build: bump the action-dependencies group with 2 updates

[dependabot]

Bumps the action-dependencies group with 2 updates: bugale/bugalint and github/codeql-action.

Updates bugale/bugalint from 4 to 5

Release notes

Sourced from bugale/bugalint's releases.

v5.0.0

5.0.0 (2026-08-03)

• feat!: filter out old issues before generating any output (012f000)

Bug Fixes

• decode a pull request diff returned as a buffer (2bee5b7)
• fail on a pull request diff that cannot be parsed (4d8b364)
• ignore an end line that precedes the start line (63ef13f)

Features

• match multi line issues that partially overlap added lines (f0e6570)
• render SARIF fixes as GitHub suggestions (04ff733)
• suggest the newline a formatter adds at the end of a file (f0490c1)
• support converting a formatter diff to suggestions (4bda5b1)

BREAKING CHANGES

• the failOnlyNew input is renamed to onlyNew and no longer affects only the failure. It now also removes the old issues from the SARIF output, the log, the summary and the comments, so uploading that SARIF to code scanning resolves the alerts of the unchanged code. Leave onlyNew unset to keep the previous output.

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com

Commits

• f0490c1 feat: suggest the newline a formatter adds at the end of a file
• 63ef13f fix: ignore an end line that precedes the start line
• 4af1f94 ci: include the Jest checks in the required check group
• 4d8b364 fix: fail on a pull request diff that cannot be parsed
• 2bee5b7 fix: decode a pull request diff returned as a buffer
• 012f000 feat!: filter out old issues before generating any output
• 4bda5b1 feat: support converting a formatter diff to suggestions
• f0e6570 feat: match multi line issues that partially overlap added lines
• 04ff733 feat: render SARIF fixes as GitHub suggestions
• See full diff in compare view

Updates github/codeql-action from 4.37.4 to 4.37.5

Release notes

Sourced from github/codeql-action's releases.

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action's changelog.

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Commits

• d1ba80a Merge pull request #4067 from github/update-v4.37.5-1cd4d01d5
• e74600b Update changelog for v4.37.5
• 1cd4d01 Merge pull request #4061 from github/henrymercer/turbo-system
• d2bfc30 Merge pull request #4050 from github/mbg/status/registries
• 68028fc Merge pull request #4062 from github/sam-robson/migrate-enterprise-release-pat
• c29563e ci: use federated enterprise release PAT
• 155e522 Link the PR from the changelog entry
• 2d3b351 Handle network errors when streaming the CodeQL bundle download
• 5d3eb98 Merge pull request #4055 from github/dependabot/npm_and_yarn/npm-minor-203262...
• c5f739b Merge branch 'main' into dependabot/npm_and_yarn/npm-minor-2032624187
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions