chore(deps): bump the github-actions group with 4 updates

[dependabot]

Bumps the github-actions group with 4 updates: github/codeql-action/init, github/codeql-action/analyze, dtolnay/rust-toolchain and PostHog/posthog-sdk-test-harness/.github/workflows/test-sdk-action.yml.

Updates github/codeql-action/init from 4.37.9 to 4.38.0

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

... (truncated)

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.9 to 4.38.0

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

... (truncated)

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Updates dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

Commits

• 02cb101 Merge pull request 185 from fufesou/feat/force-non-host
• b38a663 Pass --force-non-host unconditionally
• a4f61a0 Document rustup non-host opt-in requirement
• 06b350f Support force-non-host toolchains
• d103106 Predefine branches up to 1.120
• 3ea7b2d Add 1.98.1 patch release
• See full diff in compare view

Updates PostHog/posthog-sdk-test-harness/.github/workflows/test-sdk-action.yml from 1.1.0 to 1.5.0

Release notes

Sourced from PostHog/posthog-sdk-test-harness/.github/workflows/test-sdk-action.yml's releases.

1.5.0

Minor changes

• d14f173 Add versioned Feature Flag Rules v2 definitions, evaluation response, management diagnostic, and event contracts with producer and tolerant-reader fixtures. Include source-distribution integrity verification. Contract package 2.0.0 narrows the registry warning codes to the five actionable management warnings (registry 2.0.0), removing EXPERIMENT_VALUE_COLLISION, SDK_REMOTE_FALLBACK_REQUIRED, SDK_EXPERIMENT_CONTEXT_MISSING, and LEGACY_PROJECTION_LIMITED from published contract 1.2.0. — Thanks @​andehen!

1.4.0

Minor changes

• 3de40b7 Publish Feature Flag Rules v2 contract 1.2.0 and corpus 1.1.0 with fixtures pinning the Rust version 1 reference's empty-identifier rollout, variant, and holdout behavior. Correct the hash/parity documentation and record the Python local-evaluation divergence. — Thanks @​andehen!

1.3.0

Minor changes

• 89f5b4e Add the Feature Flag Rules v2 corpus with version 1 evaluation fixtures, sha1_60_v1 hash vectors, legacy projection fixtures, and companion schemas. — Thanks @​andehen!

1.2.0

Minor changes

• bcaa923 Add the versioned Feature Flag Rules v2 configuration contract, validation fixtures, and OpenFeature reason mapping. — Thanks @​andehen!

1.1.1

Patch changes

• 4274d8a Fix the AI capture routing test to accept either normal capture endpoint, including for adapters advertising both capture protocols, while still rejecting AI and unrelated endpoints. — Thanks @​marandaneto!

Changelog

Sourced from PostHog/posthog-sdk-test-harness/.github/workflows/test-sdk-action.yml's changelog.

posthog-sdk-test-harness

1.7.0 — 2026-09-22

Minor changes

• ba3f732 Publish the opt-in ghcr.io/posthog/sdk-test-harness-v2 image alongside the existing harness image under the approved release gate, with bundled pinned SDK specifications, multi-platform builds, and digest/provenance handoff artifacts. — Thanks @​dustinbyrne!

1.6.0 — 2026-09-17

Minor changes

• b6f033a Add Feature Flag Rules v2 config fixtures for the targeted-release and percentage-rollout family as contract package 2.1.0: one canonical boolean configuration and ten schema-rejected shapes (rollout fields on a targeted release, a percentage below the minimum, unknown miss policy, assignment algorithm, assignment target, property field, property operator and property type, a null rule value, and a default value of the wrong type). Published schema, registry, corpus and fixture bytes are unchanged. — Thanks @​andehen!

1.5.0 — 2026-09-15

Minor changes

• d14f173 Add versioned Feature Flag Rules v2 definitions, evaluation response, management diagnostic, and event contracts with producer and tolerant-reader fixtures. Include source-distribution integrity verification. Contract package 2.0.0 narrows the registry warning codes to the five actionable management warnings (registry 2.0.0), removing EXPERIMENT_VALUE_COLLISION, SDK_REMOTE_FALLBACK_REQUIRED, SDK_EXPERIMENT_CONTEXT_MISSING, and LEGACY_PROJECTION_LIMITED from published contract 1.2.0. — Thanks @​andehen!

1.4.0 — 2026-09-10

Minor changes

• 3de40b7 Publish Feature Flag Rules v2 contract 1.2.0 and corpus 1.1.0 with fixtures pinning the Rust version 1 reference's empty-identifier rollout, variant, and holdout behavior. Correct the hash/parity documentation and record the Python local-evaluation divergence. — Thanks @​andehen!

1.3.0 — 2026-09-10

Minor changes

• 89f5b4e Add the Feature Flag Rules v2 corpus with version 1 evaluation fixtures, sha1_60_v1 hash vectors, legacy projection fixtures, and companion schemas. — Thanks @​andehen!

1.2.0 — 2026-09-10

Minor changes

• bcaa923 Add the versioned Feature Flag Rules v2 configuration contract, validation fixtures, and OpenFeature reason mapping. — Thanks @​andehen!

1.1.1 — 2026-09-09

Patch changes

• 4274d8a Fix the AI capture routing test to accept either normal capture endpoint, including for adapters advertising both capture protocols, while still rejecting AI and unrelated endpoints. — Thanks @​marandaneto!

1.1.0 — 2026-09-07

Minor changes

• 3030099 Add opt-in feature_flags_local_evaluation_v1 adapter controls and capability-gated tests for legacy and version-2 boolean matching, including version-only reloads, groups, and recursive cohorts. Serve isolated authenticated definitions GET mocks without affecting capture/remote accounting. Existing adapters and remote fixtures remain unchanged unless explicitly opted in. — Thanks @​marandaneto!

... (truncated)

Commits

• e487249 chore: Release v1.5.0 [skip ci]
• d14f173 test(flags): add definitions, response, and event contracts (#57)
• 029a94a chore: Release v1.4.0 [skip ci]
• 3de40b7 test(flags): pin v1 empty-identifier reference behavior (#56)
• 6860597 chore: Release v1.3.0 [skip ci]
• 89f5b4e test(flags): add v1 and hashing contract corpus (#52)
• 8882c1d ci: remove redundant release token permissions (#55)
• 1fa8541 chore: Release v1.2.0 [skip ci]
• bcaa923 feat(flags): add rules v2 config contract (#51)
• 1d6b197 chore: Release v1.1.1 [skip ci]
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

posthog-elixir Compliance Report

Date: 2026-09-22T14:39:58.243088+00:00
Duration: 108492ms

⚠️ Some Tests Failed

40/47 tests passed, 7 failed

---

Capture Tests

⚠️ 29/30 tests passed, 1 failed

View Details

Test	Status	Duration
Format Validation.Event Has Required Fields	✅	608ms
Format Validation.Event Has Uuid	✅	609ms
Format Validation.Event Has Lib Properties	✅	608ms
Format Validation.Distinct Id Is String	✅	608ms
Format Validation.Token Is Present	✅	608ms
Format Validation.Custom Properties Preserved	✅	608ms
Format Validation.Event Has Timestamp	✅	609ms
Format Validation.Non Utc Event Timestamp Is Converted To Utc	❌	609ms
Retry Behavior.Retries On 503	✅	5614ms
Retry Behavior.Does Not Retry On 400	✅	2611ms
Retry Behavior.Does Not Retry On 401	✅	2610ms
Retry Behavior.Respects Retry After Header	✅	5610ms
Retry Behavior.Implements Backoff	✅	15619ms
Retry Behavior.Retries On 500	✅	5613ms
Retry Behavior.Retries On 502	✅	5615ms
Retry Behavior.Retries On 504	✅	5613ms
Retry Behavior.Max Retries Respected	✅	15625ms
Deduplication.Generates Unique Uuids	✅	618ms
Deduplication.Preserves Uuid On Retry	✅	5613ms
Deduplication.Preserves Uuid And Timestamp On Retry	✅	10619ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	5616ms
Deduplication.No Duplicate Events In Batch	✅	613ms
Deduplication.Different Events Have Different Uuids	✅	610ms
Compression.Sends Gzip When Enabled	✅	609ms
Batch Format.Uses Proper Batch Structure	✅	609ms
Batch Format.Flush With No Events Sends Nothing	✅	606ms
Batch Format.Multiple Events Batched Together	✅	612ms
Error Handling.Does Not Retry On 403	✅	2610ms
Error Handling.Does Not Retry On 413	✅	2611ms
Error Handling.Retries On 408	✅	5614ms

Failures

format_validation.non_utc_event_timestamp_is_converted_to_utc

Event 0 field 'timestamp' instant '2026-09-22T14:38:14.236882Z' != expected '2025-01-02T03:04:05Z'

Feature_Flags Tests

⚠️ 11/17 tests passed, 6 failed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	7ms
Request Payload.Flags Request Uses V2 Query Param	✅	6ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	5ms
Request Payload.Flags Request Omits Authorization Header	✅	6ms
Request Payload.Token In Flags Body Matches Init	✅	5ms
Request Payload.Groups Round Trip	✅	6ms
Request Payload.Groups Default To Empty Object	❌	6ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	5ms
Request Payload.Disable Geoip Omitted Defaults To False	❌	6ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	6ms
Request Lifecycle.No Flags Request On Init Alone	✅	3ms
Request Lifecycle.No Flags Request On Normal Capture	✅	607ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	9ms
Request Lifecycle.Mock Response Value Is Returned To Caller	❌	6ms
Retry Behavior.Retries Flags On 502	❌	309ms
Retry Behavior.Retries Flags On 504	❌	309ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	❌	609ms

Failures

request_payload.groups_default_to_empty_object

Field 'groups' not found in /flags request body at path 'groups'. Available keys: ['distinct_id', 'api_key', 'flag_keys_to_evaluate']

request_payload.disable_geoip_omitted_defaults_to_false

Field 'geoip_disable' not found in /flags request body at path 'geoip_disable'. Available keys: ['distinct_id', 'api_key', 'flag_keys_to_evaluate']

request_lifecycle.mock_response_value_is_returned_to_caller

Last action result missing field 'value'. Keys: ['error', 'success']

retry_behavior.retries_flags_on_502

Last action result missing field 'value'. Keys: ['error', 'success']

retry_behavior.retries_flags_on_504

Last action result missing field 'value'. Keys: ['error', 'success']

side_effect_events.get_feature_flag_captures_feature_flag_called_event

Expected 1 events with name '$feature_flag_called', got 0