This also makes sure that our URL fragments should be more consistent
over the years, as duplicate names (across parent and child options)
cannot clash.
This also corrects links from the code to include the new fragment.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fix: preserve vendor prefixes in mise manager version updates
* test: cover kafka fallback path for 100% coverage
* test(mise): add failing tests for short java version versioning
Bare major versions like java = "21" or temurin-21 should use
semver-partial versioning to prevent invalid update proposals.
Full versions like "21.0.2" should keep the default versioning.
* fix(mise): use semver-partial versioning for short java versions
Short java versions (bare major like "21" or major.minor like "21.0")
now use semver-partial versioning, which treats them as ranges and
preserves precision in updates (e.g. "21" → "22" on major bump).
This replaces the replaceString/autoReplaceStringTemplate approach
with a versioning-based fix as suggested in discussion #41159.
Full versions (e.g. "21.0.2") keep the default semver-coerced
versioning unchanged.
* test(mise): remove unrelated kafka test
* refactor(mise): inline regex in shortJavaVersioning
* refactor(mise): return empty object instead of undefined
* refactor: use it.each to reduce duplication
* refactor: hardcode semver-partial in it.each test
As `fileName` makes more sense (as it's not always a lock file we're
updating).
Also, if you set `fileName`, it would never actually output the
filename.
This renames the usages of `lockFile` to `fileName`.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* test: add test cases
* fix(swift): fix for the handling of the `traits` argument
* chore: use codeBlock tag
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Fix git+ and ssh+ for copier
* Address PR review: use codeBlock and it.each in copier extract tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat(managers/npm): allow specifying `toolSettings.nodeMaxMemory`
As noted in #40942, we're seeing an increase in memory usage across
`pnpm` and `yarn` users in Mend-hosted apps.
To allow limiting the maximum memory that any `node` child processes
will use, we can add a new `toolSettings.nodeMaxMemory` to (hopefully)
mitigate this.
Similar to the `toolSettings.jvmMaxMemory`, the self-hosted
administrator can set a maximum, which cannot be exceeded by repo-level
configuration.
* fixup! feat(managers/npm): allow specifying `toolSettings.nodeMaxMemory`
* fix(gomod): add -modfile flag for non-default go.mod filenames
When using managerFilePatterns to manage non-standard go.mod files
(e.g. tools.mod), the go commands (get, mod tidy, mod vendor) now
include the -modfile flag so they operate on the correct module file
instead of defaulting to go.mod in the working directory
* Update lib/modules/manager/gomod/artifacts.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Update lib/modules/manager/gomod/artifacts.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* use string templates
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* chore: Add vitest plugin to oxlint
* Remove unused line in versioning spec
* Remove coverage threshold check job
The coverage threshold check has been removed from the build workflow. This job was redundant as
coverage is already handled by the codecov job.
* Refine versioning API schema with existence check
* Revert "Remove coverage threshold check job"
This reverts commit f2c9dd872b.
* Remove vitest ESLint plugin
The vitest ESLint plugin and its configurations have been removed. ESLint will no longer enforce
vitest-specific rules.
* Remove unused vitest eslint plugin
The `@vitest/eslint-plugin` is no longer used and can be safely removed.
* fix(versioning/hex): handle Elixir == pin prefix in isSingleVersion
Hex versioning inherited npm's isSingleVersion which only strips a single
= prefix. Elixir uses == for pinning, so "== 1.7.16" was not recognized
as a pinned version, causing duplicate pin PRs on every update.
Add isSingleVersion override that handles the double == prefix and add
getPinnedValue to emit the correct == prefix when pinning.
* fix: use non-null assertion instead of optional chaining in test
* fix(crate): respect config.json in indices
* improve coverage
* improve coverage
* Apply suggestions from code review
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* fixup
* fix import sorting
* further simplify, by merging clonepath/sparse variable
* use registryconfigschema in tests
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* feat(swift): update Package.resolved when updating Package.swift
Add artifact support to the Swift Package Manager module so that
Package.resolved lockfiles are updated alongside Package.swift manifest
changes. Uses direct JSON modification (targeted regex replacement of
version and revision within each pin block) instead of requiring the
Swift toolchain, avoiding the need for a macOS runner or private repo
authentication.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(swift): achieve 100% coverage for artifacts.ts
Add tests for missing datasource/packageName, missing pins array, and
getDigest exceptions. Mark three unreachable defensive guards with
istanbul ignore (valid JSON always has matching braces and identities).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor(swift): address review feedback from viceice
- Inline test fixtures instead of using fixture files
- Remove unnecessary beforeEach/resetAllMocks
- Use PackageDependency and Upgrade types instead of inline type literals
- Add Zod schema for safe Package.resolved parsing
- Move PackageResolvedPin/PackageResolvedJson types to schema.ts
- Delete fixture files
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix(gitlab): skip branch status when no pipeline found, retry after PR creation
On GitLab with MR pipelines, posting a commit status without a
pipeline_id causes GitLab to create an unwanted branch pipeline.
