build(deps): bump github/codeql-action from 4 to 4.37.4 - #113
build(deps): bump github/codeql-action from 4 to 4.37.4#113dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4 to 4.37.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4...v4.37.4) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| uses: github/codeql-action/init@v4.37.4 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
| queries: security-extended,security-and-quality | ||
|
|
||
| - name: 🔍 Autobuild | ||
| uses: github/codeql-action/autobuild@v4 | ||
| uses: github/codeql-action/autobuild@v4.37.4 | ||
|
|
||
| - name: 🔍 Perform Analysis | ||
| uses: github/codeql-action/analyze@v4 | ||
| uses: github/codeql-action/analyze@v4.37.4 |
There was a problem hiding this comment.
📝 Info: Pinning to an exact tag stops automatic patch updates
All four github/codeql-action/* references were updated consistently (.github/workflows/code-quality.yml:148, .github/workflows/security-scan.yml:32,38,41), so there is no version skew between init, autobuild, analyze, and upload-sarif. Note however that moving from the floating @v4 major tag to the exact @v4.37.4 tag means the workflows no longer pick up patch/minor fixes automatically; future updates will depend on Dependabot PRs being merged. Also relevant: AGENTS.md soft rule 4 states "Alterar CI workflows → requer revisão", so this change should get an explicit maintainer review.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
Qodana Community for .NET10 new problems were found
💡 Qodana analysis was run in the pull request mode: only the changed files were checked View the detailed Qodana reportTo be able to view the detailed Qodana report, you can either:
To get - name: 'Qodana Scan'
uses: JetBrains/qodana-action@v2026.1.3
with:
upload-result: trueContact Qodana teamContact us at qodana-support@jetbrains.com
|
1 participant
Bumps github/codeql-action from 4 to 4.37.4.
Release notes
Sourced from github/codeql-action's releases.
... (truncated)
Changelog
Sourced from github/codeql-action's changelog.
Commits
18420e3Merge pull request #4043 from github/mbg/ts/changelog7e8d897Merge pull request #4046 from github/mbg/repo-prop/code-quality2d4c474Log!analysisKindSupportedcase98c05a1Fix argument validation inrollback-changelog.ts8289a49Ignore repository property for unsupported analysis kinds2a8731cMoveconfig-filecomputation after determining theanalysisKinds3434fbbMerge pull request #4044 from github/mbg/ff/promote-toolcache3013ac0PromoteAllowToolcacheInputfeature74b15aaInstall JS deps if needed inpost-release-mergebackworkflowf00f809Fix checking keys rather than valuesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)