build(deps): bump github/codeql-action from 3 to 4#714
Merged
ErikBjare merged 1 commit intoJan 24, 2026
Conversation
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3 to 4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v3...v4) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![ellipsis-dev[bot]](https://avatars.githubusercontent.com/in/64358?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Important
Looks good to me! 👍
Reviewed everything up to 46113e5 in 56 seconds. Click for details.
- Reviewed
23lines of code in1files - Skipped
0files when reviewing. - Skipped posting
3draft comments. View those below. - Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.
1. .github/workflows/codeql.yml:30
- Draft comment:
Updated the CodeQL init action from v3 to v4. Please verify if any configuration or default behavior has changed in v4 that might require adjustments (e.g., parameters or query defaults). - Reason this comment was not posted:
Comment did not seem useful. Confidence is useful =0%<= threshold50%This comment is asking the PR author to verify if any configuration or default behavior has changed in the new version of CodeQL. This falls under the rule of not asking the author to double-check things or ensure behavior is intended. The comment does not provide a specific suggestion or point out a specific issue.
2. .github/workflows/codeql.yml:36
- Draft comment:
Bumped the autobuild action from v3 to v4. Confirm that v4 maintains the same build triggers and doesn't introduce breaking changes to the build process. - Reason this comment was not posted:
Comment did not seem useful. Confidence is useful =0%<= threshold50%This comment is asking the PR author to confirm that the new version of the autobuild action doesn't introduce breaking changes. This falls under the rule of not asking the author to confirm or ensure behavior, which is not allowed.
3. .github/workflows/codeql.yml:39
- Draft comment:
Updated the analyze action from v3 to v4. Please double-check that the new version’s output and configuration (e.g., the category input) work as expected in your workflow. - Reason this comment was not posted:
Comment did not seem useful. Confidence is useful =0%<= threshold50%This comment is asking the PR author to double-check the output and configuration of a version update, which violates the rule against asking the author to confirm or ensure behavior. It does not provide a specific suggestion or point out a specific issue.
Workflow ID: wflow_iswBj2wTCUCxg7Pt
You can customize 
dependabot
Bot
deleted the
dependabot/github_actions/github/codeql-action-4
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps github/codeql-action from 3 to 4.
Release notes
Sourced from github/codeql-action's releases.
... (truncated)
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
a841c54ScratchuploadSpecifiedFilestests, makeuploadPayloadtests insteadaeb12f6Merge branch 'main' into redsun82/skip-sarif-upload-tests6fd4cebMerge pull request #3189 from github/henrymercer/download-codeql-rate-limit196a3e5Merge pull request #3188 from github/mbg/telemetry/partial-config98abb87Add configuration error for rate limited CodeQL downloadbdd2cdfAlso includelanguagein error status report forstart-proxy, if availablefb14878Includelanguagesinstart-proxytelemetry2ff418fParselanguagebefore callinggetCredentialsYou can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Important
Bump
github/codeql-actionfromv3tov4in the CodeQL GitHub Actions workflow.github/codeql-actionfromv3tov4in.github/workflows/codeql.yml.init,autobuild, andanalyzesteps.This description was created by
for 46113e5. You can customize this summary. It will automatically update as commits are pushed.