GitHub Release: dependabot/dependabot-core v0.402.0 (27.10.2026)

What's Changed

• Ignore commented-out _authToken lines in .npmrc by @alhss in #16550


• Fix wording in Docker and updater specs by @JamieMagee in #16633


• bun: scope workspace-only dependency installs/updates with --filter by @v-sachin-sandhu in #16543


• Skip public PyPI library lookup when a python_index credential has replaces-base by @v-thavaahariharangit with @Copilot in #16619


• Classify pnpm errors that currently surface as unknown errors by @v-sachin-sandhu in #16643


• Add support for apm lockfile regeneration and pinning deps to commit sha by @v-abhishekbhaskar in #16514


• update Python 3.14 and 3.13 to address eMudhra GHSA-6q48-6c7w-9gw2 by @ABruihler in #16652


• Enable Sorbet checking for Cargo specs by @JamieMagee in #16631


• Enable Sorbet checking for Rust toolchain specs by @JamieMagee in #16630


• [Part 3 of 3] Handle unreadable pnpm versions, release-age errors and old lockfiles in monorepos by @v-sachin-sandhu in #16521


• update uv to 0.13.5 to address eMudhra GHSA-hq85-5cpj-mr62 by @ABruihler in #16651


• github_actions: support new gh-actions-lock findings and ignore local actions by @nodeselector in #16649


• github_actions: update declarations in files with CRLF line endings by @v-sachin-sandhu in #16647


• go_modules: run go list -m all after workspace updates by @v-sachin-sandhu in #16650


• bun: classify registry and workspace failures and tolerate bare JSON … by @v-sachin-sandhu in #16644


• Docker: memoize latest_tag and log when no tag matches latest by @v-thavaahariharangit with @Copilot in #16665


• npm_and_yarn: scope Yarn conflicting dependencies to the instance being updated by @v-thavaahariharangit with @Copilot in #16664


• Fix Yarn lockfile matching for ranges containing spaces by @jtlopezdev in #16367


• Enable Sorbet checking for Terraform specs by @JamieMagee in #16653


• Enable Sorbet checking for OpenTofu specs by @JamieMagee in #16654


• gradle: recognize trailing-lambda repository declarations by @JohNan in #16677


• Fix Python requirement pairing when a package is declared more than once by @v-kbukum1 in #16681


• Recognize PHP out-of-memory errors that follow mmap failures in composer by @v-kbukum1 in #16691


• nix: stop treating a deleted branch's null SHA as the latest release by @v-sachin-sandhu in #16674


• Report Bundler checksum mismatches as a clear user error by @v-kbukum1 in #16689


• Fix yarn cacheFolder lookup by @tamayika in #16641


• Gradle: avoid infinite recursion on cyclic included builds by @v-kbukum1 in #16685


• [NoChangeError] npm_and_yarn: parse a dependency named like its own npm project by @v-sachin-sandhu in #16693


• bazel: don't crash on non-version .bazelversion values or unresolved constants by @v-sachin-sandhu in #16659


• Don't report removed dependencies as failed group security updates by @v-thavaahariharangit in #16708


• Don't report semver-rejected dependencies as failed group security updates by @v-thavaahariharangit in #16728


• helm: don't raise on versions with more than one underscore-separated group by @v-sachin-sandhu in #16661


• Enable Sorbet checking for APM specs by @JamieMagee in #16710


• Enable Sorbet checking for GitHub Actions specs by @JamieMagee in #16720


• Enable Sorbet checking for Helm specs by @JamieMagee in #16723


• uv: allow lockfile-only updates for transitive dependencies by @v-kbukum1 in #16686


• v0.402.0 by @dependabot-core-action-automation[bot] in #16705

New Contributors

• @JohNan made their first contribution in #16677


• @tamayika made their first contribution in #16641

Full Changelog: v0.401.0...v0.402.0