chore(deps): Bump the actions group across 1 directory with 2 updates

[dependabot]

Bumps the actions group with 2 updates in the / directory: github/codeql-action and SonarSource/sonarqube-quality-gate-action.

Updates github/codeql-action from 4.37.3 to 4.37.9

Release notes

Sourced from github/codeql-action's releases.

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v4.37.4

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

Changelog

Sourced from github/codeql-action's changelog.

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

Commits

• cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
• 7243f38 Update changelog for v4.37.9
• 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
• ecfa6e1 Add changelog note
• adcdf4a Update default bundle to codeql-bundle-v2.26.4
• 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
• 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
• ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
• 4605e03 Rebuild
• 099c869 Update changelog and version after v4.37.8
• Additional commits viewable in compare view

Updates SonarSource/sonarqube-quality-gate-action from 1.2.0 to 1.2.1

Release notes

Sourced from SonarSource/sonarqube-quality-gate-action's releases.

v1.2.1

What's Changed

• BUILD-8875: Migrate to standardized GitHub runner names by @​SonarTech in SonarSource/sonarqube-quality-gate-action#66
• SC-32488 Add sq analysis by @​stanislavhh in SonarSource/sonarqube-quality-gate-action#67
• SC-36243 Add sonar-secrets pre-commit hook by @​VictorSchneuwly in SonarSource/sonarqube-quality-gate-action#68
• SQQGGHA-13 SubmitReview: Use Vault token by @​pavel-mikula-sonarsource in SonarSource/sonarqube-quality-gate-action#69
• SQQGGHA-12: surface SonarQube error message on background task … by @​amaurywyart-sq in SonarSource/sonarqube-quality-gate-action#71

New Contributors

• @​SonarTech made their first contribution in SonarSource/sonarqube-quality-gate-action#66
• @​stanislavhh made their first contribution in SonarSource/sonarqube-quality-gate-action#67
• @​VictorSchneuwly made their first contribution in SonarSource/sonarqube-quality-gate-action#68
• @​amaurywyart-sq made their first contribution in SonarSource/sonarqube-quality-gate-action#71

Full Changelog: SonarSource/sonarqube-quality-gate-action@v1.2.0...v1.2.1

Commits

• 7a5fffe SQQGGHA-12: surface SonarQube error message on background task … (#71)
• 8e9b0ca SQQGGHA-13 SubmitReview: Use Vault token (#69)
• cb3ed20 SC-36243 Add sonar-secrets pre-commit hook (#68)
• 95b1cc6 SC-32488 Add sq analysis (#67)
• 174f836 BUILD-8875: Update GitHub Actions runners to new naming convention
• See full diff in compare view

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud