From ce3def737e9a607f2b15f2ebd962724dc57b7f3b Mon Sep 17 00:00:00 2001
From: "totally-not-ai[bot]"
 <290682512+totally-not-ai[bot]@users.noreply.github.com>
Date: Wed, 11 Nov 2026 14:06:54 +0000
Subject: [PATCH] ci: update the code review action to keep security weaknesses
 out of findings

Pins vaadin/github-actions/code-review to ae1f782. The code review now
has a security area, and neither profile reports or hints at a
pre-existing security weakness, since findings are public.
---
 .github/workflows/code-review.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/code-review.yml b/.github/workflows/code-review.yml
index 2d94fe595b..3c0bc61753 100644
--- a/.github/workflows/code-review.yml
+++ b/.github/workflows/code-review.yml
@@ -152,7 +152,7 @@ jobs:
         run: rm -f .mcp.json
 
       - name: Run code review
-        uses: vaadin/github-actions/code-review@5e91962ee15f7602a7366238d92375429afaa0d1 # main
+        uses: vaadin/github-actions/code-review@ae1f7829c521dde703f12c46198f067ac1bc876b # main
         with:
           anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
           pr-number: ${{ env.PR_NUMBER }}