* test(noNewURL): add new rule enforcing parseUrl() from 'lib/util/url.ts'
* replace newURL with parseUrl
* remove non-null assertions marks if appropiate
* test: add additional tests
* test: add additional tests and ignore where it makes sense
* implement suggestions
* test: further improve coverage
* apply suggestion
* fix(github): set commit message explicitly for platform automerge
When GitHub's "Use PR title and body as commit message" setting is
enabled, the verbose Renovate PR description gets used as the squash
commit body. Pass `commitHeadline` and `commitBody` to the
`enablePullRequestAutoMerge` GraphQL mutation so the actual commit
message is used instead.
* add REBASE test
* pr feedback
As noted in #43304, when using `osvVulnerabilityAlerts`, we can
sometimes produce an `allowedVersions` that is valid for the ecosystem,
but without setting the `versioning`, we produce an invalid rule, which
then results in a `config-validation` result, breaking any updates on
the repo.
When this happens, it's unclear which `versioning` is used to validate
this, so we should add this to the error message.
As noted in #43304, when using `osvVulnerabilityAlerts`, we can
sometimes produce an `allowedVersions` that is valid for the ecosystem,
but without setting the `versioning`, we produce an invalid rule, which
then results in a `config-validation` result, breaking any updates on
the repo.
We should therefore wire in the default `versioning` for the given
datasource.
As noted in #15827, it would be useful to log the "shallow"
configuration for a given repository - that is, the resolved
configuration, but without any Renovate internal presets being included.
This will be very useful for debugging, as it shows the final resulting
configuration, but without the - often very - verbose internal presets.
In the case that only this log line is shared, we can make sure to
reference the version of the Renovate CLI in the log line.
This requires building on top of changes in
6a4fa3f245 to be able to return a `merged`
and `unmerged` list of presets, and uses helpers from
c8f42e86b4, and
66b84dd12b to process the internal presets
accordingly.
Since we first worked on this, we've worked on improvements to caching
which should provide a require no additional performance overhead
performing this resolution twice.
This can also lead to being able to understand more clearly how Renovate
configuration is being used[0], as we have the final resolved configuration.
We want to make sure we don't try and merge or visit any internal
presets if we're not going to merge them, so we can avoid verbose
`config` or `visitedPresets` results.
[0]: https://www.jvt.me/posts/2024/04/14/renovate-config-sql/
* feat: remove `(major)` suffix from PR title when there's a version already
* Use isNonEmptyStringAndNotWhitespace
* Ensure commitMessageExtra is actually a version
* feat(vulnerability): Add vulnerability alerts to deps-end + lein
deps-edn and lein both essentially use maven upstream for several
packages. Some packages come from clojars directly but others are
typical java packages. If there is an OSV alert for a maven package
however, it will not propagate to the deps-edn or lein dependency update
from renovate. This tries to adjust that so that clojure can derive
dependency alerts from maven as well so that those dependencies are
treated the same way.
* chore: Code review feedback
* chore: Make ecosystem to datasource one to many
Technically datasource to ecosystem was already many to one in a way, as
maven appeared in the values twice. Once for clojure and once for maven
itself. This changes it so that the ecosystem to datasource is the same
way and looking up by ecosystem you will get multiple datasources
(should match the map above the modified code).
Then to make this work, instead of keying off of datasource for
vulnerabilities we key off of ecosystem so that all of the datasources
that are part of that ecosystem inherit the vulnerabilities for the same
dependency.
* chore: Tweaking to try to force CI/CD retry
* feat: allow separate versioning for constraints
As noted in #31831, there are times where it can be useful to override
the version that a given datasource uses, when performing
`constraintsFiltering=strict.`
This should only be applicable to the "additional" constraints, so we
make sure to validate this.
As this is new functionality, any misconfiguration should be marked as
an error.
We can make sure to provide a real-world usecase for this (taking
inspiration from `rails`' versioning of the `rubygems` constraint).
This will be used in the future by the extraction of the `go` directive,
which requires a different versioning to the default `semver`.
