［Historical PR］ deps（actions）: bump actions/dependency-review-action from 4 to 5 #141

Historical pull request 141
Original state: merged
Originally created: 2026-06-29T04:44:02Z
Restored as documentation; authors, timestamps, and native events are not replayed.

Bumps ［actions/dependency-review-action］（https：//github．com/actions/dependency-review-action） from 4 to 5.
＜details＞
＜summary＞Release notes＜/summary＞
＜p＞＜em＞Sourced from ＜a href="https：//github．com/actions/dependency-review-action/releases"＞actions/dependency-review-action's releases＜/a＞.＜/em＞＜/p＞
＜blockquote＞
＜h2＞5.0.0＜/h2＞
＜p＞This is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version ＜a href="https：//github．com/actions/runner/releases/tag/v2.327.1"＞v2.327.1＜/a＞ to run.＜/p＞
＜h2＞What's Changed＜/h2＞
＜ul＞
＜li＞Add .github/copilot-instructions.md for Copilot coding agent by ＜a href="https：//github．com/ahpook"＞＜code＞＠ahpook＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1067"＞actions/dependency-review-action＃1067＜/a＞＜/li＞
＜li＞Update Node.js runtime from 20 to 24 by ＜a href="https：//github．com/scottschreckengaust"＞＜code＞＠scottschreckengaust＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1084"＞actions/dependency-review-action＃1084＜/a＞＜/li＞
＜li＞Bump spdx-license-ids from 3.0.20 to 3.0.23 by ＜a href="https：//github．com/mongolyy"＞＜code＞＠mongolyy＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1091"＞actions/dependency-review-action＃1091＜/a＞＜/li＞
＜li＞docs: bump actions/checkout from v4 to v6 in workflow examples by ＜a href="https：//github．com/Marukome0743"＞＜code＞＠Marukome0743＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1077"＞actions/dependency-review-action＃1077＜/a＞＜/li＞
＜li＞fix: patched version display for advisories with non-strict semver ranges （e.g. Maven beta versions） by ＜a href="https：//github．com/tspascoal"＞＜code＞＠tspascoal＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1076"＞actions/dependency-review-action＃1076＜/a＞＜/li＞
＜li＞Resolve security findings by ＜a href="https：//github．com/AshelyTC"＞＜code＞＠AshelyTC＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1094"＞actions/dependency-review-action＃1094＜/a＞＜/li＞
＜li＞v5.0.0 release branch by ＜a href="https：//github．com/ahpook"＞＜code＞＠ahpook＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1098"＞actions/dependency-review-action＃1098＜/a＞＜/li＞
＜/ul＞
＜h2＞New Contributors＜/h2＞
＜ul＞
＜li＞＜a href="https：//github．com/scottschreckengaust"＞＜code＞＠scottschreckengaust＜/code＞＜/a＞ made their first contribution in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1084"＞actions/dependency-review-action＃1084＜/a＞＜/li＞
＜li＞＜a href="https：//github．com/mongolyy"＞＜code＞＠mongolyy＜/code＞＜/a＞ made their first contribution in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1091"＞actions/dependency-review-action＃1091＜/a＞＜/li＞
＜li＞＜a href="https：//github．com/Marukome0743"＞＜code＞＠Marukome0743＜/code＞＜/a＞ made their first contribution in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1077"＞actions/dependency-review-action＃1077＜/a＞＜/li＞
＜/ul＞
＜p＞＜strong＞Full Changelog＜/strong＞: ＜a href="https：//github．com/actions/dependency-review-action/compare/v4.9.0...v5.0.0"＞https：//github．com/actions/dependency-review-action/compare/v4.9.0...v5.0.0＜/a＞＜/p＞
＜h2＞Dependency Review Action 4.9.0＜/h2＞
＜p＞This feature release contains a couple of notable changes:＜/p＞
＜ul＞
＜li＞There is a new configuration option ＜code＞show＿patched＿versions＜/code＞ which will add a column to the output, showing the fix version of each vulnerable dependency. Thanks ＜a href="https：//github．com/felickz"＞＜code＞＠felickz＜/code＞＜/a＞！＜/li＞
＜li＞Runs which do not display OpenSSF scorecards no longer fetch scorecard information; previously it was fetched regardless of whether or not it was displayed, causing unneccessary slowness. Great catch ＜a href="https：//github．com/jantiebot"＞＜code＞＠jantiebot＜/code＞＜/a＞！＜/li＞
＜li＞There are a couple of fixes to purl parsing which should improve match accuracy for ＜code＞allow-package-dependency＜/code＞ lists, including case （in）sensitivity and url-encoded namespaces Thanks ＜a href="https：//github．com/juxtin"＞＜code＞＠juxtin＜/code＞＜/a＞！＜/li＞
＜/ul＞
＜h2＞What's Changed＜/h2＞
＜ul＞
＜li＞Compare normalized purls to account for encoding quirks by ＜a href="https：//github．com/juxtin"＞＜code＞＠juxtin＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1056"＞actions/dependency-review-action＃1056＜/a＞＜/li＞
＜li＞Make purl comparisons case insensitive by ＜a href="https：//github．com/juxtin"＞＜code＞＠juxtin＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1057"＞actions/dependency-review-action＃1057＜/a＞＜/li＞
＜li＞Feat: Add ＜code＞Patched Version＜/code＞ to ＜code＞Vulnerabilities＜/code＞ summary by ＜a href="https：//github．com/felickz"＞＜code＞＠felickz＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1045"＞actions/dependency-review-action＃1045＜/a＞＜/li＞
