ci(deps): bump the github-actions-minor-patch group across 1 directory with 4 updates

[dependabot]

Bumps the github-actions-minor-patch group with 4 updates in the / directory: github/codeql-action, google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml, google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml and relizaio/rearm-actions.

Updates github/codeql-action from 3.35.2 to 3.35.4

Release notes

Sourced from github/codeql-action's releases.

v3.35.4

• Update default CodeQL bundle version to 2.25.4. #3881

v3.35.3

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
• Update default CodeQL bundle version to 2.25.3. #3865

Commits

• 7fd177f Merge pull request #3887 from github/backport-v3.35.4-68bde559d
• ea18e99 Rebuild
• 19f4654 Update version and changelog for v3.35.4
• 8f15c6f Merge remote-tracking branch 'origin/releases/v4' into backport-v3.35.4-68bde...
• 349cede Revert "Rebuild"
• f0ffd57 Revert "Update version and changelog for v3.35.3"
• 68bde55 Merge pull request #3885 from github/update-v4.35.4-803d9e8c3
• 9739ad2 Update changelog for v4.35.4
• 803d9e8 Merge pull request #3883 from github/mbg/test/macro-wrapper
• 0fd9c7d Merge pull request #3882 from github/dependabot/github_actions/dot-github/wor...
• Additional commits viewable in compare view

Updates google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 2.3.5 to 2.3.8

Release notes

Sourced from google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml's releases.

v2.3.8

What's Changed

This updates OSV-Scanner to v2.3.8.

Full Changelog: google/osv-scanner-action@v2.3.5...v2.3.8

Commits

• 9a49870 Update unified workflow example to point to v2.3.8 reusable workflows
• 3adb4b1 Update reusable workflows to point to v2.3.8 actions
• 8dc0919 "Update actions to use v2.3.8 osv-scanner image"
• 43f380b Merge pull request #125 from google/update-to-v2.3.6
• dcf4ddd Update unified workflow example to point to v2.3.6 reusable workflows
• b9dbb7e Update reusable workflows to point to v2.3.6 actions
• fe54858 "Update actions to use v2.3.6 osv-scanner image"
• eb5b619 Merge pull request #100 from thomasleplus/main
• 9517144 feat: output results in reusable workflow
• f17cd09 Merge branch 'main' into main
• Additional commits viewable in compare view

Updates google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.3.5 to 2.3.8

Release notes

Sourced from google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml's releases.

v2.3.8

What's Changed

This updates OSV-Scanner to v2.3.8.

Full Changelog: google/osv-scanner-action@v2.3.5...v2.3.8

Commits

• 9a49870 Update unified workflow example to point to v2.3.8 reusable workflows
• 3adb4b1 Update reusable workflows to point to v2.3.8 actions
• 8dc0919 "Update actions to use v2.3.8 osv-scanner image"
• 43f380b Merge pull request #125 from google/update-to-v2.3.6
• dcf4ddd Update unified workflow example to point to v2.3.6 reusable workflows
• b9dbb7e Update reusable workflows to point to v2.3.6 actions
• fe54858 "Update actions to use v2.3.6 osv-scanner image"
• eb5b619 Merge pull request #100 from thomasleplus/main
• 9517144 feat: output results in reusable workflow
• f17cd09 Merge branch 'main' into main
• Additional commits viewable in compare view

Updates relizaio/rearm-actions from 1.3.1 to 1.4.0

Release notes

Sourced from relizaio/rearm-actions's releases.

1.4.0

Features

• Option to enable invisible character check
• Support Pull Request as first class entity

Bug fixes

• Surface errors on ReARM CLI commands
• Wire PR related fields to initialize and finalize
• Proper environment variable for branch resolution on initialize
• Proper handling of self-registration for components
• Support allow rebuild on getversion

Chores

• Bump default ReARM CLI to 26.05.5
• Use cdxgen for npm SBOM, bump cdxgen to 12.3.3

Commits

• 46f1e94 chore: use cdxgen for npm sbom and bump it to 12.3.3
• 7032085 chore: bump default ReARM CLI to 26.05.5
• beca508 feat: support allow rebuild on getversion
• b243664 fix: upsert PR data on every initialize
• 9df42fe feat: bump cli and support pr as first class entity
• 2ac9dce fix(initialize): extra case where component may not pre-exist
• 6352720 fix(initialize): do not treat as error case where we have brand new component...
• 6604005 fix(initialize): proper env var for branch resolution
• 9f467ff fix: wire PR related fields to initialize and finalize
• 81cbb8e chore(setup-cli): bump default ReARM CLI to 26.04.9
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.