dependabot-core

dependabot-core copied to clipboard

Support scanning `uv.lock` for dependencies

5

### Is there an existing issue for this? - [x] I have searched the existing issues ### Feature description Now that dependabot somewhat supports updating uv.lock, it'd be great if...

isbldr

0.0.0 version is considered "latest" even though it isn't

1

### Is there an existing issue for this? - [x] I have searched the existing issues ### Package ecosystem pip ### Package manager version poetry ### Language version Python ###...

CiottiGiorgio

### Is there an existing issue for this? - [x] I have searched the existing issues ### Package ecosystem Helm ### Package manager version Helm ### Language version _No response_...

jaredlueck

### What are you trying to accomplish? Add release date tracking for Gradle plugins to enable the cooldown feature, which prevents updating to newly released versions too quickly. Gradle plugins...

thavaahariharangit

Handle situations where the OpenTofu registry errors

3

### What are you trying to accomplish? There are situations where the OpenTofu registry returns a non-200 status code for a reason (Such as a cloudflare outage!) And this commit...

Yantrio

[dart/pub] Dependabot is incorrectly and unexpectedly changing pubspec.lock flutter constraint from "3.35.6" to ">=3.35.6"

6

### Is there an existing issue for this? - [x] I have searched the existing issues ### Package ecosystem dart ### Package manager version _No response_ ### Language version _No...

acoutts

The DependencyGrapher inherits from a base class in a different module, causing Ruby to fail finding MANIFEST_FILENAME. This broke the graph command for npm repos without a committed lockfile (when...

jurre

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 3.14.1 to 3.14.2. Changelog Sourced from js-yaml's changelog. [3.14.2] - 2025-11-15 Security Backported v4.1.1 fix to v3 [4.1.1] - 2025-11-12 Security Fix prototype pollution issue in yaml...

dependabot[bot]

While auditing the Dockerfiles last week, I spotted this confusing warning about a hack to work around a npm 6 issue. We've deprecated npm 6 support recently, so this hack...

jeffwidman

Bump the npm-dependencies group across 1 directory with 3 updates

1

Bumps the npm-dependencies group with 3 updates in the /npm_and_yarn/helpers directory: [@npmcli/arborist](https://github.com/npm/cli/tree/HEAD/workspaces/arborist), [nock](https://github.com/nock/nock) and [semver](https://github.com/npm/node-semver). Updates `@npmcli/arborist` from 8.0.0 to 9.1.6 Release notes Sourced from @​npmcli/arborist's releases. arborist: v9.1.6 9.1.6...

dependabot[bot]