v4.1.0

Fixes report generation failing with a GraphQL timeout on repositories with a large dependency manifest.

The problem

The dependency graph query expanded dependencyGraphManifests.dependencies, which makes GitHub resolve every manifest's full dependency graph. On a repository with a large lockfile that exceeds GitHub's server-side GraphQL budget and fails the whole query:

##[error]Request failed due to following response errors:
 - timedout

No PDF was produced. In most workflows this went unnoticed because the report step runs with continue-on-error: true, so the job stayed green and the step reported success — the failure appeared only in the raw logs, followed by mv: cannot stat 'report.pdf'.

If you are seeing an empty report artifact, or a "No files were found with the provided path: ./*.pdf" warning after your CodeQL job, this is very likely the cause.

What changed

• Manifests are read with a metadata-only GraphQL query; the expensive nested connection is gone. It was never rendered by the report template.
• Dependencies now come from the repository's dependency-graph SBOM, via the asynchronous SBOM API (generate-report, then polling fetch-report). Polling is bounded and raises a clear error rather than hanging the job.
• The synchronous /dependency-graph/sbom endpoint is deprecated and scheduled for removal on 2026-11-13; it is retained only as a fallback for GitHub Enterprise Server instances without the async endpoint.
• The dependency count in the report is now accurate. It previously relied on dependenciesCount, which GitHub only populates as a side effect of the same expensive resolver, so it frequently read 0.

Behavior changes

These affect the JSON data shaping, not the rendered report or summary templates:

• Dependency versions are SBOM-resolved (1.3.0) rather than manifest ranges (^1.0.0).
• Dependency grouping keys come from the purl type (npm, githubactions, maven) rather than GraphQL's NPM / ACTIONS.
• Dependencies are no longer attributed to the manifest that introduced them; the SBOM does not carry that mapping. Manifest lists (processed / unprocessed) are unaffected.

If you use the legacy summary_old.html template, note it hardcodes dependencies.npm and dependencies.maven.

Upgrading

- name: Generate Security Report
  uses: rsdmike/github-security-report-action@v4.1.0
  with:
    template: report
    token: ${{ secrets.SECURITY_TOKEN }}

No input or output changes. Once upgraded, consider removing continue-on-error: true from the report step so future failures are visible.

Full Changelog: v4.0.1...v4.1.0

v4.0.1

A maintenance release. The action runtime is unchanged from v4.0.0 (using: node24), so this is a drop-in upgrade for existing workflows — the internals moved to ESM, but that is invisible to consumers, who only ever run the bundled dist/index.js.

The one thing that does change is the rendered output of the report template, which is the point of two of the fixes below.

Fixed

SARIF rule help now renders as HTML in the report template. marked was imported and configured but never actually invoked — the DOMPurify sanitizer was being passed to nunjucks-markdown as the renderer — so rule help text appeared in the generated HTML and PDF as literal markdown source (# Heading, **bold**, [link](url)). It is now parsed with marked and then sanitized, as originally intended. Untrusted SARIF content is still scrubbed.

The bundled templates are no longer shipped stale. dist/templates/ in v4.0.0 had drifted from templates/, so the report output was missing the per-alert Tool: row and a page break before the Dependency Vulnerabilities section. npm run package now copies the templates explicitly rather than relying on ncc's asset relocator, which only recognises path.join(__dirname, '…') and silently stopped copying anything once the sources moved to import.meta.dirname. npm run test:dist now fails if dist/templates ever drifts from source again, or if a bundled template stops compiling.

Changed

• Migrated from CommonJS to ESM, using Node's native TypeScript type stripping instead of ts-node.
• Dropped nunjucks-markdown (unmaintained, last published June 2022) in favour of a native nunjucks filter. Output is identical for the same input, and the filter renders empty rather than throwing when a rule carries no help markdown.
• Dependency updates: @actions/core and @actions/io v3, @octokit/rest v22, @octokit/types v17, marked v18.
• The minimum Node version for running the CLI from a clone is now 22.18.0 (was 22.12.0). This does not affect the action itself — the runner supplies the node24 runtime.

