chore(deps): Bump github/codeql-action/init from 4.39.0 to 4.39.1 by dependabot[bot] · Pull Request #406 · EvilBit-Labs/Stringy

dependabot · 2026-10-28T06:56:11Z

Bumps github/codeql-action/init from 4.39.0 to 4.39.1.

Release notes

Sourced from github/codeql-action/init's releases.

v4.39.1

Update default CodeQL bundle version to 2.27.3. #4256

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.1 - 21 Oct 2026

Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148

Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206

The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits

9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
b5e1ed9 Trigger workflows
20f5ec3 Update changelog for v4.39.1
c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
b96e339 Change comment for getConfig call in upload-sarif
7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
a69c7cb Document that setting the env vars to false takes precedence
74ddcd9 Fix typo in comment
Additional commits viewable in compare view

mergify · 2026-10-28T06:56:49Z

mergify

Automatically approved by Mergify

mergify · 2026-10-28T07:46:01Z

🚫 Left the queue

22 min in the queue, with no time running CI.

So far

✅ Entered the queue Wed 28 Oct, 07:46 · rule dependabot · triggered by merge protections
⏹️ Testing stopped · draft merge queue: checking #406 on main (7280a6f), stacked on 4 pull requests ahead #414
🚫 Left the queue 08:08 · c99954c

Reason

The pull request #406 has been manually updated

Merge conditions: 13 of 15 met

This pull request

	Condition	Required by
✅	`github-code-owner-review-satisfied`	GitHub repository ruleset rule `main`
✅	`github-review-approved`	GitHub repository ruleset rule `main` and GitHub repository ruleset rule `ossf_best_practices`
✅	`#commits-behind <= 10`	Merge Protections rule `Do not merge outdated PRs`

The batch, tested on draft #414

	Condition	Required by
❌	`check-success = coverage`	Merge Protections rule `Full CI must pass`
❌	`check-success = test-cross-platform (windows-latest, Windows)`	Merge Protections rule `Full CI must pass`
✅	`check-success = msrv (stable minus 1 releases)`	Merge Protections rule `Full CI must pass`
✅	`check-success = msrv (stable minus 2 releases)`	Merge Protections rule `Full CI must pass`
✅	`check-success = msrv (stable minus 3 releases)`	Merge Protections rule `Full CI must pass`
✅	`check-success = msrv (stable minus 4 releases)`	Merge Protections rule `Full CI must pass`
✅	`check-success = msrv (stable)`	Merge Protections rule `Full CI must pass`
✅	`check-success = quality`	Merge Protections rule `Full CI must pass`
✅	`check-success = test`	Merge Protections rule `Full CI must pass`
✅	`check-success = test-cross-platform (macos-latest, macOS)`	Merge Protections rule `Full CI must pass`
✅	`check-success = test-cross-platform (ubuntu-latest, Linux)`	Merge Protections rule `Full CI must pass`
✅	any of: `check-neutral = @mergify/Mergify Merge Protections`, `check-skipped = @mergify/Mergify Merge Protections`, `check-success = @mergify/Mergify Merge Protections`	GitHub repository ruleset rule `main`

Requeued — the merge queue status continues in this comment ↓.

_{Times in UTC · dashboard · how the merge queue works}

Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.39.0 to 4.39.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@6f2ac81...9b32540) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…on/init-4.39.1

mergify · 2026-10-28T08:47:07Z

✅ Merged into `main` as `c159acf` at 09:21 UTC

35 min in the queue, 32 min of it CI.

So far

✅ Entered the queue Wed 28 Oct, 08:47 · rule dependabot · triggered by merge protections
✅ Passed · draft merge queue: checking #406 on main (6c1ea1a), stacked on #409 #416
✅ Merged 09:21 · c159acf · squash

Merge conditions: 15 of 15 met

This pull request

	Condition	Required by
✅	`github-code-owner-review-satisfied`	GitHub repository ruleset rule `main`
✅	`github-review-approved`	GitHub repository ruleset rule `main` and GitHub repository ruleset rule `ossf_best_practices`
✅	`#commits-behind <= 10`	Merge Protections rule `Do not merge outdated PRs`

