Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update github/codeql-action action to v3.28.0 #119

Merged
merged 1 commit into from
Jan 1, 2025
Merged

Update github/codeql-action action to v3.28.0 #119

merged 1 commit into from
Jan 1, 2025

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jan 1, 2025

This PR contains the following updates:

Package Type Update Change
github/codeql-action action minor v3.27.9 -> v3.28.0

Release Notes

github/codeql-action (github/codeql-action)

v3.28.0

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.28.0 - 20 Dec 2024
  • Bump the minimum CodeQL bundle version to 2.15.5. #​2655
  • Don't fail in the unusual case that a file is on the search path. #​2660.

See the full CHANGELOG.md for more information.

Configuration

📅 Schedule: Branch creation - "* 0-4 * * 3" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions GitHub Actions
Copy link

github-actions bot commented Jan 1, 2025

[puLL-Merge] - github/[email protected]

Diff 
diff --git .github/workflows/__go-indirect-tracing-workaround-diagnostic.yml .github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
index 1726950ad6..2f7caf34b7 100644
--- .github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
+++ .github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
@@ -28,7 +28,7 @@ jobs:
       matrix:
         include:
           - os: ubuntu-latest
-            version: stable-v2.14.6
+            version: default
     name: 'Go: diagnostic when Go is changed after init step'
     permissions:
       contents: read
diff --git .github/workflows/__go-indirect-tracing-workaround-no-file-program.yml .github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
index a1d1aa24d1..03d48d86d0 100644
--- .github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
+++ .github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
@@ -28,7 +28,7 @@ jobs:
       matrix:
         include:
           - os: ubuntu-latest
-            version: stable-v2.14.6
+            version: default
     name: 'Go: diagnostic when `file` is not installed'
     permissions:
       contents: read
diff --git .github/workflows/__go-indirect-tracing-workaround.yml .github/workflows/__go-indirect-tracing-workaround.yml
index 9f7e06e59e..b5924bca17 100644
--- .github/workflows/__go-indirect-tracing-workaround.yml
+++ .github/workflows/__go-indirect-tracing-workaround.yml
@@ -28,7 +28,7 @@ jobs:
       matrix:
         include:
           - os: ubuntu-latest
-            version: stable-v2.14.6
+            version: default
     name: 'Go: workaround for indirect tracing'
     permissions:
       contents: read
diff --git .github/workflows/__go-tracing-autobuilder.yml .github/workflows/__go-tracing-autobuilder.yml
index d4a84fc6d8..a430ddd26c 100644
--- .github/workflows/__go-tracing-autobuilder.yml
+++ .github/workflows/__go-tracing-autobuilder.yml
@@ -27,10 +27,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            version: stable-v2.14.6
-          - os: macos-13
-            version: stable-v2.14.6
           - os: ubuntu-latest
             version: stable-v2.15.5
           - os: macos-latest
@@ -47,6 +43,10 @@ jobs:
             version: stable-v2.18.4
           - os: macos-latest
             version: stable-v2.18.4
+          - os: ubuntu-latest
+            version: stable-v2.19.4
+          - os: macos-latest
+            version: stable-v2.19.4
           - os: ubuntu-latest
             version: default
           - os: macos-latest
diff --git .github/workflows/__go-tracing-custom-build-steps.yml .github/workflows/__go-tracing-custom-build-steps.yml
index 52b769bd49..bd2af96bc7 100644
--- .github/workflows/__go-tracing-custom-build-steps.yml
+++ .github/workflows/__go-tracing-custom-build-steps.yml
@@ -27,10 +27,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            version: stable-v2.14.6
-          - os: macos-13
-            version: stable-v2.14.6
           - os: ubuntu-latest
             version: stable-v2.15.5
           - os: macos-latest
@@ -47,6 +43,10 @@ jobs:
             version: stable-v2.18.4
           - os: macos-latest
             version: stable-v2.18.4
+          - os: ubuntu-latest
+            version: stable-v2.19.4
+          - os: macos-latest
+            version: stable-v2.19.4
           - os: ubuntu-latest
             version: default
           - os: macos-latest
diff --git .github/workflows/__go-tracing-legacy-workflow.yml .github/workflows/__go-tracing-legacy-workflow.yml
index 46f8b85c5d..1f7bee078b 100644
--- .github/workflows/__go-tracing-legacy-workflow.yml
+++ .github/workflows/__go-tracing-legacy-workflow.yml
@@ -27,10 +27,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            version: stable-v2.14.6
-          - os: macos-13
-            version: stable-v2.14.6
           - os: ubuntu-latest
             version: stable-v2.15.5
           - os: macos-latest
@@ -47,6 +43,10 @@ jobs:
             version: stable-v2.18.4
           - os: macos-latest
             version: stable-v2.18.4
+          - os: ubuntu-latest
+            version: stable-v2.19.4
+          - os: macos-latest
+            version: stable-v2.19.4
           - os: ubuntu-latest
             version: default
           - os: macos-latest
diff --git .github/workflows/__multi-language-autodetect.yml .github/workflows/__multi-language-autodetect.yml
index 7f1346d137..5d5c52cac3 100644
--- .github/workflows/__multi-language-autodetect.yml
+++ .github/workflows/__multi-language-autodetect.yml
@@ -27,10 +27,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-13
-            version: stable-v2.14.6
-          - os: ubuntu-latest
-            version: stable-v2.14.6
           - os: macos-latest
             version: stable-v2.15.5
           - os: ubuntu-latest
@@ -47,6 +43,10 @@ jobs:
             version: stable-v2.18.4
           - os: ubuntu-latest
             version: stable-v2.18.4
+          - os: macos-latest
+            version: stable-v2.19.4
+          - os: ubuntu-latest
+            version: stable-v2.19.4
           - os: macos-latest
             version: default
           - os: ubuntu-latest
@@ -88,15 +88,12 @@ jobs:
         id: init
         with:
           db-location: ${{ runner.temp }}/customDbLocation
-      # Swift is not supported on Ubuntu or codeql 2.14 so we manually exclude it from the list here
-          languages: ${{ (runner.os == 'Linux' || (runner.os == 'macOS' && matrix.version
-            == 'stable-v2.14.6')) && 'cpp,csharp,go,java,javascript,python,ruby' ||
-            '' }}
+          languages: ${{ runner.os == 'Linux' && 'cpp,csharp,go,java,javascript,python,ruby'
+            || '' }}
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
       - uses: ./../action/.github/actions/setup-swift
-    # Exclude macos on v2.14.6 since we can not longer run swift on ARM runners
-        if: runner.os == 'macOS' && matrix.version != 'stable-v2.14.6'
+        if: runner.os == 'macOS'
         with:
           codeql-path: ${{ steps.init.outputs.codeql-path }}
 
@@ -149,8 +146,7 @@ jobs:
           fi
 
       - name: Check language autodetect for Swift on macOS
-    # Exclude macos on v2.14.6 since we can not longer run swift on ARM runners
-        if: runner.os == 'macOS' && matrix.version != 'stable-v2.14.6'
+        if: runner.os == 'macOS'
         shell: bash
         run: |
           SWIFT_DB=${{ fromJson(steps.analysis.outputs.db-locations).swift }}
diff --git a/.github/workflows/__start-proxy.yml b/.github/workflows/__start-proxy.yml
new file mode 100644
index 0000000000..2a361ed31e
--- /dev/null
+++ .github/workflows/__start-proxy.yml
@@ -0,0 +1,80 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     (cd pr-checks; pip install [email protected] && python3 sync.py)
+# to regenerate this file.
+
+name: PR Check - Start proxy
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch: {}
+jobs:
+  start-proxy:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: macos-latest
+            version: linked
+          - os: windows-latest
+            version: linked
+    name: Start proxy
+    permissions:
+      contents: read
+      security-events: write
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Setup Python on macOS
+        uses: actions/setup-python@v5
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
+        with:
+          python-version: '3.11'
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - uses: ./../action/init
+        with:
+          languages: csharp
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Setup proxy for registries
+        id: proxy
+        uses: ./../action/start-proxy
+        with:
+          registry_secrets: '[{ "type": "nuget_feed", "url": "https://api.nuget.org/v3/index.json"
+            }]'
+
+      - name: Print proxy outputs
+        run: |
+          echo "${{ steps.proxy.outputs.proxy_host }}"
+          echo "${{ steps.proxy.outputs.proxy_port }}"
+          echo "${{ steps.proxy.outputs.proxy_urls }}"
+
+      - name: Fail if proxy outputs are not set
+        if: (!steps.proxy.outputs.proxy_host) || (!steps.proxy.outputs.proxy_port)
+          || (!steps.proxy.outputs.proxy_ca_certificate) || (!steps.proxy.outputs.proxy_urls)
+        run: exit 1
+    env:
+      CODEQL_ACTION_TEST_MODE: true
diff --git .github/workflows/debug-artifacts.yml .github/workflows/debug-artifacts.yml
index 348246c164..a8cf710085 100644
--- .github/workflows/debug-artifacts.yml
+++ .github/workflows/debug-artifacts.yml
@@ -22,11 +22,11 @@ jobs:
       fail-fast: false
       matrix:
         version:
-        - stable-v2.14.6
         - stable-v2.15.5
         - stable-v2.16.6
         - stable-v2.17.6
         - stable-v2.18.4
+        - stable-v2.19.4
         - default
         - linked
         - nightly-latest
@@ -71,7 +71,7 @@ jobs:
       - name: Check expected artifacts exist
         shell: bash
         run: |
-          VERSIONS="stable-v2.14.6 stable-v2.15.5 stable-v2.16.6 stable-v2.17.6 stable-v2.18.4 default linked nightly-latest"
+          VERSIONS="stable-v2.15.5 stable-v2.16.6 stable-v2.17.6 stable-v2.18.4 stable-v2.19.4 default linked nightly-latest"
           LANGUAGES="cpp csharp go java javascript python"
           for version in $VERSIONS; do
             pushd "./my-debug-artifacts-${version//./}"
diff --git CHANGELOG.md CHANGELOG.md
index 0de71e9b2f..083550e87f 100644
--- CHANGELOG.md
+++ CHANGELOG.md
@@ -4,6 +4,11 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 Note that the only difference between `v2` and `v3` of the CodeQL Action is the node version they support, with `v3` running on node 20 while we continue to release `v2` to support running on node 16. For example `3.22.11` was the first `v3` release and is functionally identical to `2.22.11`. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.
 
+## 3.28.0 - 20 Dec 2024
+
+- Bump the minimum CodeQL bundle version to 2.15.5. [#2655](https://github.com/github/codeql-action/pull/2655)
+- Don't fail in the unusual case that a file is on the search path. [#2660](https://github.com/github/codeql-action/pull/2660).
+
 ## 3.27.9 - 12 Dec 2024
 
 No user facing changes.
diff --git README.md README.md
index 429c3ac66e..a32bf37bf6 100644
--- README.md
+++ README.md
@@ -81,9 +81,8 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n
 | `v3.25.11` | `2.17.6` | Enterprise Server 3.14 | |
 | `v3.24.11` | `2.16.6` | Enterprise Server 3.13 | |
 | `v3.22.12` | `2.15.5` | Enterprise Server 3.12 | |
-| `v2.22.1` | `2.14.6` | Enterprise Server 3.11 | Supports CodeQL Action v3, but did not ship with CodeQL Action v3. For more information, see "[Code scanning: deprecation of CodeQL Action v2](https://github.blog/changelog/2024-01-12-code-scanning-deprecation-of-codeql-action-v2/#users-of-github-enterprise-server-311)." |
 
-CodeQL Action v2 will stop receiving updates when GHES 3.11 is deprecated.
+CodeQL Action v2 has stopped receiving updates now that GHES 3.11 is deprecated.
 
 See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server).
 
