diff --git a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md index 01d39a3ada2b..344796e6c249 100644 --- a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md +++ b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md @@ -258,6 +258,9 @@ The table below shows the package managers that support `cooldown`. The `default | {% ifversion dependabot-julia-support %} | | Julia | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | | {% endif %} | +| {% ifversion dependabot-kotlin-toolchain-support %} | +| Kotlin Toolchain | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | +| {% endif %} | | Maven | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | | {% ifversion dependabot-nix-support %} | | Nix flakes | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | @@ -309,8 +312,32 @@ If you need to use more than one block in the configuration file to define updat ## `enable-beta-ecosystems` {% octicon "versions" aria-label="Version updates only" height="24" %} +{% ifversion dependabot-kotlin-toolchain-support %} + +By default, {% data variables.product.prodname_dependabot %} updates the dependency manifests and lock files only for fully supported ecosystems. Use the `enable-beta-ecosystems` flag to opt in to updates for ecosystems that are not yet generally available. + +Ecosystems currently in {% data variables.release-phases.public_preview %}: + +* Kotlin Toolchain (`kotlin-toolchain`) + +```yaml copy +# Configure an ecosystem in public preview + +version: 2 +enable-beta-ecosystems: true +updates: + - package-ecosystem: "kotlin-toolchain" + directory: "/" + schedule: + interval: "weekly" +``` + +{% else %} + Not currently in use. +{% endif %} + ## `groups` {% octicon "versions" aria-label="Version updates" height="24" %} {% octicon "shield-check" aria-label="Security updates" height="24" %} Define rules to create one or more sets of dependencies managed by a package manager, to group updates into fewer, targeted pull requests. For examples, see [AUTOTITLE](/code-security/tutorials/secure-your-dependencies/optimizing-pr-creation-version-updates). @@ -589,6 +616,9 @@ Package manager | YAML value | Supported versions | | {% data variables.product.prodname_actions %} | `github-actions` | Not applicable | | Go modules | `gomod` | v1 | | Gradle | `gradle` | Not applicable | +| {% ifversion dependabot-kotlin-toolchain-support %} | +| Kotlin Toolchain | `kotlin-toolchain` | >=v0.11 | +| {% endif %} | | Maven | `maven` | Not applicable | | {% ifversion dependabot-nix-support %} | | Nix flakes | `nix` | Not applicable | diff --git a/data/features/dependabot-kotlin-toolchain-support.yml b/data/features/dependabot-kotlin-toolchain-support.yml new file mode 100644 index 000000000000..53c676a6d4ac --- /dev/null +++ b/data/features/dependabot-kotlin-toolchain-support.yml @@ -0,0 +1,6 @@ +# Reference: https://github.com/dependabot/dependabot-core/pull/16203 +# Kotlin Toolchain support for Dependabot +versions: + fpt: '*' + ghec: '*' + ghes: '>3.22' diff --git a/data/reusables/dependabot/dependabot-updates-supported-versioning-tags.md b/data/reusables/dependabot/dependabot-updates-supported-versioning-tags.md index 68cfa4e6717d..09db8850e9ef 100644 --- a/data/reusables/dependabot/dependabot-updates-supported-versioning-tags.md +++ b/data/reusables/dependabot/dependabot-updates-supported-versioning-tags.md @@ -45,6 +45,9 @@ The `dependabot.yml` file doesn't control the versioning tags that you can use, | {% ifversion dependabot-julia-support %} | | Julia | `julia` | Any SemVer prerelease identifier (commonly `rc`, `DEV`, `beta`) | `HTTP@1.10.0-rc1`, `Plots@2.0.0-DEV`, `DataFrames@1.6.0-beta.1` | | {% endif %} | +| {% ifversion dependabot-kotlin-toolchain-support %} | +| Kotlin Toolchain | `kotlin-toolchain` | `alpha`, `a`, `beta`, `b`, `milestone`, `m`, `rc`, `cr`, `snapshot`, `ga`, `final`, `release`, `sp` (case-insensitive) | `kotlin-toolchain@0.12.0-dev-4188`, `kotlinx-coroutines-core@1.10.0-RC`, `ktor-server-core@3.0.0-rc-1` | +| {% endif %} | | {% ifversion dependabot-nix-support %} | | Nix | `nix` | None—tracks flake input commits (no versioning scheme) | `nixpkgs@a1b2c3d`, `devenv@e4f5a6b`, `flake-utils@c7d8e9f` | | {% endif %} | diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md index d3f3716f5143..ce715b7ab327 100644 --- a/data/reusables/dependabot/supported-package-managers.md +++ b/data/reusables/dependabot/supported-package-managers.md @@ -29,6 +29,9 @@ git submodule | `gitsubmodule` | Not applicable | {% octicon "check" aria-lab [{% data variables.product.prodname_actions %}](#github-actions) | `github-actions` | Not applicable | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | Not applicable | Go modules | `gomod` | v1 | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | [Gradle](#gradle) | `gradle` | Not applicable | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | +| {% ifversion dependabot-kotlin-toolchain-support %} | +[Kotlin Toolchain](#kotlin-toolchain) ({% data variables.release-phases.public_preview %}) | `kotlin-toolchain` | >=v0.11 | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | +| {% endif %} | [Maven](#maven) | `maven` | Not applicable | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | | {% ifversion dependabot-nix-support %} | [Nix](#nix) | `nix` | Not applicable | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | Not applicable | Not applicable | @@ -163,6 +166,27 @@ The `helm-registry` type only supports HTTP Basic Auth and does not support OCI- When configuring {% data variables.product.prodname_dependabot %} for Helm charts, it will also automatically update the Docker images referenced within those charts, ensuring that both the chart versions and their contained images stay up to date. +{% ifversion dependabot-kotlin-toolchain-support %} + +### Kotlin Toolchain + +{% data variables.product.prodname_dependabot %} support for Kotlin Toolchain is in {% data variables.release-phases.public_preview %}. To enable it, set `enable-beta-ecosystems: true` in your `dependabot.yml` file. For more information, see [`enable-beta-ecosystems`](/code-security/reference/supply-chain-security/dependabot-options-reference#enable-beta-ecosystems-). + +{% data variables.product.prodname_dependabot %} reads the toolchain version from the `kotlin` and `kotlin.bat` wrapper scripts in your project. Versions 0.11 and later are supported. + +{% data variables.product.prodname_dependabot %} updates Maven dependencies in the following files without running the toolchain: + +* `project.yaml` +* `module.yaml` +* `*.module-template.yaml` +* `libs.versions.toml` or `gradle/libs.versions.toml` + +{% data variables.product.prodname_dependabot %} also updates the `kotlin` and `kotlin.bat` wrapper scripts when a new toolchain version is available. Kotlin Toolchain projects don't use a lockfile. + +Private registry support uses the `maven-repository` type, including `replaces-base`. For more information, see `maven-repository` in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries#maven-repository). + +{% endif %} + ### Maven {% data variables.product.prodname_dependabot %} doesn't run Maven but supports updates to `pom.xml` files.