* feat(manager): add Apache Ant manager with basic inline version extraction
Add new ant package manager that extracts Maven dependencies from
Ant build.xml files using the maven-resolver-ant-tasks library.
Supports inline version attributes on dependency elements.
* fix test
* reuse fn
* fix lint
* fix coverage
* apply suggestions
* simplify tests
* use extractPackageFile and extractPackageFiles
* coverage fix
* apply sugestions
* test: add additional case for attestation changes
* fix: correctly warn when an attestation is missing
As noted in #37258, when a package registry had previously seen an
attestation for authenticity of a given package release, Renovate should
warn if future updates then lose authenticity.
Our previous attempt at this didn't quite pass around the current
package's attestation, which results in no warnings.
Given recent supply chain attacks where an attestation was removed (such
as Axios in MSC-2026-3522), we should make sure that this logic does
work correctly, and flags to our users.
In the future, we'll add more checks and a failing status check.
By introducing `hasAttestation` in the `LookupUpdate`, this can now be
matched on with `matchJsonata`, as well as providing visibility in the
`packageFiles with updates` log line.
* fixup! fix: correctly warn when an attestation is missing
> Run `pnpm run jest
> lib/workers/repository/process/lookup/index.spec.ts` and handle any test
> failures - the implementation is correct, so update the tests
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* test: clarify that we don't check for intermediate releases
Which we'll look to improve as part of future changes.
* chore: fix typo
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* fix(swift): don't write `from:` range to `Package.resolved`
When a dependency uses a range specifier like `from: "1.0.0"` in
Package.swift, the `newValue` produced by the versioning module contains
the range expression (e.g. `from: "603.0.0"`) rather than a plain version
string. Using `newValue` directly to update `Package.resolved` results in
the lock file containing the range expression instead of a resolved version,
which corrupts it.
Fix by using `dep.newVersion` with the `v` prefix stripped, which is
the actual resolved version and the correct value for `Package.resolved`.
* Update lib/modules/manager/swift/artifacts.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* docs: explicitly document `depTypes` each manager supports
A long-standing question we receive is "what `depTypes` can I match
against in my project".
Although the best recommendation we usually have is "check the
`packageFiles with updates" log line (as a very key log line for users),
we can go one step further and try and create a stronger contract.
To do this, I've used Claude Sonnet 4.6 to work through the codebase,
determine areas that a `depType` is set in a manager (statically or
dynamically) and generate a structured, typed, means to document how
they're used.
Through a few iterations of the process, and attempts at human-written
documentation, we've settled on:
- prioritising autogenerated documentation (for humans to read) to note
what `depTypes` are known, and what they are
- `knownDepTypes`, to describe any known, static, `depType`s and their
human-readable meaning
- with the `prettyDepType`, if used
- `supportsDynamicDepTypesNote`, to add a Markdown note to the generated
documentation
While here, we also:
- make sure to note this in the "adding a new package manager"
documentation
- remove any hand-written references to `depTypes` in each manager's
documentation page
- correct the Gleam `depTypes`
- make sure to use the `knownDepTypes`'s `prettyDepType` definition if
we know it, for a given `depType`
The descriptions have been generated by Claude Sonnet, with some
human-written tweaks where appropriate.
[0]: https://github.com/renovatebot/renovate/discussions/15176
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! docs: explicitly document `depTypes` each manager supports
* docs(manager): display `depTypes` documentation if none present
For consistency, and to make it more explicit.
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(manager/npm): pass --before to npm install when minimumReleaseAge is set
* use logger metadata
* Apply suggestion from @viceice
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
---------
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
As reported in #41994, in 49fbc8392e, we
assumed that `updateArtifacts` would only ever be called when updating
the `maven-wrapper.properties`.
As this isn't always the case, and we may be updating a `mvnw` file, we
should check what we're about to delete, before we do.
* feat(github-actions): Support non-semver refs (tags and branches)
* refactor(github-actions): drop ref= prefix, use bare token comments
Address review feedback: use bare `# cargo-llvm-cov` instead of
`# ref=cargo-llvm-cov` for non-semver pin comments, consistent with
how version comments work (`# v4.0.0`).
- Rename pinnedVersionRe -> pinTokenRe, add bareTokenRe fallback
- Add `ref` field to CommentData, separate from pinnedVersion
- Guard replaceString extension to only use ref for SHA-pinned actions
- Remove redundant autoReplaceStringTemplate override
- Deduplicate versionLikeRe (export from parse.ts)
- Add datasource assertions to non-semver tests
* refactor(github-actions): remove unreachable parseComment branch
* test(github-actions): add coverage for non-version ref fallback
Explicitly set --lockfile_mode=update when running bazel mod deps to ensure the lockfile can be updated even when checksums are missing or mismatched. This prevents failures when --lockfile_mode=error is the default or active in the environment.
As noted in #41780, in the case that a `newVersion` has the `v` prefix,
we use that version, which then results in `xcodebuild` failing to build
the project.
We should instead use `newValue`, which does not include the `v` prefix.
To make this clear in our tests, we can align the test data with the
expected input from our Datasources.
Because we need to use the `newVersion` for digest lookups, we need to
make sure that we still require it (or log when it's not found for some
reason).
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(maven-wrapper): support checksum updates when updating versions
When updating Maven distribution or wrapper versions, Renovate now updates
the corresponding SHA-256 checksums (distributionSha256Sum, wrapperSha256Sum)
by downloading the new artifacts and computing their hashes.
- Add HTTP client to fetch artifacts and compute SHA-256 checksums
- Update checksums before running wrapper:wrapper command
- Delete old maven-wrapper.jar to prevent checksum validation failures
- Handle maven-only updates when distributionSha256Sum is present
- Preserve old checksums on network failures (PR still created)
Closes#33444
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: Gasper Kojek <gkojek@gradle.com>
* fix(maven-wrapper): strip checksums before wrapper:wrapper to avoid validation failure
When wrapper:wrapper runs, mvnw downloads the new JAR and validates it
against checksums in the properties file. With old checksums still present,
this validation fails. Now checksums are stripped before running
wrapper:wrapper and recomputed afterward.
Signed-off-by: Gasper Kojek <gkojek@gradle.com>
* fix(maven-wrapper): preserve distributionType when running wrapper:wrapper
Use existing distributionType from properties file or default to 'script'
when running wrapper:wrapper. This ensures JAR-based mode is preserved
for repos using checksums.
Signed-off-by: Gasper Kojek <gkojek@gradle.com>
* fix(maven-wrapper): Fix after merge
* test(maven-wrapper): cover checksum branches
* fix(maven-wrapper): preserve checksums on failures
* test(maven-wrapper): cover missing content branch
* Merge branch 'main' into gk/mavenWrapperChecksums-old
* main: (215 commits)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.1.15 (main) (#40929)
docs(terraform): clarify release timestamp and limitation (#40923)
feat(gradle): allow specifying Gradle daemon heap size (#40090)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.1.14 (main) (#40911)
docs(minimum-release-age): clarify lack of support for non-Docker Hub (#40910)
build(deps): update dependency re2 to v1.23.2 (main) (#40906)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.1.13 (main) (#40899)
fix(gitlab): skip automerge retry when merge_when_pipeline_succeeds already set (#39979)
chore(renovate): enable maintenance branch (#40871)
chore(deps): update dependency globals to v17.2.0 (main) (#40883)
chore(deps): update dependency type-fest to v5.4.2 (main) (#40882)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.1.12 (main) (#40880)
fix(workers): re-attempt platform automerge only in case of new commits (#40028)
build(deps): update dependency protobufjs to v8 (main) (#40878)
chore(deps): update github artifact actions (main) (major) (#40876)
chore(deps): update peter-evans/create-pull-request action to v8 (main) (#40877)
chore(deps): update dessant/lock-threads action to v6 (main) (#40874)
chore(deps): update dessant/label-actions action to v5 (main) (#40873)
chore(deps): update dependency vite-tsconfig-paths to v6 (main) (#40872)
chore(deps): update dependency @containerbase/semantic-release-pnpm to v1.3.18 (main) (#40669)
...
# Conflicts:
# lib/modules/manager/maven-wrapper/artifacts.spec.ts
# lib/modules/manager/maven-wrapper/artifacts.ts
* refactor(maven-wrapper): address PR review comments
(cherry picked from commit 9084d356496f6258dc0e846d926598f39b65cda3)
* fix: use named capture group in getChecksumValue
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Signed-off-by: Gasper Kojek <gkojek@gradle.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add Home Assistant Manifest manager
* Fix review comments
* Set skipReason as unspecified-version when no version in pip dependency
* Fix tests with zod/v3
* Fix lint issue
* Set unspecified-version in HA manager instead of pip
* feat(exec): register bazelisk as containerbase tool
* test(bazel-module): add failing tests for updateArtifacts
* feat(bazel-module): implement updateArtifacts for lockfile support
* feat(bazel-module): export updateArtifacts from manager index
* fix(bazel-module): address code review feedback
- Use logger.warn instead of debug for artifact errors
- Add utf8 encoding to readLocalFile calls
- Use getSiblingFileName for lockfile path derivation
- Add empty updatedDeps guard
- Strengthen test assertions
* docs(bazel-module): document lockfile support
* Update lib/modules/manager/bazel-module/index.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Apply suggestions from code review
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* fix(bazel-module): address review feedback
- Remove unnecessary afterEach in tests
- Use partial<StatusResult> for all StatusResult mocks
- Add lockfile maintenance support
- Export supportsLockFileMaintenance flag
* fix(bazel-module): handle untracked lock files and clarify docs
Check status.not_added alongside status.modified for lock file changes,
matching the pattern used by other managers (composer, gomod, etc.).
Clarify that Bazelisk (not Renovate) reads .bazelversion. Add test for
lockfile maintenance with no changes.
* feat(bazelisk): implement updateArtifacts for MODULE.bazel.lock
When the Bazel version in .bazelversion changes, run `bazel mod deps` to
regenerate MODULE.bazel.lock and return the updated lockfile as an artifact.
* feat(bazelisk): add lockfile maintenance support
* docs(bazelisk): add lockfile support section linking to bazel-module docs
* refactor(bazel-module): extract shared lockfile update helper
* refactor(bazel-module): delegate lockfile update to shared helper
Replace inline lockfile update logic in artifacts.ts with a call to the
shared updateBazelLockfile() helper, and update tests to mock the helper.
* refactor(bazelisk): delegate lockfile update to shared helper
Replace inline lockfile update logic in bazelisk/artifacts.ts with a
call to the shared updateBazelLockfile() helper from bazel-module/lockfile.ts.
* fix(bazelisk): use index.md for cross-manager docs link
The docs pipeline renames readme.md to index.md, so cross-manager
links must reference index.md to pass the docs link checker.
* feat(bazel-module,bazelisk): support bazelisk version constraint
Pass config.constraints.bazelisk through to toolConstraints so users
can pin the bazelisk version if the newest release is broken.
* fix(bazel-module): rename lockFile to fileName in ArtifactError
Upstream renamed lockFile to fileName in ArtifactError type (#41631).
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
This also makes sure that our URL fragments should be more consistent
over the years, as duplicate names (across parent and child options)
cannot clash.
This also corrects links from the code to include the new fragment.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fix: preserve vendor prefixes in mise manager version updates
* test: cover kafka fallback path for 100% coverage
* test(mise): add failing tests for short java version versioning
Bare major versions like java = "21" or temurin-21 should use
semver-partial versioning to prevent invalid update proposals.
Full versions like "21.0.2" should keep the default versioning.
* fix(mise): use semver-partial versioning for short java versions
Short java versions (bare major like "21" or major.minor like "21.0")
now use semver-partial versioning, which treats them as ranges and
preserves precision in updates (e.g. "21" → "22" on major bump).
This replaces the replaceString/autoReplaceStringTemplate approach
with a versioning-based fix as suggested in discussion #41159.
Full versions (e.g. "21.0.2") keep the default semver-coerced
versioning unchanged.
* test(mise): remove unrelated kafka test
* refactor(mise): inline regex in shortJavaVersioning
* refactor(mise): return empty object instead of undefined
* refactor: use it.each to reduce duplication
* refactor: hardcode semver-partial in it.each test
As `fileName` makes more sense (as it's not always a lock file we're
updating).
Also, if you set `fileName`, it would never actually output the
filename.
This renames the usages of `lockFile` to `fileName`.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* test: add test cases
* fix(swift): fix for the handling of the `traits` argument
* chore: use codeBlock tag
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Fix git+ and ssh+ for copier
* Address PR review: use codeBlock and it.each in copier extract tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
RahulGautamSingh