chore(deps): bump the github-actions group with 4 updates

[dependabot]

Bumps the github-actions group with 4 updates: github/codeql-action/init, github/codeql-action/analyze, pnpm/setup and PostHog/posthog-sdk-test-harness/.github/workflows/test-sdk-action.yml.

Updates github/codeql-action/init from 4.37.6 to 4.37.7

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995

... (truncated)

Commits

• ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
• 951a133 Update changelog for v4.37.7
• be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
• 9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
• b4d8a54 Rebuild
• ab5db25 Bump the npm-minor group across 1 directory with 8 updates
• 38055a3 Drop logger from databaseInitCluster in interface
• 1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
• dc1b98a Make logger available to getCodeQLForCmd
• 6f0220e Merge pull request #4084 from github/navntoft/bump-undici
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.6 to 4.37.7

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995

... (truncated)

Commits

• ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
• 951a133 Update changelog for v4.37.7
• be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
• 9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
• b4d8a54 Rebuild
• ab5db25 Bump the npm-minor group across 1 directory with 8 updates
• 38055a3 Drop logger from databaseInitCluster in interface
• 1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
• dc1b98a Make logger available to getCodeQLForCmd
• 6f0220e Merge pull request #4084 from github/navntoft/bump-undici
• Additional commits viewable in compare view

Updates pnpm/setup from 1.0.0 to 2.0.2

Release notes

Sourced from pnpm/setup's releases.

v2.0.2

What's Changed

• feat: install pnpm from the npm registry, verified against npm's signature by @​zkochan in pnpm/setup#24
• fix: keep the installed runtime authoritative against context-aware shims by @​zkochan in pnpm/setup#25

Full Changelog: pnpm/setup@v2.0.1...v2.0.2

v2.0.1

What's Changed

• fix: normalize Windows cache store paths by @​zkochan in pnpm/setup#22
• docs(README): bump versions (node, action/setup) by @​urban-adeininger in pnpm/setup#20

New Contributors

• @​urban-adeininger made their first contribution in pnpm/setup#20

Full Changelog: pnpm/setup@v2.0.0...v2.0.1

v2.0.0

The action no longer installs pnpm through npm. It downloads pnpm's self-contained release binary for the runner's platform straight from pnpm's GitHub releases, verifies it against the SHA-256 digest GitHub publishes for the asset, and puts it on PATH. No Node.js, no npm, no @pnpm/exe, no self-update round-trip.

That also makes the action immune to broken npm artifacts. pnpm 11.13.0's @pnpm/exe build shipped without its platform binary, which made v1 install a placeholder file that failed later with This: not found and exit code 127. The GitHub release binary for that same version is fine, so v2 installs it correctly. v2 additionally verifies the install by running pnpm --version and comparing it against the requested version, so a bad artifact fails immediately with a clear message instead of surfacing as a confusing error in a later step.

Breaking changes

pnpm v11 or newer is required. v1 could set up pnpm 10 via pnpm self-update; v2 rejects anything below v11 with an explanatory error. The action is built around pnpm's self-contained release binaries and the pnpm runtime command, both of which arrived in v11.

If you need pnpm 10 or older, use pnpm/action-setup instead.

The bin-dest output points somewhere new. It was ~/setup-pnpm/node_modules/.bin/bin; it is now ~/setup-pnpm (the dest directory itself). Workflows that read the output are unaffected — it still names the directory holding pnpm — but anything that hardcoded the old path needs updating.

cache-hit is stricter. It is now true only on an exact key match. v1 reported true for any restore. This matches what actions/cache means by cache-hit.

No inputs or outputs were removed or renamed.

What's new

• Flexible version specs. version accepts an exact version (12.0.0-beta.4), a semver range (^12.0.0), or an npm dist-tag (next-12). It is still optional when packageManager or devEngines.packageManager is set in package.json.
• Partial store cache reuse. Cache restore now falls back to restore keys, so a single changed dependency no longer forces a full re-download of the store.
• New token input. Used for the GitHub release lookup, defaulting to ${{ github.token }} so the low anonymous API rate limit doesn't apply. It rarely needs to be set.
• pnpx, pn, and pnx aliases are linked next to the pnpm binary.

Upgrading

For most workflows the upgrade is the tag:

-      - uses: pnpm/setup@v1
+      - uses: pnpm/setup@v2

... (truncated)

Commits

• 84cb39b fix: keep the installed runtime authoritative against context-aware shims (#25)
• ed0c46d feat: install pnpm from the npm registry, verified against npm's signature (#24)
• 4700d73 README: bump versions (node, actions/setup) (#20)
• 34ec361 fix: normalize Windows cache store paths (#22)
• c9883cc docs: reference v2 in examples; update pnpm to v12.0.0-beta.4 (#16)
• 4f13ee5 refactor: introduce restore keys for cache (#14)
• 6523ce9 feat: support pnpm v11 by downloading from GitHub releases (#12)
• 6bfbb82 feat!: install pnpm v12 as a standalone native executable (#11)
• 77cf068 docs: update version in examples
• See full diff in compare view

Updates PostHog/posthog-sdk-test-harness/.github/workflows/test-sdk-action.yml from 0.10.0 to 1.0.0

Release notes

Sourced from PostHog/posthog-sdk-test-harness/.github/workflows/test-sdk-action.yml's releases.

1.0.0

Major changes

• 4a7e606 Require SDK adapters to normalize event timestamps to canonical UTC before capture. — Thanks @​marandaneto!

0.11.0

Minor changes

• c8c78d3 Add capture_ai test suite for the dedicated AI capture endpoint — Thanks @​carlos-marchal-ph for your first contribution 🎉!

