v0.402.0

What's Changed

• Ignore commented-out _authToken lines in .npmrc by @alhss in #16550
• Fix wording in Docker and updater specs by @JamieMagee in #16633
• bun: scope workspace-only dependency installs/updates with --filter by @v-sachin-sandhu in #16543
• Skip public PyPI library lookup when a python_index credential has replaces-base by @v-thavaahariharangit with @Copilot in #16619
• Classify pnpm errors that currently surface as unknown errors by @v-sachin-sandhu in #16643
• Add support for apm lockfile regeneration and pinning deps to commit sha by @v-abhishekbhaskar in #16514
• update Python 3.14 and 3.13 to address eMudhra GHSA-6q48-6c7w-9gw2 by @ABruihler in #16652
• Enable Sorbet checking for Cargo specs by @JamieMagee in #16631
• Enable Sorbet checking for Rust toolchain specs by @JamieMagee in #16630
• [Part 3 of 3] Handle unreadable pnpm versions, release-age errors and old lockfiles in monorepos by @v-sachin-sandhu in #16521
• update uv to 0.13.5 to address eMudhra GHSA-hq85-5cpj-mr62 by @ABruihler in #16651
• github_actions: support new gh-actions-lock findings and ignore local actions by @nodeselector in #16649
• github_actions: update declarations in files with CRLF line endings by @v-sachin-sandhu in #16647
• go_modules: run go list -m all after workspace updates by @v-sachin-sandhu in #16650
• bun: classify registry and workspace failures and tolerate bare JSON … by @v-sachin-sandhu in #16644
• Docker: memoize latest_tag and log when no tag matches latest by @v-thavaahariharangit with @Copilot in #16665
• npm_and_yarn: scope Yarn conflicting dependencies to the instance being updated by @v-thavaahariharangit with @Copilot in #16664
• Fix Yarn lockfile matching for ranges containing spaces by @jtlopezdev in #16367
• Enable Sorbet checking for Terraform specs by @JamieMagee in #16653
• Enable Sorbet checking for OpenTofu specs by @JamieMagee in #16654
• gradle: recognize trailing-lambda repository declarations by @JohNan in #16677
• Fix Python requirement pairing when a package is declared more than once by @v-kbukum1 in #16681
• Recognize PHP out-of-memory errors that follow mmap failures in composer by @v-kbukum1 in #16691
• nix: stop treating a deleted branch's null SHA as the latest release by @v-sachin-sandhu in #16674
• Report Bundler checksum mismatches as a clear user error by @v-kbukum1 in #16689
• Fix yarn cacheFolder lookup by @tamayika in #16641
• Gradle: avoid infinite recursion on cyclic included builds by @v-kbukum1 in #16685
• [NoChangeError] npm_and_yarn: parse a dependency named like its own npm project by @v-sachin-sandhu in #16693
• bazel: don't crash on non-version .bazelversion values or unresolved constants by @v-sachin-sandhu in #16659
• Don't report removed dependencies as failed group security updates by @v-thavaahariharangit in #16708
• Don't report semver-rejected dependencies as failed group security updates by @v-thavaahariharangit in #16728
• helm: don't raise on versions with more than one underscore-separated group by @v-sachin-sandhu in #16661
• Enable Sorbet checking for APM specs by @JamieMagee in #16710
• Enable Sorbet checking for GitHub Actions specs by @JamieMagee in #16720
• Enable Sorbet checking for Helm specs by @JamieMagee in #16723
• uv: allow lockfile-only updates for transitive dependencies by @v-kbukum1 in #16686
• v0.402.0 by @dependabot-core-action-automation[bot] in #16705

New Contributors

• @JohNan made their first contribution in #16677
• @tamayika made their first contribution in #16641

Full Changelog: v0.401.0...v0.402.0