[PR #532] [MERGED] build(deps): bump actions/dependency-review-action from 4.4.0 to 4.5.0 #538

New issue

Closed

opened 2026-03-03 14:31:38 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 14:31:38 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/konstruktoid/hardening/pull/532
Author: @dependabot[bot]
Created: 11/21/2024
Status: ✅ Merged
Merged: 11/21/2024
Merged by: @konstruktoid

Base: master ← Head: dependabot/github_actions/actions/dependency-review-action-4.5.0

📝 Commits (1)

fa9cd4a build(deps): bump actions/dependency-review-action from 4.4.0 to 4.5.0

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 .github/workflows/dependency-review.yml (+1 -1)

📄 Description

Bumps actions/dependency-review-action from 4.4.0 to 4.5.0.

Release notes

Sourced from actions/dependency-review-action's releases.

v4.5.0

What's Changed

Bump got from 14.4.2 to 14.4.3 by @dependabot in actions/dependency-review-action#844

Bump nodemon from 3.1.0 to 3.1.7 by @dependabot in actions/dependency-review-action#847

Bump @vercel/ncc from 0.38.1 to 0.38.3 by @dependabot in actions/dependency-review-action#849

Overriding the cross-spawn dependency to use a safe version by @Ahmed3lmallah in actions/dependency-review-action#850

fix: add summary comment on failure when warn-only: true by @ebickle in actions/dependency-review-action#827

Prepare for 4.5.0 release by @Ahmed3lmallah in actions/dependency-review-action#851

New Contributors

@ebickle made their first contribution in actions/dependency-review-action#827

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4...v4.5.0

Commits

3b139cf Merge pull request #851 from actions/ahmed3lmallah/prepare-for-4.5.0-release
d6807b6 updating generated code
c89b41f addressing lint issues
eee97d8 incrementing project version
9d10182 Merge pull request #827 from ebickle/fix/comment-warn-only
9192be9 Merge pull request #850 from actions/ahmed3lmallah/adressing-CVE-2024-21538
2fc8e23 Using cross-spawn safe version
fb86db2 fix: resolve race conditions in async core.group calls
0a198ab fix: replace integer failureCount with boolean
fc499fc Merge branch 'main' into fix/comment-warn-only
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/konstruktoid/hardening/pull/532 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 11/21/2024 **Status:** ✅ Merged **Merged:** 11/21/2024 **Merged by:** [@konstruktoid](https://github.com/konstruktoid) **Base:** `master` ← **Head:** `dependabot/github_actions/actions/dependency-review-action-4.5.0` --- ### 📝 Commits (1) - [`fa9cd4a`](https://github.com/konstruktoid/hardening/commit/fa9cd4af8174ad79d8a157a4cf2eb1b5e1921195) build(deps): bump actions/dependency-review-action from 4.4.0 to 4.5.0 ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/dependency-review.yml` (+1 -1) </details> ### 📄 Description Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 4.4.0 to 4.5.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/dependency-review-action/releases">actions/dependency-review-action's releases</a>.</em></p> <blockquote> <h2>v4.5.0</h2> <h2>What's Changed</h2> <ul> <li>Bump got from 14.4.2 to 14.4.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/844">actions/dependency-review-action#844</a></li> <li>Bump nodemon from 3.1.0 to 3.1.7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/847">actions/dependency-review-action#847</a></li> <li>Bump <code>@vercel/ncc</code> from 0.38.1 to 0.38.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/849">actions/dependency-review-action#849</a></li> <li>Overriding the cross-spawn dependency to use a safe version by <a href="https://github.com/Ahmed3lmallah"><code>@Ahmed3lmallah</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/850">actions/dependency-review-action#850</a></li> <li>fix: add summary comment on failure when warn-only: true by <a href="https://github.com/ebickle"><code>@ebickle</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/827">actions/dependency-review-action#827</a></li> <li>Prepare for 4.5.0 release by <a href="https://github.com/Ahmed3lmallah"><code>@Ahmed3lmallah</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/851">actions/dependency-review-action#851</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ebickle"><code>@ebickle</code></a> made their first contribution in <a href="https://redirect.github.com/actions/dependency-review-action/pull/827">actions/dependency-review-action#827</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/dependency-review-action/compare/v4...v4.5.0">https://github.com/actions/dependency-review-action/compare/v4...v4.5.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/dependency-review-action/commit/3b139cfc5fae8b618d3eae3675e383bb1769c019"><code>3b139cf</code></a> Merge pull request <a href="https://redirect.github.com/actions/dependency-review-action/issues/851">#851</a> from actions/ahmed3lmallah/prepare-for-4.5.0-release</li> <li><a href="https://github.com/actions/dependency-review-action/commit/d6807b6643179f05418e138a25fff841c8646a2a"><code>d6807b6</code></a> updating generated code</li> <li><a href="https://github.com/actions/dependency-review-action/commit/c89b41fdc6d9794d60f1090afe0dca3a28344f01"><code>c89b41f</code></a> addressing lint issues</li> <li><a href="https://github.com/actions/dependency-review-action/commit/eee97d8b03930b9729cc733c2064b81da03229ec"><code>eee97d8</code></a> incrementing project version</li> <li><a href="https://github.com/actions/dependency-review-action/commit/9d101822a37e3a155f1fbce62bf70039ae01e834"><code>9d10182</code></a> Merge pull request <a href="https://redirect.github.com/actions/dependency-review-action/issues/827">#827</a> from ebickle/fix/comment-warn-only</li> <li><a href="https://github.com/actions/dependency-review-action/commit/9192be9c722c974bdd08907626f2da15cccc50d6"><code>9192be9</code></a> Merge pull request <a href="https://redirect.github.com/actions/dependency-review-action/issues/850">#850</a> from actions/ahmed3lmallah/adressing-CVE-2024-21538</li> <li><a href="https://github.com/actions/dependency-review-action/commit/2fc8e23b125c76dce6fd50617e881d942f205855"><code>2fc8e23</code></a> Using cross-spawn safe version</li> <li><a href="https://github.com/actions/dependency-review-action/commit/fb86db204331e3278a86fde515f9a3856cdd2e61"><code>fb86db2</code></a> fix: resolve race conditions in async core.group calls</li> <li><a href="https://github.com/actions/dependency-review-action/commit/0a198ab3ed7324295cb94cee2d50a07dbe3fbe20"><code>0a198ab</code></a> fix: replace integer failureCount with boolean</li> <li><a href="https://github.com/actions/dependency-review-action/commit/fc499fc13affcdbaad5544148db6cef2cfd5a377"><code>fc499fc</code></a> Merge branch 'main' into fix/comment-warn-only</li> <li>Additional commits viewable in <a href="https://github.com/actions/dependency-review-action/compare/4081bf99e2866ebe428fc0477b69eb4fcda7220a...3b139cfc5fae8b618d3eae3675e383bb1769c019">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/dependency-review-action&package-manager=github_actions&previous-version=4.4.0&new-version=4.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>