* feat(vendir): support extracting HTTP sources
As noted in #41435, Vendir's support for HTTP sources would be useful
for Renovate to keep updated.
Instead of managing the updating of files ourselves, we can use Vendir's
existing `lockFileMaintenance` task to do so, where `vendir sync` will
re-fetch the remote file(s) and sync them to the repo.
For this to be supported, we can extract the HTTP sources with
`unsupported-datasource`, so Renovate knows that the dependency is
there, but can't be managed by us.
This makes it possible to extract HTTP dependencies, and then have
Renovate update them through `lockFileMaintenance`.
* fixup! feat(vendir): support extracting HTTP sources
As we're always returning a dependency, we can remove the nullable
return type.
This also allows us to increase test coverage, because we now don't have
code paths that aren't tested.
fix(datasource/python-version): gracefully handles python.org 429 rate limiting
When python.org returns HTTP 429, falls back to containerbase prebuild
releases instead of aborting the entire repository with ExternalHostError.
* Add nuget capability to read packages from cs files
This is useful for dotnet source files that make use
of the .NET 10 feature to have single file projects,
where packages and sdks can be defined in a source
file.
* Add tests to validate that the nuget.config file is respected for single csharp files
* Apply PR linter suggestion for prettier code
* Remove unnecessary try-catch to increase code coverage
* Update phrasing in documentation
Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>
* Use codeblock instead of fixture
* Remove unused import
* Remove unnecessary fixtures and only verify required methods are called
* Fix imports in single-chsarp-file.ts
* Fix import ordering
* Increase code block indent
---------
Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* refactor(platform): programatically mark Platforms as experimental
As part of future changes, we'll want to be able to more
straightforwardly determine whether a given Platform is experimental.
To do this, we can add a new optional `experimental` flag to the
`Platform`.
As part of having this available, we can refactor how our docs for
Platforms are built, and replace a hand-authored experimental notice, we
can automagically insert it into the built docs.
To make sure that we don't break the rendering of the Markdown for
Mkdocs, we need to insert the experimental notice after the page
heading.
As we're now using the Platform itself, not only the ID, we need to
refactor how `tools/docs/platforms.ts` renders the pages.
* docs(platforms): clarify which Platforms are experimental (#41249)
* chore: format code block
---------
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
As noted in #41215 and #40830, when using the Bun manager in a
repository that has a `.npmrc`, the `.npmrc` is not used.
This is at odds with `bun`'s tooling itself reading from this file, so
we should make it possible to parse + make the `npmrc` available for
usage.
We can add this with our new `resolveNpmrc` function.
We do not need to add in-depth test coverage as this should be handled
by `resolveNpmrc`.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* refactor(manager/npm): extract function for resolving `.npmrc`
As part of future changes in #41215 and/or #41216, we will resolve the
`.npmrc`, if it can be found, in multiple places.
Before we do this, we can prefactor this logic to extract this out into
its own function that can be used independently.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* test(manager/npm): add missing test coverage
This is coverage that we've never had on this function, and was reported
by CodeCov.
---------
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* feat(versioning): add elm versioning support
* fix(versioning/elm): remove unnecessary defensive check in nextMajor
* fix(versioning/elm): use named capture groups in range regex
* fix(versioning/elm): use semver gte instead of gt || eq
* Update lib/modules/versioning/elm/index.ts
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* feat(mise): add support for github backend
* test(mise): remove redundant github backend test
* refactor(mise): flatten nested conditionals in github backend
* refactor(mise): only set extractVersion for custom version_prefix
* refactor(mise): use escapeRegExp and simplify extractVersion spread
* feat(nuget): add supportsLockFileMaintenance flag
The NuGet manager supports lock file maintenance via `packages.lock.json`
but was missing the `supportsLockFileMaintenance` export.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(manager): add lockFileNames metadata to all lock file managers
Add `lockFileNames` field to `ManagerApi` interface and export it from
all 24 managers that support lock file maintenance. This metadata will
be used to auto-generate the lock file support table in docs.
Also adds a validation test ensuring managers with
`supportsLockFileMaintenance` always provide `lockFileNames`.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
feat(nuget): add supportsLockFileMaintenance flag
The NuGet manager supports lock file maintenance via `packages.lock.json`
but was missing the `supportsLockFileMaintenance` export.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
As part of #39309 we enabled "Vigilant Mode" for the `@renovate-bot`
author.
To give an indication to folks who are self-hosting (on GitHub.com) and
using this Git commit author, we can provide a log message to let them
know.
This does not at all stop usage of this default committer email address,
but does provide a "nudge" to folks that they may see `Unverified`
commits pop up.
* fix(vendir): remove registryUrls from git-refs dependencies
The git-refs datasource does not support custom registries
(customRegistrySupport = false). Setting registryUrls on git
dependencies causes a spurious warning in the Renovate dashboard:
'Custom registries are not allowed for this datasource.'
This removes the registryUrls property from extractGitSource since
the git URL is already captured in depName and packageName.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(vendir): remove redundant packageName from git-refs dependencies
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
This change introduces a heap size limitation for the Gradle daemon used
when updating the Gradle wrapper, defaults to 512m.
The heap size is limited to the globally configured limit, which
defaults to 512m. It can be configured on the repository level, but not
exceed the globally configured limit. A hard coded mimiumum heap size of
512m is enforced.
The configuration option is named `toolSettings`, which has two
properties for the maximum and initial heap size. See
`docs/usage/configuration-options#toolSettings` for more details.
Avoid unnecessary retry loops when merge_when_pipeline_succeeds is already
enabled on a merge request. This prevents wasting ~15 seconds per MR when
reattempting platform automerge on MRs with failed pipelines.
Co-authored-by: Ona <no-reply@ona.com>
As a safety measure for self-hosted administrators, we can make sure
that we set `allowedUnsafeExecutions` to not allow any commands by
default.
This closes off a significant risk of executing Gradle Wrapper
commands, which use the repository's copy of the wrapper, and any
Gradle buildscript, when executing, which can lead to significant remote
code execution, even before you take into account malicious dependencies.
As this is now off-by-default, we can enable it by default in our tests
to make sure that there are minimal changes required.
As noted in #40774, if a `pnpm-lock.yaml` isn't found, the
`pnpmShrinkwrap` is undefined, which then results in `upath.dirname`
throwing an error.
We can make sure that we have a value, and exit out early if not.
This is a short-term fix, and we should follow-up to make it so we can
find the `pnpm-workspace.yaml` if there's not a lockfile.
Jamie Tanna