What's Changed docker: don't raise on versions with more than one underscore-separated group by @v-sachin-sandhu in #16660 Enable Sorbet checking for Go modules specs by @JamieMagee in #16732 Enable Sorbet checking for pub specs by @JamieMagee in #16733 Enable Sorbet checking for pre-commit specs by @JamieMagee in #16734 terraform: don't crash when the lockfile has no entry for the updated provide…
What's Changed Ignore commented-out _authToken lines in .npmrc by @alhss in #16550 Fix wording in Docker and updater specs by @JamieMagee in #16633 bun: scope workspace-only dependency installs/updates with --filter by @v-sachin-sandhu in #16543 Skip public PyPI library lookup when a python_index credential has replaces-base by @v-thavaahariharangit with @Copilot in #16619 Classify pnpm errors tha…
What's Changed bun: Update catalog dependencies by @fbartho in #16544 github_actions: pass home hostname to gh-actions-lock by @nodeselector in #16504 Type common model specs and shared RSpec ancestors by @JamieMagee in #16506 Type common credential, group, and experiment specs by @JamieMagee in #16552 Type common cooldown spec fixtures by @JamieMagee in #16551 Enable Sorbet checking for Git submo…
What's Changed Type Python registry distribution metadata by @JamieMagee in #16466 Maven: only propose updates with writable requirements by @v-kbukum1 in #16465 Support Bun 1.4 and lockfile versions 2 and 3 by @v-sachin-sandhu in #16485 Maven: reliable dependency tree scan behind maven_transitive_dependencies by @v-kbukum1 in #16487 Classify unchanged dependency files with typed error by @v-thava…
What's Changed Bump pacote from 21.3.1 to 21.5.1 in /npm_and_yarn/helpers by @dependabot[bot] in #16411 Report conflicting dependencies for security updates by @v-thavaahariharangit with @Copilot in #16335 Fix vulnerable Yarn alias test fixture by @v-thavaahariharangit with @Copilot in #16414 Bump the dev-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #16403 Use typed…
What's Changed Fix NilClass passed to Pub cooldown in_cooldown_period? by @v-kbukum1 in #16362 Bump browserslist from 4.28.1 to 4.28.9 in /npm_and_yarn/helpers by @dependabot[bot] in #16145 Bump @humanfs/node from 0.16.6 to 0.16.8 in /bun/helpers by @dependabot[bot] in #16144 Bump js-yaml from 3.14.2 to 3.15.2 in /npm_and_yarn/helpers by @dependabot[bot] in #16236 Bump poetry from 2.4.1 to 2.4.3 i…
What's Changed Bump js-yaml from 3.14.1 to 3.15.2 in /bun/helpers by @dependabot[bot] in #16292 Bump Microsoft.Extensions.Logging from 10.0.11 to 10.0.12 by @dependabot[bot] in #16284 Fix devcontainers crash on features referenced without a version tag by @v-kbukum1 in #16295 Add support for .zst nixpkgs tarball by @bazcatqubed in #16166 npm_and_yarn: route pnpm 12 native binary download through t…
What's Changed Remove fully rolled out feature flags by @ruben-pachecocaldera in #16046 build(deps): bump hcl2json to v0.6.9 by @JamieMagee in #16188 build(deps): bump PowerShell to 7.6.5 by @JamieMagee in #16189 build(deps): bump Yarn to 4.18.0 by @JamieMagee in #16187 build(deps): bump git-shim to v1.5.0 by @JamieMagee in #16186 Add shared delivery for unavailable cooldown warnings by @v-robaike…
What's Changed fix: handle nil hash results from unavailable Python package indexes by @sachin-sandhu in #16078 Skip unsupported Maven wrappers instead of failing the Maven job by @kbukum1 in #16090 Migrate test runner to turbo_tests2 by @jeffwidman in #15991 Bump the dev-dependencies group across 2 directories with 5 updates by @dependabot[bot] in #16085 Bump the prod-dependencies group across 2…
What's Changed Remove enable_corepack_for_npm_and_yarn and preserve direct execution by @ruben-pachecocaldera with @Copilot in #15945 Remove enable_private_registry_for_corepack flag and make private-registry corepack env permanent by @ruben-pachecocaldera with @Copilot in #15946 Nix: lock the selected revision by @JamieMagee in #15984 Remove allow_refresh_for_existing_pr_dependencies feature flag…
What's Changed Type common runtime boundaries by @JamieMagee in #15916 Type common provider clients by @JamieMagee in #15917 Type common repository fetching by @JamieMagee in #15918 Type common metadata boundaries by @JamieMagee in #15919 Type common pull request reads by @JamieMagee in #15920 Type common pull request writes by @JamieMagee in #15921 Bump erb from 6.0.1 to 6.0.1.1 in /updater by @d…
What's Changed Type shared Python requirement boundaries by @JamieMagee in #15837 Type Python requirement consumers by @JamieMagee in #15838 Type UV requirement access by @JamieMagee in #15839 Type Conda requirement access by @JamieMagee in #15840 Roll pub. Fix flutter/dart sdk constraint rewritten in lockfile by @svartalfheim in #15654 Use GitHub Artifact Attestations for container image signing…
What's Changed Add typed requirement metadata readers by @JamieMagee in #15740 Type common requirement access by @JamieMagee in #15741 gracefully handle exceptions generated during package detail fetch by @brettfo in #15762 Bump the dev-dependencies group across 2 directories with 7 updates by @dependabot[bot] in #15563 Upgrade uv to 0.11.31 by @ABruihler in #15424 Bump ip-address from 10.2.0 to 1…
What's Changed Add typed requirement source API by @JamieMagee in #15705 Reland "Cargo: handle crates locked at multiple versions" (#15638) by @p-linnane in #15668 Preserve original absence of the bundler self-checksum on lockfile updates by @p-linnane in #15669 Support security updates for vcpkg ports by @JamieMagee in #15676 Beta support of PNPM 11 by @v-robaiken in #15710 Remove enable_cooldown…
What's Changed Rescue errors in metadata_cascades_for_dep to prevent PR message loss by @yeikel in #14905 Bump sigstore from 4.1.0 to 4.1.1 in /npm_and_yarn/helpers by @dependabot[bot] in #15484 Bump handlebars from 4.7.8 to 4.7.9 in /npm_and_yarn/helpers by @dependabot[bot] in #14547 Bump lodash from 4.17.23 to 4.18.1 in /npm_and_yarn/helpers by @dependabot[bot] in #14605 fix: use canonical LOCKF…
What's Changed Type GitHub release metadata by @JamieMagee in #15597 Make GitCommitChecker strongly typed by @JamieMagee in #15598 Retry corepack prepare and install on signature metadata errors from private registries by @kbukum1 in #15606 Fix UV DependencyGrapher to detect nested uv.lock in monorepos by @thavaahariharangit with @Copilot in #15520 Bump library/rust from 1.95.0-bookworm to 1.97.0-…
What's Changed Type the gradle, swift, and pre_commit ecosystems by @JamieMagee in #15534 Default cooldown to 3 days when default-days is not specified (behind a feature flag) by @robaiken with @Copilot in #15344 Use shared base cooldown in git_submodules by @robaiken in #15537 [Update graph] Avoid PathDependenciesNotReachable killing the whole job by @brrygrdn in #15522 [Update Graph] Ensure that…
What's Changed Capture offending gem details on bundler registry metadata errors by @kbukum1 in #15512 Bundler: apply empty-checksum metadata patch to the v2 helper by @kbukum1 in #15513 [Update graph] Ensure bystander txt files are removed before parsing for Python by @brrygrdn in #15508 Handle global.json with no SDK version in dotnet_sdk parser by @brettfo in #15510 Type the cargo ecosystem and…
What's Changed Support package-scoped NuGet release notes by @Cjewett in #15211 Filter null entries from job directories by @brettfo in #15457 devcontainers: preserve major-only Feature pins when precision-matching tags are absent by @thavaahariharangit with @Copilot in #15445 Type opaque hashes in common with T.anything by @JamieMagee in #15458 Type the options passthrough in base classes with T.…
What's Changed Bazel: Fix prerelease filtering with same-release-line scoping by @v-HaripriyaC in #15332 Respect cooldown for Docker digest updates and suppress multi-arch no-ops by @robaiken in #15354 Bypass npmrc min-release-age for transitive npm security updates by @robaiken in #15386 Ratchet the Sorbet T.untyped burndown by @JamieMagee in #15399 feat(docker): implement single-platform image d…
What's Changed Bump bundled npm from 11.8.0 to 11.17.0 by @kbukum1 in #15335 Fix composer specs failure due to block-insecure feature by @AbhishekBhaskar in #15334 Add blocked_versions.ignored metric for Security-blocked update checks by @kbukum1 in #15333 Preserve original bundler checksum on Bundler 4.0.11+ lockfile updates by @lucasmazza in #15249 Generate .npmrc from scope property when lockfi…
What's Changed Add support for scope property in npm_registry credentials by @AbhishekBhaskar in #15219 uv: Remove dead add_auth_env_vars code and add credential matching diagnostics by @kbukum1 in #15209 Fix npm registry credential leak to sibling paths on the same host by @Copilot in #15248 Fix pnpm lockfileVersion 9.0 parsing error with optional chaining by @markhallen in #13959 Parse remaining…
What's Changed Disable npmMinimalAgeGate for Yarn Berry security updates by @yeikel in #15191 Add Bundler 4 support by @JamieMagee in #15180 Bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 in /maven/lib/dependabot/maven by @dependabot[bot] in #15190 Add GONOPROXY/GONOSUMDB env vars to go_modules FileParser by @Nishnha in #15159 fix(go_modules): include advisory pseudo-v…
What's Changed bundler: avoid adding Bundler checksum for lockfiles using 4.0.0-4.0.10 by @thavaahariharangit in #15164 Remove beta ecosystem flag handling for Deno by @markhallen in #15173 [bun] Add lockfile generator for bun by @brrygrdn in #14882 Pass --config.minimumReleaseAge=0 for pnpm security updates to bypass pnpm-workspace.yaml by @yeikel in #15170 build(deps): bump terraform to 1.15.3 b…
What's Changed Fix duplicate updated dependencies in multi-directory group refresh by @markhallen in #15098 Recategorise lockfile generation errors as known types by @brrygrdn in #15084 [Graph Job] Do not treat Dependabot::UnexpectedExternalCode as a hard failure by @brrygrdn in #15075 [Graph] Fix handling of multiple version resolution by @brrygrdn in #15099 Bun: Upgrade to Node JS 24 by @yeikel…
What's Changed fix(opentofu): strip v prefix in cooldown version comparison by @diofeher in #15044 Use POM last-modified as Gradle plugin release date fallback by @thavaahariharangit in #15006 Add blocked versions support to updater job by @kbukum1 in #14915 Add blocked versions support to dry-run script by @kbukum1 in #14916 Strip surrounding quotes from go.env values before writing by @yeikel in…
What's Changed Implement sbt metadata finder by @AbhishekBhaskar in #15011 Bump NuGet.Client to release/7.6.x and pin dotnet-core to v10.0.8 by @JamieMagee in #14995 feat(opentofu): resolve locals references in module version constraints by @diofeher in #15009 simplify line indent detection by @brettfo in #14980 Fix flaky test: use unique git.store path to avoid parallel race condition by @brettfo…
What's Changed Julia: filter yanked versions from get_available_versions by @IanButterworth in #14939 Add blob_oid metadata to manifests in dependency snapshots by @juxtin in #14857 Fix Maven released? check for non-jar packaging types (e.g., aar) by @kbukum1 in #14886 (Python): Move Pip file filtering to grapher by @Copilot in #14856 detect central package version scheme by @brettfo in #14927 all…
What's Changed Implement SBT UpdateChecker to fetch available versions by @AbhishekBhaskar in #14918 Handle Artifactory directory listings for Gradle release dates by @thavaahariharangit in #14938 feat: Add Deno support to Dependabot Omnibus Gem Spec by @kbukum1 in #14941 v0.375.0 by @dependabot-core-action-automation[bot] in #14942 Full Changelog: v0.374.0...v0.375.0