dependabot-core

What's Changed

• Nuget file fetching simplifications by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8524
• Add Open Telemetry Spans throughout the codebase by @jpinz in https://github.com/dependabot/dependabot-core/pull/8488
• [NuGet] add dotnet 8.0 support by @brettfo in https://github.com/dependabot/dependabot-core/pull/8562
• Teach updater how to do multi-directory version pull requests by @brbayes-msft in https://github.com/dependabot/dependabot-core/pull/8541
• report and search *.proj files as dependencies by @brettfo in https://github.com/dependabot/dependabot-core/pull/8569
• Run spoom bump as part of CI by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8469
• resolve nupkg download link from repository base address and type by @brettfo in https://github.com/dependabot/dependabot-core/pull/8575
• update NuGet.Client submodule to latest public release, 6.8.0.131 by @brettfo in https://github.com/dependabot/dependabot-core/pull/8574
• Fix docker attempting to append digest for helm by @brbayes-msft in https://github.com/dependabot/dependabot-core/pull/8595
• fix Sorbet type error by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8606
• fix: Use portable Bash shebang by @l0b0 in https://github.com/dependabot/dependabot-core/pull/8378
• feat: Updates Hex to 2.0.6 by @isaacsanders in https://github.com/dependabot/dependabot-core/pull/7890
• consider shrinkwrap when inferring an npmrc file by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8611
• Handle Version Elements in Update by @ryanbrandenburg in https://github.com/dependabot/dependabot-core/pull/8612
• break out the ci paths filter to a file by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8604
• Fix: Typo by @localheinz in https://github.com/dependabot/dependabot-core/pull/8581
• Fix: Typo by @localheinz in https://github.com/dependabot/dependabot-core/pull/8580
• Fix: Typo by @localheinz in https://github.com/dependabot/dependabot-core/pull/8579
• Bump the dev-dependencies group in /updater with 2 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/8564
• fix Python updates involving mysqlclient by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8618
• support Composer artifact repositories by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8620
• fix exception when Action is pinned to a SHA with no tags by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8621
• Remove unused requires of deleted go native helper functionality by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/8630
• "re-selling" -> "reselling" by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/8623
• Fix missing version in commit message for dependency group with 1 update by @martincostello in https://github.com/dependabot/dependabot-core/pull/8577
• pin Sorbet's version so it doesn't randomly break by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8649
• help customers debug Python issues like update_not_possible by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8644
• Strictly type BranchNamer::Base by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8557
• Strong type MetadataFinders by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8556
• Strictly type Experiments by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8555
• Stop printing pointless git default branch warning into logs/tests by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/8632
• Azure DevOps now supports HTML in PR descriptions by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/8628
• Add a test for Azure sources by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/8629
• fix #8533 modify registries typing in file.rb by @lucemia in https://github.com/dependabot/dependabot-core/pull/8599
• Use a hash in the branch name for multi-directory grouped security updates by @Nishnha in https://github.com/dependabot/dependabot-core/pull/8560
• Strictly type errors by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8493
• Create abstract Dependabot::Requirement class by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8492
• Fix up some of the open telemetry issues by @jpinz in https://github.com/dependabot/dependabot-core/pull/8650
• build(deps): bump Terraform to 1.6.6 by @Nishnha in https://github.com/dependabot/dependabot-core/pull/8645
• improve how branch images skips by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8651
• group all the actions updates together by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8655
• Bump the all-actions group with 4 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/8657
• Bump actions/labeler from 4 to 5 by @dependabot in https://github.com/dependabot/dependabot-core/pull/8586
• Fix failing test for NuGet updates by @martincostello in https://github.com/dependabot/dependabot-core/pull/8485
• Normalize "lockfile" terminology by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8660
• v0.239.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/8607

New Contributors

• @brbayes-msft made their first contribution in https://github.com/dependabot/dependabot-core/pull/8541
• @l0b0 made their first contribution in https://github.com/dependabot/dependabot-core/pull/8378
• @isaacsanders made their first contribution in https://github.com/dependabot/dependabot-core/pull/7890

