Bump actions/dependency-review-action from 3.0.6 to 4.3.2

[dependabot[bot]]

Bumps actions/dependency-review-action from 3.0.6 to 4.3.2.

Release notes

Sourced from actions/dependency-review-action's releases.

v4.3.2

What's Changed

• Fix package-url parsing for allow-dependencies-licenses by @​juxtin in actions/dependency-review-action#761

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.3.1...v4.3.2

v4.3.1

What's Changed

This release fixes some bugs related to package-url parsing that were introduced in 4.3.0. See actions/dependency-review-action#753.

Full Changelog: https://github.com/actions/dependency-review-action/compare/V4.3.0...v4.3.1

v4.3.0

New Features

• The deny-packages option can now be used without a version number to exclude all versions of a package.

What's Changed

• Fix action variable name for scorecard by @​lukehinds in actions/dependency-review-action#735
• Fix extra https:// in summary by @​jhutchings1 in actions/dependency-review-action#748
• Bump typescript from 5.3.3 to 5.4.5 by @​dependabot in actions/dependency-review-action#744
• Bump eslint-plugin-github from 4.10.1 to 4.10.2 by @​dependabot in actions/dependency-review-action#737
• Show denied packages with red X by @​juxtin in actions/dependency-review-action#750
• deny-packages configuration option can deny specified version or all packages by @​febuiles and @​bteng22 in actions/dependency-review-action#733

New Contributors

• @​bteng22 made their first contribution in actions/dependency-review-action#733
• @​lukehinds made their first contribution in actions/dependency-review-action#735

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.2.5...V4.3.0

4.2.5

What's Changed

• Fixed a bug where some configuration options in external files were not being properly picked up -- actions/dependency-review-action#722
• Bump eslint from 8.56.0 to 8.57.0

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.2.4...v4.2.5

v4.2.4

What's Changed

Fixed a bug in the output of OpenSSF cards for GitHub Actions.

New Contributors

• @​sporkmonger made their first contribution in actions/dependency-review-action#721

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.2.3...v4.2.4

4.2.3

... (truncated)

Commits

• 0c155c5 Merge pull request #762 from actions/juxtin/prepare-4.3.2
• f3dac32 Merge pull request #761 from actions/juxtin/fix-allow-dependencies-licenses
• d0d5cc3 Update version number to 4.3.2
• 49fbbe0 Fix package-url parsing for allow-dependencies-licenses
• e58c696 Merge pull request #758 from actions/juxtin/prepare-4.3.1
• 9b7c72d Change version to 4.3.1
• 7dcfabf Merge pull request #753 from actions/juxtin/debug-purl
• 5f0808f Validate that deny-packages purls are complete
• fcc66c2 Refine purl parsing and tests
• 1dd418b Basic tests for PURL validation in config
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)