[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	patch	v4.39.2 → v4.39.3

---

Release Notes

github/codeql-action

v4.39.3

Compare Source

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #​4283

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fossabot]

Needs Review

I recommend reviewing this upgrade before merging because a failing external CI check from security/snyk cannot be analyzed with available tooling, preventing a confident 'safe' verdict. The upgrade itself is a minimal patch bump containing one bug fix, and the codebase correctly uses github/codeql-action across four workflow files. The only explicitly version-pinned reference (hadolint.yml) is updated to the new patch version, while the other workflows use the floating @​v4 major-version tag, a pattern that avoids intra-workflow version-mismatch issues reported in the 4.39.x series. The Snyk CI failure may be unrelated to this codeql-action bump (Snyk tests application code, not GitHub Actions themselves), but its logs are inaccessible and must be reviewed by a maintainer before merging.

Tip: Comment @​fossabot fix to attempt automatic fixes.

Fix Suggestions

We identified 1 fixable issue in this upgrade.

• Investigate the failing security/snyk CI check to confirm it is unrelated to the github/codeql-action patch bump
  Files: .github/workflows/snyk-code.yml

AI Assistant Prompt

Copy prompt for AI assistant

I'm reviewing PR #624 in the `algorithm-exercises-java` repository, which bumps `github/codeql-action` from v4.39.2 to v4.39.3. The change itself is a one-line patch in `.github/workflows/hadolint.yml` updating the pinned version tag.

## What the PR changes

The only file modified is `.github/workflows/hadolint.yml`, line 51:
```diff
-        uses: github/codeql-action/upload-sarif@​v4.39.2
+        uses: github/codeql-action/upload-sarif@​v4.39.3
```

This is a bug-fix release that corrects diff-informed alert filtering for files whose paths contain spaces, special characters, or non-ASCII characters.

## What I need help investigating

The `security/snyk` CI check is failing on this PR. I need to determine whether the Snyk failure is related to this `codeql-action` bump or is a pre-existing/unrelated issue.

Please help me with the following:

### 1. Check the Snyk workflow configuration
Review `.github/workflows/snyk-code.yml` and confirm whether it has any dependency on the `github/codeql-action` version that was changed. The Snyk workflow uses `github/codeql-action/upload-sarif@​v4` (floating major tag), not a pinned patch version, so it should be unaffected by this PR's change to `hadolint.yml`.

### 2. Verify version consistency across all workflows
Check all workflow files that reference `github/codeql-action` for version consistency:
- `.github/workflows/hadolint.yml` — uses `@​v4.39.3` (pinned, updated in this PR)
- `.github/workflows/codeql.yml` — uses `@​v4` (floating)
- `.github/workflows/snyk-code.yml` — uses `@​v4` (floating)
- `.github/workflows/docker-image.yml` — uses `@​v4` (floating)

Confirm there are no version-mismatch issues between these files.

### 3. Diagnose the Snyk failure
The Snyk workflow (`snyk-code.yml`) runs `snyk/actions/gradle-9-jdk24` to scan application code for vulnerabilities. Since Snyk scans Java application dependencies (not GitHub Actions versions), the failure is very likely unrelated to this `codeql-action` bump. Help me confirm this by:
- Checking if the `SNYK_TOKEN` secret might be expired or misconfigured
- Checking if the Snyk action version (pinned to commit `9adf32b`) is current
- Looking at whether `continue-on-error: true` on the Snyk step means the upload step could still fail if the SARIF file wasn't generated
- Checking if this same Snyk check was also failing on the main branch (pre-existing failure)

### 4. Provide a recommendation
Based on your analysis, tell me whether this PR is safe to merge or if the Snyk failure needs to be resolved first. If the Snyk failure is unrelated, suggest how to fix it separately.

What we checked

• The only workflow step that pins github/codeql-action/upload-sarif to the explicit version @​v4.39.3, the target of this PR's upgrade. This is the single directly-updated reference in the codebase. ^[1]
• The github/codeql-action/init step uses the floating @​v4 tag. Within the same workflow, analyze (line 117) also uses @​v4, so there is no intra-workflow version mismatch despite the known 4.39.x version-consistency requirement. ^[2]
• github/codeql-action/analyze uses @​v4, consistent with init on line 92. No version mismatch exists within this workflow. ^[3]
• github/codeql-action/upload-sarif is referenced with the floating @​v4 tag, used only once in this workflow so no intra-workflow mismatch. ^[4]
• github/codeql-action/upload-sarif is referenced with the floating @​v4 tag, used only once in this workflow so no intra-workflow mismatch. ^[5]
• Known issue in the 4.39.x series: all github/codeql-action steps within a single workflow must be on the same version. This repo avoids the problem because each individual workflow consistently uses either all-pinned-to-same-version or all-floating-@​v4 tags. ^[6]
• Confirms that within 4.39.x, mixing step versions in the same workflow causes failures starting from 4.39.0. Review confirms no such mixing is present in this repository's workflows. ^[7]

Dependency Usage

No usage of the analyzed dependencies was found in this repository.

