Skip to content

v4.0.0

Choose a tag to compare

View all tags
@rsdmike rsdmike released this 27 Aug 22:58
· 17 commits to main since this release
v4.0.0
d667152

⚠️ Breaking changes

The action now runs on the node24 runtime and requires Node >= 22.12.0.

action.yml moves from using: node16 to using: node24. node16 is
end-of-life, and puppeteer-core 25 requires Node >= 22.12.0, so node20 was no
longer viable either.

Before upgrading, check that:

  • Self-hosted runners are on a runner release that supports the node24
    runtime. Older runners will fail to start the action.
  • Linux self-hosted runners have glibc 2.28 or newer. Node 24 binaries
    will not run on older glibc (RHEL/CentOS 7 and Ubuntu 18.04 are below this).

GitHub-hosted runners already satisfy both.

Features

  • Add Trivy results to the scan (#544ffd6)

Maintenance

This release covers 59 commits since v3.0.4 (April 2023). Highlights:

  • Test suite restored on modern Node. Built-in TypeScript type-stripping (on by
    default since Node 22.6) preempted ts-node's require.extensions hook, which
    broke the suite with a misleading Cannot find module ./src/pdf/pdfWriter.
  • CI now runs the suite against Node 22, 24 and 26.
  • npm run package is the single source of truth for dist/; CI uses the
    pinned ncc devDependency rather than installing latest globally.
  • Dependency updates: puppeteer-core 21 → 25, @actions/core and
    @actions/io → v2, commander 11 → 15, jsdom 23 → 28, marked 4 → 10,
    chai 4 → 6, mocha 10 → 11, @vercel/ncc 0.38 → 0.45, ESLint 9 with flat
    config and neostandard.
  • Security: resolved all npm audit findings by overriding mocha's transitive
    diff and serialize-javascript (GHSA-73rr-hh4g-fpgx, GHSA-5c6j-r48x-rmvq,
    GHSA-qj8w-gfj5-8c6v). Replaced the unmaintained ts-sinon with sinon 22.
  • CodeQL analysis re-enabled and scoped to src/, excluding the generated
    dist/ bundle.

Removed

  • The Build Bundle Executables workflow. It invoked npm run build-exe-*
    scripts that were dropped in April 2023, so it had failed immediately for over
    three years. No release ever carried these binaries — v3.0.0 through v3.0.4 all
    have zero attached assets.

    Note: README.md still contains "Installation" and "Running" sections that
    describe downloading a zip bundle and running ./github-security-report-mac-x64.
    Those instructions were already inaccurate before this release and remain to be
    cleaned up.

Assets 2
Loading