chore(deps): bump the actions group across 1 directory with 3 updates

[dependabot]

Bumps the actions group with 3 updates in the / directory: pnpm/action-setup, github/codeql-action/init and github/codeql-action/analyze.

Updates pnpm/action-setup from 6.0.10 to 6.1.0

Release notes

Sourced from pnpm/action-setup's releases.

v6.1.0

What's Changed

• feat: support pnpm v12 by @​zkochan in pnpm/action-setup#288

Full Changelog: pnpm/action-setup@v6.0.10...v6.1.0

Commits

• ea17c68 feat: support pnpm v12 (#288)
• See full diff in compare view

Updates github/codeql-action/init from 4.37.9 to 4.38.1

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

... (truncated)

Commits

• 1c5b675 Merge pull request #4152 from github/update-v4.38.1-a65b83a73
• a97cdca Add changelog entry for #4146
• cc6c691 Update changelog for v4.38.1
• a65b83a Merge pull request #4146 from github/henrymercer/per-language-bundles-pr
• 07fa87d Clarify the latest-nightly eligibility exception
• f18f353 Describe the bundle URL resolver
• ecec9b5 Share per-language telemetry fields without renaming
• 79fe3a1 Move download telemetry into the status-report directory
• ead1f7d Rename the platform module
• 549d498 Simplify per-language platform eligibility checks
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.9 to 4.38.1

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

... (truncated)

Commits

• 1c5b675 Merge pull request #4152 from github/update-v4.38.1-a65b83a73
• a97cdca Add changelog entry for #4146
• cc6c691 Update changelog for v4.38.1
• a65b83a Merge pull request #4146 from github/henrymercer/per-language-bundles-pr
• 07fa87d Clarify the latest-nightly eligibility exception
• f18f353 Describe the bundle URL resolver
• ecec9b5 Share per-language telemetry fields without renaming
• 79fe3a1 Move download telemetry into the status-report directory
• ead1f7d Rename the platform module
• 549d498 Simplify per-language platform eligibility checks
• Additional commits viewable in compare view

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 22, 2026, 3:00 PM ET / 19:00 UTC (Revision 8).

ClawSweeper review

What this changes

Updates pinned pnpm setup and CodeQL actions used for package checks, security analysis, and releases.

Merge readiness

✅ Ready for maintainer review

This remains a useful dependency update absent from current main. The pinned changes introduce no identified correctness or security defect, and the supplied workflow checks passed.

Priority: P3
Reviewed head: 94f3e896194d169eb1191bd027f760d081645704

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused dependency update with verified upstream pins, successful workflow checks, and no actionable findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: Bot-authored dependency maintenance is exempt from contributor runtime proof; supplied CI exercises pnpm setup and CodeQL, and no stored-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Bot-authored dependency maintenance is exempt from contributor runtime proof; supplied CI exercises pnpm setup and CodeQL, and no stored-data contract changes.
Evidence reviewed	8 items	Introduced changes and necessity: The pinned delta contains exactly four action-reference replacements across three workflows. Main still uses pnpm setup 6.0.10 and CodeQL 4.37.9; this branch uses 6.1.0 and 4.38.1. Workflow inputs, permissions, triggers, and publishing commands are unchanged. Verified upstream pnpm action: The upstream annotated v6.1.0 tag resolves to the exact proposed commit. The inspected upstream installer changes add pnpm 12 support while retaining manifest-based version selection; the target continues requesting pnpm 11.24.0. Direct workflow execution of this action establishes the dependency boundary. Verified upstream CodeQL action: The upstream annotated v4.38.1 tag resolves to the exact proposed commit. Inspected release changes cover bundle selection, toolcache cleanup, and platform support; the init manifest adds an optional internal job-status input. Both target CodeQL steps remain pinned to the same revision.
Findings	None	None.
Security	None	None.

How this fits together

GitHub workflows validate the router package, scan its source, and publish tagged releases. These action dependencies prepare the package manager and run security analysis.

flowchart TD
  A[Pull requests and main pushes] --> B[Package checks]
  A --> C[CodeQL analysis]
  D[Release tags] --> E[Release validation]
  F[Pinned pnpm setup] --> B
  F --> E
  C --> G[Security results]
  E --> H[Published package]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Workflow scope	4 pinned references updated across 3 workflows	The patch changes dependency revisions without changing workflow permissions or execution steps.

Technical review

Best possible solution:

Retain the focused, immutable action updates while preserving manifest-selected pnpm and existing workflow permissions.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a workflow dependency refresh, and no broken router behavior is claimed.

Is this the best way to solve the issue?

Yes: updating the existing immutable action pins is a narrow maintenance path, with compatible inputs and successful supplied workflow checks.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against b1e0b320cb21.

Labels

Label changes:

No label changes.

Label justifications:

• P3: Routine automation dependency maintenance with no demonstrated urgent user-facing failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Bot-authored dependency maintenance is exempt from contributor runtime proof; supplied CI exercises pnpm setup and CodeQL, and no stored-data contract changes.

Evidence

What I checked:

• Introduced changes and necessity: The pinned delta contains exactly four action-reference replacements across three workflows. Main still uses pnpm setup 6.0.10 and CodeQL 4.37.9; this branch uses 6.1.0 and 4.38.1. Workflow inputs, permissions, triggers, and publishing commands are unchanged. (.github/workflows/ci.yml:50, 94f3e896194d)
• Verified upstream pnpm action: The upstream annotated v6.1.0 tag resolves to the exact proposed commit. The inspected upstream installer changes add pnpm 12 support while retaining manifest-based version selection; the target continues requesting pnpm 11.24.0. Direct workflow execution of this action establishes the dependency boundary. (src/install-pnpm/run.ts, ea17c68df891)
• Verified upstream CodeQL action: The upstream annotated v4.38.1 tag resolves to the exact proposed commit. Inspected release changes cover bundle selection, toolcache cleanup, and platform support; the init manifest adds an optional internal job-status input. Both target CodeQL steps remain pinned to the same revision. (init/action.yml, 1c5b675653bb)
• Validation: Read-only YAML parsing passed for every repository YAML file, and the pinned diff passed whitespace validation. Supplied checks show all six Node/OS package-check jobs, workflow lint, and both CodeQL analyses succeeded. Package builds and tests were not rerun locally because they write artifacts. (.github/workflows/ci.yml:64, 94f3e896194d)
• Release and related-work check: Latest release v0.1.1 still uses pnpm setup 6.0.9. chore(deps): bump pnpm/action-setup from 6.0.10 to 6.1.0 in the actions group #30 proposed the same pnpm update but closed unmerged; it does not replace this PR. The repository pull listing identified no merged replacement for these exact updates. (.github/workflows/ci.yml:50, f5ce7c0d7c04)
• Workflow history and routing: Workflow history includes Peter Steinberger's tooling refreshes and manifest-version change, plus Vincent Koc's release work. GitHub maps the manifest-version commit to steipete. Some deeper local blame/history reads failed on unavailable historical blobs; the relevant commit patch was inspected through GitHub without asserting source-line introduction. (.github/workflows/release.yml, 4c9fce036744)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• openclaw/openclaw-secops: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (7 earlier review cycles)

• reviewed 2026-09-11T18:58:32.020Z sha d903e63 :: needs maintainer review before merge. :: none
• reviewed 2026-09-14T19:03:17.510Z sha d903e63 :: needs maintainer review before merge. :: none
• reviewed 2026-09-15T18:59:58.821Z sha ef0af52 :: needs maintainer review before merge. :: none
• reviewed 2026-09-16T19:02:41.482Z sha 3292b19 :: needs maintainer review before merge. :: none
• reviewed 2026-09-17T19:00:09.976Z sha 3292b19 :: needs maintainer review before merge. :: none
• reviewed 2026-09-18T19:00:41.104Z sha 3292b19 :: needs maintainer review before merge. :: none
• reviewed 2026-09-21T19:02:55.706Z sha 94f3e89 :: needs maintainer review before merge. :: none

[steipete]

Validated the pinned pnpm setup and CodeQL revisions against their upstream release tags. Independent Codex review found no actionable P0–P2 findings. The exact PR head has passing Node 22/24 checks on Linux, macOS, and Windows, workflow lint, and CodeQL. The full package gate also passed on AWS Crabbox using pnpm install --frozen-lockfile && pnpm run check.