v0.3.2

What's Changed

• fix: report check-dist as a 3-way success/neutral/failure status by @felickz in #159
• Add .npmrc with min-release-age=7 supply-chain safeguard by @felickz in #168
• fix: fail the check-dist-build job too on a real dist/ mismatch by @felickz in #166
• Update Undici to patched version 6.28.0 by @felickz with @Copilot in #169
• Address #168 review feedback: align Dependabot cooldown, document min-release-age bypass by @felickz in #171
• fix: drop the custom Checks API check-run, use plain job pass/fail instead by @felickz in #172
• chore: bump version (patch) by @github-actions[bot] in #175

Full Changelog: v0.3.1...v0.3.2

v0.3.1

What's Changed

• Handle percent-encoded epochs in SPDX purls by @felickz with @Copilot in #153
• Retry snapshot submission with exponential backoff on transient API errors by @felickz with @Copilot in #154
• fix: read the standard SPDX versionInfo field instead of packageVersion by @felickz in #156
• Support dependency snapshot submission to target repositories by @felickz with @Copilot in #155
• fix: scope check-dist to release-related changes only by @felickz in #157
• chore: bump version (patch) by @github-actions[bot] in #158

Full Changelog: v0.3.0...v0.3.1

v0.3.0

What's Changed

• README:Update SBOM upload action version to 0.2.0 by @felickz in #103
• chore: Bump eslint from 10.0.0 to 10.0.1 in the development-dependencies group by @dependabot[bot] in #104
• chore: Bump the development-dependencies group with 2 updates by @dependabot[bot] in #108
• deps: Bump actions/upload-artifact from 6 to 7 in the production-dependencies group by @dependabot[bot] in #107
• build(deps-dev): Bump minimatch from 3.1.2 to 3.1.5 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #109
• chore: Bump eslint from 10.0.2 to 10.0.3 in the development-dependencies group by @dependabot[bot] in #112
• chore: Bump flatted from 3.3.3 to 3.4.2 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #117
• chore: Bump picomatch from 2.3.1 to 2.3.2 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #119
• deps: Bump actions/setup-node from 6.2.0 to 6.3.0 in the production-dependencies group by @dependabot[bot] in #111
• build(deps-dev): Bump brace-expansion from 1.1.12 to 1.1.13 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #120
• chore(security): add 3-day Dependabot cooldown and grouped updates by @felickz with @Copilot in #126
• deps: Bump actions/setup-node from 6.3.0 to 6.4.0 in the actions group across 1 directory by @dependabot[bot] in #129
• Bump undici to 6.24.0 to fix GHSA-vrm6-8vpv-qv8q (CVE-2026-1526) by @adrienpessu with @Copilot in #133
• deps: Bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #138
• Fix SPDX dependency classification by @nullchimp in #137
• build(deps-dev): Bump brace-expansion from 1.1.13 to 1.1.18 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #136
• chore: Bump the development-dependencies group across 1 directory with 4 updates by @dependabot[bot] in #131
• deps: Bump the production-dependencies group across 1 directory with 2 updates & bumps CI to node 24 by @dependabot[bot] in #125
• feat: add .release.yml versioning automation and release workflow by @felickz in #143
• Allow reusable release workflow PR updates by @felickz with @Copilot in #144
• fix: pin patch-release-me to 0.6.5 (0.6.6 image missing from ghcr.io) by @felickz in #145
• fix: skip lifecycle scripts when syncing package-lock.json by @felickz in #146
• fix: invoke patch-release-me via docker run to avoid mode arg quoting bug by @felickz in #148
• fix: rebuild dist/ during automated version bumps by @felickz in #151
• chore: bump version (minor) by @github-actions[bot] in #152

New Contributors

• @nullchimp made their first contribution in #137
• @github-actions[bot] made their first contribution in #152

Full Changelog: v0.2.0...v0.3.0

v0.2.0

What's Changed

• build: Update dist files after dependency bump by @Copilot in #97
• deps: Bump the production-dependencies group with 2 updates by @dependabot[bot] in #96
• chore: Bump eslint from 9.39.1 to 9.39.2 in the development-dependencies group by @dependabot[bot] in #95
• deps: Bump the production-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #98
• chore: Bump eslint from 9.39.2 to 10.0.0 in the development-dependencies group by @dependabot[bot] in #100
• deps: Bump the production-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #101
  • Convert to ES modules for @actions/core v3 and @actions/github v9 compatibility #102

Full Changelog: v0.1.2...v0.2.0

v0.1.2 - features and maintenance release

What's Changed

• Update CODEOWNERS to DG team by @jhutchings1 in #49
• Update CODEOWNERS by @GeekMasher in #54
• deps: bump actions/setup-node from 4.0.2 to 4.2.0 in the production-dependencies group across 1 directory by @dependabot[bot] in #69
• feat: Update dependabot.yml by @GeekMasher in #55
• feat: Add support for running inside a matrix by overriding the default correlator identifier by @felickz in #50
• deps: bump actions/setup-node from 4.2.0 to 4.3.0 in the production-dependencies group by @dependabot[bot] in #71
• deps: bump actions/setup-node from 4.3.0 to 4.4.0 in the production-dependencies group by @dependabot[bot] in #72
• Update README.md to use v4 for checkout and upload-artifact by @CallMeGreg in #73
• conditional test - do not run on PR from fork by @felickz in #74
• Bump the npm_and_yarn group across 1 directory with 5 updates by @dependabot[bot] in #77
• deps: bump actions/checkout from 4 to 5 in the production-dependencies group by @dependabot[bot] in #79
• chore: bump the development-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #78
• chore: bump js-yaml from 3.14.1 to 3.14.2 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #86
• deps: bump the production-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #76
• chore: bump glob from 10.4.5 to 10.5.0 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #87
• deps: bump the production-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #85
• deps: Bump the production-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #89
• chore: bump the development-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #82
• Fix for "workflow does not contain permissions", plus updated dist and fixed test failure with lazy loading of submission toolkit by @aegilops in #90
• deps: bump @actions/core from 1.11.1 to 2.0.1 in the production-dependencies group by @dependabot[bot] in #92

New Contributors

• @felickz made their first contribution in #50
• @CallMeGreg made their first contribution in #73
• @aegilops made their first contribution in #90

Full Changelog: v0.1.1...v0.1.2

v0.1.1

What's Changed

• Hotfix for PURL issues by @GeekMasher in #42

Full Changelog: v0.1.0...v0.1.1

v0.1.0

What's Changed

• Bump eslint from 8.34.0 to 8.40.0 by @dependabot in #11
• feat: Update dependabot.yml by @GeekMasher in #27
• deps: bump the production-dependencies group with 4 updates by @dependabot in #28
• v0.1.0 by @GeekMasher in #38

New Contributors

• @dependabot made their first contribution in #11
• @GeekMasher made their first contribution in #27

Full Changelog: v0.0.1...v0.1.0

Initial release (v0.0.1)

Completes the migration from jhutchings1/spdx-to-dependency-graph-action to this repository.