Skip to content

chore(deps): update github/codeql-action action to v4.39.0 - #219

Merged
sir-gon merged 1 commit into
mainfrom
renovate/github-codeql-action-4.x
Oct 15, 2026
Merged

chore(deps): update github/codeql-action action to v4.39.0#219
sir-gon merged 1 commit into
mainfrom
renovate/github-codeql-action-4.x

Conversation

@renovate

@renovate renovate Bot commented Oct 15, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
github/codeql-action action minor v4.38.3 → v4.39.0

Release Notes

github/codeql-action

v4.39.0

Compare Source

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@fossabot

fossabot Bot commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown

✓ Safe to upgrade

I recommend merging this upgrade because the one breaking change introduced — bumping the minimum required CodeQL bundle version — does not affect this repository. The codebase uses github/codeql-action in three workflows: hadolint.yml (pinned to the new target version for upload-sarif), codeql.yml (using the floating @​v4 major-version tag for init and analyze), and docker-image.yml (using @​v4 for upload-sarif). None of these workflows pin a custom CodeQL bundle via the tools: parameter, so the action's own bundled, up-to-date CodeQL tooling is used automatically — always satisfying the new minimum. The upload-sarif action does not invoke a CodeQL bundle at all, making the minimum-version constraint entirely irrelevant to those steps. The upgrade additionally delivers one new feature and two bug fixes with no further compatibility concerns detected.

What we checked

  • Primary versioned usage of github/codeql-action/upload-sarif@​v4.39.0 — already updated to the new target version by this PR. This action only uploads SARIF output; it does not invoke a CodeQL bundle, so the minimum-bundle-version breaking change does not apply here. [1]
  • github/codeql-action/init@​v4 is used without a tools: parameter, meaning the action selects its own bundled CodeQL tooling automatically. No custom (potentially old) bundle is pinned, so the new minimum bundle requirement of 2.20.7 is not a concern. [2]
  • github/codeql-action/analyze@​v4 likewise uses no pinned tools: version, confirming the workflow relies on the action's default, always-compatible bundle. [3]
  • github/codeql-action/upload-sarif@​v4 used for SARIF upload only. As with the Hadolint workflow, this step does not use a CodeQL bundle and is unaffected by the breaking change. [4]
  • The breaking change in this release enforces a minimum CodeQL bundle version of 2.20.7. This only impacts workflows that explicitly pin an older bundle via the tools: input — which this repository does not do. [5]
  • Deprecation of CodeQL versions 2.21.2 and earlier was announced in v4.38.3 (the prior version). The upgrade to v4.39.0 finalises that deprecation. Since the repository uses the default bundle, it is not pinned to any deprecated version. [6]

Dependency Usage

No usage of the analyzed dependencies was found in this repository.

  • Primary versioned usage of github/codeql-action/upload-sarif@​v4.39.0 — already updated to the new target version by this PR. This action only uploads SARIF output; it does not invoke a CodeQL bundle, so the minimum-bundle-version breaking change does not apply here.

    algorithm-exercises-cpp/.github/workflows/hadolint.yml

    Line 57 in c3bae17

    uses: github/codeql-action/upload-sarif@v4.39.0
  • github/codeql-action/init@​v4 is used without a tools: parameter, meaning the action selects its own bundled CodeQL tooling automatically. No custom (potentially old) bundle is pinned, so the new minimum bundle requirement of 2.20.7 is not a concern.

    algorithm-exercises-cpp/.github/workflows/codeql.yml

    Line 101 in c3bae17

    uses: github/codeql-action/init@v4
View 2 more usages

Changes

github/codeql-action was updated with a breaking change that raises the minimum required CodeQL bundle version — workflows using older bundles will fail. Two bug fixes are also included: one resolving cache restoration failures with third-party caching implementations, and another ensuring codeql-action/start-proxy correctly locates CodeQL releases on non-github.com GitHub instances.

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205 (v4.39.0, changelog)
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206 (v4.39.0, changelog)
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. [#4198](https://redirect.github.... (v4.39.0, changelog)
View 1 more change
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. [#4148](https://redirect.... (v4.39.0, changelog)
References (6)

[1]: Primary versioned usage of github/codeql-action/upload-sarif@​v4.39.0 — already updated to the new target version by this PR. This action only uploads SARIF output; it does not invoke a CodeQL bundle, so the minimum-bundle-version breaking change does not apply here.

algorithm-exercises-cpp/.github/workflows/hadolint.yml

Line 57 in c3bae17

uses: github/codeql-action/upload-sarif@v4.39.0

[2]: github/codeql-action/init@​v4 is used without a tools: parameter, meaning the action selects its own bundled CodeQL tooling automatically. No custom (potentially old) bundle is pinned, so the new minimum bundle requirement of 2.20.7 is not a concern.

algorithm-exercises-cpp/.github/workflows/codeql.yml

Line 101 in c3bae17

uses: github/codeql-action/init@v4

[3]: github/codeql-action/analyze@​v4 likewise uses no pinned tools: version, confirming the workflow relies on the action's default, always-compatible bundle.

algorithm-exercises-cpp/.github/workflows/codeql.yml

Line 126 in c3bae17

uses: github/codeql-action/analyze@v4

[4]: github/codeql-action/upload-sarif@​v4 used for SARIF upload only. As with the Hadolint workflow, this step does not use a CodeQL bundle and is unaffected by the breaking change.

algorithm-exercises-cpp/.github/workflows/docker-image.yml

Line 310 in c3bae17

uses: github/codeql-action/upload-sarif@v4

[5]: The breaking change in this release enforces a minimum CodeQL bundle version of 2.20.7. This only impacts workflows that explicitly pin an older bundle via the tools: input — which this repository does not do. (source link)

[6]: Deprecation of CodeQL versions 2.21.2 and earlier was announced in v4.38.3 (the prior version). The upgrade to v4.39.0 finalises that deprecation. Since the repository uses the default bundle, it is not pinned to any deprecated version. (source link)

fossabot analyzed this PR using dependency research and AI. View this analysis on the web

@fossabot

fossabot Bot commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown

fossabot is Thinking

@fossabot

fossabot Bot commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown

fossabot is Thinking

@fossabot

fossabot Bot commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown

No Issues

No application code changes were detected to scan. The PR contains only configuration files, documentation, or other non-code files.

fossabot analyzed this PR using SAST security analysis and AI (changed files only).

@sonarqubecloud

sonarqubecloud Bot commented Oct 15, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@codecov

codecov Bot commented Oct 15, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (f3b077b) to head (c3bae17).

Additional details and impacted files 
@@            Coverage Diff            @@
##              main      #219   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           14        14           
  Lines          197       197           
  Branches        70        70           
=========================================
  Hits           197       197

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@sir-gon
sir-gon merged commit ad99f80 into main Oct 15, 2026
53 checks passed
@renovate
renovate Bot deleted the renovate/github-codeql-action-4.x branch October 15, 2026 17:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@sir-gon