Bump advanced-security/spdx-dependency-submission-action from 0.2.0 to 0.3.2

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps advanced-security/spdx-dependency-submission-action from 0.2.0 to 0.3.2.

Release notes

Sourced from advanced-security/spdx-dependency-submission-action's releases.

v0.3.2

What's Changed

• fix: report check-dist as a 3-way success/neutral/failure status by @​felickz in advanced-security/spdx-dependency-submission-action#159
• Add .npmrc with min-release-age=7 supply-chain safeguard by @​felickz in advanced-security/spdx-dependency-submission-action#168
• fix: fail the check-dist-build job too on a real dist/ mismatch by @​felickz in advanced-security/spdx-dependency-submission-action#166
• Update Undici to patched version 6.28.0 by @​felickz with @​Copilot in advanced-security/spdx-dependency-submission-action#169
• Address #168 review feedback: align Dependabot cooldown, document min-release-age bypass by @​felickz in advanced-security/spdx-dependency-submission-action#171
• fix: drop the custom Checks API check-run, use plain job pass/fail instead by @​felickz in advanced-security/spdx-dependency-submission-action#172
• chore: bump version (patch) by @​github-actions[bot] in advanced-security/spdx-dependency-submission-action#175

Full Changelog: advanced-security/spdx-dependency-submission-action@v0.3.1...v0.3.2

v0.3.1

What's Changed

• Handle percent-encoded epochs in SPDX purls by @​felickz with @​Copilot in advanced-security/spdx-dependency-submission-action#153
• Retry snapshot submission with exponential backoff on transient API errors by @​felickz with @​Copilot in advanced-security/spdx-dependency-submission-action#154
• fix: read the standard SPDX versionInfo field instead of packageVersion by @​felickz in advanced-security/spdx-dependency-submission-action#156
• Support dependency snapshot submission to target repositories by @​felickz with @​Copilot in advanced-security/spdx-dependency-submission-action#155
• fix: scope check-dist to release-related changes only by @​felickz in advanced-security/spdx-dependency-submission-action#157
• chore: bump version (patch) by @​github-actions[bot] in advanced-security/spdx-dependency-submission-action#158

Full Changelog: advanced-security/spdx-dependency-submission-action@v0.3.0...v0.3.1

v0.3.0

What's Changed

• README:Update SBOM upload action version to 0.2.0 by @​felickz in advanced-security/spdx-dependency-submission-action#103
• chore: Bump eslint from 10.0.0 to 10.0.1 in the development-dependencies group by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#104
• chore: Bump the development-dependencies group with 2 updates by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#108
• deps: Bump actions/upload-artifact from 6 to 7 in the production-dependencies group by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#107
• build(deps-dev): Bump minimatch from 3.1.2 to 3.1.5 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#109
• chore: Bump eslint from 10.0.2 to 10.0.3 in the development-dependencies group by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#112
• chore: Bump flatted from 3.3.3 to 3.4.2 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#117
• chore: Bump picomatch from 2.3.1 to 2.3.2 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#119
• deps: Bump actions/setup-node from 6.2.0 to 6.3.0 in the production-dependencies group by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#111
• build(deps-dev): Bump brace-expansion from 1.1.12 to 1.1.13 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#120
• chore(security): add 3-day Dependabot cooldown and grouped updates by @​felickz with @​Copilot in advanced-security/spdx-dependency-submission-action#126
• deps: Bump actions/setup-node from 6.3.0 to 6.4.0 in the actions group across 1 directory by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#129
• Bump undici to 6.24.0 to fix GHSA-vrm6-8vpv-qv8q (CVE-2026-1526) by @​adrienpessu with @​Copilot in advanced-security/spdx-dependency-submission-action#133
• deps: Bump the actions group across 1 directory with 2 updates by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#138
• Fix SPDX dependency classification by @​nullchimp in advanced-security/spdx-dependency-submission-action#137
• build(deps-dev): Bump brace-expansion from 1.1.13 to 1.1.18 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#136
• chore: Bump the development-dependencies group across 1 directory with 4 updates by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#131
• deps: Bump the production-dependencies group across 1 directory with 2 updates & bumps CI to node 24 by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#125
• feat: add .release.yml versioning automation and release workflow by @​felickz in advanced-security/spdx-dependency-submission-action#143
• Allow reusable release workflow PR updates by @​felickz with @​Copilot in advanced-security/spdx-dependency-submission-action#144
• fix: pin patch-release-me to 0.6.5 (0.6.6 image missing from ghcr.io) by @​felickz in advanced-security/spdx-dependency-submission-action#145
• fix: skip lifecycle scripts when syncing package-lock.json by @​felickz in advanced-security/spdx-dependency-submission-action#146
• fix: invoke patch-release-me via docker run to avoid mode arg quoting bug by @​felickz in advanced-security/spdx-dependency-submission-action#148

... (truncated)

Commits

• 8b97fad chore: bump version (patch) (#175)
• 411bc66 fix: drop the custom Checks API check-run, use plain job pass/fail instead (#...
• 4d50327 Address PR #168 review feedback (#171)
• b61ae62 Update Undici to patched version 6.28.0 (#169)
• 1feba8b fix: fail the check-dist-build job too on a real dist/ mismatch (#166)
• c239063 Add .npmrc with min-release-age=7 to block newly published packages (#168)
• 2b22041 fix: report check-dist as a 3-way success/neutral/failure status (#159)
• 08de881 chore: bump version (patch) (#158)
• ecad333 fix: scope check-dist to release-related changes only (#157)
• 5460a4e Support dependency snapshot submission to target repositories (#155)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)