To harden Renovate from being able to access internal hosts, we can add
a level of enforcement on all outgoing requests.
We can split this into two types of traffic:
- where the response becomes configuration (i.e. `extends`)
- where the response does not become configuration (i.e.
`customDatasources`)
To harden this, we enforce on every outbound HTTP request:
- check the resolved URL before anything, including cache lookups, can
proceed
- catching IP-literal hosts in every spelling the WHATWG URL parser normalizes
- blocking known Cloud metadata IPs, too
- a `dnsLookup` wrapper validates every address a hostname resolves to,
on every new connection, which also defeats DNS rebinding
- a `beforeRedirect` hook re-runs the URL check on each redirect
target, with the new host getting its own grant lookup rather than
inheriting the original host's verdict
We default this enforcement to `warn`, to not break existing deployments
and instead give them visibility into required configuration before a
future major version (major+1) enables `block` by default.
We'll also remove allow in a future major version (major+2), to give
time for admins to migrate over.
When a request is blocked, this degrades like an unreachable registry,
so a Renovate run isn't aborted by a blocked request.
As part of this, we can also provide a worked example of the different
cases that do/do not need allowing via `hostRules`.
Requests through an admin-configured proxy resolve DNS at the proxy, so
`dnsLookup` never runs for them, so we can resolve the hostname locally
and validate every address before the request instead.
This doesn't catch everything, especially as the proxy may resolve the
name to a different result, and if we can't resolve the name - possible
in locked-down corporate environments - we fail open.
Child processes aren't currently able to route traffic through
Renovate's HTTP layer, so are unrestricted.
Co-authored-by: Claude Fable 5 <jamie.tanna+claude-code@mend.io>
Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io>
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
Adds a custom oxlint rule renovate/v8-ignore-no-count that flags the
count form '/* v8 ignore next <N> */'. The count is not honored by
vitest's ast-v8-to-istanbul hint parser, which captures only the
keyword (if/else/next/file); 'next' always exempts exactly the next
AST node. Trailing counts therefore suggest a line range that is never
applied and mislead readers.
The rule is autofixable (drops the count, preserving actual behavior)
and has been applied to all existing occurrences.
* fix(datasource): replace getJsonUnchecked with validated getJson in misc+merge-confidence group
Replaces all getJsonUnchecked calls with Zod-validated getJson calls in:
- crate: adds CrateMetadataSchema to existing schema.ts
- conan: uses existing ConanJSON schema directly
- puppet-forge: new schema.ts with PuppetModuleSchema
- conda: new schema.ts with CondaPackageSchema
- repology: new schema.ts with RepologyPackagesSchema
- jenkins-plugins: new schema.ts, parameterizes helper with ZodType<T>
- custom/formats/json: uses z.unknown() for user-defined responses
- merge-confidence: adds inline MergeConfidenceResponseSchema
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: correct nullable/optional schema fields for crate, jenkins-plugins, puppet-forge
- crate: remove .optional() from all CrateMetadata fields to match string|null type
- jenkins-plugins: use .default({}) instead of .optional() for plugins fields so schemas match required Record types; widen ZodType input to unknown; update JenkinsPluginVersion.releaseTimestamp to Timestamp|null to match MaybeTimestamp output
- puppet-forge: change releases from .optional() to .default([]) to match Release[] type
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore: migrate zod/v3 imports to zod/v4 in misc datasources and merge-confidence
Update remaining zod/v3 imports in files added/modified by the getJsonUnchecked
migration to use zod/v4 as required after the upstream migration.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore minor improvements
* remove unnecessary types and reintroduce nullable where necessary
* refactor: move logic into transform
* test: add tests to improve coverage
* chore removed some unused types
* remove type declaration
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Renames `lookupName` to be `packageName`.
BREAKING CHANGE: Use `packageName` instead of `lookupName` if interacting with Renovate datasources directly.
Moves datasource, manager, platform and versioning code from lib/ into new lib/modules/
BREAKING CHANGE: External tools must update paths to datasource, manager, platform and versioning
Jamie Tanna