[renovate]

Description

Renovate proposes this dependency update under the family preset. The table below lists each package and its version change, and the release notes follow.

Pre-Merge Verification Checklist

The bot ticks nothing; CI runs the repository's required gate on this pull request; items no check decides (3D tests among them) still need a reviewer's look.

• Local verification passed: make verify-all
• No new HISS / NASA Power-of-10 infractions (all new/modified functions
  $\le 60$ LOC)
• 3D Tests included (Positive, Negative, Boundary) for public APIs
• Agent contexts in sync: standardsctl compile-context --verify
• Commit messages adhere to Conventional Commits format

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	patch	v4.39.1 → v4.39.3

---

Release Notes

github/codeql-action

v4.39.3

Compare Source

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #​4283

v4.39.2

Compare Source

• Update default CodeQL bundle version to 2.27.4. #​4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #​4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #​4243

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sourcery-ai]

Sorry @renovate[bot], this account has used its review budget of 2,500,000 diff characters for the last 7 days.

You can request another review in 2 days and 4 hours by commenting @sourcery-ai review.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Both CodeQL workflow steps now use the v4.39.3 action commit instead of v4.39.1. The language, build mode, and step names remain unchanged.

Changes: CodeQL action update

Layer / File(s)	Summary
Update CodeQL action version .github/workflows/codeql.yml	Both CodeQL action steps now reference v4.39.3. The language, build mode, and step names remain unchanged.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: lusoris

Merge Risk: Minimal · up to 83db2

This updates the CodeQL workflow action to a newer patch release with a fix for changed-file paths. No merge-blocking risk is identified.

Architecture risk: Low · up to d41b9

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/codeql.yml: Both CodeQL action steps now reference the v4.39.2 commit instead of v4.39.1; the language, build mode, and step names are unchanged.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly describes the update of github/codeql-action to v4.39.3.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d6dc4bdd-009a-48da-9e56-b060534332d1

Commits

Reviewing files that changed from the base of the PR and between d41b907 and 83db247.

Files selected for processing: 1

• .github/workflows/codeql.yml

Files skipped from review as they are similar to previous changes: 1

• .github/workflows/codeql.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

✅ No blocking issues noticed

No blocking findings were identified. The workflow-specific version check remains an unverified test scenario.

Test suggestions

• Verify the workflow references v4.39.2 for both init and analyze actions.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify the workflow references v4.39.2 for both init and analyze actions.

_{TIP How was this review? Give us feedback}