chore(deps): bump github/codeql-action from 4 to 4.37.3

[dependabot]

Bumps github/codeql-action from 4 to 4.37.3.

Release notes

Sourced from github/codeql-action's releases.

v4.37.3

No user facing changes.

v4.37.2

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v4.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

v4.36.2

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

v4.36.1

No user facing changes.

v4.36.0

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

v4.35.5

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

v4.35.4

• Update default CodeQL bundle version to 2.25.4. #3881

v4.35.3

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
• Update default CodeQL bundle version to 2.25.3. #3865

v4.35.2

• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
• The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

Commits

• e4fba86 Merge pull request #4031 from github/update-v4.37.3-72f6a9da0
• fb50ab5 Update changelog for v4.37.3
• 72f6a9d Merge pull request #4030 from github/mbg/fix/no-proxy
• 3b5ee58 Use default request options instead of undefined
• bfb6be4 Merge pull request #4028 from github/mergeback/v4.37.2-to-main-e0647621
• 526ab84 Rebuild
• d6217b9 Update changelog and version after v4.37.2
• e064762 Merge pull request #4027 from github/update-v4.37.2-385bcdc5a
• e0faed8 Add a couple of change notes
• 73aad0e Update changelog for v4.37.2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[helebest]

Automated Dependabot review — ⚠️ CI blocked by design, not merging

Step 1 (code review): the bump itself (github/codeql-action 4 → 4.37.3, in .github/workflows/codeql.yml) is a low-risk pin update and looks fine.

Step 3 (CI): the required Gate integrity (no reward-hacking) check fails by design, because this PR edits a file under .github/workflows/**:

✖ Gate integrity FAILED — the verification itself was weakened:
  ✖ [gate-machinery-modified] .github/workflows/codeql.yml — gate/CI machinery changed

Per scripts/check-gate-integrity.mjs (see docs/adr/0005-delivery-loop-hardening.md), any change to CI/gate machinery is blocked unless a maintainer adds the visible gate-change label to the PR. That is a deliberate human decision, so I am not self-applying it in an automated run.

Separately, the required Dependency audit (prod, high+) check is also red repo-wide (pre-existing transitive vulns, unrelated to this bump).

Decision: not merged. A maintainer needs to add the gate-change label and re-run CI for this Action bump to become mergeable. (Longer term, consider excluding version-only bumps of trusted actions from the gate, or teaching Dependabot's github_actions PRs to carry the label automatically.)

---

Generated by Claude Code

[helebest]

Automated Dependabot review — not merged (maintainer action required) ⚠️

Scope: github/codeql-action 4 → 4.37.3 in .github/workflows/codeql.yml (2 lines).

Step 1 — Code review: action pin bump only. The changelog shows no breaking changes relevant to this repo's usage (default CodeQL bundle updates, additive config-file address-format support). Low risk and worth taking. The CodeQL Analyze check itself is green on this PR.

Blocking finding (Step 3 — CI): the required Gate integrity (no reward-hacking) check fails by design. That gate flags any edit under .github/workflows/** as a CI-machinery change and fails unless a maintainer has authorized it — see scripts/check-gate-integrity.mjs and docs/adr/0005-delivery-loop-hardening.md. This is the intended human-in-the-loop control, not a defect in the PR.

Resolution requires a maintainer: add the visible gate-change label to this PR (GATE_HAS_OVERRIDE); the gate then passes and the PR is mergeable. I have intentionally not added the label or overridden the gate, since authorizing a CI-machinery change is a deliberate maintainer decision. Flagging for maintainer action — once the label is applied and the gate re-runs green, this is a safe squash-merge.

---

Generated by Claude Code

[helebest]

Automated dependency review — github/codeql-action 4 → 4.37.3 ⚠️ Not merging automatically

Step 1 — Code review

Pins the floating github/codeql-action@v4 major tag to the specific patch 4.37.3 in .github/workflows/codeql.yml. Change is consistent and low-risk — 4.37.3 is "No user facing changes", and pinning to an exact patch is a supply-chain hardening improvement over a floating major.

Steps 2–4 — Blocked by a required check (by design)

This PR edits .github/workflows/**, so the required Gate integrity (no reward-hacking) check fails intentionally — that gate blocks any change to CI/gate machinery unless a maintainer adds the visible, auditable gate-change label to the PR (GATE_HAS_OVERRIDE). See docs/adr/0005-delivery-loop-hardening.md.

Applying that override is a deliberate maintainer decision, so I'm not self-applying it or merging in this unattended run. The PR is also currently behind main and would need a rebase for a fresh CI pass.

To land it: a maintainer adds the gate-change label, updates the branch (·@·d·ependabot r·ebase), and merges once CI (minus the pre-existing audit/trivy advisories) is green.

---

Generated by Claude Code

[helebest]

Dependabot PR review — blocked by the reward-hacking gate 🔒 (needs maintainer action)

Step 1 — Code review
Pins github/codeql-action init/analyze from the floating major @v4 to the exact @v4.37.3 in .github/workflows/codeql.yml. This is a routine, low-risk security-tooling pin — pinning to an exact patch release is good supply-chain hygiene. Diff is consistent with the PR description; CodeQL and Verify both pass.

Step 2 — Regression verification
Verify ✅, CodeQL ✅, Analyze (javascript-typescript) ✅. (Trivy/npm audit red = pre-existing baseline unrelated to this change.)

Step 3 — CI — Gate integrity (no reward-hacking) fails by design ❌
The repo's check:gate guard fails on any edit to .github/workflows/** unless a maintainer applies the visible gate-change label (GATE_HAS_OVERRIDE). This PR edits codeql.yml, so the gate is intentionally red. This is a governance control that requires a human maintainer's sign-off; an automated agent should not self-authorize bypassing it.

Decision: Not merging. The bump itself is good — a maintainer should add the gate-change label to this PR, after which the gate goes green and it can be squash-merged. Fail-fast at Step 3 pending that label.

---

Generated by Claude Code

[helebest]

Automated dependency review — github/codeql-action 4 → 4.37.3

Step 1 · Code review

• Single-line change in .github/workflows/** pinning github/codeql-action from the floating major v4 to v4.37.3. Reviewed the release notes for v4.35–v4.37: bundle updates, config-file address-format additions, and deprecation warnings for old CodeQL bundles — no breaking change relevant to this repo's usage. The bump itself is benign and desirable (pins a floating tag).

Step 2/3 · Verification & CI — ⛔ blocked by policy gate
The Gate integrity (no reward-hacking) required check fails by design: this PR edits a file under .github/workflows/**, which scripts/check-gate-integrity.mjs treats as a change to CI/verification machinery. Per docs/adr/0005-delivery-loop-hardening.md, such an edit is only permitted when a maintainer adds the visible gate-change label to the PR (GATE_HAS_OVERRIDE). The PR is also currently behind main and would need a rebase.

Decision — not merging. This block is an intentional human-in-the-loop control, so I will not bypass it (I'm not adding the label, and there is no admin override in this run). To proceed, a maintainer should add the gate-change label and rebase; once the gate passes on the updated head, this is safe to squash-merge.

(The Dependency-audit / Container-scan reds are the pre-existing environmental advisories, unrelated to this bump.)

---

Generated by Claude Code

[helebest]

Automated Dependabot review — github/codeql-action 4 → 4.37.3

1. Code review. Pins github/codeql-action/init and .../analyze to v4.37.3 in .github/workflows/codeql.yml. Safe, and pinning to a full patch version is good supply-chain practice.

2. Regression verification (CI). The required Gate integrity (no reward-hacking) check ❌ fails by design, because the change edits .github/workflows/** (gate-machinery-modified). It clears only when a maintainer adds the gate-change label to the PR (see docs/adr/0005-delivery-loop-hardening.md).

3. Decision. ⛔ Not merging automatically. Requires a maintainer to add the gate-change label; once Gate integrity passes, the PR can be squash-merged.

---

Generated by Claude Code

[helebest]

Automated review — ✅ change is safe, but ⛔ merge deferred to a maintainer

Step 1 · Code review — Clean, correct pin of github/codeql-action @v4 → @v4.37.3 for both the init and analyze steps in codeql.yml. Pinning the floating major to an exact patch is a reasonable supply-chain hardening; no other behavior changes. Description matches the diff.

Step 2 · Regression verification — Verify and the CodeQL/Analyze jobs passed on this branch, so the pinned action runs correctly.

Step 3 · CI — blocked by the reward-hacking gate (by design). The required Gate integrity (no reward-hacking) job fails because this PR edits .github/workflows/** (codeql.yml). That guard (scripts/check-gate-integrity.mjs) flags any CI/gate-machinery edit and only passes once a maintainer applies the visible gate-change label (GATE_HAS_OVERRIDE). See docs/adr/0005-delivery-loop-hardening.md.

Decision: Safe change, but a workflow-file edit requires human sign-off by project policy. As an automated agent I will not self-apply the gate-change override. Not merged.

Action needed from a maintainer: review the CodeQL action pin and, if approved, add the gate-change label so Gate integrity passes; the PR is then ready to squash-merge.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — github/codeql-action 4 → 4.37.3 — ⏸️ blocked (needs gate-change label)

1. Code review

• Consistency/Effectiveness: Diff pins github/codeql-action/init and .../analyze from the floating @v4 tag to @v4.37.3 in .github/workflows/codeql.yml (+2/-2). Matches the description.
• Security: 4.37.3 carries no user-facing behavior change for our init + analyze (javascript-typescript) usage; it updates the default CodeQL bundle and adds a private-registry config feature we don't use. Pinning to an exact patch is a supply-chain improvement over a floating major tag.

2 & 3. Verification / CI

The required Gate integrity (no reward-hacking) check fails by design because this PR edits .github/workflows/**, which the gate treats as CI-machinery changes (see docs/adr/0005-delivery-loop-hardening.md). This is not a defect in the PR — it is the deterministic backstop working as intended. The other checks are unaffected by this change.

Decision

Not merging autonomously. By design, a workflow-file change requires a maintainer to add the visible gate-change label (the GATE_HAS_OVERRIDE path), then re-run CI, before gate-integrity will pass. That human-in-the-loop step is intentional, so I'm deferring it to a maintainer rather than self-applying the override. Once the label is added and CI re-runs green, this is safe to squash-merge.

(Note: the branch is also behind main and will need a rebase before merge.)

---

Generated by Claude Code

[helebest]

Automated review — blocked at Step 3 (CI)

Code review (Step 1): ✅ Clean, low-risk. Pins the github/codeql-action action from the floating major 4 to 4.37.3 in .github/workflows/codeql.yml. No source or runtime impact.

Blocker: The required Gate integrity (no reward-hacking) check is failing on this PR, and it is a required merge gate. That gate deliberately fails any edit under .github/workflows/** unless a maintainer applies the visible gate-change label (GATE_HAS_OVERRIDE) — see docs/adr/0005-delivery-loop-hardening.md. Because this PR edits a workflow file, it cannot pass the gate without that label.

Per the fail-fast policy I am stopping here and not merging. This requires a maintainer to add the gate-change label (an intentional, auditable action I should not take on their behalf), after which CI will re-run and the PR can be merged.

---

Generated by Claude Code