$ git log --author="dependabot" --all --oneline

On the record

dependabot

@dependabot ↗ first byline August 2026

Every morning, RepoJournal's newsroom reads what shipped across the open-source projects developers depend on — and writes the wire. Your commits kept making the news. This is your clippings file: the stories where your work was the story.

200

stories filed

120

daily wires

19

newsrooms

$ grep -rn "author: dependabot" wires/ | sort -r

Safety Evals

wire 2026-11-09

inspect_evals 0.28.0 closes an SSRF hole in BFCL web search

chore(deps): bump the python-packages group with 4 updates UKGovernmentBEIS/inspect_ai

Agentic Coding

wire 2026-11-08

Goose live voice points at any GPT-Live server

chore(deps): bump vite from 8.0.16 to 8.3.5 OpenHands/OpenHands

Rails

wire 2026-11-07

Active Record consolidates to one pool reaper thread; frozen verifiers stop raising

build(deps): bump the github-actions group with 2 updates rails/tailwindcss-rails

Agent Security

wire 2026-11-07

Injection rail now blocks when redaction is incomplete

chore(deps): bump certifi from 2026.6.17 to 2026.10.18 NVIDIA-NeMo/Guardrails

OpenAI

wire 2026-11-05

Three new data residency regions land in both SDKs

chore(deps): update aiohttp, multidict, PyJWT, and required yarl security floors openai/openai-python

Agent Security

wire 2026-11-04

Judge prompts stop leaking to hooks-server logs

chore(deps-dev): Bump @typescript-eslint/parser in /agent-governance-python/agent-os/extensions/copilot microsoft/agent-governance-toolkit

FastAPI & Pydantic

wire 2026-11-03

Pydantic caches fixed core schemas, and its schema path skips dispatch for builtin scalars

⬆ Bump the python-packages group across 1 directory with 9 updates tiangolo/sqlmodel

Kubernetes

wire 2026-11-02

Release tooling gains per-image levels, Kueue CI moves to Go 1.27

Bump sigs.k8s.io/promo-tools/v4 from 4.7.1 to 4.8.0 kubernetes/release

Supabase

wire 2026-11-02

Realtime 2.151.0 measures join budgets, dbdev pulls a critical Next.js patch

chore(deps): bump next from 16.3.8 to 16.4.1 in /website in the npm_and_yarn group across 1 directory supabase/dbdev

AI Red Teaming

wire 2026-11-01

PyRIT trims duplicate adversarial response format instructions

MAINT: Bump tornado from 6.5.10 to 6.6 in the security-minor-and-patch group across 1 directory microsoft/PyRIT

Elixir & Phoenix

wire 2026-11-01

Phoenix's JS toolchain bumps to eslint 10.13.0

Bump the minor-and-patch group with 3 updates phoenixframework/phoenix

Hugging Face

wire 2026-10-28

TRL fixes chunked loss precision, drops liger-kernel from dev deps

Bump the actions group across 1 directory with 4 updates huggingface/optimum

Node.js

wire 2026-10-27

Amaro 1.3.0 moves to registerHooks, snap stops nightly rollbacks

build(deps): bump undici nodejs/remark-preset-lint-node

FastAPI & Pydantic

wire 2026-10-27

Lazy reprs in nested union serialization, and a dependency train

⬆ Bump black from 26.5.1 to 26.10.1 fastapi/fastapi
⬆ Bump opentelemetry-api from 1.44.0 to 1.45.1 fastapi/fastapi

FastAPI & Pydantic

wire 2026-10-26

FastAPI's dependency bots move; Pydantic fixes its CI cache keys

⬆ Bump gitpython from 3.1.62 to 3.2.1 fastapi/fastapi
⬆ Bump opentelemetry-api from 1.44.0 to 1.45.1 fastapi/fastapi

AI Red Teaming

wire 2026-10-26

Promptfoo moves off vulnerable MSAL, PyRIT adds a char-split attack and cloud token detection

chore(deps): patch body-parser and fast-uri promptfoo/promptfoo

Agent Security

wire 2026-10-23

Windows push keys survive uninstall, and managed installs can skip absent agents

chore(deps-dev): Bump vite from 8.0.16 to 8.3.5 in /agent-governance-python/agentmesh-integrations/mastra-agentmesh microsoft/agent-governance-toolkit

