Skip to content

build(deps): bump github/codeql-action from 3.30.0 to 4.31.7 #1901

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

build(deps): bump github/codeql-action from 3.30.0 to 4.31.7 #1901

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/codeql-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ jobs:

# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v3.30.0
uses: github/codeql-action/init@v4.31.7
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
Expand All @@ -52,7 +52,7 @@ jobs:
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
uses: github/codeql-action/autobuild@v3.30.0
uses: github/codeql-action/autobuild@v4.31.7

# ℹ️ Command-line programs to run using the OS shell.
# 📚 https://git.io/JvXDl
Expand All @@ -66,4 +66,4 @@ jobs:
# make release

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3.30.0
uses: github/codeql-action/analyze@v4.31.7
2 changes: 1 addition & 1 deletion .github/workflows/scorecards-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,6 @@ jobs:

# Upload the results to GitHub's code scanning dashboard.
- name: "Upload to code-scanning"
uses: github/codeql-action/upload-sarif@v3.30.0 # v1.0.26
uses: github/codeql-action/upload-sarif@v4.31.7 # v1.0.26
with:
sarif_file: results.sarif
Comment on lines 57 to 62
Copy link

@sentry sentry bot Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: github/codeql-action@v4+ requires Node.js v24, but workflows use Node.js v20 by default, causing failures.
Severity: CRITICAL | Confidence: High

🔍 Detailed Analysis

The github/codeql-action@v4.31.7 requires Node.js v24, but the GitHub Actions ubuntu-latest runner defaults to Node.js v20 as of December 2025. Without an explicit actions/setup-node step to specify node-version: 24, the CodeQL initialization, autobuild, analyze, and upload steps will fail. This will prevent the workflows from completing successfully.

💡 Suggested Fix

Add actions/setup-node with node-version: 24 to the workflow files before the CodeQL steps, or defer the upgrade to github/codeql-action@v4+ until after March 4, 2026.

🤖 Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: .github/workflows/scorecards-analysis.yml#L57-L62

Potential issue: The `github/codeql-action@v4.31.7` requires Node.js v24, but the GitHub
Actions `ubuntu-latest` runner defaults to Node.js v20 as of December 2025. Without an
explicit `actions/setup-node` step to specify `node-version: 24`, the CodeQL
initialization, autobuild, analyze, and upload steps will fail. This will prevent the
workflows from completing successfully.

Did we get this right? 👍 / 👎 to inform future reviews.
Reference ID: 6033426

Loading