* feat(manager/ant): add registry URL discovery from settingsFile and remoteRepository
Read Maven registry URLs from settingsFile attribute on dependency
blocks (parsed via Maven's extractRegistries) and from inline
<remoteRepository url="..." /> elements. Registries are merged,
deduplicated, and scoped to their dependency block.
* update java docs
* fix coverage
* apply suggestions
* fix ci issues
* fix(workers/repository): don't include `skipReason`'d dependencies in flattened updates
When we're preparing the final, flattened, list of branches to prepare
updates for, we're not filtering out any dependencies that have a
`skipReason` in them.
In the case that, as part of future changes like #42510, a `skipReason`
may be added after the `lookup` phase, we can still get PRs raised even
when they shouldn't be.
We already filter out `enabled=false`, so we should make sure to also
filter anything with a `skipReason`.
* feat(osv): mark malicious packages with `skipReason`s
As part of current ongoing supply chain attacks, there have been cases
where Renovate updates packages to a malicious version.
We'll be introducing a more in-depth means to surface these, including
from different API sources, as part of the Enrichment functionality,
but in the short-term we can utilise osv.dev's ingestion of OpenSSF's
Malicious Packages data.
To do this, we need to:
- look for any `MAL-` advisories
- match it against the current dependency's version, and if affected, mark it
as `skipReason: malicious-version-in-use` (which will be unset in
the `lookup()` function, so we still perform updates
- match it against the dependency's available updates, and if any are
affected, mark the dependency
as `skipReason: malicious-update-proposed`
* fixup! feat(osv): mark malicious packages with `skipReason`s
* fixup! feat(osv): mark malicious packages with `skipReason`s
* test(workers/repository): add missing coverage
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
* chore: simplify type
* wip-opus
* Revert "wip-opus"
This reverts commit e7b5f297c9.
* simplify
* sq
* sq
* fixup
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
* docs: add Community Tools page with Renovate Operator
* docs(readme): link to Community Tools page
* docs(running): add link to community tools
---------
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io>
* docs: explicitly document `depTypes` each manager supports
A long-standing question we receive is "what `depTypes` can I match
against in my project".
Although the best recommendation we usually have is "check the
`packageFiles with updates" log line (as a very key log line for users),
we can go one step further and try and create a stronger contract.
To do this, I've used Claude Sonnet 4.6 to work through the codebase,
determine areas that a `depType` is set in a manager (statically or
dynamically) and generate a structured, typed, means to document how
they're used.
Through a few iterations of the process, and attempts at human-written
documentation, we've settled on:
- prioritising autogenerated documentation (for humans to read) to note
what `depTypes` are known, and what they are
- `knownDepTypes`, to describe any known, static, `depType`s and their
human-readable meaning
- with the `prettyDepType`, if used
- `supportsDynamicDepTypesNote`, to add a Markdown note to the generated
documentation
While here, we also:
- make sure to note this in the "adding a new package manager"
documentation
- remove any hand-written references to `depTypes` in each manager's
documentation page
- correct the Gleam `depTypes`
- make sure to use the `knownDepTypes`'s `prettyDepType` definition if
we know it, for a given `depType`
The descriptions have been generated by Claude Sonnet, with some
human-written tweaks where appropriate.
[0]: https://github.com/renovatebot/renovate/discussions/15176
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! docs: explicitly document `depTypes` each manager supports
* docs(manager): display `depTypes` documentation if none present
For consistency, and to make it more explicit.
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(datasource): add elm-package datasource
* refactor(elm): inline test fixtures
* fix(elm): correct import ordering in test file
* fix(elm): use zod/v3 import to match codebase conventions
* refactor(elm): rename types.ts to schema.ts
Follow project convention of using schema.ts for zod schema files.
* test(elm): add test for invalid JSON response
Use v8 ignore if directive and add test covering the null result
path when the API returns invalid JSON.
* refactor(elm): remove unreachable null check
* test(elm): add test for default registry URL fallback
* refactor(elm): guard against missing registryUrl instead of fallback
* fix(elm): handle ZodError gracefully instead of throwing
* feat(elm): add package cache for elm-package datasource
* feat(manager/npm): pass --before to npm install when minimumReleaseAge is set
* use logger metadata
* Apply suggestion from @viceice
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
---------
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* fix(cache): instrument repository cache load and save
Wrap repository cache `load()` and `save()` calls with the existing
`instrument()` helper to create OpenTelemetry spans for cache lifecycle
operations. This gives operators visibility into repository cache
performance, especially useful with S3 backends.