diff --git lib/actions-util.js lib/actions-util.js
index 81233bb7bf..ab028c5be4 100644
--- lib/actions-util.js
+++ lib/actions-util.js
@@ -53,7 +53,7 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const core = __importStar(require("@actions/core"));
 const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
-const safeWhich = __importStar(require("@chrisgavin/safe-which"));
+const io = __importStar(require("@actions/io"));
 const util_1 = require("./util");
 // eslint-disable-next-line import/no-commonjs, @typescript-eslint/no-require-imports
 const pkg = require("../package.json");
@@ -219,7 +219,7 @@ const getFileType = async (filePath) => {
     let stdout = "";
     let fileCmdPath;
     try {
-        fileCmdPath = await safeWhich.safeWhich("file");
+        fileCmdPath = await io.which("file", true);
     }
     catch (e) {
         throw new FileCmdNotFoundError(`The \`file\` program is required, but does not appear to be installed. Please install it: ${e}`);
diff --git lib/analyze.js lib/analyze.js
index 33d26c1625..e6bf71d0bd 100644
--- lib/analyze.js
+++ lib/analyze.js
@@ -47,7 +47,7 @@ exports.runCleanup = runCleanup;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const perf_hooks_1 = require("perf_hooks");
-const safe_which_1 = require("@chrisgavin/safe-which");
+const io = __importStar(require("@actions/io"));
 const del_1 = __importDefault(require("del"));
 const yaml = __importStar(require("js-yaml"));
 const actionsUtil = __importStar(require("./actions-util"));
@@ -437,7 +437,7 @@ async function warnIfGoInstalledAfterInit(config, logger) {
     const goInitPath = process.env[environment_1.EnvVar.GO_BINARY_LOCATION];
     if (process.env[environment_1.EnvVar.DID_AUTOBUILD_GOLANG] !== "true" &&
         goInitPath !== undefined) {
-        const goBinaryPath = await (0, safe_which_1.safeWhich)("go");
+        const goBinaryPath = await io.which("go", true);
         if (goInitPath !== goBinaryPath) {
             logger.warning(`Expected \`which go\` to return ${goInitPath}, but got ${goBinaryPath}: please ensure that the correct version of Go is installed before the \`codeql-action/init\` Action is used.`);
             (0, diagnostics_1.addDiagnostic)(config, languages_1.Language.go, (0, diagnostics_1.makeDiagnostic)("go/workflow/go-installed-after-codeql-init", "Go was installed after the `codeql-action/init` Action was run", {
diff --git lib/codeql.js lib/codeql.js
index 15609dd8b1..2b4f017c04 100644
--- lib/codeql.js
+++ lib/codeql.js
@@ -75,19 +75,19 @@ let cachedCodeQL = undefined;
  * The version flags below can be used to conditionally enable certain features
  * on versions newer than this.
  */
-const CODEQL_MINIMUM_VERSION = "2.14.6";
+const CODEQL_MINIMUM_VERSION = "2.15.5";
 /**
  * This version will shortly become the oldest version of CodeQL that the Action will run with.
  */
-const CODEQL_NEXT_MINIMUM_VERSION = "2.14.6";
+const CODEQL_NEXT_MINIMUM_VERSION = "2.15.5";
 /**
  * This is the version of GHES that was most recently deprecated.
  */
-const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.10";
+const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.11";
 /**
  * This is the deprecation date for the version of GHES that was most recently deprecated.
  */
-const GHES_MOST_RECENT_DEPRECATION_DATE = "2024-09-24";
+const GHES_MOST_RECENT_DEPRECATION_DATE = "2024-12-19";
 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 /*
diff --git lib/codeql.test.js lib/codeql.test.js
index 900e68fde4..23dd199ee2 100644
--- lib/codeql.test.js
+++ lib/codeql.test.js
@@ -39,8 +39,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.stubToolRunnerConstructor = stubToolRunnerConstructor;
 const fs = __importStar(require("fs"));
 const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
+const io = __importStar(require("@actions/io"));
 const toolcache = __importStar(require("@actions/tool-cache"));
-const safeWhich = __importStar(require("@chrisgavin/safe-which"));
 const ava_1 = __importDefault(require("ava"));
 const del_1 = __importDefault(require("del"));
 const yaml = __importStar(require("js-yaml"));
@@ -539,8 +539,8 @@ for (const { codeqlVersion, flagPassed, githubVersion, negativeFlagPassed, } of
         const runnerConstructorStub = stubToolRunnerConstructor();
         const codeqlObject = await codeql.getCodeQLForTesting();
         sinon.stub(codeqlObject, "getVersion").resolves(codeqlVersion);
-        // safeWhich throws because of the test CodeQL object.
-        sinon.stub(safeWhich, "safeWhich").resolves("");
+        // io throws because of the test CodeQL object.
+        sinon.stub(io, "which").resolves("");
         await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", undefined, "", Object.assign({}, stubConfig, { gitHubVersion: githubVersion }), (0, testing_utils_1.createFeatures)([]));
         const actualArgs = runnerConstructorStub.firstCall.args[1];
         t.is(actualArgs.includes("--new-analysis-summary"), flagPassed, `--new-analysis-summary should${flagPassed ? "" : "n't"} be passed`);
@@ -555,8 +555,8 @@ for (const { codeqlVersion, flagPassed, githubVersion, negativeFlagPassed, } of
     stubToolRunnerConstructor(32, cliStderr);
     const codeqlObject = await codeql.getCodeQLForTesting();
     sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.17.6"));
-    // safeWhich throws because of the test CodeQL object.
-    sinon.stub(safeWhich, "safeWhich").resolves("");
+    // io throws because of the test CodeQL object.
+    sinon.stub(io, "which").resolves("");
     await t.throwsAsync(async () => await codeqlObject.finalizeDatabase("db", "--threads=2", "--ram=2048", false), {
         instanceOf: util.ConfigurationError,
         message: new RegExp('Encountered a fatal error while running \\"codeql-for-testing database finalize --finalize-dataset --threads=2 --ram=2048 db\\"\\. ' +
@@ -578,8 +578,8 @@ for (const { codeqlVersion, flagPassed, githubVersion, negativeFlagPassed, } of
     const codeqlObject = await codeql.getCodeQLForTesting();
     sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.17.6"));
     sinon.stub(codeqlObject, "resolveExtractor").resolves("/path/to/extractor");
-    // safeWhich throws because of the test CodeQL object.
-    sinon.stub(safeWhich, "safeWhich").resolves("");
+    // io throws because of the test CodeQL object.
+    sinon.stub(io, "which").resolves("");
     await t.throwsAsync(async () => await codeqlObject.runAutobuild(stubConfig, languages_1.Language.java), {
         instanceOf: util.ConfigurationError,
         message: "We were unable to automatically build your code. Please provide manual build steps. " +
@@ -596,8 +596,8 @@ for (const { codeqlVersion, flagPassed, githubVersion, negativeFlagPassed, } of
     const codeqlObject = await codeql.getCodeQLForTesting();
     sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.17.6"));
     sinon.stub(codeqlObject, "resolveExtractor").resolves("/path/to/extractor");
-    // safeWhich throws because of the test CodeQL object.
-    sinon.stub(safeWhich, "safeWhich").resolves("");
+    // io throws because of the test CodeQL object.
+    sinon.stub(io, "which").resolves("");
     await t.throwsAsync(async () => await codeqlObject.runAutobuild(stubConfig, languages_1.Language.java), {
         instanceOf: util.ConfigurationError,
         message: "We were unable to automatically build your code. Please provide manual build steps. " +
@@ -616,8 +616,8 @@ for (const { codeqlVersion, flagPassed, githubVersion, negativeFlagPassed, } of
     const codeqlObject = await codeql.getCodeQLForTesting();
     sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.17.6"));
     sinon.stub(codeqlObject, "resolveExtractor").resolves("/path/to/extractor");
-    // safeWhich throws because of the test CodeQL object.
-    sinon.stub(safeWhich, "safeWhich").resolves("");
+    // io throws because of the test CodeQL object.
+    sinon.stub(io, "which").resolves("");
     await t.throwsAsync(async () => await codeqlObject.databaseRunQueries(stubConfig.dbLocation, []), {
         instanceOf: cli_errors_1.CliError,
         message: `Encountered a fatal error while running "codeql-for-testing database run-queries  --expect-discarded-cache --min-disk-free=1024 -v --intra-layer-parallelism". Exit code was 1 and error was: Oops! A fatal internal error occurred. Details:
@@ -630,8 +630,8 @@ for (const { codeqlVersion, flagPassed, githubVersion, negativeFlagPassed, } of
     stubToolRunnerConstructor(32, cliStderr);
     const codeqlObject = await codeql.getCodeQLForTesting();
     sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.17.6"));
-    // safeWhich throws because of the test CodeQL object.
-    sinon.stub(safeWhich, "safeWhich").resolves("");
+    // io throws because of the test CodeQL object.
+    sinon.stub(io, "which").resolves("");
     await t.throwsAsync(async () => await codeqlObject.finalizeDatabase("db", "--threads=2", "--ram=2048", false), {
         instanceOf: util.ConfigurationError,
         message: new RegExp('Encountered a fatal error while running \\"codeql-for-testing database finalize --finalize-dataset --threads=2 --ram=2048 db\\"\\. ' +
@@ -642,8 +642,8 @@ for (const { codeqlVersion, flagPassed, githubVersion, negativeFlagPassed, } of
     const runnerConstructorStub = stubToolRunnerConstructor();
     const codeqlObject = await codeql.getCodeQLForTesting();
     sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.17.6"));
-    // safeWhich throws because of the test CodeQL object.
-    sinon.stub(safeWhich, "safeWhich").resolves("");
+    // io throws because of the test CodeQL object.
+    sinon.stub(io, "which").resolves("");
     process.env["CODEQL_ACTION_EXTRA_OPTIONS"] =
         '{ "database": { "init": ["--overwrite"] } }';
     await codeqlObject.databaseInitCluster(stubConfig, "sourceRoot", undefined, undefined, (0, logging_1.getRunnerLogger)(false));
diff --git lib/git-utils.js lib/git-utils.js
index bac8096963..a0520dab4f 100644
--- lib/git-utils.js
+++ lib/git-utils.js
@@ -38,7 +38,7 @@ exports.getRef = getRef;
 exports.isAnalyzingDefaultBranch = isAnalyzingDefaultBranch;
 const core = __importStar(require("@actions/core"));
 const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
-const safeWhich = __importStar(require("@chrisgavin/safe-which"));
+const io = __importStar(require("@actions/io"));
 const actions_util_1 = require("./actions-util");
 const util_1 = require("./util");
 async function runGitCommand(checkoutPath, args, customErrorMessage) {
@@ -46,7 +46,7 @@ async function runGitCommand(checkoutPath, args, customErrorMessage) {
     let stderr = "";
     core.debug(`Running git command: git ${args.join(" ")}`);
     try {
-        await new toolrunner.ToolRunner(await safeWhich.safeWhich("git"), args, {
+        await new toolrunner.ToolRunner(await io.which("git", true), args, {
             silent: true,
             listeners: {
                 stdout: (data) => {
diff --git lib/init-action.js lib/init-action.js
index ecaedc4d77..22c217c1df 100644
--- lib/init-action.js
+++ lib/init-action.js
@@ -36,7 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const core = __importStar(require("@actions/core"));
-const safe_which_1 = require("@chrisgavin/safe-which");
+const io = __importStar(require("@actions/io"));
 const uuid_1 = require("uuid");
 const actions_util_1 = require("./actions-util");
 const api_client_1 = require("./api-client");
@@ -258,7 +258,7 @@ async function run() {
         if (config.languages.includes(languages_1.Language.go) &&
             process.platform === "linux") {
             try {
-                const goBinaryPath = await (0, safe_which_1.safeWhich)("go");
+                const goBinaryPath = await io.which("go", true);
                 const fileOutput = await (0, actions_util_1.getFileType)(goBinaryPath);
                 // Go 1.21 and above ships with statically linked binaries on Linux. CodeQL cannot currently trace custom builds
                 // where the entry point is a statically linked binary. Until that is fixed, we work around the problem by
diff --git lib/init.js lib/init.js
index 678c4f7dd3..fa9c6ba663 100644
--- lib/init.js
+++ lib/init.js
@@ -42,7 +42,7 @@ exports.cleanupDatabaseClusterDirectory = cleanupDatabaseClusterDirectory;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
-const safeWhich = __importStar(require("@chrisgavin/safe-which"));
+const io = __importStar(require("@actions/io"));
 const actions_util_1 = require("./actions-util");
 const codeql_1 = require("./codeql");
 const configUtils = __importStar(require("./config-utils"));
@@ -102,7 +102,7 @@ async function checkInstallPython311(languages, codeql) {
         process.platform === "win32" &&
         !(await codeql.getVersion()).features?.supportsPython312) {
         const script = path.resolve(__dirname, "../python-setup", "check_python12.ps1");
-        await new toolrunner.ToolRunner(await safeWhich.safeWhich("powershell"), [
+        await new toolrunner.ToolRunner(await io.which("powershell", true), [
             script,
         ]).exec();
     }
diff --git lib/start-proxy-action.js lib/start-proxy-action.js
index db6b0a0e58..0d95a3ac5e 100644
--- lib/start-proxy-action.js
+++ lib/start-proxy-action.js
@@ -152,6 +152,10 @@ async function startProxy(binPath, config, logFilePath, logger) {
         core.setOutput("proxy_host", host);
         core.setOutput("proxy_port", port.toString());
         core.setOutput("proxy_ca_certificate", config.ca.cert);
+        const registry_urls = config.all_credentials
+            .filter((credential) => credential.url !== undefined)
+            .map((credential) => credential.url);
+        core.setOutput("proxy_urls", JSON.stringify(registry_urls));
     }
     catch (error) {
         core.setFailed(`start-proxy action failed: ${util.getErrorMessage(error)}`);
diff --git lib/tar.js lib/tar.js
index 891edf854c..64db8a5398 100644
--- lib/tar.js
+++ lib/tar.js
@@ -41,14 +41,14 @@ const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const stream = __importStar(require("stream"));
 const toolrunner_1 = require("@actions/exec/lib/toolrunner");
+const io = __importStar(require("@actions/io"));
 const toolcache = __importStar(require("@actions/tool-cache"));
-const safe_which_1 = require("@chrisgavin/safe-which");
 const actions_util_1 = require("./actions-util");
 const util_1 = require("./util");
 const MIN_REQUIRED_BSD_TAR_VERSION = "3.4.3";
 const MIN_REQUIRED_GNU_TAR_VERSION = "1.31";
 async function getTarVersion() {
-    const tar = await (0, safe_which_1.safeWhich)("tar");
+    const tar = await io.which("tar", true);
     let stdout = "";
     const exitCode = await new toolrunner_1.ToolRunner(tar, ["--version"], {
         listeners: {
diff --git lib/util.js lib/util.js
index 728a78efda..27878936bf 100644
--- lib/util.js
+++ lib/util.js
@@ -86,7 +86,7 @@ const path = __importStar(require("path"));
 const util_1 = require("util");
 const core = __importStar(require("@actions/core"));
 const exec = __importStar(require("@actions/exec/lib/exec"));
-const safe_which_1 = require("@chrisgavin/safe-which");
+const io = __importStar(require("@actions/io"));
 const check_disk_space_1 = __importDefault(require("check-disk-space"));
 const del_1 = __importDefault(require("del"));
 const get_folder_size_1 = __importDefault(require("get-folder-size"));
@@ -940,7 +940,7 @@ async function cleanUpGlob(glob, name, logger) {
 }
 async function isBinaryAccessible(binary, logger) {
     try {
-        await (0, safe_which_1.safeWhich)(binary);
+        await io.whi,ch(binary, true);
         logger.debug(`Found ${binary}.`);
         return true;
     }
diff --git node_modules/.package-lock.json node_modules/.package-lock.json
index 009fde807f..e25e97497d 100644
--- node_modules/.package-lock.json
+++ node_modules/.package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "3.27.9",
+  "version": "3.28.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
@@ -555,10 +555,6 @@
         "node": ">=6.9.0"
       }
     },
-    "node_modules/@chrisgavin/safe-which": {
-      "version": "1.0.2",
-      "license": "MIT"
-    },
     "node_modules/@eslint-community/eslint-utils": {
       "version": "4.4.0",
       "dev": true,
@@ -655,9 +651,9 @@
       }
     },
     "node_modules/@eslint/js": {
-      "version": "9.16.0",
-      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.16.0.tgz",
-      "integrity": "sha512-tw2HxzQkrbeuvyj1tG2Yqq+0H9wGoI2IMk4EOsQeX+vmd75FtJAzf+gTA69WF+baUKRYQ3x2kbLE08js5OsTVg==",
+      "version": "9.17.0",
+      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.17.0.tgz",
+      "integrity": "sha512-Sxc4hqcs1kTu0iID3kcZDW3JHq2a77HO9P8CP6YEA/FpH3Ll8UXE2r/86Rz9YJLKme39S9vU5OWNjC6Xl0Cr3w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1307,16 +1303,17 @@
       "license": "MIT"
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.18.0.tgz",
-      "integrity": "sha512-NR2yS7qUqCL7AIxdJUQf2MKKNDVNaig/dEB0GBLU7D+ZdHgK1NoH/3wsgO3OnPVipn51tG3MAwaODEGil70WEw==",
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.18.1.tgz",
+      "integrity": "sha512-Ncvsq5CT3Gvh+uJG0Lwlho6suwDfUXH0HztslDf5I+F2wAFAZMRwYLEorumpKLzmO2suAXZ/td1tBg4NZIi9CQ==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.10.0",
-        "@typescript-eslint/scope-manager": "8.18.0",
-        "@typescript-eslint/type-utils": "8.18.0",
-        "@typescript-eslint/utils": "8.18.0",
-        "@typescript-eslint/visitor-keys": "8.18.0",
+        "@typescript-eslint/scope-manager": "8.18.1",
