What's Changed
- Bump pacote from 21.3.1 to 21.5.1 in /npm_and_yarn/helpers by @dependabot[bot] in #16411
- Report conflicting dependencies for security updates by @v-thavaahariharangit with @Copilot in #16335
- Fix vulnerable Yarn alias test fixture by @v-thavaahariharangit with @Copilot in #16414
- Bump the dev-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #16403
- Use typed UV lockfile records in parsing and resolution by @JamieMagee in #16348
- Add typed Composer manifest and lockfile readers by @JamieMagee in #16349
- Use typed Composer repository and path records by @JamieMagee in #16350
- Add typed Pipfile and Pipfile.lock readers by @JamieMagee in #16351
- Revert "Report conflicting dependencies for security updates" by @v-robaiken in #16418
- Keep typed pyproject documents in the pip resolver by @JamieMagee in #16352
- Respect npm engine version during updates by @v-thavaahariharangit in #16415
- Bump Microsoft.Extensions.FileSystemGlobbing from 10.0.11 to 10.0.12 by @dependabot[bot] in #16283
- fix(maven): preserve POM formatting during dependencyManagement injec… by @shikhahere in #16206
- Bump poetry from 2.4.3 to 2.5.1 in /python/helpers in the poetry group by @dependabot[bot] in #16404
- Bump Microsoft.NET.Test.Sdk from 18.9.0 to 18.10.1 by @dependabot[bot] in #16409
- Bump flake8 from 7.3.0 to 7.4.1 in /python/helpers in the common group across 1 directory by @dependabot[bot] in #16402
- Parse Python setup helper results into typed records by @JamieMagee in #16421
- Bump ip-address from 10.4.0 to 10.7.2 in /bun/helpers by @dependabot[bot] in #16419
- Parse Bundler version resolution results into typed records by @JamieMagee in #16422
- Scrub credentials from index URLs emitted into compiled requirement files by @SashaMIT in #15866
- Type vcpkg manifest parsing and updates by @JamieMagee in #16426
- julia: process
[extras], resolve each Manifest with its own Julia, keep JLL builds out of compat, fix up-to-date crash, cooldown and entry order by @IanButterworth in #16307 - NuGet: skip update candidates with missing transitive dependencies by @brettfo in #16432
- NuGet: skip normalized unconditional ignores by @brettfo in #16438
- Prepare CI and updater images for merge queues by @JamieMagee in #16433
- Preserve grouped file operations relative to initial state by @handsomejack-42 in #16314
- NuGet: cache package version lists per job by @brettfo in #16439
- Type Pub helper results and registry responses by @JamieMagee in #16445
- fix(npm_and_yarn): keep pnpm --no-save updates working under a repo release-age gate by @Stanzilla in #16376
- Add NuGet dependency-name subgroups by @brettfo in #16045
- Type Go module manifest command output by @JamieMagee in #16454
- julia: hold back General releases too new to have a release date in a cooldown by @IanButterworth in #16461
- NuGet: make config tests line-ending agnostic by @brettfo in #16440
- Type Go module-list responses by @JamieMagee in #16460
- Maven: use XML source spans when pinning transitive dependencies by @v-kbukum1 in #16452
- Type Composer registry release metadata by @JamieMagee in #16464
- Log conflicting dependencies that prevent security updates by @v-thavaahariharangit in #16424
- v0.399.0 by @dependabot-core-action-automation[bot] in #16477
New Contributors
- @shikhahere made their first contribution in #16206
- @SashaMIT made their first contribution in #15866
- @handsomejack-42 made their first contribution in #16314
Full Changelog: v0.398.0...v0.399.0