dependabot / dependabot/dependabot-core

Dependabot's supported Ruby versions list is behind on 3.3, 3.4, and 4.0 patch releases

Open
#16,111 0 comments 0 reactions 1 assignee Claimed by @v-robaiken View on GitHub
L: javascript L: ruby:bundler T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 14h
Merged PRs (30d)
156

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

Bundler

### Package manager version

Bundler 4.0.13

### Language version

Ruby 3.4.10

### Manifest location and content before the Dependabot update

.ruby-version:

`3.4.10`

### dependabot.yml content

```
version: 2
updates:
- package-ecosystem: "bundler" # See documentation for possible values
directory: "/" # Location of package manifests
schedule:
interval: "weekly"
open-pull-requests-limit: 10
registries:
- github-rubygems
groups:
development-dependencies:
dependency-type: "development"
exclude-patterns:
- "rubocop*"
- "rspec*"
update-types:
- "patch"
- "minor"
patch-updates:
dependency-type: "production"
update-types:
- "patch"
rubocop-dependencies:
patterns:
- "rubocop*"
```

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

Expected Dependabot to resolve and update dependencies normally, since 3.4.10 is a supported, current Ruby patch release.

Instead, Dependabot reported:

> Dependabot detected the following ruby requirement for your project: '~> 3.4.10'. Currently, the following ruby versions are supported in Dependabot: 1.8.7, 1.9.3, 2.0.0, 2.1.10, 2.2.10, 2.3.8, 2.4.10, 2.5.9, 2.6.10, 2.7.8, 3.0.7, 3.1.7, 3.2.11, 3.3.11, 3.4.9, 4.0.5.

The job checks every dependency in the manifest and fails identically on each one once it hits the Ruby version check. The first dependency it failed on was debug (in the development-dependencies group), then it proceeded to fail the same way on the remaining dependencies checked (brakeman, byebug, rails, puma, nokogiri, sidekiq, rubocop, and 30+ others) before the job aborted. In total 42 dependencies failed with the identical tool_version_not_supported error.

Handled error whilst updating debug:

> tool_version_not_supported {"tool-name": "ruby", "detected-version": "~> 3.4.10", "supported-versions": "1.8.7, 1.9.3, 2.0.0, 2.1.10, 2.2.10, 2.3.8, 2.4.10, 2.5.9, 2.6.10, 2.7.8, 3.0.7, 3.1.7, 3.2.11, 3.3.11, 3.4.9, 4.0.5"}

This isn't isolated to 3.4. The same gap exists across three Ruby branches I'm tracking:

Branch | Dependabot's supported version | Actual current version
-- | -- | --
3.3 | 3.3.11 | 3.3.12 (released 2026-07-16)
3.4 | 3.4.9 | 3.4.10 (released 2026-06-30)
4.0 | 4.0.5 | 4.0.6 (released 2026-07-14)

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.