[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	patch	v4.39.1 → v4.39.2

---

Release Notes

github/codeql-action

v4.39.2

Compare Source

• Update default CodeQL bundle version to 2.27.4. #​4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #​4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #​4243

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fossabot]

✓ Safe to upgrade

I recommend merging this upgrade because the one documented breaking change in this release, the removal of the undocumented CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable, does not affect this repository. A search of all workflow files confirms that neither that variable nor any trap-caching configuration is present. The repository uses the standard init, analyze, and upload-sarif action steps with no custom CodeQL queries or module imports that could be impacted by query module removals. This is a patch-level upgrade and all changes are compatible with how the action is currently used in this project.

What we checked

• The PR pins upload-sarif to the new version @​v4.39.2 here. This is the only step in the repository explicitly pinned to a specific patch version of github/codeql-action. ^[1]
• The init step uses the floating @​v4 tag. No trap-caching input is configured, so the removal of CODEQL_ACTION_CLEANUP_TRAP_CACHES has no impact here. ^[2]
• The analyze step uses the floating @​v4 tag with only a category input. No environment variables or custom queries are configured that would be affected by this upgrade. ^[3]
• The CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable was removed in the 4.39.x release series. Users relying on it must migrate to trap-caching: false on the init action. This repository does not use this variable, so no migration is needed. ^[4]
• CodeQL Action v3 is scheduled for deprecation in December 2026. This repository already uses @​v4 across all workflows, so no action is required for this upcoming deprecation. ^[5]

Dependency Usage

No usage of the analyzed dependencies was found in this repository.

• The PR pins upload-sarif to the new version @​v4.39.2 here. This is the only step in the repository explicitly pinned to a specific patch version of github/codeql-action.
  

  algorithm-exercises-java/.github/workflows/hadolint.yml

  Line 51 in 9f92a8b

  uses: github/codeql-action/upload-sarif@v4.39.2

• The init step uses the floating @​v4 tag. No trap-caching input is configured, so the removal of CODEQL_ACTION_CLEANUP_TRAP_CACHES has no impact here.
  

  algorithm-exercises-java/.github/workflows/codeql.yml

  Line 92 in 9f92a8b

  uses: github/codeql-action/init@v4

View 1 more usage

• The analyze step uses the floating @​v4 tag with only a category input. No environment variables or custom queries are configured that would be affected by this upgrade.
  

  algorithm-exercises-java/.github/workflows/codeql.yml

  Line 117 in 9f92a8b

  uses: github/codeql-action/analyze@v4

Changes

github/codeql-action has been updated with one breaking change: the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, and workflows using it should migrate to the trap-caching: false input on the init action instead. Additionally, older CodeQL bundles (discontinued alongside GitHub Enterprise Server 3.18) now trigger a deprecation warning, and traced analyses are no longer supported on macOS 27 with Xcode 27.

• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. [#4243](https://redirect.github.... (v4.39.2, changelog)
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266 (v4.39.2, changelog)
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the [Tool Status Page](https://docs.github.... (v4.39.2, changelog)

View 1 more change

• Update default CodeQL bundle version to 2.27.4. #4284 (v4.39.2, changelog)

References (5)

[1]: The PR pins upload-sarif to the new version @​v4.39.2 here. This is the only step in the repository explicitly pinned to a specific patch version of github/codeql-action.

algorithm-exercises-java/.github/workflows/hadolint.yml

Line 51 in 9f92a8b

uses: github/codeql-action/upload-sarif@v4.39.2

[2]: The init step uses the floating @​v4 tag. No trap-caching input is configured, so the removal of CODEQL_ACTION_CLEANUP_TRAP_CACHES has no impact here.

algorithm-exercises-java/.github/workflows/codeql.yml

Line 92 in 9f92a8b

uses: github/codeql-action/init@v4

[3]: The analyze step uses the floating @​v4 tag with only a category input. No environment variables or custom queries are configured that would be affected by this upgrade.

algorithm-exercises-java/.github/workflows/codeql.yml

Line 117 in 9f92a8b

uses: github/codeql-action/analyze@v4

[4]: The CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable was removed in the 4.39.x release series. Users relying on it must migrate to trap-caching: false on the init action. This repository does not use this variable, so no migration is needed. (source link)

[5]: CodeQL Action v3 is scheduled for deprecation in December 2026. This repository already uses @​v4 across all workflows, so no action is required for this upcoming deprecation. (source link)

---

fossabot analyzed this PR using dependency research and AI. View this analysis on the web

[fossabot]

[fossabot]

[fossabot]

No Issues

No application code changes were detected to scan. The PR contains only configuration files, documentation, or other non-code files.

---

fossabot analyzed this PR using SAST security analysis and AI (changed files only).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (0bfa0bd) to head (9f92a8b).

Additional details and impacted files

@@             Coverage Diff             @@
##                main      #623   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity       434       434           
===========================================
  Files             76        76           
  Lines           1383      1383           
  Branches         210       210           
===========================================
  Hits            1383      1383           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.