GitHub Release: dependabot/dependabot-core v0.396.0 (14.09.2026)

$ git clone https://github.com/dependabot/dependabot-core.git Clone

What's Changed

• Remove fully rolled out feature flags by


• build(deps): bump hcl2json to v0.6.9 by


• build(deps): bump PowerShell to 7.6.5 by


• build(deps): bump Yarn to 4.18.0 by


• build(deps): bump git-shim to v1.5.0 by


• Add shared delivery for unavailable cooldown warnings by


• Bump library/golang in /go_modules by


• Bump the all-actions group across 1 directory with 2 updates by


• Give the security refresh operation a directory to work with by


• Bump composer/composer from 2.10.2 to 2.10.3 in /composer/helpers/v2 in the prod-dependencies group across 1 directory by


• Bump regclient/regctl in /docker by


• Add a typed package.json reader by


• Use typed package.json reads in npm and Yarn by


• Use typed package.json reads in Bun by


• Separate grouped security update diagnosis from reporting by


• Fix Pipenv graphing for local path dependencies by


• julia: support Pkg 1.13's registry_info and pin the image to Julia 1.13 by


• Use typed requirements helper results in Python and UV by


• docker: fix repeated image update and regex metacharacter matching by


• Surface unavailable cooldown dates in package finders by


• Skip uv dependencies pinned to a source that can never be updated by


• Use typed npm lockfile lookup results by


• Decode pnpm lockfile helper output into typed records by


• Use typed npm JSON lockfile records by


• Log filtered package versions by


• Use typed Yarn lockfile records and relationships by


• Use typed Bun lockfile records and graph reads by


• Bump baseline-browser-mapping from 2.9.6 to 2.11.21 in /npm_and_yarn/helpers by


• v0.396.0 by @dependabot-core-action-automation[bot] in made their first contribution in made their first contribution in
  Vollständiger Original-Bericht

  Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf github.com.

  ↗ Original-Artikel auf github.com lesen