build(deps): bump the actions group with 2 updates

[dependabot]

Bumps the actions group with 2 updates: github/codeql-action/init and github/codeql-action/analyze.

Updates github/codeql-action/init from 4.37.8 to 4.37.9

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995

... (truncated)

Commits

• cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
• 7243f38 Update changelog for v4.37.9
• 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
• ecfa6e1 Add changelog note
• adcdf4a Update default bundle to codeql-bundle-v2.26.4
• 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
• 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
• ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
• 4605e03 Rebuild
• 099c869 Update changelog and version after v4.37.8
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.8 to 4.37.9

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995

... (truncated)

Commits

• cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
• 7243f38 Update changelog for v4.37.9
• 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
• ecfa6e1 Add changelog note
• adcdf4a Update default bundle to codeql-bundle-v2.26.4
• 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
• 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
• ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
• 4605e03 Rebuild
• 099c869 Update changelog and version after v4.37.8
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 31, 2026, 4:31 AM ET / 08:31 UTC.

ClawSweeper review

What this changes

Updates the pinned GitHub CodeQL initialize and analyze actions from v4.37.8 to v4.37.9 in the repository security-scanning workflow.

Merge readiness

✅ Ready for maintainer review

This small, SHA-pinned CodeQL Action update is clean, passed the updated CodeQL jobs, and remains useful for normal maintainer merge review.

Priority: P3
Reviewed head: be1e668166dc8ba6ef0b584eb409c5ce67387581

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A narrow, immutable-pinned dependency update with successful execution of the affected workflow.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The changed production owner is the CodeQL workflow’s initialize/analyze pair; the supplied exact-head CI results show both language analyses and CodeQL completing successfully after the v4.37.9 update.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The changed production owner is the CodeQL workflow’s initialize/analyze pair; the supplied exact-head CI results show both language analyses and CodeQL completing successfully after the v4.37.9 update.
Evidence reviewed	4 items	Introduced workflow change: The verified PR-introduced diff changes only the immutable SHA pins for CodeQL initialization and analysis, keeping both steps on the same v4.37.9 release. Workflow security boundary retained: The workflow retains read-only repository permissions, disables checkout credential persistence, and uses full immutable action SHAs for the updated action references. Observed after-update execution: The supplied exact-head check snapshot records successful Analyze actions, Analyze javascript-typescript, CodeQL, and repository check runs, exercising the updated workflow on this PR.
Findings	None	None.
Security	None	None.

How this fits together

The CodeQL workflow runs on pushes, pull requests, schedules, and manual dispatches to scan the repository’s Actions and JavaScript/TypeScript sources. It checks out the repository, initializes CodeQL for each language, and uploads analysis results to GitHub.

flowchart LR
  A[Push, pull request, schedule] --> B[CodeQL workflow]
  B --> C[Checkout source]
  C --> D[Initialize CodeQL]
  D --> E[Analyze Actions and TypeScript]
  E --> F[GitHub security results]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Workflow pin update	2 action references changed; +2, -2 across 1 workflow	Both coupled CodeQL steps advance together to the same immutable v4.37.9 release.

Technical review

Best possible solution:

Land the matching v4.37.9 CodeQL pins after normal maintainer approval.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a pinned CI dependency update, and the supplied exact-head workflow checks successfully exercised the changed CodeQL steps.

Is this the best way to solve the issue?

Yes: updating both coupled CodeQL action references to the same official immutable v4.37.9 SHA is the narrowest maintainable change.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 9a269d2bce29.

Labels

Label justifications:

• P3: This is a routine, low-blast-radius CI dependency maintenance update with successful exact-head checks.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The changed production owner is the CodeQL workflow’s initialize/analyze pair; the supplied exact-head CI results show both language analyses and CodeQL completing successfully after the v4.37.9 update.
• proof: sufficient: Contributor real behavior proof is sufficient. The changed production owner is the CodeQL workflow’s initialize/analyze pair; the supplied exact-head CI results show both language analyses and CodeQL completing successfully after the v4.37.9 update.

Evidence

What I checked:

• Introduced workflow change: The verified PR-introduced diff changes only the immutable SHA pins for CodeQL initialization and analysis, keeping both steps on the same v4.37.9 release. (.github/workflows/codeql.yml:44, be1e668166dc)
• Workflow security boundary retained: The workflow retains read-only repository permissions, disables checkout credential persistence, and uses full immutable action SHAs for the updated action references. (.github/workflows/codeql.yml:14, be1e668166dc)
• Observed after-update execution: The supplied exact-head check snapshot records successful Analyze actions, Analyze javascript-typescript, CodeQL, and repository check runs, exercising the updated workflow on this PR. (.github/workflows/codeql.yml:44, be1e668166dc)
• Relevant main-line history: The immediate main-base commit refreshed CodeQL in this same workflow, identifying the recent owner of the surrounding CI dependency surface. (.github/workflows/codeql.yml:44, 9a269d2bce29)

Likely related people:

• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• dependabot[bot]: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (13 earlier review cycles; latest 8 shown)

• reviewed 2026-08-29T20:07:15.488Z sha be1e668 :: needs maintainer review before merge. :: none
• reviewed 2026-08-30T01:58:51.835Z sha be1e668 :: needs maintainer review before merge. :: none
• reviewed 2026-08-30T08:50:34.242Z sha be1e668 :: needs maintainer review before merge. :: none
• reviewed 2026-08-30T12:01:11.359Z sha be1e668 :: needs maintainer review before merge. :: none
• reviewed 2026-08-30T16:05:57.946Z sha be1e668 :: needs maintainer review before merge. :: none
• reviewed 2026-08-30T20:08:55.809Z sha be1e668 :: needs maintainer review before merge. :: none
• reviewed 2026-08-31T02:04:28.253Z sha be1e668 :: needs maintainer review before merge. :: none
• reviewed 2026-08-31T07:12:21.588Z sha be1e668 :: needs maintainer review before merge. :: none