Refs #41760
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cache): instrument package cache init and destroy
Wrap package cache `init()` and `destroy()` with `instrument()` to
create OpenTelemetry spans, matching the repository cache instrumentation
from the previous commit. Covers redis, sqlite, and file backends.
Refs #41760
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* docs: document cache lifecycle tracing in OpenTelemetry guide
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Move destroy() outside init instrument span
Avoids nesting the package-cache.destroy span inside
package-cache.init, making them sibling spans instead.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Use 'verb NounClass' span naming convention
Rename instrument span names from dot-notation (e.g.
'package-cache.init') to 'verb NounClass' pattern (e.g.
'init PackageCache') per reviewer feedback.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: port Ubuntu versioning support to Debian container images
Resolves#27862.
Signed-off-by: Alexander Gil <pando855@gmail.com>
* refactor: Remove dead code in debian versioning
Signed-off-by: Alexander Gil <pando855@gmail.com>
* refactor: Rename groups to match
* perf: optimize isStable method by reusing getVersionByCodename result
* fix(debian): specify radix in parseInt for dated container image version
---------
Signed-off-by: Alexander Gil <pando855@gmail.com>
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io>
Add template compilation support for sourceUrl in package rules,
allowing users to dynamically construct source URLs using template
syntax. This enables use cases like OpenTofu providers where the
source URL needs to be constructed from the package name.
* feat(exec): register bazelisk as containerbase tool
* test(bazel-module): add failing tests for updateArtifacts
* feat(bazel-module): implement updateArtifacts for lockfile support
* feat(bazel-module): export updateArtifacts from manager index
* fix(bazel-module): address code review feedback
- Use logger.warn instead of debug for artifact errors
- Add utf8 encoding to readLocalFile calls
- Use getSiblingFileName for lockfile path derivation
- Add empty updatedDeps guard
- Strengthen test assertions
* docs(bazel-module): document lockfile support
* Update lib/modules/manager/bazel-module/index.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Apply suggestions from code review
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* fix(bazel-module): address review feedback
- Remove unnecessary afterEach in tests
- Use partial<StatusResult> for all StatusResult mocks
- Add lockfile maintenance support
- Export supportsLockFileMaintenance flag
* fix(bazel-module): handle untracked lock files and clarify docs
Check status.not_added alongside status.modified for lock file changes,
matching the pattern used by other managers (composer, gomod, etc.).
Clarify that Bazelisk (not Renovate) reads .bazelversion. Add test for
lockfile maintenance with no changes.
* feat(bazelisk): implement updateArtifacts for MODULE.bazel.lock
When the Bazel version in .bazelversion changes, run `bazel mod deps` to
regenerate MODULE.bazel.lock and return the updated lockfile as an artifact.
* feat(bazelisk): add lockfile maintenance support
* docs(bazelisk): add lockfile support section linking to bazel-module docs
* refactor(bazel-module): extract shared lockfile update helper
* refactor(bazel-module): delegate lockfile update to shared helper
Replace inline lockfile update logic in artifacts.ts with a call to the
shared updateBazelLockfile() helper, and update tests to mock the helper.
* refactor(bazelisk): delegate lockfile update to shared helper
Replace inline lockfile update logic in bazelisk/artifacts.ts with a
call to the shared updateBazelLockfile() helper from bazel-module/lockfile.ts.
* fix(bazelisk): use index.md for cross-manager docs link
The docs pipeline renames readme.md to index.md, so cross-manager
links must reference index.md to pass the docs link checker.
* feat(bazel-module,bazelisk): support bazelisk version constraint
Pass config.constraints.bazelisk through to toolConstraints so users
can pin the bazelisk version if the newest release is broken.
* fix(bazel-module): rename lockFile to fileName in ArtifactError
Upstream renamed lockFile to fileName in ArtifactError type (#41631).
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
This also makes sure that our URL fragments should be more consistent
over the years, as duplicate names (across parent and child options)
cannot clash.
This also corrects links from the code to include the new fragment.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
As it was in the middle of the `customManagers` documentation.
As it's now in the correct place, we need to re-sort the headers so the
`customDatasources` options are in the right place.
Jamie Tanna