+        "@typescript-eslint/type-utils": "8.18.1",
+        "@typescript-eslint/utils": "8.18.1",
+        "@typescript-eslint/visitor-keys": "8.18.1",
         "graphemer": "^1.4.0",
         "ignore": "^5.3.1",
         "natural-compare": "^1.4.0",
@@ -1336,13 +1333,14 @@
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.18.0.tgz",
-      "integrity": "sha512-PNGcHop0jkK2WVYGotk/hxj+UFLhXtGPiGtiaWgVBVP1jhMoMCHlTyJA+hEj4rszoSdLTK3fN4oOatrL0Cp+Xw==",
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.18.1.tgz",
+      "integrity": "sha512-HxfHo2b090M5s2+/9Z3gkBhI6xBH8OJCFjH9MhQ+nnoZqxU3wNxkLT+VWXWSFWc3UF3Z+CfPAyqdCTdoXtDPCQ==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.18.0",
-        "@typescript-eslint/visitor-keys": "8.18.0"
+        "@typescript-eslint/types": "8.18.1",
+        "@typescript-eslint/visitor-keys": "8.18.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -1353,10 +1351,11 @@
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/types": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.18.0.tgz",
-      "integrity": "sha512-FNYxgyTCAnFwTrzpBGq+zrnoTO4x0c1CKYY5MuUTzpScqmY5fmsh2o3+57lqdI3NZucBDCzDgdEbIaNfAjAHQA==",
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.18.1.tgz",
+      "integrity": "sha512-7uoAUsCj66qdNQNpH2G8MyTFlgerum8ubf21s3TSM3XmKXuIn+H2Sifh/ES2nPOPiYSRJWAk0fDkW0APBWcpfw==",
       "dev": true,
+      "license": "MIT",
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
@@ -1366,13 +1365,14 @@
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.18.0.tgz",
-      "integrity": "sha512-rqQgFRu6yPkauz+ms3nQpohwejS8bvgbPyIDq13cgEDbkXt4LH4OkDMT0/fN1RUtzG8e8AKJyDBoocuQh8qNeg==",
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.18.1.tgz",
+      "integrity": "sha512-z8U21WI5txzl2XYOW7i9hJhxoKKNG1kcU4RzyNvKrdZDmbjkmLBo8bgeiOJmA06kizLI76/CCBAAGlTlEeUfyg==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.18.0",
-        "@typescript-eslint/visitor-keys": "8.18.0",
+        "@typescript-eslint/types": "8.18.1",
+        "@typescript-eslint/visitor-keys": "8.18.1",
         "debug": "^4.3.4",
         "fast-glob": "^3.3.2",
         "is-glob": "^4.0.3",
@@ -1392,15 +1392,16 @@
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.18.0.tgz",
-      "integrity": "sha512-p6GLdY383i7h5b0Qrfbix3Vc3+J2k6QWw6UMUeY5JGfm3C5LbZ4QIZzJNoNOfgyRe0uuYKjvVOsO/jD4SJO+xg==",
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.18.1.tgz",
+      "integrity": "sha512-8vikiIj2ebrC4WRdcAdDcmnu9Q/MXXwg+STf40BVfT8exDqBCUPdypvzcUPxEqRGKg9ALagZ0UWcYCtn+4W2iQ==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.4.0",
-        "@typescript-eslint/scope-manager": "8.18.0",
-        "@typescript-eslint/types": "8.18.0",
-        "@typescript-eslint/typescript-estree": "8.18.0"
+        "@typescript-eslint/scope-manager": "8.18.1",
+        "@typescript-eslint/types": "8.18.1",
+        "@typescript-eslint/typescript-estree": "8.18.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -1415,12 +1416,13 @@
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.18.0.tgz",
-      "integrity": "sha512-pCh/qEA8Lb1wVIqNvBke8UaRjJ6wrAWkJO5yyIbs8Yx6TNGYyfNjOo61tLv+WwLvoLPp4BQ8B7AHKijl8NGUfw==",
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.18.1.tgz",
+      "integrity": "sha512-Vj0WLm5/ZsD013YeUKn+K0y8p1M0jPpxOkKdbD1wB0ns53a5piVY02zjf072TblEweAbcYiFiPoSMF3kp+VhhQ==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.18.0",
+        "@typescript-eslint/types": "8.18.1",
         "eslint-visitor-keys": "^4.2.0"
       },
       "engines": {
@@ -1436,6 +1438,7 @@
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
       "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0"
       }
@@ -1445,6 +1448,7 @@
       "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.0.tgz",
       "integrity": "sha512-UyLnSehNt62FFhSwjZlHmeokpRK59rcz29j+F1/aDgbkbRTk7wIc9XzdoasMUbRNKDM0qQt/+BJ4BrpFeABemw==",
       "dev": true,
+      "license": "Apache-2.0",
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
@@ -1457,6 +1461,7 @@
       "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
       "integrity": "s,ha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
       "dev": true,
+      "license": "ISC",
       "dependencies": {
         "brace-expansion": "^2.0.1"
       },
@@ -1468,15 +1473,16 @@
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.18.0.tgz",
-      "integrity": "sha512-hgUZ3kTEpVzKaK3uNibExUYm6SKKOmTU2BOxBSvOYwtJEPdVQ70kZJpPjstlnhCHcuc2WGfSbpKlb/69ttyN5Q==",
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.18.1.tgz",
+      "integrity": "sha512-rBnTWHCdbYM2lh7hjyXqxk70wvon3p2FyaniZuey5TrcGBpfhVp0OxOa6gxr9Q9YhZFKyfbEnxc24ZnVbbUkCA==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.18.0",
-        "@typescript-eslint/types": "8.18.0",
-        "@typescript-eslint/typescript-estree": "8.18.0",
-        "@typescript-eslint/visitor-keys": "8.18.0",
+        "@typescript-eslint/scope-manager": "8.18.1",
+        "@typescript-eslint/types": "8.18.1",
+        "@typescript-eslint/typescript-estree": "8.18.1",
+        "@typescript-eslint/visitor-keys": "8.18.1",
         "debug": "^4.3.4"
       },
       "engines": {
@@ -1492,13 +1498,14 @@
       }
     },
     "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.18.0.tgz",
-      "integrity": "sha512-PNGcHop0jkK2WVYGotk/hxj+UFLhXtGPiGtiaWgVBVP1jhMoMCHlTyJA+hEj4rszoSdLTK3fN4oOatrL0Cp+Xw==",
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.18.1.tgz",
+      "integrity": "sha512-HxfHo2b090M5s2+/9Z3gkBhI6xBH8OJCFjH9MhQ+nnoZqxU3wNxkLT+VWXWSFWc3UF3Z+CfPAyqdCTdoXtDPCQ==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.18.0",
-        "@typescript-eslint/visitor-keys": "8.18.0"
+        "@typescript-eslint/types": "8.18.1",
+        "@typescript-eslint/visitor-keys": "8.18.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -1509,10 +1516,11 @@
       }
     },
     "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/types": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.18.0.tgz",
-      "integrity": "sha512-FNYxgyTCAnFwTrzpBGq+zrnoTO4x0c1CKYY5MuUTzpScqmY5fmsh2o3+57lqdI3NZucBDCzDgdEbIaNfAjAHQA==",
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.18.1.tgz",
+      "integrity": "sha512-7uoAUsCj66qdNQNpH2G8MyTFlgerum8ubf21s3TSM3XmKXuIn+H2Sifh/ES2nPOPiYSRJWAk0fDkW0APBWcpfw==",
       "dev": true,
+      "license": "MIT",
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
@@ -1522,13 +1530,14 @@
       }
     },
     "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.18.0.tgz",
-      "integrity": "sha512-rqQgFRu6yPkauz+ms3nQpohwejS8bvgbPyIDq13cgEDbkXt4LH4OkDMT0/fN1RUtzG8e8AKJyDBoocuQh8qNeg==",
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.18.1.tgz",
+      "integrity": "sha512-z8U21WI5txzl2XYOW7i9hJhxoKKNG1kcU4RzyNvKrdZDmbjkmLBo8bgeiOJmA06kizLI76/CCBAAGlTlEeUfyg==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.18.0",
-        "@typescript-eslint/visitor-keys": "8.18.0",
+        "@typescript-eslint/types": "8.18.1",
+        "@typescript-eslint/visitor-keys": "8.18.1",
         "debug": "^4.3.4",
         "fast-glob": "^3.3.2",
         "is-glob": "^4.0.3",
@@ -1548,12 +1557,13 @@
       }
     },
     "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.18.0.tgz",
-      "integrity": "sha512-pCh/qEA8Lb1wVIqNvBke8UaRjJ6wrAWkJO5yyIbs8Yx6TNGYyfNjOo61tLv+WwLvoLPp4BQ8B7AHKijl8NGUfw==",
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.18.1.tgz",
+      "integrity": "sha512-Vj0WLm5/ZsD013YeUKn+K0y8p1M0jPpxOkKdbD1wB0ns53a5piVY02zjf072TblEweAbcYiFiPoSMF3kp+VhhQ==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.18.0",
+        "@typescript-eslint/types": "8.18.1",
         "eslint-visitor-keys": "^4.2.0"
       },
       "engines": {
@@ -1569,6 +1579,7 @@
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
       "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0"
       }
@@ -1578,6 +1589,7 @@
       "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.0.tgz",
       "integrity": "sha512-UyLnSehNt62FFhSwjZlHmeokpRK59rcz29j+F1/aDgbkbRTk7wIc9XzdoasMUbRNKDM0qQt/+BJ4BrpFeABemw==",
       "dev": true,
+      "license": "Apache-2.0",
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
@@ -1590,6 +1602,7 @@
       "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
       "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
       "dev": true,
+      "license": "ISC",
       "dependencies": {
         "brace-expansion": "^2.0.1"
       },
@@ -1619,13 +1632,14 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.18.0.tgz",
-      "integrity": "sha512-er224jRepVAVLnMF2Q7MZJCq5CsdH2oqjP4dT7K6ij09Kyd+R21r7UVJrF0buMVdZS5QRhDzpvzAxHxabQadow==",
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.18.1.tgz",
+      "integrity": "sha512-jAhTdK/Qx2NJPNOTxXpMwlOiSymtR2j283TtPqXkKBdH8OAMmhiUfP0kJjc/qSE51Xrq02Gj9NY7MwK+UxVwHQ==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/typescript-estree": "8.18.0",
-        "@typescript-eslint/utils": "8.18.0",
+        "@typescript-eslint/typescript-estree": "8.18.1",
+        "@typescript-eslint/utils": "8.18.1",
         "debug": "^4.3.4",
         "ts-api-utils": "^1.3.0"
       },
@@ -1642,13 +1656,14 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.18.0.tgz",
-      "integrity": "sha512-PNGcHop0jkK2WVYGotk/hxj+UFLhXtGPiGtiaWgVBVP1jhMoMCHlTyJA+hEj4rszoSdLTK3fN4oOatrL0Cp+Xw==",
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.18.1.tgz",
+      "integrity": "sha512-HxfHo2b090M5s2+/9Z3gkBhI6xBH8OJCFjH9MhQ+nnoZqxU3wNxkLT+VWXWSFWc3UF3Z+CfPAyqdCTdoXtDPCQ==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.18.0",
-        "@typescript-eslint/visitor-keys": "8.18.0"
+        "@typescript-eslint/types": "8.18.1",
+        "@typescript-eslint/visitor-keys": "8.18.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -1659,10 +1674,11 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/types": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.18.0.tgz",
-      "integrity": "sha512-FNYxgyTCAnFwTrzpBGq+zrnoTO4x0c1CKYY5MuUTzpScqmY5fmsh2o3+57lqdI3NZucBDCzDgdEbIaNfAjAHQA==",
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.18.1.tgz",
+      "integrity": "sha512-7uoAUsCj66qdNQNpH2G8MyTFlgerum8ubf21s3TSM3XmKXuIn+H2Sifh/ES2nPOPiYSRJWAk0fDkW0APBWcpfw==",
       "dev": true,
+      "license": "MIT",
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
@@ -1672,13 +1688,14 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.18.0.tgz",
-      "integrity": "sha512-rqQgFRu6yPkauz+ms3nQpohwejS8bvgbPyIDq13cgEDbkXt4LH4OkDMT0/fN1RUtzG8e8AKJyDBoocuQh8qNeg==",
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.18.1.tgz",
+      "integrity": "sha512-z8U21WI5txzl2XYOW7i9hJhxoKKNG1kcU4RzyNvKrdZDmbjkmLBo8bgeiOJmA06kizLI76/CCBAAGlTlEeUfyg==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.18.0",
-        "@typescript-eslint/visitor-keys": "8.18.0",
+        "@typescript-eslint/types": "8.18.1",
+        "@typescript-eslint/visitor-keys": "8.18.1",
         "debug": "^4.3.4",
         "fast-glob": "^3.3.2",
         "is-glob": "^4.0.3",
@@ -1698,15 +1715,16 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/utils": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.18.0.tgz",
-      "integrity": "sha512-p6GLdY383i7h5b0Qrfbix3Vc3+J2k6QWw6UMUeY5JGfm3C5LbZ4QIZzJNoNOfgyRe0uuYKjvVOsO/jD4SJO+xg==",
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.18.1.tgz",
+      "integrity": "sha512-8vikiIj2ebrC4WRdcAdDcmnu9Q/MXXwg+STf40BVfT8exDqBCUPdypvzcUPxEqRGKg9ALagZ0UWcYCtn+4W2iQ==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.4.0",
-        "@typescript-eslint/scope-manager": "8.18.0",
-        "@typescript-eslint/types": "8.18.0",
-        "@typescript-eslint/typescript-estree": "8.18.0"
+        "@typescript-eslint/scope-manager": "8.18.1",
+        "@typescript-eslint/types": "8.18.1",
+        "@typescript-eslint/typescript-estree": "8.18.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -1721,12 +1739,13 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.18.0.tgz",
-      "integrity": "sha512-pCh/qEA8Lb1wVIqNvBke8UaRjJ6wrAWkJO5yyIbs8Yx6TNGYyfNjOo61tLv+WwLvoLPp4BQ8B7AHKijl8NGUfw==",
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.18.1.tgz",
+      "integrity": "sha512-Vj0WLm5/ZsD013YeUKn+K0y8p1M0jPpxOkKdbD1wB0ns53a5piVY02zjf072TblEweAbcYiFiPoSMF3kp+VhhQ==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.18.0",
+        "@typescript-eslint/types": "8.18.1",
         "eslint-visitor-keys": "^4.2.0"
       },
       "engines": {
@@ -1742,6 +1761,7 @@
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
       "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0"
       }
@@ -1751,6 +1771,7 @@
       "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.0.tgz",
       "integrity": "sha51,2-UyLnSehNt62FFhSwjZlHmeokpRK59rcz29j+F1/aDgbkbRTk7wIc9XzdoasMUbRNKDM0qQt/+BJ4BrpFeABemw==",
       "dev": true,
+      "license": "Apache-2.0",
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
@@ -1763,6 +1784,7 @@
       "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
       "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
       "dev": true,
+      "license": "ISC",
       "dependencies": {
         "brace-expansion": "^2.0.1"
       },
diff --git node_modules/@chrisgavin/safe-which/README.md node_modules/@chrisgavin/safe-which/README.md
deleted file mode 100644
index 168eb14d65..0000000000
--- node_modules/@chrisgavin/safe-which/README.md
+++ /dev/null
@@ -1,2 +0,0 @@
-# safe-which
-A NodeJS library to guard against Windows binary planting attacks.
diff --git node_modules/@chrisgavin/safe-which/build/index.d.ts node_modules/@chrisgavin/safe-which/build/index.d.ts
deleted file mode 100644
index 600c9885bf..0000000000
--- node_modules/@chrisgavin/safe-which/build/index.d.ts
+++ /dev/null
@@ -1,2 +0,0 @@
-export declare const isWindows: boolean;
-export declare function safeWhich(program: string): Promise<string>;
diff --git node_modules/@chrisgavin/safe-which/build/index.js node_modules/@chrisgavin/safe-which/build/index.js
deleted file mode 100644
index 39264dd325..0000000000
--- node_modules/@chrisgavin/safe-which/build/index.js
+++ /dev/null
@@ -1,40 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.safeWhich = exports.isWindows = void 0;
-const fs = require("fs");
-const path = require("path");
-exports.isWindows = process.platform === "win32";
-const pathSeparator = exports.isWindows ? ";" : ":";
-const defaultPathExt = exports.isWindows ? [".com", ".exe", ".bat", ".cmd"] : [""];
-async function safeWhich(program) {
-    if (program.includes("/") || (program.includes("\\") && exports.isWindows)) {
-        // If the path contains slashes it's either absolute or relative and should not be searched for.
-        return program;
-    }
-    let pathValue = process.env.PATH;
-    if (pathValue === undefined) {
-        throw new Error(`Could not resolve program ${program} because no PATH environment variable was set.`);
-    }
-    let searchPaths = pathValue.split(pathSeparator);
-    let pathExts = defaultPathExt;
-    if (exports.isWindows && process.env.PATHEXT !== undefined) {
-        pathExts = process.env.PATHEXT.split(pathSeparator);
-    }
-    for (let searchPath of searchPaths) {
-        for (let pathExt of pathExts) {
-            let completePath = path.join(searchPath, program + pathExt);
-            try {
-                await fs.promises.access(completePath, fs.constants.X_OK);
-                return completePath;
-            }
-            catch (err) {
-                if (err.code !== "ENOENT") {
-                    throw err;
-                }
-            }
-        }
-    }
-    throw new Error(`Could not find program ${program} on PATH.`);
-}
-exports.safeWhich = safeWhich;
-//# sourceMappingURL=index.js.map
\ No newline at end of file
diff --git node_modules/@chrisgavin/safe-which/build/index.test.d.ts node_modules/@chrisgavin/safe-which/build/index.test.d.ts
deleted file mode 100644
index cb0ff5c3b5..0000000000
--- node_modules/@chrisgavin/safe-which/build/index.test.d.ts
+++ /dev/null
@@ -1 +0,0 @@
-export {};
diff --git node_modules/@chrisgavin/safe-which/build/index.test.js node_modules/@chrisgavin/safe-which/build/index.test.js
deleted file mode 100644
index 8c5d92e628..0000000000
--- node_modules/@chrisgavin/safe-which/build/index.test.js
+++ /dev/null
@@ -1,75 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const ava_1 = require("ava");
-const index_1 = require("./index");
-const path = require("path");
-const originalEnv = process.env;
-const originalWorkingDirectory = process.cwd();
-const testResources = path.resolve(path.join("src", "index.test"));
-ava_1.default.beforeEach(_ => {
-    process.env = { ...originalEnv };
-});
-ava_1.default.afterEach(_ => {
-    process.env = originalEnv;
-    process.chdir(originalWorkingDirectory);
-});
-ava_1.default("relative path with forward-slash is returned as-is", async (t) => {
-    process.env.PATH = path.join(testResources, "path");
-    t.deepEqual(await index_1.safeWhich("./anything"), "./anything");
-});
-ava_1.default("absolute path with forward-slash is returned as-is", async (t) => {
-    process.env.PATH = path.join(testResources, "path");
-    t.deepEqual(await index_1.safeWhich("/usr/bin/anything"), "/usr/bin/anything");
-});
-ava_1.default("binaries in cwd are not returned", async (t) => {
-    process.env.PATH = path.join(testResources, "empty");
-    process.chdir(path.join(testResources, "path"));
-    await t.throwsAsync(index_1.safeWhich("program"));
-    await t.throwsAsync(index_1.safeWhich("has-an-extension"));
-    await t.throwsAsync(index_1.safeWhich("has-an-extension.exe"));
-});
-if (index_1.isWindows) {
-    ava_1.default("program is found if on path with correct extension preference", async (t) => {
-        process.env.PATH = path.join(testResources, "path");
-        process.env.PATHEXT = ".com;.exe";
-        t.deepEqual(await index_1.safeWhich("has-an-extension"), path.join(testResources, "path", "has-an-extension.com"));
-        process.env.PATHEXT = ".exe;.com";
-        t.deepEqual(await index_1.safeWhich("has-an-extension"), path.join(testResources, "path", "has-an-extension.exe"));
-    });
-    ava_1.default("program is not found if no extension", async (t) => {
-        process.env.PATH = path.join(testResources, "path");
-        await t.throwsAsync(index_1.safeWhich("program"));
-    });
-    ava_1.default("relative path with backward-slash is returned as-is", async (t) => {
-        process.env.PATH = path.join(testResources, "path");
-        t.deepEqual(await index_1.safeWhich(".\\anything"), ".\\anything");
-    });
-    ava_1.default("absolute path with backward-slash is returned as-is", async (t) => {
-        process.env.PATH = path.join(testResources, "path");
-        t.deepEqual(await index_1.safeWhich("C:\\Python27\\python.exe"), "C:\\Python27\\python.exe");
-    });
-    ava_1.default("path order is respected", async (t) => {
-        process.env.PATHEXT = ".com;.exe;.bat";
-        process.env.PATH = path.join(testResources, "path") + ";" + path.join(testResources, "second-path");
-        t.deepEqual(await index_1.safeWhich("has-an-extension"), path.join(testResources, "path", "has-an-extension.com"));
-        process.env.PATH = path.join(testResources, "second-path") + ";" + path.join(testResources, "path");
-        t.deepEqual(await index_1.safeWhich("has-an-extension"), path.join(testResources, "second-path", "has-an-extension.bat"));
-    });
-}
-else {
-    ava_1.default("program is found if on path and executable", async (t) => {
-        process.env.PATH = path.join(testResources, "path");
-        t.deepEqual(await index_1.safeWhich("program"), path.join(testResources, "path", "program"));
-    });
-    ava_1.default("program is not found if not executable", async (t) => {
-        process.env.PATH = path.join(testResources, "path");
-        await t.throwsAsync(index_1.safeWhich("non-executable-file"));
-    });
-    ava_1.default("path order is respected", async (t) => {
-        process.env.PATH = path.join(testResources, "path") + ":" + path.join(testResources, "second-path");
-        t.deepEqual(await index_1.safeWhich("program"), path.join(testResources, "path", "program"));
-        process.env.PATH = path.join(testResources, "second-path") + ":" + path.join(testResources, "path");
-        t.deepEqual(await index_1.safeWhich("program"), path.join(testResources, "second-path", "program"));
-    });
-}
-//# sourceMappingURL=index.test.js.map
\ No newline at end of file
diff --git node_modules/@chrisgavin/safe-which/package.json node_modules/@chrisgavin/safe-which/package.json
deleted file mode 100644
index f9a6b9ca20..0000000000
--- node_modules/@chrisgavin/safe-which/package.,json
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  "name": "@chrisgavin/safe-which",
-  "version": "1.0.2",
-  "description": "A NodeJS library to guard against Windows binary planting attacks.",
-  "license": "MIT",
-  "homepage": "https://github.com/chrisgavin/safe-which/",
-  "publishConfig": {
-    "access": "public"
-  },
-  "main": "./build/index.js",
-  "types": "./build/index.d.ts",
-  "scripts": {
-    "build": "tsc",
-    "pretest": "npm install && npm run build",
-    "test": "ava --verbose --serial ./src/**",
-    "prepublishOnly": "npm install && npm run build && npm version --allow-same-version=true --git-tag-version=false ${GITHUB_REF#refs/tags/}"
-  },
-  "dependencies": {},
-  "devDependencies": {
-    "@ava/typescript": "^1.1.1",
-    "@types/node": "^14.14.7",
-    "ava": "^3.13.0",
-    "typescript": "^3.8.3"
-  },
-  "ava": {
-    "typescript": {
-      "rewritePaths": {
-        "./src/": "./build/"
-      }
-    }
-  }
-}
diff --git node_modules/@eslint/js/package.json node_modules/@eslint/js/package.json
index a151eafe32..d1175fff13 100644
--- node_modules/@eslint/js/package.json
+++ node_modules/@eslint/js/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@eslint/js",
-  "version": "9.16.0",
+  "version": "9.17.0",
   "description": "ESLint JavaScript language implementation",
   "main": "./src/index.js",
   "types": "./types/index.d.ts",
diff --git node_modules/@typescript-eslint/eslint-plugin/dist/rules/no-unnecessary-boolean-literal-compare.js node_modules/@typescript-eslint/eslint-plugin/dist/rules/no-unnecessary-boolean-literal-compare.js
index 4993a91a60..30eb310226 100644
--- node_modules/@typescript-eslint/eslint-plugin/dist/rules/no-unnecessary-boolean-literal-compare.js
+++ node_modules/@typescript-eslint/eslint-plugin/dist/rules/no-unnecessary-boolean-literal-compare.js
@@ -84,7 +84,7 @@ exports.default = (0, util_1.createRule)({
             if (!comparison) {
                 return undefined;
             }
-            const expressionType = services.getTypeAtLocation(comparison.expression);
+            const expressionType = (0, util_1.getConstrainedTypeAtLocation)(services, comparison.expression);
             if (isBooleanType(expressionType)) {
                 return {
                     ...comparison,
diff --git node_modules/@typescript-eslint/eslint-plugin/dist/rules/no-unnecessary-condition.js node_modules/@typescript-eslint/eslint-plugin/dist/rules/no-unnecessary-condition.js
index 084fbb60e0..8c7110bb1e 100644
--- node_modules/@typescript-eslint/eslint-plugin/dist/rules/no-unnecessary-condition.js
+++ node_modules/@typescript-eslint/eslint-plugin/dist/rules/no-unnecessary-condition.js
@@ -157,7 +157,7 @@ exports.default = (0, util_1.createRule)({
             alwaysNullish: 'Unnecessary conditional, left-hand side of `??` operator is always `null` or `undefined`.',
             alwaysTruthy: 'Unnecessary conditional, value is always truthy.',
             alwaysTruthyFunc: 'This callback should return a conditional, but return is always truthy.',
-            literalBooleanExpression: 'Unnecessary conditional, comparison is always {{trueOrFalse}}. Both sides of the comparison always have a literal type.',
+            comparisonBetweenLiteralTypes: 'Unnecessary conditional, comparison is always {{trueOrFalse}}, since `{{left}} {{operator}} {{right}}` is {{trueOrFalse}}.',
             never: 'Unnecessary conditional, value is `never`.',
             neverNullish: 'Unnecessary conditional, expected left-hand side of `??` operator to be possibly null or undefined.',
             neverOptionalChain: 'Unnecessary optional chain on a non-nullish value.',
@@ -352,8 +352,11 @@ exports.default = (0, util_1.createRule)({
                 const conditionIsTrue = booleanComparison(leftStaticValue.value, operator, rightStaticValue.value);
                 context.report({
                     node,
-                    messageId: 'literalBooleanExpression',
+                    messageId: 'comparisonBetweenLiteralTypes',
                     data: {
+                        left: checker.typeToS,tring(leftType),
+                        operator,
+                        right: checker.typeToString(rightType),
                         trueOrFalse: conditionIsTrue ? 'true' : 'false',
                     },
                 });
@@ -546,7 +549,9 @@ exports.default = (0, util_1.createRule)({
                     if (propType) {
                         return (0, util_1.isNullableType)(propType);
                     }
-                    return !!checker.getIndexInfoOfType(type, ts.IndexKind.String);
+                    const indexInfo = checker.getIndexInfosOfType(type);
+                    return indexInfo.some(info => (0, util_1.getTypeName)(checker, info.keyType) === 'string' &&
+                        (0, util_1.isNullableType)(info.type));
                 });
                 return !isOwnNullable && (0, util_1.isNullableType)(prevType);
             }
diff --git node_modules/@typescript-eslint/eslint-plugin/dist/rules/no-unnecessary-template-expression.js node_modules/@typescript-eslint/eslint-plugin/dist/rules/no-unnecessary-template-expression.js
index f250d6dd15..0ffd7f730f 100644
--- node_modules/@typescript-eslint/eslint-plugin/dist/rules/no-unnecessary-template-expression.js
+++ node_modules/@typescript-eslint/eslint-plugin/dist/rules/no-unnecessary-template-expression.js
@@ -89,6 +89,11 @@ exports.default = (0, util_1.createRule)({
             return (expression.type === utils_1.AST_NODE_TYPES.Identifier &&
                 expression.name === 'NaN');
         }
+        function hasCommentsBetweenQuasi(startQuasi, endQuasi) {
+            const startToken = (0, util_1.nullThrows)(context.sourceCode.getTokenByRangeStart(startQuasi.range[0]), util_1.NullThrowsReasons.MissingToken('`${', 'opening template literal'));
+            const endToken = (0, util_1.nullThrows)(context.sourceCode.getTokenByRangeStart(endQuasi.range[0]), util_1.NullThrowsReasons.MissingToken('}', 'closing template literal'));
+            return context.sourceCode.commentsExistBetween(startToken, endToken);
+        }
         return {
             TemplateLiteral(node) {
                 if (node.parent.type === utils_1.AST_NODE_TYPES.TaggedTemplateExpression) {
@@ -100,6 +105,9 @@ exports.default = (0, util_1.createRule)({
                     node.expressions.length === 1 &&
                     isUnderlyingTypeString(node.expressions[0]);
                 if (hasSingleStringVariable) {
+                    if (hasCommentsBetweenQuasi(node.quasis[0], node.quasis[1])) {
+                        return;
+                    }
                     context.report({
                         loc: (0, rangeToLoc_1.rangeToLoc)(context.sourceCode, [
                             node.expressions[0].range[0] - 2,
@@ -123,12 +131,16 @@ exports.default = (0, util_1.createRule)({
                     nextQuasi: node.quasis[index + 1],
                     prevQuasi: node.quasis[index],
                 }))
-                    .filter(({ expression, nextQuasi }) => {
+                    .filter(({ expression, nextQuasi, prevQuasi }) => {
                     if ((0, util_1.isUndefinedIdentifier)(expression) ||
                         isInfinityIdentifier(expression) ||
                         isNaNIdentifier(expression)) {
                         return true;
                     }
+                    // allow expressions that include comments
+                    if (hasCommentsBetweenQuasi(prevQuasi, nextQuasi)) {
+                        return false;
+                    }
                     if (isLiteral(expression)) {
                         // allow trailing whitespace literal
                         if (startsWithNewLine(nextQuasi.value.raw)) {
diff --git node_modules/@typescript-eslint/eslint-plugin/dist/rules/no-unsafe-type-assertion.js node_modules/@typescript-eslint/eslint-plugin/dist/rules/no-unsafe-type-assertion.js
index 464f227397..719bfc9543 100644
--- node_modules/@typescript-eslint/eslint-plugin/dist/rules/no-unsafe-type-assertion.js
+++ node_modules/@typescript-eslint/eslint-plugin/dist/rules/no-unsafe-ty,pe-assertion.js
@@ -45,8 +45,8 @@ exports.default = (0, util_1.createRule)({
             requiresTypeChecking: true,
         },
         messages: {
-            unsafeOfAnyTypeAssertion: 'Unsafe cast from {{type}} detected: consider using type guards or a safer cast.',
-            unsafeToAnyTypeAssertion: 'Unsafe cast to {{type}} detected: consider using a more specific type to ensure safety.',
+            unsafeOfAnyTypeAssertion: 'Unsafe assertion from {{type}} detected: consider using type guards or a safer assertion.',
+            unsafeToAnyTypeAssertion: 'Unsafe assertion to {{type}} detected: consider using a more specific type to ensure safety.',
             unsafeTypeAssertion: "Unsafe type assertion: type '{{type}}' is more narrow than the original type.",
         },
         schema: [],
@@ -68,7 +68,7 @@ exports.default = (0, util_1.createRule)({
             if (expressionType === assertedType) {
                 return;
             }
-            // handle cases when casting unknown ==> any.
+            // handle cases when asserting unknown ==> any.
             if ((0, util_1.isTypeAnyType)(assertedType) && (0, util_1.isTypeUnknownType)(expressionType)) {
                 context.report({
                     node,
diff --git node_modules/@typescript-eslint/eslint-plugin/dist/rules/non-nullable-type-assertion-style.js node_modules/@typescript-eslint/eslint-plugin/dist/rules/non-nullable-type-assertion-style.js
index 298379761e..4b4b9b2313 100644
--- node_modules/@typescript-eslint/eslint-plugin/dist/rules/non-nullable-type-assertion-style.js
+++ node_modules/@typescript-eslint/eslint-plugin/dist/rules/non-nullable-type-assertion-style.js
@@ -42,7 +42,7 @@ exports.default = (0, util_1.createRule)({
     meta: {
         type: 'suggestion',
         docs: {
-            description: 'Enforce non-null assertions over explicit type casts',
+            description: 'Enforce non-null assertions over explicit type assertions',
             recommended: 'stylistic',
             requiresTypeChecking: true,
         },
diff --git node_modules/@typescript-eslint/eslint-plugin/dist/rules/prefer-reduce-type-parameter.js node_modules/@typescript-eslint/eslint-plugin/dist/rules/prefer-reduce-type-parameter.js
index 6a877fe7cd..bf4f524cea 100644
--- node_modules/@typescript-eslint/eslint-plugin/dist/rules/prefer-reduce-type-parameter.js
+++ node_modules/@typescript-eslint/eslint-plugin/dist/rules/prefer-reduce-type-parameter.js
@@ -40,13 +40,13 @@ exports.default = (0, util_1.createRule)({
     meta: {
         type: 'problem',
         docs: {
-            description: 'Enforce using type parameter when calling `Array#reduce` instead of casting',
+            description: 'Enforce using type parameter when calling `Array#reduce` instead of using a type assertion',
             recommended: 'strict',
             requiresTypeChecking: true,
         },
         fixable: 'code',
         messages: {
-            preferTypeParameter: 'Unnecessary cast: Array#reduce accepts a type parameter for the default value.',
+            preferTypeParameter: 'Unnecessary assertion: Array#reduce accepts a type parameter for the default value.',
         },
         schema: [],
     },
diff --git node_modules/@typescript-eslint/eslint-plugin/dist/rules/strict-boolean-expressions.js node_modules/@typescript-eslint/eslint-plugin/dist/rules/strict-boolean-expressions.js
index 850169a302..87e711aa84 100644
--- node_modules/@typescript-eslint/eslint-plugin/dist/rules/strict-boolean-expressions.js
+++ node_modules/@typescript-eslint/eslint-plugin/dist/rules/strict-boolean-expressions.js
@@ -50,7 +50,7 @@ exports.default = (0, util_1.createRule)({
         hasSuggestions: true,
         messages: {
             conditionErrorAny: 'Unexpected any value in conditional. ' +
-                'An explicit comparison or type cast is required.',
+                'An explicit comparison or type conversion is required.',
             conditionErrorNullableBoolean: 'Unexpected nullable boolean value in conditional. ' +
                 'Ple,ase handle the nullish case explicitly.',
             conditionErrorNullableEnum: 'Unexpected nullable enum value in conditional. ' +
@@ -71,7 +71,7 @@ exports.default = (0, util_1.createRule)({
                 'A boolean expression is required.',
             conditionErrorString: 'Unexpected string value in conditional. ' +
                 'An explicit empty string check is required.',
-            conditionFixCastBoolean: 'Explicitly cast value to a boolean (`Boolean(value)`)',
+            conditionFixCastBoolean: 'Explicitly convert value to a boolean (`Boolean(value)`)',
             conditionFixCompareEmptyString: 'Change condition to check for empty string (`value !== ""`)',
             conditionFixCompareFalse: 'Change condition to check if false (`value === false`)',
             conditionFixCompareNaN: 'Change condition to check for NaN (`!Number.isNaN(value)`)',
diff --git node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.d.ts.map node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.d.ts.map
index df5afab269..a5398741e3 100644
--- node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.d.ts.map
+++ node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.d.ts.map
@@ -1 +1 @@
