From 601b1abf14f565be6b2816f9c5bbffca3468e4db Mon Sep 17 00:00:00 2001 From: Jarry Shaw Date: Tue, 27 Oct 2026 11:07:59 -0400 Subject: [PATCH] build(deps): bump github/codeql-action to 4.39.1 (#2384, #2385, #2386) codeql-action now refuses to run unless every step in a workflow (init, autobuild, analyze) is on the same version. Dependabot opened one PR per step (#2384, #2385, #2386), so each failed Analyze alone. Bumps all three together to the sha the v4.39.1 tag resolves to, same as each individual PR proposed. --- .github/workflows/codeql-analysis.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 8e34c0076a..279386bb7b 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -51,15 +51,15 @@ jobs: # #2130: the config leaves tests/ out of the scan. - name: Initialize CodeQL - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: config-file: ./.github/codeql/codeql-config.yml - name: Autobuild - uses: github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 # #2030: the run's report, to its thread in Discussions. A pull request's run # posts nothing: its findings belong to the pull request, and the alerts the