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.238.0...v0.239.0

What's Changed

• Update error message matching by @pavera in https://github.com/dependabot/dependabot-core/pull/8408
• yarn:update add a handled error for missing tags by @pavera in https://github.com/dependabot/dependabot-core/pull/8389
• Contribute changes to NuGet updater from Azure team by @brettfo in https://github.com/dependabot/dependabot-core/pull/8179
• Strictly type GitMetadataFetcher by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8441
• Strictly type Dependabot::Dependency by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8418
• Bump nuget files type strictness by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8468
• Sanitize .yanrc.yml when missing environment variables prevent yarn from running by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8446
• Remove unused licensed gem and artifacts by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8466
• Capture dependencies groups with inline comments in pyproject files by @dsuleimenov in https://github.com/dependabot/dependabot-core/pull/8423
• build(deps): bump pNPM to 8.11.0 by @yeikel in https://github.com/dependabot/dependabot-core/pull/8471
• Bump the dev-dependencies group in /npm_and_yarn/helpers with 2 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/8438
• Bump the npm-dependencies group in /npm_and_yarn/helpers with 2 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/8336
• Fix pipenv upgrades when star requirement is used by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8452
• Bump cython from 3.0.4 to 3.0.5 in /python/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/8337
• fix #8414 follow poetry source constraint by @lucemia in https://github.com/dependabot/dependabot-core/pull/8422
• Handle 403 Forbidden errors from PNPM by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8447
• Bump poetry from 1.6.1 to 1.7.1 in /python/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/8437
• Fix type issues detected in GitHub Actions ecosystem by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8472
• Bump pipenv from 2023.8.28 to 2023.11.15 in /python/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/8087
• fix individual PRs being created that should be in the group by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8264
• Bump the dev-dependencies group in /composer/helpers/v2 with 2 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/8462
• Bump the dev-dependencies group in /composer/helpers/v1 with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/8459
• Fix encoding changes when truncating PR descriptions by @mburumaxwell in https://github.com/dependabot/dependabot-core/pull/8077
• fix grouped update PRs are missing current -> updated version message by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8478
• Bump opentelemetry-sdk from 1.3.0 to 1.3.1 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/8342
• Bump the dev-dependencies group in /updater with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/8340
• Use a pipenv fork for now to fix tomlkit issues in pipenv by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8477
• Bump sorbet-runtime from 0.5.11094 to 0.5.11142 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/8461
• Ignore repo access issues while parsing actions dependencies by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8454
• Fix missing codecommit require by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8479
• Handle 401 Unauthorized errors from PNPM by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8476
• Bump type strictness by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8482
• Refactor error handling by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8486
• Enforce LF line endings on checkout by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8487
• Raise user error when Yarn is misconfigured by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8326
• Fix NPM yanked package detection by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8489
• Fix private registry authentication for NPM 8 or higher by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8453
• add support for refreshing a grouped security update by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8497
• Honor NuGet.config sources and search all build files for properties by @brettfo in https://github.com/dependabot/dependabot-core/pull/8498
• port Docker updater improvements from Azure DevOps by @brettfo in https://github.com/dependabot/dependabot-core/pull/8192
• Teach Dependabot how to present multi-directory PRs by @Nishnha in https://github.com/dependabot/dependabot-core/pull/8494
• fix regression in json gem by using an older version by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8509
• Choose closest Nuget.Config by @ryanbrandenburg in https://github.com/dependabot/dependabot-core/pull/8501
• Update contribution information by @carogalvin in https://github.com/dependabot/dependabot-core/pull/8507
• fix NuGet smoke test by properly locating Directory.Packages.props by @brettfo in https://github.com/dependabot/dependabot-core/pull/8511
• clean up smoke.yml by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8525
• Fix issue with parsing docker images with a tag in the _. format by @jpinz in https://github.com/dependabot/dependabot-core/pull/8500
• require correct FileFetcher by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8527
• Skip Maven snapshots repositories from versions checking by @slawekjaranowski in https://github.com/dependabot/dependabot-core/pull/8514
• don't attempt to update a package if no versions could be found by @brettfo in https://github.com/dependabot/dependabot-core/pull/8502
• Include the directory name in multi-directory PR summaries by @Nishnha in https://github.com/dependabot/dependabot-core/pull/8528
• Create feature flag for Grouped security updates by @ryanbrandenburg in https://github.com/dependabot/dependabot-core/pull/8529
• fix group update creation failure when a dependency is ignored by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8535
• properly resolve nuget search query when the api is versioned by @brettfo in https://github.com/dependabot/dependabot-core/pull/8534
• only run suites that have changes by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8536
• Skip Maven snapshots repositories from versions checking - fix 2 by @slawekjaranowski in https://github.com/dependabot/dependabot-core/pull/8542
• Bump golang from 1.21.4-bookworm to 1.21.5-bookworm in /go_modules by @TomSellers in https://github.com/dependabot/dependabot-core/pull/8548
• Use upstream pipenv again by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8547
• Don't escape dependency names in tarball URLs since it doesn't always work by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8546
• dynamically discover smoke tests by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8551
• improvements to querying nuget apis for versions by @brettfo in https://github.com/dependabot/dependabot-core/pull/8538
• Prioritize detection of sha suffixed tags over date tags by @mctofu in https://github.com/dependabot/dependabot-core/pull/8553
• Fix docker updates for tags with a v prefix by @mctofu in https://github.com/dependabot/dependabot-core/pull/8561
• v0.238.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/8448

New Contributors

• @dsuleimenov made their first contribution in https://github.com/dependabot/dependabot-core/pull/8423
• @ryanbrandenburg made their first contribution in https://github.com/dependabot/dependabot-core/pull/8501
• @jpinz made their first contribution in https://github.com/dependabot/dependabot-core/pull/8500
• @slawekjaranowski made their first contribution in https://github.com/dependabot/dependabot-core/pull/8514
• @TomSellers made their first contribution in https://github.com/dependabot/dependabot-core/pull/8548