The batch, tested on draft #416

	Condition	Required by
✅	`check-success = coverage`	Merge Protections rule `Full CI must pass`
✅	`check-success = msrv (stable minus 1 releases)`	Merge Protections rule `Full CI must pass`
✅	`check-success = msrv (stable minus 2 releases)`	Merge Protections rule `Full CI must pass`
✅	`check-success = msrv (stable minus 3 releases)`	Merge Protections rule `Full CI must pass`
✅	`check-success = msrv (stable minus 4 releases)`	Merge Protections rule `Full CI must pass`
✅	`check-success = msrv (stable)`	Merge Protections rule `Full CI must pass`
✅	`check-success = quality`	Merge Protections rule `Full CI must pass`
✅	`check-success = test`	Merge Protections rule `Full CI must pass`
✅	`check-success = test-cross-platform (macos-latest, macOS)`	Merge Protections rule `Full CI must pass`
✅	`check-success = test-cross-platform (ubuntu-latest, Linux)`	Merge Protections rule `Full CI must pass`
✅	`check-success = test-cross-platform (windows-latest, Windows)`	Merge Protections rule `Full CI must pass`
✅	any of: `check-neutral = @mergify/Mergify Merge Protections`, `check-skipped = @mergify/Mergify Merge Protections`, `check-success = @mergify/Mergify Merge Protections`	GitHub repository ruleset rule `main`

_{Times in UTC · dashboard · how the merge queue works}

codecov · 2026-10-28T08:47:28Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 28, 2026

mergify Bot approved these changes Oct 28, 2026

View reviewed changes

mergify Bot added the queued label Oct 28, 2026

mergify Bot mentioned this pull request Oct 28, 2026

merge queue: checking #406 on main (7280a6f), stacked on 4 pull requests ahead #414

Closed

46 of 55 tasks

dependabot Bot force-pushed the dependabot/github_actions/github/codeql-action/init-4.39.1 branch from c99954c to 8479a1d Compare October 28, 2026 08:07

Merge branch 'main' into dependabot/github_actions/github/codeql-acti…

803da58

…on/init-4.39.1

mergify Bot removed the queued label Oct 28, 2026

mergify Bot added the queued label Oct 28, 2026

This was referenced Oct 28, 2026

merge queue: checking #406 on main (6c1ea1a), stacked on #409 #416

Closed

chore(deps): Bump github/codeql-action/upload-sarif from 4.39.0 to 4.39.1 #407

Merged

mergify Bot merged commit c159acf into main Oct 28, 2026
29 checks passed

mergify Bot deleted the dependabot/github_actions/github/codeql-action/init-4.39.1 branch October 28, 2026 09:21

mergify Bot removed the queued label Oct 28, 2026

Navigation Menu

Repository navigation

chore(deps): Bump github/codeql-action/init from 4.39.0 to 4.39.1 - #406

chore(deps): Bump github/codeql-action/init from 4.39.0 to 4.39.1#406
mergify[bot] merged 2 commits into
mainfrom
dependabot/github_actions/github/codeql-action/init-4.39.1

dependabot Bot commented on behalf of github Oct 28, 2026 •

edited

Loading

Uh oh!

mergify Bot commented Oct 28, 2026 •

edited

Loading

🟢 Full CI must pass

🟢 Do not merge outdated PRs

🟢 🚦 Auto-queue

Uh oh!

mergify Bot left a comment

Uh oh!

mergify Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

mergify Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Oct 28, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.39.1

CodeQL Action Changelog

[UNRELEASED]

4.39.1 - 21 Oct 2026

4.39.0 - 15 Oct 2026

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

4.37.9 - 26 Aug 2026

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

Uh oh!

mergify Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Protections

🟢 Full CI must pass

🟢 Do not merge outdated PRs

🟢 🚦 Auto-queue

Uh oh!

mergify Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mergify Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚫 Left the queue

Uh oh!

mergify Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Merged into main as c159acf at 09:21 UTC

Uh oh!

codecov Bot commented Oct 28, 2026

Codecov Report

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 28, 2026 •

edited

Loading

mergify Bot commented Oct 28, 2026 •

edited

Loading

mergify Bot commented Oct 28, 2026 •

edited

Loading

mergify Bot commented Oct 28, 2026 •

edited

Loading

✅ Merged into `main` as `c159acf` at 09:21 UTC