Bump the minor-and-patch group across 1 directory with 2 updates

[dependabot]

Bumps the minor-and-patch group with 2 updates in the /frontend/ios directory: fastlane and cocoapods.

Updates fastlane from 2.237.0 to 2.240.1

Release notes

Sourced from fastlane's releases.

2.240.1 Improvements

• [gem] add cgi gem for Ruby 4 std removal (#30232) via Connor Tumbleson (@​iBotPeaches)
• [deliver] keep an explicitly set platform when a pkg is present (#30224) via Anand Hegde (@​anandghegde)
• [match] upload certs immediatly to storage to prevent desync of files (#30160) via Connor Tumbleson (@​iBotPeaches)
• security gem 0.3.0 integration (#30178) via Jerome Lacoste (@​lacostej)
• build: prevent locking androidpublisher_v3 to 0.99.0 (#30228) via Connor Tumbleson (@​iBotPeaches)
• [tests] Keep the Tempfile, not only its path (#30227) via Jerome Lacoste (@​lacostej)
• [tests] Stop four specs writing into the shared temp root (#30225) via Jerome Lacoste (@​lacostej)
• [tests] Restore the working directory structurally in two specs (#30221) via Jerome Lacoste (@​lacostej)
• [tests] Remove the fixed paths under /tmp from the test suite (#30220) via Jerome Lacoste (@​lacostej)
• build(deps): bump actions/upload-artifact from 4 to 7 (#30222) via dependabot[bot] (@​dependabot[bot])

2.240.0 Improvements

• [fastlane_core] Fix for upload_to_testflight and altool - report failure, but upload succeeds (#30196) via Michal Šrůtek (@​michalsrutek)
• [ci] run full workflows on master as they stack (#30218) via Connor Tumbleson (@​iBotPeaches)
• chore: treat 'both' as 'all' for all 3 platforms (#30214) via Connor Tumbleson (@​iBotPeaches)
• [tests] Give each spec its own scratch directory instead of /tmp/fastlane (#30217) via Jerome Lacoste (@​lacostej)
• [tests] Stop a spec mutating the plist fixture another spec reads (#30215) via Jerome Lacoste (@​lacostej)
• [spaceship] Read the App Store Connect API key from where Apple keeps it now (#30206) via Jerome Lacoste (@​lacostej)
• [tests] Stop two spec files racing for the system clipboard (#30211) via Jerome Lacoste (@​lacostej)
• [spaceship] Say what actually went wrong fetching the App Store Connect API key (#30205) via Jerome Lacoste (@​lacostej)
• [core] Stop hardcoding /tmp where a real path is needed (#30209) via Jerome Lacoste (@​lacostej)
• Run the CI suite as several processes (#30202) via Jerome Lacoste (@​lacostej)
• Run the spec suite as several processes (#30191) via Jerome Lacoste (@​lacostej)
• [fastlane_core] Carry the pty exit status as a value rather than in $? (#30201) via Jerome Lacoste (@​lacostej)
• Stop two specs depending on process wide state another example populated (#30200) via Jerome Lacoste (@​lacostej)
• [spaceship] Use the system temporary directory instead of a literal /tmp (#30197) via Jerome Lacoste (@​lacostej)
• Stop two specs depending on files an earlier run left behind (#30195) via Jerome Lacoste (@​lacostej)
• Report the environment variables that escape the example that set them (#30194) via Jerome Lacoste (@​lacostej)
• Stop nine specs depending on what ran before them (#30193) via Jerome Lacoste (@​lacostej)
• Stop spaceship specs sharing clients and cached state (#30192) via Jerome Lacoste (@​lacostej)
• Stop specs depending on module level configuration another example left behind (#30190) via Jerome Lacoste (@​lacostej)
• build: move to Bundler 2.6.9 (#30185) via Connor Tumbleson (@​iBotPeaches)
• Define only the trainer fixture groups that apply to the current xcresulttool (#30183) via Jerome Lacoste (@​lacostej)
• Surface xcresulttool version detection failures instead of hiding them (#30182) via Jerome Lacoste (@​lacostej)
• Stop the pilot transporter specs querying the real Keychain (#30181) via Jerome Lacoste (@​lacostej)
• Fix flaky fastlane_pty_spec by applying the PTY flush workaround (#30180) via Jerome Lacoste (@​lacostej)
• [gym][scan][snapshot] Add disallow_xcodebuild_settings_lookup option (#30112) via Brett Best (@​Brett-Best)
• [gem] move to rubyzip v3 (#30176) via Connor Tumbleson (@​iBotPeaches)
• chore: update security gem to 0.2.0 (#30177) via Jerome Lacoste (@​lacostej)
• [ci] unset GEM_HOST_API_KEY for GHA publish (#30174) via Connor Tumbleson (@​iBotPeaches)

2.239.0 Improvements

• [supply] list google play releases (#30000) via Tim Shedor (@​tshedor)
• [sigh] Fix duplicate prefix in application-identifier entitlement during resign (#30169) via Shubhransh Gupta (@​shubhransh-gupta)
• [Ruby] Ruby 3.1 is now the minimum (dropping Ruby 3.0) (#30120) via Connor Tumbleson (@​iBotPeaches)
• [deliver/pilot] support app coverage files (#30153) via Connor Tumbleson (@​iBotPeaches)
• [match] prevent leaking keys if invalid usage (#30161) via Connor Tumbleson (@​iBotPeaches)
• [meta] set pr template to drop reference to CircleCI (#30162) via Connor Tumbleson (@​iBotPeaches)
• [deliver] prevent duplicate image uploads (#30150) via Connor Tumbleson (@​iBotPeaches)

... (truncated)

Commits

• 1b9d750 Version bump to 2.240.1 (#30233)
• 354da89 [gem] add cgi gem for Ruby 4 std removal (#30232)
• f05f95e [deliver] keep an explicitly set platform when a pkg is present (#30224)
• d6c0e95 [match] upload certs immediatly to storage to prevent desync of files (#30160)
• cf9422b security gem 0.3.0 integration (#30178)
• 4a52b9a [gem] prevent locking androidpublisher_v3 to 0.99.0 (#30228)
• 3309d41 [tests] Keep the Tempfile, not only its path (#30227)
• bc8a1e0 [tests] Stop four specs writing into the shared temp root (#30225)
• 3b29558 [tests] Restore the working directory structurally in two specs (#30221)
• 88365c6 [tests] Remove the fixed paths under /tmp from the test suite (#30220)
• Additional commits viewable in compare view

Updates cocoapods from 1.16.2 to 1.17.0

Release notes

Sourced from cocoapods's releases.

1.17.0

Enhancements

• Added --no-lint option for pod repo push command to allow skipping Lint phase when publishing a Pod.
  Guillermo Mazzola #12706

• Bump minimum Xcodeproj to 1.28.0.
  Eric Amorde #12913

• Remove unused escape dependency.
  Samuel Giddins, Eric Amorde #12914

Bug Fixes

• Update ruby-macho to 4.1.0 to address new mergable libraries not beind detected correctly.
  Parsa Nasirimehr #12691

• Fix a crash when run with certain versions of active_support.
  Eric Amorde #12915

Changelog

Sourced from cocoapods's changelog.

1.17.0 (2026-07-06)

Enhancements

• Added --no-lint option for pod repo push command to allow skipping Lint phase when publishing a Pod.
  Guillermo Mazzola #12706

• Bump minimum Xcodeproj to 1.28.0.
  Eric Amorde #12913

• Remove unused escape dependency.
  Samuel Giddins, Eric Amorde #12914

Bug Fixes

• Update ruby-macho to 4.1.0 to address new mergable libraries not beind detected correctly.
  Parsa Nasirimehr #12691

• Fix a crash when run with certain versions of active_support.
  Eric Amorde #12915

Commits

• 5493bfd Release 1.17.0
• b80e113 Fixup changelog
• 26fe302 Fix changelog formatting
• 4cd9036 Merge pull request #12915 from CocoaPods/amorde/update-gems
• a3e2c06 Fix active_support crash on certain versions
• 36b8c95 Merge pull request #12914 from CocoaPods/amorde/remove-escape-dependency
• 5cfa2a8 Remove unused escape dependency
• bf410d2 Merge pull request #12913 from CocoaPods/amorde/update-xcodeproj
• 9428644 Merge pull request #12912 from CocoaPods/amorde/ci-updates-followup
• 2843e2e Bump xcodeproj to 1.28.1
• Additional commits viewable in compare view

[seluianova]

💭 I wonder why it says Updates fastlane from 2.237.0 to 2.238.0 in the PR description but fastline was not actually updated...

💭 We also have a mise.toml configuration, which Dependabot currently doesn’t update. I’m not sure if this can be automated, so we may have to update it manually every time (?)

[f1sh1918]

Build still runs
https://app.circleci.com/pipelines/gh/digitalfabrik/entitlementcard/11389/workflows/5513181e-f6c7-4513-a4db-419e0042b304?utm_campaign=vcs-integration-link&utm_medium=referral&utm_content=summary&utm_source=github-checks-link

[seluianova]

We also have a mise.toml configuration, which Dependabot currently doesn’t update

I'm not sure what was the plan for mise, so I won't touch it here. but I created a separate task to establish a single source of truth: #3166

Build still runs

the build runs with the old versions because Dependabot doesn't update the mise configuration used in CI.