-{"version":3,"file":"ClassVisitor.d.ts","sourceRoot":"","sources":["../../src/referencer/ClassVisitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAIzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAI/C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,cAAM,YAAa,SAAQ,OAAO;;gBAK9B,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe;IAO5D,MAAM,CAAC,KAAK,CACV,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe,GACzD,IAAI;IAKP,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAanD,SAAS,CAAC,UAAU,CAClB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe,GACzD,IAAI;IAgCP,SAAS,CAAC,oCAAoC,CAC5C,IAAI,EAAE,QAAQ,CAAC,SAAS,GACvB,IAAI;IAaP,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAc5D,SAAS,CAAC,mBAAmB,CAC3B,IAAI,EAAE,QAAQ,CAAC,kBAAkB,EACjC,UAAU,EAAE,QAAQ,CAAC,gBAAgB,GACpC,IAAI;IA2GP,SAAS,CAAC,iBAAiB,CACzB,IAAI,EACA,QAAQ,CAAC,gBAAgB,GACzB,QAAQ,CAAC,kBAAkB,GAC3B,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,4BAA4B,GACxC,IAAI;IA4BP,SAAS,CAAC,uBAAuB,CAC/B,IAAI,EACA,QAAQ,CAAC,gBAAgB,GACzB,QAAQ,CAAC,kBAAkB,GAC3B,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,4BAA4B,GACxC,IAAI;IAWP,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAWjE,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAIjE,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI;IAMnD,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,GAAG,IAAI;IAIrD,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAIjE,SAAS,CAAC,iBAAiB,IAAI,IAAI;IAInC,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,kBAAkB,GAAG,IAAI;IAIrE,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,GAAG,IAAI;IAQvD,SAAS,CAAC,0BAA0B,CAClC,IAAI,EAAE,QAAQ,CAAC,0BAA0B,GACxC,IAAI;IAIP,SAAS,CAAC,0BAA0B,CAClC,IAAI,EAAE,QAAQ,CAAC,0BAA0B,GACxC,IAAI;IAIP,SAAS,CAAC,4BAA4B,CACpC,IAAI,EAAE,QAAQ,CAAC,4BAA4B,GAC1C,IAAI;IAIP,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;CAGlE;AAsCD,OAAO,EAAE,YAAY,EAAE,CAAC"}
\ No newline at end of file
+{"version":3,"file":"ClassVisitor.d.ts","sourceRoot":"","sources":["../../src/referencer/ClassVisitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAIzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAI/C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,cAAM,YAAa,SAAQ,OAAO;;gBAK9B,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe;IAO5D,MAAM,CAAC,KAAK,CACV,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe,GACzD,IAAI;IAKP,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAanD,SAAS,CAAC,UAAU,CAClB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe,GACzD,IAAI;IAgCP,SAAS,CAAC,oCAAo,C,CAC5C,IAAI,EAAE,QAAQ,CAAC,SAAS,GACvB,IAAI;IAaP,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAc5D,SAAS,CAAC,mBAAmB,CAC3B,IAAI,EAAE,QAAQ,CAAC,kBAAkB,EACjC,UAAU,EAAE,QAAQ,CAAC,gBAAgB,GACpC,IAAI;IA8GP,SAAS,CAAC,iBAAiB,CACzB,IAAI,EACA,QAAQ,CAAC,gBAAgB,GACzB,QAAQ,CAAC,kBAAkB,GAC3B,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,4BAA4B,GACxC,IAAI;IA4BP,SAAS,CAAC,uBAAuB,CAC/B,IAAI,EACA,QAAQ,CAAC,gBAAgB,GACzB,QAAQ,CAAC,kBAAkB,GAC3B,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,4BAA4B,GACxC,IAAI;IAWP,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAWjE,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAIjE,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI;IAMnD,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,GAAG,IAAI;IAIrD,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAIjE,SAAS,CAAC,iBAAiB,IAAI,IAAI;IAInC,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,kBAAkB,GAAG,IAAI;IAIrE,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,GAAG,IAAI;IAQvD,SAAS,CAAC,0BAA0B,CAClC,IAAI,EAAE,QAAQ,CAAC,0BAA0B,GACxC,IAAI;IAIP,SAAS,CAAC,0BAA0B,CAClC,IAAI,EAAE,QAAQ,CAAC,0BAA0B,GACxC,IAAI;IAIP,SAAS,CAAC,4BAA4B,CACpC,IAAI,EAAE,QAAQ,CAAC,4BAA4B,GAC1C,IAAI;IAIP,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;CAGlE;AAsCD,OAAO,EAAE,YAAY,EAAE,CAAC"}
\ No newline at end of file
diff --git node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.js node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.js
index 1384c5c0f1..b06ab79227 100644
--- node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.js
+++ node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.js
@@ -83,6 +83,9 @@ class ClassVisitor extends Visitor_1.Visitor {
             // FunctionExpressionNameScope.
             this.#referencer.scopeManager.nestFunctionExpressionNameScope(node);
         }
+        node.params.forEach(param => {
+            param.decorators.forEach(d => this.visit(d));
+        });
         // Consider this function is in the MethodDefinition.
         this.#referencer.scopeManager.nestFunctionScope(node, true);
         /**
@@ -149,7 +152,6 @@ class ClassVisitor extends Visitor_1.Visitor {
                 this.#referencer.referencingDefaultValue(pattern, info.assignments, null, true);
             }, { processRightHandNodes: true });
             this.visitFunctionParameterTypeAnnotation(param);
-            param.decorators.forEach(d => this.visit(d));
         }
         this.visitType(node.returnType);
         this.visitType(node.typeParameters);
diff --git node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager/package.json node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager/package.json
index d3a2d41a8f..2c49bda321 100644
--- node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager/package.json
+++ node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typescript-eslint/scope-manager",
-  "version": "8.18.0",
+  "version": "8.18.1",
   "description": "TypeScript scope analyser for ESLint",
   "files": [
     "dist",
@@ -46,13 +46,13 @@
     "typecheck": "npx nx typecheck"
   },
   "dependencies": {
-    "@typescript-eslint/types": "8.18.0",
-    "@typescript-eslint/visitor-keys": "8.18.0"
+    "@typescript-eslint/types": "8.18.1",
+    "@typescript-eslint/visitor-keys": "8.18.1"
   },
   "devDependencies": {
     "@jest/types": "29.6.3",
     "@types/glob": "*",
-    "@typescript-eslint/typescript-estree": "8.18.0",
+    "@typescript-eslint/typescript-estree": "8.18.1",
     "glob": "*",
     "jest-specific-snapshot": "*",
     "make-dir": "*",
diff --git node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/types/package.json node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/types/package.json
index 85a131b81b..9c2cbeee2b 100644
--- node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/types/package.json
+++ node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/types/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typescript-eslint/types",
-  "version": "8.18.0",
+  "version": "8.18.1",
   "description": "Types for the TypeScript-ESTree AST spec",
   "files": [
     "dist",
diff --git node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/typescript-estree/package.json node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/typescript-estree/package.json
index 96d8b2491f..40080b2878 100644
--- node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/typescript-estree/package.json
+++ node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/typescript-estree/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typescript-eslint/typescript-estree",
-  "version": "8.18.0",
+  "version": "8.18.1",
   "description": "A parser that converts TypeScript source code into an ESTree compatible form",
   "files": [
     "dist",
@@ -54,8 +54,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@typescript-eslint/types": "8.18.0",
-    "@typescript-eslint/visitor-keys": "8.18.0",
+    "@typescript-eslint/types": "8.18.1",
+    "@typescript-eslint/visitor-keys": "8.18.1",
     "debug": "^4.3.4",
     "fast-glob": "^3.3.2",
     "is-glob": "^4.0.3",
diff --git node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils/package.json node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils/package.json
index fdf32e9770..e328e5bace 100644
--- node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils/package.json
+++ node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typescript-eslint/utils",
-  "version": "8.18.0",
+  "version": "8.18.1",
   "description": "Utilities for working with TypeScript + ESLint together",
   "files": [
     "dist",
@@ -64,9 +64,9 @@
   },
   "dependencies": {
     "@eslint-community/eslint-utils": "^4.4.0",
-    "@typescript-eslint/scope-manager": "8.18.0",
-    "@typescript-eslint/types": "8.18.0",
-    "@typescript-eslint/typescript-estree": "8.18.0"
+    "@typescript-eslint/scope-manager": "8.18.1",
+    "@typescript-eslint/types": "8.18.1",
+    "@typescript-eslint/typescript-estree": "8.18.1"
   },
   "peerDependencies": {
     "eslint": "^8.57.0 || ^9.0.0",
diff --git node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/visitor-keys/package.json node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/visitor-keys/package.json
index b78c61c362..b10b4730e1 100644
--- node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/visitor-keys/package.json
+++ node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/visitor-keys/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typescript-eslint/visitor-keys",
-  "version": "8.18.0",
+  "version": "8.18.1",
   "description": "Visitor keys used to help traverse the TypeScript-ESTree AST",
   "files": [
     "dist",
@@ -47,7 +47,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@typescript-eslint/types": "8.18.0",
+    "@typescript-eslint/types": "8.18.1",
     "eslint-visitor-keys": "^4.2.0"
   },
   "devDependencies": {
diff --git node_modules/@typescript-eslint/eslint-plugin/package.json node_modules/@typescript-eslint/eslint-plugin/package.json
index e866c301b6..efce361339 100644
--- node_modules/@typescript-eslint/eslint-plugin/package.json
+++ node_modules/@typescript-eslint/eslint-plugin/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typescript-eslint/eslint-plugin",
-  "version": "8.18.0",
+  "version": "8.18.1",
   "description": "TypeScript plugin for ESLint",
   "files": [
     "dist",
@@ -61,10 +61,10 @@
   },
   "dependencies": {
     "@eslint-community/regexpp": "^4.10.0",
-    "@typescript-eslint/scope-manager": "8.18.0",
-    "@typescript-eslint/type-utils": "8.18.0",
-    "@typescript-eslint/utils": "8.18.0",
-    "@typescript-eslint/visitor-keys": "8.18.0",
+    "@typescript-eslint/scope-manager": "8.18.1",
+    "@typescript-eslint/type-utils": "8.18.1",
+    "@typescript-eslint/utils": "8.18.1",
+    "@typescript-eslint/visitor-keys": "8.18.1",
     "graphemer": "^1.4.0",
     "ignore": "^5.3.1",
     "natural-compare": "^1.4.0",
@@ -75,8 +75,8 @@
     "@types/marked": "^5.0.2",
     "@types/mdast": "^4.0.3",
     "@types/natural-compare": "*",
-    "@typescript-eslint/rule-schema-to-typescript-types": "8.18.0",
-    "@typescript-eslint/rule-tester": "8.18.0",
+    "@typescript-eslint/rule-schema-to-typescript-types": "8.18.1",
+    "@typescript-eslint/rule-tester": "8.18.1",
     "ajv": "^6.12.6",
     "cross-env": "^7.0.3",
     "cross-fetch": "*",
diff --git node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.d.ts.map node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.d.ts.map
index df5afab269..a5398741e3 100644
--- node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.d.ts.map
+++ node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.d.ts.map
@@ -1 +1 @@
-{"version":3,"file":"ClassVisitor.d.ts","sourceRoot":"","sources":["../../src/referencer/ClassVisitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAIzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAI/C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,cAAM,YAAa,SAAQ,OAAO;;gBAK9B,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe;IAO5D,MAAM,CAAC,KAAK,CACV,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe,GACzD,IAAI;IAKP,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAanD,SAAS,CAAC,UAAU,CAClB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe,GACzD,IAAI;IAgCP,SAAS,CAAC,oCAAoC,CAC5C,IAAI,EAAE,QAAQ,CAAC,SAAS,GACvB,IAAI;IAaP,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAc5D,SAAS,CAAC,mBAAmB,CAC3B,IAAI,EAAE,QAAQ,CAAC,kBAAkB,EACjC,UAAU,EAAE,QAAQ,CAAC,gBAAgB,GACpC,IAAI;IA2GP,SAAS,CAAC,iBAAiB,CACzB,IAAI,EACA,QAAQ,CAAC,gBAAgB,GACzB,QAAQ,CAAC,kBAAkB,GAC3B,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,4BAA4B,GACxC,IAAI;IA4BP,SAAS,CAAC,uBAAuB,CAC/B,IAAI,EACA,QAAQ,CAAC,gBAAgB,GACzB,QAAQ,CAAC,kBAAkB,GAC3B,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,4BAA4B,GACxC,IAAI;IAWP,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAWjE,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAIjE,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI;IAMnD,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,GAAG,IAAI;IAIrD,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAIjE,SAAS,CAAC,iBAAiB,IAAI,IAAI;IAInC,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,kBAAkB,GAAG,IAAI;IAIrE,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,GAAG,IAAI;IAQvD,SAAS,CAAC,0BAA0B,CAClC,IAAI,EAAE,QAAQ,CAAC,0BAA0B,GACxC,IAAI;IAIP,SAAS,CAAC,0BAA0B,CAClC,IAAI,EAAE,QAAQ,CAAC,0BAA0B,GACxC,IAAI;IAIP,SAAS,CAAC,4BAA4B,CACpC,IAAI,EAAE,QAAQ,CAAC,4BAA4B,GAC1C,IAAI;IAIP,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;CAGlE;AAsCD,OAAO,EAAE,YAAY,EAAE,CAAC"}
\ No newline at end of file
+{"version":3,"file":"ClassVisitor.d.ts","sourceRoot":"","sources":["../../src/referencer/ClassVisitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAIzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAI/C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,cAAM,YAAa,SAAQ,OAAO;;gBAK9B,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe;IAO5D,MAAM,CAAC,KAAK,CACV,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe,GACzD,IAAI;IAKP,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAanD,SAAS,CAAC,UAAU,CAClB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe,GACzD,IAAI;IAgCP,SAAS,CAAC,oCAAoC,CAC5C,IAAI,EAAE,QAAQ,CAAC,SAAS,GACvB,IAAI;IAaP,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAc5D,SAAS,CAAC,mBAAmB,CAC3B,IAAI,EAAE,QAAQ,CAAC,kBAAkB,EACjC,UAAU,EAAE,QAAQ,CAAC,gBAAgB,GACpC,IAAI;IA8GP,SAAS,CAAC,iBAAiB,CACzB,IAAI,EACA,QAAQ,CAAC,gBAAgB,GACzB,QAAQ,CAAC,kBAAkB,GAC3B,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,4BAA4B,GACxC,IAAI;IA4BP,SAAS,CAAC,uBAAuB,CAC/B,IAAI,EACA,QAAQ,CAAC,gBAAgB,GACzB,QAAQ,CAAC,kBAAkB,GAC3B,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,4BAA4B,GACxC,IAAI;IAWP,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAWjE,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAIjE,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI;IAMnD,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,GAAG,IAAI;IAIrD,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAIjE,SAAS,CAAC,iBAAiB,IAAI,IAAI;IAInC,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,kBAAkB,GAAG,IAAI;IAIrE,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,GAAG,IAAI;IAQvD,SAAS,CAAC,0BAA0B,CAClC,IAAI,EAAE,QAAQ,CAAC,0BAA0B,GACxC,IAAI;IAIP,SAAS,CAAC,0BAA0B,CAClC,IAAI,EAAE,QAAQ,CAAC,0BAA0B,GACxC,IAAI;IAIP,SAAS,CAAC,4BAA4B,CACpC,IAAI,EAAE,QAAQ,CAAC,4BAA4B,GAC1C,IAAI;IAIP,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;CAGlE;AAsCD,OAAO,EAAE,YAAY,EAAE,CAAC"}
\ No newline at end of file
diff --git node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.js node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.js
index 1384c5c0f1..b06ab79227 100644
--- node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.js
+++ node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.js
@@ -83,6 +83,9 @@ class ClassVisitor extends Visitor_1.Visitor {
             // FunctionExpressionNameScope.
             this.#referencer.scopeManager.nestFunctionExpressionNameScope(node);
         }
+        node.params.forEach(param => {
+            param.decorators.forEach(d => this.visit(d));
+        });
         // Consider this function is in the MethodDefinition.
         this.#referencer.scopeManager.nestFunctionScope(node, true);
         /**
@@ -149,7 +152,6 @@ class ClassVisitor extends Visitor_1.Visitor {
                 this.#referencer.referencingDefaultValue(pattern, info.assignments, null, true);
             }, { processRightHandNodes: true });
             this.visitFunctionParameterTypeAnnotation(param);
-            param.decorators.forEach(d => this.visit(d));
         }
         this.visitType(node.returnType);
         this.visitType(node.typeParameters);
diff --git node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager/package.json node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager/package.json
index d3a2d41a8f..2c49bda321 100644
--- node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager/package.json
+++ node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typescript-eslint/scope-manager",
-  "version": "8.18.0",
+  "version": "8.18.1",
   "description": "TypeScript scope analyser for ESLint",
   "files": [
     "dist",
@@ -46,13 +46,13 @@
     "typecheck": "npx nx typecheck"
   },
   "dependencies": {
-    "@typescript-eslint/types": "8.18.0",
-    "@typescript-eslint/visitor-keys": "8.18.0"
+    "@typescript-eslint/types": "8.18.1",
+    "@typescript-eslint/visitor-keys": "8.18.1"
   },
   "devDependencies": {
     "@jest/types": "29.6.3",
     "@types/glob": "*",
-    "@typescript-eslint/typescript-estree": "8.18.0",
+    "@typescript-eslint/typescript-estree": "8.18.1",
     "glob": "*",
     "jest-specific-snapshot": "*",
     "make-dir": "*",
diff --git node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/types/package.json node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/types/package.json
index 85a131b81b..9c2cbeee2b 100644
--- node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/types/package.json
+++ node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/types/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typescript-eslint/types",
-  "version": "8.18.0",
+  "version": "8.18.1",
   "description": "Types for the TypeScript-ESTree AST spec",
   "files": [
     "dist",
diff --git node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/typescript-estree/package.json node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/typescript-estree/package.json
index 96d8b2491f..40080b2878 100644
--- node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/typescript-estree/package.json
+++ node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/typescript-estree/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typescript-eslint/typescript-estree",
-  "version": "8.18.0",
+  "version": "8.18.1",
   "description": "A parser that converts TypeScript source code into an ESTree compatible form",
   "files": [
     "dist",
@@ -54,8 +54,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@typescript-eslint/types": "8.18.0",
-    "@typescript-eslint/visitor-keys": "8.18.0",
+    "@typescript-eslint/types": "8.18.1",
+    "@typescript-eslint/visitor-keys": "8.18.1",
     "debug": "^4.3.4",
     "fast-glob": "^3.3.2",
     "is-glob": "^4.0.3",
diff --git node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/visitor-keys/package.json node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/visitor-keys/package.json
index b78c61c362..b10b4730e1 100644
--- node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/visitor-keys/package.json
+++ node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/visitor-keys/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typescript-eslint/visitor-keys",
-  "version": "8.18.0",
+  "version": "8.18.1",
   "description": "Visitor keys used to help traverse the TypeScript-ESTree AST",
   "files": [
     "dist",
@@ -47,7 +47,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@typescript-eslint/types": "8.18.0",
+    "@typescript-eslint/types": "8.18.1",
     "eslint-visitor-keys": "^4.2.0"
   },
   "devDependencies": {
diff --git node_modules/@typescript-eslint/parser/package.json node_modules/@typescript-eslint/parser/package.json
index 2726668f12..73f1c49818 100644
--- node_modules/@typescript-eslint/parser/package.json
+++ node_modules/@typescript-eslint/parser/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typescript-eslint/parser",
-  "version": "8.18.0",
+  "version": "8.18.1",
   "description": "An ESLint custom parser which leverages TypeScript ESTree",
   "files": [
     "dist",
@@ -28,7 +28,7 @@
     "url": "https://github.com/typescript-eslint/typescript-eslint/issues"
   },
   "homepage": "https://typescript-eslint.io/packages/parser",
-  "license": "MITClause",
+  "license": "MIT",
   "keywords": [
     "ast",
     "ecmascript",
@@ -53,10 +53,10 @@
     "typescript": ">=4.8.4 <5.8.0"
   },
   "dependencies": {
-    "@typescript-eslint/scope-manager": "8.18.0",
-    "@typescript-eslint/types": "8.18.0",
-    "@typescript-eslint/typescript-estree": "8.18.0",
-    "@typescript-eslint/visitor-keys": "8.18.0",
+    "@typescript-eslint/scope-manager": "8.18.1",
+    "@typescript-eslint/types": "8.18.1",
+    "@typescript-eslint/typescript-estree": "8.18.1",
+    "@typescript-eslint/visitor-keys": "8.18.1",
     "debug": "^4.3.4"
   },
   "devDependencies": {
diff --git node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.d.ts.map node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.d.ts.map
index df5afab269..a5398741e3 100644
--- node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.d.ts.map
+++ node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.d.ts.map
@@ -1 +1 @@
-{"version":3,"file":"ClassVisitor.d.ts","sourceRoot":"","sources":["../../src/referencer/ClassVisitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAIzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAI/C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,cAAM,YAAa,SAAQ,OAAO;;gBAK9B,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe;IAO5D,MAAM,CAAC,KAAK,CACV,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe,GACzD,IAAI;IAKP,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAanD,SAAS,CAAC,UAAU,CAClB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe,GACzD,IAAI;IAgCP,SAAS,CAAC,oCAAoC,CAC5C,IAAI,EAAE,QAAQ,CAAC,SAAS,GACvB,IAAI;IAaP,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAc5D,SAAS,CAAC,mBAAmB,CAC3B,IAAI,EAAE,QAAQ,CAAC,kBAAkB,EACjC,UAAU,EAAE,QAAQ,CAAC,gBAAgB,GACpC,IAAI;IA2GP,SAAS,CAAC,iBAAiB,CACzB,IAAI,EACA,QAAQ,CAAC,gBAAgB,GACzB,QAAQ,CAAC,kBAAkB,GAC3B,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,4BAA4B,GACxC,IAAI;IA4BP,SAAS,CAAC,uBAAuB,CAC/B,IAAI,EACA,QAAQ,CAAC,gBAAgB,GACzB,QAAQ,CAAC,kBAAkB,GAC3B,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,4BAA4B,GACxC,IAAI;IAWP,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAWjE,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAIjE,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI;IAMnD,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,GAAG,IAAI;IAIrD,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAIjE,SAAS,CAAC,iBAAiB,IAAI,IAAI;IAInC,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,kBAAkB,GAAG,IAAI;IAIrE,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,GAAG,IAAI;IAQvD,SAAS,CAAC,0BAA0B,CAClC,IAAI,EAAE,QAAQ,CAAC,0BAA0B,GACxC,IAAI;IAIP,SAAS,CAAC,0BAA0B,CAClC,IAAI,EAAE,QAAQ,CAAC,0BAA0B,GACxC,IAAI;IAIP,SAAS,CAAC,4BAA4B,CACpC,IAAI,EAAE,QAAQ,CAAC,4BAA4B,GAC1C,IAAI;IAIP,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;CAGlE;AAsCD,OAAO,EAAE,YAAY,EAAE,CAAC"}
\ No newline at end of file
+{"version":3,"file":"ClassVisitor.d.ts","sourceRoot":"","sources":["../../src/referencer/ClassVisitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAIzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAI/C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,cAAM,YAAa,SAAQ,OAAO;;gBAK9B,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe;IAO5D,MAAM,CAAC,KAAK,CACV,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe,GACzD,IAAI;IAKP,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAanD,SAAS,CAAC,UAAU,CAClB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe,GACzD,IAAI;IAgCP,SAAS,CAAC,oCAAoC,CAC5C,IAAI,EAAE,QAAQ,CAAC,SAAS,GACvB,IAAI;IAaP,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAc5D,SAAS,CAAC,mBAAmB,CAC3B,IAAI,EAAE,QAAQ,CAAC,kBAAkB,EACjC,UAAU,EAAE,QAAQ,CAAC,gBAAgB,GACpC,IAAI;IA8GP,SAAS,CAAC,iBAAiB,CACzB,IAAI,EACA,QAAQ,CAAC,gBAAgB,GACzB,QAAQ,CAAC,kBAAkB,GAC3B,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,4BAA4B,GACxC,IAAI;IA4BP,SAAS,CAAC,uBAAuB,CAC/B,IAAI,EACA,QAAQ,CAAC,gBAAgB,GACzB,QAAQ,CAAC,kBAAkB,GAC3B,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,4BAA4B,GACxC,IAAI;IAWP,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAWjE,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAIjE,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI;IAMnD,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,GAAG,IAAI;IAIrD,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;IAIjE,SAAS,CAAC,iBAAiB,IAAI,IAAI;IAInC,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,kBAAkB,GAAG,IAAI;IAIrE,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,GAAG,IAAI;IAQvD,SAAS,CAAC,0BAA0B,CAClC,IAAI,EAAE,QAAQ,CAAC,0BAA0B,GACxC,IAAI;IAIP,SAAS,CAAC,0BAA0B,CAClC,IAAI,EAAE,QAAQ,CAAC,0BAA0B,GACxC,IAAI;IAIP,SAAS,CAAC,4BAA4B,CACpC,IAAI,EAAE,QAAQ,CAAC,4BAA4B,GAC1C,IAAI;IAIP,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,GAAG,IAAI;CAGlE;AAsCD,OAAO,EAAE,YAAY,EAAE,CAAC"}
\ No newline at end of file
diff --git node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.js node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.js
index 1384c5c0f1..b06ab79227 100644
--- node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.js
+++ node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/scope-manager/dist/referencer/ClassVisitor.js
@@ -83,6 +83,9 @@ class ClassVisitor extends Visitor_1.Visitor {
             // FunctionExpressionNameScope.
             this.#referencer.scopeManager.nestFunctionExpressionNameScope(node);
         }
+        node.params.forEach(param => {
+            param.decorators.forEach(d => this.visit(d));
+        });
         // Consider this function is in the MethodDefinition.
         this.#referencer.scopeManager.nestFunctionScope(node, true);
         /**
@@ -149,7 +152,6 @@ class ClassVisitor extends Visitor_1.Visitor {
                 this.#referencer.referencingDefaultValue(pattern, info.assignments, null, true);
             }, { processRightHandNodes: true });
             this.visitFunctionParameterTypeAnnotation(param);
-            param.decorators.forEach(d => this.visit(d));
         }
         this.visitType(node.returnType);
         this.visitType(node.typeParameters);
diff --git node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/scope-manager/package.json node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/scope-manager/package.json
index d3a2d41a8f..2c49bda321 100644
--- node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/scope-manager/package.json
+++ node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/scope-manager/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typescript-eslint/scope-manager",
-  "version": "8.18.0",
+  "version": "8.18.1",
   "description": "TypeScript scope analyser for ESLint",
   "files": [
     "dist",
@@ -46,13 +46,13 @@
     "typecheck": "npx nx typecheck"
   },
   "dependencies": {
-    "@typescript-eslint/types": "8.18.0",
-    "@typescript-eslint/visitor-keys": "8.18.0"
+    "@typescript-eslint/types": "8.18.1",
+    "@typescript-eslint/visitor-keys": "8.18.1"
   },
   "devDependencies": {
     "@jest/types": "29.6.3",
     "@types/glob": "*",
-    "@typescript-eslint/typescript-estree": "8.18.0",
+    "@typescript-eslint/typescript-estree": "8.18.1",
     "glob": "*",
     "jest-specific-snapshot": "*",
     "make-dir": "*",
diff --git node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/types/package.json node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/types/package.json
index 85a131b81b..9c2cbeee2b 100644
--- node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/types/package.json
+++ node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/types/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typescript-eslint/types",
-  "version": "8.18.0",
+  "version": "8.18.1",
   "description": "Types for the TypeScript-ESTree AST spec",
   "files": [
     "dist",
diff --git node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/typescript-estree/package.json node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/typescript-estree/package.json
index 96d8b2491f..40080b2878 100644
--- node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/typescript-estree/package.json
+++ node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/typescript-estree/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typescript-eslint/typescript-estree",
-  "version": "8.18.0",
+  "version": "8.18.1",
   "description": "A parser that converts TypeScript source code into an ESTree compatible form",
   "files": [
     "dist",
@@ -54,8 +54,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@typescript-eslint/types": "8.18.0",
-    "@typescript-eslint/visitor-keys": "8.18.0",
+    "@typescript-eslint/types": "8.18.1",
+    "@typescript-eslint/visitor-keys": "8.18.1",
     "debug": "^4.3.4",
     "fast-glob": "^3.3.2",
     "is-glob": "^4.0.3",
diff --git node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/utils/package.json node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/utils/package.json
index fdf32e9770..e328e5bace 100644
--- node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/utils/package.json
+++ node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/utils/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typescript-eslint/utils",
-  "version": "8.18.0",
+  "version": "8.18.1",
   "description": "Utilities for working with TypeScript + ESLint together",
   "files": [
     "dist",
@@ -64,9 +64,9 @@
   },
   "dependencies": {
     "@eslint-community/eslint-utils": "^4.4.0",
-    "@typescript-eslint/scope-manager": "8.18.0",
-    "@typescript-eslint/types": "8.18.0",
-    "@typescript-eslint/typescript-estree": "8.18.0"
+    "@typescript-eslint/scope-manager": "8.18.1",
+    "@typescript-eslint/types": "8.18.1",
+    "@typescript-eslint/typescript-estree": "8.18.1"
   },
   "peerDependencies": {
     "eslint": "^8.57.0 || ^9.0.0",
diff --git node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/visitor-keys/package.json node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/visitor-keys/package.json
index b78c61c362..b10b4730e1 100644
--- node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/visitor-keys/package.json
+++ node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/visitor-keys/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typescript-eslint/visitor-keys",
-  "version": "8.18.0",
+  "version": "8.18.1",
   "description": "Visitor keys used to help traverse the TypeScript-ESTree AST",
   "files": [
     "dist",
@@ -47,7 +47,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@typescript-eslint/types": "8.18.0",
+    "@typescript-eslint/types": "8.18.1",
     "eslint-visitor-keys": "^4.2.0"
   },
   "devDependencies": {
diff --git node_modules/@typescript-eslint/type-utils/package.json node_modules/@typescript-eslint/type-utils/package.json
index c46b5b9421..5e9c84f4fb 100644
--- node_modules/@typescript-eslint/type-utils/package.json
+++ node_modules/@typescript-eslint/type-utils/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typescript-eslint/type-utils",
-  "version": "8.18.0",
+  "version": "8.18.1",
   "description": "Type utilities for working with TypeScript + ESLint together",
   "files": [
     "dist",
@@ -46,8 +46,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@typescript-eslint/typescript-estree": "8.18.0",
-    "@typescript-eslint/utils": "8.18.0",
+    "@typescript-eslint/typescript-estree": "8.18.1",
+    "@typescript-eslint/utils": "8.18.1",
     "debug": "^4.3.4",
     "ts-api-utils": "^1.3.0"
   },
@@ -57,7 +57,7 @@
   },
   "devDependencies": {
     "@jest/types": "29.6.3",
-    "@typescript-eslint/parser": "8.18.0",
+    "@typescript-eslint/parser": "8.18.1",
     "ajv": "^6.12.6",
     "downlevel-dts": "*",
     "jest": "29.7.0",
diff --git package.json package.json
index 362e7e605b..4085e2244b 100644
--- package.json
+++ package.json
@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "3.27.9",
+  "version": "3.28.0",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
@@ -32,7 +32,6 @@
     "@actions/http-client": "^2.2.3",
     "@actions/io": "^1.1.3",
     "@actions/tool-cache": "^2.0.1",
-    "@chrisgavin/safe-which": "^1.0.2",
     "@octokit/plugin-retry": "^5.0.2",
     "@octokit/types": "^13.6.2",
     "@schemastore/package": "0.0.10",
@@ -63,7 +62,7 @@
     "@ava/typescript": "4.1.0",
     "@eslint/compat": "^1.1.1",
     "@eslint/eslintrc": "^3.2.0",
-    "@eslint/js": "^9.16.0",
+    "@eslint/js": "^9.17.0",
     "@microsoft/eslint-formatter-sarif": "^3.1.0",
     "@types/adm-zip": "^0.5.7",
     "@types/console-log-level": "^1.4.5",
@@ -73,8 +72,8 @@
     "@types/node": "20.9.0",
     "@types/semver": "^7.5.8",
     "@types/sinon": "^17.0.3",
-    "@typescript-eslint/eslint-plugin": "^8.18.0",
-    "@typescript-eslint/parser": "^8.18.0",
+    "@typescript-eslint/eslint-plugin": "^8.18.1",
+    "@typescript-eslint/parser": "^8.18.1",
     "ava": "^5.3.1",
     "eslint": "^8.57.1",
     "eslint-import-resolver-typescript": "^3.7.0",
diff --git a/pr-checks/.gitignore b/pr-checks/.gitignore
new file mode 100644
index 0000000000..0a764a4de3
--- /dev/null
+++ pr-checks/.gitignore
@@ -0,0 +1 @@
+env
diff --git pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml
index 39966b52cd..0638262bfe 100644
--- pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml
+++ pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml
@@ -3,7 +3,7 @@ description: "Checks that we emit a diagnostic if Go is changed after the init s
 # only Linux is affected
 operatingSystems: ["ubuntu"]
 # pinned to a version which does not support statically linked binaries for indirect tracing
-versions: ["stable-v2.14.6"]
+versions: ["default"]
 steps:
   - uses: actions/setup-go@v5
     with:
diff --git pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml
index 8f90bbde57..e7e6ee9a0a 100644
--- pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml
+++ pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml
@@ -3,7 +3,7 @@ description: "Checks that we emit a diagnostic if the `file` program is not inst
 # only Linux is affected
 operatingSystems: ["ubuntu"]
 # pinned to a version which does not support statically linked binaries for indirect tracing
-versions: ["stable-v2.14.6"]
+versions: ["default"]
 steps:
   - uses: actions/setup-go@v5
     with:
diff --git pr-checks/checks/go-indirect-tracing-workaround.yml pr-checks/checks/go-indirect-tracing-workaround.yml
index 14dfb39985..fff42da97a 100644
--- pr-checks/checks/go-indirect-tracing-workaround.yml
+++ pr-checks/checks/go-indirect-tracing-workaround.yml
@@ -3,7 +3,7 @@ description: "Checks that our workaround for indirect tracing for Go 1.21+ on Li
 # only Linux is affected
 operatingSystems: ["ubuntu"]
 # pinned to a version which does not support statically linked binaries for indirect tracing
-versions: ["stable-v2.14.6"]
+versions: ["default"]
 steps:
   - uses: actions/setup-go@v5
     with:
diff --git pr-checks/checks/multi-language-autodetect.yml pr-checks/checks/multi-language-autodetect.yml
index 1bb2ad4258..24049fb723 100644
--- pr-checks/checks/multi-language-autodetect.yml
+++ pr-checks/checks/multi-language-autodetect.yml
@@ -10,13 +10,11 @@ steps:
     id: init
     with:
       db-location: "${{ runner.temp }}/customDbLocation"
-      # Swift is not supported on Ubuntu or codeql 2.14 so we manually exclude it from the list here
-      languages: ${{ (runner.os == 'Linux' || (runner.os == 'macOS' && matrix.version == 'stable-v2.14.6')) && 'cpp,csharp,go,java,javascript,python,ruby' || '' }}
+      languages: ${{ runner.os == 'Linux' && 'cpp,csharp,go,java,javascript,python,ruby' || '' }}
       tools: ${{ steps.prepare-test.outputs.tools-url }}
 
