Bump github/codeql-action from 4.37.9 to 4.38.0

[dependabot]

Bumps github/codeql-action from 4.37.9 to 4.38.0.

Release notes

Sourced from github/codeql-action's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action's changelog.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
CI-only dependency version bump with no application or security-logic changes in this repo.

Overview
Bumps the CodeQL GitHub Actions workflow from github/codeql-action v4.37.9 to v4.38.0 for both the Initialize CodeQL (init) and Perform CodeQL Analysis (analyze) steps in .github/workflows/codeql-analysis.yml.

No build steps, matrix languages, or permissions change—only the action version pins. The newer release pulls in upstream behavior such as a default CodeQL bundle update, optional Linux Arm64 bundle support, and toolcache cleanup on hosted runners.

^{Reviewed by Cursor Bugbot for commit a614a7d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

Verdict: benign

I'll review the CodeQL Action bump against the malware checklist, starting with local usage, upstream diffs, and scanner findings.

This is a first-party GitHub Actions pin (github/codeql-action 4.37.9 → 4.38.0) used only in .github/workflows/codeql-analysis.yml (init / analyze). Tagged commit b96794f matches the published v4.38.0 notes: toolcache bundle cleanup, native linux-arm64 bundles, and default CodeQL bundle 2.27.0. Adjacent minor bump; no skipped versions or unexpected publisher.

Scanner vs interpretation: status is warn (warn-only). Unicode / confusable / IOC counts are 0. The 1065 heuristics are false positives on a large bundled lib/entry-points.js plus normal Action code:

• charCodeAt / fromCodePoint in HTTP/URL/base64 parsers, not hidden-payload assembly
• .exec() on regex and @actions/exec / child_process for CodeQL CLI and tar, not a dropper
• “credential exfil” hits in CHANGELOG and GitHub API token paths
• /* @__PURE__ */ matching a typosquat pattern
• maintainer_drift is a generic version-bump flag, not an account change

No preinstall / install / postinstall scripts. Lockfile change is the action’s own package-lock.json. Consumer PR workflow edits are pin-only; upstream .github/workflows diffs are that repo’s CI (arm64 / runner sizing), not injected into this repo.

New filesystem deletes are scoped to unused CodeQL toolcache entries on GitHub-hosted runners (symlink-refusing), which matches the documented disk-space change. No evidence of compromise.

Compatibility Analysis

I'll inspect how this repo uses github/codeql-action and compare that against the 4.38.0 upstream changes.I'll inspect upstream action.yml inputs and the v4.37.9 → v4.38.0 changelog against this workflow's usage.Recommendation: merge

1) Usage in this repo

Only .github/workflows/codeql-analysis.yml (CodeQL CI, not a library import).

• github/codeql-action/init@v4.38.0 with languages: ${{ matrix.language }} (cpp, python)
• Manual build between init and analyze (pip wheel . after apt/cmake deps)
• github/codeql-action/analyze@v4.38.0 with no inputs
• runs-on: ubuntu-latest, security-events: write
• No tools pin, no config-file / queries / packs, no autobuild, no upload-sarif

2) Intersection with 4.38.0 changes

None that require workflow edits. Inspected upstream changelog, init/analyze action.yml, and src/defaults.json.

Change	Hits this repo?
Toolcache cleanup of unused bundles (#4124)	Internal to the action on GitHub-hosted runners; no inputs used here
Native linux-arm64 bundle (#4072)	No — job is ubuntu-latest (x64)
Default bundle 2.26.4 → 2.27.0 (#4129)	Yes, via default tools on init — still the supported default path

No removed/renamed public inputs. The C++ manual-build-between-init-and-analyze pattern is still documented. This is a minor action bump, not an API break.

3) Risks / unknowns

• First post-merge CodeQL run may show new or changed cpp/python alerts because the CLI/query packs moved to 2.27.0. That is expected, not a workflow incompat.
• Toolcache cleanup is described as a gradual rollout; it should only free disk, not change analysis results.
• No local way to execute the GitHub Action here; confirm the CodeQL workflow on this PR after merge.

4) Verdict

Merge. Default init + analyze usage stays valid; no repo changes needed beyond the Dependabot pin. Watch the next CodeQL job and any new scanning alerts.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 49
• Resolution strategy: tag_range
• Changed node/vendor paths: 0
• Changed lockfiles: 1
• Resolved upstream range: cdf488f595d80d6e07e03d4674febd5ab45fa938..b96794f015dfd88f77b49b1c93e0fa7110f94c63
• Resolved refs: from=cdf488f595d80d6e07e03d4674febd5ab45fa938 to=b96794f015dfd88f77b49b1c93e0fa7110f94c63
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 1065

Top findings

• lib/entry-points.js:1137 codepoint_decoder :: const code = this.code = key.charCodeAt(index2);
• lib/entry-points.js:1159 codepoint_decoder :: const code = key.charCodeAt(index2);
• lib/entry-points.js:1643 codepoint_decoder :: if (!isTokenCharCode(characters.charCodeAt(i))) {
• lib/entry-points.js:3115 codepoint_decoder :: for (let i = "A".charCodeAt(0); i <= "Z".charCodeAt(0); i++) {
• lib/entry-points.js:3721 codepoint_decoder :: if (data.charCodeAt(dataLength - 1) === 61) {
• lib/entry-points.js:3723 codepoint_decoder :: if (data.charCodeAt(dataLength - 1) === 61) {
• lib/entry-points.js:3803 codepoint_decoder :: while (lead < str.length && predicate(str.charCodeAt(lead))) lead++;
• lib/entry-points.js:3806 codepoint_decoder :: while (trail > 0 && predicate(str.charCodeAt(trail))) trail--;
• lib/entry-points.js:4170 codepoint_decoder :: if (x.charCodeAt(index2) > 255) {
• lib/entry-points.js:4172 codepoint_decoder :: Cannot convert argument to a ByteString because the character at index ${index2} has a value of ${x.charCodeAt(index2)} which is greater than 255.
• lib/entry-points.js:4344 codepoint_decoder :: const code = url2.charCodeAt(i);
• lib/entry-points.js:4370 codepoint_decoder :: const c = statusText.charCodeAt(i);
• lib/entry-points.js:4924 codepoint_decoder :: if (data.charCodeAt(position.position) !== 61) {
• lib/entry-points.js:4937 codepoint_decoder :: const code = char.charCodeAt(0);
• lib/entry-points.js:4951 codepoint_decoder :: if (data.charCodeAt(position.position) !== 45) {
• lib/entry-points.js:4964 codepoint_decoder :: const code = char.charCodeAt(0);
• lib/entry-points.js:5063 codepoint_decoder :: if (input.charCodeAt(position.position) === 34) {
• lib/entry-points.js:5072 codepoint_decoder :: assert(input.charCodeAt(position.position) === 44);
• lib/entry-points.js:5411 codepoint_decoder :: if ((chars.charCodeAt(i) & ~127) !== 0) {
• lib/entry-points.js:5423 codepoint_decoder :: const cp = boundary.charCodeAt(i);