npm run package

.github/PULL_REQUEST_TEMPLATE/pull_request_template.md

@@ -1,7 +0,0 @@
-## Purpose
-
-_Describe the purpose of this pull request_
-
-## Related Issues
-
-_What issues does this PR close or relate to?_

.github/workflows/stale.yaml

@@ -15,12 +15,9 @@ jobs:
     - uses: actions/[email protected]
       name: Clean up stale PRs and Issues
       with:
-        stale-pr-message: "👋 This pull request has been marked as stale because it has been open with no activity for 180 days. You can: comment on the PR or remove the stale label to hold stalebot off for a while, add the `Keep` label to hold stale off permanently, or do nothing. If you do nothing, this pull request will be closed eventually by the stalebot. Please see CONTRIBUTING.md for more policy details."
+        stale-pr-message: "👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the `Keep` label to hold stale off permanently, or do nothing. If you do nothing, this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details."
         stale-pr-label: "Stale"
-        close-pr-message: "👋 This pull request has been closed by stalebot because it has been open with no activity for over 180 days. Please see CONTRIBUTING.md for more policy details."
         stale-issue-label: "Stale"
-        stale-issue-message: "👋 This issue has been marked as stale because it has been open with no activity for 180 days. You can: comment on the issue or remove the stale label to hold stalebot off for a while, add the `Keep` label to hold stale off permanently, or do nothing. If you do nothing, this issue will be closed eventually by the stalebot. Please see CONTRIBUTING.md for more policy details."
-        close-issue-message: "👋 This issue has been closed by stalebot because it has been open with no activity for over 180 days. Please see CONTRIBUTING.md for more policy details."
         exempt-pr-labels: "Keep" # a "Keep" label will keep the PR from being closed as stale
         exempt-issue-labels: "Keep" # a "Keep" label will keep the issue from being closed as stale
         days-before-pr-stale: 180 # when the PR is considered stale

CONTRIBUTING.md

@@ -16,7 +16,7 @@ If you've encountered a problem, please let us know by [submitting an issue](htt
 
 ## Enhancements and feature requests
 
-If you've got an idea for a new feature or a significant change to the code or its dependencies, please submit as [an issue](https://github.com/actions/dependency-review-action/issues/new) so that the community can see it, and we can discuss it there. We may not be able to respond to every single issue, but will make a best effort!
+If you've got an idea for a new feature, please submit as [an issue](https://github.com/actions/dependency-review-action/issues/new) so that the community can see it, and we can discuss it there. We may not be able to respond to every single issue, but will make a best effort!
 
 If you'd like to make a contribution yourself, we ask that before significant effort is put into code changes, that we have agreement that the change aligns with our strategy for the action. Since this is a verified Action owned by GitHub we want to make sure that contributions are high quality, and that they maintain consistency with the rest of the action's behavior.
 

__tests__/config.test.ts

@@ -124,51 +124,6 @@ test('it raises an error when no refs are provided and the event is not a pull r
   ).toThrow()
 })
 
-const pullRequestLikeEvents = [
-  'pull_request',
-  'pull_request_target',
-  'merge_group'
-]
-
-test.each(pullRequestLikeEvents)(
-  'it uses the given refs even when the event is %s',
-  async eventName => {
-    setInput('base-ref', 'a-custom-base-ref')
-    setInput('head-ref', 'a-custom-head-ref')
-
-    const refs = getRefs(await readConfig(), {
-      payload: {
-        pull_request: {
-          number: 42,
-          base: {sha: 'pr-base-ref'},
-          head: {sha: 'pr-head-ref'}
-        }
-      },
-      eventName
-    })
-    expect(refs.base).toEqual('a-custom-base-ref')
-    expect(refs.head).toEqual('a-custom-head-ref')
-  }
-)
-
-test.each(pullRequestLikeEvents)(
-  'it uses the event refs when the event is %s and the no refs are input',
-  async eventName => {
-    const refs = getRefs(await readConfig(), {
-      payload: {
-        pull_request: {
-          number: 42,
-          base: {sha: 'pr-base-ref'},
-          head: {sha: 'pr-head-ref'}
-        }
-      },
-      eventName
-    })
-    expect(refs.base).toEqual('pr-base-ref')
-    expect(refs.head).toEqual('pr-head-ref')
-  }
-)
-
 test('it defaults to runtime scope', async () => {
   const config = await readConfig()
   expect(config.fail_on_scopes).toEqual(['runtime'])

__tests__/spdx.test.ts

@@ -1,7 +1,7 @@
-import {expect, test, describe} from '@jest/globals'
+import {expect, test} from '@jest/globals'
 import * as spdx from '../src/spdx'
 
-describe('satisfiesAny', () => {
+test('satisfiesAny', () => {
   const units = [
     {
       candidate: 'MIT',
@@ -59,14 +59,17 @@ describe('satisfiesAny', () => {
   ]
 
   for (const unit of units) {
-    const got: boolean = spdx.satisfiesAny(unit.candidate, unit.licenses)
+    let got: boolean = spdx.satisfiesAny(unit.candidate, unit.licenses)
-    test(`should return ${unit.expected} for ("${unit.candidate}", "${unit.licenses}")`, () => {
+    if (got != unit.expected) {
-      expect(got).toBe(unit.expected)
+      console.log(
-    })
+        `failing unit test inputs: candidate(${unit.candidate}) licenses(${unit.licenses})`
+      )
+    }
+    expect(got).toBe(unit.expected)
   }
 })
 
-describe('satisfiesAll', () => {
+test('satisfiesAll', () => {
   const units = [
     {
       candidate: 'MIT',
@@ -134,14 +137,17 @@ describe('satisfiesAll', () => {
   ]
 
   for (const unit of units) {
-    const got: boolean = spdx.satisfiesAll(unit.candidate, unit.licenses)
+    let got: boolean = spdx.satisfiesAll(unit.candidate, unit.licenses)
-    test(`should return ${unit.expected} for ("${unit.candidate}", "${unit.licenses}")`, () => {
+    if (got != unit.expected) {
-      expect(got).toBe(unit.expected)
+      console.log(
-    })
+        `failing unit test inputs: candidate(${unit.candidate}) licenses(${unit.licenses})`
+      )
+    }
+    expect(got).toBe(unit.expected)
   }
 })
 
-describe('satisfies', () => {
+test('satisfies', () => {
   const units = [
     {
       candidate: 'MIT',
@@ -214,14 +220,17 @@ describe('satisfies', () => {
   ]
 
   for (const unit of units) {
-    const got: boolean = spdx.satisfies(unit.candidate, unit.constraint)
+    let got: boolean = spdx.satisfies(unit.candidate, unit.constraint)
-    test(`should return ${unit.expected} for ("${unit.candidate}", "${unit.constraint}")`, () => {
+    if (got != unit.expected) {
-      expect(got).toBe(unit.expected)
+      console.log(
-    })
+        `failing unit test inputs: candidateExpr(${unit.candidate}) constraintExpr(${unit.constraint})`
+      )
+    }
+    expect(got).toBe(unit.expected)
   }
 })
 
-describe('isValid', () => {
+test('isValid', () => {
   const units = [
     {
       candidate: 'MIT',
@@ -249,9 +258,10 @@ describe('isValid', () => {
     }
   ]
   for (const unit of units) {
-    const got: boolean = spdx.isValid(unit.candidate)
+    let got: boolean = spdx.isValid(unit.candidate)
-    test(`should return ${unit.expected} for ("${unit.candidate}")`, () => {
+    if (got != unit.expected) {
-      expect(got).toBe(unit.expected)
+      console.log(`failing unit test inputs: candidateExpr(${unit.candidate})`)
-    })
+    }
+    expect(got).toBe(unit.expected)
   }
 })

__tests__/summary.test.ts

@@ -109,6 +109,42 @@ test('prints headline as h1', () => {
   expect(text).toContain('<h1>Dependency Review</h1>')
 })
 
+test('returns minimal summary in case the core.summary is too large for a PR comment', () => {
+  let changes: Changes = [
+    createTestChange({name: 'lodash', version: '1.2.3'}),
+    createTestChange({name: 'colors', version: '2.3.4'}),
+    createTestChange({name: '@foo/bar', version: '*'})
+  ]
+
+  let minSummary: string = summary.addSummaryToSummary(
+    changes,
+    emptyInvalidLicenseChanges,
+    emptyChanges,
+    scorecard,
+    defaultConfig
+  )
+
+  // side effect DR report into core.summary as happens in main.ts
+  summary.addScannedDependencies(changes)
+  const text = core.summary.stringify()
+
+  expect(text).toContain('<h1>Dependency Review</h1>')
+  expect(minSummary).toContain('# Dependency Review')
+
+  expect(text).toContain('❌ 3 vulnerable package(s)')
+  expect(text).not.toContain('* ❌ 3 vulnerable package(s)')
+  expect(text).toContain('lodash')
+  expect(text).toContain('colors')
+  expect(text).toContain('@foo/bar')
+
+  expect(minSummary).toContain('* ❌ 3 vulnerable package(s)')
+  expect(minSummary).not.toContain('lodash')
+  expect(minSummary).not.toContain('colors')
+  expect(minSummary).not.toContain('@foo/bar')
+
+  expect(text.length).toBeGreaterThan(minSummary.length)
+})
+
 test('returns minimal summary formatted for posting as a PR comment', () => {
   const OLD_ENV = process.env
 
@@ -196,10 +232,14 @@ test('groups dependencies with empty manifest paths together', () => {
     emptyScorecard,
     defaultConfig
   )
-  summary.addScannedFiles(changesWithEmptyManifests)
+  summary.addScannedDependencies(changesWithEmptyManifests)
   const text = core.summary.stringify()
-  expect(text).toContain('Unnamed Manifest')
+
-  expect(text).toContain('python/dist-info/METADATA')
+  expect(text).toContain('<summary>Unnamed Manifest</summary>')
+  expect(text).toContain('castore')
+  expect(text).toContain('connection')
+  expect(text).toContain('<summary>python/dist-info/METADATA</summary>')
+  expect(text).toContain('pygments')
 })
 
 test('does not include status section if nothing was found', () => {

dist/licenses.txt

@@ -1460,7 +1460,7 @@ lru-cache
 ISC
 The ISC License
 
-Copyright (c) 2010-2023 Isaac Z. Schlueter and Contributors
+Copyright (c) Isaac Z. Schlueter and Contributors
 
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
@@ -1764,6 +1764,25 @@ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
 IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 
+yallist
+ISC
+The ISC License
+
+Copyright (c) Isaac Z. Schlueter and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+
 yaml
 ISC
 Copyright Eemeli Aro <[email protected]>

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "dependency-review-action",
-  "version": "4.3.5",
+  "version": "4.3.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "dependency-review-action",
-      "version": "4.3.5",
+      "version": "4.3.3",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.1",
@@ -15,14 +15,14 @@
         "@octokit/request-error": "^5.0.1",
         "@onebeyond/spdx-license-satisfies": "^1.0.1",
         "ansi-styles": "^6.2.1",
-        "got": "^14.4.2",
+        "got": "^14.2.0",
         "jest": "^29.7.0",
         "octokit": "^3.1.2",
         "spdx-expression-parse": "^3.0.1",
         "spdx-satisfies": "^5.0.1",
-        "ts-jest": "^29.2.5",
+        "ts-jest": "^29.1.2",
         "yaml": "^2.3.4",
-        "zod": "^3.23.8"
+        "zod": "^3.22.3"
       },
       "devDependencies": {
         "@types/jest": "^29.5.12",
@@ -35,7 +35,7 @@
         "esbuild-register": "^3.5.0",
         "eslint": "^8.57.0",
         "eslint-plugin-github": "^4.10.2",
-        "eslint-plugin-jest": "^28.8.3",
+        "eslint-plugin-jest": "^27.9.0",
         "eslint-plugin-prettier": "^5.1.3",
         "js-yaml": "^4.1.0",
         "nodemon": "^3.1.0",
@@ -1945,22 +1945,17 @@
         "url": "https://opencollective.com/unts"
       }
     },
-    "node_modules/@sec-ant/readable-stream": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/@sec-ant/readable-stream/-/readable-stream-0.4.1.tgz",
-      "integrity": "sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg=="
-    },
     "node_modules/@sinclair/typebox": {
       "version": "0.27.8",
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.27.8.tgz",
       "integrity": "sha512-+Fj43pSMwJs4KRrH/938Uf+uAELIgVBmQzg/q1YG10djyfA3TnrU8N8XzqCh/okZdszqBQTZf96idMfE5lnwTA=="
     },
     "node_modules/@sindresorhus/is": {
-      "version": "7.0.0",
+      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/@sindresorhus/is/-/is-7.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@sindresorhus/is/-/is-6.1.0.tgz",
-      "integrity": "sha512-WDTlVTyvFivSOuyvMeedzg2hdoBLZ3f1uNVuEida2Rl9BrfjrIRjWA/VZIrMRLvSwJYCAlCRA3usDt1THytxWQ==",
+      "integrity": "sha512-BuvU07zq3tQ/2SIgBsEuxKYDyDjC0n7Zir52bpHy2xnBbW81+po43aLFPLbeV3HRAheFbGud1qgcqSYfhtHMAg==",
       "engines": {
-        "node": ">=18"
+        "node": ">=16"
       },
       "funding": {
         "url": "https://github.com/sindresorhus/is?sponsor=1"
@@ -2105,11 +2100,11 @@
       }
     },
     "node_modules/@types/node": {
-      "version": "20.16.0",
+      "version": "20.11.28",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.0.tgz",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.11.28.tgz",
-      "integrity": "sha512-vDxceJcoZhIVh67S568bm1UGZO0DX0hpplJZxzeXMKwIPLn190ec5RRxQ69BKhX44SUGIxxgMdDY557lGLKprQ==",
+      "integrity": "sha512-M/GPWVS2wLkSkNHVeLkrF2fD5Lx5UC4PxA0uZcKc6QqbIQUJyW1jVjueJYi1z8n0I5PxYrtpnPnWglE+y9A0KA==",
       "dependencies": {
-        "undici-types": "~6.19.2"
+        "undici-types": "~5.26.4"
       }
     },
     "node_modules/@types/semver": {
@@ -2634,12 +2629,6 @@
       "integrity": "sha512-OH/2E5Fg20h2aPrbe+QL8JZQFko0YZaF+j4mnQ7BGhfavO7OpSLa8a0y9sBwomHdSbkhTS8TQNayBfnW5DwbvQ==",
       "dev": true
     },
-    "node_modules/async": {
-      "version": "3.2.6",
-      "resolved": "https://registry.npmjs.org/async/-/async-3.2.6.tgz",
-      "integrity": "sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==",
-      "license": "MIT"
-    },
     "node_modules/asynciterator.prototype": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/asynciterator.prototype/-/asynciterator.prototype-1.0.0.tgz",
@@ -2822,11 +2811,11 @@
       }
     },
     "node_modules/braces": {
-      "version": "3.0.3",
+      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz",
-      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
+      "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==",
       "dependencies": {
-        "fill-range": "^7.1.1"
+        "fill-range": "^7.0.1"
       },
       "engines": {
         "node": ">=8"
@@ -2906,46 +2895,20 @@
       }
     },
     "node_modules/cacheable-request": {
