dependabot / dependabot/dependabot-core
Dependabot's supported Ruby versions list is behind on 3.3, 3.4, and 4.0 patch releases
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 156
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Package ecosystem
Bundler
### Package manager version
Bundler 4.0.13
### Language version
Ruby 3.4.10
### Manifest location and content before the Dependabot update
.ruby-version:
`3.4.10`
### dependabot.yml content
```
version: 2
updates:
- package-ecosystem: "bundler" # See documentation for possible values
directory: "/" # Location of package manifests
schedule:
interval: "weekly"
open-pull-requests-limit: 10
registries:
- github-rubygems
groups:
development-dependencies:
dependency-type: "development"
exclude-patterns:
- "rubocop*"
- "rspec*"
update-types:
- "patch"
- "minor"
patch-updates:
dependency-type: "production"
update-types:
- "patch"
rubocop-dependencies:
patterns:
- "rubocop*"
```
### Updated dependency
_No response_
### What you expected to see, versus what you actually saw
Expected Dependabot to resolve and update dependencies normally, since 3.4.10 is a supported, current Ruby patch release.
Instead, Dependabot reported:
> Dependabot detected the following ruby requirement for your project: '~> 3.4.10'. Currently, the following ruby versions are supported in Dependabot: 1.8.7, 1.9.3, 2.0.0, 2.1.10, 2.2.10, 2.3.8, 2.4.10, 2.5.9, 2.6.10, 2.7.8, 3.0.7, 3.1.7, 3.2.11, 3.3.11, 3.4.9, 4.0.5.
The job checks every dependency in the manifest and fails identically on each one once it hits the Ruby version check. The first dependency it failed on was debug (in the development-dependencies group), then it proceeded to fail the same way on the remaining dependencies checked (brakeman, byebug, rails, puma, nokogiri, sidekiq, rubocop, and 30+ others) before the job aborted. In total 42 dependencies failed with the identical tool_version_not_supported error.
Handled error whilst updating debug:
> tool_version_not_supported {"tool-name": "ruby", "detected-version": "~> 3.4.10", "supported-versions": "1.8.7, 1.9.3, 2.0.0, 2.1.10, 2.2.10, 2.3.8, 2.4.10, 2.5.9, 2.6.10, 2.7.8, 3.0.7, 3.1.7, 3.2.11, 3.3.11, 3.4.9, 4.0.5"}
This isn't isolated to 3.4. The same gap exists across three Ruby branches I'm tracking:
Branch | Dependabot's supported version | Actual current version
-- | -- | --
3.3 | 3.3.11 | 3.3.12 (released 2026-07-16)
3.4 | 3.4.9 | 3.4.10 (released 2026-06-30)
4.0 | 4.0.5 | 4.0.6 (released 2026-07-14)
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
_No response_
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.