[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	patch	v4.39.1 → v4.39.3
step-security/harden-runner	action	patch	v2.22.3 → v2.22.4

---

Release Notes

github/codeql-action

v4.39.3

Compare Source

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #​4283

v4.39.2

Compare Source

• Update default CodeQL bundle version to 2.27.4. #​4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #​4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #​4243

step-security/harden-runner

v2.22.4

Compare Source

What's Changed

• Fixed a Linux agent memory leak that could cause runners to run out of memory during jobs with heavy process or network activity.
• The workaround for GitHub’s DNS resolver and outbound proxy experiment on GitHub-hosted Linux runners now defaults to enabled when feature flags can’t be fetched.
• Improved HTTP/2 TLS interception on Linux (enterprise tier).
• Added retries for failed monitoring API requests, improving reliability of monitoring initialization and raw-event uploads.

Full Changelog: step-security/harden-runner@v2.22.3...v2.22.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 8am on Tuesday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[opentelemetry-pr-dashboard]

Pull request dashboard status

Merged · refreshed 2026-11-10 10:56 UTC

Status above doesn't look right?

• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the pinned security-workflow dependency updates.

No open issues 🎉

What changed in this PR

Updates pinned GitHub Actions dependencies used by the repository’s security workflows, without changing workflow logic or configuration.

Changes:

• Updates CodeQL actions from v4.39.1 to v4.39.3.
• Updates Harden Runner from v2.22.3 to v2.22.4.
• Retains commit-SHA pinning for both dependencies.

File	Description
.github/​workflows/​scorecard.yml	Updates both Harden Runner steps and the CodeQL SARIF upload action.
.github/​workflows/​codeql.yml	Updates CodeQL initialization and analysis actions.

_{Review effort: Balanced}