build(deps): bump rsdmike/github-security-report-action from 3.0.4 to 4.1.0

[dependabot]

Bumps rsdmike/github-security-report-action from 3.0.4 to 4.1.0.

Release notes

Sourced from rsdmike/github-security-report-action's releases.

v4.1.0

Fixes report generation failing with a GraphQL timeout on repositories with a large dependency manifest.

The problem

The dependency graph query expanded dependencyGraphManifests.dependencies, which makes GitHub resolve every manifest's full dependency graph. On a repository with a large lockfile that exceeds GitHub's server-side GraphQL budget and fails the whole query:

##[error]Request failed due to following response errors:
 - timedout

No PDF was produced. In most workflows this went unnoticed because the report step runs with continue-on-error: true, so the job stayed green and the step reported success — the failure appeared only in the raw logs, followed by mv: cannot stat 'report.pdf'.

If you are seeing an empty report artifact, or a "No files were found with the provided path: ./*.pdf" warning after your CodeQL job, this is very likely the cause.

What changed

• Manifests are read with a metadata-only GraphQL query; the expensive nested connection is gone. It was never rendered by the report template.
• Dependencies now come from the repository's dependency-graph SBOM, via the asynchronous SBOM API (generate-report, then polling fetch-report). Polling is bounded and raises a clear error rather than hanging the job.
• The synchronous /dependency-graph/sbom endpoint is deprecated and scheduled for removal on 2026-11-13; it is retained only as a fallback for GitHub Enterprise Server instances without the async endpoint.
• The dependency count in the report is now accurate. It previously relied on dependenciesCount, which GitHub only populates as a side effect of the same expensive resolver, so it frequently read 0.

Behavior changes

These affect the JSON data shaping, not the rendered report or summary templates:

• Dependency versions are SBOM-resolved (1.3.0) rather than manifest ranges (^1.0.0).
• Dependency grouping keys come from the purl type (npm, githubactions, maven) rather than GraphQL's NPM / ACTIONS.
• Dependencies are no longer attributed to the manifest that introduced them; the SBOM does not carry that mapping. Manifest lists (processed / unprocessed) are unaffected.

If you use the legacy summary_old.html template, note it hardcodes dependencies.npm and dependencies.maven.

Upgrading

- name: Generate Security Report
  uses: rsdmike/github-security-report-action@v4.1.0
  with:
    template: report
    token: ${{ secrets.SECURITY_TOKEN }}

No input or output changes. Once upgraded, consider removing continue-on-error: true from the report step so future failures are visible.

Full Changelog: rsdmike/github-security-report-action@v4.0.1...v4.1.0

v4.0.1

A maintenance release. The action runtime is unchanged from v4.0.0 (using: node24), so this is a drop-in upgrade for existing workflows — the internals moved to ESM, but that is invisible to consumers, who only ever run the bundled dist/index.js.

... (truncated)

Commits

• a3d8cc0 chore(release): v4.1.0
• 7979819 refactor(dependencies): poll the SBOM report through Octokit's templated route
• 89c1cdc fix(dependencies): source dependencies from the SBOM API to avoid GraphQL tim...
• 1df22b1 chore(release): v4.0.1
• 56798d0 fix(build): copy templates into dist/ instead of relying on ncc
• ae714b0 test: add a smoke test that the packaged bundle loads
• 719cb10 refactor(templating): drop nunjucks-markdown for a native nunjucks filter
• 766cb29 fix(templating): render markdown via marked and bump marked to v18
• 3fea622 build(deps): update @​octokit/rest to v22 and @​octokit/types to v17
• 2ad83c0 build(deps): update @​actions/core and @​actions/io to v3
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)