＜li＞fix: only get scorecard levels if user wants to see the OpenSSF scorecard by ＜a href="https：//github．com/jantiebot"＞＜code＞＠jantiebot＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1060"＞actions/dependency-review-action＃1060＜/a＞＜/li＞
＜li＞Bump actions/stale from 10.1.0 to 10.2.0 by ＜a href="https：//github．com/dependabot"＞＜code＞＠dependabot＜/code＞＜/a＞［bot］ in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1058"＞actions/dependency-review-action＃1058＜/a＞＜/li＞
＜li＞Bump actions/checkout from 4 to 6 by ＜a href="https：//github．com/dependabot"＞＜code＞＠dependabot＜/code＞＜/a＞［bot］ in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1021"＞actions/dependency-review-action＃1021＜/a＞＜/li＞
＜li＞Updates for release 4.9.0 by ＜a href="https：//github．com/ahpook"＞＜code＞＠ahpook＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1064"＞actions/dependency-review-action＃1064＜/a＞＜/li＞
＜/ul＞
＜h2＞New Contributors＜/h2＞
＜ul＞
＜li＞＜a href="https：//github．com/jantiebot"＞＜code＞＠jantiebot＜/code＞＜/a＞ made their first contribution in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1060"＞actions/dependency-review-action＃1060＜/a＞＜/li＞
＜/ul＞
＜p＞＜strong＞Full Changelog＜/strong＞: ＜a href="https：//github．com/actions/dependency-review-action/compare/v4.8.3...v4.9.0"＞https：//github．com/actions/dependency-review-action/compare/v4.8.3...v4.9.0＜/a＞＜/p＞
＜h2＞4.8.3＜/h2＞
＜h2＞Dependency Review Action v4.8.3＜/h2＞
＜p＞This is a bugfix release that updates a number of upstream dependencies and includes a fix for the earlier feature that detected oversized summaries and upload them as artifacts, which could occasionally crash the action.＜/p＞
＜p＞We have also updated the release process to use a long-lived ＜code＞v4＜/code＞ ＜strong＞branch＜/strong＞ for the action, instead of a force-pushed tag, which aligns better with git branching strategies; the change should be transparent to end users.＜/p＞
＜h2＞What's Changed＜/h2＞
＜ul＞
＜li＞GitHub Actions can't push to our protected main by ＜a href="https：//github．com/dangoor"＞＜code＞＠dangoor＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/1017"＞actions/dependency-review-action＃1017＜/a＞＜/li＞
＜li＞Bump actions/stale from 9.1.0 to 10.1.0 by ＜a href="https：//github．com/dependabot"＞＜code＞＠dependabot＜/code＞＜/a＞［bot］ in ＜a href="https：//redirect．github．com/actions/dependency-review-action/pull/995"＞actions/dependency-review-action＃995＜/a＞＜/li＞
＜/ul＞
＜！-- raw HTML omitted --＞
＜/blockquote＞
＜p＞... （truncated）＜/p＞
＜/details＞
＜details＞
＜summary＞Commits＜/summary＞
＜ul＞
＜li＞＜a href="https：//github．com/actions/dependency-review-action/commit/ａ１ｄ２８２ｂ３６ｂ６ｆ３５１９ａａ１ｆ３ｆｃ６３６ｆ６０９ｃ４７ｄｄｄｂ２９４"＞＜code＞ａ１ｄ２８２ｂ＜/code＞＜/a＞ Merge pull request ＜a href="https：//redirect．github．com/actions/dependency-review-action/issues/1098"＞＃1098＜/a＞ from actions/ahpook/v5-release＜/li＞
＜li＞＜a href="https：//github．com/actions/dependency-review-action/commit/ｅｂ６ｃ１９９ｃ５ａ８５ｃ７３８７ｆ１ｆ０ｂ０２ｂ３ｂａ５ｃ６３６４７４０６９５"＞＜code＞ｅｂ６ｃ１９９＜/code＞＜/a＞ update examples to show ＜a href="https：//github．com/v5"＞＜code＞＠v5＜/code＞＜/a＞＜/li＞
＜li＞＜a href="https：//github．com/actions/dependency-review-action/commit/３９４３ｃ２ｃ５ｂｅａａａｆ１８０６ｅｂ３７５８２７３ｃ２０３ｄａｂｃｂｆ８９ｃ"＞＜code＞３９４３ｃ２ｃ＜/code＞＜/a＞ v5.0.0 release branch＜/li＞
＜li＞＜a href="https：//github．com/actions/dependency-review-action/commit/４５４９４３ｃ８８０ｂ１４７ａｄｂｆｅ７ｄｅ０ｃｄｄ３ｅｃｅ１ｃ００８８２０３３"＞＜code＞４５４９４３ｃ＜/code＞＜/a＞ Merge pull request ＜a href="https：//redirect．github．com/actions/dependency-review-action/issues/1094"＞＃1094＜/a＞ from actions/ashelytc/security-findings＜/li＞
＜li＞＜a href="https：//github．com/actions/dependency-review-action/commit/６ｄ９２ａ１２２８ｅ９ｅ９ｄｂ３３４ｆ０２ｃ０９ｆ８４ｆｅ９２１７ｄ２ｂ４４６３"＞＜code＞６ｄ９２ａ１２＜/code＞＜/a＞ revert ＜code＞＠typescript-eslint/parser＜/code＞ update＜/li＞
＜li＞＜a href="https：//github．com/actions/dependency-review-action/commit/ａ８ｅ５ａ７ｅ９３６９５ｂ４１ａｂｆ６ｄ１０８３ｃｄ２２０ｂｅｅ３９ａ７２０ｆ０"＞＜code＞ａ８ｅ５ａ７ｅ＜/code＞＜/a＞ Merge pull request ＜a href="https：//redirect．github．com/actions/dependency-review-action/issues/1076"＞＃1076＜/a＞ from tspascoal/fix-version-matching-for-non-string-s...＜/li＞
＜li＞＜a href="https：//github．com/actions/dependency-review-action/commit/ｂ６ｂ７０７９０３１ｅｆ４ｅｄ６１６５６ｃ２２１９８８ｆ１ｆ３ｂｃｂｆ３５１０１"＞＜code＞ｂ６ｂ７０７９＜/code＞＜/a＞ update ＜code＞＠typescript-eslint/parser＜/code＞ to 8.40.0＜/li＞
＜li＞＜a href="https：//github．com/actions/dependency-review-action/commit/８２１ａ２１ｄｄ６９１ｆ１６２ｃ４ｃ５ｃ２ｅ９７５４ａ３４４ａｃｃｄｅ９ａ２０８"＞＜code＞８２１ａ２１ｄ＜/code＞＜/a＞ update more dependencies＜/li＞
＜li＞＜a href="https：//github．com/actions/dependency-review-action/commit/０５ａａａａｅ４５ｃｆ４ｃ４２０ｄｅ０１２ａｄｄｆ２ａ７２ｅ３４３５ｄｄａａ６３"＞＜code＞０５ａａａａｅ＜/code＞＜/a＞ run npm audit fix＜/li＞
＜li＞＜a href="https：//github．com/actions/dependency-review-action/commit/５５ｄ３ｅ７５４５０１ｆｃ１３ｃ８４ｂ９５６３７ｃｅ５１ｆ１３５０１２ｄ４１ｅａ"＞＜code＞５５ｄ３ｅ７５＜/code＞＜/a＞ Merge pull request ＜a href="https：//redirect．github．com/actions/dependency-review-action/issues/1077"＞＃1077＜/a＞ from Marukome0743/docs/checkout＜/li＞
＜li＞Additional commits viewable in ＜a href="https：//github．com/actions/dependency-review-action/compare/v4...v5"＞compare view＜/a＞＜/li＞
＜/ul＞
＜/details＞
＜br /＞

