From 50869d51e9c80d3ba3034963e21f09f3b44df743 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2026 23:45:45 +0000
Subject: [PATCH 1/2] fix(deps): bump github/codeql-action/upload-sarif from
 4.38.3 to 4.39.0

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.38.3 to 4.39.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/rg-security.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/rg-security.yml b/.github/workflows/rg-security.yml
index a7e24ff..c240d9c 100644
--- a/.github/workflows/rg-security.yml
+++ b/.github/workflows/rg-security.yml
@@ -55,7 +55,7 @@ jobs:
             --lockfile=${{ inputs.lockfile }}
             --format=sarif
             --output=osv-results.sarif
-      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+      - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         if: always() && hashFiles('osv-results.sarif') != ''
         with:
           sarif_file: osv-results.sarif

From f623d72ec5abef9d4c2b52a7d69d961ce4d336d3 Mon Sep 17 00:00:00 2001
From: daedalus-omt <268206840+daedalus-omt@users.noreply.github.com>
Date: Tue, 20 Oct 2026 00:28:20 +0000
Subject: [PATCH 2/2] fix(ci): keep CodeQL v4.39.0 subactions in strict
 lockstep

Append to canonical268 Dependabot upload update; align init and analyze
at official6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee.
Reuse the landed271 shared positive helper unchanged except exact pins;
refresh mixed and floating-tag negative controls to the new release.
Retain ordered pin equality, singleton Set, count and subaction identities.
Preserve source bot commit and merged Daedalus/OpenAI provenance as ancestors.
PR272 is an independent OSV update and is not included.

AI-Provider: OpenAI
AI-Model: openai/gpt-6.1-sol
Configured-Effort: HIGH (parent and prior same-session receipt; not provider-attested)
Signed-off-by: daedalus-omt <268206840+daedalus-omt@users.noreply.github.com>
---
 .github/workflows/rg-security.yml |  4 ++--
 test/security-workflow.test.ts    | 12 ++++++------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/rg-security.yml b/.github/workflows/rg-security.yml
index c240d9c..0d3d571 100644
--- a/.github/workflows/rg-security.yml
+++ b/.github/workflows/rg-security.yml
@@ -39,10 +39,10 @@ jobs:
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+      - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with:
           languages: ${{ inputs.codeql-languages }}
-      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+      - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
       - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         if: inputs.enable-dependency-review && github.event_name == 'pull_request'
         with:
diff --git a/test/security-workflow.test.ts b/test/security-workflow.test.ts
index 8dbb707..9457440 100644
--- a/test/security-workflow.test.ts
+++ b/test/security-workflow.test.ts
@@ -13,9 +13,9 @@ function expectCodeqlPins(rgSecuritySteps: WorkflowStep[]) {
     .filter((uses): uses is string => uses?.startsWith("github/codeql-action/") ?? false)
     .map((uses) => uses.split("@")[1]);
   expect(codeqlActionVersions).toEqual([
-    "24c54180a607b1449ed407dd24f251e4e9147c8d",
-    "24c54180a607b1449ed407dd24f251e4e9147c8d",
-    "24c54180a607b1449ed407dd24f251e4e9147c8d"
+    "6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee",
+    "6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee",
+    "6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee"
   ]);
 
   const codeqlSteps = rgSecuritySteps.filter((step): step is { uses: string } =>
@@ -25,7 +25,7 @@ function expectCodeqlPins(rgSecuritySteps: WorkflowStep[]) {
   expect(codeqlVersions).toHaveLength(3);
   expect(new Set(codeqlVersions)).toEqual(
     new Set([
-      "24c54180a607b1449ed407dd24f251e4e9147c8d"
+      "6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee"
     ])
   );
   expect(codeqlSteps.map((step) => step.uses?.split("@")[0])).toEqual([
@@ -50,9 +50,9 @@ describe("security and reusable workflows", () => {
       } else if (mutation === "missing") {
         steps.splice(1, 1);
       } else if (mutation === "mixed") {
-        steps[1].uses = steps[1].uses!.replace(/@.*/, "@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2");
+        steps[1].uses = steps[1].uses!.replace(/@.*/, "@24c54180a607b1449ed407dd24f251e4e9147c8d");
       } else if (mutation === "tag") {
-        for (const step of steps) step.uses = step.uses!.replace(/@.*/, "@v4.38.3");
+        for (const step of steps) step.uses = step.uses!.replace(/@.*/, "@v4.39.0");
       } else {
         steps[1].uses = steps[0].uses;
       }