Looks like there was a bug in the oldest two CLI versions, on `macos-12` here.
security-experimental
codeql-config.yml
package.json