Wrap `expect` calls that sat directly in `describe` bodies in their
own `it` blocks (gomod and haskell-cabal extract/index specs), then
re-enable the rule.
Part of #43845
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Add distinct hints to the multi-snapshot tests flagged by the rule
and regenerate the affected snapshot files, then re-enable the rule.
Part of #43845
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* fix(manager/nuget): detect MSBuild SDK updates in sqlproj files
MSBuild SDK versions in `<Sdk>`, `<Import Sdk>`, and `<Project Sdk>`
elements are exact pins, but NuGet versioning treats bare versions as
minimum ranges (`>=`). That caused dependencies such as
`0.1.19-preview` to resolve to the latest release and skip updates.
Apply hybrid versioning to all `msbuild-sdk` dependencies at extract
time: use strict `semver` when the pin is valid semver, otherwise fall
back to `semver-coerced` for non-standard NuGet version strings (e.g.
four-segment revisions). Also add `.sqlproj` to the default manager
file patterns for SSDT SQL projects.
Changes:
- Add `applyMsbuildSdkVersioning()` helper and wire it through all
msbuild-sdk extract paths (XML, global.json, single-csharp-file)
- Extend `managerFilePatterns` to match `.sqlproj` files
- Add extract, util, index, and integration tests
- Document `.sqlproj` and MSBuild SDK extraction in nuget docs/readme
* fix(manager/nuget): use bump range strategy for msbuild-sdk deps
Replace hybrid semver versioning for MSBuild SDK pins with a default
package rule (`matchDepTypes: msbuild-sdk`, `rangeStrategy: bump`) per
review feedback. Remove `applyMsbuildSdkVersioning()` from all extract
paths and update tests accordingly. Sort nuget doc file extensions
alphabetically.
* fix: deno lockfile update in presence of private registries
Renovate was unable to update the lockfile when updating packages from
public registries if any packages from private registries were
referenced in the package file.
This commit fixes this by processing host rules and configuring the
`deno install` invocation for those private registries.
Note that this still doesn't mean support for updating packages from
private registries, it just unblocks lockfile updates in projects where
private registries are used in parallel to public registries.
* fixup! fix: deno lockfile update in presence of private registries
* fix(manager/mise): install resolver tools during mise lock
When binarySource=install, Containerbase only installs tools listed in
toolConstraints. mise lock can invoke npm, go, and gem CLIs while
resolving versions for those backends, but Renovate previously only
installed mise itself.
* fix(manager/mise): use go constraint for golang resolver
* test(manager/mise): remove redundant resolver constraint test
* test(manager/mise): cover resolver tool dynamic installs
* test(manager/mise): cover unconstrained resolver lock updates
* Update lib/modules/manager/mise/artifacts.ts
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
* style(manager/mise): fix prettier whitespace in JSDoc comment
* test(manager/mise): clarify what happens with no `constraints`
* chore(manager/mise): update JsDoc
---------
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io>
* added dart/pub constraintsFilter support
* updated documentation to include pub for constraintsFiltering
* only add extractedConstraints if its populated
* increased coverage
* handle non-nullable environment.sdk better
* chore(manager/mix): extract hardcoded Erlang version for updates
As noted in #44149, we're not performing updates to the version of
Erlang, which means that unless users specify a `constraints.erlang`,
they are resolved to Erlang 25.3.2.21 (2025-07-09).
To start getting updates more frequently, we can extract this with a
Custom Manager, with:
- `loose` versioning (per #26768) for the 4-part versioning
- `extractVersion` to make sure we only get the first major
- `separateMultipleMajor` to allow us control over how we update
- a `renovate:` comment for visibility
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! chore(manager/mix): extract hardcoded Erlang version for updates
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
As a follow-up to e1e5c398e0, we can make
sure that we remove references to hardcoded docs site URLs, by wiring in
the `GlobalConfig.get(...)` call.
To do this, we need to make sure that `productLinks` exists to be called
by `GlobalConfig.get`.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
mise tool versions are plain version strings (e.g. `"aqua:pnpm/pnpm" = "11.6.0"`)
with no syntax to attach a commit digest, so a digest can never be written to a
mise config file. Backends such as aqua and core resolve to the github-tags
datasource, which exposes `getDigest`, so a global `pinDigests: true` makes
Renovate emit `pinDigest` updates for mise tools. These updates produce no file
change and then fail post-update verification with "Digest is not updated" ->
"Error updating branch: update failure" on every run.
