* added support for extracting integrity and tarball from npm datasource
* test(datasource/npm): keep integrity and tarball in packument shape assertions
The packument-trimming tests on main pinned a cached shape that dropped
`dist.tarball`, so they broke once the schema started retaining
`integrity` and `tarball`. Update both expectations to the new shape and
cover `integrity` alongside `tarball`.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test(workers/lookup): expect integrity and tarball on npm updates
`generateUpdate` copies `downloadUrl` and `newDigest` from the release
onto the update, so every npm lookup in these tests now carries the
tarball URL and, where the packument fixture has one, the integrity
hash. Pin and rollback updates are built without those release fields,
so their expectations are unchanged.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Michael Kriese <michael.kriese@mend.io>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: preserve current compatibility after lookup
* fix: expose current compatibility in lookup result
* test: preserve current compatibility after lookup
* test: preserve compatibility through fetch
* test: isolate current compatibility regression
* test: isolate current compatibility regression
* test: isolate current compatibility regression
* test: isolate current compatibility regression
Adds a custom oxlint rule renovate/v8-ignore-no-count that flags the
count form '/* v8 ignore next <N> */'. The count is not honored by
vitest's ast-v8-to-istanbul hint parser, which captures only the
keyword (if/else/next/file); 'next' always exempts exactly the next
AST node. Trailing counts therefore suggest a line range that is never
applied and mislead readers.
The rule is autofixable (drops the count, preserving actual behavior)
and has been applied to all existing occurrences.
As part of future changes in #45190, we have found that when using
GitHub Actions' dependency lockfile, the digest pinning is manged by the
lockfile, rather than being specified in the package file itself.
To avoid a "flip flop" where using the manager removes the digest from
the package file (relying on the lockfile itself) and then a `pinDigest`
update re-adds it to the package file, we can instead follow how
`digestOneAndOnly` works and add a means to note
`digestManagedExternally`.
This isn't currently used, but allows an opt out for github-actions in
the future.
Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io>
As per #44820, `pinDigest` updates currently don't get
`minimumReleaseAge` checks applied to them.
We can extend the recent support for `digest`s being handled by also
introducing support for `pinDigest`s to receive `minimumReleaseAge`
enforcement.
This will:
- enforce `minimumReleaseAge` on all updates that `pinDigest`s has
pending
- consider the newest resolved version's timestamp, ignoring
`rangeStrategy`-related logic
- allow unversioned releases like `latest` to /not/ be bound by
`minimumReleaseAge`, as they'll potentially not have a release
timestamp and will be unpinned forever, which is less safe (and
reduces reproducibility)
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
In some cases, we hadn't correctly wired in the `minimumReleaseAge`
checks for `digest`, due to the `currentValue` not changing.
To handle this, we need to:
- use our helper methods for calculating whether the `minimumReleaseAge`
has passed
- handle a new digest's new `releaseTimestamp`
the current timestamp
- intentionally not gate `minimumConfidence`, as this is only computed
per-release, not at the digest level
- note the fixed behaviour, and clarify when it will/will not work
- add coverage for all generated updates for `digest`s, including when
remapping a Go Modules update as a `digest`
- clarify that `filterInternalChecks` and
`applyMinimumReleaseAgeToDigestUpdate` should stay in sync
Co-authored-by: Claude Fable 5 <jamie.tanna+claude-code@mend.io>
As part of follow-up changes, we'll need to call the checks in multiple
places, so should prefactor these into helper methods.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
As part of follow-up changes, we'll use these functions to centrally
determine as to whether to execute `minimumReleaseAge` or
`minimumConfidence` checks against a given updateType.
For now, we can wire this into our documentation tests, to make sure
that this stays in sync with `isMinimumReleaseAgeApplicable`.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
Enable the type-aware typescript/no-unnecessary-type-arguments rule as
error and remove all 44 pre-existing redundant type arguments (type
arguments identical to the type parameter default), e.g.
HttpResponse<string>, ZodError<unknown>,
PackageDependency<Record<string, any>>.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Enable no-else-return (with allowElseIf: false) and unicorn/no-lonely-if
as errors in .oxlintrc.json and fix all 131 pre-existing violations
(91 no-else-return, 40 unicorn/no-lonely-if) across 98 files.
The no-else-return violations were fixed with the oxlint autofix
(iterated to a fixpoint, plus two else-if chains that required
--fix-dangerously) followed by Prettier formatting. One comment dropped
by the autofix in lib/modules/manager/pub/artifacts.ts was restored
manually. The unicorn/no-lonely-if violations were merged by hand,
preserving comments and coverage-ignore hints.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
ci(linter): add renovate/no-redundant-mock-reset rule
Vitest sets mockReset: true globally in vitest.config.mts, which resets
all mocks before each test. This makes vi.resetAllMocks() /
vi.clearAllMocks() and per-mock .mockReset() / .mockClear() calls inside
beforeEach/afterEach hooks redundant. Add a custom oxlint rule (enabled
for **/*.spec.ts and test/**) flagging such calls, and remove the 40
redundant calls it found. restoreAllMocks/mockRestore are not flagged
because restoreMocks is not enabled globally.
Two sites keep an inline disable with a reason: nested beforeEach hooks
in filter-checks.spec.ts and onboarding/pr/index.spec.ts intentionally
call mockReset() to discard once-values queued by an outer beforeEach.
Requested by maintainer review feedback (review comment 3052324877).
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
As noted in #43304, when using `osvVulnerabilityAlerts`, we can
sometimes produce an `allowedVersions` that is valid for the ecosystem,
but without setting the `versioning`, we produce an invalid rule, which
then results in a `config-validation` result, breaking any updates on
the repo.
