Bump fastlane-plugin-wpmreleasetoolkit from 13.8.1 to 14.11.0

[dependabot]

Bumps fastlane-plugin-wpmreleasetoolkit from 13.8.1 to 14.11.0.

Release notes

Sourced from fastlane-plugin-wpmreleasetoolkit's releases.

14.11.0

New Features

• New macos_verify_code_signing action, asserting that macOS artifacts are signed, signed by the expected authority, accepted by Gatekeeper, and have a notarization ticket stapled to them. Handles .app bundles and .dmg disk images, picking the checks that apply to each. #757

Bug Fixes

• StringsFileValidationHelper.find_duplicated_keys now parses unquoted keys/values and inter-token comments, matching the grammar plutil accepts, instead of raising Invalid character. This lets ios_lint_localizations' check_duplicate_keys work on InfoPlist.strings-style files. #741
• ios_lint_localizations' check_duplicate_keys now warns and skips, rather than crashing, on a file that parses as a property list but isn't a tokenizable flat .strings. #741
• L10nHelper.merge_strings now prefixes keys via a comment-aware tokenizer, so unquoted keys, unquoted values, and keys behind an inter-token comment are prefixed in the output consistently with the reported keys. #741
• Bump fastlane to ~> 2.237 to pull in excon >= 1.5.0, fixing CVE-2026-54171 / GHSA-48rx-c7pg-q66r. #754
• upload_github_release_assets: make release lookup more resilient by falling back to GitHub's direct release-by-tag lookup when the releases list does not include the requested release. #753

Internal Changes

• Added regression coverage for upload_github_release_assets direct release lookup errors. #755
• Centralized .strings duplicate-key detection behind StringsFileValidationHelper.scan_for_duplicate_keys, returning a [:scanned | :unsupported_format | :unscannable, payload] tri-state that callers can map to their own warn-and-skip vs fail-closed policy. #741
• L10nHelper.strings_file_type and StringsFileValidationHelper.scan_for_duplicate_keys accept assume_valid: to skip a redundant plutil -lint when the caller has already parsed the file. #741
• Bumped development Ruby version to 3.4.9 #729

14.10.0

New Features

• android_prune_orphaned_translations action: removes <string>, <string-array> and <plurals> entries from values-*/strings.xml whose keys are not declared in the source values/strings.xml optionally unioned with additional_source_strings_paths. #734

Bug Fixes

• Bump faraday and nokogiri to address security vulnerabilities. #749
• Bump concurrent-ruby to address CVE-2026-54904 / GHSA-h8w8-99g7-qmvj. #751

14.9.0

New Features

• upload_github_release_assets action: uploads assets on an existing GitHub release without disturbing unrelated assets. If assets exists already, it replaces them. #743

14.8.0

New Features

• find_or_create_pull_request action: returns the URL of the open Pull Request for a head branch, creating one only if none exists yet. #733
• ContinuousBuildCodeFormatter: derives an Android Play Store versionCode for a "continuous trunk" release model as (major * 10 + minor) * 10^build_digits + build_number (default build_digits: 6). #735

14.7.0

New Features

• Added new update_apps_cdn_build_metadata action to update metadata (e.g. visibility) of one or more existing builds on the Apps CDN without re-uploading the files, via the dedicated /wpcom/v2/sites/{site_id}/a8c-cdn/builds/{post_id} endpoint. Accepts an array of post_ids. This enables a two-phase release flow: upload builds as Internal first, then flip to External at publish time. #701

Bug Fixes

• openai_ask: avoid logging sensitive tool diagnostics and refuse to execute additional tool calls after max_tool_iterations. #719
• Bump the fastlane floor to ~> 2.235 to pull in jwt >= 3.2.0, fixing GHSA-c32j-vqhx-rx3x (ruby-jwt empty-key HMAC bypass). #728

... (truncated)

Changelog

Sourced from fastlane-plugin-wpmreleasetoolkit's changelog.

14.11.0

New Features

• New macos_verify_code_signing action, asserting that macOS artifacts are signed, signed by the expected authority, accepted by Gatekeeper, and have a notarization ticket stapled to them. Handles .app bundles and .dmg disk images, picking the checks that apply to each. #757

Bug Fixes

• StringsFileValidationHelper.find_duplicated_keys now parses unquoted keys/values and inter-token comments, matching the grammar plutil accepts, instead of raising Invalid character. This lets ios_lint_localizations' check_duplicate_keys work on InfoPlist.strings-style files. #741
• ios_lint_localizations' check_duplicate_keys now warns and skips, rather than crashing, on a file that parses as a property list but isn't a tokenizable flat .strings. #741
• L10nHelper.merge_strings now prefixes keys via a comment-aware tokenizer, so unquoted keys, unquoted values, and keys behind an inter-token comment are prefixed in the output consistently with the reported keys. #741
• Bump fastlane to ~> 2.237 to pull in excon >= 1.5.0, fixing CVE-2026-54171 / GHSA-48rx-c7pg-q66r. #754
• upload_github_release_assets: make release lookup more resilient by falling back to GitHub's direct release-by-tag lookup when the releases list does not include the requested release. #753

Internal Changes

• Added regression coverage for upload_github_release_assets direct release lookup errors. #755
• Centralized .strings duplicate-key detection behind StringsFileValidationHelper.scan_for_duplicate_keys, returning a [:scanned | :unsupported_format | :unscannable, payload] tri-state that callers can map to their own warn-and-skip vs fail-closed policy. #741
• L10nHelper.strings_file_type and StringsFileValidationHelper.scan_for_duplicate_keys accept assume_valid: to skip a redundant plutil -lint when the caller has already parsed the file. #741
• Bumped development Ruby version to 3.4.9 #729

14.10.0

New Features

• android_prune_orphaned_translations action: removes <string>, <string-array> and <plurals> entries from values-*/strings.xml whose keys are not declared in the source values/strings.xml optionally unioned with additional_source_strings_paths. #734

Bug Fixes

• Bump faraday and nokogiri to address security vulnerabilities. #749
• Bump concurrent-ruby to address CVE-2026-54904 / GHSA-h8w8-99g7-qmvj. #751

14.9.0

New Features

• upload_github_release_assets action: uploads assets on an existing GitHub release without disturbing unrelated assets. If assets exists already, it replaces them. #743

14.8.0

New Features

• find_or_create_pull_request action: returns the URL of the open Pull Request for a head branch, creating one only if none exists yet. #733
• ContinuousBuildCodeFormatter: derives an Android Play Store versionCode for a "continuous trunk" release model as (major * 10 + minor) * 10^build_digits + build_number (default build_digits: 6). #735

14.7.0

New Features

• Added new update_apps_cdn_build_metadata action to update metadata (e.g. visibility) of one or more existing builds on the Apps CDN without re-uploading the files, via the dedicated /wpcom/v2/sites/{site_id}/a8c-cdn/builds/{post_id} endpoint. Accepts an array of post_ids. This enables a two-phase release flow: upload builds as Internal first, then flip to External at publish time. #701

... (truncated)

Commits

• 64a0694 Release 14.11.0 into trunk (#758)
• 04e6e26 Bumped to version 14.11.0
• a5c8412 Use Ruby 3.4.9 and re-bundle (#729)
• d43af2d Fix faraday regression to >= 1.10.5 instead of >=1.10.6
• afe31c6 Add changelog entry for Ruby version bump
• cab3b32 Use Xcode 26.6
• c7c1fa0 Use latest Bundler, 4.0.17
• 1cef861 Use latest Fastlane
• b3e85cf Remove Bundler dependency and use Gemfile for dev
• a9ec5d0 Address a ShellCheck issue
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dangermattic]

	1 Warning
⚠️	PR is not assigned to a milestone.

Generated by 🚫 Danger

[wpmobilebot]

📲 You can test the changes from this Pull Request in Simplenote Android by scanning the QR code below to install the corresponding build.

	App Name	Simplenote Android
	Build Type	Debug
	Commit	0b78bb0
	Direct Download	simplenote-android-prototype-build-pr1853-0b78bb0-019fa270-1009-48d6-b084-1dcfb4e985b8.apk

[dependabot]

Superseded by #1855.