📢 upcoming v3 deprecation, v4 now released 📢 #3271

Activity

1. mario-campos

   pinned this issue on Nov 3, 2025
2. brian-welsh commented on Nov 14, 2025

   

   brian-welsh

   on Nov 14, 2025

   Last edited by brian-welsh

   More actions

   depreciation message states v3 will be depreciated December 2026. However, it generates and error breaking all scanning using v3

    C:\hostedtoolcache\windows\CodeQL\2.23.5\x64\codeql\codeql.exe database finalize --finalize-dataset --threads=2 --ram=6655 D:\a\_temp\codeql_databases\javascript
     CodeQL detected code written in C# and GitHub Actions, but not any written in JavaScript/TypeScript. Confirm that there is some source code for JavaScript/TypeScript in the project. For more information, review our troubleshooting guide at https://gh.io/troubleshooting-code-scanning/no-source-code-seen-during-build .
     Error: Encountered a fatal error while running "C:\hostedtoolcache\windows\CodeQL\2.23.5\x64\codeql\codeql.exe database finalize --finalize-dataset --threads=2 --ram=6655 D:\a\_temp\codeql_databases\javascript". Exit code was 32 and last log line was: CodeQL detected code written in C# and GitHub Actions, but not any written in JavaScript/TypeScript. Confirm that there is some source code for JavaScript/TypeScript in the project. For more information, review our troubleshooting guide at https://gh.io/troubleshooting-code-scanning/no-source-code-seen-during-build . See the logs for more details.
   

   Issue: #3297
3. mbg commented on Nov 14, 2025

   

   mbg

   on Nov 14, 2025

   Member

   More actions

   @brian-welsh I have responded in the issue you created/linked.
4. ulgens commented on Nov 15, 2025

   

   ulgens

   on Nov 15, 2025

   Last edited by ulgens

   More actions

   I'm not sure where to report this but it seems GitHub itself is still using v3. Our codeql logs start with

   Error: CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/

   This is coming from the embedded CodeQL check, we are not doing anything custom.

   👍React with 👍1Reacted by Alexander Lindeskär
5. mbg commented on Nov 15, 2025

   

   mbg

   on Nov 15, 2025

   Member

   More actions

   Hi @ulgens,

   Thanks -- we are aware and in the process of updating the Default Setup workflow to use v4. Obviously this will be done in good time before v3 is deprecated and there's nothing you need to do there.

   We wanted to get the deprecation message out as soon as possible to give everyone with custom workflows as much notice as possible to make the change.

   😕React with 😕3Reacted by Ülgen Sarıkavak, Alexander Lindeskär and Christian Nicolai
6. ulgens commented on Nov 15, 2025

   

   ulgens

   on Nov 15, 2025

   Last edited by ulgens

   More actions

   @mbg Thank you, but I'm still confused. If it's too early even for GitHub to use v4, why is there even a deprecation warning? I do understand the concern you shared, but I'm not sure it creates the result you intend. Seeing a deprecation warning for an internal tool that we have no control over feels weird and problematic.

   👍React with 👍2Reacted by Alexander Lindeskär and Christian Nicolai
7. mbg commented on Nov 16, 2025

   

   mbg

   on Nov 16, 2025

   Member

   More actions

   If it's too early even for GitHub to use v4, why is there even a deprecation warning?

   In general, the purpose of a deprecation message is to give as much notice of a forthcoming deprecation as possible, to allow everyone to plan for it and take whatever steps are necessary to migrate to the new version.

   It's not too early to use v4 of the CodeQL Action, if you are currently using v3 and are able to upgrade.

   Seeing a deprecation warning for an internal tool that we have no control over feels weird and problematic.

   Thank you for this feedback and I understand your point, but the message is purely informative and has no effect on the outcomes, results, or behaviours of the workflows. There is some value in having this message, even for Default Setup. For example, you may have a combination of Default Setup and Advanced Setup configurations for CodeQL and displaying the message in logs for both helps raise awareness. Furthermore, if you have configured restrictions for which Actions or which versions of Actions are allowed to be used in your organisation, then that may need to be updated to allow v4 even if you are only using Default Setup.

   Like I said, we are in the process of getting the Default Setup workflow upgraded to v4 and I would hope that this will ship in the coming week. The message will disappear from those workflows then.

   👍React with 👍2Reacted by Ülgen Sarıkavak and dms1981

   😕React with 😕1Reacted by Alexander Lindeskär
8. jrmatherly

   added a commit that references this issue on Jan 12, 2026

   ci(github-action): upgrade CodeQL from v3.31.9 to v4.31.10

   ...

   8e2fcc3
9. InRiPa

   added a commit that references this issue on Jul 31, 2026

   chore: upgrade CodeQL Action to v4 and checkout to v7

   ...

   79f9264