chore(deps): bump github/codeql-action 4.37.1 -> 4.37.3 - #105
Merged
Conversation
Restores four-repo workflow conformance. apple-mail-mcp (#114) and apple-numbers-mcp (#41) took this bump from the weekly Dependabot github-actions group today; notes and photos did not get a PR, leaving codeql.yml and scorecard.yml split 2-2 across the family and conformance-check.sh failing. Pin verified against the upstream tag: v4.37.3 resolves to e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Restores four-repo workflow conformance.
apple-mail-mcp(#114) andapple-numbers-mcp(#41) both took thegithub/codeql-action4.37.1 → 4.37.3 bump from the weekly Dependabot github-actions group this morning. No equivalent PR was opened for notes or photos, which leftcodeql.ymlandscorecard.ymlsplit 2-2 across the family andconformance-check.shfailing with 4 DRIFT findings.All four repos have byte-identical
dependabot.ymlgithub-actions blocks (weekly, 7-day cooldown, grouped*), so this is a missed run rather than a config difference — bumping by hand rather than waiting on the next weekly slot.Pin verified against the upstream tag before use:
No version bump or CHANGELOG entry: github-actions-only changes are exempt from
version-guard, and nothing shipped to npm changes. Matches how #114 and #41 landed.