What's Changed
- docker: don't raise on versions with more than one underscore-separated group by @v-sachin-sandhu in #16660
- Enable Sorbet checking for Go modules specs by @JamieMagee in #16732
- Enable Sorbet checking for pub specs by @JamieMagee in #16733
- Enable Sorbet checking for pre-commit specs by @JamieMagee in #16734
- terraform: don't crash when the lockfile has no entry for the updated provider by @v-sachin-sandhu in #16667
- julia: report the running Julia as the language version by @IanButterworth in #16600
- go_modules: report an import that no module provides as an unresolvable file by @v-sachin-sandhu in #16742
- Add missing PR labeler entries for julia, conda, bazel, nix, sbt, pre… by @v-sachin-sandhu in #16752
- Enable Sorbet checking for NuGet Ruby specs by @JamieMagee in #16739
- Enable Sorbet checking for Bazel specs by @JamieMagee in #16748
- Enable Sorbet checking for vcpkg specs by @JamieMagee in #16749
- NuGet: fetch release notes and package URLs concurrently by @JamieMagee in #16755
- github_actions: give pinned-ref clone failures a stable fingerprint by @v-sachin-sandhu in #16718
- opentofu: lock only the platforms the new provider version ships by @v-sachin-sandhu in #16690
- python, uv: do not match the start of a longer declaration of the same package by @v-sachin-sandhu in #16753
- NuGet: treat empty existing PR directory as wildcard on refresh by @v-thavaahariharangit with @Copilot in #16760
- Fix Composer implicit PHP requirement retries by @v-thavaahariharangit in #16747
- helm: ask the registry for the image path without its host name by @v-sachin-sandhu in #16706
- julia: resolve a manifest for its Julia version with Pkg instead of juliaup by @IanButterworth in #16591
- julia: report a version for a stdlib in the PR body by @IanButterworth in #16716
- Enable Sorbet checking for Nix specs by @JamieMagee in #16768
- Enable Sorbet checking for Elm specs by @JamieMagee in #16769
- Enable Sorbet checking for Hex specs by @JamieMagee in #16770
- Enable Sorbet checking for Composer specs by @JamieMagee in #16772
- Enable Sorbet checking for Swift specs by @JamieMagee in #16773
- Enable Sorbet checking for Julia specs by @JamieMagee in #16774
- python: report a poetry.lock that Poetry cannot read as a file that does not resolve by @v-sachin-sandhu in #16767
- Add support for Python 3.15 by @amnesiaof in #16525
- Bump gh-actions-lock to v0.4.1 by @nodeselector in #16799
- Enable Sorbet checking for Bundler specs by @JamieMagee in #16776
- Enable Sorbet checking for Bundler v2 helper specs by @JamieMagee in #16777
- Enable Sorbet checking for Bundler v4 helper specs by @JamieMagee in #16778
- github_actions: clone only commits and tags for pinned-ref and cooldown lookups by @v-sachin-sandhu in #16780
- Preserve grouped artifact operations across directories by @handsomejack-42 in #16447
- v0.403.0 by @dependabot-core-action-automation[bot] in #16789
- Update uv dependencies pinned to a git tag by @Dichotomia in #16151
- Preserve update summaries when dependency metadata lookup fails by @brettfo in #16736
- Preserve go.work changes between grouped dependency updates by @v-markhallen in #16810
- Python & uv updates, including for eMudhra by @ABruihler in #16729
- npm_and_yarn: don't let a pnpm update add versions inside the repo's minimumReleaseAge window by @v-sachin-sandhu in #16757
- common: clone only commits and tags to read git tag dates by @v-sachin-sandhu in #16800
- Upgrade Swift version to 6.4.1 by @bruno-mfw in #16817
- npm_and_yarn: resolve a transitive update to the copy that replaced the vulnerable one by @v-sachin-sandhu in #16832
- Skip git tags that the version class cannot parse by @naoto-naka-safie in #16663
- Fix gradle incorrect update for same group id and version by @v-abhishekbhaskar in #16829
- Recognize multi-requester Yarn 4 peer warnings by @segiddins in #16486
- Ensure we handle a PEP-621 style poetry project when graphing and updating. by @brrygrdn in #16824
- NuGet: don't close refreshed PR when a later directory has nothing to update by @v-thavaahariharangit with @Copilot in #16846
- Fix Poetry Python constraints with the OR (||) operator by @frandominguezl in #16833
- Maven: leave transitive dependencyManagement overrides to security updates by @v-kbukum1 in #16825
- Maven: match classified declarations against the requirement being updated by @v-kbukum1 in #16843
- Fetch .NET release metadata from builds.dotnet.microsoft.com by @jurre in #16484
- npm_and_yarn: explain a pnpm patch that no package uses after an update by @v-sachin-sandhu in #16741
- Don't treat Maven registry rate limits and server errors as no versions by @v-kbukum1 in #16688
- nuget: ignore only the exact update type in version finder by @gatlex in #16808
- Align Python marker parsing between FileParser and UpdateChecker to avoid dropping requirements by @brrygrdn in #15875
- Revert Excon EOF error fingerprint updates by @v-abhishekbhaskar in #16818
- v0.404.0 by @dependabot-core-action-automation[bot] in #16860
New Contributors
- @amnesiaof made their first contribution in #16525
- @v-markhallen made their first contribution in #16810
- @bruno-mfw made their first contribution in #16817
- @segiddins made their first contribution in #16486
- @frandominguezl made their first contribution in #16833
- @gatlex made their first contribution in #16808
Full Changelog: v0.402.0...v0.404.0