Skip to content

Release 2.1.256 (2026-10-22)

Bug fixes

  • build failed-command messages from CalledProcessError fields (#3438) Python 3.15 changed str(subprocess.CalledProcessError): an argv list is no longer quoted. User-facing messages were built from that stdlib text, so they changed between interpreters and test_vrg_package failed on 3.15.

Add lib/process_errors.py: command_text (moved from update_deps/failure.py), failure_message, failure_detail and error_text, which build the message from cmd, returncode, stderr and stdout. GitHubAPIError.str now uses failure_detail, so every handler that prints a GitHubAPIError is version-independent too. Route every site that interpolated str() or {exc} of a CalledProcessError through the helper, and assert the helper's own format in the tests.

Chores

  • uv lock --upgrade

Features

  • enable alerts fleet-wide and add vrg-dependabot-audit (#3435)

  • feat(repo-config): enable Dependabot alerts in the desired security posture

  • feat(dependabot): add vrg-dependabot-audit, failing on any open Dependabot alert

  • canonical report-only dependabot.yml, scaffolding, validate guard and fleet sync (#3436)

  • feat(dependabot): render the canonical report-only dependabot.yml and scaffold it in new repos

  • feat(validate): reject any dependabot.yml entry that could open a PR

  • feat(dependabot): sync dependabot.yml per repo and across the fleet

  • test(dependabot): type the fleet-sync target test helper for the type checker

CI Evidence: All gates passed — full audit bundle available. Download →