v0.138.4

[thepwagner]

Patch release containing these commits

And these PRs:

• Bundler 2: Add native helpers for LockfileUpdater #3326
• Fix flaky npm spec by checking requirements array #3337
• The PR MessageBuilder requires a github_redirection_service to be specified #3301
• Bundler 2: [Prerelease] Implement v2 native functions for LatestVersionFinder #3327
• Bundler 2: [Prerelease] Add version resolver #3319
• Bundler [Prerelease]: Add force updater helpers #3329
• Attempt to fix npm install timing out ci builds #3338
• Make code coverage optional via an envvar #3339
• Bundler req replacer not equal #3344
• Bundler 2 [pre-release]: Add UpdateChecker #3349
• Update npm from 7.6.1 to 7.7.4 #3331
• docker: valid Accept header #3352

[brrygrdn]

LGTM!

[feelepxyz]

Looks like #3351 snuck in also.

Would be nice to have something in place to prevent this from happening or rejig our workflow. This has happened a few times recently with release PRs waiting for CI.

[thepwagner]

Would be nice to have something in place to prevent this from happening or rejig our workflow

Small change: we could just tag from the branch's tip instead of tagging the merge commit?

Bigger change: orienting around GitHub releases might be interesting - this "double-check my release notes" style of PR could perhaps be a "draft release".

For this build in particular I'm going to stick with tagging the merge commit as I don't fear #3351 (it actually sounds rather useful!). Thanks for flagging.