   - uses: ./../action/.github/actions/setup-swift
-    # Exclude macos on v2.14.6 since we can not longer run swift on ARM runners
-    if: runner.os == 'macOS' && matrix.version != 'stable-v2.14.6'
+    if: runner.os == 'macOS'
     with:
       codeql-path: ${{ steps.init.outputs.codeql-path }}
 
@@ -69,8 +67,7 @@ steps:
       fi
 
   - name: Check language autodetect for Swift on macOS
-    # Exclude macos on v2.14.6 since we can not longer run swift on ARM runners
-    if: runner.os == 'macOS' && matrix.version != 'stable-v2.14.6'
+    if: runner.os == 'macOS'
     shell: bash
     run: |
       SWIFT_DB=${{ fromJson(steps.analysis.outputs.db-locations).swift }}
diff --git a/pr-checks/checks/start-proxy.yml b/pr-checks/checks/start-proxy.yml
new file mode 100644
index 0000000000..b918b7a63f
--- /dev/null
+++ pr-checks/checks/start-proxy.yml
@@ -0,0 +1,25 @@
+name: "Start proxy"
+description: "Tests that the proxy can be initialised on all platforms"
+operatingSystems: ["ubuntu", "macos", "windows"]
+versions: ["linked"]
+steps:
+  - uses: ./../action/init
+    with:
+      languages: csharp
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+  - name: Setup proxy for registries
+    id: proxy
+    uses: ./../action/start-proxy
+    with:
+      registry_secrets: '[{ "type": "nuget_feed", "url": "https://api.nuget.org/v3/index.json" }]'
+
+  - name: Print proxy outputs
+    run: |
+      echo "${{ steps.proxy.outputs.proxy_host }}"
+      echo "${{ steps.proxy.outputs.proxy_port }}"
+      echo "${{ steps.proxy.outputs.proxy_urls }}"
+
+  - name: Fail if proxy outputs are not set
+    if: (!steps.proxy.outputs.proxy_host) || (!steps.proxy.outputs.proxy_port) || (!steps.proxy.outputs.proxy_ca_certificate) || (!steps.proxy.outputs.proxy_urls)
+    run: exit 1
diff --git pr-checks/sync.py pr-checks/sync.py
index 7b3a194352..d16ae4551d 100755
--- pr-checks/sync.py
+++ pr-checks/sync.py
@@ -9,8 +9,6 @@
 # The default set of CodeQL Bundle versions to use for the PR checks.
 defaultTestVersions = [
     # The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
-    "stable-v2.14.6",
-    # The last CodeQL release in the 2.15 series.
     "stable-v2.15.5",
     # The last CodeQL release in the 2.16 series.
     "stable-v2.16.6",
@@ -18,6 +16,8 @@
     "stable-v2.17.6",
     # The last CodeQL release in the 2.18 series.
     "stable-v2.18.4",
+    # The last CodeQL release in the 2.19 series.
+    "stable-v2.19.4",
     # The default version of CodeQL for Dotcom, as determined by feature flags.
     "default",
     # The version of CodeQL shipped with the Action in `defaults.json`. During the release process
diff --git queries/binary-planting.ql queries/binary-planting.ql
index aca6f1acca..952d0372e9 100644
--- queries/binary-planting.ql
+++ queries/binary-planting.ql
@@ -10,8 +10,8 @@ import javascript
 import DataFlow
 import DataFlow::PathGraph
 
-class SafeWhichBarrierGuardNode extends DataFlow::BarrierGuardNode, DataFlow::InvokeNode {
-  SafeWhichBarrierGuardNode() { getCalleeName() = "safeWhich" }
+class WhichBarrierGuardNode extends DataFlow::BarrierGuardNode, DataFlow::InvokeNode {
+  WhichBarrierGuardNode() { getCalleeName() = "which" }
 
   override predicate blocks(boolean outcome, Expr e) {
     outcome = true and
@@ -36,7 +36,7 @@ class BinaryPlantingConfiguration extends DataFlow::Configuration {
   }
 
   override predicate isBarrierGuard(DataFlow::BarrierGuardNode guard) {
-    guard instanceof SafeWhichBarrierGuardNode
+    guard instanceof WhichBarrierGuardNode
   }
 }
 
diff --git src/actions-util.ts src/actions-util.ts
index 4fe56e98cd..cd4e163f3f 100644
--- src/actions-util.ts
+++ src/actions-util.ts
@@ -3,7 +3,7 @@ import * as path from "path";
 
 import * as core from "@actions/core";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
-import * as safeWhich from "@chrisgavin/safe-which";
+import * as io from "@actions/io";
 import { JSONSchemaForNPMPackageJsonFiles } from "@schemastore/package";
 
 import type { Config } from "./config-utils";
@@ -209,7 +209,7 @@ export const getFileType = async (filePath: string): Promise<string> => {
   let fileCmdPath: string;
 
   try {
-    fileCmdPath = await safeWhich.safeWhich("file");
+    fileCmdPath = await io.which("file", true);
   } catch (e) {
     throw new FileCmdNotFoundError(
       `The \`file\` program is required, but does not appear to be installed. Please install it: ${e}`,
diff --git src/analyze.ts src/analyze.ts
index fa67211fa2..7e82df4a56 100644
--- src/analyze.ts
+++ src/analyze.ts
@@ -2,7 +2,7 @@ import * as fs from "fs";
 import * as path from "path";
 import { performance } from "perf_hooks";
 
