[github-actions]

This PR bumps the version number and updates the changelog after the v4.39.3 release.

Please do the following:

• Approve running the full set of PR checks.
• Approve and merge the PR. When merging the PR, make sure "Create a merge commit" is selected rather than "Squash and merge" or "Rebase and merge".

[Copilot]

🟢 Approval recommended

The release mergeback consistently records v4.39.3 and updates package, lockfile, and generated entry-point versions to 4.39.4 with no active review issues.

No open issues 🎉

What changed in this PR

This mergeback records the v4.39.3 release on main and prepares the repository for development version 4.39.4.

Changes:

• Moves the diff-informed SARIF URI fix into the v4.39.3 changelog.
• Removes the corresponding unreleased change note.
• Bumps package and lockfile versions to 4.39.4.
• Updates the generated action entry point to version 4.39.4.

This pull request is ready to be approved.

File	Description
unreleased-change-notes/​decode-diff-informed-sarif-uris.md	Removes the change note now included in the released changelog.
package.json	Bumps the development version to 4.39.4.
package-lock.json	Synchronizes package metadata with version 4.39.4.
lib/​entry-points.js	Updates the generated action version to 4.39.4.
CHANGELOG.md	Adds the v4.39.3 release entry and its associated fix.

_{Review effort: Lite (auto)}