[mrz1836]

What Changed

• Updated MAGE_X_VERSION from v1.25.0 to v1.25.1 in .github/env/10-mage-x.env
• Upgraded CodeQL action versions from e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 (v4.37.3) to f205ea1c3313d32999d8d6a48b4f6530d4437b38 (v4.37.4) across init, autobuild, and analyze steps in .github/workflows/codeql-analysis.yml
• Added null-safe handling for deleted user accounts in PR review processing logic in .github/workflows/auto-merge-on-approval.yml by using optional chaining (review.user?.id) and falling back to a unique key pattern (deleted-user:${review.id})
• Updated CodeQL action versions from v4.37.3 to v4.37.4 in .github/workflows/dependabot-auto-merge.yml and .github/workflows/scorecard.yml

Why It Was Necessary

• MAGE-X version bump ensures the latest patch release (v1.25.1) is used with potential bug fixes or improvements
• CodeQL action updates provide the latest security scanning capabilities and potential bug fixes in the analysis tooling
• Null-safe review handling prevents workflow failures when processing reviews from deleted GitHub accounts, which would previously throw errors when attempting to access review.user.id

Testing Performed

• Version bumps for pinned GitHub Actions can be validated by checking that the commit hashes correspond to the specified tag versions
• The null-safe review handling logic should be tested with PRs that have reviews from deleted user accounts to ensure no JavaScript errors occur
• CI workflows should be monitored on the next runs to verify CodeQL analysis completes successfully with the updated action versions

Impact / Risk

• Risk: Low - MAGE-X patch version update and CodeQL minor version updates are generally backward compatible
• Regression: The null-safe handling fix prevents a potential runtime error; existing functionality with active users remains unchanged
• Breaking Changes: None - all changes are dependency updates and defensive null checks that maintain existing behavior while fixing an edge case

[mrz1836]

LGTM!