Repository navigation
Conversation
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from c20e34f438d671fc35777cc9820dd7adf8252874 to faaca9a8f6edddba5725ffe5adefdab6669a2eca. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c20e34f...faaca9a) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: faaca9a8f6edddba5725ffe5adefdab6669a2eca dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
dependencies
dependabot
Bot
added
github_actions
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
YashasVM
approved these changes
Sep 13, 2026
YashasVM
left a comment
YashasVM
left a comment
Owner
There was a problem hiding this comment.
Yashas's code review bot: Reviewed the CodeQL init action update. The diff only updates the pinned init action, and the exact-head CodeQL matrix plus CI and Security workflows all pass. I found no remaining correctness, security, or merge-blocking issues. This PR is safe to merge.
YashasVM
changed the title
YashasVM
changed the title
YashasVM
changed the title
dependabot
Bot
deleted the
dependabot/github_actions/github/codeql-action/init-faaca9a8f6edddba5725ffe5adefdab6669a2eca
branch
October 12, 2026 16:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The CodeQL dependency update changed only init and left autobuild and analyze on the older release. Align all three on reviewed v3.38.0 commit faaca9a8f6edddba5725ffe5adefdab6669a2eca.
After the npm dependency repairs, the security scan exposed reachable Go standard-library vulnerabilities and vulnerable x/net code. Update Go to 1.26.9 across the module, CI, security, release builds, and README, and update x/net to 0.60.0.
Full-history Gitleaks scanning also identified repeated dummy values in two test-fixture paths. Keep default detection enabled and exempt only the exact reviewed fixture values for generic-api-key at those exact paths.
Validation: Go vet, three full Go test runs, and six Linux/macOS/Windows cross-builds pass. Govulncheck reports no reachable vulnerabilities; an unreachable x/crypto advisory has no fixed release. The focused local route-selection test is flaky on both old and new toolchains; assertions remain unchanged. Explicit Gitleaks directory and full-history scans pass, and a synthetic credential is still detected. YAML parsing and diff checks pass. Fresh GitHub verification, security, and both CodeQL language analyses run on the final commit.