chore(deps): bump the github-actions group across 1 directory with 2 updates

[dependabot]

Bumps the github-actions group with 2 updates in the / directory: github/codeql-action and actions/setup-node.

Updates github/codeql-action from 4.38.0 to 4.38.3

Release notes

Sourced from github/codeql-action's releases.

v4.38.3

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

• Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

Changelog

Sourced from github/codeql-action's changelog.

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

Commits

• 24c5418 Merge pull request #4214 from github/update-v4.38.3-e0b52dbdc
• 69e87c5 Add changelog note for #4184
• 23b6828 Update changelog for v4.38.3
• e0b52db Merge pull request #4210 from github/henrymercer/pin-python-for-older-clis-in-ci
• 6b99698 Pin Python 3.13.15 for older CLI versions in multi-language check
• 63d3d63 Merge pull request #4203 from github/update-bundle/codeql-bundle-v2.27.2
• 7377a10 Add changelog note
• c1a30cd Update default bundle to codeql-bundle-v2.27.2
• d208ec7 Merge pull request #4200 from github/mbg/esm/migrate-pr-checks
• a71b0c6 Replace __dirname in sync.ts
• Additional commits viewable in compare view

Updates actions/setup-node from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

• Add support for mise.toml file by @​gperdomor in actions/setup-node#1421
• Support absolute paths in node-version-file by @​v-mahabaleshwars in actions/setup-node#1633

Bug fixes:

• Add Node version validation and manifest fetch retry by @​v-jitenderpalsingh in actions/setup-node#1580

Documentation updates:

• README.md: bump actions/checkout to latest version 7 by @​deining in actions/setup-node#1578
• docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by @​v-gowridurgad in actions/setup-node#1593
• Fixed cache recommendation syntax by @​SubJunk in actions/setup-node#1603

Dependency updates:

• Update workflow pins and migrate Node matrices to modern versions by @​v-HarithaVattikuti in actions/setup-node#1583
• Upgrade @​actions/cache to 6.2.0 by @​philip-gai in actions/setup-node#1584
• Pin @​types/node to v24 by @​v-priyagupta108 in actions/setup-node#1585
• Override brace-expansion to 5.0.8 by @​v-priyagupta108 with @​Copilot in actions/setup-node#1599
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-node#1598
• Upgrade prettier from 3.8.4 to 3.9.6 by @​dependabot in actions/setup-node#1590
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in actions/setup-node#1610
• Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by @​dependabot in actions/setup-node#1602
• Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by @​dependabot in actions/setup-node#1629
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in actions/setup-node#1616
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in actions/setup-node#1615
• Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by @​dependabot in actions/setup-node#1631
• Upgrade jest-each from 30.4.1 to 30.5.2 by @​dependabot in actions/setup-node#1636
• Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by @​dependabot in actions/setup-node#1638
• Update dependencies and add license files by @​v-HarithaVattikuti in actions/setup-node#1642
• Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by @​dependabot in actions/setup-node#1635

New Contributors

• @​v-jitenderpalsingh made their first contribution in actions/setup-node#1580
• @​philip-gai made their first contribution in actions/setup-node#1584
• @​gperdomor made their first contribution in actions/setup-node#1421
• @​SubJunk made their first contribution in actions/setup-node#1603

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits

• 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
• 7207c4f chore: update dependencies and add license files (#1642)
• 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
• fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
• 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
• 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
• a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
• 680d1e4 Support absolute paths in node-version-file (#1633)
• db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
• 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Note

Low Risk
CI-only version pin updates with no changes to application code, secrets, or workflow logic beyond the action references.

Overview
Bumps pinned GitHub Actions versions in three CI workflows only.

CodeQL (codeql-analysis.yml): github/codeql-action init, autobuild, and analyze steps move from v4.38.0 to v4.38.3 (patch release; upstream notes include a newer default CodeQL bundle and deprecation warnings for older CodeQL CLI versions).

Node setup: actions/setup-node goes from v7.0.0 to v7.1.0 in the dependency-audit and i18n-locale-check workflows (still using node-version-file: '.nvmrc'). No application or runtime dependency changes.

^{Reviewed by Cursor Bugbot for commit 2b11513. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T23:12:12.813174Z	2b11513	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.