build(deps): bump the codeql-action group with 3 updates

Bumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.39.2 to 4.39.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/1fc58d04a4d4374f921bdac573c3811c240f9c26...33d7b85da1a04171e211befe2c739303b9a4c066)

Updates `github/codeql-action/analyze` from 4.39.2 to 4.39.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/1fc58d04a4d4374f921bdac573c3811c240f9c26...33d7b85da1a04171e211befe2c739303b9a4c066)

Updates `github/codeql-action/upload-sarif` from 4.39.2 to 4.39.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/1fc58d04a4d4374f921bdac573c3811c240f9c26...33d7b85da1a04171e211befe2c739303b9a4c066)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.39.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.39.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.39.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -67,3 +67,4 @@ updates:
       - dependency-name: mcp
       - dependency-name: boltons
       - dependency-name: "opentelemetry-*"
+      - dependency-name: importlib-metadata

.github/workflows/codeql-analysis.yml

@@ -38,7 +38,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
+      uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
       with:
         languages: c-cpp
         # Analyze the sources without compiling them. Autobuild compiled the
@@ -47,4 +47,4 @@ jobs:
         build-mode: none
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
+      uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3

.github/workflows/flawfinder.yml

@@ -48,6 +48,6 @@ jobs:
           output: 'flawfinder_results.sarif'
 
       - name: Upload analysis results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
+        uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           sarif_file: ${{github.workspace}}/flawfinder_results.sarif

.github/workflows/scorecards.yml

@@ -80,6 +80,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
+        uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           sarif_file: results.sarif

.github/workflows/semgrep.yml

@@ -65,7 +65,7 @@ jobs:
 
       # Upload SARIF file generated in previous step
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
+        uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           sarif_file: semgrep.sarif
         if: always()

cmake/requirements/requirements-semgrep.txt

@@ -391,9 +391,9 @@ httpx-sse==0.4.3 \
 idna==3.20 \
     --hash=sha256:a7db850025b95ded1eae8a46181a1a6c56c92c96f0e2b005d9ff8dc0210cab44 \
     --hash=sha256:ab7ae7122974553370f0bdb919e1a960b2cd1bc1ef0276416d896db81c14582c
-importlib-metadata==10.1.0 \
+importlib-metadata==8.7.1 \
-    --hash=sha256:82b04047fa09792c1a8cfeddfe08bec79e4b13c29c8469b0d3949860f61017e8 \
+    --hash=sha256:49fef1ae6440c182052f407c8d34a68f72efc36db9ca90dc0113398f2fdde8bb \
-    --hash=sha256:cf45ce66a929c64e994185a809c04840d0501db17e663810d993d0f4829265c7
+    --hash=sha256:5a1f80bf1daa489495071efbb095d75a634cf28a8bc299581244063b53176151
 jsonschema==4.25.1 \
     --hash=sha256:3fba0169e345c7175110351d456342c364814cfcf3b964ba4587f22915230a63 \
     --hash=sha256:e4a9655ce0da0c0b67a085847e00a3a51449e1157f4f75e9fb5aa545e122eb85

include/nlohmann/detail/input/input_adapters.hpp

@@ -1312,23 +1312,15 @@ struct can_compare_ne_either_order : std::integral_constant < bool,
     can_compare_ne_impl<IteratorType, SentinelType>::value ||
     can_compare_ne_reversed<IteratorType, SentinelType>::value > {};
 
-// Two kinds of SentinelType are excluded explicitly:
+// std::nullptr_t is excluded explicitly: a literal `nullptr` passed as a
-//
+// trailing default argument (e.g. parse(s, nullptr, ...)) must never be
-// - std::nullptr_t: a literal `nullptr` passed as a trailing default argument
+// mistaken for a sentinel, and some compilers (e.g. GCC 4.8) unreliably
-//   (e.g. parse(s, nullptr, ...)) must never be mistaken for a sentinel, and
+// SFINAE the `operator!=` detection above for std::nullptr_t against
-//   some compilers (e.g. GCC 4.8) unreliably SFINAE the `operator!=` detection
+// container/string types, which would otherwise make such calls ambiguous
-//   above for std::nullptr_t against container/string types, which would
+// with the compatible-input overload.
-//   otherwise make such calls ambiguous with the compatible-input overload.
-// - function pointers and functions: a parser callback passed as plain function
-//   (e.g. parse(s, cb)) is never a sentinel. The callback's parameter types
-//   make basic_json an associated class, so ADL finds the friend
-//   operator!=(const_reference, ScalarType) of basic_json, which makes
-//   `s != cb` well-formed (both convert to basic_json) and would select the
-//   iterator/sentinel overload.
 template<typename IteratorType, typename SentinelType>
 struct can_compare_ne : std::integral_constant < bool,
     !std::is_same<SentinelType, std::nullptr_t>::value &&
-    !std::is_function<typename std::remove_pointer<SentinelType>::type>::value &&
     can_compare_ne_either_order<IteratorType, SentinelType>::value > {};
 
 template<typename T>

single_include/nlohmann/json.hpp

@@ -10421,23 +10421,15 @@ struct can_compare_ne_either_order : std::integral_constant < bool,
     can_compare_ne_impl<IteratorType, SentinelType>::value ||
     can_compare_ne_reversed<IteratorType, SentinelType>::value > {};
 
-// Two kinds of SentinelType are excluded explicitly:
+// std::nullptr_t is excluded explicitly: a literal `nullptr` passed as a
-//
+// trailing default argument (e.g. parse(s, nullptr, ...)) must never be
-// - std::nullptr_t: a literal `nullptr` passed as a trailing default argument
+// mistaken for a sentinel, and some compilers (e.g. GCC 4.8) unreliably
-//   (e.g. parse(s, nullptr, ...)) must never be mistaken for a sentinel, and
+// SFINAE the `operator!=` detection above for std::nullptr_t against
-//   some compilers (e.g. GCC 4.8) unreliably SFINAE the `operator!=` detection
+// container/string types, which would otherwise make such calls ambiguous
-//   above for std::nullptr_t against container/string types, which would
+// with the compatible-input overload.
-//   otherwise make such calls ambiguous with the compatible-input overload.
-// - function pointers and functions: a parser callback passed as plain function
-//   (e.g. parse(s, cb)) is never a sentinel. The callback's parameter types
-//   make basic_json an associated class, so ADL finds the friend
-//   operator!=(const_reference, ScalarType) of basic_json, which makes
-//   `s != cb` well-formed (both convert to basic_json) and would select the
-//   iterator/sentinel overload.
 template<typename IteratorType, typename SentinelType>
 struct can_compare_ne : std::integral_constant < bool,
     !std::is_same<SentinelType, std::nullptr_t>::value &&
-    !std::is_function<typename std::remove_pointer<SentinelType>::type>::value &&
     can_compare_ne_either_order<IteratorType, SentinelType>::value > {};
 
 template<typename T>

tests/src/unit-class_parser.cpp

@@ -3232,40 +3232,3 @@ TEST_CASE("object keys are delivered decoded and validated")
         CHECK(keys_of_format(std::string("\x87\xC3\x28\x91"), json::input_format_t::bon8).empty());
     }
 }
-
-namespace
-{
-// a plain function (not a lambda or std::function) used as parser callback
-bool keep_everything_callback(int /*depth*/, json::parse_event_t /*event*/, json& /*parsed*/)
-{
-    return true;
-}
-} // namespace
-
-TEST_CASE("a plain function is accepted as parser callback for containers")
-{
-    // ADL finds basic_json's friend operator!= for "container != function
-    // pointer", which must not make the iterator/sentinel overloads viable
-
-    const json expected = {1, 2};
-    const std::string text = "[1,2]";
-    const std::vector<std::uint8_t> bytes(text.begin(), text.end());
-    const std::vector<char> chars(text.begin(), text.end());
-
-    CHECK(json::parse(text, keep_everything_callback) == expected);
-    CHECK(json::parse(text, &keep_everything_callback) == expected);
-    CHECK(json::parse(std::string("[1,2]"), keep_everything_callback) == expected);
-    CHECK(json::parse(bytes, keep_everything_callback) == expected);
-    CHECK(json::parse(bytes, &keep_everything_callback) == expected);
-    CHECK(json::parse(chars, keep_everything_callback) == expected);
-    CHECK(json::parse(text.begin(), text.end(), keep_everything_callback) == expected);
-
-    // the sentinel overloads (shared constraint of parse, accept, sax_parse and
-    // the from_* functions) are not viable for a container and a function
-    // pointer, but still are for iterator pairs
-    using callback_pointer = decltype(&keep_everything_callback);
-    CHECK_FALSE((nlohmann::detail::can_compare_ne<std::string, callback_pointer>::value));
-    CHECK_FALSE((nlohmann::detail::can_compare_ne<std::vector<std::uint8_t>, callback_pointer>::value));
-    CHECK((nlohmann::detail::can_compare_ne<std::string::const_iterator, std::string::const_iterator>::value));
-    CHECK((nlohmann::detail::can_compare_ne<const char*, const char*>::value));
-}