chore: update CodeQL together and release 4.2.3

[CryptoJones]

Summary

• update CodeQL init and analyze together to 4.37.1
• group GitHub Actions Dependabot updates to prevent split-version failures
• bump omind to 4.2.3 and add release notes

Verification

• ruff check .
• mypy src
• pip-audit
• pytest: 782 passed, 1 skipped; 85.59% coverage
• wheel build/install smoke
• gitleaks full history

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Release

  • Updated the package to version 4.2.3.

• Bug Fixes

  • Updated CodeQL security scanning actions to version 4.37.1.
  • Improved dependency update handling to keep related GitHub Actions versions synchronized.

• Documentation

  • Added release notes for version 4.2.3.

Walkthrough

Changes

Release maintenance

Layer / File(s)	Summary
GitHub Actions version management .github/workflows/codeql.yml, .github/dependabot.yml	CodeQL actions are upgraded to v4.37.1, and Dependabot groups all GitHub Actions dependencies.
Release version alignment pyproject.toml, src/omind/__init__.py, CHANGELOG.md	Package metadata and __version__ are updated to 4.2.3, with a corresponding changelog entry.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the CodeQL update and 4.2.3 release bump.
Description check	✅ Passed	The description matches the changeset and the verification details are relevant.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/codeql-4.37.1-release

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@CHANGELOG.md`:
- Around line 12-13: Insert a blank line immediately after the “### Fixed”
heading in CHANGELOG.md and before its first bullet, preserving the existing
changelog text.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fec83cc1-6304-432f-9215-7298aa559851

📥 Commits

Reviewing files that changed from the base of the PR and between 960ef3f and 57eddc3.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• .github/dependabot.yml
• .github/workflows/codeql.yml
• CHANGELOG.md
• pyproject.toml
• src/omind/__init__.py

📜 Review details

⏰ Context from checks skipped due to timeout. (10)

• GitHub Check: test (ubuntu-latest, 3.11)
• GitHub Check: test (macos-latest, 3.14)
• GitHub Check: test (windows-latest, 3.14)
• GitHub Check: test (ubuntu-latest, 3.14)
• GitHub Check: test (windows-latest, 3.10)
• GitHub Check: test (macos-latest, 3.10)
• GitHub Check: test (ubuntu-latest, 3.13)
• GitHub Check: test (ubuntu-latest, 3.10)
• GitHub Check: test (ubuntu-latest, 3.12)
• GitHub Check: Analyze (python)

🧰 Additional context used

🪛 markdownlint-cli2 (0.23.0)

CHANGELOG.md

[warning] 12-12: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below

(MD022, blanks-around-headings)

🔇 Additional comments (4)

.github/workflows/codeql.yml (1)

27-33: LGTM!

.github/dependabot.yml (1)

19-21: LGTM!

pyproject.toml (1)

3-3: LGTM!

src/omind/__init__.py (1)

5-5: LGTM!

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Add a blank line after the Fixed heading.

Markdownlint reports MD022 because the heading on Line 12 is immediately followed by list content. Insert a blank line before the first bullet.

Proposed fix

 ### Fixed
+
 - Upgrade both CodeQL workflow actions together to 4.37.1, avoiding the

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	### Fixed
	- Upgrade both CodeQL workflow actions together to 4.37.1, avoiding the
	### Fixed
	- Upgrade both CodeQL workflow actions together to 4.37.1, avoiding the

🧰 Tools

🪛 markdownlint-cli2 (0.23.0)

[warning] 12-12: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below

(MD022, blanks-around-headings)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@CHANGELOG.md` around lines 12 - 13, Insert a blank line immediately after the
“### Fixed” heading in CHANGELOG.md and before its first bullet, preserving the
existing changelog text.

Source: Linters/SAST tools