v0.2.1: Gradle version catalogs Dependabot does not read

• New rule unsupported-version-catalog (warning): a Gradle version catalog other than gradle/libs.versions.toml is not read by Dependabot (the docs list only the standard catalog; custom catalogs: dependabot-core#8079). Reported only when the config has a gradle entry (or with --all-ecosystems); catalogs under test/example paths are info.

v0.2.0: PR mode, sticky comment, glob model verified against Ruby

Pull request mode

--base <ref> (Action: pr-mode: "true", base:, or comment: "true") reports only the gaps a pull request introduces; exit code and counts follow those alone. Optional sticky PR comment (comment: "true"): created once, updated in place, skipped for forks, never fails the job. CI proves exactly one comment after two runs on a same-repo PR.

Glob model checked against real Ruby

The directories glob model was rewritten and is now differentially tested against Ruby's Dir.glob(..., File::FNM_DOTMATCH) (the call dependabot-core makes): 47 hand-picked patterns identical; random fuzz 9/20000 mismatches, all of the shape x/**/**/. This corrected README claims from 0.1.0 (/**/* and /apps/* also select the root / /apps itself). See "Glob model vs real Ruby" in the README for scope and limits.

Dependabot's own pipeline was not run; only the glob expansion is verified.

Marketplace: action.yml has name, description, branding and inputs; publishing to the Marketplace is a manual step by the repo owner.

v0.1.0: find what your dependabot.yml forgets

First release.

• Finds manifests no updates entry covers (uncovered-manifest), entries that match nothing (unmatched-entry), overlapping entries (overlapping-entries), directory: with a glob (directory-glob), a missing file (no-config) and invalid/unparseable configuration.
• directories globbing follows dependabot-core (Dir.glob with FNM_DOTMATCH); directory (singular) is literal; exclude-paths honoured.
• Understands what Dependabot fetches with a covered manifest: npm/yarn/pnpm workspaces, Cargo workspaces, Maven modules, Gradle subprojects.
• GitHub Actions: / covers .github/workflows and the root action.yml; composite actions in subfolders need their own directory.
• Precision filters: ecosystems with no entry at all are one info line (deliberate opt-out); manifests without dependencies are ignored; test/example/docs paths are info; node_modules, vendor etc. skipped.
• Output: text, markdown, json, GitHub annotations, SARIF 2.1.0; --fix appends the missing entries; --rev reads a git revision without a checkout.
• Composite GitHub Action with a committed bundle (no nested actions), Marketplace metadata.