starred/hardening

Fork 0

mirror of https://github.com/konstruktoid/hardening.git synced 2026-04-25 16:55:53 +03:00

[PR #729] [MERGED] chore(deps): update actions/dependency-review-action action to v4.8.3 #728

New issue

Closed

opened 2026-03-03 14:32:30 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 14:32:30 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/konstruktoid/hardening/pull/729
Author: @renovate[bot]
Created: 2/20/2026
Status: ✅ Merged
Merged: 2/20/2026
Merged by: @renovate[bot]

Base: master ← Head: renovate/actions-dependency-review-action-4.x

📝 Commits (1)

75b315a chore(deps): update actions/dependency-review-action action to v4.8.3

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 .github/workflows/dependency-review.yml (+1 -1)

📄 Description

This PR contains the following updates:

Package	Type	Update	Change
actions/dependency-review-action	action	patch	`v4.8.2` → `v4.8.3`

Release Notes

actions/dependency-review-action (actions/dependency-review-action)

`v4.8.3`: 4.8.3

Compare Source

Dependency Review Action v4.8.3

This is a bugfix release that updates a number of upstream dependencies and includes a fix for the earlier feature that detected oversized summaries and upload them as artifacts, which could occasionally crash the action.

We have also updated the release process to use a long-lived v4 branch for the action, instead of a force-pushed tag, which aligns better with git branching strategies; the change should be transparent to end users.

What's Changed

GitHub Actions can't push to our protected main by @dangoor in #1017
Bump actions/stale from 9.1.0 to 10.1.0 by @dependabot[bot] in #995
Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #1003
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #1005
Upgrade glob to address a vulnerability by @brrygrdn in #1024
Bump js-yaml by @dependabot[bot] in #1020
Addressing vulnerabilities by @Ahmed3lmallah in #1036
Bump fast-xml-parser from 5.3.3 to 5.3.5 by @dependabot[bot] in #1050
Bump fast-xml-parser from 5.3.5 to 5.3.6 by @dependabot[bot] in #1053
Properly truncate long summaries and catch errors by @juxtin in #1052
Bump spdx-expression-parse from 3.0.1 to 4.0.0 in the spdx-licenses group across 1 directory by @dependabot[bot] in #931
Changes for Release 4.8.3 by @ahpook in #1054

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.8.2..v4.8.3

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/konstruktoid/hardening/pull/729 **Author:** [@renovate[bot]](https://github.com/apps/renovate) **Created:** 2/20/2026 **Status:** ✅ Merged **Merged:** 2/20/2026 **Merged by:** [@renovate[bot]](https://github.com/apps/renovate) **Base:** `master` ← **Head:** `renovate/actions-dependency-review-action-4.x` --- ### 📝 Commits (1) - [`75b315a`](https://github.com/konstruktoid/hardening/commit/75b315ac3d60e4160e204bb723ca210de666c367) chore(deps): update actions/dependency-review-action action to v4.8.3 ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/dependency-review.yml` (+1 -1) </details> ### 📄 Description This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/dependency-review-action](https://redirect.github.com/actions/dependency-review-action) | action | patch | `v4.8.2` → `v4.8.3` | --- ### Release Notes <details> <summary>actions/dependency-review-action (actions/dependency-review-action)</summary> ### [`v4.8.3`](https://redirect.github.com/actions/dependency-review-action/releases/tag/v4.8.3): 4.8.3 [Compare Source](https://redirect.github.com/actions/dependency-review-action/compare/v4.8.2...v4.8.3) #### Dependency Review Action v4.8.3 This is a bugfix release that updates a number of upstream dependencies and includes a fix for the earlier feature that detected oversized summaries and upload them as artifacts, which could occasionally crash the action. We have also updated the release process to use a long-lived `v4` **branch** for the action, instead of a force-pushed tag, which aligns better with git branching strategies; the change should be transparent to end users. #### What's Changed - GitHub Actions can't push to our protected main by [@dangoor](https://redirect.github.com/dangoor) in [#1017](https://redirect.github.com/actions/dependency-review-action/pull/1017) - Bump actions/stale from 9.1.0 to 10.1.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#995](https://redirect.github.com/actions/dependency-review-action/pull/995) - Bump github/codeql-action from 3 to 4 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#1003](https://redirect.github.com/actions/dependency-review-action/pull/1003) - Bump actions/setup-node from 4 to 6 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#1005](https://redirect.github.com/actions/dependency-review-action/pull/1005) - Upgrade glob to address a vulnerability by [@brrygrdn](https://redirect.github.com/brrygrdn) in [#1024](https://redirect.github.com/actions/dependency-review-action/pull/1024) - Bump js-yaml by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#1020](https://redirect.github.com/actions/dependency-review-action/pull/1020) - Addressing vulnerabilities by [@Ahmed3lmallah](https://redirect.github.com/Ahmed3lmallah) in [#1036](https://redirect.github.com/actions/dependency-review-action/pull/1036) - Bump fast-xml-parser from 5.3.3 to 5.3.5 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#1050](https://redirect.github.com/actions/dependency-review-action/pull/1050) - Bump fast-xml-parser from 5.3.5 to 5.3.6 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#1053](https://redirect.github.com/actions/dependency-review-action/pull/1053) - Properly truncate long summaries and catch errors by [@juxtin](https://redirect.github.com/juxtin) in [#1052](https://redirect.github.com/actions/dependency-review-action/pull/1052) - Bump spdx-expression-parse from 3.0.1 to 4.0.0 in the spdx-licenses group across 1 directory by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#931](https://redirect.github.com/actions/dependency-review-action/pull/931) - Changes for Release 4.8.3 by [@ahpook](https://redirect.github.com/ahpook) in [#1054](https://redirect.github.com/actions/dependency-review-action/pull/1054) **Full Changelog**: <https://github.com/actions/dependency-review-action/compare/v4.8.2..v4.8.3> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/konstruktoid/hardening).  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem

2026-03-03 14:32:30 +03:00

closed this issue
added the
pull-request
label

No labels

Stale

bug

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/hardening#728

No description provided.

Rows
Columns