chore(deps): bump woocommerce/action-scheduler from 3.9.3 to 4.1.0

[dependabot]

Bumps woocommerce/action-scheduler from 3.9.3 to 4.1.0.

Release notes

Sourced from woocommerce/action-scheduler's releases.

Version 4.1.0

• Fix - Correct an oversight in the lock implementation (used to rate-limit async request runners) that could leave a lock permanently stuck and result in database errors in unusual cases.
• Fix - Correct the behavior of the wp action-scheduler clean command so that the --before option defaults to 31 days ago.
• Performance - Reduce the number of SQL queries on the Action Scheduler admin page.
• Performance - Cache resolved group IDs to reduce the number of SQL queries.
• Performance - Use the WordPress caching layer for the option lock component.
• Enhancement - Display action IDs in the admin list and allow searching by action ID.
• Enhancement - Use wp_admin_notice() to render admin notices, instead of custom HTML.
• Security - Add protections to guard against the risk of object-injection/deserialization attacks when retrieving stored schedule data.
• Dev - Include the underlying database error in the exception thrown when the legacy post store fails to claim actions.
• Dev - Add filters (action_scheduler_allowed_nested_schedule_classes, action_scheduler_enforce_schedule_allowed_classes) and an action (action_scheduler_unexpected_schedule_class) to tune and observe schedule deserialization.

Version 4.0.0

• Breaking change: action args are taken into account when scheduling unique actions.
• Breaking change: failed actions are now automatically purged after 3 months by default, controlled by the action_scheduler_retention_period_for_failed filter.
• Add action_scheduler_enable_failed_action_cleanup filter to disable automatic cleanup of failed actions.
• Performance - Actions with corrupted data are automatically cancelled on detection and their excess logs cleaned up in batches, preventing queue stalls and log table bloat.
• Performance - Action cleanup now runs as a dedicated daily task at 3 am site time with higher throughput.
• Update favicon images.
• Fix number formating for action numbers in list view.
• Import missing WP_CLI class to prevent fatal error.
• Fix possible undefined variable in action cancel --all CLI command.
• Move recurring A-S cache key to transient.
• Optimize get_claim_count() query for large stores.
• Update require_once path for Cancel_CommandFix absolute import.
• Fix esc_html() hook name in admin notice markup.
• Ensure cleanup action is enqueued via queue runner.
• Bump WordPress compatibility to version 7.0 and require at least 6.8.
• Dev - Bump picomatch from 2.3.1 to 2.3.2.
• Dev - Bump phpunit/phpunit from 8.5.42 to 8.5.52.
• Dev - Bump lodash, grunt-legacy-log and grunt-legacy-util.

Changelog

Sourced from woocommerce/action-scheduler's changelog.

*** Changelog ***

= 4.1.0 - 2026-08-05 =

• Fix - Correct an oversight in the lock implementation (used to rate-limit async request runners) that could leave a lock permanently stuck and result in database errors in unusual cases.
• Fix - Correct the behavior of the wp action-scheduler clean command so that the --before option defaults to 31 days ago.
• Performance - Reduce the number of SQL queries on the Action Scheduler admin page.
• Performance - Cache resolved group IDs to reduce the number of SQL queries.
• Performance - Use the WordPress caching layer for the option lock component.
• Enhancement - Display action IDs in the admin list and allow searching by action ID.
• Enhancement - Use wp_admin_notice() to render admin notices, instead of custom HTML.
• Security - Add protections to guard against the risk of object-injection/deserialization attacks when retrieving stored schedule data.
• Dev - Include the underlying database error in the exception thrown when the legacy post store fails to claim actions.
• Dev - Add filters (action_scheduler_allowed_nested_schedule_classes, action_scheduler_enforce_schedule_allowed_classes) and an action (action_scheduler_unexpected_schedule_class) to tune and observe schedule deserialization.

= 4.0.0 - 2026-06-16 =

• Breaking change: action args are taken into account when scheduling unique actions.
• Breaking change: failed actions are now automatically purged after 3 months by default, controlled by the action_scheduler_retention_period_for_failed filter.
• Add action_scheduler_enable_failed_action_cleanup filter to disable automatic cleanup of failed actions.
• Performance - Actions with corrupted data are automatically cancelled on detection and their excess logs cleaned up in batches, preventing queue stalls and log table bloat.
• Performance - Action cleanup now runs as a dedicated daily task at 3 am site time with higher throughput.
• Update favicon images.
• Fix number formating for action numbers in list view.
• Import missing WP_CLI class to prevent fatal error.
• Fix possible undefined variable in action cancel --all CLI command.
• Move recurring A-S cache key to transient.
• Optimize get_claim_count() query for large stores.
• Update require_once path for Cancel_CommandFix absolute import.
• Fix esc_html() hook name in admin notice markup.
• Ensure cleanup action is enqueued via queue runner.
• Bump WordPress compatibility to version 7.0 and require at least 6.8.
• Dev - Bump picomatch from 2.3.1 to 2.3.2.
• Dev - Bump phpunit/phpunit from 8.5.42 to 8.5.52.
• Dev - Bump lodash, grunt-legacy-log and grunt-legacy-util.

= 3.9.3 - 2025-07-15 =

• Add hook 'action_scheduler_ensure_recurring_actions' specifically for scheduling recurring actions.
• Assume an action is valid until proven otherwise.
• Implement SKIP LOCKED during action claiming.
• Import get_flag_value() from WP_CLI\Utils before using.
• Make $unique available to all pre-creation/short-circuit hooks.
• Make version/source information available via new class.
• Only release claims on pending actions.
• Tweak - WP 6.8 compatibility.
• Update minimum supported php and phpunit versions.
• Update readme.txt.
• WP CLI get action command: correct parentheses/nesting of conditional checks.

= 3.9.2 - 2025-02-03 =

• Fixed fatal errors by moving version info methods to a new class and deprecating conflicting ones in ActionScheduler_Versions

... (truncated)

Commits

• 40a3df9 Release prep: 4.1.0 (#1361)
• c5a0fa0 Add action IDs to admin list and search (#1359)
• 424ccf2 Schedule deserialization hardening (#1344)
• 2275f49 Add AGENTS.md (and a CLAUDE.md as a thin wrapper/pointer). (#1356)
• b6e83ce Add light colour scheme for GitHub Pages docs site (#1350)
• 4e671df Fix default 'before' date in WP-CLI clean command #1343 (#1346)
• 96e062f [Performance] Use the WordPress caching layer for the option lock component. ...
• 5da0bb4 [Performance] Cache resolved group IDs to reduce the number of SQL queries (#...
• 22df113 [Performance] Reduce the number of SQL queries on scheduler admin page (#1330)
• e56fc51 Option lock stuck locked with '' (#1289)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[pirate-bot]

Plugin build for 6e6cad2 is ready 🛎️!

• Download build