From b532ca72ffba44d831150871b0ce6cf30a156fb4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 30 Jan 2025 08:44:56 -0800
Subject: [PATCH] Bump actions/dependency-review-action from 2.5.1 to 4.5.0
 (#2103)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[actions/dependency-review-action](https://github.com/actions/dependency-review-action)
from 2.5.1 to 4.5.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/dependency-review-action/releases">actions/dependency-review-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.5.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump got from 14.4.2 to 14.4.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/844">actions/dependency-review-action#844</a></li>
<li>Bump nodemon from 3.1.0 to 3.1.7 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/847">actions/dependency-review-action#847</a></li>
<li>Bump <code>@​vercel/ncc</code> from 0.38.1 to 0.38.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/849">actions/dependency-review-action#849</a></li>
<li>Overriding the cross-spawn dependency to use a safe version by <a
href="https://github.com/Ahmed3lmallah"><code>@​Ahmed3lmallah</code></a>
in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/850">actions/dependency-review-action#850</a></li>
<li>fix: add summary comment on failure when warn-only: true by <a
href="https://github.com/ebickle"><code>@​ebickle</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/827">actions/dependency-review-action#827</a></li>
<li>Prepare for 4.5.0 release by <a
href="https://github.com/Ahmed3lmallah"><code>@​Ahmed3lmallah</code></a>
in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/851">actions/dependency-review-action#851</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/ebickle"><code>@​ebickle</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/827">actions/dependency-review-action#827</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/dependency-review-action/compare/v4...v4.5.0">https://github.com/actions/dependency-review-action/compare/v4...v4.5.0</a></p>
<h2>v4.4.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix for merge_group event bug by <a
href="https://github.com/Ahmed3lmallah"><code>@​Ahmed3lmallah</code></a>
in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/846">actions/dependency-review-action#846</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/dependency-review-action/compare/v4.3.5...v4.4.0">https://github.com/actions/dependency-review-action/compare/v4.3.5...v4.4.0</a></p>
<h2>v4.3.5</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: getRefs function to handle merge_group events by <a
href="https://github.com/louis-bompart"><code>@​louis-bompart</code></a>
in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/766">actions/dependency-review-action#766</a></li>
<li>Create pull_request_template.md by <a
href="https://github.com/jonjanego"><code>@​jonjanego</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/794">actions/dependency-review-action#794</a></li>
<li>Update CONTRIBUTING.md by <a
href="https://github.com/jonjanego"><code>@​jonjanego</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/793">actions/dependency-review-action#793</a></li>
<li>Bump <code>@​types/node</code> from 20.11.28 to 20.16.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/815">actions/dependency-review-action#815</a></li>
<li>Upgrade transitive micromatch library by <a
href="https://github.com/elireisman"><code>@​elireisman</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/829">actions/dependency-review-action#829</a></li>
<li>Do not list changed dependencies in summary by <a
href="https://github.com/hmaurer"><code>@​hmaurer</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/828">actions/dependency-review-action#828</a></li>
<li>Update stale.yaml by <a
href="https://github.com/jonjanego"><code>@​jonjanego</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/832">actions/dependency-review-action#832</a></li>
<li>Bump got from 14.4.1 to 14.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/822">actions/dependency-review-action#822</a></li>
<li>Bump eslint-plugin-jest and ts-jest by <a
href="https://github.com/Ahmed3lmallah"><code>@​Ahmed3lmallah</code></a>
in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/840">actions/dependency-review-action#840</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/louis-bompart"><code>@​louis-bompart</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/766">actions/dependency-review-action#766</a></li>
<li><a
href="https://github.com/Ahmed3lmallah"><code>@​Ahmed3lmallah</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/840">actions/dependency-review-action#840</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/dependency-review-action/compare/v4.3.4...v4.3.5">https://github.com/actions/dependency-review-action/compare/v4.3.4...v4.3.5</a></p>
<h2>v4.3.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Include all added dependencies in scorecard entries by <a
href="https://github.com/elireisman"><code>@​elireisman</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/783">actions/dependency-review-action#783</a></li>
<li>Update SPDX Expression Parsing by <a
href="https://github.com/febuiles"><code>@​febuiles</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/719">actions/dependency-review-action#719</a>
<ul>
<li>This PR is a significant refactor of SPDX expression parsing that
<em>may</em> fix some bugs, but unfortunately there are several related
known issues that remain unresolved as of this version.</li>
</ul>
</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/dependency-review-action/compare/v4.3.3...v4.3.4">https://github.com/actions/dependency-review-action/compare/v4.3.3...v4.3.4</a></p>
<h2>Notes for v4.3.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Allow slashes in purl package names by <a
href="https://github.com/juxtin"><code>@​juxtin</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/765">actions/dependency-review-action#765</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/dependency-review-action/commit/3b139cfc5fae8b618d3eae3675e383bb1769c019"><code>3b139cf</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/dependency-review-action/issues/851">#851</a>
from actions/ahmed3lmallah/prepare-for-4.5.0-release</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/d6807b6643179f05418e138a25fff841c8646a2a"><code>d6807b6</code></a>
updating generated code</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/c89b41fdc6d9794d60f1090afe0dca3a28344f01"><code>c89b41f</code></a>
addressing lint issues</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/eee97d8b03930b9729cc733c2064b81da03229ec"><code>eee97d8</code></a>
incrementing project version</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/9d101822a37e3a155f1fbce62bf70039ae01e834"><code>9d10182</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/dependency-review-action/issues/827">#827</a>
from ebickle/fix/comment-warn-only</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/9192be9c722c974bdd08907626f2da15cccc50d6"><code>9192be9</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/dependency-review-action/issues/850">#850</a>
from actions/ahmed3lmallah/adressing-CVE-2024-21538</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/2fc8e23b125c76dce6fd50617e881d942f205855"><code>2fc8e23</code></a>
Using cross-spawn safe version</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/fb86db204331e3278a86fde515f9a3856cdd2e61"><code>fb86db2</code></a>
fix: resolve race conditions in async core.group calls</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/0a198ab3ed7324295cb94cee2d50a07dbe3fbe20"><code>0a198ab</code></a>
fix: replace integer failureCount with boolean</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/fc499fc13affcdbaad5544148db6cef2cfd5a377"><code>fc499fc</code></a>
Merge branch 'main' into fix/comment-warn-only</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/dependency-review-action/compare/0efb1d1d84fc9633afcdaad14c485cbbc90ef46c...3b139cfc5fae8b618d3eae3675e383bb1769c019">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/dependency-review-action&package-manager=github_actions&previous-version=2.5.1&new-version=4.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/pr_3p_deps.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pr_3p_deps.yaml b/.github/workflows/pr_3p_deps.yaml
index c78a17e7e72..0db36e85bc3 100644
--- a/.github/workflows/pr_3p_deps.yaml
+++ b/.github/workflows/pr_3p_deps.yaml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3  # v3.5.0
-    - uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c  # v2.5.1
+    - uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019  # v4.5.0
       with:
         # Refer to the following for the allowlist.
         # https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md#approved-licenses-for-allowlist