Node.js

wire 2026-10-20

A "worker" condition for Web Workers, and a lint rule that catches dead benchmarks

tools: bump the doc group in /tools/doc with 4 updates nodejs/node

HashiCorp

wire 2026-10-19

x/net bumps in mdns, a doc correction in the AWS provider

[chore] : Bump golang.org/x/net from 0.59.0 to 0.61.0 in the go group hashicorp/mdns

Node.js

wire 2026-10-19

Dev dependency maintenance across nodejs tooling

build(deps-dev): bump eslint from 9.39.4 to 10.12.0 nodejs/undici

Node.js

wire 2026-10-18

net.BlockList fails closed, QUIC validates error codes

build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 nodejs/undici

Safety Evals

wire 2026-10-18

inspect_evals 0.25.0 rescores SWE-Lancer accuracy

chore(deps): bump the actions group with 7 updates UKGovernmentBEIS/inspect_evals

Node.js

wire 2026-10-12

AbortSignal.any() leak fixed, diagnostics_channel context unblocked

tools: bump the doc group in /tools/doc with 2 updates nodejs/node

HashiCorp

wire 2026-10-12

Terraform AWS provider adds a DevOps Agent resource as dependency bumps roll through Nomad

build(deps): bump the go group across 1 directory with 2 updates hashicorp/nomad-autoscaler
build(deps): bump the actions group with 2 updates hashicorp/nomad-driver-podman
build(deps): bump the actions group with 3 updates hashicorp/nomad-autoscaler

Kubernetes

wire 2026-10-12

etcd benchmark fixed, promo-tools bump breaks the release build

Bump sigs.k8s.io/promo-tools/v4 from 4.7.0 to 4.7.1 in the all group kubernetes/release

FastAPI & Pydantic

wire 2026-10-06

Pydantic clears two test blockers, SQLModel bumps its whole Python stack

⬆ Bump the python-packages group across 1 directory with 8 updates tiangolo/sqlmodel

Hugging Face

wire 2026-10-05

TRL widens template matching for LFM2, LFM2.5, and Gemma 4

chore(deps): bump huggingface/doc-builder/.github/workflows/build_main_documentation.yml from ef23fb82532fe347298732dc81dacad2f8eff961 to 9d137cbeab5c75e8093b5c0036f83a429cf878fb huggingface/OpenEnv

HashiCorp

wire 2026-10-05

Nomad's release image moves to busybox 1.38.0

[chore] : Bump the go group with 6 updates hashicorp/go-getter

AI Red Teaming

wire 2026-10-04

Codex provider works on Windows, PyRIT pulls mcp 2.2.0

MAINT: Bump mcp from 1.30.0 to 2.2.0 microsoft/PyRIT
MAINT: Bump the minor-and-patch group in /frontend with 9 updates microsoft/PyRIT

FastAPI & Pydantic

wire 2026-10-03

FastAPI absorbs a 14-package dependency bump, docs translations land in four languages

⬆ Bump the python-packages group across 1 directory with 14 updates fastapi/fastapi
⬆ Bump the github-actions group with 3 updates tiangolo/sqlmodel

FastAPI & Pydantic

wire 2026-10-02

Pydantic survives ZoneInfo OS errors, FastAPI’s bothousekeeping continues

⬆ Bump the github-actions group with 3 updates fastapi/fastapi

Node.js

wire 2026-10-02

node-gyp 13.1.0 fixes --msvs_version, and citgm's red builds traced to loglevel precedence

chore(deps): bump undici nodejs/nodejs-dist-indexer
chore(deps): bump undici nodejs/changelog-maker

Rails

wire 2026-09-28

Boolean pool config no longer crashes boot, except_on error matching fixed

build(deps): bump the github-actions group with 2 updates rails/tailwindcss-rails

Hugging Face

wire 2026-09-23

Fused logprob kernels in TRL, rustls pinned past RUSTSEC-2026-0285

chore(deps): bump pip from 25.2 to 26.2 in /tests/validation_runtime huggingface/OpenEnv

HashiCorp

wire 2026-09-23

Consul-k8s adopts pre-configured k8s auth methods, GCP CIS policies land

Bump the gomod-backward-compatible group across 1 directory with 12 updates hashicorp/vault-secrets-operator

OpenAI

wire 2026-09-22

openai-python's required call_id change lands, then gets reverted

chore(deps): bump httpx2 from 2.7.0 to 2.12.0 in the python-security group across 1 directory openai/openai-python

HashiCorp

wire 2026-09-22

Consul dataplane drops a mutex on DNS backoff, packer-plugin-alicloud ships v1.2.0

[chore] : Bump the go group with 4 updates hashicorp/go-getter

Kubernetes

wire 2026-09-21

Minikube probes drivers in parallel, promo-tools signs promotion records

Bump sigs.k8s.io/promo-tools/v4 from 4.5.1 to 4.6.0 kubernetes/release
chore(deps): bump the golang-org group across 1 directory with 7 updates kubernetes/minikube

Kubernetes

wire 2026-09-20

Minikube drops pre-1.28 test fixtures, golang.org/x bumps land across the tree

chore(deps): bump google.golang.org/api from 0.289.0 to 0.297.0 kubernetes/minikube

Node.js

wire 2026-09-18

cpSync dereference regression fixed, trace union punning removed

tools: bump the eslint group in /tools/eslint with 6 updates nodejs/node

Vue.js

wire 2026-09-15

create-vue fixes Vitest config imports, js-yaml patches merge-sequence CPU use

chore(deps): bump js-yaml from 4.3.0 to 4.3.2 vuejs/v2.cn.vuejs.org

Kubernetes

wire 2026-09-14

DRA kind jobs get 12Gi, kubelet drops an optimistic volume default

build(deps): bump go.etcd.io/etcd/client/v3 from 3.5.15 to 3.7.1 in /util-images/request-benchmark kubernetes/perf-tests

Laravel

wire 2026-09-13

Laravel MCP serves legacy clients, middleware priority list fixes land

Bump @babel/core from 7.13.1 to 7.29.7 laravel/vapor-js

Supabase

wire 2026-09-11

Postgrest v16.3 and storage v1.75.1 slim artifacts, Vitest 5 across the monorepo

Laravel

wire 2026-09-07

LSP skips diagnostics for interpolated strings

Bump picomatch, @typescript-eslint/eslint-plugin, @typescript-eslint/parser and @vscode/test-cli laravel/vs-code-extension

Hugging Face

wire 2026-09-07

Transformers.js adds structured output and docs overhaul

chore(deps): bump the actions group with 2 updates huggingface/hf-mount
Bump the actions group with 5 updates huggingface/trl

HashiCorp

wire 2026-09-07

Copyright compliance sweep lands across HashiCorp repos

[chore] : Bump the go group across 1 directory with 2 updates hashicorp/go-metrics

Node.js

wire 2026-09-04

domain runtime-deprecation lands; BlockList round-trip fixed

chore(deps): bump the lint group with 3 updates nodejs/nodejs.org
chore(deps): bump the mdx group with 5 updates nodejs/nodejs.org
chore(deps): bump @opennextjs/cloudflare from 1.19.3 to 1.20.2 nodejs/nodejs.org

FastAPI & Pydantic

wire 2026-09-03

Pydantic hardens JSON mode serialization error handling

Bump actions/checkout from 7.0.0 to 7.0.1 pydantic/pydantic

Agentic Coding

wire 2026-09-03

Cline desktop stops false hub-update nag, shows device sign-in code

chore(deps): bump orjson from 3.11.6 to 3.12.0 in /libs/partners/fireworks langchain-ai/langchain
chore(deps): bump langsmith from 0.10.16 to 0.12.1 in /libs/partners/chroma langchain-ai/langchain

Node.js

wire 2026-09-02

Node.js adds v8.setHeapProfileNearHeapLimit, fixes environment live lock

build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.9 nodejs/undici
build(deps): bump github/codeql-action/analyze from 4.37.3 to 4.37.9 nodejs/undici

Elixir & Phoenix

wire 2026-09-02

Phoenix phx.new.web drops Ecto by default

Bump the minor-and-patch group with 4 updates phoenixframework/phoenix

FastAPI & Pydantic

wire 2026-09-02

Dependency churn across FastAPI and SQLModel, decimal validation hardening in Pydantic

⬆ Bump the python-packages group across 1 directory with 15 updates fastapi/fastapi
⬆ Bump fastar from 0.11.0 to 0.12.0 fastapi/fastapi
⬆ Bump the python-packages group with 9 updates tiangolo/sqlmodel
⬆ Bump sqlalchemy from 2.0.51 to 2.0.52 tiangolo/sqlmodel

