Issues

• pnpm grouped update does not update pnpm-workspace.yaml overrides, leaving direct dependency updates ineffective

  L: javascriptT: bug 🐞
  dependabot/dependabot-core#16529 · Filter by author nyaomaru opened on Oct 10, 2026

• Grouped go_modules updates drop deletions of vendored files (regression from #16290)

  L: dockerL: github:actionsL: go:modulesL: javascriptL: ruby:bundler
  dependabot/dependabot-core#16527 · Filter by author huww98 opened on Oct 10, 2026
  1

• Python 3.15 support

  L: python:uvL: python
  dependabot/dependabot-core#16524 · Filter by author amnesiaof opened on Oct 10, 2026
  1

• Pipenv dependency in both [packages] and [dev-packages] is only updated in default lockfile section

  L: pythonT: bug 🐞
  dependabot/dependabot-core#16523 · Filter by author aoyako opened on Oct 10, 2026

• go_modules: workspace update omits go.mod/go.sum changes required in other go.work members

  L: dockerL: github:actionsL: go:modules
  dependabot/dependabot-core#16519 · Filter by author koba1t opened on Oct 9, 2026

• go_modules: run go list -m all after workspace updates to stabilize committed go.work.sum on Go < 1.28

  L: dockerL: github:actionsL: go:modules
  dependabot/dependabot-core#16518 · Filter by author koba1t opened on Oct 9, 2026
  

• https://github.com/dependabot/dependabot-core.git

  T: feature-request
  dependabot/dependabot-core#16512 · Filter by author mosajunahid220-stack opened on Oct 9, 2026

• uv: resolution errors from uv >= 0.12.14 are no longer recognised (× No solution found regexes)

  L: javascriptL: python:uvL: python
  dependabot/dependabot-core#16510 · Filter by author wenceslas-sanchez opened on Oct 8, 2026
  

• Cooldown - exclude not working for github-actions ecosystem

  L: github:actionsL: php:composerT: bug 🐞
  dependabot/dependabot-core#16502 · Filter by author jrfnl opened on Oct 8, 2026

• Feature request: native manual approval for Dependabot PR workflow execution after dependency review failure

  T: feature-request
  dependabot/dependabot-core#16501 · Filter by author willrichboa opened on Oct 8, 2026

• Python/uv library detection queries public PyPI with private project names despite replaces-base: true

  L: python:uvL: pythonT: bug 🐞
  dependabot/dependabot-core#16500 · Filter by author marcguinovart-sec opened on Oct 8, 2026
  

• pip-compile: files are not ordered by -c constraints, so layered requirements fail to update

  L: pythonT: feature-request
  dependabot/dependabot-core#16499 · Filter by author flodolo opened on Oct 8, 2026

• Composer: don't hold require-dev dependencies of libraries to the lowest PHP version allowed by require.php

  L: php:composerT: feature-request
  dependabot/dependabot-core#16494 · Filter by author marekdedic opened on Oct 7, 2026

• Composer: implicit PHP platform requirement no longer detected for single-version errors since #11245, so no updates are found

  L: php:composer
  dependabot/dependabot-core#16493 · Filter by author marekdedic opened on Oct 7, 2026
  

• Security updates are skipped for dependencies nested inside an npm workspace

  L: javascriptT: bug 🐞
  dependabot/dependabot-core#16491 · Filter by author untitaker opened on Oct 7, 2026
  

• npm: v3 lockfiles emit workspace paths and alias keys as registry dependencies with allow: all

  L: dockerL: javascriptL: ruby:bundler
  dependabot/dependabot-core#16488 · Filter by author myevolve opened on Oct 7, 2026
  5

  

• support updating github/gh-aw-actions/setup-cli with.version value

  L: github:actionsT: feature-request
  dependabot/dependabot-core#16480 · Filter by author setchy opened on Oct 5, 2026

• nix: releases.nixos.org is not on the proxy egress allowlist, breaking channel tarball updates with 403

  L: nixT: bug 🐞
  dependabot/dependabot-core#16479 · Filter by author barsikus007 opened on Oct 5, 2026
  

• pip requirements in one file/group can raise or update the wrong platform

  L: python:uvL: pythonT: bug 🐞
  dependabot/dependabot-core#16476 · Filter by author SProst opened on Oct 4, 2026
  

• GitHub Actions update is 13 hours earlier than the cooldown specifies

  L: nixL: rust:cargoT: bug 🐞
  dependabot/dependabot-core#16455 · Filter by author hashcatHitman opened on Oct 2, 2026
  3

  

• npm security updates time out in VulnerabilityAuditor on a large workspace monorepo (buildDependencyChains path explosion)

  L: javascript
  dependabot/dependabot-core#16451 · Filter by author rcdailey opened on Oct 1, 2026
  

• uv: versioning-strategy: lockfile-only blocks security updates for transitive dependencies (security_update_not_possible)

  L: javascriptL: python:uvL: python
  dependabot/dependabot-core#16449 · Filter by author jspiewak opened on Oct 1, 2026
  1

  

• Support updating .NET tools in workflows

  L: dotnet:dotnet-sdkL: javascriptT: feature-request
  dependabot/dependabot-core#16448 · Filter by author MichielOda opened on Oct 1, 2026

• dependabot for maven wrapper does not use repositories configured in project

  L: java:mavenT: bug 🐞
  dependabot/dependabot-core#16446 · Filter by author pzygielo opened on Oct 1, 2026
  2

  

• npm_and_yarn: transitive security update fails when a lower version of the same package is also in the lockfile

  L: javascriptL: ruby:bundler
  dependabot/dependabot-core#16444 · Filter by author kylemellander opened on Sep 30, 2026