[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	minor	v4.38.3 → v4.39.0

---

Release Notes

github/codeql-action

v4.39.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fossabot]

Needs Review

I recommend reviewing this upgrade before merging because it includes a high-confidence breaking change that raises the minimum required CodeQL bundle version, and there is a failing external CI check from Snyk whose logs cannot be analyzed. The breaking change, bumping the minimum supported CodeQL bundle, primarily affects GitHub Enterprise Server (GHES) deployments running older bundle versions; for this repository, which uses standard @​v4 tags on GitHub.com with ubuntu-latest runners, the bundle is managed by GitHub and is typically well above any minimum threshold, so practical impact is likely low. However, a deprecation warning introduced in the prior release signals that CodeQL versions 2.21.2 and earlier are being actively phased out, and workflows relying on such older bundles would break after this upgrade. The failing security/snyk check cannot be assessed without log access, and per policy this warrants a manual review pass before merging.

Tip: Comment @​fossabot fix to attempt automatic fixes.

Fix Suggestions

We identified 2 fixable issues in this upgrade.

• Investigate the failing security/snyk CI check to determine whether it is related to the github/codeql-action upgrade or is a pre-existing issue
  Files: .github/workflows/codeql.yml
• Confirm this repository does not use GitHub Enterprise Server or self-hosted runners with pinned CodeQL bundles older than 2.20.7
  Files: .github/workflows/codeql.yml

AI Assistant Prompt

Copy prompt for AI assistant

# Dependency Upgrade Review: github/codeql-action in algorithm-exercises-csharp (PR #452)

## Context
The `github/codeql-action` dependency has been upgraded. This upgrade includes:
- A **breaking change** that raises the minimum required CodeQL bundle version to 2.20.7
- Bug fixes for cache restoration with third-party caching and `start-proxy` on non-github.com instances

## Tasks
Please help me review and address the following items in this PR:

### 1. Review `.github/workflows/codeql.yml` for compatibility
- Confirm the workflow uses `ubuntu-latest` runners on GitHub.com (not GitHub Enterprise Server)
- Confirm there are no pinned CodeQL bundle versions older than 2.20.7
- Check that the `codeql-action` references (e.g., `@​v4`) are consistent and correct after the upgrade
- If the workflow explicitly sets a `tools` parameter pointing to a specific CodeQL bundle version, ensure it is >= 2.20.7

### 2. Check for other workflow files referencing codeql-action
- Search across `.github/workflows/` for any other files that reference `github/codeql-action`
- Ensure all references are updated consistently

### 3. Manual follow-up items (not automatable)
These require human action outside the codebase:
- **Snyk CI check is failing**: Visit https://app.snyk.io/org/sir-gon/pr-checks/6b5d5845-473a-467c-90c1-7fcd046c9e7d to determine if the failure is related to this upgrade or pre-existing
- **Verify no GHES or self-hosted runners** in the organization use older CodeQL bundles

Please review the file `.github/workflows/codeql.yml` and flag any potential issues with this upgrade.

What we checked

• Repository actively uses github/codeql-action/init@​v4, a directly invoked action in the CodeQL workflow, confirming the upgrade affects a live, in-use workflow step. ^[1]
• Repository also uses github/codeql-action/analyze@​v4; the second action step is equally affected by the minimum bundle version constraint introduced in this upgrade. ^[2]
• Workflow uses ubuntu-latest on GitHub.com (not GHES), meaning the CodeQL bundle is managed and kept current by GitHub infrastructure, greatly reducing the likelihood that the minimum 2.20.7 bundle requirement is a practical blocker for this repository. ^[3]
• Breaking change confirmed at high confidence: v4.39.0 raises the minimum required CodeQL bundle version to 2.20.7. GHES deployments or self-hosted runners pinning CodeQL bundles older than 2.20.7 will see workflow failures after this upgrade. ^[4]
• Deprecation context: v4.38.3 (the prior version) began surfacing deprecation warnings for CodeQL bundle versions 2.21.2 and earlier, which were discontinued on 24 September 2026. This upgrade (v4.39.0) drops support for those versions entirely, aligning with the announced end-of-life timeline. ^[5]
• Dependabot is configured to manage github-actions dependencies on a weekly schedule; this PR is a Dependabot-generated bump, consistent with expected automated maintenance behavior. ^[6]
• The external security/snyk CI check is failing. Logs from this provider are inaccessible for analysis, making it impossible to determine whether the failure is related to the github/codeql-action upgrade or pre-existing. Per review policy, this failure requires a manual inspection before merging. ^[7]

Dependency Usage

No usage of the analyzed dependencies was found in this repository.

