Coding Tools
Dependabot adds npm 12, pnpm 11/12, and Bun 1.4 support
GitHub Changeloghigh confidence
Why it matters
- →Enables automated security patching for projects using the latest npm, pnpm, and Bun versions.
- →Critical for developers who migrated to newer package managers but lacked Dependabot integration.
- →Security scanning is currently broken for pnpm 12 users due to YAML format detection issues.
GitHub has updated Dependabot to support npm version 12, pnpm versions 11 and 12, and Bun version 1.4. This update is available for all github.com users and will be included in GitHub Enterprise Server 3.24. However, a known limitation exists for pnpm 12: because it writes pnpm-lock.yaml as two YAML documents by default, the dependency graph currently fails to detect dependencies in that file. Consequently, while version updates continue, Dependabot alerts and security updates are not generated for affected dependencies, and existing alerts may close. GitHub is actively working on a fix for this detection issue.
Read originalThe story around this
Earlier coverage that leads up to this article, and what followed. Lines connect each piece to the closest one after it, converging here.
How we got here
- 1Dependabot Adds Default Package Cooldown
GitHub Changelog · July 14, 2026 · Related
What happened next
- 2Dependabot API adds dependency versions
GitHub Changelog · October 20, 2026 · Related
More in Coding Tools
Coding Toolscoding
Claude Code v2.1.316: Subagents and Gateway Budgets
Anthropic is tightening control over Claude Code's autonomous behavior with new environment variables that let you disable 'ultrathink' or cap subagent effort levels. For teams, the introduction of pooled group budgets on the gateway allows shared monthly spending limits across members, a practical fix for enterprise cost management. The release also patches critical bugs where shell commands would hang or crash on exit, stabilizing the developer experience significantly.
Claude Code Releases
Coding Toolscoding
llama.cpp b12022 adds ROCm 10 and Snapdragon support
This release quietly cements llama.cpp as the universal inference runtime by finally bringing ROCm 10.0 to Linux and Windows alongside CUDA 13.4, effectively closing the hardware gap for AMD users who were previously left behind. The inclusion of native Snapdragon support on Linux marks a significant step toward running local LLMs on ARM-based mobile chips without emulation overhead. While KleidiAI on Apple Silicon is disabled in this build, the broader expansion to diverse accelerators ensures that developers aren't locked into NVIDIA ecosystems anymore.