What's Changed
- Ignore commented-out _authToken lines in .npmrc by @alhss in #16550
- Fix wording in Docker and updater specs by @JamieMagee in #16633
- bun: scope workspace-only dependency installs/updates with --filter by @v-sachin-sandhu in #16543
- Skip public PyPI library lookup when a python_index credential has replaces-base by @v-thavaahariharangit with @Copilot in #16619
- Classify pnpm errors that currently surface as unknown errors by @v-sachin-sandhu in #16643
- Add support for apm lockfile regeneration and pinning deps to commit sha by @v-abhishekbhaskar in #16514
- update Python 3.14 and 3.13 to address eMudhra GHSA-6q48-6c7w-9gw2 by @ABruihler in #16652
- Enable Sorbet checking for Cargo specs by @JamieMagee in #16631
- Enable Sorbet checking for Rust toolchain specs by @JamieMagee in #16630
- [Part 3 of 3] Handle unreadable pnpm versions, release-age errors and old lockfiles in monorepos by @v-sachin-sandhu in #16521
- update uv to 0.13.5 to address eMudhra GHSA-hq85-5cpj-mr62 by @ABruihler in #16651
- github_actions: support new gh-actions-lock findings and ignore local actions by @nodeselector in #16649
- github_actions: update declarations in files with CRLF line endings by @v-sachin-sandhu in #16647
- go_modules: run go list -m all after workspace updates by @v-sachin-sandhu in #16650
- bun: classify registry and workspace failures and tolerate bare JSON … by @v-sachin-sandhu in #16644
- Docker: memoize latest_tag and log when no tag matches latest by @v-thavaahariharangit with @Copilot in #16665
- npm_and_yarn: scope Yarn conflicting dependencies to the instance being updated by @v-thavaahariharangit with @Copilot in #16664
- Fix Yarn lockfile matching for ranges containing spaces by @jtlopezdev in #16367
- Enable Sorbet checking for Terraform specs by @JamieMagee in #16653
- Enable Sorbet checking for OpenTofu specs by @JamieMagee in #16654
- gradle: recognize trailing-lambda repository declarations by @JohNan in #16677
- Fix Python requirement pairing when a package is declared more than once by @v-kbukum1 in #16681
- Recognize PHP out-of-memory errors that follow mmap failures in composer by @v-kbukum1 in #16691
- nix: stop treating a deleted branch's null SHA as the latest release by @v-sachin-sandhu in #16674
- Report Bundler checksum mismatches as a clear user error by @v-kbukum1 in #16689
- Fix yarn cacheFolder lookup by @tamayika in #16641
- Gradle: avoid infinite recursion on cyclic included builds by @v-kbukum1 in #16685
- [NoChangeError] npm_and_yarn: parse a dependency named like its own npm project by @v-sachin-sandhu in #16693
- bazel: don't crash on non-version .bazelversion values or unresolved constants by @v-sachin-sandhu in #16659
- Don't report removed dependencies as failed group security updates by @v-thavaahariharangit in #16708
- Don't report semver-rejected dependencies as failed group security updates by @v-thavaahariharangit in #16728
- helm: don't raise on versions with more than one underscore-separated group by @v-sachin-sandhu in #16661
- Enable Sorbet checking for APM specs by @JamieMagee in #16710
- Enable Sorbet checking for GitHub Actions specs by @JamieMagee in #16720
- Enable Sorbet checking for Helm specs by @JamieMagee in #16723
- uv: allow lockfile-only updates for transitive dependencies by @v-kbukum1 in #16686
- v0.402.0 by @dependabot-core-action-automation[bot] in #16705
New Contributors
Full Changelog: v0.401.0...v0.402.0