v6.0.1

What's Changed

• Bump tar-fs from 2.1.2 to 2.1.3 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #116
• Add .github/dependabot.yml to stop Dependabot scanning test-data/ Maven poms and add cooldowns by @felickz with @Copilot in #135
• Bump vitest from 3.1.3 to 4.1.8 by @dependabot[bot] in #142
• Bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #145
• Bump actions/checkout from 4 to 7 by @dependabot[bot] in #144
• Bump @github/dependency-submission-toolkit from 2.0.4 to 2.0.5 by @dependabot[bot] in #146
• Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #137
• Bump packageurl-js from 1.2.1 to 2.0.1 by @dependabot[bot] in #141
• Bump tar-fs from 2.1.3 to 2.1.5 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #151
• Suppress Dependabot updates for pinned Maven fixtures by @felickz with @Copilot in #153
• Bump the npm-dependencies group with 8 updates / Node 22 by @dependabot[bot] in #152
• Update action runtime from Node.js 20 to Node.js 24 by @felickz with @Copilot in #131
• Bump @types/chai from 4.3.14 to 5.2.3 in the npm-dependencies group by @dependabot[bot] in #154
• Pin transitive undici to ^6.27.0 (GHSA-vxpw-j846-p89q) by @felickz with @Copilot in #155
• Automate tracked releases and floating version tags by @felickz in #156
• Fix reusable release workflow permissions by @felickz in #157
• Fix Node 24 ESM packaging for action bundle by @felickz with @Copilot in #164
• chore: bump version (patch) by @github-actions[bot] in #158

New Contributors

• @felickz with @Copilot made their first contribution in #135
• @felickz made their first contribution in #156
• @github-actions[bot] made their first contribution in #158

Full Changelog: v5.0.0...v6.0.1

v6.0.0-fix

What's Changed

• Automate tracked releases and floating version tags by @felickz in #156
• Fix reusable release workflow permissions by @felickz in #157
• Fix Node 24 ESM packaging for action bundle by @felickz with @Copilot in #164

New Contributors

• @felickz made their first contribution in #156

Full Changelog: v6.0.0...v6.0.0-fix

v6.0.0

What's Changed

• Bump tar-fs from 2.1.2 to 2.1.3 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #116
• Add .github/dependabot.yml to stop Dependabot scanning test-data/ Maven poms and add cooldowns by @felickz with @Copilot in #135
• Bump vitest from 3.1.3 to 4.1.8 by @dependabot[bot] in #142
• Bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #145
• Bump actions/checkout from 4 to 7 by @dependabot[bot] in #144
• Bump @github/dependency-submission-toolkit from 2.0.4 to 2.0.5 by @dependabot[bot] in #146
• Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #137
• Bump packageurl-js from 1.2.1 to 2.0.1 by @dependabot[bot] in #141
• Bump tar-fs from 2.1.3 to 2.1.5 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #151
• Suppress Dependabot updates for pinned Maven fixtures by @felickz with @Copilot in #153
• Bump the npm-dependencies group with 8 updates / Node 22 by @dependabot[bot] in #152
• Update action runtime from Node.js 20 to Node.js 24 by @felickz with @Copilot in #131
• Bump @types/chai from 4.3.14 to 5.2.3 in the npm-dependencies group by @dependabot[bot] in #154
• Pin transitive undici to ^6.27.0 (GHSA-vxpw-j846-p89q) by @felickz with @Copilot in #155
• Enabled feature: Enable release immutability starting with v6.0.0

New Contributors

• @felickz with @Copilot made their first contribution in #135

Full Changelog: v5.0.0...v6.0.0

v5.0.0

Improved multi-module support

This release improves multi-module support by reflecting which pom.xml file brings in a particular dependency. Previously, the dependencies were aggregated into the top-level pom.xml file. If a given package is brought in via multiple modules, that package will be reflected in all of the modules that reference it.

Because of this change in behavior, we've removed two configuration options:

• snapshot-dependency-file-name: no longer applicable since we submit more than one manifest
• snapshot-include-file-name: this flag determined whether the manifest object included the file path. It should always be available and there's no reason to omit it, so we've removed the flag.

v4.1.3

The release bumps dependency versions to stay up-to-date.

v4.1.2

What's Changed

• Add cycle safety for transitive dependencies by @juxtin in #103

New Contributors

• @juxtin made their first contribution in #103

Full Changelog: v4...v4.1.2

v4.1.1

chore: Updating release files

v4.1.0

• Adds the ability to change the detector details for the dependency snapshots via the optional input parameters:

  • detector-name
  • detector-url
  • detector-version

  If the detector-name is specified, then all three become mandatory as there are no sensible defaults that can be attributed to the values.

v4.0.3

• Updating the build process and tooling for Node 20 support in the CLI executables which were introduced when the dependency-submission-toolkit transitioned in to an ESM module

• Fixes #69 #61

v4.0.2

chore: Updating release files