[dependabot]

Bumps github/codeql-action from 4.37.4 to 4.37.6.

Release notes

Sourced from github/codeql-action's releases.

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action's changelog.

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Commits

• 5595cca Merge pull request #4071 from github/update-v4.37.6-6a9359a1b
• ec9c757 Add change note for PR 4070
• 45c8742 Update changelog for v4.37.6
• 6a9359a Merge pull request #4070 from github/mbg/remote-address/change-file-default
• 065cdc0 Change DEFAULT_CONFIG_FILE_NAME
• f99dd5a Merge pull request #4066 from github/dependabot/npm_and_yarn/js-yaml-5.2.2
• 1804b21 Merge pull request #4068 from github/mergeback/v4.37.5-to-main-d1ba80a1
• 3020a2f Rebuild
• 93c3a5a Update changelog and version after v4.37.5
• d1ba80a Merge pull request #4067 from github/update-v4.37.5-1cd4d01d5
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[diegosouzapw]

Reviewed this Dependabot bump of github/codeql-action (SARIF-upload step in docker-publish.yml) from v4.37.4 to v4.37.6.

Findings:

• Single-line, mechanical version bump — pulls two upstream patch releases (a CodeQL-bundle-download network-fallback fix in 4.37.5, and a config-file default-path change in 4.37.6). No functional or security regression risk.
• All blocking checks are green (Fast Quality Gates, Vitest fast-path, all Unit Tests shards, ESLint, Merge integrity, semgrep, Fast Production Build).
• Build (advisory) shows a failure, but it's non-blocking by design and unrelated to this diff (workflow-only change, no app build surface touched); dast-smoke was cancelled, which is expected for an infra-only PR.

No changes requested — this looks safe to merge as-is.

[diegosouzapw]

Validated in local merge-train .claude/worktrees/merge-train-20260816-000002-suite.log on devbox-vm-06-dev002 @ 8be62df65f61cc4cf29cdc3e6bc38173ffafa4e3 (FAST gates green: static + changed tests + vitest; daily full-suite run still required). Merged under the batch merge-train protocol (merge-gates §7). ⚠️ base-red inherited: #10523 (ServiceSupervisor order-dependent test, not touched by this batch).