Changelog

Sourced from PostHog/posthog-sdk-test-harness/.github/workflows/test-sdk-action.yml's changelog.

posthog-sdk-test-harness

1.0.0 — 2026-08-14

Major changes

• 4a7e606 Require SDK adapters to normalize event timestamps to canonical UTC before capture. — Thanks @​marandaneto!

0.11.0 — 2026-08-13

Minor changes

• c8c78d3 Add capture_ai test suite for the dedicated AI capture endpoint — Thanks @​carlos-marchal-ph for your first contribution 🎉!

0.10.0 — 2026-07-02

Minor changes

• 1b7b345 Add /flags retry contract tests for transient 502 and 504 responses — Thanks @​marandaneto!

0.9.1 — 2026-07-02

Patch changes

• 2216d8c Relax the /flags distinct_id contract. — Thanks @​marandaneto!

0.9.0 — 2026-06-30

Minor changes

• 829b49b Add SDK compliance workflow options for suite selection, SDK type, and blocking failures — Thanks @​marandaneto!

0.8.0 — 2026-06-04

Minor changes

• baad3c3 Switch the release flow to Sampo with a gated Release GitHub environment. Docker image publishes now require explicit human approval via Slack before they go out, addressing the supply-chain concern that any merge to main could push a new image consumed by every PostHog SDK. Contributors now write sampo add changesets instead of editing pyproject.toml and CHANGELOG.md by hand. — Thanks @​ioannisj!

0.7.0 - 2026-05-29

Changed

• Removed error_response_has_structured_body and error_response_has_correct_tag tests from response_format_validation -- these tested mock fidelity, not SDK behavior
• Clarified in test_actions.yaml that assert_v1_error_response_format, assert_v1_error_tag, and assert_v1_per_event_result are infrastructure for integration tests, not used in the base SDK compliance suite
• assert_events_in_batch_count now accepts a request_index param (default -1, the most recent request) so partial-batch retry tests can inspect the retried batch instead of the original. Fixes retries_only_retry_events_from_partial, which previously asserted against the original 3-event batch rather than the 1-event retry

Added

• unknown_result_treated_as_terminal test: SDK does not retry events with unrecognized per-event result strings (forward compatibility)
• respects_retry_after_on_retryable_error test: SDK honors Retry-After header on 503 error responses

... (truncated)

Commits

• 6d19abb chore: Release v1.0.0 [skip ci]
• 4a7e606 fix: require UTC timestamps in SDK contracts (#47)
• 8d9cadf chore: Release v0.11.0 [skip ci]
• c8c78d3 feat: capture_ai suite (#46)
• 78074c3 chore: group Dependabot updates (#45)
• e9ecc8c chore(deps): bump actions/cache from 5.0.5 to 6.1.0 (#42)
• 0c1e9bc chore(deps): bump actions/github-script from 7.1.0 to 9.0.0 (#41)
• 1e9c058 chore(deps): bump docker/login-action from 3.7.0 to 4.6.0 (#43)
• 405dc8c chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 (#44)
• 707b76d chore(deps-dev): update setuptools requirement from >=61.0 to >=83.0.0 (#40)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

posthog-ruby Compliance Report

Date: 2026-08-26 18:43:06 UTC
Duration: 98680ms

✅ All Tests Passed!

46/46 tests passed

---

Capture Tests

✅ 29/29 tests passed

View Details

Test	Status	Duration
Format Validation.Event Has Required Fields	✅	110ms
Format Validation.Event Has Uuid	✅	106ms
Format Validation.Event Has Lib Properties	✅	109ms
Format Validation.Distinct Id Is String	✅	108ms
Format Validation.Token Is Present	✅	106ms
Format Validation.Custom Properties Preserved	✅	107ms
Format Validation.Event Has Timestamp	✅	108ms
Retry Behavior.Retries On 503	✅	5415ms
Retry Behavior.Does Not Retry On 400	✅	2108ms
Retry Behavior.Does Not Retry On 401	✅	2109ms
Retry Behavior.Respects Retry After Header	✅	8116ms
Retry Behavior.Implements Backoff	✅	15723ms
Retry Behavior.Retries On 500	✅	5213ms
Retry Behavior.Retries On 502	✅	5211ms
Retry Behavior.Retries On 504	✅	5212ms
Retry Behavior.Max Retries Respected	✅	15714ms
Deduplication.Generates Unique Uuids	✅	111ms
Deduplication.Preserves Uuid On Retry	✅	5212ms
Deduplication.Preserves Uuid And Timestamp On Retry	✅	10317ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	5217ms
Deduplication.No Duplicate Events In Batch	✅	113ms
Deduplication.Different Events Have Different Uuids	✅	107ms
Compression.Sends Gzip When Enabled	✅	106ms
Batch Format.Uses Proper Batch Structure	✅	107ms
Batch Format.Flush With No Events Sends Nothing	✅	4ms
Batch Format.Multiple Events Batched Together	✅	111ms
Error Handling.Does Not Retry On 403	✅	2109ms
Error Handling.Does Not Retry On 413	✅	2109ms
Error Handling.Retries On 408	✅	5210ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	108ms
Request Payload.Flags Request Uses V2 Query Param	✅	107ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	108ms
Request Payload.Flags Request Omits Authorization Header	✅	108ms
Request Payload.Token In Flags Body Matches Init	✅	108ms
Request Payload.Groups Round Trip	✅	108ms
Request Payload.Groups Default To Empty Object	✅	108ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	107ms
Request Payload.Disable Geoip Omitted Defaults To False	✅	107ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	107ms
Request Lifecycle.No Flags Request On Init Alone	✅	3ms
Request Lifecycle.No Flags Request On Normal Capture	✅	105ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	111ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	107ms
Retry Behavior.Retries Flags On 502	✅	210ms
Retry Behavior.Retries Flags On 504	✅	255ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	109ms