• The only workflow step that pins github/codeql-action/upload-sarif to the explicit version @​v4.39.3, the target of this PR's upgrade. This is the single directly-updated reference in the codebase.
  

  algorithm-exercises-java/.github/workflows/hadolint.yml

  Line 51 in aad8cdc

  uses: github/codeql-action/upload-sarif@v4.39.3

• The github/codeql-action/init step uses the floating @​v4 tag. Within the same workflow, analyze (line 117) also uses @​v4, so there is no intra-workflow version mismatch despite the known 4.39.x version-consistency requirement.
  

  algorithm-exercises-java/.github/workflows/codeql.yml

  Line 92 in aad8cdc

  uses: github/codeql-action/init@v4

View 3 more usages

• github/codeql-action/analyze uses @​v4, consistent with init on line 92. No version mismatch exists within this workflow.
  

  algorithm-exercises-java/.github/workflows/codeql.yml

  Line 117 in aad8cdc

  uses: github/codeql-action/analyze@v4

• github/codeql-action/upload-sarif is referenced with the floating @​v4 tag, used only once in this workflow so no intra-workflow mismatch.
  

  algorithm-exercises-java/.github/workflows/snyk-code.yml

  Line 35 in aad8cdc

  uses: github/codeql-action/upload-sarif@v4

• github/codeql-action/upload-sarif is referenced with the floating @​v4 tag, used only once in this workflow so no intra-workflow mismatch.
  

  algorithm-exercises-java/.github/workflows/docker-image.yml

  Line 259 in aad8cdc

  uses: github/codeql-action/upload-sarif@v4

Changes

github/codeql-action was updated with a bug fix for diff-informed alert filtering, which was incorrectly suppressing alerts in files whose paths contain spaces, special characters, or non-ASCII characters.

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283 (v4.39.3, changelog)

References (7)

[1]: The only workflow step that pins github/codeql-action/upload-sarif to the explicit version @​v4.39.3, the target of this PR's upgrade. This is the single directly-updated reference in the codebase.

algorithm-exercises-java/.github/workflows/hadolint.yml

Line 51 in aad8cdc

uses: github/codeql-action/upload-sarif@v4.39.3

[2]: The github/codeql-action/init step uses the floating @​v4 tag. Within the same workflow, analyze (line 117) also uses @​v4, so there is no intra-workflow version mismatch despite the known 4.39.x version-consistency requirement.

algorithm-exercises-java/.github/workflows/codeql.yml

Line 92 in aad8cdc

uses: github/codeql-action/init@v4

[3]: github/codeql-action/analyze uses @​v4, consistent with init on line 92. No version mismatch exists within this workflow.

algorithm-exercises-java/.github/workflows/codeql.yml

Line 117 in aad8cdc

uses: github/codeql-action/analyze@v4

[4]: github/codeql-action/upload-sarif is referenced with the floating @​v4 tag, used only once in this workflow so no intra-workflow mismatch.

algorithm-exercises-java/.github/workflows/snyk-code.yml

Line 35 in aad8cdc

uses: github/codeql-action/upload-sarif@v4

[5]: github/codeql-action/upload-sarif is referenced with the floating @​v4 tag, used only once in this workflow so no intra-workflow mismatch.

algorithm-exercises-java/.github/workflows/docker-image.yml

Line 259 in aad8cdc

uses: github/codeql-action/upload-sarif@v4

[6]: Known issue in the 4.39.x series: all github/codeql-action steps within a single workflow must be on the same version. This repo avoids the problem because each individual workflow consistently uses either all-pinned-to-same-version or all-floating-@​v4 tags. (source link)

[7]: Confirms that within 4.39.x, mixing step versions in the same workflow causes failures starting from 4.39.0. Review confirms no such mixing is present in this repository's workflows. (source link)

---

fossabot analyzed this PR using dependency research and AI. View this analysis on the web

[fossabot]

[fossabot]

No Issues

No application code changes were detected to scan. The PR contains only configuration files, documentation, or other non-code files.

---

fossabot analyzed this PR using SAST security analysis and AI (changed files only).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (2ff9255) to head (aad8cdc).

Additional details and impacted files

@@             Coverage Diff             @@
##                main      #624   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity       434       434           
===========================================
  Files             76        76           
  Lines           1383      1383           
  Branches         210       210           
===========================================
  Hits            1383      1383           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[fossabot]