chore(deps): bump github/codeql-action from 4.37.7 to 4.37.8 in the actions-minor-patch group

[dependabot]

Bumps the actions-minor-patch group with 1 update: github/codeql-action.

Updates github/codeql-action from 4.37.7 to 4.37.8

Release notes

Sourced from github/codeql-action's releases.

v4.37.8

No user facing changes.

Changelog

Sourced from github/codeql-action's changelog.

4.37.8 - 21 Aug 2026

No user facing changes.

Commits

• db488dd Merge pull request #4102 from github/update-v4.37.8-9ee088e13
• 1845f5b Update changelog for v4.37.8
• 9ee088e Merge pull request #4080 from github/henrymercer/studious-giggle
• 1aef003 Address review feedback on overlay disk flags
• 508b83b Merge main into overlay minimum disk feature branch
• d97b342 Merge pull request #4098 from github/mbg/permission-error-as-configuration-error
• 47fa622 Make EACCES a ConfigurationError
• 45693cc Refactor ENOSPC check into isDiskConfigurationError function
• c2fd8f5 Merge pull request #4081 from github/mario-campos/version-cache-to-disk
• c56f48e Log unexpected conditions during caching CLI output
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[changeset-bot]

⚠️ No Changeset found

Latest commit: 895f884

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[freshtonic]

Approving the bump itself — v4.37.7 → v4.37.8 within the actions-minor-patch group, tag-pinned exactly as before, CI green.

But the two lines this PR touches expose a pre-existing defect that needs an urgent follow-up: this workflow never runs CodeQL analysis. Both steps use github/codeql-action/init — the step named "Perform CodeQL Analysis" included:

- name: Perform CodeQL Analysis
  uses: github/codeql-action/init@v4.37.8   # should be codeql-action/analyze

There is no analyze step anywhere in the file, so the job initializes CodeQL twice, uploads nothing, and reports green — a security scan that scans nothing, which is precisely the vacuous-guard failure mode this repo's own test suite exists to catch elsewhere. (The category: input on that step is an analyze input too, which init silently ignores.) The Security tab presumably shows no CodeQL results for as long as this workflow has existed — worth confirming, since that's the observable symptom.

Not blocking this bump because the fix is a functional workflow change, not a version update, and holding the group bump hostage to it helps nobody — but it should be a same-day one-line follow-up: change the second step to github/codeql-action/analyze@v4.37.8. Happy to open it.