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.237.0...v0.238.0

What's Changed

• Pass user info to Sentry by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8188
• Bump the dev-dependencies group in /updater with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/8282
• Bump psych from 5.1.0 to 5.1.1.1 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/8236
• Detect Python version from pip-compile generated files by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8280
• Bump the pnpm-dependencies group in /npm_and_yarn/helpers with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/8268
• Bump the npm-dependencies group in /npm_and_yarn/helpers with 2 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/8255
• Bump @babel/traverse from 7.23.0 to 7.23.2 in /npm_and_yarn/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/8235
• Handle null dependencies in package.json by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8212
• Set Python to always clone by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8266
• Add types to git workspace by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8285
• Add sigs for errors by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8097
• Explicitly add # typed: false for bin files by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8287
• Bump the dev-dependencies group in /composer/helpers/v2 with 2 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/8294
• Bump the dev-dependencies group in /updater with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/8291
• Bump the dev-dependencies group in /npm_and_yarn/helpers with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/8290
• Bump the dev-dependencies group in /composer/helpers/v1 with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/8256
• Revert python always clone registration by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8288
• Fixes for v234 release bugs by @LakSenanayaka in https://github.com/dependabot/dependabot-core/pull/8218
• Bump cython from 3.0.3 to 3.0.4 in /python/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/8252
• Bump pip from 23.2.1 to 23.3.1 in /python/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/8251
• Enable always clone for Python (take 2) by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8301
• Some more types for common by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8304
• Type LinkAndMentionSanitizer by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8298
• Sorbet types for source by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8272
• Type SharedHelpers by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8302
• Bump composer/composer from 2.5.8 to 2.6.5 in /composer/helpers/v2 by @dependabot in https://github.com/dependabot/dependabot-core/pull/8159
• Fix tests broken by racc release by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8313
• Raise expected errors when unsupported PNPM versions are used by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8147
• Fix illformed requirement error on "workspace:" dependencies by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8099
• Fix error when parsing version of some PNPM lockfiles by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8315
• Bump excon from 0.102.0 to 0.104.0 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/8292
• Bump faraday from 2.7.10 to 2.7.11 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/8059
• Replace pipenv lock with pipenv upgrade by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8312
• Type SharedHelpers more thoroughly by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8310
• Properly aggregate pipenv upgrade errors in Sentry by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8323
• Bump composer/composer from 1.10.26 to 1.10.27 in /composer/helpers/v1 by @dependabot in https://github.com/dependabot/dependabot-core/pull/8114
• build(deps): bump pNPM to 8.10.2 by @yeikel in https://github.com/dependabot/dependabot-core/pull/8289
• Add types for setup.rb by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8317
• Redact SCP-style git URIs in Sentry by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8306
• Catch more 404 PNPM fetch errors and raise them as user errors by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8324
• Simplify group updates by dep type test to fix CI by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8344
• Fix broken composer CI by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8345
• Bump the dev-dependencies group in /composer/helpers/v2 with 2 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/8343
• Add types for ExceptionSanitizer by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8314
• Fix common CI by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8347
• Fix more test failures by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8361
• add Dependabot config for Docker at /go_modules by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8373
• Bump golang from 1.21.3-bookworm to 1.21.4-bookworm in /go_modules by @dependabot in https://github.com/dependabot/dependabot-core/pull/8374
• Teach Updater to Invoke fetch files Based on Multi-Dir by @honeyankit in https://github.com/dependabot/dependabot-core/pull/8309
• Types for FileFetchers::Base by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8327
• Remove feature flag gating dependency removal by @mctofu in https://github.com/dependabot/dependabot-core/pull/8359
• Fix incorrect casing in some Dependabot PR titles by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8355
• handle updating manifests across multiple directories by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8331
• Fix one more and_call_original-related flaky spec by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8392
• Fix more Sorbet + and_call_original issues by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8394
• Enforce # typed: true where possible by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8385
• Strictly type file by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8384
• fix broken updates due to incorrect directory filtering by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8405
• Building python is fast now by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8407
• Strictly type UpdateConfig by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8403
• Strictly type DependencyGroup by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8404
• Fix PNPM issues with private registries by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8330
• Support updating Package.swift files without a lockfile by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8352
• Bump Bundler to 2.4.22 by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8224
• Refactor composer error handling and better handle potential errors by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8305
• Raise user errors about being unable to reach private git PNPM dependencies by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8332
• build(deps): bump Yarn to 3.7.0 by @yeikel in https://github.com/dependabot/dependabot-core/pull/8399
• build(deps): bump pNPM to 8.10.5 by @yeikel in https://github.com/dependabot/dependabot-core/pull/8370
• Respect poetry explicit source by @lucemia in https://github.com/dependabot/dependabot-core/pull/8371
• Update README.md by @sungam3r in https://github.com/dependabot/dependabot-core/pull/8387
• Strongly type PullRequestCreator::Message by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8410
• Strongly type SimpleInstrumentor by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8421
• Strongly type VersionFilters by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8409
• Clone submodules in CI workflows by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8429
• Clone submodules when building images manually by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8430
• Fix windows servercore Docker updates by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8442
• Fix the new alpine image versions for docker by @honeyankit in https://github.com/dependabot/dependabot-core/pull/8432
• Bundler native helpers should not run in a frozen context by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8419
• Properly capture and re-raise PublicSourceTimedOut errors in Bundler by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8420
• v0.237.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/8316

New Contributors

• @LakSenanayaka made their first contribution in https://github.com/dependabot/dependabot-core/pull/8218
• @lucemia made their first contribution in https://github.com/dependabot/dependabot-core/pull/8371
• @sungam3r made their first contribution in https://github.com/dependabot/dependabot-core/pull/8387

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.236.0...v0.237.0

What's Changed

• check types in the updater too by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8238
• Type ArtifactUpdater and VendorUpdater by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8215
• fix markdown header formatting by @brettfo in https://github.com/dependabot/dependabot-core/pull/8194
• Ignore specs when running Sorbet by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8240
• add types to the ApiClient by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8239
• Removed unignore command feature flag by @honeyankit in https://github.com/dependabot/dependabot-core/pull/8241
• add types to service by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8246
• report extra information if a repo can't be found by @brettfo in https://github.com/dependabot/dependabot-core/pull/8191
• Correct handling of updater directory in sorbet by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8247
• Clarify docker logs about ignoring a normally expected update candidate by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8262
• Add OpenTelemetry SDK by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8210
• Fix poetry regression by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8263
• stop processing if updated_deps is empty by @brettfo in https://github.com/dependabot/dependabot-core/pull/8193
• add types to some of the Dependabot::Config classes by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8261
• Recurse submodules when cloning npm and yarn repos by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/6718
• Unlock related Gemfile dependencies, but not everything that changed by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8267
• Add subdirectory value while preparing pyproject.toml if subdirectory key exists by @VictoryKon in https://github.com/dependabot/dependabot-core/pull/8067
• Avoid incorrectly downgrading top level deps by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8279
• Bump sorbet-runtime from 0.5.11026 to 0.5.11094 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/8281
• temporary fix for flaky test by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8284
• Sorbet types for logger and commit_signer by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8269
• Update autogenerated RBIs by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8271
• v0.236.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/8276

New Contributors

• @brettfo made their first contribution in https://github.com/dependabot/dependabot-core/pull/8194
• @VictoryKon made their first contribution in https://github.com/dependabot/dependabot-core/pull/8067

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.235.0...v0.236.0

What's Changed

• Improve detection of unsupported cargo toolchains by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8181
• build(deps): bump PNpm from 8.8.0 to 8.9.0 by @yeikel in https://github.com/dependabot/dependabot-core/pull/8175
• Expose a new directory_not_found user error by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8174
• Refactor shelling out in Python by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8167
• Fix false positive auth redaction by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8185
• remove unused code by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8171
• Fix multiple pip compile errors by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8189
• Fix poetry multiple requirement replacement in pyproject.toml by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8190
• Improve running updater tests by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8206
• build(deps): bump PNpm from 8.9.0 to 8.9.2 by @yeikel in https://github.com/dependabot/dependabot-core/pull/8202
• build(deps): bump yarn to 3.6.4 by @yeikel in https://github.com/dependabot/dependabot-core/pull/8151
• Mark .rbi as linguist-generated by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8209
• Fix version comments after quoted strings by @kurtmckee in https://github.com/dependabot/dependabot-core/pull/8127
• Get better info on an unknown error by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8211
• Raise user errors on invalid poetry manifest by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8207
• Fix sentry redaction issues by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8219
• Avoid trying to parse poetry.lock if pyproject.toml is invalid for Poetry by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8223
• Ignore dependencies from remote constraint files by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8222
• Go: pull from the official Docker image so that Dependabot bumps it by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8225
• Make composer CI pass consistently by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8226
• Ensure Grouped Security Updates are rebased correctly by @jurre in https://github.com/dependabot/dependabot-core/pull/8204
• Raise user error when not finding path dependencies in Python by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8172
• Support Python requirements with preceding "v" by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8229
• Add types to FileUpdaters::Base by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8214
• v0.235.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/8231