Kubernetes

wire 2026-09-02

SIG Storage co-chair transition, PodSchedulingReadiness gate removed

Bump step-security/harden-runner from 2.21.0 to 2.21.1 in the actions group kubernetes/release
Bump google.golang.org/grpc from 1.83.0 to 1.83.1 kubernetes/release

HashiCorp

wire 2026-09-01

Consul CNI tolerations now configurable, Nomad plan diff sorts args numerically

[chore] : Bump google.golang.org/grpc from 1.83.1 to 1.83.2 in the go group across 1 directory hashicorp/go-plugin
[chore] : Bump the go group with 7 updates hashicorp/go-getter

Arch Linux

wire 2026-08-31

Routine package bumps and archinstall lint cleanup

build(deps-dev): bump types-bleach from 6.4.0.20260607 to 6.4.0.20260728 archlinux/archweb

Spring

wire 2026-08-30

Spring improves singleton destruction caching, upgrades Elasticsearch and Boot deps

Bump org.springframework.boot:spring-boot-starter from 4.0.7 to 4.0.8 in the development-dependencies group spring-projects/spring-kafka
Bump org.springframework.data:spring-data-bom from 2026.1.0-M1 to 2026.1.0-SNAPSHOT spring-projects/spring-kafka

Agentic Coding

wire 2026-08-30

Cline fixes hook telemetry and crashes; LlamaIndex purges unfixable packages

chore(deps): bump the uv group across 3 directories with 3 updates run-llama/llama_index

Spring

wire 2026-08-28

Spring Batch Fixes Null Step Name That Breaks JDBC Jobs

Bump io.spring.gradle:spring-security-release-plugin from 1.0.16 to 1.0.17 spring-projects/spring-session
Bump io.spring.gradle:spring-security-release-plugin from 1.0.16 to 1.0.17 spring-projects/spring-session

Django

wire 2026-08-25

DJANGOPROJECT.COM SHORES UP CI TOOLING WITH ACTION UPGRADES AND PRE-COMMIT AUTOMATION

Bump actions/setup-python from 6 to 7 django/djangoproject.com
Bump actions/checkout from 7.0.0 to 7.0.1 django/djangoproject.com

Node.js

wire 2026-08-24

Node's compile cache turns read-only

chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 nodejs/amaro
chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 nodejs/amaro

HashiCorp

wire 2026-08-24

DEPENDENCY BUMPS ROLL THROUGH HASHICORP'S CORE

[chore] : Bump the go group with 6 updates hashicorp/go-getter
[chore] : Bump the go group with 2 updates hashicorp/memberlist

.NET

wire 2026-08-24

DOTNET PIPELINES SWARM: 14 PRS, ONE MESSAGE

Bump github/gh-aw-actions/setup from 0.86.2 to 0.87.2 dotnet/msbuild
Bump Microsoft.IdentityModel.Protocols.OpenIdConnect and System.IdentityModel.Tokens.Jwt dotnet/dev-proxy
Bump github/codeql-action/analyze from 4.37.1 to 4.37.7 dotnet/dev-proxy

Spring

wire 2026-08-24

SPRING BOOT DOCS POINT TO DEAD WEB SECURITY CLASS

Bump org.springframework:spring-core from 7.0.8 to 7.0.9 spring-projects/spring-ldap
Bump com.apollographql.apollo:apollo-runtime from 5.0.1 to 5.1.0 spring-projects/spring-ldap
Bump io.micrometer:micrometer-bom from 1.17.0 to 1.17.1 spring-projects/spring-ldap
Bump gradle-wrapper from 9.7.0 to 9.7.1 spring-projects/spring-ldap
Bump io.projectreactor:reactor-core from 3.8.6 to 3.8.7 spring-projects/spring-ldap

Supabase

wire 2026-08-23

Supabase Guards QueryEditor Against Destructive Queries

fix(deps): bump the npm-major group with 2 updates supabase/cli

Spring

wire 2026-08-23

SPeL Configuration Gets a Builder, Deprecates 9 Constructors

Bump tools.jackson:jackson-bom from 3.2.1 to 3.2.2 spring-projects/spring-integration
Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 spring-projects/spring-integration
Bump tools.jackson:jackson-bom from 3.2.1 to 3.2.2 spring-projects/spring-kafka
Bump com.fasterxml.jackson:jackson-bom from 2.21.5 to 2.21.6 spring-projects/spring-kafka
Bump org.springframework.boot:spring-boot-starter from 4.0.3 to 4.0.7 in the development-dependencies group spring-projects/spring-kafka

Spring

wire 2026-08-22

Spring Kafka leaks serializer resources in a silent bug

Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 spring-projects/spring-amqp
Bump tools.jackson:jackson-bom from 3.2.1 to 3.2.2 spring-projects/spring-amqp
Bump io.projectreactor:reactor-bom from 2026.0.0-M1 to 2026.0.0-SNAPSHOT spring-projects/spring-amqp

Spring

wire 2026-08-21

SPRING SECURITY SPLITS AES CRYPTO AS DEPRECATION LOOMS

Bump io.spring.javaformat:spring-javaformat-checkstyle from 0.0.47 to 0.0.48 spring-projects/spring-security-samples

Hugging Face

wire 2026-08-21

Transformers Brings Biology to v5 Main

Bump astral-sh/setup-uv from 9.0.0 to 10.0.0 in the actions group huggingface/sentence-transformers

Kubernetes

wire 2026-08-21

Go 1.26.5 image gap stalls Kubernetes patch builds

Bump github.com/stretchr/testify from 1.12.0 to 1.12.1 in the all group kubernetes/release

HashiCorp

wire 2026-08-21

Nomad strips multierror for stdlib, nvidia plugin jumps to Go 1.27

build(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 hashicorp/nomad-device-nvidia
Bump the build-and-test group with 2 updates hashicorp/setup-copywrite

Laravel

wire 2026-08-20

Cloud CLI leaks API tokens, fix lands in hours

Bump EndBug/add-and-commit from 10.0.0 to 11.0.0 in the github-actions group laravel/nightwatch

Spring

wire 2026-08-20

Spring Security Stops Thread Leaks

Bump com.squareup.okhttp3:mockwebserver from 5.4.0 to 5.5.0 spring-projects/spring-ldap
Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 spring-projects/spring-security

HashiCorp

wire 2026-08-20

PYTHON-TFE SHIPS v1.4.0 WITH TF-POLICY SUPPORT

chore(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /jobspec2 hashicorp/nomad

Kubernetes

wire 2026-08-19

CI Flake Hunters Strike Gold in GCP Test Harness

:seedling: (chore): Bump golang.org/x/net from 0.57.0 to 0.58.0 kubernetes/cloud-provider-vsphere
:seedling: (chore): Bump github.com/stretchr/testify from 1.11.1 to 1.12.0 kubernetes/cloud-provider-vsphere
:seedling: (chore): Bump github.com/prometheus/client_golang from 1.24.0 to 1.24.1 kubernetes/cloud-provider-vsphere

Spring

wire 2026-08-18

Logback 1.6.3 shuts down CVE-2026-19880 in Spring Security and Session

Bump ch.qos.logback:logback-classic from 1.6.2 to 1.6.3 spring-projects/spring-security
Bump ch.qos.logback:logback-core from 1.6.1 to 1.6.3 spring-projects/spring-session
Bump tools.jackson:jackson-bom from 3.2.1 to 3.2.2 spring-projects/spring-security
Bump antora from 3.2.0-rc.2 to 3.2.0-rc.3 spring-projects/spring-ldap

Arch Linux

wire 2026-08-18

SQLPARSER DOS FIX LANDS IN ARCHWEB

build(deps): bump sqlparse from 0.5.5 to 0.6.0 archlinux/archweb

Node.js

wire 2026-08-18

NODE FFI HARDENS AGAINST CONSTRUCTOR ABUSE

build(deps-dev): bump @fastify/busboy from 3.2.0 to 3.2.1 nodejs/undici
build(deps-dev): bump esbuild from 0.28.1 to 0.28.2 nodejs/undici

Spring

wire 2026-08-17

LOGBACK 1.6.2 LANDS IN SPRING SECURITY

Bump ch.qos.logback:logback-classic from 1.6.1 to 1.6.2 spring-projects/spring-security

Rails

wire 2026-08-17

Rails cuts schema cache dumps in half for large databases

build(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-actions group rails/tailwindcss-rails
build(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-actions group rails/rails-html-sanitizer

HashiCorp

wire 2026-08-17

TERRAFORM PROVIDER AWS ADDS FSX NETWORK TYPE SUPPORT ACROSS TWO FILE SYSTEM TYPES

build(deps): Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 in /tools hashicorp/terraform-plugin-go

Kubernetes

wire 2026-08-17

KOPS EXPANDS AKAMAI VOLUMES, TIGHTENS SSH USER DISCOVERY ACROSS CLOUDS

Bump golang.org/x/text from 0.40.0 to 0.41.0 kubernetes/release
Bump the actions group with 7 updates kubernetes/release

Node.js

wire 2026-08-17

JS-YAML SECURITY FIX SHIPS IN NODEJS-DIST-INDEXER 1.8.24

chore(deps-dev): bump js-yaml from 4.2.0 to 4.3.1 nodejs/nodejs-dist-indexer

HashiCorp

wire 2026-08-14

TERRAFORM-PROVIDER-TFE SHIPS BREAKING CHANGES, AZURERM CLEANS UP 5.0 GATES

build(deps): bump the gomod-backward-compatible group across 1 directory with 10 updates hashicorp/terraform-provider-vault

Spring

wire 2026-08-14

SPRING FRAMEWORK 7.1 FORCES RECKONING ACROSS SECURITY, AMQP, AND BOOT

Bump org.junit:junit-bom from 6.1.2 to 6.1.3 spring-projects/spring-kafka
Bump org.junit:junit-bom from 6.1.2 to 6.1.3 spring-projects/spring-amqp
Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 in the development-dependencies group spring-projects/spring-amqp

Spring

wire 2026-08-13

SPRING KAFKA FIXES BATCH LISTENER STATE CORRUPTION ACROSS PARTITIONS

Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 spring-projects/spring-security

Node.js

wire 2026-08-13

NODE.JS DOCKER AUTOMATION TIGHTENS RELEASE KEY SYNC

chore(deps): bump github/codeql-action/upload-sarif from 4.37.4 to 4.37.6 nodejs/docker-node

Laravel

wire 2026-08-12

LARAVEL SHIPS QUEUE PAUSING AND VITE 3.2.0 IN OVERNIGHT PUSH

Bump the composer group in /agent with 2 updates laravel/nightwatch

Django

wire 2026-08-12

DJANGO 6.1 LANDS. SECURITY PATCHES SHIPPED. ADMIN BUGS FIXED.

Bump django from 5.2.14 to 5.2.17 django/code.djangoproject.com

Node.js

wire 2026-08-12

NODE CORE TIGHTENS CRYPTO IN FIPS MODE, FIXES SQLITE STATEMENT LEAKS

chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 nodejs/node-meeting-agenda
chore(deps-dev): bump brace-expansion from 1.1.11 to 1.1.18 nodejs/node-meeting-agenda

Django

wire 2026-08-11

DJANGO KILLS FALSE DEPRECATION WARNING IN TEMPLATES

Bump playwright from 1.61.0 to 1.62.0 in /requirements django/djangoproject.com
Bump time-machine from 3.2.0 to 3.3.0 in /requirements django/djangoproject.com
Bump feedparser from 6.0.12 to 6.0.14 in /requirements django/djangoproject.com

FastAPI & Pydantic

wire 2026-08-11

TIANGOLO CONSOLIDATES CI ACROSS FASTAPI AND SQLMODEL, PYDANTIC TIGHTENS TYPE INTROSPECTION

⬆ Bump pymdown-extensions from 11.0 to 11.0.1 fastapi/fastapi
⬆ Bump gitpython from 3.1.57 to 3.1.58 fastapi/fastapi

Node.js

wire 2026-08-11

UNDICI 8.10.0 SHIPS AS NODE CORE DEPS SYNC ACROSS THE STACK

build(deps-dev): bump ws from 8.21.1 to 8.21.3 nodejs/undici

FastAPI & Pydantic

wire 2026-08-10

FastAPI Locks Down Automation, Pydantic Fixes Regex Flag Loss

Bump pymdown-extensions from 11.0 to 11.0.1 pydantic/pydantic

Arch Linux

wire 2026-08-10

AURWEB MIGRATION OVERHAUL SHIPS WITH DOWNGRADE TESTING

build(deps): bump django from 5.2.14 to 5.2.16 archlinux/archweb

Laravel

wire 2026-08-10

LARAVEL MCP DITCHES THE HANDSHAKE

chore(deps): bump crate-ci/typos from 1.48.0 to 1.49.0 in the github-actions group laravel/moat

Agentic Coding

wire 2026-08-09

CLINE FIXES ABORT-WINDOW PROMPT LOSS, CLIPBOARD IMAGES LAND ON DESKTOP

chore: bump h2 from 4.3.0 to 4.4.1 in /libs/langchain langchain-ai/langchain
chore: bump h2 from 4.3.0 to 4.4.1 in /libs/langchain_v1 langchain-ai/langchain

Laravel

wire 2026-08-08

LARAVEL MCP ALIGNS WITH 2026 SPEC, MULTIPLEX SHIPS BREAKING COLOR CHANGES

Bump the npm group across 1 directory with 7 updates laravel/multiplex

Spring

wire 2026-08-07

SPRING KAFKA BLEEDS CI TIMEOUTS AS PULSAR EYES COMMERCIAL BUILD PARITY

Bump js-yaml from 4.2.0 to 4.3.1 in /javascript spring-projects/spring-security
Bump brace-expansion from 1.1.11 to 1.1.18 in /javascript spring-projects/spring-security
Bump actions/setup-java from 5.6.0 to 5.7.0 spring-projects/spring-security
Bump @springio/antora-extensions from 1.14.12 to 1.14.13 in /docs spring-projects/spring-security

HashiCorp

wire 2026-08-07

CONSUL API GATEWAY FIX STOPS 503 CASCADES IN MULTI-PARTITION SETUPS

Bump google.golang.org/grpc from 1.72.2 to 1.82.1 in /integration-tests hashicorp/consul-dataplane

Elixir & Phoenix

wire 2026-08-06

ELIXIR BUMPS ZIZMOR SECURITY SCANNER TO 1.28.0

Bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 elixir-lang/elixir

FastAPI & Pydantic

wire 2026-08-06

PYDANTIC TIGHTENS NAMED TUPLE VALIDATION, FASTAPI PULLS 12 DEPENDENCY UPDATES

⬆ Bump the python-packages group with 12 updates fastapi/fastapi
⬆ Bump the python-packages group with 7 updates tiangolo/sqlmodel

Agentic Coding

wire 2026-08-05

HITL APPROVAL GATES STOP SILENTLY FAILING OPEN, AIOHTTP FIXES REDIRECT LEAKS ACROSS LANGCHAIN STACK

chore: bump aiohttp from 3.14.1 to 3.14.3 in /libs/langchain langchain-ai/langchain
chore: bump aiohttp from 3.14.1 to 3.14.3 in /libs/partners/xai langchain-ai/langchain
chore: bump aiohttp from 3.14.1 to 3.14.3 in /libs/partners/huggingface langchain-ai/langchain
chore: bump aiohttp from 3.14.1 to 3.14.3 in /libs/partners/fireworks langchain-ai/langchain

Spring

wire 2026-08-05

SPRING INTEGRATION UPGRADES TO CAMEL 4.21.0 AS RELEASE TRAIN AUTOMATION LANDS ACROSS ECOSYSTEM

Bump com.webauthn4j:webauthn4j-core from 0.31.8.RELEASE to 0.31.9.RELEASE spring-projects/spring-security

FastAPI & Pydantic

wire 2026-08-05

PYDANTIC TUNES MODEL BUILDING FOR SPEED WHILE FASTAPI HARDENS CRYPTO

⬆ Bump cryptography from 48.0.1 to 50.0.0 fastapi/fastapi
⬆ Bump gitpython from 3.1.54 to 3.1.57 fastapi/fastapi

Kubernetes

wire 2026-08-04

KUBERNETES DOCS SURGE AHEAD AS GCP PROVIDER TACKLES INFRASTRUCTURE FLAKES

Bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 in the all group kubernetes/release

Node.js

wire 2026-08-04

NODE 26.6.0 AND 24.19.0 LTS LAND WITH FFI EVENT LOOP AND BUFFER STREAMING

chore(deps-dev): bump undici from 7.28.0 to 7.29.0 nodejs/docker-node

Rails

wire 2026-08-04

Rails fixes composite foreign key tracking across counter cache and autosave

Bump activerecord from 8.1.2 to 8.1.3.1 rails/action_push_native
Bump activejob from 8.1.2 to 8.1.3.1 rails/action_push_native
Bump webmock from 3.26.1 to 3.26.2 rails/action_push_native
Bump actions/checkout from 4 to 7 rails/action_push_native

FastAPI & Pydantic

wire 2026-08-04

PYDANTIC TACKLES CORE SCHEMA PERFORMANCE WHILE FASTAPI DOCS GET A UI FIX

⬆ Bump the github-actions group with 6 updates fastapi/fastapi
⬆ Bump the github-actions group with 5 updates tiangolo/sqlmodel
Bump aiohttp from 3.14.1 to 3.14.3 pydantic/pydantic

Agentic Coding

wire 2026-08-04

LANGCHAIN PLUGS RESOURCE LEAK, CLINE ADDS CONTEXT-WINDOW RECOVERY

chore(deps-dev): bump the testing group across 1 directory with 6 updates OpenHands/OpenHands

Spring

wire 2026-08-03

SPRING BOOT SCRUBS OBSOLETE INFLUXDB DOCS AHEAD OF 4.0 RELEASE

Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.2 to 5.6.3 spring-projects/spring-security
Bump commons-codec:commons-codec from 1.22.0 to 1.22.1 spring-projects/spring-ldap

Hugging Face

wire 2026-08-03

LEROBOT FIXES D405 REALSENSE STARTUP HANGS WITH AUTO-RECOVERY

Bump the actions group with 2 updates huggingface/optimum-habana

Rails

wire 2026-08-03

RAILS RESTORES ALIAS_ATTRIBUTE IN ASSOCIATIONS, FIXES SILENT FAILURES

build(deps): bump the github-actions group with 3 updates rails/tailwindcss-rails

FastAPI & Pydantic

wire 2026-08-03

PYDANTIC MAINTENANCE SWEEP TACKLES DEPENDENCY CHAIN

Bump astral-sh/setup-uv from 8.2.0 to 9.0.0 pydantic/pydantic
Bump actions/setup-python from 6.3.0 to 7.0.0 pydantic/pydantic
Bump actions/setup-node from 6.4.0 to 7.0.0 pydantic/pydantic
Bump CodSpeedHQ/action from 4.18.1 to 4.18.5 pydantic/pydantic
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 pydantic/pydantic

Node.js

wire 2026-08-03

NODE CRYPTO UNLOCKS PRIVATE KEY LOADERS, FFI CRASH FIXED BEFORE IT SPREADS

chore(deps): bump the storybook group across 1 directory with 3 updates nodejs/nodejs.org
chore(deps): bump the testing group across 1 directory with 2 updates nodejs/nodejs.org
chore(deps): bump the styling group across 1 directory with 2 updates nodejs/nodejs.org
chore(deps): bump the vercel group across 1 directory with 7 updates nodejs/nodejs.org
chore(deps): bump wrangler from 4.77.0 to 4.114.0 nodejs/nodejs.org
meta: bump c8 from 11.0.0 to 12.0.0 nodejs/doc-kit
meta: bump @playwright/test from 1.60.0 to 1.62.0 nodejs/doc-kit

Elixir & Phoenix

wire 2026-08-03

SQLITE TEST FLAKES FIXED, DATETIME CASTING BREAKING CHANGE LANDS

Bump jsdom from 29.1.1 to 30.0.1 phoenixframework/phoenix
Bump the minor-and-patch group with 2 updates phoenixframework/phoenix

Arch Linux

wire 2026-08-03

FEEDPARSER PATCHES SGMLLIB, BENCODE ADDS DEPTH LIMITS

build(deps): bump feedparser from 6.0.12 to 6.0.14 archlinux/archweb
build(deps): bump bencode-py from 4.0.0 to 4.1.0 archlinux/archweb

HashiCorp

wire 2026-08-03

AWS SDK gets patched across the stack

[chore] : Bump the go group with 7 updates hashicorp/go-getter
[chore] : Bump github.com/hashicorp/go-metrics from 0.6.0 to 0.6.1 in the go group hashicorp/memberlist

Kubernetes

wire 2026-08-03

KOPS HARDENS S3 BOOTSTRAP AND CONDITION LOGIC AS DOCUMENTATION SURGE CONTINUES

Bump the actions group with 4 updates kubernetes/release

Spring

wire 2026-08-02

SPRING BATCH MOVES TO 6.1.0, DEPENDENCY UPDATES ROLL OUT ACROSS ECOSYSTEM

Bump org.apache.groovy:groovy-bom from 5.0.7 to 5.0.8 spring-projects/spring-integration