deps(actions): bump github/codeql-action/init from 4.35.5 to 4.37.1#199
deps(actions): bump github/codeql-action/init from 4.35.5 to 4.37.1#199dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.35.5 to 4.37.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@9e0d7b8...7188fc3) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![datadog-datadog-prod-us1-2[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
There was a problem hiding this comment.
Security scan job will fail at runtime when analyze@v4.35.5 tries to process a CodeQL database created by init@v4.37.1. The analyze step may crash or produce incomplete results, missing security vulnerabilities.
Assertion details
- Input: Security workflow runs with init@v4.37.1 and analyze@v4.35.5 in sequence
- Expected:
Both init and analyze actions should be at the same version (v4.37.1) to ensure database format and feature compatibility - Actual:
init bumped to v4.37.1 while analyze remains at v4.35.5, creating incompatible versions released 2 months apart with breaking changes between them
Was this helpful? React 👍 or 👎
🤖 Datadog Autotest · What is Autotest? · Any feedback? Reach out in #autotest
There was a problem hiding this comment.
This PR bumps codeql-action/init to v4.37.1 but leaves codeql-action/analyze at v4.35.5, creating a version mismatch. Prior updates always kept both actions synchronized; this incompatibility will cause the security workflow to fail at runtime when analyze attempts to process a database created by the newer init version.
📊 Validated against 3 scenarios · Open Bits AI session
🤖 Datadog Autotest · Commit 231a0de · What is Autotest? · Any feedback? Reach out in #autotest
Bumps github/codeql-action/init from 4.35.5 to 4.37.1.
Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
7188fc3Merge pull request #4020 from github/update-v4.37.1-9e7c07009c8b5f69Update changelog for v4.37.19e7c070Merge pull request #4014 from github/mbg/explicit-remote-prefix3492b7eChangeREMOTE_PATH_PREFIXtoremote=3654baaMerge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix2d682acMerge pull request #4017 from github/dependabot/github_actions/dot-github/wor...23f6a50Merge pull request #4009 from github/mbg/action-state/additions1ee3c75Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...e053684Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...6803c56Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)