From 3304604b121f1688d7fb0e26393c0bb2fa230573 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sun, 1 Nov 2026 01:10:56 +0000
Subject: [PATCH] chore(deps): update github/codeql-action action to v4.39.1

---
 .github/workflows/codeql.yml      | 4 ++--
 .github/workflows/osv-scanner.yml | 2 +-
 .github/workflows/semgrep-pro.yml | 2 +-
 .github/workflows/semgrep.yml     | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0f66c5e9..459e1053 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -38,7 +38,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: ${{ matrix.language }}
           build-mode: none
@@ -48,4 +48,4 @@ jobs:
           # https://docs.github.com/en/code-security/reference/code-scanning/workflow-configuration-options#extending-codeql-coverage-with-threat-models
           config: |
             threat-models: local
-      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index 00721308..eae6acb8 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -49,7 +49,7 @@ jobs:
             --format=sarif --output=/out/results.sarif -r . || rc=$?
           echo "rc=$rc" >> "$GITHUB_OUTPUT"
           [ "$rc" -le 1 ] || { echo "::error::osv-scanner exited $rc (127=error, 128=no packages, 129=OSV API failure, 130=invalid config; 125-127 may also be docker)"; exit "$rc"; }
-      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: ${{ runner.temp }}/osv/results.sarif
           category: osv-scanner
diff --git a/.github/workflows/semgrep-pro.yml b/.github/workflows/semgrep-pro.yml
index 9a0cd145..32d3781e 100644
--- a/.github/workflows/semgrep-pro.yml
+++ b/.github/workflows/semgrep-pro.yml
@@ -36,7 +36,7 @@ jobs:
         env:
           # zizmor: ignore[secrets-outside-env]
           SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
-      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         if: ${{ !cancelled() }}
         with:
           sarif_file: semgrep.sarif
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 06565b9d..3c6b6504 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -34,7 +34,7 @@ jobs:
       - run: semgrep ci --sarif-output=semgrep.sarif
         env:
           SEMGREP_RULES: p/default p/owasp-top-ten p/cwe-top-25 p/gitleaks p/r2c-security-audit
-      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         if: ${{ !cancelled() }}
         with:
           sarif_file: semgrep.sarif