New Contributors

• @kurtmckee made their first contribution in https://github.com/dependabot/dependabot-core/pull/8127

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.234.0...v0.235.0

What's Changed

• build(deps): bump PNpm from 8.7.6 to 8.8.0 by @yeikel in https://github.com/dependabot/dependabot-core/pull/8101
• fix refreshing a grouped PR causes dependency duplication by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8150
• Bump the dev-dependencies group in /npm_and_yarn/helpers with 2 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/8157
• Bump the dev-dependencies group in /composer/helpers/v2 with 2 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/8158
• Bump the dev-dependencies group in /composer/helpers/v1 with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/8155
• Bump cython from 3.0.2 to 3.0.3 in /python/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/8153
• Suppress for Layout/MultilineMethodCallIndentation offense by @ydah in https://github.com/dependabot/dependabot-core/pull/8134
• Bump the dev-dependencies group in /updater with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/8163
• Bump the aws-sdk group in /updater with 2 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/8109
• Remove the leading v from Docker versions by @Nishnha in https://github.com/dependabot/dependabot-core/pull/8165
• grouped security updates by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8128
• Small dry-run.rb improvement to also handle file fetching errors by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8173
• include more info in grouped security update group name by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8178
• build(deps): bump Terraform from 1.5.6 to 1.6.1 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7985
• Ignore file dependencies when parsing requirement files by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8170
• v0.234.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/8180

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.233.0...v0.234.0

What's Changed

• Bump the dev-dependencies group in /updater with 2 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/8009
• Bump friendsofphp/php-cs-fixer from 3.23.0 to 3.26.1 in /composer/helpers/v2 by @dependabot in https://github.com/dependabot/dependabot-core/pull/7996
• Bump the npm-dependencies group in /npm_and_yarn/helpers with 2 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/7999
• Bump phpstan/phpstan from 1.10.30 to 1.10.34 in /composer/helpers/v2 by @dependabot in https://github.com/dependabot/dependabot-core/pull/8035
• Add sig to dependency injection containers by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8032
• Add types to clients by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8038
• fix: call 'split' on string-type object, not on version-type object by @fredrikaverpil in https://github.com/dependabot/dependabot-core/pull/8037
• Bump RUBY_VERSIONS to include 3.1.4 and 3.2.2 by @kjeldahl in https://github.com/dependabot/dependabot-core/pull/8041
• Bump phpstan/phpstan from 1.10.32 to 1.10.34 in /composer/helpers/v1 by @dependabot in https://github.com/dependabot/dependabot-core/pull/8036
• Upload spoom coverage report data by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8046
• Generate and upload spoom coverage report on main by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8047
• fix go1.21 not a toolchain by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8044
• build(deps): bump go from 1.21.0 to 1.21.1 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7986
• Update Sorbet from 0.5.11011 to 0.5.11026 by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8064
• raise if the reference already exists by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8043
• 💅 Use defaults instead of comments for documentation by @landongrindheim in https://github.com/dependabot/dependabot-core/pull/8069
• Bump actions/checkout from 3 to 4 by @dependabot in https://github.com/dependabot/dependabot-core/pull/7997
• Track unknown errors by @Nishnha in https://github.com/dependabot/dependabot-core/pull/7534
• Bump pipenv from 2022.4.8 to 2023.8.28 in /python/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/7922
• Removed logging of commands from Subprocess failure by @honeyankit in https://github.com/dependabot/dependabot-core/pull/8082
• Use new blessed method for installing NodeJS by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8093
• Respect style of each action when mixed styles are used by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8068
• fix comment typo by @mburumaxwell in https://github.com/dependabot/dependabot-core/pull/8076
• Fix Swift 5.9 package manifest analyze error by @soumyamahunt in https://github.com/dependabot/dependabot-core/pull/8073
• Dockerfile - Add infrequently layers earlier by @tvalenta in https://github.com/dependabot/dependabot-core/pull/8031
• Fix warnings when running tests in common by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8100
• Fix some github actions version comments not getting updated by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8098
• build(deps): bump PNpm from 8.6.12 to 8.7.6 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7899
• Add sigs for utils by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8096
• Properly infer .npmrc for PNPM by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8094
• Fix CI by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8105
• Improve running specs by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8092
• Remove another git warning during specs by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8113
• fix dependency duplication across multiple groups by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8106
• fix semver segments errors due to invalid Versions by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8124
• Add sigs for some version.rb by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8049
• Remove grouped updates feature flags by @jurre in https://github.com/dependabot/dependabot-core/pull/8123
• Raise unsupported Python version error as an expected error by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8104
• Fix a typo by @ydah in https://github.com/dependabot/dependabot-core/pull/8133
• Fix some flaky test failures by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8140
• Catch up test lockfile with parser 3.2.2.4 release by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8142
• Parallelize tests on all ecosystems, except for Pub by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/8139
• fix completely ignored dependencies querying for updates by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8143
• Added record update job error api back to capture unknown errors by @honeyankit in https://github.com/dependabot/dependabot-core/pull/8144
• v0.233.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/8034

New Contributors

• @fredrikaverpil made their first contribution in https://github.com/dependabot/dependabot-core/pull/8037
• @kjeldahl made their first contribution in https://github.com/dependabot/dependabot-core/pull/8041
• @soumyamahunt made their first contribution in https://github.com/dependabot/dependabot-core/pull/8073
• @ydah made their first contribution in https://github.com/dependabot/dependabot-core/pull/8133

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.232.0...v0.233.0

What's Changed

• Autobump to typed: true using spoom by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8021
• fix helpful error message to have PR number by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8024
• Actions: skip unsupported uses strings by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8026
• fix docker-dev-shell on ARM by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8029
• Add back the Docker::Version.correct? method by @Nishnha in https://github.com/dependabot/dependabot-core/pull/8030

