From 6983d9bed2297f69c0248d5b2087c2ceae3b6ab5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 20 Oct 2026 00:00:19 +0000
Subject: [PATCH] build: bump the vendor-actions group across 1 directory with
 2 updates

Bumps the vendor-actions group with 2 updates in the / directory: [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) and [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action).


Updates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee)

Updates `anthropics/claude-code-action` from 1.0.250 to 1.0.252
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/a26b07d8c778b0c43f64618e5fd29fd0f8af72e8...f27be6b65a4652f08a2ba3cff79114829b588967)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: vendor-actions
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.252
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: vendor-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/pr-audit-workflows.yml | 2 +-
 .github/workflows/pr-review-security.yml | 4 ++--
 .github/workflows/pr-review.yml          | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/pr-audit-workflows.yml b/.github/workflows/pr-audit-workflows.yml
index fd872af3..68c154fa 100644
--- a/.github/workflows/pr-audit-workflows.yml
+++ b/.github/workflows/pr-audit-workflows.yml
@@ -310,7 +310,7 @@ jobs:
 
       - name: Upload zizmor SARIF
         if: ${{ always() && !cancelled() && inputs.upload-sarif && steps.zizmor.outputs.sarif-file != '' }}
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: ${{ steps.zizmor.outputs.sarif-file }}
           category: zizmor
diff --git a/.github/workflows/pr-review-security.yml b/.github/workflows/pr-review-security.yml
index 25446e0d..39c3e68f 100644
--- a/.github/workflows/pr-review-security.yml
+++ b/.github/workflows/pr-review-security.yml
@@ -610,7 +610,7 @@ jobs:
         if: steps.scope.outputs.review != 'false' && steps.sandbox.outcome != 'failure'
         continue-on-error: true
         timeout-minutes: 13
-        uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1.0.250
+        uses: anthropics/claude-code-action@f27be6b65a4652f08a2ba3cff79114829b588967 # v1.0.252
         env:
           # The action stops reading at Claude's first result message
           # (base-action/src/run-claude-sdk.ts:198-209), so background work
@@ -763,7 +763,7 @@ jobs:
         if: steps.fallback.outputs.run == 'true'
         continue-on-error: true
         timeout-minutes: ${{ fromJSON(steps.fallback.outputs.timeout-minutes || '13') }}
-        uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1.0.250
+        uses: anthropics/claude-code-action@f27be6b65a4652f08a2ba3cff79114829b588967 # v1.0.252
         env:
           # The action stops reading at Claude's first result message
           # (base-action/src/run-claude-sdk.ts:198-209), so background work
diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index 67d7e090..90c10b00 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -720,7 +720,7 @@ jobs:
         if: steps.scope.outputs.review != 'false' && steps.sandbox.outcome != 'failure'
         continue-on-error: true
         timeout-minutes: 11
-        uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1.0.250
+        uses: anthropics/claude-code-action@f27be6b65a4652f08a2ba3cff79114829b588967 # v1.0.252
         env:
           # The action stops reading at Claude's first result message
           # (base-action/src/run-claude-sdk.ts:198-209), so background work
@@ -882,7 +882,7 @@ jobs:
         if: steps.fallback.outputs.run == 'true'
         continue-on-error: true
         timeout-minutes: ${{ fromJSON(steps.fallback.outputs.timeout-minutes || '11') }}
-        uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1.0.250
+        uses: anthropics/claude-code-action@f27be6b65a4652f08a2ba3cff79114829b588967 # v1.0.252
         env:
           # The action stops reading at Claude's first result message
           # (base-action/src/run-claude-sdk.ts:198-209), so background work