build(deps): bump rsdmike/github-security-report-action from 4.0.1 to 4.1.0

[dependabot]

Bumps rsdmike/github-security-report-action from 4.0.1 to 4.1.0.

Release notes

Sourced from rsdmike/github-security-report-action's releases.

v4.1.0

Fixes report generation failing with a GraphQL timeout on repositories with a large dependency manifest.

The problem

The dependency graph query expanded dependencyGraphManifests.dependencies, which makes GitHub resolve every manifest's full dependency graph. On a repository with a large lockfile that exceeds GitHub's server-side GraphQL budget and fails the whole query:

##[error]Request failed due to following response errors:
 - timedout

No PDF was produced. In most workflows this went unnoticed because the report step runs with continue-on-error: true, so the job stayed green and the step reported success — the failure appeared only in the raw logs, followed by mv: cannot stat 'report.pdf'.

If you are seeing an empty report artifact, or a "No files were found with the provided path: ./*.pdf" warning after your CodeQL job, this is very likely the cause.

What changed

• Manifests are read with a metadata-only GraphQL query; the expensive nested connection is gone. It was never rendered by the report template.
• Dependencies now come from the repository's dependency-graph SBOM, via the asynchronous SBOM API (generate-report, then polling fetch-report). Polling is bounded and raises a clear error rather than hanging the job.
• The synchronous /dependency-graph/sbom endpoint is deprecated and scheduled for removal on 2026-11-13; it is retained only as a fallback for GitHub Enterprise Server instances without the async endpoint.
• The dependency count in the report is now accurate. It previously relied on dependenciesCount, which GitHub only populates as a side effect of the same expensive resolver, so it frequently read 0.

Behavior changes

These affect the JSON data shaping, not the rendered report or summary templates:

• Dependency versions are SBOM-resolved (1.3.0) rather than manifest ranges (^1.0.0).
• Dependency grouping keys come from the purl type (npm, githubactions, maven) rather than GraphQL's NPM / ACTIONS.
• Dependencies are no longer attributed to the manifest that introduced them; the SBOM does not carry that mapping. Manifest lists (processed / unprocessed) are unaffected.

If you use the legacy summary_old.html template, note it hardcodes dependencies.npm and dependencies.maven.

Upgrading

- name: Generate Security Report
  uses: rsdmike/github-security-report-action@v4.1.0
  with:
    template: report
    token: ${{ secrets.SECURITY_TOKEN }}

No input or output changes. Once upgraded, consider removing continue-on-error: true from the report step so future failures are visible.

Full Changelog: rsdmike/github-security-report-action@v4.0.1...v4.1.0

Commits

• a3d8cc0 chore(release): v4.1.0
• 7979819 refactor(dependencies): poll the SBOM report through Octokit's templated route
• 89c1cdc fix(dependencies): source dependencies from the SBOM API to avoid GraphQL tim...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.71%. Comparing base (ff79777) to head (937fc98).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1243   +/-   ##
=======================================
  Coverage   56.71%   56.71%           
=======================================
  Files         149      149           
  Lines       12154    12154           
=======================================
  Hits         6893     6893           
  Misses       5260     5260           
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[RosieAMT]

🎉 This PR is included in version 1.40.1 🎉

The release is available on:

• GitHub release
• v1.40.1

Your semantic-release bot 📦🚀