Dependency Review Action 4.9.0

This feature release contains a couple of notable changes:

• There is a new configuration option show_patched_versions which will add a column to the output, showing the fix version of each vulnerable dependency. Thanks @felickz!
• Runs which do not display OpenSSF scorecards no longer fetch scorecard information; previously it was fetched regardless of whether or not it was displayed, causing unneccessary slowness. Great catch @jantiebot!
• There are a couple of fixes to purl parsing which should improve match accuracy for allow-package-dependency lists, including case (in)sensitivity and url-encoded namespaces Thanks @juxtin!

What's Changed

• Compare normalized purls to account for encoding quirks by @juxtin in #1056
• Make purl comparisons case insensitive by @juxtin in #1057
• Feat: Add Patched Version to Vulnerabilities summary by @felickz in #1045
• fix: only get scorecard levels if user wants to see the OpenSSF scorecard by @jantiebot in #1060
• Bump actions/stale from 10.1.0 to 10.2.0 by @dependabot[bot] in #1058
• Bump actions/checkout from 4 to 6 by @dependabot[bot] in #1021
• Updates for release 4.9.0 by @ahpook in #1064

New Contributors

• @jantiebot made their first contribution in #1060

Full Changelog: v4.8.3...v4.9.0