Disable digest pinning at the manager level, matching terraform, gomod, and the
other managers whose dependencies have no place to store a digest.
* chore: ensure we use `productLinks` for docs site links where possible
Where possible, we should be making sure that we're using the
`productLinks`' configuration for the documentation site, especially
where self-hosted users may create a mirror of their docs[0].
To make sure we catch this in the future, we can introduce a custom
linting rule with Oxlint to enforce this.
Where we (currently) can't wire in the config, we can disable it against
that line.
[0]: https://www.jvt.me/posts/2024/11/19/renovate-private-docs/
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! chore: ensure we use `productLinks` for docs site links where possible
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! chore: ensure we use `productLinks` for docs site links where possible
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
Move the Sveltos documentation links into the dep-types.ts description
fields so they appear in the auto-generated Dependency types table.
Replace the duplicate hand-written table in readme.md with a config
example showing how to use depTypes for fine-grained control.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Add test coverage for community actions that had no corresponding
tests: azure/setup-helm, docker/setup-buildx-action,
docker/setup-compose-action, helm/chart-testing-action, and
sigoden/install-binary.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
The zod v4 migration made compilerOptions fail validation when jsxImportSource/jsxImportSourceTypes keys were absent, aborting Deno dependency extraction.
* feat(manager/github-actions): support dtolnay/rust-toolchain `toolchain` input
Extract the `toolchain` input of `dtolnay/rust-toolchain` as a `rust` dependency via the `rust-version` datasource, mirroring the rust-toolchain manager. Sliding-window expressions like `stable 18 months ago` are extracted as-is and rejected by the `rust-release-channel` versioning during lookup.
* feat(manager/github-actions): add rust-version datasource to `supportedDatasources`
* feat(datasource/github-runners): add macOS Intel labels
Add `macos-15-intel` and `macos-26-intel` runner labels to the datasource.
* feat(datasource/github-runners): add tests
Add test for upgrading macos-*-intel runners.
* chore(datasource/github-runners): split tests
Split-up the tests into different operating system families.
* fix(flux): pin tag-only OCIRepository digests to separate ref.digest field
* fix(flux): simplify range checks in extractOCIRefTagRange function
* fix(extract): improve handling of OCI reference nodes by using Scalar types
* fix(extract): refactor findOCIRefNodes to accept parsed documents instead of raw content
* fix(extract): update OCIRepository handling to extract tag-only refs with YAML aliases
* fix(npm): use packageName for pnpm overrides with range selectors in minimumReleaseAgeExclude
For pnpm.overrides entries with version range selectors (e.g. "pkg@<=1.0.0"),
depName contains the full override key including the selector, which is needed
to correctly update package.json. However this caused invalid entries in
minimumReleaseAgeExclude like "fast-xml-parser@<=5.3.5@5.5.7" instead of
"fast-xml-parser@5.5.7", breaking pnpm install with ERR_PNPM_INVALID_MINIMUM_RELEASE_AGE_EXCLUDE.
Fix by using packageName (bare npm package name parsed by @pnpm/parse-overrides)
instead of depName when constructing minimumReleaseAgeExclude entries. Falls back
to depName for dependency types where packageName is not set.
Made-with: Cursor
* test(npm): format pnpm override minimumReleaseAgeExclude test
Use codeBlock helper for expected pnpm-workspace.yaml contents per review.
* test(npm): avoid string concat in shrinkwrap exclude test
Use template literal instead of + to satisfy restrict-plus-operands.
* fix(npm): replace malformed minimumReleaseAgeExclude entries
Skip invalid package@version lines (extra @ after package prefix) when
matching excludes, and replace them instead of appending versions.
* test(npm): cover valid vs malformed exclude matching
* Update lib/modules/manager/npm/artifacts.spec.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Update lib/modules/manager/npm/artifacts.spec.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* test(npm): use codeBlock for expected workspace contents
* fix(npm): remove stale malformed minimumReleaseAgeExclude entries
When a valid exclude entry exists for the same package, drop leftover
malformed lines from the prior double-@ bug instead of leaving them.
* test(npm): avoid string concat in codeBlock expectations
Use template literal instead of + '\n' for prefer-template.
---------
Co-authored-by: Tapio Oikarinen <tapio.oikarinen@hoxhunt.com>
Co-authored-by: Martijn van der Meij <Squixx@users.noreply.github.com>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* docs(manger/github-actions): reword "community actions" section
As some follow-ups to 27a3f5871f, we
can slightly reword the intro to add some more information about what
these target.
* docs(manager/github-actions): document why there may not be a `packageName`
* docs(manager/github-actions): generate a table for Actions and their `with`s
To provide further clarity on how each of the Actions' `with`s are used,
we can make this more explicit in our autogenerated docs, providing:
- which field(s) are extracted, taken from their Zod schema (with help
from Claude Opus to extract this)
- note the dependency updating, and where it may be determined from the
given `withSchema`
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
* fix(terraform-provider): replace getJsonUnchecked with validated getJson
Convert all five TypeScript interfaces (TerraformProviderVersions,
TerraformProviderReleaseBackend, TerraformRegistryVersions,
TerraformRegistryBuildResponse, VersionDetailResponse) to co-located
Zod schemas in schema.ts and update all five call sites in index.ts to
use the typed http.getJson() overload. Types are now derived with
z.infer<> to prevent interface/schema drift.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix linting errors
* remove types
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* docs: skip validation on JSON files that aren't Renovate config
As part of future changes, we'll enable validation on all JSON code
snippets to run Config Validation.
Before we do that, we should opt-out JSON snippets that aren't anything
related to Renovate config.
* docs: don't validate invalid Renovate config
As it's intentionally referencing a manager that doesn't exist.
* docs: don't validate partial Renovate config
As part of future changes, we'll enable validation on all JSON code
snippets to run Config Validation.
There are several code snippets we have that are part of a Renovate JSON,
but it doesn't make sense to convert these to a fully passing config, as
it'd reduce clarity on what we're trying to explain.
* docs: convert `baseBranchPatterns` snippets to code blocks
So we can validate them.
* docs: make sure that `datasourceTemplate` is set
So this passes validation.
* docs: clarify that `force` is global config
As it may not be clear, so we can make it extra clear with a `.js` file,
and note that it's global self-hosted config.
* docs: make sure `packageRules` is an array
* docs: `matchBaseBranches` needs `baseBranchPatterns` to be set
* docs: correct typo for `prBodyColumns`
* docs: mark global config snippets as such
As part of future changes, we'll use this to detect whether it's global
self-hosted configuration.
* docs: make sure `packageRules` wraps its children
* docs: add `allowedHeaders`
* docs: ignore deprecation warnings
As part of future changes, we'll use this to note that we don't care
about the validation warnings.
* docs: make sure `customManagers` wraps its children
* docs: make sure `fleet` wraps its children
* docs: validate JSON snippets are valid Renovate config
To make sure that we're always presenting valid JSON configuration to
our users, we can validate them as part of `check-fenced-code`.
As well as configuration errors we can warn for warnings, but allow code
blocks to opt-out, for instance when there's a known deprecation
affecting the code block.
We need to make sure to set `allowedEnv` for various code snippets that
reference environment variables.
* docs(development): document fenced code block checks
* docs: wrap `configType` and `ignoreConfigWarnings` in `{ ... }`
As otherwise we see build failures i.e.
WARNING - Doc file 'modules/platform/gitlab/index.md' contains a link
'../../../self-hosted-configuration.md#autodiscoverrepoorder', but the doc
'self-hosted-configuration.md' does not contain an anchor '#autodiscoverrepoorder'.
This needs to be wrapped alongside all other options like `title`.
* fixup! docs: wrap `configType` and `ignoreConfigWarnings` in `{ ... }`
* chore: migrate from zod/v3 to zod/v4
This commit contains the logic changes
* chore: migrate imports from zod/v3 to zod/v4
This contains import updates and adds explicit record keys as zod/v4 requires these now
* ci: enforce usage of zod/v4
David Straub