build(deps): bump the codeql group across 1 directory with 2 updates

[dependabot]

Bumps the codeql group with 2 updates in the / directory: github/codeql-action/init and github/codeql-action/analyze.

Updates github/codeql-action/init from 4.38.1 to 4.38.2

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.2

• Update default CodeQL bundle version to 2.27.1. #4160

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

... (truncated)

Commits

• 2892aa5 Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f
• 8ad03a3 Trigger workflows
• 98af865 Update changelog for v4.38.2
• a6ef2c9 Merge pull request #4156 from github/mario-campos/fix-validate-cmd
• 1ef28a1 Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...
• 26cb08b Merge pull request #4163 from github/mbg/fix-getCommitOid-stubs
• f035ce3 Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...
• 5e4e255 Rebuild
• b13f5f4 Bump ruby/setup-ruby
• c87fe57 Rebuild
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.38.1 to 4.38.2

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.2

• Update default CodeQL bundle version to 2.27.1. #4160

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

... (truncated)

Commits

• 2892aa5 Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f
• 8ad03a3 Trigger workflows
• 98af865 Update changelog for v4.38.2
• a6ef2c9 Merge pull request #4156 from github/mario-campos/fix-validate-cmd
• 1ef28a1 Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...
• 26cb08b Merge pull request #4163 from github/mbg/fix-getCommitOid-stubs
• f035ce3 Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...
• 5e4e255 Rebuild
• b13f5f4 Bump ruby/setup-ruby
• c87fe57 Rebuild
• Additional commits viewable in compare view

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 29, 2026, 10:07 PM ET / September 30, 2026, 02:07 UTC (Revision 3).

ClawSweeper review

What this changes

Updates both CodeQL security-scan steps from 4.38.1 to 4.38.2 and records the dependency update in the unreleased changelog.

Merge readiness

✅ Ready for maintainer review

Keep open. Current main and the latest slacrawl release still use CodeQL 4.38.1, so this update remains useful. The pinned upstream commit matches the 4.38.2 tag, the CodeQL job passed on the current PR head, and no patch defect was found.

Priority: P3
Reviewed head: 097d15eac6c08792516995992cba7af4e2f352e0

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, verified pin update with a successful current-head CodeQL run and no identified patch defect.
Proof confidence	🐚 platinum hermit (4/6)	Not applicable: This bot-authored dependency update is exempt from contributor-run proof; the CodeQL job nevertheless succeeded on the exact PR head after the pin change. No stored-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This bot-authored dependency update is exempt from contributor-run proof; the CodeQL job nevertheless succeeded on the exact PR head after the pin change. No stored-data contract changes.
Evidence reviewed	6 items	Introduced patch: The pinned PR delta changes both CodeQL action references to the same 4.38.2 commit and adds one unreleased changelog entry. Current-main boundary: The workflow on the pinned main parent still uses 4.38.1 for both steps; the verified test-merge delta retains the PR's paired update. Latest release boundary: Release v0.10.1 also uses 4.38.1, so the requested update has not shipped.
Findings	None	None.
Security	None	None.

How this fits together

The CodeQL workflow scans the repository's Go code on pull requests, main-branch pushes, and a schedule. Its initialization and analysis steps produce security-scan results for GitHub.

flowchart LR
  A[Go source and pull request] --> B[CodeQL workflow]
  B --> C[Initialize CodeQL]
  C --> D[Analyze Go code]
  D --> E[GitHub security results]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
CodeQL action pins	2 updated in 1 workflow	Both security-scan steps move together to one verified upstream commit.

Technical review

Best possible solution:

Keep initialization and analysis pinned to the same verified CodeQL release in the Go security workflow.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates a CI dependency rather than reporting a product bug; the changed CodeQL workflow ran successfully on the reviewed head.

Is this the best way to solve the issue?

Yes. Updating the two existing pinned steps together follows the repository's grouped Dependabot configuration and avoids competing CodeQL versions.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against e7b825293f96.

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is a routine, bounded security-tooling dependency update with no observed user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This bot-authored dependency update is exempt from contributor-run proof; the CodeQL job nevertheless succeeded on the exact PR head after the pin change. No stored-data contract changes.

Evidence

What I checked:

• Introduced patch: The pinned PR delta changes both CodeQL action references to the same 4.38.2 commit and adds one unreleased changelog entry. (.github/workflows/codeql.yml:32, 097d15eac6c0)
• Current-main boundary: The workflow on the pinned main parent still uses 4.38.1 for both steps; the verified test-merge delta retains the PR's paired update. (.github/workflows/codeql.yml:32, e7b825293f96)
• Latest release boundary: Release v0.10.1 also uses 4.38.1, so the requested update has not shipped. (.github/workflows/codeql.yml:32, 66a97e2e6346)
• Upstream pin verification: The annotated upstream v4.38.2 tag resolves to the exact commit used by both changed workflow steps. (2892aa5e19bb)
• Current-head validation: The CodeQL check concluded successfully on the exact reviewed head. This validates the changed CI path without implying that every future scheduled run is proven. (.github/workflows/codeql.yml:37, 097d15eac6c0)
• Workflow history and review context: Recent merged workflow history includes coordinated CodeQL updates by Peter Steinberger and the original CodeQL workflow work by Vincent Koc. A collaborator requested a rebase in the discussion, and the supplied current head follows that request. (.github/workflows/codeql.yml, 388197984ffc)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Vincent Koc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-09-27T20:17:20.196Z sha 8698015 :: needs maintainer review before merge. :: none
• reviewed 2026-09-30T01:54:31.157Z sha 602aedd :: needs maintainer review before merge. :: none

[steipete]

@dependabot rebase

[steipete]

Reviewed head 097d15e. Both CodeQL pins match the published v4.38.2 release. Codex review found no actionable P0/P1 findings. Build, tidy, formatting, vet, vulnerability/dead-code/workflow checks, CLI smoke, snapshot packaging, and both full regular and Linux race suites passed. All checks on this final head are green.