• Repository actively uses github/codeql-action/init@​v4, a directly invoked action in the CodeQL workflow, confirming the upgrade affects a live, in-use workflow step.
  

  algorithm-exercises-csharp/.github/workflows/codeql.yml

  Line 85 in 78c8798

  uses: github/codeql-action/init@v4

• Repository also uses github/codeql-action/analyze@​v4; the second action step is equally affected by the minimum bundle version constraint introduced in this upgrade.
  

  algorithm-exercises-csharp/.github/workflows/codeql.yml

  Line 109 in 78c8798

  uses: github/codeql-action/analyze@v4

View 2 more usages

• Workflow uses ubuntu-latest on GitHub.com (not GHES), meaning the CodeQL bundle is managed and kept current by GitHub infrastructure, greatly reducing the likelihood that the minimum 2.20.7 bundle requirement is a practical blocker for this repository.
  

  algorithm-exercises-csharp/.github/workflows/codeql.yml

  Line 45 in 78c8798

  runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}

• Dependabot is configured to manage github-actions dependencies on a weekly schedule; this PR is a Dependabot-generated bump, consistent with expected automated maintenance behavior.
  

  algorithm-exercises-csharp/.github/dependabot.yml

  Line 9 in 78c8798

  - package-ecosystem: "github-actions"

Changes

github/codeql-action was updated with a breaking change that raises the minimum required CodeQL bundle version — installations using older bundles will need to upgrade. Two bug fixes are also included: one resolving cache restoration failures with third-party caching implementations, and another ensuring codeql-action/start-proxy correctly locates CodeQL releases on non-github.com GitHub instances.

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205 (v4.39.0, changelog)
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206 (v4.39.0, changelog)
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. [#4198](https://redirect.github.... (v4.39.0, changelog)

View 1 more change

• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. [#4148](https://redirect.... (v4.39.0, changelog)

References (7)

[1]: Repository actively uses github/codeql-action/init@​v4, a directly invoked action in the CodeQL workflow, confirming the upgrade affects a live, in-use workflow step.

algorithm-exercises-csharp/.github/workflows/codeql.yml

Line 85 in 78c8798

uses: github/codeql-action/init@v4

[2]: Repository also uses github/codeql-action/analyze@​v4; the second action step is equally affected by the minimum bundle version constraint introduced in this upgrade.

algorithm-exercises-csharp/.github/workflows/codeql.yml

Line 109 in 78c8798

uses: github/codeql-action/analyze@v4

[3]: Workflow uses ubuntu-latest on GitHub.com (not GHES), meaning the CodeQL bundle is managed and kept current by GitHub infrastructure, greatly reducing the likelihood that the minimum 2.20.7 bundle requirement is a practical blocker for this repository.

algorithm-exercises-csharp/.github/workflows/codeql.yml

Line 45 in 78c8798

runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}

[4]: Breaking change confirmed at high confidence: v4.39.0 raises the minimum required CodeQL bundle version to 2.20.7. GHES deployments or self-hosted runners pinning CodeQL bundles older than 2.20.7 will see workflow failures after this upgrade. (source link)

[5]: Deprecation context: v4.38.3 (the prior version) began surfacing deprecation warnings for CodeQL bundle versions 2.21.2 and earlier, which were discontinued on 24 September 2026. This upgrade (v4.39.0) drops support for those versions entirely, aligning with the announced end-of-life timeline. (source link)

[6]: Dependabot is configured to manage github-actions dependencies on a weekly schedule; this PR is a Dependabot-generated bump, consistent with expected automated maintenance behavior.

algorithm-exercises-csharp/.github/dependabot.yml

Line 9 in 78c8798

- package-ecosystem: "github-actions"

[7]: The external security/snyk CI check is failing. Logs from this provider are inaccessible for analysis, making it impossible to determine whether the failure is related to the github/codeql-action upgrade or pre-existing. Per review policy, this failure requires a manual inspection before merging. (source link)

---

fossabot analyzed this PR using dependency research and AI. View this analysis on the web

[fossabot]

[fossabot]

[fossabot]

No Issues

No application code changes were detected to scan. The PR contains only configuration files, documentation, or other non-code files.

---

fossabot analyzed this PR using SAST security analysis and AI (changed files only).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (ffa7e32) to head (78c8798).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #452   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           36        36           
  Lines          731       731           
  Branches        94        94           
=========================================
  Hits           731       731           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud