build(deps): bump the codeql-action group with 2 updates

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps the codeql-action group with 2 updates: github/codeql-action/init and github/codeql-action/analyze.

Updates github/codeql-action/init from 4.37.6 to 4.37.7

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

... (truncated)

Commits

• ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
• 951a133 Update changelog for v4.37.7
• be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
• 9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
• b4d8a54 Rebuild
• ab5db25 Bump the npm-minor group across 1 directory with 8 updates
• 38055a3 Drop logger from databaseInitCluster in interface
• 1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
• dc1b98a Make logger available to getCodeQLForCmd
• 6f0220e Merge pull request #4084 from github/navntoft/bump-undici
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.6 to 4.37.7

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

... (truncated)

Commits

• ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
• 951a133 Update changelog for v4.37.7
• be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
• 9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
• b4d8a54 Rebuild
• ab5db25 Bump the npm-minor group across 1 directory with 8 updates
• 38055a3 Drop logger from databaseInitCluster in interface
• 1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
• dc1b98a Make logger available to getCodeQLForCmd
• 6f0220e Merge pull request #4084 from github/navntoft/bump-undici
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 21, 2026, 3:27 AM ET / 07:27 UTC.

ClawSweeper review

What this changes

Updates both pinned CodeQL GitHub Actions in the security-analysis workflow from v4.37.6 to v4.37.7.

Merge readiness

⚠️ Ready for maintainer review - 3 items remain

Keep open for normal merge review: the branch is a narrow, immutable-pin update that follows the repository’s established lockstep CodeQL policy, while current main still uses v4.37.6. No patch defect was found; wait for the pending CodeQL and test workflows before merging.

Priority: P3
Reviewed head: 3ae5321b9dc3844482e62c87d95c1b4f17924f68

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A small, correctly grouped immutable-pin update with normal workflow validation still pending.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot workflow-maintenance PR does not require contributor real-behavior proof; the pending CodeQL run is the direct validation surface.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot workflow-maintenance PR does not require contributor real-behavior proof; the pending CodeQL run is the direct validation surface.
Evidence reviewed	5 items	Exact workflow diff: The PR changes only the two CodeQL action pins; both retain matching immutable 40-character revisions and the v4.37.7 annotation. Configured dependency grouping: Dependabot is configured to group all github/codeql-action/* updates, so updating init and analyze together matches repository policy. Feature-history provenance: The workflow’s lockstep update policy appears to date to the commit titled “fix(ci): keep CodeQL action updates in lockstep.”.
Findings	None	None.
Security	None	None.

How this fits together

The CodeQL workflow runs on pull requests, main pushes, and a schedule to analyze the Go source and upload security findings to GitHub. This change updates the two upstream actions that initialize and complete that analysis.

flowchart LR
  A[Pull request or schedule] --> B[CodeQL workflow]
  B --> C[Checkout and Go setup]
  C --> D[Initialize CodeQL]
  D --> E[Analyze Go source]
  E --> F[GitHub code scanning results]

Loading

Before merge

• Resolve merge risk (P1) - The updated external action will continue to run with the workflow’s existing security-events write permission; its immutable SHA pin limits revision drift, but the upstream source was not locally inspected.
• Resolve merge risk (P1) - CodeQL, test, and Windows test checks were still in progress in the supplied PR state.
• Complete next step (P2) - No repair lane is needed: this PR needs ordinary workflow completion and maintainer merge review.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
CodeQL action pins	2 changed, 0 added, 0 removed	Both workflow stages move together to the same immutable v4.37.7 revision.

Merge-risk options

Maintainer options:

1. Wait for the updated scan (recommended)
   Merge once the PR’s CodeQL run completes successfully, confirming the new paired action revision still uploads analysis results.

Technical review

Best possible solution:

Merge after the CodeQL, test, and Windows workflows succeed, preserving the paired immutable action pins.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a workflow dependency update rather than a reported product bug. The relevant verification is a successful CodeQL workflow run on this PR head.

Is this the best way to solve the issue?

Yes. The configured Dependabot group and prior lockstep-policy commit support updating init and analyze together at the same immutable upstream revision.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 1ae588d4fad5.

Labels

Label changes:

• add P3: This is a small routine CI dependency update with no application behavior change.
• add merge-risk: 🚨 security-boundary: The changed CodeQL actions execute in a workflow granted security-events write permission.
• add merge-risk: 🚨 automation: The patch directly changes the repository’s automated security-analysis workflow.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot workflow-maintenance PR does not require contributor real-behavior proof; the pending CodeQL run is the direct validation surface.

Label justifications:

• P3: This is a small routine CI dependency update with no application behavior change.
• merge-risk: 🚨 security-boundary: The changed CodeQL actions execute in a workflow granted security-events write permission.
• merge-risk: 🚨 automation: The patch directly changes the repository’s automated security-analysis workflow.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot workflow-maintenance PR does not require contributor real-behavior proof; the pending CodeQL run is the direct validation surface.

Evidence

What I checked:

• Exact workflow diff: The PR changes only the two CodeQL action pins; both retain matching immutable 40-character revisions and the v4.37.7 annotation. (.github/workflows/codeql.yml:25, 3ae5321b9dc3)
• Configured dependency grouping: Dependabot is configured to group all github/codeql-action/* updates, so updating init and analyze together matches repository policy. (.github/dependabot.yml:12, 3ae5321b9dc3)
• Feature-history provenance: The workflow’s lockstep update policy appears to date to the commit titled “fix(ci): keep CodeQL action updates in lockstep.”. (.github/workflows/codeql.yml:25, 06bb3ae46d21)
• Current main remains behind this update: The main-base workflow still pins both actions to v4.37.6, so the central requested update is not already implemented. (.github/workflows/codeql.yml:25, 1ae588d4fad5)
• Structured review limitation: The bundled autoreview helper could not construct a review bundle because this shallow checkout has no merge base for the provided base SHA; the exact two-line manual diff was reviewed instead. (3ae5321b9dc3)

Likely related people:

• Peter Steinberger: Authored the commit establishing the CodeQL actions’ lockstep update policy and is the most direct human history signal for this workflow. (role: workflow policy author; confidence: high; commits: 06bb3ae46d21, 00a94648f6f2; files: .github/workflows/codeql.yml, .github/dependabot.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Wait for the CodeQL, test, and Windows test checks to complete successfully.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Superseded by #96, which lands the dependency refresh as one coherent branch (avoids lockfile cascades) with build + smoke proof.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml