chore(deps): bump the github-actions group with 3 updates

[dependabot]

Bumps the github-actions group with 3 updates: github/codeql-action/upload-sarif, actions/setup-node and hashgraph-online/ai-plugin-scanner-action.

Updates github/codeql-action/upload-sarif from 4.38.2 to 4.38.3

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.38.3

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

... (truncated)

Commits

• 24c5418 Merge pull request #4214 from github/update-v4.38.3-e0b52dbdc
• 69e87c5 Add changelog note for #4184
• 23b6828 Update changelog for v4.38.3
• e0b52db Merge pull request #4210 from github/henrymercer/pin-python-for-older-clis-in-ci
• 6b99698 Pin Python 3.13.15 for older CLI versions in multi-language check
• 63d3d63 Merge pull request #4203 from github/update-bundle/codeql-bundle-v2.27.2
• 7377a10 Add changelog note
• c1a30cd Update default bundle to codeql-bundle-v2.27.2
• d208ec7 Merge pull request #4200 from github/mbg/esm/migrate-pr-checks
• a71b0c6 Replace __dirname in sync.ts
• Additional commits viewable in compare view

Updates actions/setup-node from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

• Add support for mise.toml file by @​gperdomor in actions/setup-node#1421
• Support absolute paths in node-version-file by @​v-mahabaleshwars in actions/setup-node#1633

Bug fixes:

• Add Node version validation and manifest fetch retry by @​v-jitenderpalsingh in actions/setup-node#1580

Documentation updates:

• README.md: bump actions/checkout to latest version 7 by @​deining in actions/setup-node#1578
• docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by @​v-gowridurgad in actions/setup-node#1593
• Fixed cache recommendation syntax by @​SubJunk in actions/setup-node#1603

Dependency updates:

• Update workflow pins and migrate Node matrices to modern versions by @​v-HarithaVattikuti in actions/setup-node#1583
• Upgrade @​actions/cache to 6.2.0 by @​philip-gai in actions/setup-node#1584
• Pin @​types/node to v24 by @​v-priyagupta108 in actions/setup-node#1585
• Override brace-expansion to 5.0.8 by @​v-priyagupta108 with @​Copilot in actions/setup-node#1599
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-node#1598
• Upgrade prettier from 3.8.4 to 3.9.6 by @​dependabot in actions/setup-node#1590
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in actions/setup-node#1610
• Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by @​dependabot in actions/setup-node#1602
• Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by @​dependabot in actions/setup-node#1629
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in actions/setup-node#1616
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in actions/setup-node#1615
• Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by @​dependabot in actions/setup-node#1631
• Upgrade jest-each from 30.4.1 to 30.5.2 by @​dependabot in actions/setup-node#1636
• Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by @​dependabot in actions/setup-node#1638
• Update dependencies and add license files by @​v-HarithaVattikuti in actions/setup-node#1642
• Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by @​dependabot in actions/setup-node#1635

New Contributors

• @​v-jitenderpalsingh made their first contribution in actions/setup-node#1580
• @​philip-gai made their first contribution in actions/setup-node#1584
• @​gperdomor made their first contribution in actions/setup-node#1421
• @​SubJunk made their first contribution in actions/setup-node#1603

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits

• 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
• 7207c4f chore: update dependencies and add license files (#1642)
• 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
• fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
• 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
• 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
• a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
• 680d1e4 Support absolute paths in node-version-file (#1633)
• db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
• 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
• Additional commits viewable in compare view

Updates hashgraph-online/ai-plugin-scanner-action from 1.2.748 to 1.2.783

Release notes

Sourced from hashgraph-online/ai-plugin-scanner-action's releases.

v1.2.783

Published automatically from https://github.com/hashgraph-online/hol-guard/tree/9c3107caff485d9fcda96740653a8297d34f2bbd with plugin-scanner 3.38.0.

Full Changelog: hashgraph-online/ai-plugin-scanner-action@v1.2.782...v1.2.783

v1.2.782

Published automatically from https://github.com/hashgraph-online/hol-guard/tree/5139b3e151d5a1570d94f0dcc339b6d124fdd554 with plugin-scanner 3.37.0.

Full Changelog: hashgraph-online/ai-plugin-scanner-action@v1.2.781...v1.2.782

v1.2.781

Published automatically from https://github.com/hashgraph-online/hol-guard/tree/367e52180728b34c49aa9e119a5399299e2f2bba with plugin-scanner 3.38.0.

Full Changelog: hashgraph-online/ai-plugin-scanner-action@v1.2.780...v1.2.781

v1.2.780

Published automatically from https://github.com/hashgraph-online/hol-guard/tree/0a187983c2a1860fa05f17836be732acb0dfbe17 with plugin-scanner 3.37.0.

Full Changelog: hashgraph-online/ai-plugin-scanner-action@v1.2.779...v1.2.780

v1.2.779

Published automatically from https://github.com/hashgraph-online/hol-guard/tree/86e1fe2096ded89f548daf34746b592cfbd2cea3 with plugin-scanner 3.36.1.

Full Changelog: hashgraph-online/ai-plugin-scanner-action@v1.2.778...v1.2.779

v1.2.778

Published automatically from https://github.com/hashgraph-online/hol-guard/tree/1f6bb79f1d47c19156ce642e7626dc6304a78ac6 with plugin-scanner 3.36.0.

Full Changelog: hashgraph-online/ai-plugin-scanner-action@v1.2.777...v1.2.778

v1.2.777

Published automatically from https://github.com/hashgraph-online/hol-guard/tree/429e8f81690d84ba2b8d52657f80113e4bcb5c9d with plugin-scanner 3.35.0.

Full Changelog: hashgraph-online/ai-plugin-scanner-action@v1.2.776...v1.2.777

v1.2.776

Published automatically from https://github.com/hashgraph-online/hol-guard/tree/fb3af285669014676038e6e1266626a0e9f5756a with plugin-scanner 3.34.1.

Full Changelog: hashgraph-online/ai-plugin-scanner-action@v1.2.775...v1.2.776

v1.2.775

Published automatically from https://github.com/hashgraph-online/hol-guard/tree/f4de331ce6ed5df4f85e421d146364a4700a6406 with plugin-scanner 3.34.0.

Full Changelog: hashgraph-online/ai-plugin-scanner-action@v1.2.774...v1.2.775

v1.2.774

Published automatically from https://github.com/hashgraph-online/hol-guard/tree/cbb94dd571963937ad6cbf1306df5112d2a75b13 with plugin-scanner 3.33.0.

Full Changelog: hashgraph-online/ai-plugin-scanner-action@v1.2.773...v1.2.774

... (truncated)

Commits

• 390cfe8 chore: publish action bundle v1.2.783 (plugin-scanner 3.38.0)
• 967a054 chore: publish action bundle v1.2.782 (plugin-scanner 3.37.0)
• 0903984 chore: publish action bundle v1.2.781 (plugin-scanner 3.38.0)
• 2e02b60 chore: publish action bundle v1.2.780 (plugin-scanner 3.37.0)
• a0fdf36 chore: publish action bundle v1.2.779 (plugin-scanner 3.36.1)
• 7cc6825 chore: publish action bundle v1.2.778 (plugin-scanner 3.36.0)
• 6f088de chore: publish action bundle v1.2.777 (plugin-scanner 3.35.0)
• d2f526f chore: publish action bundle v1.2.776 (plugin-scanner 3.34.1)
• 1e83e9f chore: publish action bundle v1.2.775 (plugin-scanner 3.34.0)
• aee780c chore: publish action bundle v1.2.774 (plugin-scanner 3.33.0)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions