chore(deps): bump woocommerce/action-scheduler from 3.9.3 to 4.1.0

[dependabot]

Bumps woocommerce/action-scheduler from 3.9.3 to 4.1.0.

Release notes

Sourced from woocommerce/action-scheduler's releases.

Version 4.1.0

• Fix - Correct an oversight in the lock implementation (used to rate-limit async request runners) that could leave a lock permanently stuck and result in database errors in unusual cases.
• Fix - Correct the behavior of the wp action-scheduler clean command so that the --before option defaults to 31 days ago.
• Performance - Reduce the number of SQL queries on the Action Scheduler admin page.
• Performance - Cache resolved group IDs to reduce the number of SQL queries.
• Performance - Use the WordPress caching layer for the option lock component.
• Enhancement - Display action IDs in the admin list and allow searching by action ID.
• Enhancement - Use wp_admin_notice() to render admin notices, instead of custom HTML.
• Security - Add protections to guard against the risk of object-injection/deserialization attacks when retrieving stored schedule data.
• Dev - Include the underlying database error in the exception thrown when the legacy post store fails to claim actions.
• Dev - Add filters (action_scheduler_allowed_nested_schedule_classes, action_scheduler_enforce_schedule_allowed_classes) and an action (action_scheduler_unexpected_schedule_class) to tune and observe schedule deserialization.

Version 4.0.0

• Breaking change: action args are taken into account when scheduling unique actions.
• Breaking change: failed actions are now automatically purged after 3 months by default, controlled by the action_scheduler_retention_period_for_failed filter.
• Add action_scheduler_enable_failed_action_cleanup filter to disable automatic cleanup of failed actions.
• Performance - Actions with corrupted data are automatically cancelled on detection and their excess logs cleaned up in batches, preventing queue stalls and log table bloat.
• Performance - Action cleanup now runs as a dedicated daily task at 3 am site time with higher throughput.
• Update favicon images.
• Fix number formating for action numbers in list view.
• Import missing WP_CLI class to prevent fatal error.
• Fix possible undefined variable in action cancel --all CLI command.
• Move recurring A-S cache key to transient.
• Optimize get_claim_count() query for large stores.
• Update require_once path for Cancel_CommandFix absolute import.
• Fix esc_html() hook name in admin notice markup.
• Ensure cleanup action is enqueued via queue runner.
• Bump WordPress compatibility to version 7.0 and require at least 6.8.
• Dev - Bump picomatch from 2.3.1 to 2.3.2.
• Dev - Bump phpunit/phpunit from 8.5.42 to 8.5.52.
• Dev - Bump lodash, grunt-legacy-log and grunt-legacy-util.

Changelog

Sourced from woocommerce/action-scheduler's changelog.

*** Changelog ***

= 4.1.0 - 2026-08-05 =

• Fix - Correct an oversight in the lock implementation (used to rate-limit async request runners) that could leave a lock permanently stuck and result in database errors in unusual cases.
• Fix - Correct the behavior of the wp action-scheduler clean command so that the --before option defaults to 31 days ago.
• Performance - Reduce the number of SQL queries on the Action Scheduler admin page.
• Performance - Cache resolved group IDs to reduce the number of SQL queries.
• Performance - Use the WordPress caching layer for the option lock component.
• Enhancement - Display action IDs in the admin list and allow searching by action ID.
• Enhancement - Use wp_admin_notice() to render admin notices, instead of custom HTML.
• Security - Add protections to guard against the risk of object-injection/deserialization attacks when retrieving stored schedule data.
• Dev - Include the underlying database error in the exception thrown when the legacy post store fails to claim actions.
• Dev - Add filters (action_scheduler_allowed_nested_schedule_classes, action_scheduler_enforce_schedule_allowed_classes) and an action (action_scheduler_unexpected_schedule_class) to tune and observe schedule deserialization.

= 4.0.0 - 2026-06-16 =

• Breaking change: action args are taken into account when scheduling unique actions.
• Breaking change: failed actions are now automatically purged after 3 months by default, controlled by the action_scheduler_retention_period_for_failed filter.
• Add action_scheduler_enable_failed_action_cleanup filter to disable automatic cleanup of failed actions.
• Performance - Actions with corrupted data are automatically cancelled on detection and their excess logs cleaned up in batches, preventing queue stalls and log table bloat.
• Performance - Action cleanup now runs as a dedicated daily task at 3 am site time with higher throughput.
• Update favicon images.
• Fix number formating for action numbers in list view.
• Import missing WP_CLI class to prevent fatal error.
• Fix possible undefined variable in action cancel --all CLI command.
• Move recurring A-S cache key to transient.
• Optimize get_claim_count() query for large stores.
• Update require_once path for Cancel_CommandFix absolute import.
• Fix esc_html() hook name in admin notice markup.
• Ensure cleanup action is enqueued via queue runner.
• Bump WordPress compatibility to version 7.0 and require at least 6.8.
• Dev - Bump picomatch from 2.3.1 to 2.3.2.
• Dev - Bump phpunit/phpunit from 8.5.42 to 8.5.52.
• Dev - Bump lodash, grunt-legacy-log and grunt-legacy-util.

= 3.9.3 - 2025-07-15 =

• Add hook 'action_scheduler_ensure_recurring_actions' specifically for scheduling recurring actions.
• Assume an action is valid until proven otherwise.
• Implement SKIP LOCKED during action claiming.
• Import get_flag_value() from WP_CLI\Utils before using.
• Make $unique available to all pre-creation/short-circuit hooks.
• Make version/source information available via new class.
• Only release claims on pending actions.
• Tweak - WP 6.8 compatibility.
• Update minimum supported php and phpunit versions.
• Update readme.txt.
• WP CLI get action command: correct parentheses/nesting of conditional checks.

= 3.9.2 - 2025-02-03 =

• Fixed fatal errors by moving version info methods to a new class and deprecating conflicting ones in ActionScheduler_Versions

... (truncated)

Commits

• 40a3df9 Release prep: 4.1.0 (#1361)
• c5a0fa0 Add action IDs to admin list and search (#1359)
• 424ccf2 Schedule deserialization hardening (#1344)
• 2275f49 Add AGENTS.md (and a CLAUDE.md as a thin wrapper/pointer). (#1356)
• b6e83ce Add light colour scheme for GitHub Pages docs site (#1350)
• 4e671df Fix default 'before' date in WP-CLI clean command #1343 (#1346)
• 96e062f [Performance] Use the WordPress caching layer for the option lock component. ...
• 5da0bb4 [Performance] Cache resolved group IDs to reduce the number of SQL queries (#...
• 22df113 [Performance] Reduce the number of SQL queries on scheduler admin page (#1330)
• e56fc51 Option lock stuck locked with '' (#1289)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[pirate-bot]

Plugin build for 6e6cad2 is ready 🛎️!

• Download build