From 1e47b7c581d47b5ca1bf945a7ed5515a01920177 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 1 Sep 2026 21:48:35 +0000 Subject: [PATCH 1/2] chore: bump github/codeql-action from 4.37.3 to 4.37.8 Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.37.3 to 4.37.8. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v4.37.3...v4.37.8) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.37.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 72859bcfa..1d1239552 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -79,7 +79,7 @@ jobs: # be retargeted, so init/analyze below are intentionally left pinned to the tag, not a SHA. # See https://github.com/github/codeql-action/releases/tag/v4.37.3 - name: Initialize CodeQL - uses: github/codeql-action/init@v4.37.3 + uses: github/codeql-action/init@v4.37.8 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -109,6 +109,6 @@ jobs: # See the immutable-release note above (github/codeql-action) — same tag, same rationale. - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.37.3 + uses: github/codeql-action/analyze@v4.37.8 with: category: "/language:${{matrix.language}}" From 8f7c0712465aa142859b09cc5a158706e33d0939 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 2 Sep 2026 06:45:54 +0000 Subject: [PATCH 2/2] docs(codeql): update immutable release reference Co-authored-by: sgalkin <1095546+sgalkin@users.noreply.github.com> --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1d1239552..fe2d53e1d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -75,9 +75,9 @@ jobs: # Initializes the CodeQL tools for scanning. # github/codeql-action publishes immutable GitHub releases (verified via the GitHub API: - # "immutable": true on GET /repos/github/codeql-action/releases/tags/v4.37.3). The tag cannot + # "immutable": true on GET /repos/github/codeql-action/releases/tags/v4.37.8). The tag cannot # be retargeted, so init/analyze below are intentionally left pinned to the tag, not a SHA. - # See https://github.com/github/codeql-action/releases/tag/v4.37.3 + # See https://github.com/github/codeql-action/releases/tag/v4.37.8 - name: Initialize CodeQL uses: github/codeql-action/init@v4.37.8 with: