ci: bump github/codeql-action from 4.37.4 to 4.37.7

[dependabot]

Bumps github/codeql-action from 4.37.4 to 4.37.7.

Release notes

Sourced from github/codeql-action's releases.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action's changelog.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Commits

• ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
• 951a133 Update changelog for v4.37.7
• be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
• 9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
• b4d8a54 Rebuild
• ab5db25 Bump the npm-minor group across 1 directory with 8 updates
• 38055a3 Drop logger from databaseInitCluster in interface
• 1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
• dc1b98a Make logger available to getCodeQLForCmd
• 6f0220e Merge pull request #4084 from github/navntoft/bump-undici
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[helebest]

Code Review

Consistency: PR description matches the diff exactly — github/codeql-action/init and github/codeql-action/analyze are both bumped from v4.37.4 to v4.37.7 in .github/workflows/codeql.yml. Both action references were updated together, so no version drift between the two steps.

Correctness: Straightforward tag bump, no logic changes. v4.37.7 is a real, current release tag on github/codeql-action.

Conventions: Matches the existing pinning style in this workflow (explicit vX.Y.Z tags rather than a major-version floating tag or a SHA pin).

Security: Reviewed the upstream changelog for 4.37.5–4.37.7:

• 4.37.5: fixes a bug where a network error during CodeQL bundle download streaming could crash the init action instead of falling back to a non-streaming download — reliability fix, not a vulnerability.
• 4.37.6: changes the default filepath convention for remote config files to .github/codeql-config.yml — this repo doesn't use a remote/external CodeQL config file, so this is a no-op here.
• 4.37.7: bumps the default CodeQL bundle to 2.26.3 — picks up upstream CodeQL query/engine updates (net security-positive for the security-and-quality query suite this repo runs).

No breaking changes or new required inputs; the with: blocks (languages/queries, category) are untouched and remain valid.

Effectiveness: Achieves the stated purpose — keeps the CodeQL Action current for the security-and-quality scan.

Test coverage: N/A — this is a CI workflow-only change (.github/workflows/codeql.yml), not application code, so no unit test cases apply. Verifying correctness of this change means watching the analyze check run itself, which CI will now do.

Proceeding to regression verification and CI monitoring.

---

Generated by Claude Code

[helebest]

Regression Verification

Ran the workspace test suite locally against the PR head (308fe3d):

uv sync
uv run pytest

• packages/dikw-converter-epub, packages/dikw-converter-example, and packages/dikw-converter-mineru fail to collect in this local environment (ModuleNotFoundError for dikw_converter_epub / dikw_converter_example, and missing pytest_httpx dep for mineru's conftest).
• I confirmed these are pre-existing and unrelated to this PR: checking out the base commit (5c35bcb, main prior to this change) and re-running uv sync && uv run pytest reproduces the identical 3 collection errors. This PR touches only .github/workflows/codeql.yml — no Python source.
• Excluding those 3 known-broken paths, the rest of the suite passes cleanly: 27 passed in 44.02s.

No regression introduced by this change. Proceeding to CI monitoring.

---

Generated by Claude Code

[helebest]

CI Status

All required checks passed on 308fe3d:

• CodeQL — success
• analyze — success
• test (3.12) — success
• test (3.13) — success

All prior steps (review, regression verification) pass. Proceeding with squash merge.

---

Generated by Claude Code