Repository navigation
fix: bump advanced-security/component-detection-dependency-submission-action from 0.1.6 to 0.2.0 - #2397
Conversation
dependabot
Bot
added
dependencies
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Dependency Review SummaryThe full dependency review summary was too large to display here (13010KB, limit is 1024KB). Please download the artifact named "dependency-review-summary" to view the complete report. |
groupthinking
left a comment
groupthinking
left a comment
There was a problem hiding this comment.
Review at head 43fc8eeb: dependency-review fails on this GitHub Action update. Please inspect the flagged dependency result, resolve the incompatibility or document a justified exception, and rerun the exact-head check before approval.
…-action Bumps [advanced-security/component-detection-dependency-submission-action](https://github.com/advanced-security/component-detection-dependency-submission-action) from 0.1.6 to 0.2.0. - [Release notes](https://github.com/advanced-security/component-detection-dependency-submission-action/releases) - [Commits](advanced-security/component-detection-dependency-submission-action@b282c67...a02aeda) --- updated-dependencies: - dependency-name: advanced-security/component-detection-dependency-submission-action dependency-version: 0.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
43fc8ee to
f5b4d06
Compare
groupthinking
left a comment
groupthinking
left a comment
There was a problem hiding this comment.
Code review at exact head cf6d2ec62a55abeecbd8ba17381fdf517a4a1f38: the effective diff only advances the three pinned component-detection submission action references to the verified v0.2.0 tag SHA. The upstream v0.2.0 source builds dependency packages and scope per manifest, addressing the older version’s cross-manifest scope-mapping risk seen with fast-uri; 20 focused workflow tests and the current hosted code checks pass. This approval covers that narrow action update and supersedes my earlier generic requested-changes review on the old head. It does not approve a dependency verdict or a merge: the exact-head dependency-review run still warns about 3 base versus 1 head snapshot, then exceeds GitHub’s output-expression limit and uploads no evidence artifact. The separate v0.2.0 canary #2494 also failed snapshot parity. Keep #2397 open and unmerged until the shared workflow produces complete, semantically checked evidence on the final head.
Review update — 2026-10-28
Current head
cf6d2ec62a55abeecbd8ba17381fdf517a4a1f38merges currentmain(ba2777d1b008c2148d413e07cc497791966310e0). Its effective diff changes only the three pinnedadvanced-security/component-detection-dependency-submission-actionreferences in.github/workflows/dependency-review.ymlfrom v0.1.6 to the verified v0.2.0 tag SHAa02aeda7a175ad4dd38a13c4d3ff2df9da8f2cf0. All 20 focused workflow tests andgit diff --checkpassed. Hosted checks finished 25 passed, 3 skipped, 1 failed. The remainingdependency-reviewfailure is the pre-existing evidence expression exceeding GitHub's template memory limit; no evidence artifact was uploaded. That fix is pending in #2487.The upstream v0.2.0 release includes a manifest-mapping fix, but the real fast-uri diagnostic #2494 still encountered 3 base versus 1 head snapshots and a misleading diff with 1,347 temporary-path removals. #2494 closed unmerged; the underlying snapshot parity issue remains open as #2490. This PR is open for review, not established as the parity fix or ready to merge. The original Dependabot release notes follow.
Original Dependabot notes
Bumps advanced-security/component-detection-dependency-submission-action from 0.1.6 to 0.2.0.
Release notes
Sourced from advanced-security/component-detection-dependency-submission-action's releases.
Commits
a02aedachore: bump version (minor) (#256)2b3feceMerge main into deps/fail-on-empty and rebuild dist (#255)ac3bac2Bump pinned undici to 6.28.1 (GHSA-rfgv-xxqx-mfg5) (#254)b256103chore(deps): bump the npm-dependencies group across 1 directory with 6 update...0fa5d39Fix dependency snapshot manifest generation (#249)ce792dcchore(deps): bump the npm-dependencies group across 1 directory with 4 update...2dfcd4cchore(deps): bump advanced-security/reusable-workflows/.github/workflows/rele...