search

dependabot / dependabot-script

A simple script that demonstrates how to use Dependabot Core
MIT License
557 stars 274 forks source link

Bump dependabot-omnibus from 0.209.0 to 0.226.0 #933

Open dependabot[bot] opened 1 year ago

dependabot[bot] commented 1 year ago

Bumps dependabot-omnibus from 0.209.0 to 0.226.0.

Release notes

Sourced from dependabot-omnibus's releases.

v0.226.0

What's Changed

... (truncated)

Changelog

Sourced from dependabot-omnibus's changelog.

Deprecated in favor of GitHub releases April 24th, 2023

The Dependabot-core Changelog is now available through GitHub Releases.

We switched to GitHub Releases to avoid the race condition between the version bump pull request and another pull request. If the other PR is merged between the time the version bump pull request was created and when it was merged, then the other pull request wasn't getting pulled into our changelog. This also allows a lot more flexibility around automation the creation of the version bump PR.

v0.217.0, 24 April 2023

  • Run UpdateAllVersions with ungrouped dependencies #7110
  • [Updater] Ensure we no longer test the legacy code path #7136
  • [Updater] Extract RefreshSecurityUpdatePullRequest into an Operation class #7128
  • [Updater] DependencyChange passes any group to the PR message builder #7137

v0.216.2, 20 April 2023

  • Pull Request names are Dependency Group aware #7115
  • 🛑 Stop clobbering Octokit middleware #7121
  • Fix more order dependent spec failures #7114
  • Fix flaky specs in updater #7113
  • Run Dependency Group updates #7075
  • [Updater] Extract UpdateVulnerableVersion as an Operation class #6961
  • [Updater] Grouped updates will not include ignored dependencies #7091
  • Improve npm package manager instrumentation #7087

v0.216.1, 14 April 2023

  • [Updater] Wire up and flesh out branch naming for Grouped Update PRs #7084
  • Fix incorrect detection of top level gemspecs #7085
  • Improve some exception error messages #7068
  • Bundle the updater when bumping versions #7070
  • Bump rubocop from 1.48.0 to 1.50.0 in /updater (@​app/dependabot) #7064

v0.216.0, 12 April 2023

  • Allow updating gemspecs loaded from a Gemfile #7051
  • Update README.md to include link to the public Dependabot Core board #7054
  • Fix update checking in Yarn repositories using workspaces #7024
  • Don't try to resolve pinned sha's to versions when updating docker images #6150
  • [Updater] Inform the backend metric service which operation class is used for each update #7009
  • [Updater] Prefer updated_dependencies to dependencies for DependencyChange objects #7005
  • [Updater] Introduce a DependencyChangeBuilder class to complete encapsulation of diff generation #7004
  • Upgrade ruby to 3.1.4 and ruby-install to 0.9.0 #6998
  • Generate proper PR summary table for docker digest updates #6996
  • [Updater] Absorb Security Advisory and Ignore Conditions into Job #6989
  • [Updater] Move filtering of parsed dependencies by allow rules or job dependencies #6991
  • Fix "no files were updated!" errors in workspaces #6950
  • Allow updating only the digest when tag is already up to date #6992

... (truncated)

Commits
  • d188759 Merge pull request #7704 from dependabot/bump-to-v0.226.0
  • b1e6efc v0.226.0
  • 4e22d43 Remove CodeQL warning (#7792)
  • c9685ff Merge pull request #7794 from dependabot/deivid-rodriguez/run-group-vendor-tests
  • a16f201 Make sure group vendor bundler tests run and pass
  • a59c8a8 Reverse logic to make it less weird
  • 9f53299 Do not check only unlocked gems for pruning (#7295)
  • 3193956 Merge pull request #7687 from dependabot/deivid-rodriguez/add-back-version-br...
  • 7ad4924 Reword for clarify
  • 3d5b2ef Support schemas with multiple build numbers
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)