From 4b328a7b7f56c58371d41ab6261f879e187698bb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:29:19 +0000 Subject: [PATCH 1/4] build(deps): Bump github/codeql-action/init from 4.36.3 to 4.37.3 Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.36.3 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c801cae..b8d1d77 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -35,7 +35,7 @@ jobs: - name: Initialize CodeQL if: github.actor != 'dependabot[bot]' - uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 + uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: languages: python # Security queries only. The "security-and-quality" suite also runs From a6b5df51f212cd0afd0652e0b7aa724ae83f558f Mon Sep 17 00:00:00 2001 From: Joel Stenberg Date: Wed, 22 Jul 2026 20:36:56 +0200 Subject: [PATCH 2/4] fix(ci): drop --refresh from the lockfile header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The lockfile-drift check in CI regenerates requirements.lock with the canonical command and diffs it. The lock landed in #155 was generated with an extra --refresh flag, which uv records in the header comment — so every 'Lockfile is up to date' step failed on that one line. Regenerated with the canonical command; only the header changes. Co-Authored-By: Claude Opus 4.8 --- requirements.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.lock b/requirements.lock index cdcbfe2..10f496e 100644 --- a/requirements.lock +++ b/requirements.lock @@ -1,5 +1,5 @@ # This file was autogenerated by uv via the following command: -# uv pip compile pyproject.toml --extra server --python-version 3.12 --universal --generate-hashes --refresh -o requirements.lock +# uv pip compile pyproject.toml --extra server --python-version 3.12 --universal --generate-hashes -o requirements.lock annotated-doc==0.0.4 \ --hash=sha256:571ac1dc6991c450b25a9c2d84a3705e2ae7a53467b5d111c24fa8baabbed320 \ --hash=sha256:fbcda96e87e9c92ad167c2e53839e57503ecfda18804ea28102353485033faa4 From 99cb2907a77ae4986f72c9e64009f0b7cd21b177 Mon Sep 17 00:00:00 2001 From: Joel Stenberg Date: Wed, 22 Jul 2026 20:46:26 +0200 Subject: [PATCH 3/4] build(deps): group codeql-action updates so init and analyze move together codeql-action/init and codeql-action/analyze are separate Dependabot update paths, so ungrouped they arrive as two PRs and land at different versions. CodeQL then fails the SARIF upload ('Error when processing the SARIF file') until the pair is realigned by hand. Co-Authored-By: Claude Opus 4.8 --- .github/dependabot.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ca3f4fd..56baa5e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -25,3 +25,10 @@ updates: directory: / schedule: interval: weekly + groups: + # codeql-action/init and codeql-action/analyze are separate update paths, + # so ungrouped Dependabot files one PR each — and CodeQL fails the SARIF + # upload whenever the two land on different versions. Group them so they + # always move together in a single PR. + codeql-action: + patterns: ["github/codeql-action*"] From 87c751cd6c7195b2e38c35017ab924706a568a25 Mon Sep 17 00:00:00 2001 From: Joel Stenberg Date: Wed, 22 Jul 2026 20:50:13 +0200 Subject: [PATCH 4/4] build(deps): bump codeql-action/analyze to 4.37.3 to match init CodeQL fails the SARIF upload when init and analyze run different versions ('Loaded a configuration file for version 4.37.3, but running version 4.37.2'). Dependabot bumped init only; this realigns analyze. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b8d1d77..b7a3ce3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -46,4 +46,4 @@ jobs: - name: Perform CodeQL analysis if: github.actor != 'dependabot[bot]' - uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2 + uses: github/codeql-action/analyze@c54b30b7df092240050e69945842bc67aee0f0f4 # v4.37.3