2026 > -------------------- > > No user facing changes. > > 4.37.2 - 21 Jul 2026 > -------------------- > > * The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://redirect.github.com/github/codeql-action/pull/4023) > * The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://redirect.github.com/github/codeql-action/pull/4007) > > 4.37.1 - 16 Jul 2026 > -------------------- > > * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956) > * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019) > > 4.37.0 - 08 Jul 2026 > -------------------- > > * Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://redirect.github.com/github/codeql-action/pull/3995) > * In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://redirect.github.com/github/codeql-action/pull/3973) > > 4.36.3 - 01 Jul 2026 > -------------------- > > No user facing changes. > > 4.36.2 - 04 Jun 2026 > -------------------- > > * Cache CodeQL CLI version information across Actions steps. [#3943](https://redirect.github.com/github/codeql-action/pull/3943) > * Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://redirect.github.com/github/codeql-action/pull/3937) > * Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://redirect.github.com/github/codeql-action/pull/3948) ... (truncated) Commits * [`5595cca`](github/codeql-action@5595cca) Merge pull request [#4071](https://redirect.github.com/github/codeql-action/issues/4071) from github/update-v4.37.6-6a9359a1b * [`ec9c757`](github/codeql-action@ec9c757) Add change note for PR 4070 * [`45c8742`](github/codeql-action@45c8742) Update changelog for v4.37.6 * [`6a9359a`](github/codeql-action@6a9359a) Merge pull request [#4070](https://redirect.github.com/github/codeql-action/issues/4070) from github/mbg/remote-address/change-file-default * [`065cdc0`](github/codeql-action@065cdc0) Change `DEFAULT_CONFIG_FILE_NAME` * [`f99dd5a`](github/codeql-action@f99dd5a) Merge pull request [#4066](https://redirect.github.com/github/codeql-action/issues/4066) from github/dependabot/npm\_and\_yarn/js-yaml-5.2.2 * [`1804b21`](github/codeql-action@1804b21) Merge pull request [#4068](https://redirect.github.com/github/codeql-action/issues/4068) from github/mergeback/v4.37.5-to-main-d1ba80a1 * [`3020a2f`](github/codeql-action@3020a2f) Rebuild * [`93c3a5a`](github/codeql-action@93c3a5a) Update changelog and version after v4.37.5 * [`d1ba80a`](github/codeql-action@d1ba80a) Merge pull request [#4067](https://redirect.github.com/github/codeql-action/issues/4067) from github/update-v4.37.5-1cd4d01d5 * Additional commits viewable in [compare view](github/codeql-action@f205ea1...5595cca) Updates `github/codeql-action/analyze` from 4.37.4 to 4.37.6 Release notes *Sourced from [github/codeql-action/analyze's releases](https://github.com/github/codeql-action/releases).* > v4.37.6 > ------- > > * Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://redirect.github.com/github/codeql-action/pull/4070) > > v4.37.5 > ------- > > * Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://redirect.github.com/github/codeql-action/pull/4061) Changelog *Sourced from [github/codeql-action/analyze's changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md).* > CodeQL Action Changelog > ======================= > > See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. > > [UNRELEASED] > ------------ > > No user facing changes. > > 4.37.6 - 04 Aug 2026 > -------------------- > > * Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://redirect.github.com/github/codeql-action/pull/4070) > > 4.37.5 - 03 Aug 2026 > -------------------- > > * Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://redirect.github.com/github/codeql-action/pull/4061) > > 4.37.4 - 29 Jul 2026 > -------------------- > > * This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://redirect.github.com/github/codeql-action/pull/4037) > * Update default CodeQL bundle version to [2.26.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://redirect.github.com/github/codeql-action/pull/4051) > > 4.37.3 - 22 Jul 2026 > -------------------- > > No user facing changes. > > 4.37.2 - 21 Jul 2026 > -------------------- > > * The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://redirect.github.com/github/codeql-action/pull/4023) > * The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://redirect.github.com/github/codeql-action/pull/4007) > > 4.37.1 - 16 Jul 2026 > -------------------- > > * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956) > * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019) > > 4.37.0 - 08 Jul 2026 > -------------------- > > * Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://redirect.github.com/github/codeql-action/pull/3995) > * In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://redirect.github.com/github/codeql-action/pull/3973) > > 4.36.3 - 01 Jul 2026 > -------------------- > > No user facing changes. > > 4.36.2 - 04 Jun 2026 > -------------------- > > * Cache CodeQL CLI version information across Actions steps. [#3943](https://redirect.github.com/github/codeql-action/pull/3943) > * Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://redirect.github.com/github/codeql-action/pull/3937) > * Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://redirect.github.com/github/codeql-action/pull/3948) ... (truncated) Commits * [`5595cca`](github/codeql-action@5595cca) Merge pull request [#4071](https://redirect.github.com/github/codeql-action/issues/4071) from github/update-v4.37.6-6a9359a1b * [`ec9c757`](github/codeql-action@ec9c757) Add change note for PR 4070 * [`45c8742`](github/codeql-action@45c8742) Update changelog for v4.37.6 * [`6a9359a`](github/codeql-action@6a9359a) Merge pull request [#4070](https://redirect.github.com/github/codeql-action/issues/4070) from github/mbg/remote-address/change-file-default * [`065cdc0`](github/codeql-action@065cdc0) Change `DEFAULT_CONFIG_FILE_NAME` * [`f99dd5a`](github/codeql-action@f99dd5a) Merge pull request [#4066](https://redirect.github.com/github/codeql-action/issues/4066) from github/dependabot/npm\_and\_yarn/js-yaml-5.2.2 * [`1804b21`](github/codeql-action@1804b21) Merge pull request [#4068](https://redirect.github.com/github/codeql-action/issues/4068) from github/mergeback/v4.37.5-to-main-d1ba80a1 * [`3020a2f`](github/codeql-action@3020a2f) Rebuild * [`93c3a5a`](github/codeql-action@93c3a5a) Update changelog and version after v4.37.5 * [`d1ba80a`](github/codeql-action@d1ba80a) Merge pull request [#4067](https://redirect.github.com/github/codeql-action/issues/4067) from github/update-v4.37.5-1cd4d01d5 * Additional commits viewable in [compare view](github/codeql-action@f205ea1...5595cca) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions

ashwin-ant added 2 commits August 3, 2026 16:03

Match downloaded images to source URLs by asset identifier

52c97f1

Derive the signed URL asset identifier from the parsed path

755952e

claude Bot reviewed Aug 3, 2026

View reviewed changes

shawnm-anthropic approved these changes Aug 4, 2026

View reviewed changes

ashwin-ant merged commit b80a0f0 into main Aug 4, 2026
40 checks passed

ashwin-ant deleted the fix/pinned-body-image-resolution branch August 4, 2026 17:04

github-actions Bot mentioned this pull request Aug 10, 2026

chore(deps): update anthropics/claude-code-action action to v1.0.185 lacolaco/zenn#392

Merged

1 task

Navigation Menu

Repository navigation

Match downloaded images to their source URLs by asset identifier - #1588

Match downloaded images to their source URLs by asset identifier#1588
ashwin-ant merged 2 commits into
mainfrom
fix/pinned-body-image-resolution

ashwin-ant commented Aug 3, 2026

Uh oh!

claude Bot left a comment

Uh oh!

claude Bot Aug 3, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ashwin-ant commented Aug 3, 2026

Summary

Test plan

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Overview

Security risks

Level of scrutiny

Other factors

Uh oh!

claude Bot Aug 3, 2026

Choose a reason for hiding this comment

What the bug is

Code path / concrete proof (verified by executing the module's exact regexes)

Why nothing in the PR prevents it

Why this is a nit, not blocking

Fix

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants