build(deps): bump github/codeql-action from 3.30.0 to 4.30.9#1886
build(deps): bump github/codeql-action from 3.30.0 to 4.30.9#1886dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.30.0 to 4.30.9. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v3.30.0...v4.30.9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.30.9 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1886 +/- ##
=======================================
Coverage 97.14% 97.14%
=======================================
Files 2 2
Lines 35 35
=======================================
Hits 34 34
Misses 1 1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
![seer-by-sentry[bot]](https://avatars.githubusercontent.com/in/801464?s=60&v=4){kind=small}
| @@ -41,7 +41,7 @@ jobs: | |||
|
|
|||
| # Initializes the CodeQL tools for scanning. | |||
| - name: Initialize CodeQL | |||
There was a problem hiding this comment.
Potential bug: The codeql-action@v4 upgrade requires Node.js v24, which may not be available on all ubuntu-latest runners, potentially causing workflow failures.
-
Description: The upgrade of
github/codeql-actionto v4 introduces a requirement for Node.js v24. The workflow is configured to useruns-on: ubuntu-latest. However, theubuntu-latestrunner environment is undergoing a gradual migration and may not yet have Node.js v24 installed by default. This mismatch can cause the CodeQL workflow to fail with a runtime error if it executes on a runner instance that lacks the required Node.js version. -
Suggested fix: Explicitly configure the GitHub Actions runner environment to use Node.js v24. Add a
setup-nodestep before thecodeql-action/initstep, for example:- uses: actions/setup-node@v4 with: node-version: '24'. This will ensure the required runtime is available before the CodeQL action runs.
severity: 0.65, confidence: 0.9
Did we get this right? 👍 / 👎 to inform future reviews.
|
Superseded by #1888. |
dependabot
bot
deleted the
dependabot/github_actions/github/codeql-action-4.30.9
branch
Bumps github/codeql-action from 3.30.0 to 4.30.9.
Release notes
Sourced from github/codeql-action's releases.
... (truncated)
Changelog
Sourced from github/codeql-action's changelog.
Commits
16140aeMerge pull request #3213 from github/update-v4.30.9-70205d3d130db5feUpdate changelog for v4.30.970205d3Merge pull request #3211 from github/mbg/init/starting-partial-config697c209Merge remote-tracking branch 'origin/main' into mbg/init/starting-partial-config1bd53baMerge pull request #3205 from github/update-bundle/codeql-bundle-v2.23.3cac4df0Rebuild77e5c0dMerge branch 'main' into update-bundle/codeql-bundle-v2.23.397a4f75Merge pull request #3204 from github/mbg/setup-codeql2d5512bMerge remote-tracking branch 'origin/main' into mbg/init/starting-partial-configfa7bdf0CallgetAnalysisKindsa second time, and ignore exceptions thrown during th...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)