* fixup! feat: allow separate versioning for constraints
* fixup! feat: allow separate versioning for constraints
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* extra-log-context
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fix(gerrit): defer change creation to `createPr()`
Signed-off-by: Felipe Santos <felipe.santos@ericsson.com>
* Refactor hashtags handling
* Add prTitle to all missing commitAndPush()
* Fix gerrit tests
* Add warning when prTitle is set in updatePr
* Remove now useless labels from commitAndPush
* Fix gerrit client coverage
* Fix gerrit scm coverage
* Fix rebase coverage
* Improve TODO about assignees
* Fix formatting
* Fix review comment
* Extract to a pushForReview function
* Fix after #41382
* Fix onboarding
* Cleanup code
* Fix ESLint
* Fix tests
* Restore gitRetry for git.merge
* Fix tests
* Simplify hashtags code
* Delete pendingChangeBranch in pushForReview()
* Fix test name
* Remove unnecessary test comments
* Improve test name again
* Fix another test name
* Delete local branch in Gerrit SCM
* Add test for deleting pending branch
* Add tests for pushForReview()
* Fix test case name
* Improve another test name
* Fix another small test inconsistency
* Fix some code style issues
* Use isUndefined instead
* Fix one small test style issue
---------
Signed-off-by: Felipe Santos <felipe.santos@ericsson.com>
* feat(datasource/npm): extract defaultRegistryUrl constant
* Fix some other places
* Remove useless defaultRegistryUrls export
* Fix another place
* Undo rules.spec.ts changes, which are not related
* Fix npm presets
* Restore line removed by mistake
* Fix another test file
* Restore changes to a file which is not relevant
* Fix another small place
* chore(workers/repository): provide more detail when rolling back
To help debug the case where rollbacks are being initiated, we can:
- add slightly more information to the `Filtered out ...` log line
- add `prBodyNotes` to the resulting PR
This requires we expose the `prBodyNotes` field to `LookupUpdate`, and
the `packageName` and `datasource` to `RollbackConfig`, so we can log
them.
* chore(modules/datasource): log `datasource` and `packageName` when filtering
For more context when reviewing the logs.
As part of general work to reinforce the brand link between Mend and
Renovate, we can improve the default PR body footer to clarify this.
This feeds into #29885 and general naming, where we want to keep these
close, while also not being too "in your face".
This is still user-controlled, but provides a more reasonable default.
This also feeds into #26838 and #39305, where we should also remove the
"Bot" from the footer.
So all lookups downstream can be performed in `O(1)` time.
Suggested by Claude Sonnet.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fix(config): resolve repository entry presets in correct order
* refactor: extract `applyHostRules` and `applyNpmrc` to functions
* Reuse applyHostRules in inherited.ts
* Fix test failure
* Improve resolvedRepoEntry log
* Coerce everything
* Fix another test coverage issue
This results in some incorrect behaviour, where we'll have an incorrect
measure of all releases, as this was previously only for a given bucket
of updates.
Additionally, we can make sure this is only mapped once by moving it
above other loops.
As part of future changes, we'll introduce a new Versioning module for
GitHub Actions, which requires knowing if the version it's proposing
actually exists.
This is a more useful concept for Versioning modules to be able to take
advantage of, so we can expose this as an optional capability that
Versioning modules can use.
* feat: timing statistics for getReleases
Adds collection and reporting of timing statistics for
`datasource.getReleases()` calls. Each call records the datasource, registryUrl,
packageName, and duration. The intent is to visibility into where
renovate is retrieving release information and how long that might take.
The report consists of a nested data-structure that provides increasing
detail as we descend datasource, registryUrl, and packageName.
The full report is logged at trace level
`getReleases statistics with packages`.
A summary report including only datasources and registryUrls is logged
at debug level `getReleases statistics summary`.
* add GetReleasesSpanProcessor
- Re-instrument getReleases calls using open telemetry.
- Adds GetReleasesSpanProcessor, which can adapt
`getReleases` spans to GetReleasesStats.
* fixup instrumentation tests
* pr feedback
* pr feedback: naming
* pr feedback: comments
* fix(workers/repository): don't include `skipReason`'d dependencies in flattened updates
When we're preparing the final, flattened, list of branches to prepare
updates for, we're not filtering out any dependencies that have a
`skipReason` in them.