-      "version": "12.0.1",
+      "version": "10.2.14",
-      "resolved": "https://registry.npmjs.org/cacheable-request/-/cacheable-request-12.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/cacheable-request/-/cacheable-request-10.2.14.tgz",
-      "integrity": "sha512-Yo9wGIQUaAfIbk+qY0X4cDQgCosecfBe3V9NSyeY4qPC2SAkbCS4Xj79VP8WOzitpJUZKc/wsRCYF5ariDIwkg==",
+      "integrity": "sha512-zkDT5WAF4hSSoUgyfg5tFIxz8XQK+25W/TLVojJTMKBaxevLBBtLxgqguAuVQB8PVW79FVjHcU+GJ9tVbDZ9mQ==",
       "dependencies": {
-        "@types/http-cache-semantics": "^4.0.4",
+        "@types/http-cache-semantics": "^4.0.2",
-        "get-stream": "^9.0.1",
+        "get-stream": "^6.0.1",
         "http-cache-semantics": "^4.1.1",
-        "keyv": "^4.5.4",
+        "keyv": "^4.5.3",
         "mimic-response": "^4.0.0",
-        "normalize-url": "^8.0.1",
+        "normalize-url": "^8.0.0",
         "responselike": "^3.0.0"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=14.16"
-      }
-    },
-    "node_modules/cacheable-request/node_modules/get-stream": {
-      "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-9.0.1.tgz",
-      "integrity": "sha512-kVCxPF3vQM/N0B1PmoqVUqgHP+EeVjmZSQn+1oCRPxd2P21P2F19lIgbR3HBosbB1PUhOAoctJnfEn2GbN2eZA==",
-      "dependencies": {
-        "@sec-ant/readable-stream": "^0.4.1",
-        "is-stream": "^4.0.1"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/cacheable-request/node_modules/is-stream": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-4.0.1.tgz",
-      "integrity": "sha512-Dnz92NInDqYckGEUJv689RbRiTSEHCQ7wOVeALbkOz999YpqT46yMRIGtSNl2iCL1waAZSx40+h59NV/EwzV/A==",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/call-bind": {
@@ -3374,21 +3337,6 @@
         "safe-buffer": "^5.0.1"
       }
     },
-    "node_modules/ejs": {
-      "version": "3.1.10",
-      "resolved": "https://registry.npmjs.org/ejs/-/ejs-3.1.10.tgz",
-      "integrity": "sha512-UeJmFfOrAQS8OJWPZ4qtgHyWExa088/MtK5UEyoJGFH67cDEXkZSviOiKRCZ4Xij0zxI3JECgYs3oKx+AizQBA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "jake": "^10.8.5"
-      },
-      "bin": {
-        "ejs": "bin/cli.js"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/electron-to-chromium": {
       "version": "1.4.578",
       "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.578.tgz",
@@ -4088,20 +4036,19 @@
       }
     },
     "node_modules/eslint-plugin-jest": {
-      "version": "28.8.3",
+      "version": "27.9.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jest/-/eslint-plugin-jest-28.8.3.tgz",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jest/-/eslint-plugin-jest-27.9.0.tgz",
-      "integrity": "sha512-HIQ3t9hASLKm2IhIOqnu+ifw7uLZkIlR7RYNv7fMcEi/p0CIiJmfriStQS2LDkgtY4nyLbIZAD+JL347Yc2ETQ==",
+      "integrity": "sha512-QIT7FH7fNmd9n4se7FFKHbsLKGQiw885Ds6Y/sxKgCZ6natwCsXdgPOADnYVxN2QrRweF0FZWbJ6S7Rsn7llug==",
       "dev": true,
-      "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/utils": "^6.0.0 || ^7.0.0 || ^8.0.0"
+        "@typescript-eslint/utils": "^5.10.0"
       },
       "engines": {
-        "node": "^16.10.0 || ^18.12.0 || >=20.0.0"
+        "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
       },
       "peerDependencies": {
-        "@typescript-eslint/eslint-plugin": "^6.0.0 || ^7.0.0 || ^8.0.0",
+        "@typescript-eslint/eslint-plugin": "^5.0.0 || ^6.0.0 || ^7.0.0",
-        "eslint": "^7.0.0 || ^8.0.0 || ^9.0.0",
+        "eslint": "^7.0.0 || ^8.0.0",
         "jest": "*"
       },
       "peerDependenciesMeta": {
@@ -4113,6 +4060,128 @@
         }
       }
     },
+    "node_modules/eslint-plugin-jest/node_modules/@typescript-eslint/scope-manager": {
+      "version": "5.62.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-5.62.0.tgz",
+      "integrity": "sha512-VXuvVvZeQCQb5Zgf4HAxc04q5j+WrNAtNh9OwCsCgpKqESMTu3tF/jhZ3xG6T4NZwWl65Bg8KuS2uEvhSfLl0w==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/types": "5.62.0",
+        "@typescript-eslint/visitor-keys": "5.62.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/eslint-plugin-jest/node_modules/@typescript-eslint/types": {
+      "version": "5.62.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-5.62.0.tgz",
+      "integrity": "sha512-87NVngcbVXUahrRTqIK27gD2t5Cu1yuCXxbLcFtCzZGlfyVWWh8mLHkoxzjsB6DDNnvdL+fW8MiwPEJyGJQDgQ==",
+      "dev": true,
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/eslint-plugin-jest/node_modules/@typescript-eslint/typescript-estree": {
+      "version": "5.62.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-5.62.0.tgz",
+      "integrity": "sha512-CmcQ6uY7b9y694lKdRB8FEel7JbU/40iSAPomu++SjLMntB+2Leay2LO6i8VnJk58MtE9/nQSFIH6jpyRWyYzA==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/types": "5.62.0",
+        "@typescript-eslint/visitor-keys": "5.62.0",
+        "debug": "^4.3.4",
+        "globby": "^11.1.0",
+        "is-glob": "^4.0.3",
+        "semver": "^7.3.7",
+        "tsutils": "^3.21.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/eslint-plugin-jest/node_modules/@typescript-eslint/utils": {
+      "version": "5.62.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-5.62.0.tgz",
+      "integrity": "sha512-n8oxjeb5aIbPFEtmQxQYOLI0i9n5ySBEY/ZEHHZqKQSFnxio1rv6dthascc9dLuwrL0RC5mPCxB7vnAVGAYWAQ==",
+      "dev": true,
+      "dependencies": {
+        "@eslint-community/eslint-utils": "^4.2.0",
+        "@types/json-schema": "^7.0.9",
+        "@types/semver": "^7.3.12",
+        "@typescript-eslint/scope-manager": "5.62.0",
+        "@typescript-eslint/types": "5.62.0",
+        "@typescript-eslint/typescript-estree": "5.62.0",
+        "eslint-scope": "^5.1.1",
+        "semver": "^7.3.7"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      }
+    },
+    "node_modules/eslint-plugin-jest/node_modules/@typescript-eslint/visitor-keys": {
+      "version": "5.62.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-5.62.0.tgz",
+      "integrity": "sha512-07ny+LHRzQXepkGg6w0mFY41fVUNBrL2Roj/++7V1txKugfjm/Ci/qSND03r2RhlJhJYMcTn9AhhSSqQp0Ysyw==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/types": "5.62.0",
+        "eslint-visitor-keys": "^3.3.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/eslint-plugin-jest/node_modules/eslint-scope": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.1.1.tgz",
+      "integrity": "sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw==",
+      "dev": true,
+      "dependencies": {
+        "esrecurse": "^4.3.0",
+        "estraverse": "^4.1.1"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/eslint-plugin-jest/node_modules/estraverse": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz",
+      "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==",
+      "dev": true,
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
     "node_modules/eslint-plugin-jsx-a11y": {
       "version": "6.8.0",
       "resolved": "https://registry.npmjs.org/eslint-plugin-jsx-a11y/-/eslint-plugin-jsx-a11y-6.8.0.tgz",
@@ -4415,40 +4484,10 @@
         "node": "^10.12.0 || >=12.0.0"
       }
     },
-    "node_modules/filelist": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/filelist/-/filelist-1.0.4.tgz",
-      "integrity": "sha512-w1cEuf3S+DrLCQL7ET6kz+gmlJdbq9J7yXCSjK/OZCPA+qEN1WyF4ZAf0YYJa4/shHJra2t/d/r8SV4Ji+x+8Q==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "minimatch": "^5.0.1"
-      }
-    },
-    "node_modules/filelist/node_modules/brace-expansion": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
-      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0"
-      }
-    },
-    "node_modules/filelist/node_modules/minimatch": {
-      "version": "5.1.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
-      "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/fill-range": {
-      "version": "7.1.1",
+      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz",
-      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
+      "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==",
       "dependencies": {
         "to-regex-range": "^5.0.1"
       },
@@ -4722,21 +4761,21 @@
       }
     },
     "node_modules/got": {
-      "version": "14.4.2",
+      "version": "14.2.0",
-      "resolved": "https://registry.npmjs.org/got/-/got-14.4.2.tgz",
+      "resolved": "https://registry.npmjs.org/got/-/got-14.2.0.tgz",
-      "integrity": "sha512-+Te/qEZ6hr7i+f0FNgXx/6WQteSM/QqueGvxeYQQFm0GDfoxLVJ/oiwUKYMTeioColWUTdewZ06hmrBjw6F7tw==",
+      "integrity": "sha512-dBq2KkHcQl3AwPoIWsLsQScCPpUgRulz1qZVthjPYKYOPmYfBnekR3vxecjZbm91Vc3JUGnV9mqFX7B+Fe2quw==",
       "dependencies": {
-        "@sindresorhus/is": "^7.0.0",
+        "@sindresorhus/is": "^6.1.0",
         "@szmarczak/http-timer": "^5.0.1",
         "cacheable-lookup": "^7.0.0",
-        "cacheable-request": "^12.0.1",
+        "cacheable-request": "^10.2.14",
         "decompress-response": "^6.0.0",
         "form-data-encoder": "^4.0.2",
+        "get-stream": "^8.0.1",
         "http2-wrapper": "^2.2.1",
         "lowercase-keys": "^3.0.0",
         "p-cancelable": "^4.0.1",
-        "responselike": "^3.0.0",
+        "responselike": "^3.0.0"
-        "type-fest": "^4.19.0"
       },
       "engines": {
         "node": ">=20"
@@ -4745,10 +4784,10 @@
         "url": "https://github.com/sindresorhus/got?sponsor=1"
       }
     },
-    "node_modules/got/node_modules/type-fest": {
+    "node_modules/got/node_modules/get-stream": {
-      "version": "4.20.0",
+      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.20.0.tgz",
+      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-8.0.1.tgz",
-      "integrity": "sha512-MBh+PHUHHisjXf4tlx0CFWoMdjx8zCMLJHOjnV1prABYZFHqtFOyauCIK2/7w4oIfwkF8iNhLtnJEfVY2vn3iw==",
+      "integrity": "sha512-VaUJspBffn/LMCJVoMvSAdmscJyS1auj5Zulnn5UoYcY531UWmdwhRWkcGKnGU93m5HSXP9LP2usOryrBtQowA==",
       "engines": {
         "node": ">=16"
       },
@@ -5410,24 +5449,6 @@
         "set-function-name": "^2.0.1"
       }
     },
-    "node_modules/jake": {
-      "version": "10.9.2",
-      "resolved": "https://registry.npmjs.org/jake/-/jake-10.9.2.tgz",
-      "integrity": "sha512-2P4SQ0HrLQ+fw6llpLnOaGAvN2Zu6778SJMrCUwns4fOoG9ayrTiZk3VV8sCPkVZF8ab0zksVpS8FDY5pRCNBA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "async": "^3.2.3",
-        "chalk": "^4.0.2",
-        "filelist": "^1.0.4",
-        "minimatch": "^3.1.2"
-      },
-      "bin": {
-        "jake": "bin/cli.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/jest": {
       "version": "29.7.0",
       "resolved": "https://registry.npmjs.org/jest/-/jest-29.7.0.tgz",
@@ -6277,12 +6298,11 @@
       }
     },
     "node_modules/micromatch": {
-      "version": "4.0.8",
+      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
+      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz",
-      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
+      "integrity": "sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==",
-      "license": "MIT",
       "dependencies": {
-        "braces": "^3.0.3",
+        "braces": "^3.0.2",
         "picomatch": "^2.3.1"
       },
       "engines": {
@@ -6421,9 +6441,9 @@
       }
     },
     "node_modules/normalize-url": {
-      "version": "8.0.1",
+      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-8.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-8.0.0.tgz",
-      "integrity": "sha512-IO9QvjUMWxPQQhs60oOu10CRkWCiZzSUkzbXGGV9pviYl1fXYcvkzQ5jV9z8Y6un8ARoVRl4EtC6v6jNqbaJ/w==",
+      "integrity": "sha512-uVFpKhj5MheNBJRTiMZ9pE/7hD1QTeEvugSJW/OmLzAp78PB5O6adfMNTvmfKhXBkvCzC+rqifWcVYpGFwTjnw==",
       "engines": {
         "node": ">=14.16"
       },
@@ -7164,10 +7184,12 @@
       }
     },
     "node_modules/semver": {
-      "version": "7.6.3",
+      "version": "7.5.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.3.tgz",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
-      "integrity": "sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A==",
+      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
-      "license": "ISC",
+      "dependencies": {
+        "lru-cache": "^6.0.0"
+      },
       "bin": {
         "semver": "bin/semver.js"
       },
@@ -7175,6 +7197,22 @@
         "node": ">=10"
       }
     },
+    "node_modules/semver/node_modules/lru-cache": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
+      "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
+      "dependencies": {
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/semver/node_modules/yallist": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="
+    },
     "node_modules/set-function-length": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.1.1.tgz",
@@ -7581,30 +7619,27 @@
       }
     },
     "node_modules/ts-jest": {
-      "version": "29.2.5",
+      "version": "29.1.2",
-      "resolved": "https://registry.npmjs.org/ts-jest/-/ts-jest-29.2.5.tgz",
+      "resolved": "https://registry.npmjs.org/ts-jest/-/ts-jest-29.1.2.tgz",
-      "integrity": "sha512-KD8zB2aAZrcKIdGk4OwpJggeLcH1FgrICqDSROWqlnJXGCXK4Mn6FcdK2B6670Xr73lHMG1kHw8R87A0ecZ+vA==",
+      "integrity": "sha512-br6GJoH/WUX4pu7FbZXuWGKGNDuU7b8Uj77g/Sp7puZV6EXzuByl6JrECvm0MzVzSTkSHWTihsXt+5XYER5b+g==",
-      "license": "MIT",
       "dependencies": {
-        "bs-logger": "^0.2.6",
+        "bs-logger": "0.x",
-        "ejs": "^3.1.10",
+        "fast-json-stable-stringify": "2.x",
-        "fast-json-stable-stringify": "^2.1.0",
         "jest-util": "^29.0.0",
         "json5": "^2.2.3",
-        "lodash.memoize": "^4.1.2",
+        "lodash.memoize": "4.x",
-        "make-error": "^1.3.6",
+        "make-error": "1.x",
-        "semver": "^7.6.3",
+        "semver": "^7.5.3",
-        "yargs-parser": "^21.1.1"
+        "yargs-parser": "^21.0.1"
       },
       "bin": {
         "ts-jest": "cli.js"
       },
       "engines": {
-        "node": "^14.15.0 || ^16.10.0 || ^18.0.0 || >=20.0.0"
+        "node": "^16.10.0 || ^18.0.0 || >=20.0.0"
       },
       "peerDependencies": {
         "@babel/core": ">=7.0.0-beta.0 <8",
-        "@jest/transform": "^29.0.0",
         "@jest/types": "^29.0.0",
         "babel-jest": "^29.0.0",
         "jest": "^29.0.0",
@@ -7614,9 +7649,6 @@
         "@babel/core": {
           "optional": true
         },
-        "@jest/transform": {
-          "optional": true
-        },
         "@jest/types": {
           "optional": true
         },
@@ -7667,6 +7699,27 @@
       "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q==",
       "dev": true
     },
+    "node_modules/tsutils": {
+      "version": "3.21.0",
+      "resolved": "https://registry.npmjs.org/tsutils/-/tsutils-3.21.0.tgz",
+      "integrity": "sha512-mHKK3iUXL+3UF6xL5k0PEhKRUBKPBCv/+RkEOpjRWxxx27KKRBmmA60A9pgOUvMi8GKhRMPEmjBRPzs2W7O1OA==",
+      "dev": true,
+      "dependencies": {
+        "tslib": "^1.8.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      },
+      "peerDependencies": {
+        "typescript": ">=2.8.0 || >= 3.2.0-dev || >= 3.3.0-dev || >= 3.4.0-dev || >= 3.5.0-dev || >= 3.6.0-dev || >= 3.6.0-beta || >= 3.7.0-dev || >= 3.7.0-beta"
+      }
+    },
+    "node_modules/tsutils/node_modules/tslib": {
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
+      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
+      "dev": true
+    },
     "node_modules/tunnel": {
       "version": "0.0.6",
       "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
@@ -7806,9 +7859,9 @@
       "dev": true
     },
     "node_modules/undici": {
-      "version": "5.28.4",
+      "version": "5.28.3",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.4.tgz",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.3.tgz",
-      "integrity": "sha512-72RFADWFqKmUb2hmmvNODKL3p9hcB6Gt2DOQMis1SEBaV6a4MH8soBvzg+95CYhCKPFedut2JY9bMfrDl9D23g==",
+      "integrity": "sha512-3ItfzbrhDlINjaP0duwnNsKpDQk3acHI3gVJ1z4fmwMK31k5G9OVIAMLSIaP6w4FaGkaAkN6zaQO9LUvZ1t7VA==",
       "dependencies": {
         "@fastify/busboy": "^2.0.0"
       },
@@ -7817,9 +7870,9 @@
       }
     },
     "node_modules/undici-types": {
-      "version": "6.19.6",
+      "version": "5.26.5",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.19.6.tgz",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
-      "integrity": "sha512-e/vggGopEfTKSvj4ihnOLTsqhrKRN3LeO6qSN/GxohhuRv8qH9bNQ4B8W7e/vFL+0XTnmHPB4/kegunZGA4Org=="
+      "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA=="
     },
     "node_modules/universal-github-app-jwt": {
       "version": "1.1.2",
@@ -8113,9 +8166,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "3.23.8",
+      "version": "3.22.4",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.23.8.tgz",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-3.22.4.tgz",
-      "integrity": "sha512-XBx9AXhXktjUqnepgTiE5flcKIYWi/rme0Eaj+5Y0lftuGBq+jyRu/md4WnuxqgP1ubdpNCsYEYPxrzVHD8d6g==",
+      "integrity": "sha512-iC+8Io04lddc+mVqQ9AZ7OQ2MrUKGN+oIQyq1vemgt46jwCwLfhq7/pwnBnNXXXZb8VTVLKwp9EDkx+ryxIWmg==",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "dependency-review-action",
-  "version": "4.3.5",
+  "version": "4.3.3",
   "private": true,
   "description": "A GitHub Action for Dependency Review",
   "main": "lib/main.js",
@@ -31,14 +31,14 @@
     "@octokit/request-error": "^5.0.1",
     "@onebeyond/spdx-license-satisfies": "^1.0.1",
     "ansi-styles": "^6.2.1",
-    "got": "^14.4.2",
+    "got": "^14.2.0",
     "jest": "^29.7.0",
     "octokit": "^3.1.2",
     "spdx-expression-parse": "^3.0.1",
     "spdx-satisfies": "^5.0.1",
-    "ts-jest": "^29.2.5",
+    "ts-jest": "^29.1.2",
     "yaml": "^2.3.4",
-    "zod": "^3.23.8"
+    "zod": "^3.22.3"
   },
   "devDependencies": {
     "@types/jest": "^29.5.12",
@@ -51,7 +51,7 @@
     "esbuild-register": "^3.5.0",
     "eslint": "^8.57.0",
     "eslint-plugin-github": "^4.10.2",
-    "eslint-plugin-jest": "^28.8.3",
+    "eslint-plugin-jest": "^27.9.0",
     "eslint-plugin-prettier": "^5.1.3",
     "js-yaml": "^4.1.0",
     "nodemon": "^3.1.0",

