From 02453fdbe61849e76bc1f09f3412e307cc6b0b5d Mon Sep 17 00:00:00 2001
From: Konrad Heimel <konrad.heimel@gmail.com>
Date: Mon, 21 Sep 2026 02:18:03 +0200
Subject: [PATCH 1/2] :arrow_up: build(deps): bump github/codeql-action init
 and analyze to v4.38.0

init and analyze must run the same version. Dependabot proposed them as separate PRs, and each failed with a configuration version mismatch. Moved together here.
---
 .github/workflows/codeql.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 98781d8..ee9431a 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -44,7 +44,7 @@ jobs:
         with:
           go-version: stable # matches verify.yaml (go.mod minimum, CI on latest stable)
 
-      - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -53,6 +53,6 @@ jobs:
         name: Build for CodeQL
         run: go build -mod=readonly ./...
 
-      - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           category: "/language:${{ matrix.language }}"

From 244bd8313119c821d835d0167258666900e2d654 Mon Sep 17 00:00:00 2001
From: Konrad Heimel <konrad.heimel@gmail.com>
Date: Mon, 21 Sep 2026 02:18:08 +0200
Subject: [PATCH 2/2] :wrench: chore(deps): group the codeql-action bumps in
 Dependabot

Stops Dependabot splitting init, analyze and upload-sarif into separate PRs that cannot pass alone.
---
 .github/dependabot.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3436ff1..6150bc9 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,6 +10,11 @@ updates:
     schedule:
       interval: weekly
     labels: [dependencies]
+    groups:
+      # init, analyze and upload-sarif must move together: a run that mixes versions
+      # fails with a configuration version mismatch.
+      codeql-action:
+        patterns: ["github/codeql-action/*"]
   - package-ecosystem: pip
     directory: /docs
     schedule: