Bump actions/dependency-review-action from 4.1.3 to 4.3.1

[dependabot[bot]]

Bumps actions/dependency-review-action from 4.1.3 to 4.3.1.

Release notes

Sourced from actions/dependency-review-action's releases.

v4.3.1

What's Changed

This release fixes some bugs related to package-url parsing that were introduced in 4.3.0. See actions/dependency-review-action#753.

Full Changelog: https://github.com/actions/dependency-review-action/compare/V4.3.0...v4.3.1

v4.3.0

New Features

• The deny-packages option can now be used without a version number to exclude all versions of a package.

What's Changed

• Fix action variable name for scorecard by @​lukehinds in actions/dependency-review-action#735
• Fix extra https:// in summary by @​jhutchings1 in actions/dependency-review-action#748
• Bump typescript from 5.3.3 to 5.4.5 by @​dependabot in actions/dependency-review-action#744
• Bump eslint-plugin-github from 4.10.1 to 4.10.2 by @​dependabot in actions/dependency-review-action#737
• Show denied packages with red X by @​juxtin in actions/dependency-review-action#750
• deny-packages configuration option can deny specified version or all packages by @​febuiles and @​bteng22 in actions/dependency-review-action#733

New Contributors

• @​bteng22 made their first contribution in actions/dependency-review-action#733
• @​lukehinds made their first contribution in actions/dependency-review-action#735

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.2.5...V4.3.0

4.2.5

What's Changed

• Fixed a bug where some configuration options in external files were not being properly picked up -- actions/dependency-review-action#722
• Bump eslint from 8.56.0 to 8.57.0

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.2.4...v4.2.5

v4.2.4

What's Changed

Fixed a bug in the output of OpenSSF cards for GitHub Actions.

New Contributors

• @​sporkmonger made their first contribution in actions/dependency-review-action#721

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.2.3...v4.2.4

4.2.3

What's Changed

• Set comment as output by @​jsoref in actions/dependency-review-action#698
• Add support for calculating OpenSSF Scorecards by @​jhutchings1 in actions/dependency-review-action#709
• Add outputs for the changes data by @​laughedelic in actions/dependency-review-action#707

New Contributors

... (truncated)

Commits

• e58c696 Merge pull request #758 from actions/juxtin/prepare-4.3.1
• 9b7c72d Change version to 4.3.1
• 7dcfabf Merge pull request #753 from actions/juxtin/debug-purl
• 5f0808f Validate that deny-packages purls are complete
• fcc66c2 Refine purl parsing and tests
• 1dd418b Basic tests for PURL validation in config
• 6406179 Replace packageurl-js with our own implementation
• 2034bab Bypass purls (mostly) for deny checks
• 7e773b1 Log offending purl
• a346092 Parse purls cautiously in getDeniedChanges
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot[bot]]

Superseded by #114.