chore(deps): update actions/dependency-review-action action to v5

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/dependency-review-action	action	major	v4.9.0 → v5.0.0

---

Release Notes

actions/dependency-review-action (actions/dependency-review-action)

v5.0.0: 5.0.0

Compare Source

This is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version v2.327.1 to run.

What's Changed

• Add .github/copilot-instructions.md for Copilot coding agent by @​ahpook in #​1067
• Update Node.js runtime from 20 to 24 by @​scottschreckengaust in #​1084
• Bump spdx-license-ids from 3.0.20 to 3.0.23 by @​mongolyy in #​1091
• docs: bump actions/checkout from v4 to v6 in workflow examples by @​Marukome0743 in #​1077
• fix: patched version display for advisories with non-strict semver ranges (e.g. Maven beta versions) by @​tspascoal in #​1076
• Resolve security findings by @​AshelyTC in #​1094
• v5.0.0 release branch by @​ahpook in #​1098

New Contributors

• @​scottschreckengaust made their first contribution in #​1084
• @​mongolyy made their first contribution in #​1091
• @​Marukome0743 made their first contribution in #​1077

Full Changelog: actions/dependency-review-action@v4.9.0...v5.0.0

---

Configuration

📅 Schedule: (in timezone America/Boise)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	aerealith	9548626	Jul 04 2026, 05:28 PM

[github-code-quality]

Code Coverage Overview

Languages: JavaScript

JavaScript / code-coverage/vitest

The overall coverage remains at 86%, unchanged from the master branch.

---

_{Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

Coverage Report for Aerealith Vitest Coverage (.)

Status	Category	Percentage	Covered / Total
🔵	Lines	85.61%	833 / 973
🔵	Statements	85.64%	835 / 975
🔵	Functions	73.46%	227 / 309
🔵	Branches	68.55%	316 / 461

File Coverage

No changed files found.

Generated in workflow #103 for commit 9548626 by the Vitest Coverage Report Action

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/dependency-review-action	a1d282b36b6f3519aa1f3fc636f609c47dddb294	🟢 7.7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Maintained 🟢 10 15 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 9 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches SAST 🟢 9 SAST tool detected but not run on all commits

Scanned Files

• .github/workflows/06-dependency-review.yaml

[codecov]

Bundle Report

Bundle size has no change ✅

[github-actions]

Aerealith CI

Overall result: ❌ Failed
Run: #103

Check	Result
Dependency install	✅ Passed
Nx installation	✅ Passed
Nx workspace reset	✅ Passed
Git comparison range	✅ Passed
Nx affected validation	❌ Failed
MegaLinter	✅ Passed

Cache

• pnpm store: hit
• Nx task cache: managed by Nx Cloud when configured for this workspace.

Run details

• Base SHA: 255485f7eac3305483f1936f5df67656b686a63b
• Head SHA: 9548626e8d484e198771f989007749ec4de6d684
• Validation targets: lint, typecheck, test, build
• Logs: download the ci-logs artifact from the workflow run.

Warning

Nx affected validation failed. Download the ci-logs artifact and inspect nx-affected-validation.log.
If the project graph reports Vite or Vitest plugin-worker failures, repair the affected Nx/Vite/Vitest configuration before rerunning CI.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud