ci(deps): bump github/codeql-action/init from 3.35.5 to 4.37.9

[dependabot]

Bumps github/codeql-action/init from 3.35.5 to 4.37.9.

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v4.37.4

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

v4.37.3

No user facing changes.

v4.37.2

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v4.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

v4.36.2

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

v4.36.1

No user facing changes.

v4.36.0

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

... (truncated)

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995

... (truncated)

Commits

• cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
• 7243f38 Update changelog for v4.37.9
• 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
• ecfa6e1 Add changelog note
• adcdf4a Update default bundle to codeql-bundle-v2.26.4
• 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
• 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
• ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
• 4605e03 Rebuild
• 099c869 Update changelog and version after v4.37.8
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[helebest]

Dependabot PR review — ❌ Blocked, not merging

Author: dependabot[bot] (in scope) · Change: github/codeql-action/init 3.35.5 → 4.37.9 (single-line SHA bump 458d36d… → cdf488f… in .github/workflows/codeql.yml). This PR supersedes #264 (which targeted 4.37.3).

Step 1 — Code review

• Consistency: New pinned SHA cdf488f595d80d6e07e03d4674febd5ab45fa938 is release v4.37.9, matching the title. The trailing pin comment still reads # v3 and should be # v4.37.9 (Dependabot did not refresh it) — cosmetic.
• Correctness / Effectiveness — blocking: This PR bumps only the init step. The analyze step in the same workflow stays at v3 / 3.35.5 on main. CodeQL requires init and analyze to run the same version, so applying this bump alone produces the mismatch.

Step 2/3 — CI

The Analyze Python job failed (configuration error) — the mirror image of #265's failure: a v4 init writes a config that the v3 analyze cannot consume. Merging this alone would also break the CodeQL workflow on main.

Step 4 — Merge

Not merged. Per fail-fast, stopping here.

Recommendation

This PR (#267, init → 4.37.9) and #265 (analyze → 4.37.9) are now the matching pair — both point at the same commit cdf488f…. They only fail because they are two separate PRs: merging either one alone leaves the other step at v3 on main. They must land together. Options:

1. Combine both bumps into a single branch (set init and analyze to cdf488f… # v4.37.9) and merge that one change — it closes out both ci(deps): bump github/codeql-action/analyze from 3.35.5 to 4.37.9 #265 and ci(deps): bump github/codeql-action/init from 3.35.5 to 4.37.9 #267 and keeps main green; or
2. Add a groups: entry in .github/dependabot.yml matching github/codeql-action* so future CodeQL bumps arrive as one PR, then ·@·d·ependabot r·ecreate here.

Leaving the coordination decision to a maintainer since it spans two PRs (a block signal for this automated loop).

---

Generated by Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fe9ea81bc1

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Upgrade the analyze action alongside init

In every execution of this workflow, the initialization step now runs CodeQL Action v4.37.9 while the downstream Perform CodeQL analysis step at line 43 remains pinned to v3.35.5. CodeQL Action components in one job must use the same version because analyze consumes state created by init; this mismatch prevents the scan from completing and therefore eliminates CodeQL results for pushes, pull requests, and scheduled runs. Pin analyze to the same v4.37.9 commit.

Useful? React with 👍 / 👎.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[helebest]

Automated Dependabot review — ⚠️ HOLD (fail-fast)

Step 1 — Code review

• Consistency: The diff bumps only the Initialize CodeQL step (github/codeql-action/init) in .github/workflows/codeql.yml. Note this 3.35.5 → 4.37.9 is a major version bump (v3 → v4), despite the small-looking SHA change.
• Correctness / blocking issue: The codeql-action/init and codeql-action/analyze steps must use the same CodeQL Action release. This PR moves init to v4.37.9 (CodeQL bundle 2.26.4) while the analyze step in the same workflow stays pinned at v3.35.5 (458d36d…). That mismatch is unsupported and is exactly what the failing check below reports.
• Conventions: The trailing version comment is now stale — the line reads # v3 but the new SHA cdf488f595d80d6e07e03d4674febd5ab45fa938 is v4.37.9. It should read # v4 (or # v4.37.9) once landed.
• Security: The v4.x changelog entries (min CodeQL bundle 2.19.4, deprecation of CodeQL ≤ 2.20.6) concern GitHub Enterprise Server / bundle floors and do not affect this github.com-hosted workflow using the default bundle. No advisory concerns with the bump itself.
• Effectiveness / Test coverage: N/A beyond the workflow's own execution — which currently fails (see below).

Step 2 / Step 3 — Verification & CI: ❌ The Analyze Python check failed. Job log:

CodeQL job status was configuration error.
##[warning] … github/codeql-action/analyze@458d36d… … being forced to run on Node.js 24 (Node 20 deprecated)

Root cause is the v4-init / v3-analyze version mismatch described above — it will not go green while only init is bumped, and merging this alone would break the CodeQL workflow on main.

Step 4 — Decision: HOLD, not merging. Per the fail-fast rule, stopping here because a required step (CI) did not pass.

This is a coordinated bump that Dependabot split across two PRs — the companion is #265 (codeql-action/analyze), which hits the mirror-image failure for the same reason. Recommendation: land both steps at v4.37.9 in a single change (bump init and analyze together, and update both # v3 comments to # v4), e.g. combine the two PRs or rebase one onto the other after adding the missing step. Requesting human review before proceeding.

---

Generated by Claude Code