chore(deps): bump the actions-minor-patch group across 1 directory with 3 updates

[dependabot]

Bumps the actions-minor-patch group with 3 updates in the / directory: github/codeql-action, google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml and dorny/paths-filter.

Updates github/codeql-action from 4.37.5 to 4.37.7

Release notes

Sourced from github/codeql-action's releases.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

Changelog

Sourced from github/codeql-action's changelog.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

Commits

• ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
• 951a133 Update changelog for v4.37.7
• be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
• 9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
• b4d8a54 Rebuild
• ab5db25 Bump the npm-minor group across 1 directory with 8 updates
• 38055a3 Drop logger from databaseInitCluster in interface
• 1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
• dc1b98a Make logger available to getCodeQLForCmd
• 6f0220e Merge pull request #4084 from github/navntoft/bump-undici
• Additional commits viewable in compare view

Updates google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.3.8 to 2.5.1

Release notes

Sourced from google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml's releases.

v2.5.1

This updates OSV-Scanner to v2.3.8.

What's Changed

• Update actions/checkout action to v7 by @​renovate-bot in google/osv-scanner-action#133

Fixes:

• Preserve package namespaces when querying osv.dev API (fixes #2978).
• Re-add support for the OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY environment variable (fixes #2983).
• Fix local vulnerability matching (--offline-vulnerabilities) not working when network capability is NetworkOnline.

Full Changelog: google/osv-scanner-action@v2.5.0...v2.5.1

v2.5.0

This updates OSV-Scanner to v2.5.0 as well as:

What's Changed

• feat: gate reusable workflow outputs with a flag by @​another-rex in google/osv-scanner-action#130
• Pin download-artifact action to SHA by @​SVilgelm in google/osv-scanner-action#127
• feat: add runs-on input to reusable workflows by @​BeyondEvil in google/osv-scanner-action#131
• fix: address zizmor warnings by @​another-rex in google/osv-scanner-action#135
• fix: add GOTOOLCHAIN=auto env to osv-scanner calls by @​another-rex in google/osv-scanner-action#138

New Contributors

• @​SVilgelm made their first contribution in google/osv-scanner-action#127
• @​BeyondEvil made their first contribution in google/osv-scanner-action#131

Full Changelog: google/osv-scanner-action@v2.3.8...v2.5.0

Commits

• 6e4298e Merge pull request #141 from google/update-to-v2.5.1
• 5957b4e Update unified workflow example to point to v2.5.1 reusable workflows
• 880d9b5 Update reusable workflows to point to v2.5.1 actions
• baa4139 "Update actions to use v2.5.1 osv-scanner image"
• f4cfcc0 Merge pull request #117 from renovate-bot/renovate/workflows
• dfd4cd1 Update workflows
• e13f842 Merge pull request #133 from renovate-bot/renovate/major-workflows
• 8deb546 Merge pull request #140 from google/update-to-v2.5.0
• 8fb3f8c Update unified workflow example to point to v2.5.0 reusable workflows
• 0c58c54 Update reusable workflows to point to v2.5.0 actions
• Additional commits viewable in compare view

Updates dorny/paths-filter from 3.0.3 to 3.0.4

Release notes

Sourced from dorny/paths-filter's releases.

v3.0.4

What's Changed

• Backporting fix for: Escape multi-line filenames in list-files shell and csv output

Changelog

Sourced from dorny/paths-filter's changelog.

Changelog

v4.0.3

• Document safe handling of file list outputs in workflows
• Escape multi-line filenames in list-files shell and csv output
• Add 'some-with-excludes' predicate quantifier
• Add contents permission to PR example
• Scope base-ignored warning to API path
• Update outputs in readme to account for the 'every' predicate-quantifier

v4.0.2

• Work around git dubious ownership errors in container jobs
• Use rev-parse instead of branch --show-current for older git compat
• Fix warning message

v4.0.1

• Support merge queue

v4.0.0

• Update action runtime to node24

v3.0.4

• Escape multi-line filenames in list-files shell and csv output

v3.0.3

• Add missing predicate-quantifier

v3.0.2

• Add config parameter for predicate quantifier

v3.0.1

• Compare base and ref when token is empty

v3.0.0

• Update to Node.js 20
• Update all dependencies

v2.11.1

• Update @​actions/core to v1.10.0 - Fixes warning about deprecated set-output
• Document need for pull-requests: read permission
• Updating to actions/checkout@v3

v2.11.0

• Set list-files input parameter as not required
• Update Node.js
• Fix incorrect handling of Unicode characters in exec()
• Use Octokit pagination
• Updates real world links

v2.10.2

... (truncated)

Commits

• 0e4a8c6 Merge commit from fork
• See full diff in compare view

[changeset-bot]

⚠️ No Changeset found

Latest commit: b5ca82e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[tobyhede]

Superseded by #945 (same commit from a maintainer branch). This PR touches only workflow files and still failed the EQL PG17 shards — which is what proved those failures environmental (Dependabot secret-store keyset mismatch). The maintainer PR runs with Actions secrets.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml