* fix(manager/mise): expand file patterns to match mise's config search
Updates mise manager file patterns to align with the official mise configuration file search patterns. The patterns now include:
- Additional config locations (.config/mise/, .config/mise.toml)
- Legacy rtx.toml files
- Environment-specific configs (e.g., mise.production.toml)
- Local configs (e.g., mise.local.toml)
This ensures Renovate detects all mise configuration files that mise itself recognizes.
* CR
* Use brace expansions in the patterns
* Fix stupid typo
* feat(flux): map Helm sourceRef names via registryAliases
* fix: update docs with packageRules for registryAliases showcase
* fix: add tests to fill coverage
* fix: test for isOCIRegistry
As noted in #40611, we shouldn't reference the same version multiple
times in the same exclude directive.
This also handles the case where we could end up with multiple comments
for a given package.
This is slightly more complex logic, and slightly simplifes by
extracting out to a new helper method.
We also need to make sure that we use `getIn` so we get the raw node, so
we can look at the comment inside the `minimumReleaseAgeExclude`'s list,
but before the first element.
As noted in #40610, when `newVersion` contains a caret (or other
npm-specific versioning constraints) a generated
`minimumReleaseAgeExclude` directive will result in
ERR_PNPM_INVALID_MINIMUM_RELEASE_AGE_EXCLUDE Invalid value in
minimumReleaseAgeExclude: Invalid versions union. Found: "...". Use
exact versions only.
To handle this better, we can make sure we use `newVersion` over
`newValue`, as it'll provide the raw version number.
We also need to update an unrelated to test to make sure it's using
`newVersion`.
As noted in #30231, it would be useful to present a changelog URL for
Git submodule PRs, which is possible with
`helpers:githubDigestChangelogs`.
However, because the `sourceUrl` is not set, this doesn't get applied.
Given the `packageName` is the HTTP URL for the Git submodule, we can
use this for our `sourceUrl`.
* registryAlias for bazel-module oci.pull
* use getDep from dockerfile manager instead
* expand testing for oci.pull
* test: merge autoReplaceStringTemplate assertion into registryAliases test
* move assertion to other test
* Update lib/modules/manager/bazel-module/extract.spec.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
As reported in #40275, since f430552de4
we've seen Flux failing to update.
We can take advantage of the new `shell` option to handle this safe
shell semantics usage for file redirection.
As reported in #40294, since f430552de4
we've seen Yarn 1 failing to update.
We can take advantage of the new `ignoreFailure` option to replace the
usage of shell semantics.
We also refactor `getOptimizeCommand` to make sure this always returns
the split command-and-arguments.
As reported in #40284, since f430552de4
we've seen Composer failing to update.
We can take advantage of the new `ignoreFailure` option to replace the
usage of shell semantics.
After recent changes to remove `shell: true`, it's clear from #40231
that this breaks Containerbase's installing of tools, as we use the
`hash` shell built-in.
As we no longer need the `hash` call, we can remove it.
* fix(util/exec): migrate to `execa` for command execution
As part of a future change, we need to make sure that we have
cross-platform support for specific command executions.
By using `execa`'s functionality on top of `node:child_process`, we can
provide this functionality, as well as retain a consistent API with
internal users.
We need to make a couple of small tweaks to setting the `RawExecOptions`
as we're now bound by `readonly` properties.
As the `stdio` property's type is not exported, we can replace this with
an explicit setting of `stdin`, `stdout` and `stderr`.
This requires a number of test changes to make sure that the `stdin`,
`stdout` and `stderr` are set.
This doesn't migrate any calls under `tools`, as they can remain using
`node:child_process`.
* chore(util/exec): ignore floating promises `.on` calls
Since moving to use `execa`, we now have "floating promises" for the
`.on` method calls.
As we aren't handling them here, we can now mark them as `void` (as an
alternative to ignoring the ESLint rule).
This has been deprecated since 2022-07, and is unused as we only ever
use UTF-8.
In `tools/utils/exec.ts` we make sure to specify it explicitly, so we
don't get a Buffer returned.
We recently introduced the ability for self-hosted administrators to
control execution of possibly unsafe commands with
`allowedUnsafeExecutions`.
An existing attack vector of Gradle Wrapper commands being executed
(i.e. for Verification Metadata or lockfile updates) needs to be
retrofit into `allowedUnsafeExecutions` as part of #39657.
This will be kept on-by-default until the next breaking change, after
which self-hosted administrators will be able to opt-in to enabling this
functionality is required.
Sergei Zharinov