Issues

deps-gitlab-ci: SHA-pin update leaves the stale trailing version comment (no comment read, rewrite, or mismatch check)
bug-ops/deps-lsp#1743 · opened on Sep 29, 2026
deps-core: make CommitSha case-canonical and key TagIndex SHA lookups by &CommitSha instead of &str
bug-ops/deps-lsp#1742 · opened on Sep 29, 2026
deps-github-actions: carry the pinned commit as CommitSha inside PinStyle::Sha instead of re-deriving it from version_literal
bug-ops/deps-lsp#1741 · opened on Sep 29, 2026
deps-github-actions: a pre-release tag pin (@v2-beta) is never reported outdated
bug-ops/deps-lsp#1740 · opened on Sep 29, 2026
deps-github-actions: move ClosingDelimiters into the PinStyle::Sha payload so closers are unrepresentable on other pins
bug-ops/deps-lsp#1739 · opened on Sep 29, 2026
deps-core: OSV lookup still takes the version from the comment for a SHA absent from the tag index
bug-ops/deps-lsp#1735 · opened on Sep 29, 2026
deps-github-actions: offer a quickfix for a SHA pinned to the latest release with a wrong version comment
bug-ops/deps-lsp#1734 · opened on Sep 29, 2026
deps-cli: add a --fail-on token for the other diagnostic category
bug-ops/deps-lsp#1733 · opened on Sep 29, 2026
SHA pin marked only by a moving tag (v1, 1.1) is reported up to date although the commit is not the latest
bug-ops/deps-lsp#1730 · opened on Sep 29, 2026
deps-engine: phase B candidate and latest checks should scan every release tag on the candidate's commit
bug-ops/deps-lsp#1727 · opened on Sep 29, 2026
deps-cli: report should name the sibling release tag an advisory matched
bug-ops/deps-lsp#1726 · opened on Sep 29, 2026
GitHub Actions: verify non-release commit pins via the GitHub compare API before reporting outdated
bug-ops/deps-lsp#1725 · opened on Sep 29, 2026
research: should the sibling release-tag scan include cross-major tags on the same commit?
bug-ops/deps-lsp#1719 · opened on Sep 29, 2026
deps-github-actions: rescan documents when a tag move is observed via another document's tag fetch
bug-ops/deps-lsp#1716 · opened on Sep 29, 2026
deps-lsp: lockfile-change OSV rescan path checks vulnerabilities_enabled but not offline
bug-ops/deps-lsp#1710 · opened on Sep 29, 2026
deps-swift: resolve .package(id:) via a Swift Package Registry (SE-0292) client
bug-ops/deps-lsp#1691 · opened on Sep 29, 2026
deps-composer: OR-gap bound derivation re-parses every branch per explicitly_excludes call instead of caching at compile_requirement time
bug-ops/deps-lsp#1623 · opened on Sep 28, 2026
Unfixable items report empty advisory_ids despite fix.advisory_ids being in scope
bug-ops/deps-lsp#1618 · opened on Sep 28, 2026
Research: installer-level cooldown mechanism for auto-following ecosystems (Cargo/Dart/PyPI-default/Swift from:)
bug-ops/deps-lsp#1569 · opened on Sep 27, 2026
Centralize env-override-by-name trust once a second ecosystem needs it
bug-ops/deps-lsp#1459 · opened on Sep 25, 2026
Research: compatibility-score / advisory-based risk data source for automated updates
bug-ops/deps-lsp#1121 · opened on Sep 16, 2026
deps-cli: update grouping config (dependabot.yml groups: equivalent)
bug-ops/deps-lsp#1118 · opened on Sep 16, 2026
deps-cli: git branch/commit/PR creation for automated updates
bug-ops/deps-lsp#1117 · opened on Sep 16, 2026
deps-cli: lockfile regeneration across all 14 ecosystems
bug-ops/deps-lsp#1116 · opened on Sep 16, 2026
Epic: deps-cli as a full Dependabot replacement (write-back capability)
bug-ops/deps-lsp#1114 · opened on Sep 16, 2026