Bump github/codeql-action/upload-sarif from 4.37.6 to 4.37.7 - #627
Merged
Adam Rudell (arudell) merged 1 commit intoAug 27, 2026
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
the
dependencies
dependabot
Bot
added
the
github_actions
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the CodeQL SARIF uploader dependency, though two workflows receive undocumented pin changes.
Changes:
- Upgrades DevSkim’s uploader from v4.37.6 to v4.37.7.
- Changes uploader pins in two additional workflows without matching version annotations.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
.github/workflows/devskim.yml |
Applies the documented v4.37.7 upgrade. |
.github/workflows/powershell.yml |
Changes an additional uploader pin. |
.github/workflows/scorecards.yml |
Changes an additional uploader pin. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.6 to 4.37.7. - [Release notes](https://github.com/github/codeql-action/releases) - [Commits](github/codeql-action@v4.37.6...v4.37.7) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/github/codeql-action/upload-sarif-4.37.7
branch
from
August 27, 2026 16:00
6b7aa93 to
524dbc3
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.
Suppressed comments (2)
.github/workflows/scorecards.yml:74
- This occurrence is not pinned to the v4.37.7 commit used by the same PR in
devskim.yml; it also retains an unrelated v3.29.5 label. As a result, this workflow does not receive the advertised dependency bump. Pin the v4.37.7 commit consistently and update the label.
uses: github/codeql-action/upload-sarif@0963041ab44fef14b249c939dcda503ac8403e0c # v3.29.5
.github/workflows/powershell.yml:52
- This occurrence is not pinned to the v4.37.7 commit used by the same PR in
devskim.yml; it also retains the v4.37.4 label. As a result, this workflow does not receive the advertised dependency bump. Pin the v4.37.7 commit consistently and update the label.
uses: github/codeql-action/upload-sarif@0963041ab44fef14b249c939dcda503ac8403e0c # v4.37.4
Adam Rudell (arudell)
approved these changes
Aug 27, 2026
Adam Rudell (arudell)
enabled auto-merge (squash)
August 27, 2026 16:09
Adam Rudell (arudell)
deleted the
dependabot/github_actions/github/codeql-action/upload-sarif-4.37.7
branch
August 27, 2026 16:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps github/codeql-action/upload-sarif from 4.37.6 to 4.37.7.
Release notes
Sourced from github/codeql-action/upload-sarif's releases.
Commits
ff2f1c6Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8951a133Update changelog for v4.37.7be7a3dbMerge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...9310334Merge pull request #4086 from github/mbg/thread-action-state-to-codeqlb4d8a54Rebuildab5db25Bump the npm-minor group across 1 directory with 8 updates38055a3DroploggerfromdatabaseInitClusterin interface1f87aedMerge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3dc1b98aMakeloggeravailable togetCodeQLForCmd6f0220eMerge pull request #4084 from github/navntoft/bump-undici