When this happens, it's unclear which `versioning` is used to validate
this, so we should add this to the error message.
* feat(datasource/npm): extract defaultRegistryUrl constant
* Fix some other places
* Remove useless defaultRegistryUrls export
* Fix another place
* Undo rules.spec.ts changes, which are not related
* Fix npm presets
* Restore line removed by mistake
* Fix another test file
* Restore changes to a file which is not relevant
* Fix another small place
* chore(workers/repository): provide more detail when rolling back
To help debug the case where rollbacks are being initiated, we can:
- add slightly more information to the `Filtered out ...` log line
- add `prBodyNotes` to the resulting PR
This requires we expose the `prBodyNotes` field to `LookupUpdate`, and
the `packageName` and `datasource` to `RollbackConfig`, so we can log
them.
* chore(modules/datasource): log `datasource` and `packageName` when filtering
For more context when reviewing the logs.
So all lookups downstream can be performed in `O(1)` time.
Suggested by Claude Sonnet.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
This results in some incorrect behaviour, where we'll have an incorrect
measure of all releases, as this was previously only for a given bucket
of updates.
Additionally, we can make sure this is only mapped once by moving it
above other loops.
As part of future changes, we'll introduce a new Versioning module for
GitHub Actions, which requires knowing if the version it's proposing
actually exists.
This is a more useful concept for Versioning modules to be able to take
advantage of, so we can expose this as an optional capability that
Versioning modules can use.
* test: add additional case for attestation changes
* fix: correctly warn when an attestation is missing
As noted in #37258, when a package registry had previously seen an
attestation for authenticity of a given package release, Renovate should
warn if future updates then lose authenticity.
Our previous attempt at this didn't quite pass around the current
package's attestation, which results in no warnings.
Given recent supply chain attacks where an attestation was removed (such
as Axios in MSC-2026-3522), we should make sure that this logic does
work correctly, and flags to our users.
In the future, we'll add more checks and a failing status check.
By introducing `hasAttestation` in the `LookupUpdate`, this can now be
matched on with `matchJsonata`, as well as providing visibility in the
`packageFiles with updates` log line.
* fixup! fix: correctly warn when an attestation is missing
> Run `pnpm run jest
> lib/workers/repository/process/lookup/index.spec.ts` and handle any test
> failures - the implementation is correct, so update the tests
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* test: clarify that we don't check for intermediate releases
Which we'll look to improve as part of future changes.
* chore: fix typo
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
When a `lookupError` occurs, it's currently unclear as to why the lookup
error occurred.
It seems to be more common in the Go ecosystem where a lookup error
occurs, and Renovate autocloses PRs, only to recreate them in a
future run.
To provide more useful debugging information to users, we can add the
actual `lookupError` string itself.
This will make sure that we're calling it for each release being
skipped/continued with, so we're reducing the log lines for duplicate
dependencies across the codebase.
Refactors `getNewValue` logic to replace it with an optional
`getPinnedValue()` where rangeStrategy=pin. This way each versioning
module doesn't need to add and test extensive "pin" logic.
This should not be breaking, but out of an abundance of caution, we'll
mark it as such.
* chore: debug log message when timestamp is optional
When setting minimumReleaseAgeBehaviour to optional
it is intended that packages that does not have a release timestamp
will get updated. Writing a warning to the console is spam for an
intentional setting.
* chore: re-add WARN log, once
To make sure that users are still aware, we can make sure a single
warning log message is emitted.
---------
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io>
* Optimize version filtering logic in filterVersions and lookupUpdates functions
* Simplifies version filtering optimization to cover conditions by existing tests.
* Further reduction of versioning API usage.
* Keeping compatibility of exported function filterVersions()
As noted in #38290, #38348, a "rough edge" of the current implementation
of `minimumReleaseAge` is that:
- if we have set `minimumReleaseAge` to apply to a given dependency
- and we have 3 dependencies that need an update
- 2 of which have a `releaseTimestamp` that is not yet "stable"
- 1 of which does not have a `releaseTimestamp`
The dependency update that does not have a `releaseTimestamp` will be
treated as "stable", and will receive an update immediately.
To make this a little more predictable, and explicit, we should add a
new configuration item, `minimumReleaseAgeBehaviour`, to control this
behaviour.
This adds the new configuration field, as well as making it available as
a strongly typed field in the codebase.
In the case that `minimumReleaseAgeBehaviour=timestamp-optional` is
being used, we will WARN on any packages that are being updated, but
maybe shouldn't be, as a way to proactively inform the user of possible
misconfiguration.
Closes#38290, #38348.
When performing lookups in Mend's Merge Confidence APIs, our contract
requires that we use the `packageName` not the `depName`.
In 9b7ae6aa98 and
b67eae2180 we made changes to make sure
that this wasn't the case, but we ended up missing a couple of cases.
As part of discussion in #38290, #38348 and #38324, the current
behaviour of `minimumReleaseAge` has been flagged as not particularly
great, as when we run with `minimumReleaseAge` enforced, a package that
does not return a `releaseTimestamp` will no longer be treated as
release that is bound by `minimumReleaseAge`'s checks to make it
pending.
As noted in the discussions, this can lead to cases where users are in a
"false sense of security", as they feel comfortable with
`minimumReleaseAge` in place, but it is not being enforced, only when
the `releaseTimestamp` is present.
Before we change this, we should add a test to document the existing
behaviour.
[0]: https://github.com/renovatebot/renovate/discussions/38290
[1]: https://github.com/renovatebot/renovate/discussions/38348
chore(tests): remove snapshots from `filter-checks`
As CI complains about it when modifying tests in this file, so we should
prefactor these snapshots out.
Matthew Nitschke