[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	minor	v4.38.3 → v4.39.0

---

Release Notes

github/codeql-action

v4.39.0

Compare Source

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fossabot]

Needs Review

I recommend reviewing this upgrade before merging because an external Snyk CI check (security/snyk (sir-gon)) is failing and its logs cannot be accessed for analysis, which per policy requires manual review. Additionally, this release enforces a new minimum CodeQL bundle version, a breaking change that affects users on older GHES instances or workflows that pin a specific CodeQL bundle below the new minimum. For this repository, the CodeQL workflow (.github/workflows/codeql.yml) runs on GitHub.com using the @​v4 tag without any pinned bundle version, so GitHub.com's automatically managed bundles will satisfy the new minimum and the breaking change is very unlikely to have practical impact here. The snyk-code.yml workflow also uses github/codeql-action/upload-sarif@​v4, which is similarly unaffected. The release additionally ships 1 new feature and 2 bug fixes, which are positive signals. The primary blocker is the unresolvable external CI failure; once that is confirmed to be pre-existing or unrelated to this upgrade, the PR is likely safe to merge.

Tip: Comment @​fossabot fix to attempt automatic fixes.

Fix Suggestions

We identified 1 fixable issue in this upgrade.

• Verify that the failing external Snyk CI check (security/snyk (sir-gon)) is pre-existing and unrelated to the github/codeql-action upgrade
  Files: .github/workflows/snyk-code.yml

AI Assistant Prompt

Copy prompt for AI assistant

# Dependency Upgrade Review: github/codeql-action (PR #612)

I need help verifying that a dependency upgrade PR is safe to merge in my `algorithm-exercises-java` repository.

## Context

`github/codeql-action` has been updated. The new version includes:
- **Breaking change**: Raises the minimum required CodeQL bundle version (affects older GHES instances or workflows pinning an older bundle)
- **Bug fixes**: Fixes cache restoration failures with third-party caching; improves CodeQL release discovery for non-github.com instances
- **1 new feature**

Our workflows use `@​v4` on GitHub.com without pinning a specific bundle version, so the breaking change should have no practical impact here.

## Issue to Investigate

An external Snyk CI check (`security/snyk (sir-gon)`) is failing, but its logs are inaccessible. I need to determine whether this failure is **pre-existing** (unrelated to this PR) or **caused by the upgrade**.

Please help me with the following:

### 1. Review `.github/workflows/snyk-code.yml`
- Check if and how it references `github/codeql-action/upload-sarif@​v4`
- Confirm that the Snyk check itself is a separate service integration, not dependent on the codeql-action bundle version
- Determine if anything in this workflow could be affected by the codeql-action upgrade

### 2. Review `.github/workflows/codeql.yml`
- Confirm it uses `@​v4` without a pinned bundle version
- Confirm it runs on `github.com` (not GHES)
- Verify the breaking change (new minimum bundle version) does not affect this workflow

### 3. Provide a recommendation
- Is the Snyk failure likely pre-existing/unrelated?
- Is this PR safe to merge?
- Any additional steps I should take before merging?

Please review these two workflow files and give me a clear assessment.

What we checked

• Uses github/codeql-action/init@​v4, directly consuming the upgraded action. No CodeQL bundle version is pinned via the tools: parameter, so GitHub.com will supply a current bundle well above the new minimum requirement. ^[1]
• Uses github/codeql-action/analyze@​v4, a second direct reference to the upgraded action in the same workflow. ^[2]
• Uses github/codeql-action/upload-sarif@​v4 to upload Snyk SARIF results, also directly affected by the upgrade. The snyk/actions step above it has continue-on-error: true, but the external Snyk PR check (security/snyk (sir-gon)) is a separate integration whose failure logs cannot be inspected. ^[3]
• Breaking change confirmed: this release bumps the minimum required CodeQL bundle version to 2.20.7. Users on older GHES versions or with pinned bundle versions below this threshold will be blocked. This repository runs on GitHub.com without a pinned bundle, so it is not affected by this constraint. ^[4]
• Predecessor release (4.38.3) had already issued a deprecation warning that CodeQL versions 2.21.2 and earlier were discontinued on September 24, 2026, providing advance notice before this enforcement landed. The upgrade from 4.38.3 → 4.39.0 now enforces this boundary. ^[5]

Dependency Usage

No usage of the analyzed dependencies was found in this repository.

• Uses github/codeql-action/init@​v4, directly consuming the upgraded action. No CodeQL bundle version is pinned via the tools: parameter, so GitHub.com will supply a current bundle well above the new minimum requirement.
  

  algorithm-exercises-java/.github/workflows/codeql.yml

  Line 92 in 366e6fb

  uses: github/codeql-action/init@v4

• Uses github/codeql-action/analyze@​v4, a second direct reference to the upgraded action in the same workflow.
  

  algorithm-exercises-java/.github/workflows/codeql.yml

  Line 117 in 366e6fb

  uses: github/codeql-action/analyze@v4

View 1 more usage

• Uses github/codeql-action/upload-sarif@​v4 to upload Snyk SARIF results, also directly affected by the upgrade. The snyk/actions step above it has continue-on-error: true, but the external Snyk PR check (security/snyk (sir-gon)) is a separate integration whose failure logs cannot be inspected.
  

  algorithm-exercises-java/.github/workflows/snyk-code.yml

  Line 35 in 366e6fb

  uses: github/codeql-action/upload-sarif@v4

Changes

github/codeql-action was updated with a breaking change that raises the minimum required CodeQL bundle version — environments running older bundles must upgrade before this will function correctly. The update also fixes cache restoration failures with third-party caching implementations and improves CodeQL release discovery for non-github.com GitHub instances.

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205 (v4.39.0, changelog)
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206 (v4.39.0, changelog)
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. [#4198](https://redirect.github.... (v4.39.0, changelog)

View 1 more change

• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. [#4148](https://redirect.... (v4.39.0, changelog)

References (5)

[1]: Uses github/codeql-action/init@​v4, directly consuming the upgraded action. No CodeQL bundle version is pinned via the tools: parameter, so GitHub.com will supply a current bundle well above the new minimum requirement.

algorithm-exercises-java/.github/workflows/codeql.yml

Line 92 in 366e6fb

uses: github/codeql-action/init@v4

[2]: Uses github/codeql-action/analyze@​v4, a second direct reference to the upgraded action in the same workflow.

algorithm-exercises-java/.github/workflows/codeql.yml

Line 117 in 366e6fb

uses: github/codeql-action/analyze@v4

[3]: Uses github/codeql-action/upload-sarif@​v4 to upload Snyk SARIF results, also directly affected by the upgrade. The snyk/actions step above it has continue-on-error: true, but the external Snyk PR check (security/snyk (sir-gon)) is a separate integration whose failure logs cannot be inspected.

algorithm-exercises-java/.github/workflows/snyk-code.yml

Line 35 in 366e6fb

uses: github/codeql-action/upload-sarif@v4

[4]: Breaking change confirmed: this release bumps the minimum required CodeQL bundle version to 2.20.7. Users on older GHES versions or with pinned bundle versions below this threshold will be blocked. This repository runs on GitHub.com without a pinned bundle, so it is not affected by this constraint. (source link)

[5]: Predecessor release (4.38.3) had already issued a deprecation warning that CodeQL versions 2.21.2 and earlier were discontinued on September 24, 2026, providing advance notice before this enforcement landed. The upgrade from 4.38.3 → 4.39.0 now enforces this boundary. (source link)

---

fossabot analyzed this PR using dependency research and AI. View this analysis on the web

[fossabot]

[fossabot]

[fossabot]

No Issues

No application code changes were detected to scan. The PR contains only configuration files, documentation, or other non-code files.

---

fossabot analyzed this PR using SAST security analysis and AI (changed files only).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (329af4c) to head (366e6fb).

Additional details and impacted files

@@             Coverage Diff             @@
##                main      #612   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity       434       434           
===========================================
  Files             76        76           
  Lines           1383      1383           
  Branches         210       210           
===========================================
  Hits            1383      1383           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud