chore(deps): bump the actions group across 1 directory with 4 updates

[dependabot]

Bumps the actions group with 4 updates in the / directory: github/codeql-action/init, github/codeql-action/analyze, pnpm/action-setup and actions/deploy-pages.

Updates github/codeql-action/init from 4.37.9 to 4.38.1

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

... (truncated)

Commits

• 1c5b675 Merge pull request #4152 from github/update-v4.38.1-a65b83a73
• a97cdca Add changelog entry for #4146
• cc6c691 Update changelog for v4.38.1
• a65b83a Merge pull request #4146 from github/henrymercer/per-language-bundles-pr
• 07fa87d Clarify the latest-nightly eligibility exception
• f18f353 Describe the bundle URL resolver
• ecec9b5 Share per-language telemetry fields without renaming
• 79fe3a1 Move download telemetry into the status-report directory
• ead1f7d Rename the platform module
• 549d498 Simplify per-language platform eligibility checks
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.9 to 4.38.1

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

... (truncated)

Commits

• 1c5b675 Merge pull request #4152 from github/update-v4.38.1-a65b83a73
• a97cdca Add changelog entry for #4146
• cc6c691 Update changelog for v4.38.1
• a65b83a Merge pull request #4146 from github/henrymercer/per-language-bundles-pr
• 07fa87d Clarify the latest-nightly eligibility exception
• f18f353 Describe the bundle URL resolver
• ecec9b5 Share per-language telemetry fields without renaming
• 79fe3a1 Move download telemetry into the status-report directory
• ead1f7d Rename the platform module
• 549d498 Simplify per-language platform eligibility checks
• Additional commits viewable in compare view

Updates pnpm/action-setup from 6.0.10 to 6.1.0

Release notes

Sourced from pnpm/action-setup's releases.

v6.1.0

What's Changed

• feat: support pnpm v12 by @​zkochan in pnpm/action-setup#288

Full Changelog: pnpm/action-setup@v6.0.10...v6.1.0

Commits

• ea17c68 feat: support pnpm v12 (#288)
• See full diff in compare view

Updates actions/deploy-pages from 5.0.0 to 5.0.1

Release notes

Sourced from actions/deploy-pages's releases.

v5.0.1

Changelog

• Add backoff and jitter to deployment polling @​yoannchaudet (#444)
• Improve deployment request test coverage @​adwitiyagoyal (#440)

---

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

Commits

• 368f825 Merge pull request #444 from actions/yoannchaudet-deployment-polling-backoff
• 7e97763 Validate deployment polling intervals
• 0143e11 Add backoff and jitter to deployment polling
• 5e98f10 Merge pull request #440 from actions/user/adwitiya
• 8b0625a Improve deployment request test coverage
• See full diff in compare view

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 21, 2026, 2:41 PM ET / 18:41 UTC (Revision 7).

ClawSweeper review

What this changes

Updates four pinned GitHub Actions used for code scanning, SDK release preparation, and documentation deployment.

Merge readiness

✅ Ready for maintainer review

This update remains useful: main retains the older action pins, and the overlapping earlier PRs closed without merging. No actionable correctness or security defect was found.

Priority: P3
Reviewed head: f88a097a1455d726811174573295e377842c01c1

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused dependency update with verified upstream pins, successful reported checks, and no actionable findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot update is exempt from contributor runtime proof; successful CodeQL checks support scanning compatibility, while SDK publishing and Pages deployment were not exercised by this review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot update is exempt from contributor runtime proof; successful CodeQL checks support scanning compatibility, while SDK publishing and Pages deployment were not exercised by this review.
Evidence reviewed	8 items	Exact introduced scope: The pinned base-to-head diff contains four action-reference substitutions across three workflows, with no changes to permissions, triggers, environments, inputs, or publishing commands. Still absent from main and latest release: Main retains CodeQL 4.37.9, pnpm/action-setup 6.0.10, and deploy-pages 5.0.0. The latest release is sdk-v0.0.1; its SDK workflow uses pnpm/action-setup 6.0.9. The proposed update is not already implemented. Package-manager compatibility: The v6.1.0 annotated tag resolves to the proposed commit. Its installer preserves packageManager version selection and uses the new native bootstrap only for pnpm 12; Krillswitch declares pnpm 11.24.0. Dependency inspection applies because the SDK preparation workflow directly executes this action.
Findings	None	None.
Security	None	None.

How this fits together

GitHub workflows scan Krillswitch source, prepare SDK packages from release tags, and deploy built documentation to Pages. These action updates affect repository automation rather than flag evaluation.

flowchart TD
  A[Repository events] --> B[GitHub workflows]
  B --> C[Code scanning]
  B --> D[SDK package preparation]
  B --> E[Documentation build]
  C --> F[Security results]
  D --> G[SDK publishing]
  E --> H[Pages deployment]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Automation scope	4 action pins across 3 workflows	The patch preserves workflow permissions, triggers, and publishing commands.

Technical review

Best possible solution:

Retain the focused, immutable action-pin updates and existing release and deployment safeguards.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is dependency maintenance, with no reported product bug to reproduce.

Is this the best way to solve the issue?

Yes: updating the existing immutable pins is a focused approach, and the reviewed upstream changes remain compatible with the configured workflows.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 4e172a04b056.

Labels

Label justifications:

• P3: Routine minor and patch action updates have no demonstrated urgent user-facing failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot update is exempt from contributor runtime proof; successful CodeQL checks support scanning compatibility, while SDK publishing and Pages deployment were not exercised by this review.

Evidence

What I checked:

• Exact introduced scope: The pinned base-to-head diff contains four action-reference substitutions across three workflows, with no changes to permissions, triggers, environments, inputs, or publishing commands. (.github/workflows/codeql.yml:31, f88a097a1455)
• Still absent from main and latest release: Main retains CodeQL 4.37.9, pnpm/action-setup 6.0.10, and deploy-pages 5.0.0. The latest release is sdk-v0.0.1; its SDK workflow uses pnpm/action-setup 6.0.9. The proposed update is not already implemented. (.github/workflows/npm-release.yml:30, 4e172a04b056)
• Package-manager compatibility: The v6.1.0 annotated tag resolves to the proposed commit. Its installer preserves packageManager version selection and uses the new native bootstrap only for pnpm 12; Krillswitch declares pnpm 11.24.0. Dependency inspection applies because the SDK preparation workflow directly executes this action. (src/install-pnpm/run.ts:36, ea17c68df891)
• Pages dependency review: The proposed commit matches upstream v5.0.1. The reviewed production change adds bounded polling backoff and jitter; deployment credentials and request authorization are unchanged. Krillswitch directly executes this action with its existing default polling inputs. (src/internal/deployment.js:147, 368f82528645)
• CodeQL dependency provenance: The upstream v4.38.1 annotated tag resolves to the proposed commit used by both init and analyze. Reviewed changes include guarded per-language bundle selection, dependency refreshes, and analysis-status handling; the target retains its existing JavaScript/TypeScript configuration and hosted runner. (src/per-language-bundles.ts:51, 1c5b675653bb)
• Discussion and review continuity: The fetched full body matched captured SHA-256 9cfb29e7e7b15dd37e061e04f79d023af17e0b14eafd4f8bc7e379c65586aad8, including the omitted dependency sections. The prior completed review had no findings or published rank-up moves; GitHub returned no human reviews. Related chore(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1 in the actions group #92 and chore(deps): bump the actions group across 1 directory with 2 updates #94 closed unmerged and do not supersede this update. (f88a097a1455)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)
• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (6 earlier review cycles)

• reviewed 2026-09-11T18:38:52.773Z sha 6ce375d :: needs maintainer review before merge. :: none
• reviewed 2026-09-14T18:42:04.608Z sha 6ce375d :: needs maintainer review before merge. :: none
• reviewed 2026-09-15T18:42:59.526Z sha 100b358 :: needs maintainer review before merge. :: none
• reviewed 2026-09-16T18:40:25.782Z sha 100b358 :: needs maintainer review before merge. :: none
• reviewed 2026-09-17T18:45:03.768Z sha 100b358 :: needs maintainer review before merge. :: none
• reviewed 2026-09-18T18:41:22.588Z sha 100b358 :: needs maintainer review before merge. :: none

[steipete]

Superseded by #87, which includes these four Actions updates with upstream SHA verification and a passing full Crabbox gate. Closing this overlapping batch.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml