[PR #351] [MERGED] Bump actions/dependency-review-action from 2.5.1 to 3.1.4 #364

New issue

Closed

opened 2026-03-03 14:30:51 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 14:30:51 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/konstruktoid/hardening/pull/351
Author: @dependabot[bot]
Created: 12/21/2023
Status: ✅ Merged
Merged: 12/21/2023
Merged by: @konstruktoid

Base: master ← Head: dependabot/github_actions/actions/dependency-review-action-3.1.4

📝 Commits (1)

fb6e739 Bump actions/dependency-review-action from 2.5.1 to 3.1.4

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 .github/workflows/dependency-review.yml (+1 -1)

📄 Description

Bumps actions/dependency-review-action from 2.5.1 to 3.1.4.

Release notes

Sourced from actions/dependency-review-action's releases.

3.1.4

What's Changed

Fixed a bug with severity filtering when using the allow_ghsas option: actions/dependency-review-action#623.

Updates dependencies:

Bump @types/node from 16.18.61 to 16.18.62 by @dependabot in actions/dependency-review-action#619 action/pull/620

Bump @typescript-eslint/eslint-plugin from 6.11.0 to 6.12.0 by @dependabot in actions/dependency-review-action#625

Bump typescript from 5.2.2 to 5.3.2 by @dependabot in actions/dependency-review-action#624

Full Changelog: https://github.com/actions/dependency-review-action/compare/v3...v3.1.4

3.1.3

What's Changed

Fixes purl "version must be percent-encoded" by @theztefan in actions/dependency-review-action#617

Full Changelog: https://github.com/actions/dependency-review-action/compare/v3...v3.1.3

3.1.2

What's Changed

Fix a regression for setups using self-hosted runners behind HTTP proxies:@febuiles in actions/dependency-review-action#611

Full Changelog: https://github.com/actions/dependency-review-action/compare/v3...v3.1.2

3.1.1

What's Changed

Update a bunch of dependencies, including major version upgrades for octokit, @actions/github and typescript.

Full Changelog: https://github.com/actions/dependency-review-action/compare/v3.1.0...v3.1.1

3.1.0

What's New

Added support for dependencies submitted through the dependency submission API. This includes two new configuration parameters: retry-on-snapshot-warnings and retry-on-snapshot-warnings-timeout.

What's Changed

Fix(docs): Correct action input name by @oerd in actions/dependency-review-action#551

New Contributors

@oerd made their first contribution in actions/dependency-review-action#551

Full Changelog: https://github.com/actions/dependency-review-action/compare/v3...v3.1.0

3.0.8

What's Changed

... (truncated)

Commits

01bc870 bumping version
4b4f0de Merge pull request #623 from actions/fix-advisory-filters
a93fa86 Fixing test name.
550520e Merge pull request #624 from actions/dependabot/npm_and_yarn/typescript-5.3.2
2d0fb60 Merge pull request #625 from actions/dependabot/npm_and_yarn/typescript-eslin...
c07c237 Bump @typescript-eslint/eslint-plugin from 6.11.0 to 6.12.0
4d842d7 Bump typescript from 5.2.2 to 5.3.2
a6d4686 adding dist
4366dba Advisory filters should not drop entire dependencies.
50dafeb Tiny logic refactor.
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/konstruktoid/hardening/pull/351 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 12/21/2023 **Status:** ✅ Merged **Merged:** 12/21/2023 **Merged by:** [@konstruktoid](https://github.com/konstruktoid) **Base:** `master` ← **Head:** `dependabot/github_actions/actions/dependency-review-action-3.1.4` --- ### 📝 Commits (1) - [`fb6e739`](https://github.com/konstruktoid/hardening/commit/fb6e7397cec88b9407d7f76b2efc2633fa30ef76) Bump actions/dependency-review-action from 2.5.1 to 3.1.4 ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/dependency-review.yml` (+1 -1) </details> ### 📄 Description Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 2.5.1 to 3.1.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/dependency-review-action/releases">actions/dependency-review-action's releases</a>.</em></p> <blockquote> <h2>3.1.4</h2> <h2>What's Changed</h2> <ul> <li> <p>Fixed a <a href="https://redirect.github.com/actions/dependency-review-action/issues/618">bug</a> with severity filtering when using the <code>allow_ghsas</code> option: <a href="https://redirect.github.com/actions/dependency-review-action/pull/623">actions/dependency-review-action#623</a>.</p> </li> <li> <p>Updates dependencies:</p> <ul> <li>Bump <code>@types/node</code> from 16.18.61 to 16.18.62 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/619">actions/dependency-review-action#619</a> action/pull/620</li> <li>Bump <code>@typescript-eslint/eslint-plugin</code> from 6.11.0 to 6.12.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/625">actions/dependency-review-action#625</a></li> <li>Bump typescript from 5.2.2 to 5.3.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/624">actions/dependency-review-action#624</a></li> </ul> </li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/dependency-review-action/compare/v3...v3.1.4">https://github.com/actions/dependency-review-action/compare/v3...v3.1.4</a></p> <h2>3.1.3</h2> <h2>What's Changed</h2> <ul> <li>Fixes purl "version must be percent-encoded" by <a href="https://github.com/theztefan"><code>@theztefan</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/617">actions/dependency-review-action#617</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/dependency-review-action/compare/v3...v3.1.3">https://github.com/actions/dependency-review-action/compare/v3...v3.1.3</a></p> <h2>3.1.2</h2> <h2>What's Changed</h2> <ul> <li>Fix a regression for setups using self-hosted runners behind HTTP proxies:<a href="https://github.com/febuiles"><code>@febuiles</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/611">actions/dependency-review-action#611</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/dependency-review-action/compare/v3...v3.1.2">https://github.com/actions/dependency-review-action/compare/v3...v3.1.2</a></p> <h2>3.1.1</h2> <h2>What's Changed</h2> <ul> <li>Update a bunch of dependencies, including major version upgrades for <code>octokit</code>, <code>@actions/github</code> and <code>typescript</code>.</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/dependency-review-action/compare/v3.1.0...v3.1.1">https://github.com/actions/dependency-review-action/compare/v3.1.0...v3.1.1</a></p> <h2>3.1.0</h2> <h2>What's New</h2> <p>Added support for dependencies submitted through the <a href="https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#best-practices-for-using-the-dependency-review-api-and-the-dependency-submission-api-together">dependency submission API</a>. This includes two new configuration parameters: <code>retry-on-snapshot-warnings</code> and <code>retry-on-snapshot-warnings-timeout</code>.</p> <h2>What's Changed</h2> <ul> <li>Fix(docs): Correct action input name by <a href="https://github.com/oerd"><code>@oerd</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/551">actions/dependency-review-action#551</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/oerd"><code>@oerd</code></a> made their first contribution in <a href="https://redirect.github.com/actions/dependency-review-action/pull/551">actions/dependency-review-action#551</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/dependency-review-action/compare/v3...v3.1.0">https://github.com/actions/dependency-review-action/compare/v3...v3.1.0</a></p> <h2>3.0.8</h2> <h2>What's Changed</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/dependency-review-action/commit/01bc87099ba56df1e897b6874784491ea6309bc4"><code>01bc870</code></a> bumping version</li> <li><a href="https://github.com/actions/dependency-review-action/commit/4b4f0de8e1620c4be18d0da90012ccdf44131e85"><code>4b4f0de</code></a> Merge pull request <a href="https://redirect.github.com/actions/dependency-review-action/issues/623">#623</a> from actions/fix-advisory-filters</li> <li><a href="https://github.com/actions/dependency-review-action/commit/a93fa86c777e155ebd266bf2304bbaa1f1441f7b"><code>a93fa86</code></a> Fixing test name.</li> <li><a href="https://github.com/actions/dependency-review-action/commit/550520e2c57532fa895b3d4b6885b0344137a2fb"><code>550520e</code></a> Merge pull request <a href="https://redirect.github.com/actions/dependency-review-action/issues/624">#624</a> from actions/dependabot/npm_and_yarn/typescript-5.3.2</li> <li><a href="https://github.com/actions/dependency-review-action/commit/2d0fb60634ec35c35a1356b4631acc2f646d4dda"><code>2d0fb60</code></a> Merge pull request <a href="https://redirect.github.com/actions/dependency-review-action/issues/625">#625</a> from actions/dependabot/npm_and_yarn/typescript-eslin...</li> <li><a href="https://github.com/actions/dependency-review-action/commit/c07c2375ed277b1af382ec0ef5c93e260159b4c8"><code>c07c237</code></a> Bump <code>@typescript-eslint/eslint-plugin</code> from 6.11.0 to 6.12.0</li> <li><a href="https://github.com/actions/dependency-review-action/commit/4d842d754e57748932288daa14ee5f0de38bef2e"><code>4d842d7</code></a> Bump typescript from 5.2.2 to 5.3.2</li> <li><a href="https://github.com/actions/dependency-review-action/commit/a6d46863160cf427c41af940d53b8d32b289fe40"><code>a6d4686</code></a> adding dist</li> <li><a href="https://github.com/actions/dependency-review-action/commit/4366dbae42c015a363c2238839de69e3a20d4270"><code>4366dba</code></a> Advisory filters should not drop entire dependencies.</li> <li><a href="https://github.com/actions/dependency-review-action/commit/50dafeb5e4cbe3f213edd5b171daba2de1d469a1"><code>50dafeb</code></a> Tiny logic refactor.</li> <li>Additional commits viewable in <a href="https://github.com/actions/dependency-review-action/compare/0efb1d1d84fc9633afcdaad14c485cbbc90ef46c...01bc87099ba56df1e897b6874784491ea6309bc4">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/dependency-review-action&package-manager=github_actions&previous-version=2.5.1&new-version=3.1.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>