Update dependency fastlane to v2.241.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
fastlane (source, changelog)	2.240.1 → 2.241.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

fastlane/fastlane (fastlane)

v2.241.0: Improvements

Compare Source

• [ci] build: skip changelog from markdown link detection (#​30426) via Connor Tumbleson (@​iBotPeaches)
• [meta] validate the screengrab Gradle wrapper jars on CI (#​30422) via Jerome Lacoste (@​lacostej)
• [fastlane_core] spec fixtures: build the verify_build apps at spec time instead of committing them (#​30421) via Jerome Lacoste (@​lacostej)
• [fastlane] search plugins in bundler transitive dependencies as well (#​20293) via Jerome Lacoste (@​lacostej)
• [snapshot] remove ScreenshotRotate and ScreenshotFlatten, unused since 2015 (#​30405) via Jerome Lacoste (@​lacostej)
• [ci] release signed attested fastlane gem (#​30416) via Connor Tumbleson (@​iBotPeaches)
• [action] increment_build_number, increment_version_number: escape the number given to agvtool (#​30406) via Jerome Lacoste (@​lacostej)
• [action] sonar: escape the scanner's property values (#​30409) via Jerome Lacoste (@​lacostej)
• [ci] remove creation of fastlane/* tag (#​30417) via Connor Tumbleson (@​iBotPeaches)
• [ci] move to v0.8.0 of fastlane/github-actions (#​30418) via Connor Tumbleson (@​iBotPeaches)
• [resign] escape the version options (#​30407) via Jerome Lacoste (@​lacostej)
• [action] danger: escape the base, head, pr, danger_id and dangerfile values (#​30408) via Jerome Lacoste (@​lacostej)
• [core][produce][supply] remove classes no code uses (#​30411) via Jerome Lacoste (@​lacostej)
• [spaceship] remove TestFlight::AppTestInfo, its endpoint is gone (#​30412) via Jerome Lacoste (@​lacostej)
• [scan] deprecate TestResultParser, scan no longer uses it (#​30413) via Jerome Lacoste (@​lacostej)
• [docs] add the OpenSSF Scorecard badge to the README (#​30414) via Jerome Lacoste (@​lacostej)
• [ci] release step 1: declare the write permissions on its job (#​30415) via Jerome Lacoste (@​lacostej)
• [core] zip_directory: escape the paths it passes to cd, rm and zip (#​30400) via Jerome Lacoste (@​lacostej)
• [action] push_to_git_remote: escape push option values (#​30401) via Jerome Lacoste (@​lacostej)
• [action] sourcedocs: escape option values (#​30402) via Jerome Lacoste (@​lacostej)
• [action] set_pod_key: escape the key, value and project (#​30403) via Jerome Lacoste (@​lacostej)
• [action] oclint: analyse sources whose path has a space, and escape paths (#​30404) via Jerome Lacoste (@​lacostej)
• [action] verify_pod_keys: pass the key and target to pod keys as separate arguments (#​30397) via Jerome Lacoste (@​lacostej)
• [action] lcov, xcode_server_get_assets: deprecate, they no longer work with current Xcode (#​30399) via Jerome Lacoste (@​lacostej)
• [action] appium: start the server with its path, host and port as separate arguments (#​30398) via Jerome Lacoste (@​lacostej)
• [action] ensure_no_debug_code: escape the pattern, path and exclude pattern (#​30396) via Jerome Lacoste (@​lacostej)
• [deliver][snapshot][screengrab][scan] open HTML reports without a shell (#​30395) via Jerome Lacoste (@​lacostej)
• [action] xcodebuild: escape the build log path given to tee and cat (#​30394) via Jerome Lacoste (@​lacostej)
• [scan] escape values that were single-quoted in the test command (#​30393) via Jerome Lacoste (@​lacostej)
• [gym] escape values that were single-quoted in the build and package commands (#​30392) via Jerome Lacoste (@​lacostej)
• [action] nexus_upload: give curl the credentials on stdin, not on its command line (#​30387) via Jerome Lacoste (@​lacostej)
• [match] git storage: give a raw private key to ssh-add on stdin (#​30382) via Jerome Lacoste (@​lacostej)
• [ci] pin GitHub Actions to commit SHAs and default every workflow's token to read-only (#​30371) via Jerome Lacoste (@​lacostej)
• [snapshot][core] simulator commands: keep paths with spaces as one argument (#​30391) via Jerome Lacoste (@​lacostej)
• [gym] zip the dSYM when the archive name contains an apostrophe (#​30390) via Jerome Lacoste (@​lacostej)
• [action] install_xcode_plugin: deprecate, and download over HTTPS into a private temporary directory (#​30377) via Jerome Lacoste (@​lacostej)
• [action] splunkmint, apteligent: deprecate, their services were retired (#​30385) via Jerome Lacoste (@​lacostej)
• [core] sh: accept data for the command's standard input (#​30386) via Jerome Lacoste (@​lacostej)
• [scan] escape the build log path given to tee (#​30389) via Jerome Lacoste (@​lacostej)
• [core] fastlane_require: install only the gem that was asked for (#​30383) via Jerome Lacoste (@​lacostej)
• [action] import_from_git: mask git_extra_headers in the printed git command (#​30384) via Jerome Lacoste (@​lacostej)
• [match] git storage: pass the authorization header through git's environment (requires git 2.31+ with git_basic_authorization/git_bearer_authorization) (#​30381) via Jerome Lacoste (@​lacostej)
• [sigh] resign: stop when the ipa contains a link to a file outside it (#​30380) via Jerome Lacoste (@​lacostej)
• [action][pem][spaceship] replace fixed temporary names with mktmpdir (#​30375) via Jerome Lacoste (@​lacostej)
• [spaceship] keep the App Store Connect key cache in the user's fastlane directory (#​30376) via Jerome Lacoste (@​lacostej)
• [swift] Add Swift tests for the runner, and run them in CI (#​30370) via Jerome Lacoste (@​lacostej)
• [action] appaloosa: upload the binary over the presigned URL's scheme (#​30372) via Jerome Lacoste (@​lacostej)
• Make the Swift Package Manager runner work without SwiftShell (#​29238) (#​30075) via Wei (@​wei18)
• [swift] Warn when the built FastlaneRunner is outdated (#​30367) via Jerome Lacoste (@​lacostej)
• [swift] Rebuild the runner when one of its Swift files changes, not only the Fastfile (#​30366) via Jerome Lacoste (@​lacostej)
• [meta] prefill the regression issue title and label instead of asking for it in the README (#​30364) via Jerome Lacoste (@​lacostej)
• [meta] migrate files out of root (#​30351) via Connor Tumbleson (@​iBotPeaches)
• [match, supply, zip] mark the options holding secrets as sensitive (#​30363) via Jerome Lacoste (@​lacostej)
• [internal] move the docs tooling from fastlane/helper to internal/docs (#​30361) via Jerome Lacoste (@​lacostej)
• [internal] check links in Markdown files in validate_docs (#​30360) via Jerome Lacoste (@​lacostej)
• [action] push_to_git_remote: push HEAD on a detached HEAD, not the local copy of CI's branch (#​30346) via Jerome Lacoste (@​lacostej)
• [docs] fix links to sections that no longer exist (#​30359) via Jerome Lacoste (@​lacostej)
• [core] name the option in the options table's mask, e.g. API_TOKEN_REDACTED (#​30357) via Jerome Lacoste (@​lacostej)
• [core] name the option in masked output, e.g. API_TOKEN_REDACTED (#​30356) via Jerome Lacoste (@​lacostej)
• [core] Mask sensitive values in everything fastlane prints (#​30355) via Jerome Lacoste (@​lacostej)
• [action] upload_to_testflight, upload_to_app_store: upload the binary gym built, not the newest one in the current directory (#​30345) via Jerome Lacoste (@​lacostej)
• [meta] remove danger (#​30352) via Connor Tumbleson (@​iBotPeaches)
• [core] use suggested ruby version instead of hard-coded version (#​30350) via Connor Tumbleson (@​iBotPeaches)
• [action] clean_build_artifacts: say that cert's private key and signing request are kept (#​30347) via Jerome Lacoste (@​lacostej)
• [meta] remove duplicate contact link for security submission (#​30349) via Connor Tumbleson (@​iBotPeaches)
• [docs] introduce SECURITY.md (#​30348) via Connor Tumbleson (@​iBotPeaches)
• [action] github_api, xcode_server_get_assets: skip SSL verification only for their own requests (#​30342) via Jerome Lacoste (@​lacostej)
• [action] say: speak apostrophes as written (#​30341) via Jerome Lacoste (@​lacostej)
• [fastlane] import_from_git: escape the branch when updating a cached clone (#​30340) via Jerome Lacoste (@​lacostej)
• [action] hg_commit_version_bump: pass a message containing quotes intact (#​30339) via Jerome Lacoste (@​lacostej)
• [core] remove contents of file(s) in fastlane env (#​30338) via Connor Tumbleson (@​iBotPeaches)
• [internal] Derive which cops the plugin template's RuboCop config drops (#​30337) via Jerome Lacoste (@​lacostej)
• [ci] Enable Security/Open (#​30336) via Jerome Lacoste (@​lacostej)
• [spaceship] Say why Apple refused to sign in, and send the refused sign-in once (#​30320) via Jerome Lacoste (@​lacostej)
• [docs] Add AGENTS.md, testing instructions for specs, and a code-review skill (#​30334) via Jerome Lacoste (@​lacostej)
• [docs] Testing.md: a spec for a fix has to fail without the fix (#​30333) via Jerome Lacoste (@​lacostej)
• [docs] Add Design.md, the conventions action changes are reviewed against (#​30332) via Jerome Lacoste (@​lacostej)
• [ci] Let RuboCop read its target Ruby from fastlane.gemspec (#​30326) via Jerome Lacoste (@​lacostej)
• [ci] Upgrade RuboCop to 1.91.0 (#​30325) via Jerome Lacoste (@​lacostej)
• [match] Stop the change_password spec writing to the developer's login keychain (#​30328) via Jerome Lacoste (@​lacostej)
• [ci] Build fastlane's own cops on RuboCop::Cop::Base (#​30303) via Jerome Lacoste (@​lacostej)
• [ci] prefix automated spec timings commit w/ [ci] (#​30321) via Connor Tumbleson (@​iBotPeaches)
• [core] Print the fastlane version, Ruby and install source at the start of each run (#​30322) via Jerome Lacoste (@​lacostej)
• [build] update to require_tools 0.3.0 (#​30053) via Connor Tumbleson (@​iBotPeaches)
• [register_device] action can run on macOS platform too (#​21229) via Tony Li (@​crazytonyli)
• Record the spec timings the split is balanced from (#​30319) via github-actions[bot] (@​github-actions[bot])
• [core][sigh][action] Decode provisioning profiles with Ruby's OpenSSL, without touching a keychain (#​30317) via Jerome Lacoste (@​lacostej)
• [match] Stop the read-only runner spec depending on the machine's keychain (#​30314) via Jerome Lacoste (@​lacostej)
• [ci] Stop naming the two deliberately invalid Ruby files .rb (#​30313) via Jerome Lacoste (@​lacostej)
• [ci] Keep the minimum Ruby in Fastlane::MINIMUM_RUBY, and check CI tests it (#​30302) via Jerome Lacoste (@​lacostej)
• [match] ask for the git branch during match init (#​30297) via Hamza Naveed (@​Hamza0101)
• [spaceship] Read the App Store Connect API key on every login, not from the cache first (#​30296) via Jerome Lacoste (@​lacostej)
• [spaceship] Show Apple's reason when it cannot start two-factor authentication (#​30298) via Jerome Lacoste (@​lacostej)
• [ci] Publish test coverage per tool as the job summary (#​30295) via Jerome Lacoste (@​lacostej)
• [tests] Remove unused WebMock stubs and fixtures (#​30288) via Jerome Lacoste (@​lacostej)
• [tests] Merge coverage across parallel workers, replace coveralls with SimpleCov 1.2 (#​30290) via Jerome Lacoste (@​lacostej)
• [tests] Report WebMock stubs that no example requests (#​30287) via Jerome Lacoste (@​lacostej)
• [core] Hide the loading indicator even when the work raises (#​30279) via Jerome Lacoste (@​lacostej)
• [ci] build: let Dependabot manage feature updates for GHA only (#​30285) via Connor Tumbleson (@​iBotPeaches)
• build(deps): bump naturally from 2.2.1 to 2.3.0 (#​30277) via dependabot[bot] (@​dependabot[bot])
• build(deps): bump mime-types from 3.5.2 to 3.7.0 (#​30276) via dependabot[bot] (@​dependabot[bot])
• build(deps): bump excon from 1.5.0 to 1.6.0 (#​30274) via dependabot[bot] (@​dependabot[bot])
• build(deps): bump aws-sdk-s3 from 1.212.0 to 1.232.1 (#​30275) via dependabot[bot] (@​dependabot[bot])
• build(deps): bump artifactory from 3.0.15 to 3.0.17 (#​30273) via dependabot[bot] (@​dependabot[bot])
• [xcodebuild] Pass build setting values to xcodebuild unchanged (#​30282) via Jerome Lacoste (@​lacostej)
• [security] Fix seven more CodeQL alerts (#​30281) via Jerome Lacoste (@​lacostej)
• [security] Fix the two critical CodeQL alerts (#​30280) via Jerome Lacoste (@​lacostej)
• [tests] Check that every Ruby version in CI meets the minimum (#​30283) via Jerome Lacoste (@​lacostej)
• build(deps): bump excon from 0.112.0 to 1.5.0 (#​30270) via dependabot[bot] (@​dependabot[bot])
• [notify] move to v3 of terminal-notifier (#​30259) via Connor Tumbleson (@​iBotPeaches)
• build(deps): bump yard from 0.9.42 to 0.9.44 (#​30269) via dependabot[bot] (@​dependabot[bot])
• [Ruby] Ruby 3.2 is now the minimum (dropping Ruby 3.1) (#​30260) via Connor Tumbleson (@​iBotPeaches)
• Render the team table from one ERB template (#​30266) via Jerome Lacoste (@​lacostej)
• [meta] feat: introduce alumni (inactive) team members (#​30261) via Connor Tumbleson (@​iBotPeaches)
• [scan] introduce option to reduce collecting diagnostics (#​30258) via Connor Tumbleson (@​iBotPeaches)
• Fix Raise typo in Device validation guard (#​30255) via Ary Rabelo (@​aryrabelo)
• [match][sigh][spaceship] add support for Apple offline provisioning profiles (#​27547) via doronz88 (@​doronz88)
• [produce] Support App Store Connect API key for create/enable_services/disable_services (#​30158) via jakerenshawballys (@​jakerenshawballys)
• [spaceship] Add support for domain association with Apple Pay merchant IDs, domain verify method(s) (#​30230) via jack (@​signalmoroll)
• Record the spec timings the split is balanced from (#​30253) via github-actions[bot] (@​github-actions[bot])
• [ci] Open a pull request with the recorded spec timings (#​30252) via Jerome Lacoste (@​lacostej)
• [tests] Rename WORKERS to FASTLANE_SPEC_WORKERS (#​30251) via Jerome Lacoste (@​lacostej)
• [ci] Run the random order split weekly, keep recording timings quarterly (#​30250) via Jerome Lacoste (@​lacostej)
• [tests] Add a rake task that runs spec files against each other to find races (#​30246) via Jerome Lacoste (@​lacostej)
• [tests] Report the slowest files and examples after a parallel run (#​30245) via Jerome Lacoste (@​lacostej)
• [tests] Stop cutting heavy spec files into runs of examples (#​30247) via Jerome Lacoste (@​lacostej)
• [tests] Stop two pty examples depending on what $? happens to hold (#​30249) via Jerome Lacoste (@​lacostej)
• [tests] Stop the frameit config spec depending on /tmp existing (#​30248) via Jerome Lacoste (@​lacostej)
• [docs] Say what CI runs, and catalogue the ways the split breaks specs (#​30241) via Jerome Lacoste (@​lacostej)
• [spaceship] Say what the initialize rule is actually protecting (#​30238) via Jerome Lacoste (@​lacostej)
• [spaceship] Record the platform Merchant and WebsitePush were fetched with (#​30237) via Jerome Lacoste (@​lacostej)
• [ci] Upload the worker logs on every run (#​30235) via Jerome Lacoste (@​lacostej)
• [spaceship] Assert the error class instead of negating a different one (#​30234) via Jerome Lacoste (@​lacostej)

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Gemfile

Artifact update for fastlane resolved to version 2.241.1, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 2.241.0
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

📱 QA build

Download	app-qa-debug.apk
QR code	Open the QR code for this download
Commit	3e2b648
Version	17832
Available until	7 days after this build

The QA build installs alongside a released Nextcloud app, so you can keep
using your existing install while testing.

Downloading the file requires a GitHub account, so open this link on the
device you want to test on, or transfer the APK to it.