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.231.0...v0.232.0

What's Changed

• Ensure Docker versions are valid Dependabot::Versions by @Nishnha in https://github.com/dependabot/dependabot-core/pull/7984
• Use rstrip to trim trailing newlines by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/7991
• Set Layout/DotPosition to leading by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/7789
• Add .git-blame-ignore-revs-file and ignore style change by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/7992
• Bump the dev-dependencies group in /npm_and_yarn/helpers with 3 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/8000
• Add sorbet dependencies by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8007
• Update semver by @jurre in https://github.com/dependabot/dependabot-core/pull/8005
• Make sorbet and tapioca optional by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8014
• Initialize sorbet by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8012
• Add typed: false sigil by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8015
• Add rubocop-sorbet by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8016
• Add sorbet workflow by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8017
• raise exceptions when PR creation fails by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/8013
• Add Sorbet VSCode extension by @JamieMagee in https://github.com/dependabot/dependabot-core/pull/8018
• v0.231.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/8019

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.230.0...v0.231.0

What's Changed

• Bump the aws-sdk group in /updater with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/7852
• Use python3/pip3 so we don't have to have python/pip symlinks by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7927
• Bump cython from 3.0.0 to 3.0.2 in /python/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/7905
• Use pre-compiled Python from official Docker image by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7934
• build(deps): bump Yarn to 3.6.3 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7908
• build(deps): bump npm from 9.5.1 to 9.6.5 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7811
• Bump excon from 0.100.0 to 0.102.0 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/7904
• Move copying the other pythons to the end of the Dockerfile by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7941
• Python helper removes bytecode files by @tvalenta in https://github.com/dependabot/dependabot-core/pull/7944
• Stop installing apt packages for compiling Python by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7943
• Make building the default python concurrent rather than sequential by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7949
• Bump RUBY_VERSIONS to include 3.0.6 by @jade-aronson in https://github.com/dependabot/dependabot-core/pull/7948
• Replace gzip with zstd for speed + size benefits by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7950
• Gradle: fix comparison of the prefix version range by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/7975
• Bump tibdex/github-app-token from 1.8.0 to 1.8.2 by @dependabot in https://github.com/dependabot/dependabot-core/pull/7957
• go: fix ambiguous import when using a module without a dot by @vincentbernat in https://github.com/dependabot/dependabot-core/pull/7979
• Maven: fix classifier being part of the dependency name by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/7980
• v0.230.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/7982

New Contributors

• @jade-aronson made their first contribution in https://github.com/dependabot/dependabot-core/pull/7948
• @vincentbernat made their first contribution in https://github.com/dependabot/dependabot-core/pull/7979

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.229.0...v0.230.0

What's Changed

• Target latest Python versions - 3.11.5, 3.10.13, 3.9.18, 3.8.18 by @phillipuniverse in https://github.com/dependabot/dependabot-core/pull/7914
• Bump phpstan/phpstan from 1.10.30 to 1.10.32 in /composer/helpers/v1 by @dependabot in https://github.com/dependabot/dependabot-core/pull/7901
• build(deps): bump terraform from 1.5.5 to 1.5.6 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7892
• fix: duplicate response body before mutating it by @yeikel in https://github.com/dependabot/dependabot-core/pull/7926
• v0.229.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/7929

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.228.0...v0.229.0

What's Changed

• Bump rubocop from 1.50.2 to 1.56.0 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/7788
• Revert "Don't depend on flake8 at runtime (#6830)" by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7836
• When trying to parse exact package.json versions, ignore parse errors by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7844
• Bump pip from 23.2.0 to 23.2.1 in /python/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/7847
• Bump pip-tools from 7.2.0 to 7.3.0 in /python/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/7845
• Bump flake8 from 5.0.4 to 6.1.0 in /python/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/7846
• Add support for Poetry 1.5 lockfiles by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7834
• Simplify development images by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7843
• Fix Python runtime errors when instrumenting versions by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7858
• fix ungrouped PRs being created due to errors during grouped update by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/7829
• Regenerate some lockfiles with Poetry 1.5 by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7862
• Fix encoding option value for gitlab commit creation by @andrcuns in https://github.com/dependabot/dependabot-core/pull/7850
• Fix Python version switched from exact to tilde version by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/6702
• Pub smallest update by @sigurdm in https://github.com/dependabot/dependabot-core/pull/7446
• Bump underlying ubuntu to 22.04 LTS by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/5030
• Update poetry version to 1.6.1 by @noorul in https://github.com/dependabot/dependabot-core/pull/7866
• Add yamllint to linters by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7818
• Bump the dev-dependencies group in /composer/helpers/v2 with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/7870
• python: Handle explicit PyPI source in pyproject.toml by @torarvid in https://github.com/dependabot/dependabot-core/pull/7499
• Pass exact version being run when replacing python requirement in pyproject.toml by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7857
• Bump the dev-dependencies group in /composer/helpers/v1 with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/7873
• Bump the dev-dependencies group in /npm_and_yarn/helpers with 2 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/7871
• Bump rubocop from 1.56.0 to 1.56.1 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/7872
• Don't double-install packages required for building Python. by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7876
• Use dependency-type and semver grouping for dev dependencies by @jurre in https://github.com/dependabot/dependabot-core/pull/7881
• Bubble up expected pub security update errors to the user by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7880
• Fix missed error matching on composer by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7879
• Report gradle security update errors when dependency not found in repository by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7878
• Fix typo by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7883
• fix edge cases during semver grouping creating single PRs erroneously by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/7867
• Split system packages into two sections: required to build python vs required to build users' python packages by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7877
• Parallelize tests by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/6590
• fixes toolchain directive getting into go.mod by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/7884
• Install libkrb5-dev package in python Dockerfile by @yashvardhannanavati in https://github.com/dependabot/dependabot-core/pull/7604
• v0.228.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/7893

New Contributors

• @torarvid made their first contribution in https://github.com/dependabot/dependabot-core/pull/7499
• @yashvardhannanavati made their first contribution in https://github.com/dependabot/dependabot-core/pull/7604

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.227.0...v0.228.0

What's Changed

• Don't copy .rubocop.yml file to updater's home folder by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7797
• Remove mount of folder that does not exist by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7799
• Let RuboCop inspect files in ecosystem bin folders by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7798
• Explicitly require dependabot/utils before usage by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7800
• Make grouped updates table more readable by @jurre in https://github.com/dependabot/dependabot-core/pull/7796
• Reduce Swift image size by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7812
• Don't copy ruby version file into the updater image by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7802
• Bump rubocop-performance from 1.18.0 to 1.19.0 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/7809
• Bump the dev-dependencies group in /composer/helpers/v2 with 2 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/7814
• Bump the dev-dependencies group in /npm_and_yarn/helpers with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/7807
• Bump the dev-dependencies group in /composer/helpers/v1 with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/7815
• Bump nokogiri from 1.15.3 to 1.15.4 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/7810
• Add apt lists clean up to python Dockerfile by @tvalenta in https://github.com/dependabot/dependabot-core/pull/7803
• Restore a more standard RuboCop configuration layout by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7801
• Do not attempt to group git dependencies as semver by @jurre in https://github.com/dependabot/dependabot-core/pull/7817
• Drop python 3.6 by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7610
• Remove 3.6 guard when setting poetry config experimental.system-git-client by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7614
• Stop manually installing python by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7613
• Update pip requirement from <23.2.0,>=21.3.1 to >=21.3.1,<23.3.0 in /python/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/7570
• Stop explicitly specifying python patch versions by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7615
• Drop python 3.7 by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7702
• Pin poetry to specific version by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7716
• Upgrade pip-tools to 7.2.0 by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7711
• Fix typo in no matching dependencies for group error by @jurre in https://github.com/dependabot/dependabot-core/pull/7820
• Refactor poetry logic to parse subdependency types by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7826
• pip no longer requires a range by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7714
• Update Go to 1.21 by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/7823
• Revert "Don't copy ruby version file into the updater image (#7802)" by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7835
• Python 3.6 drop follow up by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7831
• Fix yanked library problems in Poetry not detected when lockfile is present by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7832
• Remove code handling pyproject.lock files by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7833
• Mount .ruby-version in the dev image instead of copying it by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7841
• Support security updates for NPM with exact requirements and no lockfile by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7819
• Simplify handling all versions metadata on NPM by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7821
• v0.227.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/7824
• Debug issues with docker prereleases by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7842

New Contributors

• @tvalenta made their first contribution in https://github.com/dependabot/dependabot-core/pull/7803

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.226.0...v0.227.0

What's Changed

• Stop checking deprecated bugtrack_url by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7681
• Fix typo in method name in Swift update checker by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7683
• Bump Bundler to 2.4.17 by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7684
• Fix Github Actions dependency parsing edge case by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7494
• Ignore tags not matching prefix, when workflow is pinned to SHAs by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7430
• Rename conf_files dir to pip_conf_files to reduce ambiguity by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7690
• Update poetry test of oldest supported python version to 3.8 by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7691
• Test that unsupported Python versions raise the expected error by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7692
• Add sane limit to PR description limit for Bitbucket cloud by @stefangr in https://github.com/dependabot/dependabot-core/pull/7693
• [Grouped Updates] Remove current handling for separate ungrouped version checks from the experiment by @brrygrdn in https://github.com/dependabot/dependabot-core/pull/7689
• Delete deprecated host-environment-markers key by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7698
• Fixup pip_version_resolver specs by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7699
• Move the Pipfile/Pipfile.lock fixtures to a clearly named folder by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7700
• Update pip-tools requirement from <=6.13.0,>=6.4.0 to >=6.4.0,<=6.14.0 in /python/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/7509
• Bump composer/composer from 2.5.5 to 2.5.8 in /composer/helpers/v2 by @dependabot in https://github.com/dependabot/dependabot-core/pull/7420
• Make python_major_minor a one-liner by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7705
• Use dockerignore rules that play better with recent docker versions by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7713
• Give better error message when fixture project is missing a file by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7717
• Document why we pin wheel by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7719
• Bump cython from 0.29.34 to 3.0.0 in /python/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/7586
• Set file encoding in GitLab commits by @mikaellanger in https://github.com/dependabot/dependabot-core/pull/7381
• Fetching GitLab repo contents correctly uses the ref argument by @maciej-gol in https://github.com/dependabot/dependabot-core/pull/7351
• Suppress error output when evaluating invalid Ruby during tests by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7706
• Fix fetching files in symlinked folders by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7411
• Enable --verbose when running specs by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7708
• Bump the dev-dependencies group in /npm_and_yarn/helpers with 4 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/7723
• Bump jason from 1.4.0 to 1.4.1 in /hex/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/7538
• Bump aws-sdk-ecr from 1.58.0 to 1.63.0 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/7667
• Bump excon from 0.99.0 to 0.100.0 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/7485
• Bump parser from 3.2.2.0 to 3.2.2.3 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/7425
• Bump rubocop-performance from 1.17.1 to 1.18.0 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/7727
• Bump faraday-retry from 2.1.0 to 2.2.0 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/7726
• Bump the pnpm-dependencies group in /npm_and_yarn/helpers with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/7725
• Group Dependabot aws-sdk-* PRs by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7732
• Bump the aws-sdk group in /updater with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/7733
• Bump vcr from 6.1.0 to 6.2.0 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/7729
• Bump commonmarker from 0.23.9 to 0.23.10 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/7730
• Bump the dev-dependencies group in /composer/helpers/v2 with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/7745
• Bump the dev-dependencies group in /composer/helpers/v1 with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/7747
• Bump the dev-dependencies group in /npm_and_yarn/helpers with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/7746
• Support SCP-style URIs in Swift updater by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7722
• Delete unused test fixture by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7737
• Pin test to legacy resolver to force desired error message by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7738
• build(deps): bump go from 1.20.6 to 1.20.7 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7754
• build(deps): bump regclient from 0.5.0 to 0.5.1 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7752
• Delete unused method error_certainly_bad_python_version? by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7739
• Don't cancel full CI runs on main by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7757
• build(deps): bump Yarn to 3.6.1 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7755
• More swift requirement parsing fixes by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7760
• Remove leftover setting that no longer exists by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7762
• Remove gitignore entry that does not exist by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7761
• fix PR unable to create with grouped updates by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/7753
• Replace deprecated pipenv lock with pipenv requirements by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7764
• build(deps): bump pnpm from 8.6.7 to 8.6.12 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7751
• Update docker_registry2 by @NautiluX in https://github.com/dependabot/dependabot-core/pull/7658
• Bump faraday from 2.7.4 to 2.7.10 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/7735
• Unify memoization by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7772
• Remove duplicated line in maven file fetcher by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7770
• Fix incorrect memoizations by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7773
• Remove leftover puts debugging message by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7779
• Fixing Yarn1 erroring with failed to replace env by @honeyankit in https://github.com/dependabot/dependabot-core/pull/7767
• fetch_file_if_present should ignore all "Not Found" errors by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7774
• Add missing require by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7781
• build(deps): bump terraform from 1.5.4 to 1.5.5 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7780
• Simplify Bundler native helper runners by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7785
• implement semver grouping and individual PRs by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/7776
• Update ignore condition table by @jurre in https://github.com/dependabot/dependabot-core/pull/7787
• Stop pinning wheel by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7784
• Stop coercing Pipfile source URL's to have trailing slashes by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7783
• Fix private source authentication error message by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7786
• Add name key to sources in Pipfiles by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7744
• Refactor preparing package.json files by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7245
• Copy clone logic in dry-run.rb from the updater by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7791
• Restore version schema with and <build_number> with words between them by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7687
• Fix missing cache prunes by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7295
• Make sure Bundler group vendoring smoke tests get actually run, and pass by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7794
• Remove CodeQL warning by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7792
• v0.226.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/7704

New Contributors

• @mikaellanger made their first contribution in https://github.com/dependabot/dependabot-core/pull/7381
• @maciej-gol made their first contribution in https://github.com/dependabot/dependabot-core/pull/7351

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.225.0...v0.226.0

What's Changed

• Fix parsing Swift packages with spaces before closing parenthesis by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7660
• Update devcontainer.json to include swift by @dwc0011 in https://github.com/dependabot/dependabot-core/pull/7653
• [Grouped Updates] Implement experimental Semantic Versioning rule by @brrygrdn in https://github.com/dependabot/dependabot-core/pull/7581
• Make sure Swift lockfile updates respect ignore conditions by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7669
• Normalize Swift package names by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7648
• Show ignore conditions in a request body by @honeyankit in https://github.com/dependabot/dependabot-core/pull/7654
• Remove manual exclusion of specific packages by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7676
• Fix some swift updates failing when directory is configured by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7674
• build(deps): bump terraform from 1.5.3 to 1.5.4 by @HorizonNet in https://github.com/dependabot/dependabot-core/pull/7657
• v0.225.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/7655

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.224.0...v0.225.0

What's Changed

• fix Gemfile not updating for peer dependencies by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/7621
• Delete leftover build script by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7611
• Add option to control PR description max length + set reasonable defaults for each platform by @dwc0011 in https://github.com/dependabot/dependabot-core/pull/7487
• Point at the correct Dockerfile for python by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7609
• Instrument Python version metric by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7617
• Metadata fetching: Don't fallback to git if not installed by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/6409
• build(deps): bump PNPM to 8.6.7 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7506
• Update dependabot.yml to capture by package manager by @abdulapopoola in https://github.com/dependabot/dependabot-core/pull/7630
• Bump the dev-dependencies group in /composer/helpers/v2 with 2 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/7622
• Bump the dev-dependencies group in /composer/helpers/v1 with 1 update by @dependabot in https://github.com/dependabot/dependabot-core/pull/7623
• Bump the npm-dependencies group in /npm_and_yarn/helpers with 2 updates by @dependabot in https://github.com/dependabot/dependabot-core/pull/7633
• Fix parsing swift ranges with spaces by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7637
• Fix typo by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7636
• Revert sanitization of package name by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7246
• Fix CI by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7650
• Implement security update support for Swift by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7638
• cd: correctly find workspace.dependencies-declared dependencies and their Cargo.toml by @ggawryal in https://github.com/dependabot/dependabot-core/pull/7649
• fix: correctly find workspace.dependencies-declared dependencies and their Cargo.toml by @poliorcetics in https://github.com/dependabot/dependabot-core/pull/5865
• Bump licensed from 4.3.1 to 4.4.0 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/7596
• v0.224.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/7631

New Contributors

• @ggawryal made their first contribution in https://github.com/dependabot/dependabot-core/pull/7649

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.223.0...v0.224.0

What's Changed

• [Grouped Updates] Add support for grouping by dependency type by @brrygrdn in https://github.com/dependabot/dependabot-core/pull/7620
• Allow gem does not exist in RubyGems case by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7626
• Fix CI by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7628
• v0.223.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/7627

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.222.0...v0.223.0

What's Changed

• build(deps): bump Terraform from 1.5.2 to 1.5.3 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7558
• build(deps): bump go from 1.20.4 to 1.20.6 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7507
• Update README.md by @jmartens in https://github.com/dependabot/dependabot-core/pull/7491
• buid(deps): bump Yarn from 3.5.0 to 3.6.0 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7329
• [Grouped Updates] Refactor the DependencyGroupEngine into an object, Improved logging for empty groups by @brrygrdn in https://github.com/dependabot/dependabot-core/pull/7548
• [Grouped Updates] Don't instantiate any groups without the feature flag by @brrygrdn in https://github.com/dependabot/dependabot-core/pull/7557
• build(deps): bump REGCTL from 0.4.8 to 0.5.0 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7505
• Detect interpolation in terragrunt sources and skip if present by @dwc0011 in https://github.com/dependabot/dependabot-core/pull/7502
• Stub registry request that's not captured by a VCR by @Nishnha in https://github.com/dependabot/dependabot-core/pull/7306
• Prevent links in PR description that link to redirect.redirect.github.com by @stefangr in https://github.com/dependabot/dependabot-core/pull/7190
• Use the new base image by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7565
• Allow GitCommitChecker to check subdependencies too by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7464
• Mount updater/bin into the docker dev shell by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7567
• Match the smoke test invocation of CLI/proxy by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7576
• Freeze mutable constants by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/5966
• fix flaky test that fails when new versions are released by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/7580
• Support split stderr/stdout when running shell commands by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7496
• Only add "v" prefix for the helper path by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7582
• Turn composer version into a metric by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7323
• ignore peer dependencies that are in a grouped update group by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/7561
• Generate PRs on Sundays weekly by @abdulapopoola in https://github.com/dependabot/dependabot-core/pull/7585
• Upgrade Node.js to active LTS version (18.x) by @christianvuerings in https://github.com/dependabot/dependabot-core/pull/7348
• Cancel previous jobs in the same branch when repushing by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7590
• Don't try to diff if there's nothing to diff by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7591
• Make smoke tests cache optional by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7592
• Aggressively group prod and dev dependencies for NPM by @abdulapopoola in https://github.com/dependabot/dependabot-core/pull/7594
• Update docker_registry2 by @NautiluX in https://github.com/dependabot/dependabot-core/pull/7578
• Revert "Update docker_registry2" by @jurre in https://github.com/dependabot/dependabot-core/pull/7601
• feat(maven): use groupId and artifactId for the dependency name by @yeikel in https://github.com/dependabot/dependabot-core/pull/7146
• Rename python_version -> python_version_file for clarity by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7616
• Group :dependabot: dev-dep PR's for PHP native helpers by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7619
• Support for Swift package manager by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7525
• v0.222.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/7625

