We've been happily using this with Mend Renovate Self-Hosted customers
since introduction in 2024, and so we're happy making this
non-experimental now.
This follows other changes where we've promoted an experimental option
to non-experimental, and heavily driven by Claude Sonnet 4.5.
We can also rename config item to use the same `repositoryCache` prefix.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* feat(nuget): add supportsLockFileMaintenance flag
The NuGet manager supports lock file maintenance via `packages.lock.json`
but was missing the `supportsLockFileMaintenance` export.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(manager): add lockFileNames metadata to all lock file managers
Add `lockFileNames` field to `ManagerApi` interface and export it from
all 24 managers that support lock file maintenance. This metadata will
be used to auto-generate the lock file support table in docs.
Also adds a validation test ensuring managers with
`supportsLockFileMaintenance` always provide `lockFileNames`.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(docs): auto-generate lockFileMaintenance lock files table
Replace the hardcoded lock file support table in configuration-options.md
with autogenerate markers and generate it from manager metadata during
docs build. This ensures the table stays in sync with manager code
automatically.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This change introduces a heap size limitation for the Gradle daemon used
when updating the Gradle wrapper, defaults to 512m.
The heap size is limited to the globally configured limit, which
defaults to 512m. It can be configured on the repository level, but not
exceed the globally configured limit. A hard coded mimiumum heap size of
512m is enforced.
The configuration option is named `toolSettings`, which has two
properties for the maximum and initial heap size. See
`docs/usage/configuration-options#toolSettings` for more details.
As noted in #40126, after recent investment in OpenTelemetry support in
Renovate, we should update our documentation to provide a more visible
example of what this looks like, some of the different data that may be
present now, and clarify the stability status.
We can also point to npm packages, rather than the source GitHub repo,
for OpenTelemetry libraries.
As noted in #40747, we have now explicitly deprecated
`binarySource=docker`.
This has been not recommended since 2023-07, and now we're noting that
it shouldn't be used any more.
We can make sure to mark any Docker-related self-hosted configuration as
deprecated, and add a custom deprecation warning (and URL for feedback)
to usages of `binarySource=docker`, so config validation flags these
deprecated usages.
As noted in #38604, future changes to `useCloudMetadataServices` will
need to refer to this configuration before we've fully initialised
Renovate.
To simplify this, we can nudge users to only specify it through the
environment.
As a safety measure for self-hosted administrators, we can make sure
that we set `allowedUnsafeExecutions` to not allow any commands by
default.
This closes off a significant risk of executing Gradle Wrapper
commands, which use the repository's copy of the wrapper, and any
Gradle buildscript, when executing, which can lead to significant remote
code execution, even before you take into account malicious dependencies.
As this is now off-by-default, we can enable it by default in our tests
to make sure that there are minimal changes required.
To make sure that we're using secure defaults, we can make sure that
this is off-by-default.
Self-hosted administrators will be able to turn this back in if they
wish.
As noted in #40716, we should provide more in-depth documentation about
Renovate's JSON Schemas as they are very useful for editor/agent
autocomplete.
Additionally, as part of the Renovate 43 release, it's something that
would be useful to link out to.
* fix(manager/mise): expand file patterns to match mise's config search
Updates mise manager file patterns to align with the official mise configuration file search patterns. The patterns now include:
- Additional config locations (.config/mise/, .config/mise.toml)
- Legacy rtx.toml files
- Environment-specific configs (e.g., mise.production.toml)
- Local configs (e.g., mise.local.toml)
This ensures Renovate detects all mise configuration files that mise itself recognizes.
* CR
* Use brace expansions in the patterns
* Fix stupid typo
feat(renovate-config-validator): automagically detect global configuration
A long-standing issue with `renovate-config-validator` has been that
setting global configuration options such as `RENOVATE_ALLOWED_ENV` or
`RENOVATE_ALLOWED_COMMANDS` has no effect.
To make it possible to validate alongside the `config.js` (or other
self-hosted global configuration) as well as setting environment
variables while performing validation, we can ensure that we partially
initialise the `GlobalConfig`.
We can also make sure that this is documented as part of this change.
Functionality such as authenticating to the platform to retrieve remote
presets will be done at a future point.
* registryAlias for bazel-module oci.pull
* use getDep from dockerfile manager instead
* expand testing for oci.pull
* test: merge autoReplaceStringTemplate assertion into registryAliases test
* move assertion to other test
* Update lib/modules/manager/bazel-module/extract.spec.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
Michael Kriese