chore(deps): update github/codeql-action action to v4.38.3

[thomhurst]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	patch	v4.38.2 → v4.38.3

---

Release Notes

github/codeql-action

v4.38.3

Compare Source

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4188
• Update default CodeQL bundle version to 2.27.2. #​4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #​4184

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

Summary by CodeRabbit

• Chores
  • Updated the CodeQL security scanning workflow to use the latest specified action version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9e217574-3f1a-4e9b-9d0a-3e981b72ebea

📥 Commits

Reviewing files that changed from the base of the PR and between af75612 and 1e5ea96.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The CodeQL workflow updates its initialization, analysis, and SARIF upload actions from v4.38.2 to v4.38.3. Workflow configuration and step conditions are unchanged.

Changes

CodeQL Action Update

Layer / File(s)	Summary
Update CodeQL action references .github/workflows/codeql.yml	The initialization, analysis, and both SARIF upload steps now use github/codeql-action v4.38.3. Configuration and retry condition are unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 1e5ea

No actionable merge risk is evident in the supplied workflow update.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: updating github/codeql-action from v4.38.2 to v4.38.3.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow lines,
Four action tags now wear new signs.
The steps keep all their settings true,
While v4.38.3 comes through.
I nibble greens and hop away,
With CodeQL freshened up today.}

_{Comment @coderabbitai help to get the list of available commands.}