[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
github/codeql-action	action	patch	v4.39.1 → v4.39.2	v4.39.3

---

Release Notes

github/codeql-action

v4.39.2

Compare Source

• Update default CodeQL bundle version to 2.27.4. #​4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #​4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #​4243

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The Scorecard workflow updates the pinned github/codeql-action/upload-sarif version from v4.39.1 to v4.39.2.

Changes: Scorecard Workflow

Layer / File(s)	Summary
Update SARIF upload action version .github/workflows/scorecards.yml	The SARIF upload step now uses github/codeql-action/upload-sarif v4.39.2 instead of v4.39.1.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: acepresso, bohdanmar

Merge Risk: Minimal · up to 31bef

The workflow updates the SARIF upload action; no actionable merge-blocking risk is established.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title states that the github/codeql-action action is updated to v4.39.2 on main. The changeset updates the pinned upload-sarif version from v4.39.1 to v4.39.2 in the Scorecard workflow. The title …
Description check		The description covers the Renovate-generated update from github/codeql-action v4.39.1 to v4.39.2. It lists the release notes for v4.39.2, which match the version bump in the changeset. It is related …
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title states that the github/codeql-action action is updated to v4.39.2 on main. The changeset updates the pinned upload-sarif version from v4.39.1 to v4.39.2 in the Scorecard workflow. The title names the same action and version as the change. It is specific and accurate, though the change is a single-line version pin in one workflow file.

Full details: Description check

Explanation

The description covers the Renovate-generated update from github/codeql-action v4.39.1 to v4.39.2. It lists the release notes for v4.39.2, which match the version bump in the changeset. It is related to the changeset.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 1da5832a-eed6-4488-b3a6-ea9319895441

Commits

Reviewing files that changed from the base of the PR and between 9052373 and 31bef0c.

Files selected for processing: 1

• .github/workflows/scorecards.yml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 7 remain after this review.