From de303a9db5f6c95afba6ef555829f5e6f14599d6 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 17 Apr 2026 00:32:32 +0000
Subject: [PATCH 1/3] Update supported GitHub Enterprise Server versions

---
 lib/analyze-action-post.js        | 2 +-
 lib/autobuild-action.js           | 2 +-
 lib/init-action-post.js           | 2 +-
 lib/init-action.js                | 2 +-
 lib/resolve-environment-action.js | 2 +-
 lib/setup-codeql-action.js        | 2 +-
 lib/start-proxy-action-post.js    | 2 +-
 lib/upload-sarif-action-post.js   | 2 +-
 src/api-compatibility.json        | 2 +-
 9 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/lib/analyze-action-post.js b/lib/analyze-action-post.js
index aa04634147..78954afbec 100644
--- a/lib/analyze-action-post.js
+++ b/lib/analyze-action-post.js
@@ -161660,7 +161660,7 @@ var semver = __toESM(require_semver2());
 
 // src/api-compatibility.json
 var maximumVersion = "3.21";
-var minimumVersion = "3.14";
+var minimumVersion = "3.16";
 
 // src/json/index.ts
 function isObject2(value) {
diff --git a/lib/autobuild-action.js b/lib/autobuild-action.js
index a1b0a32553..379911bd52 100644
--- a/lib/autobuild-action.js
+++ b/lib/autobuild-action.js
@@ -103552,7 +103552,7 @@ var semver = __toESM(require_semver2());
 
 // src/api-compatibility.json
 var maximumVersion = "3.21";
-var minimumVersion = "3.14";
+var minimumVersion = "3.16";
 
 // src/json/index.ts
 function isObject2(value) {
diff --git a/lib/init-action-post.js b/lib/init-action-post.js
index 3f44bd4d33..2e065ac6b1 100644
--- a/lib/init-action-post.js
+++ b/lib/init-action-post.js
@@ -164557,7 +164557,7 @@ var semver = __toESM(require_semver2());
 
 // src/api-compatibility.json
 var maximumVersion = "3.21";
-var minimumVersion = "3.14";
+var minimumVersion = "3.16";
 
 // src/json/index.ts
 function isObject2(value) {
diff --git a/lib/init-action.js b/lib/init-action.js
index a3c7ab96bb..1970c12791 100644
--- a/lib/init-action.js
+++ b/lib/init-action.js
@@ -103760,7 +103760,7 @@ var semver = __toESM(require_semver2());
 
 // src/api-compatibility.json
 var maximumVersion = "3.21";
-var minimumVersion = "3.14";
+var minimumVersion = "3.16";
 
 // src/json/index.ts
 function isObject2(value) {
diff --git a/lib/resolve-environment-action.js b/lib/resolve-environment-action.js
index 02342c09bc..5fa8073dd4 100644
--- a/lib/resolve-environment-action.js
+++ b/lib/resolve-environment-action.js
@@ -103552,7 +103552,7 @@ var semver = __toESM(require_semver2());
 
 // src/api-compatibility.json
 var maximumVersion = "3.21";
-var minimumVersion = "3.14";
+var minimumVersion = "3.16";
 
 // src/json/index.ts
 function isObject2(value) {
diff --git a/lib/setup-codeql-action.js b/lib/setup-codeql-action.js
index 64e6a317c4..636a142b80 100644
--- a/lib/setup-codeql-action.js
+++ b/lib/setup-codeql-action.js
@@ -103597,7 +103597,7 @@ var semver = __toESM(require_semver2());
 
 // src/api-compatibility.json
 var maximumVersion = "3.21";
-var minimumVersion = "3.14";
+var minimumVersion = "3.16";
 
 // src/json/index.ts
 function isObject2(value) {
diff --git a/lib/start-proxy-action-post.js b/lib/start-proxy-action-post.js
index 00a390c1fc..11e1e8a973 100644
--- a/lib/start-proxy-action-post.js
+++ b/lib/start-proxy-action-post.js
@@ -161656,7 +161656,7 @@ var semver = __toESM(require_semver2());
 
 // src/api-compatibility.json
 var maximumVersion = "3.21";
-var minimumVersion = "3.14";
+var minimumVersion = "3.16";
 
 // src/json/index.ts
 function isObject2(value) {
diff --git a/lib/upload-sarif-action-post.js b/lib/upload-sarif-action-post.js
index 00baeb3605..9f2fd24ebb 100644
--- a/lib/upload-sarif-action-post.js
+++ b/lib/upload-sarif-action-post.js
@@ -161656,7 +161656,7 @@ var semver = __toESM(require_semver2());
 
 // src/api-compatibility.json
 var maximumVersion = "3.21";
-var minimumVersion = "3.14";
+var minimumVersion = "3.16";
 
 // src/json/index.ts
 function isObject2(value) {
diff --git a/src/api-compatibility.json b/src/api-compatibility.json
index 2e55b9ad7d..2cded5e4cf 100644
--- a/src/api-compatibility.json
+++ b/src/api-compatibility.json
@@ -1 +1 @@
-{"maximumVersion": "3.21", "minimumVersion": "3.14"}
+{"maximumVersion": "3.21", "minimumVersion": "3.16"}

From 97be3af35ac37441d1b6361481ce99f353df02c2 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Tue, 28 Apr 2026 15:32:55 +0100
Subject: [PATCH 2/3] Deprecate CodeQL versions 2.19.3 and earlier

---
 CHANGELOG.md                      | 1 +
 lib/analyze-action-post.js        | 6 +++---
 lib/analyze-action.js             | 6 +++---
 lib/autobuild-action.js           | 6 +++---
 lib/init-action-post.js           | 6 +++---
 lib/init-action.js                | 6 +++---
 lib/resolve-environment-action.js | 6 +++---
 lib/setup-codeql-action.js        | 6 +++---
 lib/upload-lib.js                 | 6 +++---
 lib/upload-sarif-action.js        | 6 +++---
 src/codeql.ts                     | 6 +++---
 11 files changed, 31 insertions(+), 30 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ff4e2d3bf7..7bca7fa9dd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 ## [UNRELEASED]
 
 - Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. [#3852](https://github.com/github/codeql-action/pull/3852)
+- _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. [#3837](https://github.com/github/codeql-action/pull/3837)
 
 ## 4.35.2 - 15 Apr 2026
 
diff --git a/lib/analyze-action-post.js b/lib/analyze-action-post.js
index 78954afbec..e09612b2c4 100644
--- a/lib/analyze-action-post.js
+++ b/lib/analyze-action-post.js
@@ -163010,9 +163010,9 @@ async function shouldEnableIndirectTracing(codeql, config) {
 // src/codeql.ts
 var cachedCodeQL = void 0;
 var CODEQL_MINIMUM_VERSION = "2.17.6";
-var CODEQL_NEXT_MINIMUM_VERSION = "2.17.6";
-var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.13";
-var GHES_MOST_RECENT_DEPRECATION_DATE = "2025-06-19";
+var CODEQL_NEXT_MINIMUM_VERSION = "2.19.4";
+var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.15";
+var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-04-09";
 var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 async function getCodeQL(cmd) {
   if (cachedCodeQL === void 0) {
diff --git a/lib/analyze-action.js b/lib/analyze-action.js
index 750a0e52de..372021fc29 100644
--- a/lib/analyze-action.js
+++ b/lib/analyze-action.js
@@ -110045,9 +110045,9 @@ async function endTracingForCluster(codeql, config, logger) {
 // src/codeql.ts
 var cachedCodeQL = void 0;
 var CODEQL_MINIMUM_VERSION = "2.17.6";
-var CODEQL_NEXT_MINIMUM_VERSION = "2.17.6";
-var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.13";
-var GHES_MOST_RECENT_DEPRECATION_DATE = "2025-06-19";
+var CODEQL_NEXT_MINIMUM_VERSION = "2.19.4";
+var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.15";
+var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-04-09";
 var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, features, logger, checkVersion) {
   try {
diff --git a/lib/autobuild-action.js b/lib/autobuild-action.js
index 379911bd52..6825745a32 100644
--- a/lib/autobuild-action.js
+++ b/lib/autobuild-action.js
@@ -105422,9 +105422,9 @@ async function endTracingForCluster(codeql, config, logger) {
 // src/codeql.ts
 var cachedCodeQL = void 0;
 var CODEQL_MINIMUM_VERSION = "2.17.6";
-var CODEQL_NEXT_MINIMUM_VERSION = "2.17.6";
-var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.13";
-var GHES_MOST_RECENT_DEPRECATION_DATE = "2025-06-19";
+var CODEQL_NEXT_MINIMUM_VERSION = "2.19.4";
+var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.15";
+var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-04-09";
 var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 async function getCodeQL(cmd) {
   if (cachedCodeQL === void 0) {
diff --git a/lib/init-action-post.js b/lib/init-action-post.js
index 2e065ac6b1..e8dc72e0b5 100644
--- a/lib/init-action-post.js
+++ b/lib/init-action-post.js
@@ -167857,9 +167857,9 @@ async function shouldEnableIndirectTracing(codeql, config) {
 // src/codeql.ts
 var cachedCodeQL = void 0;
 var CODEQL_MINIMUM_VERSION = "2.17.6";
-var CODEQL_NEXT_MINIMUM_VERSION = "2.17.6";
-var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.13";
-var GHES_MOST_RECENT_DEPRECATION_DATE = "2025-06-19";
+var CODEQL_NEXT_MINIMUM_VERSION = "2.19.4";
+var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.15";
+var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-04-09";
 var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, features, logger, checkVersion) {
   try {
diff --git a/lib/init-action.js b/lib/init-action.js
index 1970c12791..d0b0a8b61c 100644
--- a/lib/init-action.js
+++ b/lib/init-action.js
@@ -108975,9 +108975,9 @@ async function getCombinedTracerConfig(codeql, config) {
 // src/codeql.ts
 var cachedCodeQL = void 0;
 var CODEQL_MINIMUM_VERSION = "2.17.6";
-var CODEQL_NEXT_MINIMUM_VERSION = "2.17.6";
-var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.13";
-var GHES_MOST_RECENT_DEPRECATION_DATE = "2025-06-19";
+var CODEQL_NEXT_MINIMUM_VERSION = "2.19.4";
+var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.15";
+var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-04-09";
