Bump the github-actions group with 2 updates

[dependabot]

Bumps the github-actions group with 2 updates: github/codeql-action and MishaKav/pytest-coverage-comment.

Updates github/codeql-action from 4.37.4 to 4.37.6

Release notes

Sourced from github/codeql-action's releases.

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action's changelog.

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Commits

• 5595cca Merge pull request #4071 from github/update-v4.37.6-6a9359a1b
• ec9c757 Add change note for PR 4070
• 45c8742 Update changelog for v4.37.6
• 6a9359a Merge pull request #4070 from github/mbg/remote-address/change-file-default
• 065cdc0 Change DEFAULT_CONFIG_FILE_NAME
• f99dd5a Merge pull request #4066 from github/dependabot/npm_and_yarn/js-yaml-5.2.2
• 1804b21 Merge pull request #4068 from github/mergeback/v4.37.5-to-main-d1ba80a1
• 3020a2f Rebuild
• 93c3a5a Update changelog and version after v4.37.5
• d1ba80a Merge pull request #4067 from github/update-v4.37.5-1cd4d01d5
• Additional commits viewable in compare view

Updates MishaKav/pytest-coverage-comment from 1.10.1 to 1.11.0

Release notes

Sourced from MishaKav/pytest-coverage-comment's releases.

v1.11.0

What's Changed

• add show-failed-tests input that lists failed tests (up to max-failed-tests) in the comment as a collapsible block with the test name linked to its file, a short failure reason and the pytest output
• add max-failed-tests input to cap the number of shown failed tests (30 by default, in total across all junit files, shared with multiple-files mode)
• add failedTestsHtml output with the rendered block, empty when the option is disabled or all tests pass

Test Results

Tests	Skipped	Failures	Errors	Time
4	0 💤	4 ❌	0 🔥	0.122s ⏱️

def test_wrong_title():
        # genuine failing assertion with a string diff
        post = get_post(1)
>       assert post["title"] == "my first post"
E       AssertionError: assert 'first post' == 'my first post'
E
E         - my first post
E         ? ---
E         + first post

def test_fetch_latest_post_times_out():
        # genuine timeout raised by the module under test
>       post = fetch_latest_post(timeout=0.03)
timeout = 0.03
def fetch_latest_post(timeout=FETCH_TIMEOUT_SECONDS):
    """Simulate polling a slow posts API until the timeout expires."""
    deadline = time.monotonic() + timeout
    while time.monotonic() < deadline:
        time.sleep(0.01)

>       raise TimeoutError(f"posts API d…

... (truncated)

Changelog

Sourced from MishaKav/pytest-coverage-comment's changelog.

Pytest Coverage Comment 1.11.0

Release Date: 2026-08-02

Changes

• add show-failed-tests input that lists failed tests (up to max-failed-tests) in the comment as a collapsible block with the test name linked to its file, a short failure reason and the pytest output (#293), requested in #26
• add max-failed-tests input to cap the number of shown failed tests (30 by default, in total across all junit files, shared with multiple-files mode) (#293)
• add failedTestsHtml output with the rendered block, empty when the option is disabled or all tests pass (#293)

Commits

• 09c28b6 Add failed tests report to JUnit output (show-failed-tests) (#293)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover
TOTAL	39	0	100%

report-only-changed-files is enabled. No files were changed during this commit :)