chore(deps): bump woocommerce/action-scheduler from 3.9.3 to 4.2.0

[dependabot]

Bumps woocommerce/action-scheduler from 3.9.3 to 4.2.0.

Release notes

Sourced from woocommerce/action-scheduler's releases.

Version 4.2.0

• Fix - Enforce unique action inserts atomically and release stale uniqueness keys during scheduled cleanup.
• Fix - Show the per-page Screen Option on WooCommerce's Scheduled Actions tab.
• Fix - Show the number of actions and the link in the past-due actions admin notice, instead of raw placeholders.
• Fix - Escape the action hook name in the admin notice shown after a row action.
• Add - Skip runtime scheduling (the WP Cron event, the async request dispatcher and the daily housekeeping action) when Action Scheduler is initialized from a plugin's uninstall.php, and add as_supports( 'uninstall_bootstrap' ) so host plugins can detect it.

Version 4.1.0

• Fix - Correct an oversight in the lock implementation (used to rate-limit async request runners) that could leave a lock permanently stuck and result in database errors in unusual cases.
• Fix - Correct the behavior of the wp action-scheduler clean command so that the --before option defaults to 31 days ago.
• Performance - Reduce the number of SQL queries on the Action Scheduler admin page.
• Performance - Cache resolved group IDs to reduce the number of SQL queries.
• Performance - Use the WordPress caching layer for the option lock component.
• Enhancement - Display action IDs in the admin list and allow searching by action ID.
• Enhancement - Use wp_admin_notice() to render admin notices, instead of custom HTML.
• Security - Add protections to guard against the risk of object-injection/deserialization attacks when retrieving stored schedule data.
• Dev - Include the underlying database error in the exception thrown when the legacy post store fails to claim actions.
• Dev - Add filters (action_scheduler_allowed_nested_schedule_classes, action_scheduler_enforce_schedule_allowed_classes) and an action (action_scheduler_unexpected_schedule_class) to tune and observe schedule deserialization.

Version 4.0.0

• Breaking change: action args are taken into account when scheduling unique actions.
• Breaking change: failed actions are now automatically purged after 3 months by default, controlled by the action_scheduler_retention_period_for_failed filter.
• Add action_scheduler_enable_failed_action_cleanup filter to disable automatic cleanup of failed actions.
• Performance - Actions with corrupted data are automatically cancelled on detection and their excess logs cleaned up in batches, preventing queue stalls and log table bloat.
• Performance - Action cleanup now runs as a dedicated daily task at 3 am site time with higher throughput.
• Update favicon images.
• Fix number formating for action numbers in list view.
• Import missing WP_CLI class to prevent fatal error.
• Fix possible undefined variable in action cancel --all CLI command.
• Move recurring A-S cache key to transient.
• Optimize get_claim_count() query for large stores.
• Update require_once path for Cancel_CommandFix absolute import.
• Fix esc_html() hook name in admin notice markup.
• Ensure cleanup action is enqueued via queue runner.
• Bump WordPress compatibility to version 7.0 and require at least 6.8.
• Dev - Bump picomatch from 2.3.1 to 2.3.2.
• Dev - Bump phpunit/phpunit from 8.5.42 to 8.5.52.
• Dev - Bump lodash, grunt-legacy-log and grunt-legacy-util.

Changelog

Sourced from woocommerce/action-scheduler's changelog.

*** Changelog ***

= 4.2.0 - 2026-09-16 =

• Fix - Enforce unique action inserts atomically and release stale uniqueness keys during scheduled cleanup.
• Fix - Show the per-page Screen Option on WooCommerce's Scheduled Actions tab.
• Fix - Show the number of actions and the link in the past-due actions admin notice, instead of raw placeholders.
• Fix - Escape the action hook name in the admin notice shown after a row action.
• Add - Skip runtime scheduling (the WP Cron event, the async request dispatcher and the daily housekeeping action) when Action Scheduler is initialized from a plugin's uninstall.php, and add as_supports( 'uninstall_bootstrap' ) so host plugins can detect it.

= 4.1.0 - 2026-08-05 =

• Fix - Correct an oversight in the lock implementation (used to rate-limit async request runners) that could leave a lock permanently stuck and result in database errors in unusual cases.
• Fix - Correct the behavior of the wp action-scheduler clean command so that the --before option defaults to 31 days ago.
• Performance - Reduce the number of SQL queries on the Action Scheduler admin page.
• Performance - Cache resolved group IDs to reduce the number of SQL queries.
• Performance - Use the WordPress caching layer for the option lock component.
• Enhancement - Display action IDs in the admin list and allow searching by action ID.
• Enhancement - Use wp_admin_notice() to render admin notices, instead of custom HTML.
• Security - Add protections to guard against the risk of object-injection/deserialization attacks when retrieving stored schedule data.
• Dev - Include the underlying database error in the exception thrown when the legacy post store fails to claim actions.
• Dev - Add filters (action_scheduler_allowed_nested_schedule_classes, action_scheduler_enforce_schedule_allowed_classes) and an action (action_scheduler_unexpected_schedule_class) to tune and observe schedule deserialization.

= 4.0.0 - 2026-06-16 =

• Breaking change: action args are taken into account when scheduling unique actions.
• Breaking change: failed actions are now automatically purged after 3 months by default, controlled by the action_scheduler_retention_period_for_failed filter.
• Add action_scheduler_enable_failed_action_cleanup filter to disable automatic cleanup of failed actions.
• Performance - Actions with corrupted data are automatically cancelled on detection and their excess logs cleaned up in batches, preventing queue stalls and log table bloat.
• Performance - Action cleanup now runs as a dedicated daily task at 3 am site time with higher throughput.
• Update favicon images.
• Fix number formating for action numbers in list view.
• Import missing WP_CLI class to prevent fatal error.
• Fix possible undefined variable in action cancel --all CLI command.
• Move recurring A-S cache key to transient.
• Optimize get_claim_count() query for large stores.
• Update require_once path for Cancel_CommandFix absolute import.
• Fix esc_html() hook name in admin notice markup.
• Ensure cleanup action is enqueued via queue runner.
• Bump WordPress compatibility to version 7.0 and require at least 6.8.
• Dev - Bump picomatch from 2.3.1 to 2.3.2.
• Dev - Bump phpunit/phpunit from 8.5.42 to 8.5.52.
• Dev - Bump lodash, grunt-legacy-log and grunt-legacy-util.

= 3.9.3 - 2025-07-15 =

• Add hook 'action_scheduler_ensure_recurring_actions' specifically for scheduling recurring actions.
• Assume an action is valid until proven otherwise.
• Implement SKIP LOCKED during action claiming.
• Import get_flag_value() from WP_CLI\Utils before using.
• Make $unique available to all pre-creation/short-circuit hooks.
• Make version/source information available via new class.
• Only release claims on pending actions.
• Tweak - WP 6.8 compatibility.

... (truncated)

Commits

• 9e2c6b0 Release prep: 4.2.0 (#1386)
• 77915fc Change 4.1.1 references to 4.2.0 (#1385)
• 39cf542 Change 4.2.0 references to 4.1.1 (#1383)
• ea51cd9 Skip runtime scheduling side effects when bootstrapped from a plugin's uninst...
• 57d2aa1 Make unique action inserts atomic (#1355)
• 29160a6 Run and correct the recurring action scheduler tests (#1382)
• c4651de Fix placeholders and escaping in admin notices (#1381)
• 6f49ea8 Fix screen options on WooCommerce status page (#1360)
• d12d6ef docs: forbid the %i wpdb placeholder in AGENTS.md (#1376)
• 5ed9c29 docs: top up AGENTS.md backward-compatibility guardrails (#1374)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[pirate-bot]

Plugin build for 938e285 is ready 🛎️!

• Download build