Sourced from fastlane-plugin-wpmreleasetoolkit's releases.

14.11.0

New Features

• New macos_verify_code_signing action, asserting that macOS artifacts are signed, signed by the expected authority, accepted by Gatekeeper, and have a notarization ticket stapled to them. Handles .app bundles and .dmg disk images, picking the checks that apply to each. #757

Bug Fixes

• StringsFileValidationHelper.find_duplicated_keys now parses unquoted keys/values and inter-token comments, matching the grammar plutil accepts, instead of raising Invalid character. This lets ios_lint_localizations' check_duplicate_keys work on InfoPlist.strings-style files. #741
• ios_lint_localizations' check_duplicate_keys now warns and skips, rather than crashing, on a file that parses as a property list but isn't a tokenizable flat .strings. #741
• L10nHelper.merge_strings now prefixes keys via a comment-aware tokenizer, so unquoted keys, unquoted values, and keys behind an inter-token comment are prefixed in the output consistently with the reported keys. #741
• Bump fastlane to ~> 2.237 to pull in excon >= 1.5.0, fixing CVE-2026-54171 / GHSA-48rx-c7pg-q66r. #754
• upload_github_release_assets: make release lookup more resilient by falling back to GitHub's direct release-by-tag lookup when the releases list does not include the requested release. #753

Internal Changes

• Added regression coverage for upload_github_release_assets direct release lookup errors. #755
• Centralized .strings duplicate-key detection behind StringsFileValidationHelper.scan_for_duplicate_keys, returning a [:scanned | :unsupported_format | :unscannable, payload] tri-state that callers can map to their own warn-and-skip vs fail-closed policy. #741
• L10nHelper.strings_file_type and StringsFileValidationHelper.scan_for_duplicate_keys accept assume_valid: to skip a redundant plutil -lint when the caller has already parsed the file. #741
• Bumped development Ruby version to 3.4.9 #729

Sourced from fastlane-plugin-wpmreleasetoolkit's changelog.

14.11.0

New Features

• New macos_verify_code_signing action, asserting that macOS artifacts are signed, signed by the expected authority, accepted by Gatekeeper, and have a notarization ticket stapled to them. Handles .app bundles and .dmg disk images, picking the checks that apply to each. #757

Bug Fixes

• StringsFileValidationHelper.find_duplicated_keys now parses unquoted keys/values and inter-token comments, matching the grammar plutil accepts, instead of raising Invalid character. This lets ios_lint_localizations' check_duplicate_keys work on InfoPlist.strings-style files. #741
• ios_lint_localizations' check_duplicate_keys now warns and skips, rather than crashing, on a file that parses as a property list but isn't a tokenizable flat .strings. #741
• L10nHelper.merge_strings now prefixes keys via a comment-aware tokenizer, so unquoted keys, unquoted values, and keys behind an inter-token comment are prefixed in the output consistently with the reported keys. #741
• Bump fastlane to ~> 2.237 to pull in excon >= 1.5.0, fixing CVE-2026-54171 / GHSA-48rx-c7pg-q66r. #754
• upload_github_release_assets: make release lookup more resilient by falling back to GitHub's direct release-by-tag lookup when the releases list does not include the requested release. #753

Internal Changes

• Added regression coverage for upload_github_release_assets direct release lookup errors. #755
• Centralized .strings duplicate-key detection behind StringsFileValidationHelper.scan_for_duplicate_keys, returning a [:scanned | :unsupported_format | :unscannable, payload] tri-state that callers can map to their own warn-and-skip vs fail-closed policy. #741
• L10nHelper.strings_file_type and StringsFileValidationHelper.scan_for_duplicate_keys accept assume_valid: to skip a redundant plutil -lint when the caller has already parsed the file. #741
• Bumped development Ruby version to 3.4.9 #729

• 64a0694 Release 14.11.0 into trunk (#758)
• 04e6e26 Bumped to version 14.11.0
• a5c8412 Use Ruby 3.4.9 and re-bundle (#729)
• d43af2d Fix faraday regression to >= 1.10.5 instead of >=1.10.6
• afe31c6 Add changelog entry for Ruby version bump
• cab3b32 Use Xcode 26.6
• c7c1fa0 Use latest Bundler, 4.0.17
• 1cef861 Use latest Fastlane
• b3e85cf Remove Bundler dependency and use Gemfile for dev
• a9ec5d0 Address a ShellCheck issue
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions