Skip to content

build(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0#1735

Merged
prymitive merged 1 commit intomainfrom
dependabot/github_actions/actions/dependency-review-action-4.9.0
Mar 9, 2026
Merged

build(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0#1735
prymitive merged 1 commit intomainfrom
dependabot/github_actions/actions/dependency-review-action-4.9.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 9, 2026

Bumps actions/dependency-review-action from 4.8.3 to 4.9.0.

Release notes

Sourced from actions/dependency-review-action's releases.

Dependency Review Action 4.9.0

This feature release contains a couple of notable changes:

  • There is a new configuration option show_patched_versions which will add a column to the output, showing the fix version of each vulnerable dependency. Thanks @​felickz!
  • Runs which do not display OpenSSF scorecards no longer fetch scorecard information; previously it was fetched regardless of whether or not it was displayed, causing unneccessary slowness. Great catch @​jantiebot!
  • There are a couple of fixes to purl parsing which should improve match accuracy for allow-package-dependency lists, including case (in)sensitivity and url-encoded namespaces Thanks @​juxtin!

What's Changed

New Contributors

Full Changelog: actions/dependency-review-action@v4.8.3...v4.9.0

Commits
  • 2031cfc Merge pull request #1064 from actions/ahpook/release-4.9.0
  • d02fa39 Updates for release 4.9.0
  • 4038a34 Merge pull request #1021 from actions/dependabot/github_actions/actions/check...
  • a632b83 Merge pull request #1058 from actions/dependabot/github_actions/actions/stale...
  • 57a3d46 Merge pull request #1060 from jantiebot/main
  • 5ecdc4b Merge pull request #1045 from forks-felickz/main
  • e8c2f9a fix: remove inferrable type annotation to pass eslint
  • 0e129e1 Prettier - Refactor summary table rendering for improved readability
  • aa60746 Add 'show-patched-versions' option to configuration and update summary handling
  • e404798 Merge upstream actions/dependency-review-action main
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 4.8.3 to 4.9.0.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@05fe457...2031cfc)

---
updated-dependencies:
- dependency-name: actions/dependency-review-action
  dependency-version: 4.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 9, 2026
@dependabot dependabot bot requested a review from prymitive as a code owner March 9, 2026 21:03
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 9, 2026
Copy link
Copy Markdown

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This pull request was validated by pint.

✔️ No problems found

Stats

Stat Value
Version v0.79.0-56-g3adc5ba5
Number of rules parsed 9
Number of rules checked 9
Number of problems found 0
Number of offline checks 0
Number of online checks 0
Checks duration 0

Problems

No problems reported

@github-actions
Copy link
Copy Markdown

github-actions bot commented Mar 9, 2026

Benchmark diff:

goos: linux
goarch: amd64
pkg: github.com/cloudflare/pint/cmd/pint
cpu: AMD EPYC 9V74 80-Core Processor                
                    │   old.txt   │              new.txt               │
                    │   sec/op    │   sec/op     vs base               │
GlobFinder-4          18.61m ± 1%   18.61m ± 1%       ~ (p=0.971 n=10)
GitFinder-4           442.7m ± 0%   444.8m ± 0%  +0.46% (p=0.000 n=10)
CheckRules-4           9.615 ± 1%    9.621 ± 1%       ~ (p=0.971 n=10)
RuleIsIdentical-4     5.779m ± 2%   5.758m ± 0%       ~ (p=0.143 n=10)
GetChecksForEntry-4   113.1m ± 1%   112.2m ± 1%       ~ (p=0.063 n=10)
geomean               138.9m        138.7m       -0.14%

                    │     old.txt     │                new.txt                 │
                    │      B/op       │     B/op       vs base                 │
GlobFinder-4           7.134Mi ± 0%      7.134Mi ± 0%       ~ (p=0.247 n=10)
GitFinder-4            16.08Mi ± 1%      16.09Mi ± 1%       ~ (p=0.739 n=10)
CheckRules-4          1012.3Mi ± 0%     1012.0Mi ± 0%       ~ (p=0.912 n=10)
RuleIsIdentical-4        0.000 ± 0%        0.000 ± 0%       ~ (p=1.000 n=10) ¹
GetChecksForEntry-4    56.55Mi ± 0%      56.55Mi ± 0%       ~ (p=0.382 n=10)
geomean                             ²                  -0.00%                ²
¹ all samples are equal
² summaries must be >0 to compute geomean

                    │    old.txt    │               new.txt                │
                    │   allocs/op   │  allocs/op   vs base                 │
GlobFinder-4          111.0k ± 0%     111.0k ± 0%  +0.00% (p=0.005 n=10)
GitFinder-4           148.7k ± 0%     148.7k ± 0%       ~ (p=0.196 n=10)
CheckRules-4          14.56M ± 0%     14.57M ± 0%       ~ (p=0.739 n=10)
RuleIsIdentical-4      0.000 ± 0%      0.000 ± 0%       ~ (p=1.000 n=10) ¹
GetChecksForEntry-4   916.3k ± 0%     916.3k ± 0%       ~ (p=0.731 n=10)
geomean                           ²                +0.01%                ²
¹ all samples are equal
² summaries must be >0 to compute geomean

pkg: github.com/cloudflare/pint/internal/parser
        │   old.txt   │              new.txt               │
        │   sec/op    │   sec/op     vs base               │
Parse-4   15.51m ± 3%   15.82m ± 1%  +1.97% (p=0.035 n=10)

        │   old.txt    │            new.txt             │
        │     B/op     │     B/op      vs base          │
Parse-4   6.306Mi ± 0%   6.306Mi ± 0%  ~ (p=0.279 n=10)

        │   old.txt   │             new.txt             │
        │  allocs/op  │  allocs/op   vs base            │
Parse-4   102.7k ± 0%   102.7k ± 0%  ~ (p=1.000 n=10) ¹
¹ all samples are equal

pkg: github.com/cloudflare/pint/internal/parser/source
               │   old.txt   │            new.txt            │
               │   sec/op    │   sec/op     vs base          │
LabelsSource-4   5.461m ± 1%   5.481m ± 1%  ~ (p=0.353 n=10)

               │   old.txt    │            new.txt             │
               │     B/op     │     B/op      vs base          │
LabelsSource-4   4.438Mi ± 0%   4.439Mi ± 0%  ~ (p=0.796 n=10)

               │   old.txt   │            new.txt            │
               │  allocs/op  │  allocs/op   vs base          │
LabelsSource-4   36.34k ± 0%   36.34k ± 0%  ~ (p=0.932 n=10)

pkg: github.com/cloudflare/pint/internal/promapi
                    │   old.txt   │            new.txt             │
                    │   sec/op    │    sec/op     vs base          │
QueryCacheOnlySet-4   110.1n ± 0%   124.4n ± 12%  ~ (p=0.104 n=10)

                    │  old.txt   │            new.txt             │
                    │    B/op    │    B/op     vs base            │
QueryCacheOnlySet-4   64.00 ± 0%   64.00 ± 0%  ~ (p=1.000 n=10) ¹
¹ all samples are equal

                    │  old.txt   │            new.txt             │
                    │ allocs/op  │ allocs/op   vs base            │
QueryCacheOnlySet-4   1.000 ± 0%   1.000 ± 0%  ~ (p=1.000 n=10) ¹
¹ all samples are equal

@prymitive prymitive merged commit 17a8d96 into main Mar 9, 2026
18 checks passed
@prymitive prymitive deleted the dependabot/github_actions/actions/dependency-review-action-4.9.0 branch March 9, 2026 21:23
@codecov-commenter
Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.56%. Comparing base (55ec7ff) to head (3adc5ba).
⚠️ Report is 12 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1735   +/-   ##
=======================================
  Coverage   99.56%   99.56%           
=======================================
  Files         109      109           
  Lines       13215    13215           
=======================================
  Hits        13158    13158           
  Misses         32       32           
  Partials       25       25           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants