ci: bump github/codeql-action from 4.37.8 to 4.37.9

[dependabot]

Bumps github/codeql-action from 4.37.8 to 4.37.9.

Release notes

Sourced from github/codeql-action's releases.

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

Changelog

Sourced from github/codeql-action's changelog.

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

Commits

• cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
• 7243f38 Update changelog for v4.37.9
• 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
• ecfa6e1 Add changelog note
• adcdf4a Update default bundle to codeql-bundle-v2.26.4
• 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
• 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
• ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
• 4605e03 Rebuild
• 099c869 Update changelog and version after v4.37.8
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[helebest]

Code Review

Change: Bumps github/codeql-action from 4.37.8 to 4.37.9 in .github/workflows/codeql.yml (both the init and analyze steps). This is a CI/tooling-only change — no application code is touched.

• Consistency: PR description matches the diff exactly — a single-file, version-string-only change (v4.37.8 → v4.37.9) in both places the action is referenced.
• Correctness: Both usages are bumped together, so init and analyze stay on matching versions. No logic changes introduced.
• Conventions: Consistent with the existing convention in this repo of pinning GitHub Actions to a version tag (not a SHA). No change to that convention.
• Security: Per the upstream changelog, 4.37.9 only updates the default CodeQL bundle to 2.26.4 — no breaking changes or security advisories called out. This is a routine bundle-version refresh from GitHub's own CodeQL Action, not a third-party dependency of unusual risk.
• Effectiveness: Achieves its stated purpose of keeping codeql-action current.
• Test coverage: N/A — a version-string bump in a workflow file has no corresponding unit tests; nothing to add here.

Note: the earlier automated comment about the ci label is a pre-existing dependabot.yml configuration issue (missing label), unrelated to this PR's content.

No issues found. Proceeding to regression verification.

---

Generated by Claude Code

[helebest]

Regression Verification

Checked out the PR branch (e6e5220) locally and ran the full workspace suite:

• uv lock --locked — lockfile in sync, no drift
• uv sync --all-packages --all-extras — clean install
• uv run ruff check . — all checks passed
• uv run mypy packages/*/src — no issues found in 14 source files
• uv run pytest -v --ignore=tests/packaging — 107 passed
• uv run pytest tests/packaging -v — 27 passed

No regressions. As expected for a workflow-only version bump, none of these results changed relative to main. Proceeding to CI monitoring.

---

Generated by Claude Code

[helebest]

CI Monitoring

All required checks completed successfully on e6e5220:

Check	Result
test (3.12)	✅ success
test (3.13)	✅ success
analyze (build smoke / packaging)	✅ success
CodeQL	✅ success

No failures to investigate. Proceeding to squash merge.

---

Generated by Claude Code

[helebest]

Merge

All steps (code review, regression verification, CI monitoring) passed. Squash-merged as 9c9b3fd.

---

Generated by Claude Code