From 103c90e1b2d37ec50b6b5acaf36d944c749ce4bb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2026 12:07:18 +0000 Subject: [PATCH 1/2] Bump github/codeql-action/init from 4.38.2 to 4.39.0 Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.38.2 to 4.39.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql-analysis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index b559f1b..a6dcab0 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -36,7 +36,7 @@ jobs: install_args: --locked - name: Initialize CodeQL - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 + uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4 with: languages: go build-mode: manual From 17ddd6adaa11059470c866303aa8890a1d8770b0 Mon Sep 17 00:00:00 2001 From: Gregor Noczinski Date: Mon, 19 Oct 2026 14:14:11 +0200 Subject: [PATCH 2/2] Synchronize CodeQL actions and group Dependabot updates --- .github/dependabot.yml | 8 +++++++- .github/workflows/codeql-analysis.yml | 2 +- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 609155f..223eb7b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,9 +5,15 @@ updates: schedule: interval: "daily" groups: + # CodeQL sub-actions must use the same version. codeql-actions: + applies-to: "version-updates" + patterns: + - "github/codeql-action/*" + codeql-actions-security: + applies-to: "security-updates" patterns: - - "github/codeql-action" + - "github/codeql-action/*" - package-ecosystem: "gomod" directories: diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index a6dcab0..0f3d977 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -45,4 +45,4 @@ jobs: run: mise run test:go:build - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 + uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4