* docs: explicitly document `depTypes` each manager supports
A long-standing question we receive is "what `depTypes` can I match
against in my project".
Although the best recommendation we usually have is "check the
`packageFiles with updates" log line (as a very key log line for users),
we can go one step further and try and create a stronger contract.
To do this, I've used Claude Sonnet 4.6 to work through the codebase,
determine areas that a `depType` is set in a manager (statically or
dynamically) and generate a structured, typed, means to document how
they're used.
Through a few iterations of the process, and attempts at human-written
documentation, we've settled on:
- prioritising autogenerated documentation (for humans to read) to note
what `depTypes` are known, and what they are
- `knownDepTypes`, to describe any known, static, `depType`s and their
human-readable meaning
- with the `prettyDepType`, if used
- `supportsDynamicDepTypesNote`, to add a Markdown note to the generated
documentation
While here, we also:
- make sure to note this in the "adding a new package manager"
documentation
- remove any hand-written references to `depTypes` in each manager's
documentation page
- correct the Gleam `depTypes`
- make sure to use the `knownDepTypes`'s `prettyDepType` definition if
we know it, for a given `depType`
The descriptions have been generated by Claude Sonnet, with some
human-written tweaks where appropriate.
[0]: https://github.com/renovatebot/renovate/discussions/15176
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! docs: explicitly document `depTypes` each manager supports
* docs(manager): display `depTypes` documentation if none present
For consistency, and to make it more explicit.
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
As a means to improve debuggability of Azure's `platformAutomerge` and
`autoApprove`, we can provide a log line to provide more context of what
we're changing.
* feat(datasource): add elm-package datasource
* refactor(elm): inline test fixtures
* fix(elm): correct import ordering in test file
* fix(elm): use zod/v3 import to match codebase conventions
* refactor(elm): rename types.ts to schema.ts
Follow project convention of using schema.ts for zod schema files.
* test(elm): add test for invalid JSON response
Use v8 ignore if directive and add test covering the null result
path when the API returns invalid JSON.
* refactor(elm): remove unreachable null check
* test(elm): add test for default registry URL fallback
* refactor(elm): guard against missing registryUrl instead of fallback
* fix(elm): handle ZodError gracefully instead of throwing
* feat(elm): add package cache for elm-package datasource
fix(gerrit): use the "ready" push option to ensure changes are not wip
In gerrit, changes can be set to WIP by default instead of ready.
This breaks renovate because it doesn't see WIP changes and just
creates new ones again every run.
The solution is to always include the "ready" push option to ensure
the changes are ready and not wip.
https://gerrit-review.googlesource.com/Documentation/user-upload.html
* feat(manager/npm): pass --before to npm install when minimumReleaseAge is set
* use logger metadata
* Apply suggestion from @viceice
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
---------
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* fix(platform/bitbucket): replace deprecated cross-workspace repos endpoint
The GET /2.0/repositories?role=contributor endpoint is being removed by
Bitbucket Cloud on 2026-03-31 (CHANGE-2770). Replace it with per-workspace
calls to GET /2.0/repositories/{workspace}.
When autodiscoverNamespaces is set, those values are used directly as
workspace slugs. Otherwise the current user's workspaces are first
discovered via GET /2.0/user/workspaces (the non-deprecated replacement
for GET /2.0/workspaces) and repositories are then fetched per workspace.
* fix(platform/bitbucket): address review comments
- Use z.array instead of LooseArray for WorkspaceAccesses schema
- Limit workspace fetch concurrency via promises.map
- Align test workspace slugs with reviewer suggestions
* fix(platform/bitbucket): address review comments
- Use z.array instead of LooseArray for WorkspaceAccesses schema
- Limit workspace fetch concurrency via promises.map
- Align test workspace slugs with reviewer suggestions
* fix(platform/bitbucket): restore original repo names in negation test
As reported in #41994, in 49fbc8392e, we
assumed that `updateArtifacts` would only ever be called when updating
the `maven-wrapper.properties`.
As this isn't always the case, and we may be updating a `mvnw` file, we
should check what we're about to delete, before we do.
* fix: Add `github-digest` to `GITHUB_API_USING_HOST_TYPES` list
* fix(http): detect x-access-token prefix before hostType-based auth branching
Moves GitHub App installation token detection (`x-access-token:` prefix)
before the hostType-based authorization chain in `applyAuthorization`.
This ensures correct `token` scheme auth for any GitHub-related hostType,
not only those listed in `GITHUB_API_USING_HOST_TYPES`.
* test(http/auth): add regression test for GitHub App token with non-listed hostType
* Fixes
* Fix tests
* Fix double slash error
Endpoint will always have a trailing slash, therefore the path must not start with a slash
* Remove servlet context from path
Since the `scm` part can be reconfigured to another value, it should not be hardcoded, but a part of the endpoint config
* Fix invalid test setup
* Ensure the trailing slash on the endpoint
* feat(github-actions): Support non-semver refs (tags and branches)
* refactor(github-actions): drop ref= prefix, use bare token comments
Address review feedback: use bare `# cargo-llvm-cov` instead of
`# ref=cargo-llvm-cov` for non-semver pin comments, consistent with
how version comments work (`# v4.0.0`).
- Rename pinnedVersionRe -> pinTokenRe, add bareTokenRe fallback
- Add `ref` field to CommentData, separate from pinnedVersion
- Guard replaceString extension to only use ref for SHA-pinned actions
- Remove redundant autoReplaceStringTemplate override
- Deduplicate versionLikeRe (export from parse.ts)
- Add datasource assertions to non-semver tests
* refactor(github-actions): remove unreachable parseComment branch
* test(github-actions): add coverage for non-version ref fallback
* feat: port Ubuntu versioning support to Debian container images
Resolves#27862.
Signed-off-by: Alexander Gil <pando855@gmail.com>
* refactor: Remove dead code in debian versioning
Signed-off-by: Alexander Gil <pando855@gmail.com>
* refactor: Rename groups to match
* perf: optimize isStable method by reusing getVersionByCodename result
* fix(debian): specify radix in parseInt for dated container image version
---------
Signed-off-by: Alexander Gil <pando855@gmail.com>
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io>
* fix(maven): determing properly closed ranges
A Maven range like [1,2) contains various (usually pre-release) versions of the 2.x line.
By Maven definition the smallest possible 2.x version is 2-alpha, so a properly closed range that only allows 1.x versions
would be [1,2-alpha). This is now detected and properly advanced.
* fix(maven): normalize both sides of version comparison
Without this a leftValue of v3 is incremented to 4 and then compared to v4.
* fix(maven): do not loose the v-prefix of versions in range handling
If versions of a project always start with a v prefix, this was lost when Maven ranges were involved.
The coerce and increment methods stripped the v away and it was never added back in.
* Properly fix underlying problem and make PR standalone
* Add missing coverage
* Remove unused callback parameter
Explicitly set --lockfile_mode=update when running bazel mod deps to ensure the lockfile can be updated even when checksums are missing or mismatched. This prevents failures when --lockfile_mode=error is the default or active in the environment.
* test(conan): add failing tests for wildcard-equivalent ranges in getNewValue
Add test cases for [*], [>=*], and [x] ranges with all three
strategies (widen, replace, bump). [>=*] and [x] currently crash
with TypeError in getNewValue.
* fix(conan): handle wildcard-equivalent ranges in getNewValue
Ranges like [*], [>=*], [x], and [] are all semantically "match
everything". parseRange() returns an empty array for these, causing
getNewValue to crash with TypeError when accessing properties on
undefined. Use semver.validRange() to detect all wildcard-equivalent
forms instead of checking only for '*'.
As noted in #41780, in the case that a `newVersion` has the `v` prefix,
we use that version, which then results in `xcodebuild` failing to build
the project.
We should instead use `newValue`, which does not include the `v` prefix.
To make this clear in our tests, we can align the test data with the
expected input from our Datasources.
Because we need to use the `newVersion` for digest lookups, we need to
make sure that we still require it (or log when it's not found for some
reason).
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(maven-wrapper): support checksum updates when updating versions
When updating Maven distribution or wrapper versions, Renovate now updates
the corresponding SHA-256 checksums (distributionSha256Sum, wrapperSha256Sum)
by downloading the new artifacts and computing their hashes.
- Add HTTP client to fetch artifacts and compute SHA-256 checksums
- Update checksums before running wrapper:wrapper command
- Delete old maven-wrapper.jar to prevent checksum validation failures
- Handle maven-only updates when distributionSha256Sum is present
- Preserve old checksums on network failures (PR still created)
Closes#33444
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: Gasper Kojek <gkojek@gradle.com>
* fix(maven-wrapper): strip checksums before wrapper:wrapper to avoid validation failure
When wrapper:wrapper runs, mvnw downloads the new JAR and validates it
against checksums in the properties file. With old checksums still present,
this validation fails. Now checksums are stripped before running
wrapper:wrapper and recomputed afterward.
Signed-off-by: Gasper Kojek <gkojek@gradle.com>
* fix(maven-wrapper): preserve distributionType when running wrapper:wrapper
Use existing distributionType from properties file or default to 'script'
when running wrapper:wrapper. This ensures JAR-based mode is preserved
for repos using checksums.
Signed-off-by: Gasper Kojek <gkojek@gradle.com>
* fix(maven-wrapper): Fix after merge
* test(maven-wrapper): cover checksum branches
* fix(maven-wrapper): preserve checksums on failures
* test(maven-wrapper): cover missing content branch
* Merge branch 'main' into gk/mavenWrapperChecksums-old
* main: (215 commits)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.1.15 (main) (#40929)
docs(terraform): clarify release timestamp and limitation (#40923)
feat(gradle): allow specifying Gradle daemon heap size (#40090)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.1.14 (main) (#40911)
docs(minimum-release-age): clarify lack of support for non-Docker Hub (#40910)
build(deps): update dependency re2 to v1.23.2 (main) (#40906)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.1.13 (main) (#40899)
fix(gitlab): skip automerge retry when merge_when_pipeline_succeeds already set (#39979)
chore(renovate): enable maintenance branch (#40871)
chore(deps): update dependency globals to v17.2.0 (main) (#40883)
chore(deps): update dependency type-fest to v5.4.2 (main) (#40882)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.1.12 (main) (#40880)
fix(workers): re-attempt platform automerge only in case of new commits (#40028)
build(deps): update dependency protobufjs to v8 (main) (#40878)
chore(deps): update github artifact actions (main) (major) (#40876)
chore(deps): update peter-evans/create-pull-request action to v8 (main) (#40877)
chore(deps): update dessant/lock-threads action to v6 (main) (#40874)
chore(deps): update dessant/label-actions action to v5 (main) (#40873)
chore(deps): update dependency vite-tsconfig-paths to v6 (main) (#40872)
chore(deps): update dependency @containerbase/semantic-release-pnpm to v1.3.18 (main) (#40669)
...
# Conflicts:
# lib/modules/manager/maven-wrapper/artifacts.spec.ts
# lib/modules/manager/maven-wrapper/artifacts.ts
* refactor(maven-wrapper): address PR review comments
(cherry picked from commit 9084d356496f6258dc0e846d926598f39b65cda3)
* fix: use named capture group in getChecksumValue
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Signed-off-by: Gasper Kojek <gkojek@gradle.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add Home Assistant Manifest manager
* Fix review comments
* Set skipReason as unspecified-version when no version in pip dependency
* Fix tests with zod/v3
* Fix lint issue
* Set unspecified-version in HA manager instead of pip
* feat(git-refs): use dereferenced commit hash for annotated tags
When git ls-remote lists annotated tags, it returns two entries:
1. The tag object hash: refs/tags/v1.0.0 -> abc123
2. The dereferenced commit hash: refs/tags/v1.0.0^{} -> def456
Previously, Renovate used the tag object hash (abc123). However, `git submodule status` returns the actual commit hash (def456). This mismatch caused false-positive dependency updates that resulted in empty commits, since the tag object and commit hash differ even when pointing to the same version.
This feature:
- Parses both entries from git ls-remote into allRefs
- Builds a lookup map of tag names to their dereferenced commit hashes
- For annotated tags, replaces the tag object hash with the commit hash
- Lightweight tags are unaffected (they already return the commit hash)
This ensures Renovate's detected digest matches what git submodule operations actually use, preventing unnecessary update PRs.
* Apply suggestions from code review
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* fix typo in dereferencedTags variable name
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* feat(exec): register bazelisk as containerbase tool
* test(bazel-module): add failing tests for updateArtifacts
* feat(bazel-module): implement updateArtifacts for lockfile support
* feat(bazel-module): export updateArtifacts from manager index
* fix(bazel-module): address code review feedback
- Use logger.warn instead of debug for artifact errors
- Add utf8 encoding to readLocalFile calls
- Use getSiblingFileName for lockfile path derivation
- Add empty updatedDeps guard
- Strengthen test assertions
* docs(bazel-module): document lockfile support
* Update lib/modules/manager/bazel-module/index.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Apply suggestions from code review
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* fix(bazel-module): address review feedback
- Remove unnecessary afterEach in tests
- Use partial<StatusResult> for all StatusResult mocks
- Add lockfile maintenance support
- Export supportsLockFileMaintenance flag
* fix(bazel-module): handle untracked lock files and clarify docs
Check status.not_added alongside status.modified for lock file changes,
matching the pattern used by other managers (composer, gomod, etc.).
Clarify that Bazelisk (not Renovate) reads .bazelversion. Add test for
lockfile maintenance with no changes.
* feat(bazelisk): implement updateArtifacts for MODULE.bazel.lock
When the Bazel version in .bazelversion changes, run `bazel mod deps` to
regenerate MODULE.bazel.lock and return the updated lockfile as an artifact.
* feat(bazelisk): add lockfile maintenance support
* docs(bazelisk): add lockfile support section linking to bazel-module docs
* refactor(bazel-module): extract shared lockfile update helper
* refactor(bazel-module): delegate lockfile update to shared helper
Replace inline lockfile update logic in artifacts.ts with a call to the
shared updateBazelLockfile() helper, and update tests to mock the helper.
* refactor(bazelisk): delegate lockfile update to shared helper
Replace inline lockfile update logic in bazelisk/artifacts.ts with a
call to the shared updateBazelLockfile() helper from bazel-module/lockfile.ts.
* fix(bazelisk): use index.md for cross-manager docs link
The docs pipeline renames readme.md to index.md, so cross-manager
links must reference index.md to pass the docs link checker.
* feat(bazel-module,bazelisk): support bazelisk version constraint
Pass config.constraints.bazelisk through to toolConstraints so users
can pin the bazelisk version if the newest release is broken.
* fix(bazel-module): rename lockFile to fileName in ArtifactError
Upstream renamed lockFile to fileName in ArtifactError type (#41631).
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
Jamie Tanna