Use browser_download_url instead of url

CHANGELOG.md

@@ -6,6 +6,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 - We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the `codeql-action/init` step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the `codeql-action/init` step. [#3099](https://github.com/github/codeql-action/pull/3099) and [#3100](https://github.com/github/codeql-action/pull/3100)
 - We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. [#3107](https://github.com/github/codeql-action/pull/3107)
+- Update default CodeQL bundle version to 2.23.1. [#3118](https://github.com/github/codeql-action/pull/3118)
 
 ## 3.30.3 - 10 Sep 2025
 

lib/analyze-action.js

@@ -90579,8 +90579,8 @@ var path8 = __toESM(require("path"));
 var semver3 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.0";
+var bundleVersion = "codeql-bundle-v2.23.1";
-var cliVersion = "2.23.0";
+var cliVersion = "2.23.1";
 
 // src/overlay-database-utils.ts
 var crypto = __toESM(require("crypto"));

lib/autobuild-action.js

@@ -78248,8 +78248,8 @@ var path3 = __toESM(require("path"));
 var semver3 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.0";
+var bundleVersion = "codeql-bundle-v2.23.1";
-var cliVersion = "2.23.0";
+var cliVersion = "2.23.1";
 
 // src/overlay-database-utils.ts
 var fs2 = __toESM(require("fs"));

lib/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.23.0",
+  "bundleVersion": "codeql-bundle-v2.23.1",
-  "cliVersion": "2.23.0",
+  "cliVersion": "2.23.1",
-  "priorBundleVersion": "codeql-bundle-v2.22.4",
+  "priorBundleVersion": "codeql-bundle-v2.23.0",
-  "priorCliVersion": "2.22.4"
+  "priorCliVersion": "2.23.0"
 }

lib/init-action-post.js

@@ -128785,8 +128785,8 @@ var path8 = __toESM(require("path"));
 var semver3 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.0";
+var bundleVersion = "codeql-bundle-v2.23.1";
-var cliVersion = "2.23.0";
+var cliVersion = "2.23.1";
 
 // src/overlay-database-utils.ts
 var fs6 = __toESM(require("fs"));

lib/init-action.js

@@ -86207,8 +86207,8 @@ var path8 = __toESM(require("path"));
 var semver3 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.0";
+var bundleVersion = "codeql-bundle-v2.23.1";
-var cliVersion = "2.23.0";
+var cliVersion = "2.23.1";
 
 // src/overlay-database-utils.ts
 var crypto = __toESM(require("crypto"));

lib/start-proxy-action.js

@@ -49393,8 +49393,8 @@ function getApiClient() {
 }
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.0";
+var bundleVersion = "codeql-bundle-v2.23.1";
-var cliVersion = "2.23.0";
+var cliVersion = "2.23.1";
 
 // src/languages.ts
 var KnownLanguage = /* @__PURE__ */ ((KnownLanguage2) => {
@@ -49528,10 +49528,10 @@ async function getDownloadUrl(logger) {
     for (const asset of cliRelease.data.assets) {
       if (asset.name === proxyPackage) {
         logger.info(
-          `Found '${proxyPackage}' in release '${bundleVersion}' at '${asset.url}'`
+          `Found '${proxyPackage}' in release '${bundleVersion}' at '${asset.browser_download_url}'`
         );
         return {
-          url: asset.url,
+          url: asset.browser_download_url,
           // The `update-job-proxy` doesn't have a version as such. Since we now bundle it
           // with CodeQL CLI bundle releases, we use the corresponding CLI version to
           // differentiate between (potentially) different versions of `update-job-proxy`.

lib/upload-lib.js

@@ -88894,8 +88894,8 @@ var path8 = __toESM(require("path"));
 var semver3 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.0";
+var bundleVersion = "codeql-bundle-v2.23.1";
-var cliVersion = "2.23.0";
+var cliVersion = "2.23.1";
 
 // src/overlay-database-utils.ts
 var fs5 = __toESM(require("fs"));

lib/upload-sarif-action.js

@@ -88885,8 +88885,8 @@ var path8 = __toESM(require("path"));
 var semver3 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.0";
+var bundleVersion = "codeql-bundle-v2.23.1";
-var cliVersion = "2.23.0";
+var cliVersion = "2.23.1";
 
 // src/overlay-database-utils.ts
 var fs5 = __toESM(require("fs"));

src/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.23.0",
+  "bundleVersion": "codeql-bundle-v2.23.1",
-  "cliVersion": "2.23.0",
+  "cliVersion": "2.23.1",
-  "priorBundleVersion": "codeql-bundle-v2.22.4",
+  "priorBundleVersion": "codeql-bundle-v2.23.0",
-  "priorCliVersion": "2.22.4"
+  "priorCliVersion": "2.23.0"
 }

src/start-proxy.test.ts

@@ -255,8 +255,11 @@ test("getDownloadUrl returns fallback when there's no matching release asset", a
 
 test("getDownloadUrl returns matching release asset", async (t) => {
   const assets = [
-    { name: "foo", url: "other-url" },
+    { name: "foo", browser_download_url: "other-url" },
-    { name: startProxyExports.getProxyPackage(), url: "url-we-want" },
+    {
+      name: startProxyExports.getProxyPackage(),
+      browser_download_url: "url-we-want",
+    },
   ];
   mockGetReleaseByTag(assets);
 

src/start-proxy.ts

@@ -231,10 +231,10 @@ export async function getDownloadUrl(
     for (const asset of cliRelease.data.assets) {
       if (asset.name === proxyPackage) {
         logger.info(
-          `Found '${proxyPackage}' in release '${defaults.bundleVersion}' at '${asset.url}'`,
+          `Found '${proxyPackage}' in release '${defaults.bundleVersion}' at '${asset.browser_download_url}'`,
         );
         return {
-          url: asset.url,
+          url: asset.browser_download_url,
           // The `update-job-proxy` doesn't have a version as such. Since we now bundle it
           // with CodeQL CLI bundle releases, we use the corresponding CLI version to
           // differentiate between (potentially) different versions of `update-job-proxy`.