Skip posting the status in setBranchStatus() when no pipeline is found
after retries. Retry setting branch statuses after ensurePr() in the
with-pr block so that the MR pipeline created by GitLab can be found.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* fix(gitlab): gate skip-status-without-pipeline behind experimental flag
Move the behavior that skips setting a branch status check when no
pipeline is found behind the RENOVATE_X_GITLAB_SKIP_STATUS_WITHOUT_PIPELINE
experimental environment variable. Without the flag, the original
behavior of always posting the status is preserved.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test(gitlab): restore original 'sets branch status' test case
Keep the original test that verifies branch status is set without
the experimental flag alongside the new skip-behavior test.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(docs): sort experimental env var headers alphabetically
Move RENOVATE_X_GITLAB_SKIP_STATUS_WITHOUT_PIPELINE after
RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY to satisfy alphabetical
ordering requirement in self-hosted-experimental.md.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(gitlab): address PR review comments for skip-status-without-pipeline
Use strict `=== 'true'` check for env var, update docs wording, and
add test coverage for the new experimental flag behavior.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
As noted in #39559, we should also make it possible to use Renovate's
`toolSettings` to tune the Java Virtual Machine that's used to spawn
Gradle, via the Gradle Wrapper.
This will affect any `gradle` manager invocations, but will not apply to
`postUpgradeTasks`, as this is passed in as a parameter.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* fix(gomod): support non-public module paths in `replace` directives
As noted in #41518, we allow extracting `require` directives that
include a module path that's non-public, so we should also support this
for `replace` directives.
* fixup! fix(gomod): support non-public module paths in `replace` directives
* Support InstallTools methods for cake build files
* Allow dotnet tool extraction in single file cake sdk build scripts
* Fix dependency parsing for InstallTools methods
* Remove unused import
* Fix readme for cake manager
* Add test case to improve coverage
* Update lib/modules/manager/cake/index.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
---------
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* - Added Renovate support for the [SCM-Manager](https://scm-manager.org/)
- SCM-Manager is a repository management tool like GitHub
- It is maintained as an open source project by the company [Cloudogu](https://cloudogu.com/en/)
- The SCM-Manager support is not feature complete yet, features like auto merging are still missing
- The SCM-Manager also got added to the documentation as another platform
author Thomas Zerr <thomas.zerr@cloudogu.com> 1690877165 +0200
committer Eduard Heimbuch <eduard.heimbuch@cloudogu.com> 1706264263 +0100
* Reverted numbering change in markdown docs
* Changed from type to interface, if possible
* Removed axios dependency and using the http layer of renovate instead
* Fixed not using scmm specific mime types for accept header
* Use git from test/util instead
* Add dummy tests for no ops
* Fix some phrasing and spelling issues
* Change scmm to scm-manager and fix SCM-Manager specific content type
* Add supported major versions, review plugin requirement, write permissions is needed
* Change using actual host rules instead of mocking it
* Change use http mocks for testing
* Update docs/usage/getting-started/running.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/index.ts
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/mapper.spec.ts
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/readme.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/readme.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/readme.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/readme.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/readme.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Fix scm-manager docs link
* Fix linting
* Fix linting
* Throw errors if username or token is not provided by the host rules
* Replace NO-OP with Not implemented
* Remove objects from log messages
* Fix linting
* Fix path to platform config options
* Fix link to self-host-configuration docs
* Fix link to self-host-configuration docs
* Remove the link to the platform config option, because the tests keep failing
* Fix link to self-host-configuration docs
* Remove not needed type cast
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Fix type check of protocol links
* Move scm-manager into util http folder
* Apply linting
* Add maxBodyLength function and its test
* Add test case if protocol links are not an array of links
* Use zod schema for pagination
* Apply linting
* Refactor typing with zod schema
* Fix test description
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Fix test description
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Fix test description
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Fix test description
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update readme