Documentation

• Removed report_sca from the list of available templates. It has never existed in any release, and passing it fails with Failed to resolve a template file. Software Composition Analysis is already part of report.
• Documented aggregated_report, which does exist: the same content as report, with open code scanning alerts grouped by rule and an instance count per rule, rather than listed individually.

Verification

Each top-level template was rendered against the committed sample payload, and the packaged action was run end-to-end on a real repository — CodeQL analyze into ../results, then template: report — producing a valid 281 KB PDF.

Full changelog: v4.0.0...v4.0.1

v4.0.0

⚠️ Breaking changes

The action now runs on the node24 runtime and requires Node >= 22.12.0.

action.yml moves from using: node16 to using: node24. node16 is
end-of-life, and puppeteer-core 25 requires Node >= 22.12.0, so node20 was no
longer viable either.

Before upgrading, check that:

• Self-hosted runners are on a runner release that supports the node24
  runtime. Older runners will fail to start the action.
• Linux self-hosted runners have glibc 2.28 or newer. Node 24 binaries
  will not run on older glibc (RHEL/CentOS 7 and Ubuntu 18.04 are below this).

GitHub-hosted runners already satisfy both.

Features

• Add Trivy results to the scan (#544ffd6)

Maintenance

This release covers 59 commits since v3.0.4 (April 2023). Highlights:

• Test suite restored on modern Node. Built-in TypeScript type-stripping (on by
  default since Node 22.6) preempted ts-node's require.extensions hook, which
  broke the suite with a misleading Cannot find module ./src/pdf/pdfWriter.
• CI now runs the suite against Node 22, 24 and 26.
• npm run package is the single source of truth for dist/; CI uses the
  pinned ncc devDependency rather than installing latest globally.
• Dependency updates: puppeteer-core 21 → 25, @actions/core and
  @actions/io → v2, commander 11 → 15, jsdom 23 → 28, marked 4 → 10,
  chai 4 → 6, mocha 10 → 11, @vercel/ncc 0.38 → 0.45, ESLint 9 with flat
  config and neostandard.
• Security: resolved all npm audit findings by overriding mocha's transitive
  diff and serialize-javascript (GHSA-73rr-hh4g-fpgx, GHSA-5c6j-r48x-rmvq,
  GHSA-qj8w-gfj5-8c6v). Replaced the unmaintained ts-sinon with sinon 22.
• CodeQL analysis re-enabled and scoped to src/, excluding the generated
  dist/ bundle.

Removed

• The Build Bundle Executables workflow. It invoked npm run build-exe-*
  scripts that were dropped in April 2023, so it had failed immediately for over
  three years. No release ever carried these binaries — v3.0.0 through v3.0.4 all
  have zero attached assets.

  Note: README.md still contains "Installation" and "Running" sections that
  describe downloading a zip bundle and running ./github-security-report-mac-x64.
  Those instructions were already inaccurate before this release and remain to be
  cleaned up.

v3.0.4

What's Changed

• build(deps): update dependencies by @rsdmike in #26
• build: remove source map for dist by @rsdmike in #27
• build: update typescript target to ES2022 by @rsdmike in #28

Full Changelog: v3.0.3...v3.0.4

v3.0.3

build: just guessing on how this template path works

v3.0.2

Merge pull request #25 from rsdmike/removedist

build: fix template path-ing

v3.0.1

Merge pull request #23 from rsdmike/template_fix

fix: update html templates

v3

What's Changed

• feat: enhance report with details by @rsdmike in #2
• Bump @typescript-eslint/eslint-plugin from 5.54.1 to 5.57.1 by @dependabot in #20
• Bump eslint from 8.35.0 to 8.37.0 by @dependabot in #17
• Bump puppeteer-core from 19.7.3 to 19.8.3 by @dependabot in #16
• Bump @types/node from 18.14.6 to 18.15.11 by @dependabot in #18
• Bump @typescript-eslint/parser from 5.54.1 to 5.57.1 by @dependabot in #19
• Bump eslint from 8.35.0 to 8.38.0 by @dependabot in #22
• build: change github action name by @rsdmike in #21

New Contributors

• @rsdmike made their first contribution in #2
• @dependabot made their first contribution in #20

Full Changelog: https://github.com/rsdmike/github-security-report-action/commits/v3.0.0