build(deps): bump github/codeql-action from 4.37.4 to 4.37.6

[dependabot]

Bumps github/codeql-action from 4.37.4 to 4.37.6.

Release notes

Sourced from github/codeql-action's releases.

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action's changelog.

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Commits

• 5595cca Merge pull request #4071 from github/update-v4.37.6-6a9359a1b
• ec9c757 Add change note for PR 4070
• 45c8742 Update changelog for v4.37.6
• 6a9359a Merge pull request #4070 from github/mbg/remote-address/change-file-default
• 065cdc0 Change DEFAULT_CONFIG_FILE_NAME
• f99dd5a Merge pull request #4066 from github/dependabot/npm_and_yarn/js-yaml-5.2.2
• 1804b21 Merge pull request #4068 from github/mergeback/v4.37.5-to-main-d1ba80a1
• 3020a2f Rebuild
• 93c3a5a Update changelog and version after v4.37.5
• d1ba80a Merge pull request #4067 from github/update-v4.37.5-1cd4d01d5
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
.github/workflows/codeql-analysis.yml	0% smaller

[what-the-diff]

PR Summary

• Updated CodeQL Action Versions
  This PR updates the version of CodeQL, a tool we use to automatically detect security vulnerabilities in our code. The versions have been upgraded from v4.37.4 to v4.37.6 which helps in improving its performance and detecting potential vulnerabilities more effectively. This upgrade happened in three steps: initialization of CodeQL, automatic building of this tool, and then performing the CodeQL analysis on our codebase. This ensures our application remains secure against potential threats.

[github-actions]

Failed to generate code suggestions for PR

[codescene-access]

No application code in the PR — skipped Code Health checks.

See analysis details in CodeScene

Quality Gate Profile: Customizable Safeguards
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[llamapreview]

LlamaPReview — No blocking issues found

This is a patch-level bump of CodeQL action pins (v4.37.4 → v4.37.6) in one workflow, with no behavioral change to inputs or permissions; safe to merge.

Change flow

The bump only changes version pins in a CodeQL workflow that does not run on this PR head, so the new version is first exercised on the next push to develop after merge.

sequenceDiagram
participant PR as Pull Request (develop)
participant Push as Push to develop
participant WF as CodeQL workflow
participant CodeQL as github/codeql-action
PR-->>WF: pull_request (target: main)<br/>- not triggered
Push->>WF: push to develop
WF->>WF: init (executes @v4.37.6)<br/>note over WF,CodeQL: PR change — bump v4.37.4 to v4.37.6
WF->>WF: autobuild (@v4.37.6)
WF->>CodeQL: analyze (@v4.37.6)
CodeQL-->>WF: findings
WF-->>Push: result

Loading

Review details and evidence

Material unknowns

• The root cause of the four failed CI checks (static-tests 3.14 and test-coverage 3.14, each twice) and pre-commit.ci is unknown; no supplied log ties them to this delta. If the failures are later shown to be caused by the bumped CodeQL action, the merge posture would need to change to blocking.
  • Check: Monitor the CI logs after merge and confirm the CodeQL workflow runs successfully on the next push to develop.

LlamaPReview checks

• Read the complete PR-head file .github/workflows/codeql-analysis.yml.
• Reviewed changed regions in .github/workflows/codeql-analysis.yml.

---

Automated review by LlamaPReview · Free for public open-source projects.