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Add try catch around fetching the current user
* Switch log statement from info to debug
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Switch log statement from info to trace
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Switch log statement from debug to trace
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Switch log statement from info to trace
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Switch log statement from info to trace
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Switch log statement from info to trace
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Fix linting errors
* Remove credentials check in initRepo
* Fix imports
* Fix zod schema for repositories
* Fix zod schema for pull requests
* Fix 500 error after attempting to update an pr
* Fix wrong typing
* Refactor parameterized tests for better readability
* Refactor SCM HTTP API
* Add setToken functionality
* Remove not needed type definition
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Fix assertion
* Fix istanbul comment
* Change log statement
* Remove type rename
* Move inferred types close to corresponding schemas
* Add platform is experimental
* Remove type renaming
* Fix type imports
* Fix test suite description
* Remove debug log statement
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Fix warning
* Fix paremeterized unit tests with string templates
* Fix spelling
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Fix eslint error
* Convert trace logs to debug logs
* Convert info logs to debug
* Replace manual null and undefinded check with is util
* Rephrase instruction in readme
* Use ensureTrailingSlash instead
* Fix linting
* Keep type and schema together
* Simplify hasAssignees check
* Simplify reviewer mapping
* Remove istanbul comments
* Replace custom scmm header option with renovate native http headers option
* Let the token be passed in initPlatform
* Add description which permissions are needed
* Add support for ignorePrAuthor filter
* Add notes about automerge feature within platform readme
* Add support for fast_forward_only
* Change supported versions due to merge strategy change
* Remove commented code
* Fix import
* Use email schema
* Heed review advice
* Fix import and empty array assertions
* Fix linting issue
* Fix import errors
* Fix removed ignorePrAuthor parameter from initRepo function
* Fix failing unit tests by setting/reseting the global config
* Mark scm-manager as experimental
* Fix zod import path
* Change endpoint configuration, so that user only needs to define origin, but not also the path
* Fix warning of redundant backslash
---------
Co-authored-by: Eduard Heimbuch <eduard.heimbuch@cloudogu.com>
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
Co-authored-by: René Pfeuffer <rene@pfeuffer-web.de>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: René Pfeuffer <rene.pfeuffer@cloudogu.com>
As a follow-up to #41517, when we have a placeholder pseudo version, we
attempt to look up updates for the module.
However, because these are handled by a `replace` directive, there's no
point attempting to look them up.
Especially, as noted in #41517, this could be a non-public module, so
the lookup will fail unnecessarily.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* feat(vulnerabilities): add support for github-actions vulnerability alerts
* fix failed merge from main
* now for real
* review comments
* remove no longer needed assertion
As part of efforts to improve the performance of the `getPrCache`
function, we can add additional instrumentation to understand the time
taken.
This adds additional insight through our instrumentation functions, for
those using OpenTelemetry, as well as a `durationMs` for our logs.
* test(vendir): avoid hard-to-test branches
As a follow-up to #41443, where it's difficult to test this.
* fixup! test(vendir): avoid hard-to-test branches
* fix(github): prevent PR cache sync from exhausting all pages
* refactor(github): derive cutoff from cached items, simplify reconcile
- When lastModified is missing but items exist (via updateItem()),
derive cutoff from max(item.updated_at) instead of falling back
to reconcile's return value. Eliminates the fallback branch.
- reconcile() now called purely for side effects; return value ignored.
- MAX_SYNC_PAGES guard checks needNextPageSync (not needNextPageFetch)
to avoid spurious warning when cutoff already stopped the loop.
- Add test for mixed pages (Renovate + non-Renovate PRs interleaved).
- Update derived-cutoff test for caches without lastModified.
* fix(github): advance PR cache watermark from unfiltered page
* fix(github): add comment clarifying MAX_SYNC_PAGES is a safety net
As noted in #41260, if a Go module is using a `replace` with both
modules with the same name, the major upgrade fails to produce a valid
`go.mod`, as the `replace` will still partially reference the old
package.
When using Vendir with Git repositories, we do not currently provide
authentication via Host Rules, which means we cannot access private
repositories.
Instead, we should set these, so they can be used by `vendir sync` to
authenticate to private repos.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
Dmytro Shteflyuk