Update github/codeql-action action to v4.37.4

[thomhurst]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	patch	v4.37.3 → v4.37.4

---

Release Notes

github/codeql-action (github/codeql-action)

v4.37.4

Compare Source

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #​4037
• Update default CodeQL bundle version to 2.26.2. #​4051

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[claude]

Code review

No issues found. This is an automated Renovate PR that bumps the pinned github/codeql-action SHA (init/analyze/upload-sarif, including the retry step) from v4.37.3 to v4.37.4 in .github/workflows/codeql.yml. The change is a mechanical digest bump with matching version comments and no logic changes — nothing to flag for correctness or CLAUDE.md compliance.

[claude]

Automated review: This is a routine Renovate dependency bump updating github/codeql-action from v4.37.3 → v4.37.4 across the init, analyze, and upload-sarif (including the retry) steps in .github/workflows/codeql.yml.

Verified:

• All four references are updated consistently to the same new commit SHA (f205ea1c3313d32999d8d6a48b4f6530d4437b38), with the version comment correctly matching (# v4.37.4).
• Actions remain pinned to a full commit SHA rather than a mutable tag, which is the right security practice for third-party actions in CI.
• No other workflow logic, permissions, or inputs were changed.

No architectural or design concerns — this is a mechanical, low-risk update. Good to merge.

[thomhurst]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[thomhurst]

CI failure is unrelated to this dependency pin: core test \HttpTests.Assert_SendAsync_Logs_As_Expected(True)\ hit an external TLS connection reset. PR #3562 removes that live HTTP dependency. Re-running failed jobs once per queue policy.

[claude]

Code review

No new issues. The branch was updated by merging main in to pick up an unrelated CI fix (the HttpTests.Assert_SendAsync_Logs_As_Expected flake noted above); the dependency-bump diff itself is unchanged from the earlier review — .github/workflows/codeql.yml still just bumps the pinned github/codeql-action SHA from v4.37.3 to v4.37.4 (init/analyze/upload-sarif, including the retry step), all four references consistent and still pinned by full commit SHA. Nothing further to flag.

[claude]

Code Review

Reviewed this Renovate-bot PR bumping github/codeql-action from v4.37.3 → v4.37.4 (patch release) in .github/workflows/codeql.yml.

Findings: None. This is a mechanical, low-risk dependency update:

• All four action references (init, analyze, upload-sarif, and the retry upload-sarif step) are updated consistently to the same version/SHA — no stale references left behind.
• The commit is pinned by full SHA with the version as a trailing comment, which is the correct, secure pattern for third-party GitHub Actions (protects against tag mutation/supply-chain risk).
• Diff is isolated to the CodeQL workflow file only — no unrelated changes.

No architectural or design concerns apply to a workflow-action version bump like this. Good to merge (pending CI).

[thomhurst]

Rebased onto current main after #3559 merged. Dependency-bump patch remained byte-identical (8d559cc5bc39c7ad899041e91296f89e5f27d072).

[claude]

Code review

No issues found. Re-verified against the current diff: this is the same mechanical github/codeql-action bump (v4.37.3 → v4.37.4) previously reviewed on this PR, unchanged after the rebase onto main. All four references (init, analyze, upload-sarif, and the retry upload-sarif step) in .github/workflows/codeql.yml are updated consistently, pinned by full commit SHA with a matching version comment. No other workflow logic changed. Good to merge.