- introducing the pull_request_target trigger means that not all contexts will use "dependabot[bot]" as the Actor (removed restriction)
- some dependencies use a short name ("checkstyle") in the PR title but a full name ("com.puppycrawl.tools:checkstyle") in the repositoryvulnerabilityalert API (broadened match to include *:depname)