scripts/create_summary.ts

@@ -143,7 +143,7 @@ async function createSummary(
     ...licenseIssues.unlicensed
   ]
 
-  summary.addScannedFiles(allChanges)
+  summary.addScannedDependencies(allChanges)
 
   const text = core.summary.stringify()
   await fs.promises.writeFile(path.resolve(tmpDir, fileName), text, {

src/git-refs.ts

@@ -11,8 +11,7 @@ export function getRefs(
   // The base/head ref from the config take priority, if provided.
   if (
     context.eventName === 'pull_request' ||
-    context.eventName === 'pull_request_target' ||
+    context.eventName === 'pull_request_target'
-    context.eventName === 'merge_group'
   ) {
     const pull_request = PullRequestSchema.parse(context.payload.pull_request)
     base_ref = base_ref || pull_request.base.sha
@@ -23,19 +22,19 @@ export function getRefs(
     throw new Error(
       'Both a base ref and head ref must be provided, either via the `base_ref`/`head_ref` ' +
         'config options, `base-ref`/`head-ref` workflow action options, or by running a ' +
-        '`pull_request`/`pull_request_target`/`merge_group` workflow.'
+        '`pull_request`/`pull_request_target` workflow.'
     )
   } else if (!base_ref) {
     throw new Error(
       'A base ref must be provided, either via the `base_ref` config option, ' +
         '`base-ref` workflow action option, or by running a ' +
-        '`pull_request`/`pull_request_target`/`merge_group` workflow.'
+        '`pull_request`/`pull_request_target` workflow.'
     )
   } else if (!head_ref) {
     throw new Error(
       'A head ref must be provided, either via the `head_ref` config option, ' +
         '`head-ref` workflow action option, or by running a ' +
-        'or by running a `pull_request`/`pull_request_target`/`merge_group` workflow.'
+        'or by running a `pull_request`/`pull_request_target` workflow.'
     )
   }
 

src/main.ts

@@ -125,9 +125,7 @@ async function run(): Promise<void> {
       config.deny_groups
     )
 
-    // generate informational scorecard entries for all added changes in the PR
+    const scorecard = await getScorecardLevels(filteredChanges)
-    const scorecardChanges = getScorecardChanges(changes)
-    const scorecard = await getScorecardLevels(scorecardChanges)
 
     const minSummary = summary.addSummaryToSummary(
       vulnerableChanges,
@@ -166,7 +164,7 @@ async function run(): Promise<void> {
     }
 
     core.setOutput('dependency-changes', JSON.stringify(changes))
-    summary.addScannedFiles(changes)
+    summary.addScannedDependencies(changes)
     printScannedDependencies(changes)
 
     // include full summary in output; Actions will truncate if oversized
@@ -371,7 +369,7 @@ function printScannedDependencies(changes: Changes): void {
 }
 
 function printDeniedDependencies(
-  changes: Changes,
+  changes: Change[],
   config: ConfigurationOptions
 ): void {
   core.group('Denied', async () => {
@@ -386,17 +384,6 @@ function printDeniedDependencies(
   })
 }
 
-function getScorecardChanges(changes: Changes): Changes {
-  const out: Changes = []
-  for (const change of changes) {
-    if (change.change_type === 'added') {
-      out.push(change)
-    }
-  }
-
-  return out
-}
-
 async function createScorecardWarnings(
   scorecards: Scorecard,
   config: ConfigurationOptions

src/summary.ts

@@ -1,7 +1,7 @@
 import * as core from '@actions/core'
+import {ConfigurationOptions, Changes, Change, Scorecard} from './schemas'
 import {SummaryTableRow} from '@actions/core/lib/summary'
 import {InvalidLicenseChanges, InvalidLicenseChangeTypes} from './licenses'
-import {Change, Changes, ConfigurationOptions, Scorecard} from './schemas'
 import {groupDependenciesByManifest, getManifestsSet, renderUrl} from './utils'
 
 const icons = {
@@ -10,8 +10,6 @@ const icons = {
   warning: '⚠️'
 }
 
-const MAX_SCANNED_FILES_BYTES = 1048576
-
 // generates the DR report summmary and caches it to the Action's core.summary.
 // returns the DR summary string, ready to be posted as a PR comment if the
 // final DR report is too large
@@ -265,33 +263,21 @@ function formatLicense(license: string | null): string {
   return license
 }
 
-export function addScannedFiles(changes: Changes): void {
+export function addScannedDependencies(changes: Changes): void {
-  const manifests = Array.from(
+  const dependencies = groupDependenciesByManifest(changes)
-    groupDependenciesByManifest(changes).keys()
+  const manifests = dependencies.keys()
-  ).sort()
 
-  let sf_size = 0
+  const summary = core.summary.addHeading('Scanned Manifest Files', 2)
-  let trunc_at = -1
 
-  for (const [index, entry] of manifests.entries()) {
+  for (const manifest of manifests) {
-    if (sf_size + entry.length >= MAX_SCANNED_FILES_BYTES) {
+    const deps = dependencies.get(manifest)
-      trunc_at = index
+    if (deps) {
-      break
+      const dependencyNames = deps.map(
-    }
+        dependency => `<li>${dependency.name}@${dependency.version}</li>`
-    sf_size += entry.length
+      )
-  }
+      summary.addDetails(manifest, `<ul>${dependencyNames.join('')}</ul>`)
-
-  if (trunc_at >= 0) {
-    // truncate the manifests list if it will overflow the summary output
-    manifests.slice(0, trunc_at)
-    // if there's room between cutoff size and list size, add a warning
-    const size_diff = MAX_SCANNED_FILES_BYTES - sf_size
-    if (size_diff < 12) {
-      manifests.push('(truncated)')
     }
   }
-
-  core.summary.addHeading('Scanned Files', 2).addList(manifests)
 }
 
 function snapshotWarningRecommendation(

types/spdx-license-satisfies.d.ts

@@ -13,4 +13,6 @@ declare module '@onebeyond/spdx-license-satisfies' {
     candidateExpr: string,
     licenses: string[]
   ): boolean
+
+  export function isValid(candidateExpr: string): boolean
 }