 var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, features, logger, checkVersion) {
   try {
diff --git a/lib/resolve-environment-action.js b/lib/resolve-environment-action.js
index 5fa8073dd4..87def4ccd3 100644
--- a/lib/resolve-environment-action.js
+++ b/lib/resolve-environment-action.js
@@ -105059,9 +105059,9 @@ async function shouldEnableIndirectTracing(codeql, config) {
 // src/codeql.ts
 var cachedCodeQL = void 0;
 var CODEQL_MINIMUM_VERSION = "2.17.6";
-var CODEQL_NEXT_MINIMUM_VERSION = "2.17.6";
-var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.13";
-var GHES_MOST_RECENT_DEPRECATION_DATE = "2025-06-19";
+var CODEQL_NEXT_MINIMUM_VERSION = "2.19.4";
+var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.15";
+var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-04-09";
 var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 async function getCodeQL(cmd) {
   if (cachedCodeQL === void 0) {
diff --git a/lib/setup-codeql-action.js b/lib/setup-codeql-action.js
index 636a142b80..a2699cb273 100644
--- a/lib/setup-codeql-action.js
+++ b/lib/setup-codeql-action.js
@@ -106468,9 +106468,9 @@ async function shouldEnableIndirectTracing(codeql, config) {
 // src/codeql.ts
 var cachedCodeQL = void 0;
 var CODEQL_MINIMUM_VERSION = "2.17.6";
-var CODEQL_NEXT_MINIMUM_VERSION = "2.17.6";
-var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.13";
-var GHES_MOST_RECENT_DEPRECATION_DATE = "2025-06-19";
+var CODEQL_NEXT_MINIMUM_VERSION = "2.19.4";
+var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.15";
+var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-04-09";
 var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, features, logger, checkVersion) {
   try {
diff --git a/lib/upload-lib.js b/lib/upload-lib.js
index 4bd41931bd..0d9ffc35e3 100644
--- a/lib/upload-lib.js
+++ b/lib/upload-lib.js
@@ -109154,9 +109154,9 @@ async function shouldEnableIndirectTracing(codeql, config) {
 // src/codeql.ts
 var cachedCodeQL = void 0;
 var CODEQL_MINIMUM_VERSION = "2.17.6";
-var CODEQL_NEXT_MINIMUM_VERSION = "2.17.6";
-var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.13";
-var GHES_MOST_RECENT_DEPRECATION_DATE = "2025-06-19";
+var CODEQL_NEXT_MINIMUM_VERSION = "2.19.4";
+var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.15";
+var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-04-09";
 var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, features, logger, checkVersion) {
   try {
diff --git a/lib/upload-sarif-action.js b/lib/upload-sarif-action.js
index e6ca76b230..02f6c1fb3f 100644
--- a/lib/upload-sarif-action.js
+++ b/lib/upload-sarif-action.js
@@ -109820,9 +109820,9 @@ async function shouldEnableIndirectTracing(codeql, config) {
 // src/codeql.ts
 var cachedCodeQL = void 0;
 var CODEQL_MINIMUM_VERSION = "2.17.6";
-var CODEQL_NEXT_MINIMUM_VERSION = "2.17.6";
-var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.13";
-var GHES_MOST_RECENT_DEPRECATION_DATE = "2025-06-19";
+var CODEQL_NEXT_MINIMUM_VERSION = "2.19.4";
+var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.15";
+var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-04-09";
 var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, features, logger, checkVersion) {
   try {
diff --git a/src/codeql.ts b/src/codeql.ts
index fda355033a..ecad2ea199 100644
--- a/src/codeql.ts
+++ b/src/codeql.ts
@@ -282,17 +282,17 @@ const CODEQL_MINIMUM_VERSION = "2.17.6";
 /**
  * This version will shortly become the oldest version of CodeQL that the Action will run with.
  */
-const CODEQL_NEXT_MINIMUM_VERSION = "2.17.6";
+const CODEQL_NEXT_MINIMUM_VERSION = "2.19.4";
 
 /**
  * This is the version of GHES that was most recently deprecated.
  */
-const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.13";
+const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.15";
 
 /**
  * This is the deprecation date for the version of GHES that was most recently deprecated.
  */
-const GHES_MOST_RECENT_DEPRECATION_DATE = "2025-06-19";
+const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-04-09";
 
 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";

From 0a636086c932e088ee3a3cbfc20fc728a58d5bd6 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Tue, 28 Apr 2026 15:08:54 +0100
Subject: [PATCH 3/3] Add GHES 3.21 to supported versions table

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 35b50c6a32..bee9072a07 100644
--- a/README.md
+++ b/README.md
@@ -72,6 +72,7 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n
 
 | Minimum CodeQL Action | Minimum CodeQL Bundle Version | GitHub Environment | Notes |
 |-----------------------|-------------------------------|--------------------|-------|
+| `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
 | `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
 | `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
 | `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |