From cf55b66c22a3e66585237a4a2a83879eac517c95 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 07:53:01 +0000 Subject: [PATCH 1/2] fix(deps): Bump github/codeql-action/init from 4.36.3 to 4.37.4 Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.36.3 to 4.37.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...f205ea1c3313d32999d8d6a48b4f6530d4437b38) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 8359448..df6cefe 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -45,7 +45,7 @@ jobs: uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 - name: Initialize CodeQL - uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4 + uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4 with: languages: csharp From 49c73faed0259e786ab48af602f942d3fe452aee Mon Sep 17 00:00:00 2001 From: Alpaq92 Date: Tue, 4 Aug 2026 10:20:25 +0200 Subject: [PATCH 2/2] fix(deps): Bump github/codeql-action init+analyze from 4.36.3 to 4.37.5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Supersedes the two dependabot PRs that split this pair — #25 (init -> 4.37.4) and #28 (analyze -> 4.37.3). Each was red on its own, and neither was wrong: analyze reads the version-stamped config that init writes and refuses a mismatch, so bumping one half fails with Loaded a configuration file for version '4.37.4', but running version '4.36.3' Both pins now move together to v4.37.5, the newest release, which also carries the init fix for a bundle-download network error terminating the step instead of falling back. .github/dependabot.yml grows a `codeql-action` group over `github/codeql-action*` so the next bump arrives as one PR instead of splitting into a broken pair again. Co-Authored-By: Claude Opus 5 --- .github/dependabot.yml | 12 ++++++++++++ .github/workflows/codeql.yml | 11 +++++++++-- 2 files changed, 21 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 94d944b..931a8a1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -62,3 +62,15 @@ updates: labels: - "dependencies" - "github-actions" + groups: + codeql-action: + # `github/codeql-action/init` and `.../analyze` are two dependencies + # to dependabot but one unit to CodeQL: analyze rejects a config + # written by a different release ("Loaded a configuration file for + # version 4.37.4, but running version 4.36.3"). Ungrouped, dependabot + # opened one PR per sub-action (#25 init, #28 analyze) and *each* was + # red on its own while neither was wrong — bumping only one half is + # what breaks. Grouping puts both pins in a single PR so the pair + # moves together. Added 2026-08-04 after that exact split. + patterns: + - "github/codeql-action*" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index df6cefe..d68ce3a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -44,8 +44,14 @@ jobs: - name: Setup .NET uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 + # init and analyze are one unit: the config init writes is version- + # stamped, and analyze refuses to read a config from a different + # release ("Loaded a configuration file for version X, but running + # version Y"). Bump BOTH pins to the same SHA in the same commit — + # dependabot sees them as two dependencies, so .github/dependabot.yml + # groups them into a single PR to keep that invariant. - name: Initialize CodeQL - uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4 + uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5 with: languages: csharp @@ -55,5 +61,6 @@ jobs: - name: Build run: dotnet build TopSecret.ProtectedString.sln --configuration Release --no-restore + # Same SHA as the init pin above — see the note there. - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4 + uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5