Bump the github group across 1 directory with 2 updates

[dependabot]

Bumps the github group with 2 updates in the / directory: github/codeql-action and softprops/action-gh-release.

Updates github/codeql-action from 4.36.2 to 4.37.0

Release notes

Sourced from github/codeql-action's releases.

v4.37.0

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action's changelog.

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

Commits

• 99df26d Merge pull request #3996 from github/update-v4.37.0-c7c896d71
• 31c2707 Add changenote for #3973
• 72df218 Update changelog for v4.37.0
• c7c896d Merge pull request #3995 from github/update-bundle/codeql-bundle-v2.26.0
• 3f34ff0 Add changelog note
• 43bec09 Update default bundle to codeql-bundle-v2.26.0
• f58f0d1 Merge pull request #3973 from github/mbg/repo-props/config-file-shorthands
• 7dc37cb Merge remote-tracking branch 'origin/main' into mbg/repo-props/config-file-sh...
• 8e22350 Thread ActionState to initConfig
• 69c9e8c Mark some status-report imports as type-only to avoid circular dependencies
• Additional commits viewable in compare view

Updates softprops/action-gh-release from 3.0.1 to 3.0.2

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.2

3.0.2 is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since 3.0.1.

This release fixes #795, #438, and #803. The upload transport hardening covers the historical failure reported in #790, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to #786 and does not claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

• feat: improve release error reporting and test coverage by @​chenrui333 in softprops/action-gh-release#813

Bug fixes 🐛

• fix: publish existing draft releases as prereleases by @​godfengliang in softprops/action-gh-release#801
• fix: upload small checksum assets reliably by @​chenrui333 in softprops/action-gh-release#815
• fix: replace existing release assets on Gitea by @​chenrui333 in softprops/action-gh-release#816
• fix: clarify release creation 404 errors by @​chenrui333 in softprops/action-gh-release#817

Other Changes 🔄

• chore(deps): upgrade TypeScript to 7 by @​chenrui333 in softprops/action-gh-release#812
• chore(deps): remove unused TypeScript tooling by @​chenrui333 in softprops/action-gh-release#814
• dependency, Node 24 pin, and CI maintenance merged since 3.0.1

Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.2

3.0.2 is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since 3.0.1.

This release fixes #795, #438, and #803. The upload transport hardening covers the historical failure reported in #790, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to #786 and does not claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

• feat: improve release error reporting and test coverage by @​chenrui333 in softprops/action-gh-release#813

Bug fixes 🐛

• fix: publish existing draft releases as prereleases by @​godfengliang in softprops/action-gh-release#801
• fix: upload small checksum assets reliably by @​chenrui333 in softprops/action-gh-release#815
• fix: replace existing release assets on Gitea by @​chenrui333 in softprops/action-gh-release#816
• fix: clarify release creation 404 errors by @​chenrui333 in softprops/action-gh-release#817

Other Changes 🔄

• chore(deps): upgrade TypeScript to 7 by @​chenrui333 in softprops/action-gh-release#812
• chore(deps): remove unused TypeScript tooling by @​chenrui333 in softprops/action-gh-release#814
• dependency, Node 24 pin, and CI maintenance merged since 3.0.1

Commits

• 3d0d988 release 3.0.2 (#818)
• 7e13ed4 fix: clarify release creation 404 errors (#817)
• e6c70a5 fix: replace existing release assets on Gitea (#816)
• f345337 fix: publish existing draft releases as prereleases (#801)
• d8a89a2 fix: upload small checksum assets reliably (#815)
• 45ece40 chore(deps): remove unused TypeScript tooling (#814)
• f6b913c feat: improve release error reporting and test coverage (#813)
• 15f193d chore(deps): upgrade TypeScript to 7 (#812)
• cc8268d chore(deps): bump actions/checkout in the github-actions group (#810)
• fd0ed1e chore(deps): bump the npm group with 3 updates (#811)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions