ci(deps): bump github/codeql-action/analyze from 3.35.5 to 4.37.9

[dependabot]

Bumps github/codeql-action/analyze from 3.35.5 to 4.37.9.

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v4.37.4

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

v4.37.3

No user facing changes.

v4.37.2

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v4.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

v4.36.2

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

v4.36.1

No user facing changes.

v4.36.0

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

... (truncated)

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995

... (truncated)

Commits

• cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
• 7243f38 Update changelog for v4.37.9
• 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
• ecfa6e1 Add changelog note
• adcdf4a Update default bundle to codeql-bundle-v2.26.4
• 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
• 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
• ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
• 4605e03 Rebuild
• 099c869 Update changelog and version after v4.37.8
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[helebest]

Dependabot PR review — ❌ Blocked, not merging

Author: dependabot[bot] (in scope) · Change: github/codeql-action/analyze 3.35.5 → 4.37.9 (single-line SHA bump in .github/workflows/codeql.yml).

Step 1 — Code review

• Consistency: The new pinned SHA cdf488f595d80d6e07e03d4674febd5ab45fa938 does correspond to v4.37.9, so the code matches the PR title. However, the trailing pin comment is still # v3 — it should read # v4.37.9. Cosmetic, but it leaves the pin annotation inaccurate.
• Correctness / Effectiveness — blocking: This PR bumps only the analyze step. The init step in the same workflow stays at github/codeql-action/init@458d36d7… (v3 / 3.35.5). The CodeQL Action requires init and analyze to run the same version — init writes a config file that analyze reads back, and it rejects a cross-major mismatch. So this bump breaks the CodeQL workflow on its own.

Step 2/3 — CI

CI confirms the review finding. The Analyze Python job failed with a configuration error:

##[error]Loaded a configuration file for version '3.35.5', but running version '4.37.9'
##[error]analyze post-action step failed: Loaded a configuration file for version '3.35.5', but running version '4.37.9'
CodeQL job status was configuration error.

Merging this would also carry the breakage onto main (the workflow runs on push and on every future PR).

Step 4 — Merge

Not merged. Per fail-fast, stopping here.

Recommendation

init and analyze must be bumped together to the same version. Since both live in github/codeql-action, the same release tag is one commit SHA, so the fix is to set both steps to:

uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938     # v4.37.9
uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9

Note this also supersedes #264 (which bumps only init, to a different version, 4.37.3) — that PR fails for the same coupling reason. The cleanest path is a single change bumping both init and analyze to 4.37.9 (e.g. ·@·d·ependabot r·ecreate after grouping the codeql-action updates, or one manual commit), which closes out both #264 and #265.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — ⚠️ HOLD (fail-fast)

Step 1 — Code review

• Consistency: The diff bumps only the Perform CodeQL analysis step (github/codeql-action/analyze) in .github/workflows/codeql.yml. Note this 3.35.5 → 4.37.9 is a major version bump (v3 → v4).
• Correctness / blocking issue: The codeql-action/init and codeql-action/analyze steps must use the same CodeQL Action release. This PR moves analyze to v4.37.9 while the init step in the same workflow stays pinned at v3.35.5 (458d36d…). That mismatch is unsupported and is what the failing check below reports.
• Conventions: The trailing version comment is stale — the bumped line still reads # v3 while the SHA is now v4.37.9. It should read # v4 (or # v4.37.9) once landed.
• Security: The v4.x changelog entries (min CodeQL bundle 2.19.4, deprecation of CodeQL ≤ 2.20.6) concern GitHub Enterprise Server / bundle floors and do not affect this github.com-hosted workflow. No advisory concerns with the bump itself.
• Effectiveness / Test coverage: N/A beyond the workflow's own execution — which currently fails (see below).

Step 2 / Step 3 — Verification & CI: ❌ The Analyze Python check failed (CodeQL job status was configuration error). All other CI (lint-type-test 3.12/3.13, Postgres contract tests, Server e2e, Wheel install smoke test) is green — the sole failure is the CodeQL version mismatch. It will not go green while only analyze is bumped, and merging this alone would break the CodeQL workflow on main.

Step 4 — Decision: HOLD, not merging. Per the fail-fast rule, stopping because a required step (CI) did not pass.

This is a coordinated bump that Dependabot split across two PRs — the companion is #267 (codeql-action/init), which hits the mirror-image failure. Recommendation: land both steps at v4.37.9 in a single change (bump init and analyze together, and update both # v3 comments to # v4), e.g. combine the two PRs or rebase one onto the other after adding the missing step. Requesting human review before proceeding.

---

Generated by Claude Code