New Contributors

• @christianvuerings made their first contribution in https://github.com/dependabot/dependabot-core/pull/7348
• @NautiluX made their first contribution in https://github.com/dependabot/dependabot-core/pull/7578

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.221.0...v0.222.0

What's Changed

• v0.220.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/7428
• Target latest Python versions - 3.11.4, 3.10.12, 3.9.17, 3.8.17, 3.7.17 by @phillipuniverse in https://github.com/dependabot/dependabot-core/pull/7412
• exclude patterns for grouped updates by @Nishnha in https://github.com/dependabot/dependabot-core/pull/7402
• Add a newline after the group intro by @Nishnha in https://github.com/dependabot/dependabot-core/pull/7401
• Use ruby:3.1.4-bullseye by @Nishnha in https://github.com/dependabot/dependabot-core/pull/7442
• Fix edge case when updating Actions with mixed versions by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7410
• [Grouped Updates] Cleaner management of the update dependency list by @brrygrdn in https://github.com/dependabot/dependabot-core/pull/7414
• [Grouped Updates] The VendorUpdater class watermarks DependencyFile objects it creates by @brrygrdn in https://github.com/dependabot/dependabot-core/pull/7433
• [Updater] Extract creation of new group Pull Requests into a discrete class by @brrygrdn in https://github.com/dependabot/dependabot-core/pull/7354
• [Updater] Avoid mis-representing a Dependency Group as a Dependency in error handling by @brrygrdn in https://github.com/dependabot/dependabot-core/pull/7359
• build(deps): bump Terraform to 1.5.0 by @HorizonNet in https://github.com/dependabot/dependabot-core/pull/7439
• Remove pnpm experiment flag by @mctofu in https://github.com/dependabot/dependabot-core/pull/7453
• Roll pub. Use dart 3 for running helpers. by @sigurdm in https://github.com/dependabot/dependabot-core/pull/7417
• Look in parent directories for nuget.config files by @jmarolf in https://github.com/dependabot/dependabot-core/pull/7342
• Remove persistent_gems_after_clean workaround by @jurre in https://github.com/dependabot/dependabot-core/pull/7296
• Add DEPENDABOT environment variable for users by @shu-mutou in https://github.com/dependabot/dependabot-core/pull/7407
• Bump debug from 1.7.2 to 1.8.0 in /updater by @dependabot in https://github.com/dependabot/dependabot-core/pull/7316
• Add workspace experiment to maintain state between updates and capture success/failure of each by @bdragon in https://github.com/dependabot/dependabot-core/pull/6693
• Add missing final EOL by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7456
• Add sanitization to BranchNamer::DependencyGroupStrategy by @TomNaessens in https://github.com/dependabot/dependabot-core/pull/7452
• Remove duplicated ENV by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7455
• Instantiate less dependencies by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7459
• Fix actions updates when inconsistent casing is used by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7462
• Revert "Pin CodeQL version (#7275)" by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7465
• Update Bundler to 2.4.14 by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7429
• Configure git with ENV by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7467
• Update ecosystem READMEs with recommended setup by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7472
• Fix flaky spec by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7474
• NPM: fix GitHub registry not working when path is specified by @jakecoffman in https://github.com/dependabot/dependabot-core/pull/7468
• Remove simplecov by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7473
• [Grouped Updates] Avoid passing non-manifest file changes between group updates by @brrygrdn in https://github.com/dependabot/dependabot-core/pull/7404
• build(deps): bump PNPM from 8.3.1 to 8.6.4 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7330
• Add support for Directory.Packages.props file as entrypoint by @TobiasLaving in https://github.com/dependabot/dependabot-core/pull/7086
• Add smoke tests for go, npm and bundler+vendoring by @brrygrdn in https://github.com/dependabot/dependabot-core/pull/7486
• Use table summary for large groups of dependencies by @bdragon in https://github.com/dependabot/dependabot-core/pull/7463
• build(deps): bump Terraform from 1.5.0 to 1.5.2 by @yeikel in https://github.com/dependabot/dependabot-core/pull/7493
• Stop recording the ecosystem param by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7492
• Only record ecosystem versions when flag set by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7516
• Update the hex.pm/orgs/dependabot token by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7532
• Stop exposing real account tokens in plaintext by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7533
• Switch to using the new record_ecosystem_versions endpoint. by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7517
• Fix CodeQL warning by @deivid-rodriguez in https://github.com/dependabot/dependabot-core/pull/7531
• Use the new inputs API by @jeffwidman in https://github.com/dependabot/dependabot-core/pull/7550
• v0.221.0 by @dependabot-core-action-automation in https://github.com/dependabot/dependabot-core/pull/7554

New Contributors

• @jmarolf made their first contribution in https://github.com/dependabot/dependabot-core/pull/7342
• @shu-mutou made their first contribution in https://github.com/dependabot/dependabot-core/pull/7407
• @TobiasLaving made their first contribution in https://github.com/dependabot/dependabot-core/pull/7086

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.220.0...v0.221.0

What's Changed

• Update pip-tools requirement from <=6.12.3,>=6.4.0 to >=6.4.0,<=6.13.0 in /python/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/7034
• Update poetry requirement from <1.4.0,>=1.1.15 to >=1.1.15,<1.6.0 in /python/helpers by @dependabot in https://github.com/dependabot/dependabot-core/pull/7350
• Ensure updated dependencies are correctly included when building dependency change instance by @bdragon in https://github.com/dependabot/dependabot-core/pull/7358
• [Grouped Updates] Generate deterministic branch names based on content by @brrygrdn in https://github.com/dependabot/dependabot-core/pull/7365
• Allow parsing symbols, time and date values in workflow yaml by @jurre in https://github.com/dependabot/dependabot-core/pull/7400

Full Changelog: https://github.com/dependabot/dependabot-core/compare/v0.219.0...v0.220.0