[dependabot]

Bumps the actions group with 1 update: github/codeql-action.

Updates github/codeql-action from 4.39.0 to 4.39.1

Release notes

Sourced from github/codeql-action's releases.

v4.39.1

• Update default CodeQL bundle version to 2.27.3. #4256

Changelog

Sourced from github/codeql-action's changelog.

4.39.1 - 21 Oct 2026

• Update default CodeQL bundle version to 2.27.3. #4256

Commits

• 9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
• b5e1ed9 Trigger workflows
• 20f5ec3 Update changelog for v4.39.1
• c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
• 61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
• 3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
• b96e339 Change comment for getConfig call in upload-sarif
• 7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
• a69c7cb Document that setting the env vars to false takes precedence
• 74ddcd9 Fix typo in comment
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e0bf4a8a-48fd-4c62-8b30-7e890cb638ad

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hyperpolymath]

Inbox/CI review, 25 October 2026, head 84ded00416b9a2790b9e70aa89d5bff7b0c9c797.

The two-file CodeQL 4.39.1 update and matching lock entries are narrowly scoped, and the CodeQL run passed. Sonar reports its scoped gate passed. CodeRabbit explicitly skipped the bot-authored PR; that is not a completed review. I have not merged through the other failed gates.

One repository-local CI defect is reproduced from the exact workflow blob 66ca7fb8247903e819735dfa8686f43bc79b2abf: the SPDX checker requires line 1, while gh-actions-lock's generated banner occupies line 1 and the existing licence header is line 2. I prepared this minimal predicate correction without changing any licence declaration:

-            if ! head -1 "$file" | grep -q "^# SPDX-License-Identifier:"; then
+            # gh actions-lock inserts one generated banner before the SPDX line.
+            # Do not accept arbitrary leading comments or a buried licence.
+            if ! awk 'NR == 1 && $0 == "# This workflow is managed by gh actions-lock." { next } { print; exit }' "$file" |
+              grep -q '^# SPDX-License-Identifier:'; then

The error should request preservation of the existing SPDX header, not instruct blanket MPL relicensing. The actual corrected shell step passed two positive/four negative fixtures, bash syntax checking and patch-application checking against the blob above. This is local predicate evidence, NOT full repository CI; the patch has not been committed.

Other failed jobs include stale reusable-workflow references/setup and dogfood; they require their own exact diagnostics. The pinned governance callee 571cc734cd69fb846032ec77a662aa8ee4fc32cd was verified under canonical metadatastician/standards, so do not invent an unreviewed replacement revision or bypass allowlist policy.

CONTRIBUTING.adoc/GOVERNANCE require verified signed commits. I have not appended an unsigned REST-API repair or rewritten this Dependabot branch. Apply the bounded correction through the authorised signing route and recheck all gates before merging. No review thread or failure was falsely resolved.