［！［Dependabot compatibility score］（https：//dependabot-badges.githubapp.com/badges/compatibility＿score?dependency-name=actions/dependency-review-action&package-manager=github＿actions&previous-version=4&new-version=5）］（https：//docs．github．com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates＃about-compatibility-scores）

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting ｀＠dependabot rebase｀.

［//］: ＃ （dependabot-automerge-start）
［//］: ＃ （dependabot-automerge-end）

＜details＞
＜summary＞Dependabot commands and options＜/summary＞
＜br /＞

You can trigger Dependabot actions by commenting on this PR:

• ｀＠dependabot rebase｀ will rebase this PR
• ｀＠dependabot recreate｀ will recreate this PR, overwriting any edits that have been made to it
• ｀＠dependabot show ＜dependency name＞ ignore conditions｀ will show all of the ignore conditions of the specified dependency
• ｀＠dependabot ignore this major version｀ will close this PR and stop Dependabot creating any more for this major version （unless you reopen the PR or upgrade to it yourself）
• ｀＠dependabot ignore this minor version｀ will close this PR and stop Dependabot creating any more for this minor version （unless you reopen the PR or upgrade to it yourself）
• ｀＠dependabot ignore this dependency｀ will close this PR and stop Dependabot creating any more for this dependency （unless you reopen the PR or upgrade to it yourself）

＜/details＞