[dependabot]

Bumps appsignal from 4.10.0 to 5.0.7.

Changelog

Sourced from appsignal's changelog.

5.0.7

Published on 2026-10-23.

Security

• Bump the bundled certificates that the agent uses when it can't open the configured CA file. They no longer include the emSign ECC Root CA - G3 and AAA Certificate Services root certificates, which compromised eMudhra intermediate certificates chain to.

  (patch a52c55d9, c8e8ee7e, 4282fa01, 6cd56225, 16972b8a, 78969f02)

5.0.6

Published on 2026-10-22.

Security

• Stop trusting certificates issued under the eMudhra intermediate certificate authorities whose private keys were compromised in October 2026. The bundled CA certificates no longer include the emSign ECC Root CA - G3 root certificate, which those intermediates chain to. (patch a52c55d9, c8e8ee7e, 4282fa01)

5.0.5

Published on 2026-10-14.

Added

• Automatically detect the application's revision from the HEROKU_BUILD_COMMIT environment variable, which is set by Heroku at build time when the runtime-dyno-build-metadata Heroku Labs feature is enabled.

  (patch ab022837)

• Automatically detect the application's revision from the HEROKU_BUILD_COMMIT environment variable, which is set by Heroku at build time when the runtime-dyno-build-metadata Heroku Labs feature is enabled.

  (patch 6fb3cd87)

5.0.4

Published on 2026-10-09.

Fixed

• Fix an issue where transactions would be reused across requests when an error happened before the transaction could be closed, which would lead to errors being returned by the app itself. (patch 65ff0be0)

5.0.3

... (truncated)

Commits

• df1d69b Publish version v5.0.7
• 8b5412d Merge pull request #1643 from appsignal/update-agent/0.37.6
• 78969f0 Shorten the agent certificates changeset
• 16972b8 Update agent to version 0.37.6
• 6cd5622 Publish version v5.0.6
• 4282fa0 Update bundled CA certificates (#1641)
• cac16d5 Publish version v5.0.5
• 6fb3cd8 Update agent to version 0.37.5 (#1637)
• ab02283 Update Heroku's deprecated environment variable (#1635)
• 6cd23c6 Publish version v5.0.4
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)