* ci(linter): add renovate/require-regex-util rule
Adds a custom oxlint rule that flags raw RegExp usage in lib/
production code: any `new RegExp(...)` call and any regex literal
that is not the direct first argument of `regEx(...)`. The regEx()
helper from lib/util/regex.ts uses the RE2 engine for ReDoS-safe
matching and caches compiled patterns. lib/util/regex.ts itself is
exempt.
The rule is disabled for **/*.spec.ts, test/**, and tools/** via
config overrides, because vitest APIs such as expect.stringMatching
need bare RegExp instances (a past commit reverted regEx() there).
Severity is set to "warn" instead of "error": the repo currently has
197 pre-existing violations (above the agreed mechanical-fix
threshold of 80), and a number of them are deliberately
RE2-incompatible patterns (lookahead/lookbehind/named backreferences,
see TODO #12872/#12875 markers in e.g. lib/modules/versioning/rez/
pattern.ts and lib/modules/manager/dockerfile/extract.ts) that need
per-site judgment before they can be wrapped in regEx() or suppressed
with a justified disable comment. No violation fixes are included in
this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci(linter): enforce renovate/require-regex-util at error
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor: use regEx() for regex literals and RegExp construction in lib
Burn down all renovate/require-regex-util violations (197):
- wrap RE2-compatible regex literals and RegExp constructions in regEx()
- rewrite lookaround patterns where behavior is provably preserved:
goproxy separator split, sbt-package link extraction, leiningen
comment stripping and keyword search, npm GitHub owner validation
(unit-count bound replaced by an explicit length check)
- keep native RegExp with disable comments where RE2 cannot be used:
moo / good-enough-parser lexer patterns (moo rejects RE2 instances),
MigrationsService propertyName (matched via isRegExp, which RE2
instances fail), rez named backreferences and lookaheads, GitHub
markdown link negative lookbehind, emoji astral-plane matching
- drop stale TODO #12875 comments for patterns current re2 handles
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor: reduce require-regex-util disable comments
Rewrite the github massage-markdown-links URL regex to capture an
optional `api.` prefix in a named group (skipped in code) instead of
relying on a negative lookbehind, so both the base and global variants
can use regEx()/RE2 and their two disable comments are removed. Add
spec cases for api-prefixed URLs that match the URL shape.
Consolidate the four related line disables in rez/pattern.ts (bound and
range patterns emulating Python conditional patterns via named
backreferences and lookaheads, which RE2 cannot express) into a single
block disable/enable pair, matching the treatment of the lexer files.
Disable comment count drops from 13 to 8.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor(datasource/sbt-package): use named capture group in link regex
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor(manager/cake): restore original multiLineComment regex spelling
The [^] -> [\\s\\S] rewrite was only needed for an RE2 wrap that was
later reverted; keep the diff minimal.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(datasource/go): skip empty GOPROXY segments
The switch from a lookahead split to a capture-group split (needed because
RE2 has no lookahead support) changed how empty GOPROXY segments parse:
`a|,b` yielded `{ url: ',', fallback: '|' }` before and
`{ url: '', fallback: ',' }` after. The comma fallback only continues on
404/410, so a failing proxy ahead of an empty segment silently stopped the
lookup instead of falling through to the remaining proxies.
Empty segments carry no url to query, so drop them.
* refactor(datasource/go): use isTruthy for empty segment filter
* fix(datasource/go): filter empty segments before mapping
Filtering after the map broke the contextual typing from the
GoproxyItem[] annotation, widening fallback to string.
* refactor(platform/github): use regEx() for merge queue query stripping
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(manager/hermit): propagate git credentials to hermit install
hermit install runs without git auth, failing silently for packages
hosted in private repos. Spread getGitEnvironmentVariables(['hermit'])
into extraEnv, matching the pattern used by cargo, gomod, poetry,
copier, vendir, and conan managers.
Passing ['hermit'] as additionalHostTypes ensures hostRules configured
with hostType: 'hermit' are picked up alongside the standard platform
host types.
Also guards against undefined stderr in the outer catch block —
non-UpdateHermitError exceptions rendered "undefined" in PR comments.
* test(manager/hermit): cover non-Error thrown value fallback
Exercise the String(err) branch in the generic error handler when
a non-Error value propagates from updateHermitPackage.
* fix: address review comments on hermit git auth
Remove unnecessary spread operator from getGitEnvironmentVariables() result
assignment and apply one-sentence-per-line docs convention.
* test: ensure we set `binarySource=global`
As part of future changes, we'll correctly return the default value from
`GlobalConfig.get`, instead of `undefined` if no default is provided in
the `get` call.
As `binarySource=install` is the default, this then leads to these tests
failing, as they're intended to run with `binarySource=global`.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! test: ensure we set `binarySource=global`
* fixup! fixup! test: ensure we set `binarySource=global`
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
As `fileName` makes more sense (as it's not always a lock file we're
updating).
Also, if you set `fileName`, it would never actually output the
filename.
This renames the usages of `lockFile` to `fileName`.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
This has been deprecated since 2022-07, and is unused as we only ever
use UTF-8.
In `tools/utils/exec.ts` we make sure to specify it explicitly, so we
don't get a Buffer returned.
* feat: add Hermit package manager
* fix: pass bin directory into getRepoStatus as string rather than an array
* fix: fix up hermit manager implementations
* add docker support in exec
* move fs related operations back into util/fs
* remove ENVVar passed on by process.env
* set concurrency in pMap
* use for instead of pMap for concurrency = 1
* use regex to pick up package reference parts
* fix: fix manager updateArtifacts test after change
* Update lib/modules/manager/hermit/extract.ts
Co-authored-by: Philip <42116482+PhilipAbed@users.noreply.github.com>
* fix: fix up test and docker reference for hermit manager
* test refer to internal fs
* docker image change to sidecar
* only symlink are read for the changed file content after hermit
install
* no more global mock in artifacts test
* fix: use warn instead of error so error better flows up in hermit manager
* fix: partial for test type, use throw instead of reject
* fix: update snapshot
* fix: combine install packages, also make extractPackageFile async
* fix: remove weird generated readLocalSynmlink in test
* fix: removes old test
* fix: use ensureLocalPath and fix test coverage
* fix: more test coverage
* fix: use ensureLocalPath in readLocalSymlink
* Apply suggestions from code review
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* fix: remove unused functions and types
* Apply suggestions from code review
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Apply suggestions from code review
Co-authored-by: Sergei Zharinov <zharinov@users.noreply.github.com>
* fix: use execSnapshots and for of loop when returning the result
* Update lib/modules/manager/hermit/artifacts.spec.ts
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* fix: move exports below imports
Co-authored-by: Philip <42116482+PhilipAbed@users.noreply.github.com>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
Co-authored-by: Sergei Zharinov <zharinov@users.noreply.github.com>
Sebastian Poxhofer