-import { safeWhich } from "@chrisgavin/safe-which";
+import * as io from "@actions/io";
 import del from "del";
 import * as yaml from "js-yaml";
 
@@ -660,7 +660,7 @@ export async function warnIfGoInstalledAfterInit(
     process.env[EnvVar.DID_AUTOBUILD_GOLANG] !== "true" &&
     goInitPath !== undefined
   ) {
-    const goBinaryPath = await safeWhich("go");
+    const goBinaryPath = await io.which("go", true);
 
     if (goInitPath !== goBinaryPath) {
       logger.warning(
diff --git src/codeql.test.ts src/codeql.test.ts
index 90bd2d6cb4..e239f34e5c 100644
--- src/codeql.test.ts
+++ src/codeql.test.ts
@@ -2,8 +2,8 @@ import * as fs from "fs";
 
 import { ExecOptions } from "@actions/exec";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
+import * as io from "@actions/io";
 import * as toolcache from "@actions/tool-cache";
-import * as safeWhich from "@chrisgavin/safe-which";
 import test, { ExecutionContext } from "ava";
 import del from "del";
 import * as yaml from "js-yaml";
@@ -819,8 +819,8 @@ for (const {
     const runnerConstructorStub = stubToolRunnerConstructor();
     const codeqlObject = await codeql.getCodeQLForTesting();
     sinon.stub(codeqlObject, "getVersion").resolves(codeqlVersion);
-    // safeWhich throws because of the test CodeQL object.
-    sinon.stub(safeWhich, "safeWhich").resolves("");
+    // io throws because of the test CodeQL object.
+    sinon.stub(io, "which").resolves("");
     await codeqlObject.databaseInterpretResults(
       "",
       [],
@@ -860,8 +860,8 @@ test("runTool summarizes several fatal errors", async (t) => {
   stubToolRunnerConstructor(32, cliStderr);
   const codeqlObject = await codeql.getCodeQLForTesting();
   sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.17.6"));
-  // safeWhich throws because of the test CodeQL object.
-  sinon.stub(safeWhich, "safeWhich").resolves("");
+  // io throws because of the test CodeQL object.
+  sinon.stub(io, "which").resolves("");
 
   await t.throwsAsync(
     async () =>
@@ -902,8 +902,8 @@ test("runTool summarizes autobuilder errors", async (t) => {
   const codeqlObject = await codeql.getCodeQLForTesting();
   sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.17.6"));
   sinon.stub(codeqlObject, "resolveExtractor").resolves("/path/to/extractor");
-  // safeWhich throws because of the test CodeQL object.
-  sinon.stub(safeWhich, "safeWhich").resolves("");
+  // io throws because of the test CodeQL object.
+  sinon.stub(io, "which").resolves("");
 
   await t.throwsAsync(
     async () => await codeqlObject.runAutobuild(stubConfig, Language.java),
@@ -929,8 +929,8 @@ test("runTool truncates long autobuilder errors", async (t) => {
   const codeqlObject = await codeql.getCodeQLForTesting();
   sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.17.6"));
   sinon.stub(codeqlObject, "resolveExtractor").resolves("/path/to/extractor");
-  // safeWhich throws because of the test CodeQL object.
-  sinon.stub(safeWhich, "safeWhich").resolves("");
+  // io throws because of the test CodeQL object.
+  sinon.stub(io, "which").resolves("");
 
   await t.throwsAsync(
     async () => await codeqlObject.runAutobuild(stubConfig, Language.java),
@@ -957,8 +957,8 @@ test("runTool recognizes fatal internal errors", async (t) => {
   const codeqlObject = await codeql.getCodeQLForTesting();
   sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.17.6"));
   sinon.stub(codeqlObject, "resolveExtractor").resolves("/path/to/extractor");
-  // safeWhich throws because of the test CodeQL object.
-  sinon.stub(safeWhich, "safeWhich").resolves("");
+  // io throws because of the test CodeQL object.
+  sinon.stub(io, "which").resolves("");
 
   await t.throwsAsync(
     async () =>
@@ -977,8 +977,8 @@ test("runTool outputs last line of stderr if fatal error could not be found", as
   stubToolRunnerConstructor(32, cliStderr);
   const codeqlObject = await codeql.getCodeQLForTesting();
   sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.17.6"));
-  // safeWhich throws because of the test CodeQL object.
-  sinon.stub(safeWhich, "safeWhich").resolves("");
+  // io throws because of the test CodeQL object.
+  sinon.stub(io, "which").resolves("");
 
   await t.throwsAsync(
     async () =>
@@ -1002,8 +1002,8 @@ test("Avoids duplicating --overwrite flag if specified in CODEQL_ACTION_EXTRA_OP
   const runnerConstructorStub = stubToolRunnerConstructor();
   const codeqlObject = await codeql.getCodeQLForTesting();
   sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.17.6"));
-  // safeWhich throws because of the test CodeQL object.
-  sinon.stub(safeWhich, "safeWhich").resolves("");
+  // io throws because of the test CodeQL object.
+  sinon.stub(io, "which").resolves("");
 
   process.env["CODEQL_ACTION_EXTRA_OPTIONS"] =
     '{ "database": { "init": ["--overwrite"] } }';
diff --git src/codeql.ts src/codeql.ts
index 486c2d637a..492654dd7a 100644
--- src/codeql.ts
+++ src/codeql.ts
@@ -276,22 +276,22 @@ let cachedCodeQL: CodeQL | undefined = undefined;
  * The version flags below can be used to conditionally enable certain features
  * on versions newer than this.
  */
-const CODEQL_MINIMUM_VERSION = "2.14.6";
+const CODEQL_MINIMUM_VERSION = "2.15.5";
 
 /**
  * This version will shortly become the oldest version of CodeQL that the Action will run with.
  */
-const CODEQL_NEXT_MINIMUM_VERSION = "2.14.6";
+const CODEQL_NEXT_MINIMUM_VERSION = "2.15.5";
 
 /**
  * This is the version of GHES that was most recently deprecated.
  */
-const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.10";
+const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.11";
 
 /**
  * This is the deprecation date for the version of GHES that was most recently deprecated.
  */
-const GHES_MOST_RECENT_DEPRECATION_DATE = "2024-09-24";
+const GHES_MOST_RECENT_DEPRECATION_DATE = "2024-12-19";
 
 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
diff --git src/git-utils.ts src/git-utils.ts
index 55cb0994b1..2669cd9150 100644
--- src/git-utils.ts
+++ src/git-utils.ts
@@ -1,6 +1,6 @@
 import * as core from "@actions/core";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
-import * as safeWhich from "@chrisgavin/safe-which";
+import * as io from "@actions/io";
 
 import {
   getOptionalInput,
@@ -18,7 +18,7 @@ async function runGitCommand(
   let stderr = "";
   core.debug(`Running git command: git ${args.join(" ")}`);
   try {
-    await new toolrunner.ToolRunner(await safeWhich.safeWhich("git"), args, {
+    await new toolrunner.ToolRunner(await io.which("git", true), args, {
       silent: true,
       listeners: {
         stdout: (data) => {
diff --git src/init-action.ts src/init-action.ts
index 614155d209..f733681854 100644
--- src/init-action.ts
+++ src/init-action.ts
@@ -2,7 +2,7 @@ import * as fs from "fs";
 import * as path from "path";
 
 import * as core from "@actions/core";
-import { safeWhich } from "@chrisgavin/safe-which";
+import * as io from "@actions/io";
 import { v4 as uuidV4 } from "uuid";
 
 import {
@@ -445,7 +445,7 @@ async function run() {
       process.platform === "linux"
     ) {
       try {
-        const goBinaryPath = await safeWhich("go");
+        const goBinaryPath = await io.which("go", true);
         const fileOutput = await getFileType(goBinaryPath);
 
         // Go 1.21 and above ships with statically linked binaries on Linux. CodeQL cannot currently trace custom builds
diff --git src/init.ts src/init.ts
index 859e91c2d2..c0e2a20bd2 100644
--- src/init.ts
+++ src/init.ts
@@ -2,7 +2,7 @@ import * as fs from "fs";
 import * as path from "path";
 
 import * as toolrunner from "@actions/exec/lib/toolrunner";
-import * as safeWhich from "@chrisgavin/safe-which";
+import * as io from "@actions/io";
 
 import { getOptionalInput, isSelfHostedRunner } from "./actions-util";
 import { GitHubApiCombinedDetails, GitHubApiDetails } from "./api-client";
@@ -150,7 +150,7 @@ export async function checkInstallPython311(
       "../python-setup",
       "check_python12.ps1",
     );
-    await new toolrunner.ToolRunner(await safeWhich.safeWhich("powershell"), [
+    await new toolrunner.ToolRunner(await io.which("powershell", true), [
       script,
     ]).exec();
   }
diff --git src/start-proxy-action.ts src/start-proxy-action.ts
index a0213c26ad..71c8888b94 100644
--- src/start-proxy-action.ts
+++ src/start-proxy-action.ts
@@ -171,6 +171,11 @@ async function startProxy(
     core.setOutput("proxy_host", host);
     core.setOutput("proxy_port", port.toString());
     core.setOutput("proxy_ca_certificate", config.ca.cert);
+
+    const registry_urls = config.all_credentials
+      .filter((credential) => credential.url !== undefined)
+      .map((credential) => credential.url);
+    core.setOutput("proxy_urls", JSON.stringify(registry_urls));
   } catch (error) {
     core.setFailed(`start-proxy action failed: ${util.getErrorMessage(error)}`);
   }
diff --git src/tar.ts src/tar.ts
index 93bcab202c..3f9dcec6a2 100644
--- src/tar.ts
+++ src/tar.ts
@@ -3,8 +3,8 @@ import * as fs from "fs";
 import * as stream from "stream";
 
 import { ToolRunner } from "@actions/exec/lib/toolrunner";
+import * as io from "@actions/io";
 import * as toolcache from "@actions/tool-cache";
-import { safeWhich } from "@chrisgavin/safe-which";
 
 import { CommandInvocationError } from "./actions-util";
 import { Logger } from "./logging";
@@ -19,7 +19,7 @@ export type TarVersion = {
 };
 
 async function getTarVersion(): Promise<TarVersion> {
-  const tar = await safeWhich("tar");
+  const tar = await io.which("tar", true);
   let stdout = "";
   const exitCode = await new ToolRunner(tar, ["--version"], {
     listeners: {
diff --git src/util.ts src/util.ts
index 2ed17a4ab4..3672797399 100644
--- src/util.ts
+++ src/util.ts
@@ -5,7 +5,7 @@ import { promisify } from "util";
 
 import * as core from "@actions/core";
 import * as exec from "@actions/exec/lib/exec";
-import { safeWhich } from "@chrisgavin/safe-which";
+import * as io from "@actions/io";
 import checkDiskSpace from "check-disk-space";
 import del from "del";
 import getFolderSize from "get-folder-size";
@@ -1194,7 +1194,7 @@ export async function isBinaryAccessible(
   logger: Logger,
 ): Promise<boolean> {
   try {
-    await safeWhich(binary);
+    await io.which(binary, true);
     logger.debug(`Found ${binary}.`);
     return true;
   } catch (e) {
diff --git start-proxy/action.yml start-proxy/action.yml
index dc783df80f..2cd800b096 100644
--- start-proxy/action.yml
+++ start-proxy/action.yml
@@ -23,6 +23,8 @@ outputs:
     description: The port of the proxy
   proxy_ca_certificate:
     description: The proxy's internal CA certificate in PEM format
+  proxy_urls:
+    description: The URLs of the configured registries, as a JSON array.
 runs:
   using: node20
   main: "../lib/start-proxy-action.js"

Description

This PR updates the CodeQL Action, raising the minimum supported CodeQL version to 2.15.5 and making several other changes to improve functionality and compatibility. The changes include updating dependencies, modifying workflows, and adjusting code to use io.which instead of safeWhich.

Changes

Changes

  1. .github/workflows:

    • Updated several workflow files to use newer CodeQL versions and remove references to older versions.
    • Added a new workflow file __start-proxy.yml to test proxy initialization on all platforms.

  2. CHANGELOG.md:

    • Added entry for version 3.28.0, noting the minimum CodeQL bundle version bump and other changes.

  3. README.md:

    • Updated supported versions information, removing mention of CodeQL Action v2 for GHES 3.11.

  4. lib/actions-util.js, lib/analyze.js, lib/codeql.js, lib/git-utils.js, lib/init-action.js, lib/init.js, lib/tar.js, lib/util.js:

    • Replaced safeWhich with io.which for finding executables.

  5. package.json:

    • Updated version to 3.28.0.
    • Removed @chrisgavin/safe-which dependency.
    • Updated various dev dependencies.

  6. pr-checks:

    • Modified version checks and added a new check for proxy initialization.

  7. queries/binary-planting.ql:

    • Updated to use which instead of safeWhich.

  8. src files:

    • Updated TypeScript source files to use io.which instead of safeWhich.
    • Modified version constants and deprecation dates in codeql.ts.

  9. start-proxy/action.yml:

    • Added a new output proxy_urls for configured registry URLs.
sequenceDiagram
    participant User
    participant CodeQLAction
    participant CodeQLCLI
    participant Proxy

    User->>CodeQLAction: Run CodeQL analysis
    CodeQLAction->>CodeQLCLI: Initialize with new minimum version (2.15.5)
    CodeQLCLI-->>CodeQLAction: Initialization complete
    CodeQLAction->>Proxy: Start proxy (if needed)
    Proxy-->>CodeQLAction: Proxy started, return details
    CodeQLAction->>CodeQLCLI: Run analysis
    CodeQLCLI-->>CodeQLAction: Analysis results
    CodeQLAction-->>User: Return analysis results
Loading

Security Hotspots

  1. The removal of @chrisgavin/safe-which and its replacement with io.which could potentially introduce security risks if io.which doesn't provide the same level of protection against binary planting attacks. This change should be carefully reviewed to ensure it doesn't introduce vulnerabilities.

Possible Issues

  1. The minimum supported CodeQL version bump might break compatibility with some older systems or workflows. Users should be clearly informed about this change and its potential impact.

  2. The removal of support for CodeQL Action v2 on GHES 3.11 might affect users who haven't yet upgraded. A clear migration path and communication should be provided.

@renovate renovate bot merged commit 3eb8248 into master Jan 1, 2025
8 checks passed
@renovate renovate bot deleted the renovate/github-codeql-action-3.x branch January 1, 2025 03:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@renovate-approve renovate-approve[bot] renovate-approve[bot] approved these changes

Assignees
No one assigned
Labels
dependencies puLL-Merge renovate
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants