v0.404.0

What's Changed

• docker: don't raise on versions with more than one underscore-separated group by @v-sachin-sandhu in #16660
• Enable Sorbet checking for Go modules specs by @JamieMagee in #16732
• Enable Sorbet checking for pub specs by @JamieMagee in #16733
• Enable Sorbet checking for pre-commit specs by @JamieMagee in #16734
• terraform: don't crash when the lockfile has no entry for the updated provider by @v-sachin-sandhu in #16667
• julia: report the running Julia as the language version by @IanButterworth in #16600
• go_modules: report an import that no module provides as an unresolvable file by @v-sachin-sandhu in #16742
• Add missing PR labeler entries for julia, conda, bazel, nix, sbt, pre… by @v-sachin-sandhu in #16752
• Enable Sorbet checking for NuGet Ruby specs by @JamieMagee in #16739
• Enable Sorbet checking for Bazel specs by @JamieMagee in #16748
• Enable Sorbet checking for vcpkg specs by @JamieMagee in #16749
• NuGet: fetch release notes and package URLs concurrently by @JamieMagee in #16755
• github_actions: give pinned-ref clone failures a stable fingerprint by @v-sachin-sandhu in #16718
• opentofu: lock only the platforms the new provider version ships by @v-sachin-sandhu in #16690
• python, uv: do not match the start of a longer declaration of the same package by @v-sachin-sandhu in #16753
• NuGet: treat empty existing PR directory as wildcard on refresh by @v-thavaahariharangit with @Copilot in #16760
• Fix Composer implicit PHP requirement retries by @v-thavaahariharangit in #16747
• helm: ask the registry for the image path without its host name by @v-sachin-sandhu in #16706
• julia: resolve a manifest for its Julia version with Pkg instead of juliaup by @IanButterworth in #16591
• julia: report a version for a stdlib in the PR body by @IanButterworth in #16716
• Enable Sorbet checking for Nix specs by @JamieMagee in #16768
• Enable Sorbet checking for Elm specs by @JamieMagee in #16769
• Enable Sorbet checking for Hex specs by @JamieMagee in #16770
• Enable Sorbet checking for Composer specs by @JamieMagee in #16772
• Enable Sorbet checking for Swift specs by @JamieMagee in #16773
• Enable Sorbet checking for Julia specs by @JamieMagee in #16774
• python: report a poetry.lock that Poetry cannot read as a file that does not resolve by @v-sachin-sandhu in #16767
• Add support for Python 3.15 by @amnesiaof in #16525
• Bump gh-actions-lock to v0.4.1 by @nodeselector in #16799
• Enable Sorbet checking for Bundler specs by @JamieMagee in #16776
• Enable Sorbet checking for Bundler v2 helper specs by @JamieMagee in #16777
• Enable Sorbet checking for Bundler v4 helper specs by @JamieMagee in #16778
• github_actions: clone only commits and tags for pinned-ref and cooldown lookups by @v-sachin-sandhu in #16780
• Preserve grouped artifact operations across directories by @handsomejack-42 in #16447
• v0.403.0 by @dependabot-core-action-automation[bot] in #16789
• Update uv dependencies pinned to a git tag by @Dichotomia in #16151
• Preserve update summaries when dependency metadata lookup fails by @brettfo in #16736
• Preserve go.work changes between grouped dependency updates by @v-markhallen in #16810
• Python & uv updates, including for eMudhra by @ABruihler in #16729
• npm_and_yarn: don't let a pnpm update add versions inside the repo's minimumReleaseAge window by @v-sachin-sandhu in #16757
• common: clone only commits and tags to read git tag dates by @v-sachin-sandhu in #16800
• Upgrade Swift version to 6.4.1 by @bruno-mfw in #16817
• npm_and_yarn: resolve a transitive update to the copy that replaced the vulnerable one by @v-sachin-sandhu in #16832
• Skip git tags that the version class cannot parse by @naoto-naka-safie in #16663
• Fix gradle incorrect update for same group id and version by @v-abhishekbhaskar in #16829
• Recognize multi-requester Yarn 4 peer warnings by @segiddins in #16486
• Ensure we handle a PEP-621 style poetry project when graphing and updating. by @brrygrdn in #16824
• NuGet: don't close refreshed PR when a later directory has nothing to update by @v-thavaahariharangit with @Copilot in #16846
• Fix Poetry Python constraints with the OR (||) operator by @frandominguezl in #16833
• Maven: leave transitive dependencyManagement overrides to security updates by @v-kbukum1 in #16825
• Maven: match classified declarations against the requirement being updated by @v-kbukum1 in #16843
• Fetch .NET release metadata from builds.dotnet.microsoft.com by @jurre in #16484
• npm_and_yarn: explain a pnpm patch that no package uses after an update by @v-sachin-sandhu in #16741
• Don't treat Maven registry rate limits and server errors as no versions by @v-kbukum1 in #16688
• nuget: ignore only the exact update type in version finder by @gatlex in #16808
• Align Python marker parsing between FileParser and UpdateChecker to avoid dropping requirements by @brrygrdn in #15875
• Revert Excon EOF error fingerprint updates by @v-abhishekbhaskar in #16818
• v0.404.0 by @dependabot-core-action-automation[bot] in #16860

New Contributors

• @amnesiaof made their first contribution in #16525
• @v-markhallen made their first contribution in #16810
• @bruno-mfw made their first contribution in #16817
• @segiddins made their first contribution in #16486
• @frandominguezl made their first contribution in #16833
• @gatlex made their first contribution in #16808

Full Changelog: v0.402.0...v0.404.0