In the case that, as part of future changes like #42510, a `skipReason`
may be added after the `lookup` phase, we can still get PRs raised even
when they shouldn't be.
We already filter out `enabled=false`, so we should make sure to also
filter anything with a `skipReason`.
* feat(osv): mark malicious packages with `skipReason`s
As part of current ongoing supply chain attacks, there have been cases
where Renovate updates packages to a malicious version.
We'll be introducing a more in-depth means to surface these, including
from different API sources, as part of the Enrichment functionality,
but in the short-term we can utilise osv.dev's ingestion of OpenSSF's
Malicious Packages data.
To do this, we need to:
- look for any `MAL-` advisories
- match it against the current dependency's version, and if affected, mark it
as `skipReason: malicious-version-in-use` (which will be unset in
the `lookup()` function, so we still perform updates
- match it against the dependency's available updates, and if any are
affected, mark the dependency
as `skipReason: malicious-update-proposed`
* fixup! feat(osv): mark malicious packages with `skipReason`s
* fixup! feat(osv): mark malicious packages with `skipReason`s
* test(workers/repository): add missing coverage
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
* chore: simplify type
* wip-opus
* Revert "wip-opus"
This reverts commit e7b5f297c9.
* simplify
* sq
* sq
* fixup
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
* chore(types): add a strong type for `ToolName`s
Until #41849, we can use our local definitions of the tool names that
Containerbase supports by extracting out a `ToolName` type.
* fixup! chore(types): add a strong type for `ToolName`s
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
Co-authored-by: gpt-4.1 <jamie.tanna+github-copilot@mend.io>
* fixup! fixup! chore(types): add a strong type for `ToolName`s
* no-never
* simplify
* coverage
* sq
* warn
* sq
* fixup! sq
* sq
* fixup! sq
---------
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
Co-authored-by: gpt-4.1 <jamie.tanna+github-copilot@mend.io>
When we're preparing the final, flattened, list of branches to prepare
updates for, we're not filtering out any dependencies that have a
`skipReason` in them.
In the case that, as part of future changes like #42510, a `skipReason`
may be added after the `lookup` phase, we can still get PRs raised even
when they shouldn't be.
We already filter out `enabled=false`, so we should make sure to also
filter anything with a `skipReason`.
* chore(workers/repository): report malicious packages before `packageFiles with updates`
As part of future changes, we may modify the `skipReason`s before the
update phase, which means that we should ensure these are correct before
logging out `packageFiles with updates`.
* chore(workers/repository): split malicious dependency checks
We will likely run into two specific cases of malicious dependencies -
you're currently using one, or you're receiving an update to one.
We should make these separate, explicit, cases so users are aware what
`malicious` actually means, and what the path forward is.
As part of future changes, we'll be introducing `skipReason: malicious`
against dependencies that have been found to be actively malicious.
Once we've looked up all our dependencies, we should then - centrally -
log any malicious package usages as a WARN, to highlight this to users.
As part of the addition of the new Enrichment modules, we should perform
a prefactor that'll introduce a shared helper for the how we translate
an "Ecosystem" according to OSV with a datasource that Renovate
understands.
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
As part of the addition of the new Enrichment modules, we should perform
a prefactor that'll introduce helper methods that can be used across
both GitHub and OSV Vulnerability Alerts.
Because each module uses a slightly different input (Datasource ID or an
"Ecosystem" according to OSV) we need to handle both types of inputs.
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
* refactor(lint): extract custom oxlint rules into separate files
Split `tools/lint/rules.js` into one file per rule under
`tools/lint/rules/`. Also simplify `test-root-describe` with
early-exit guard clauses.
* feat(lint): add `enforce-ts-extension` oxlint rule
Add a custom JS-based oxlint rule that enforces `.ts` extensions on
local imports. The rule catches two problems:
- `.js` extension used instead of `.ts` (auto-fixable)
- missing file extension entirely (report only)
Checked locations:
- static import/export declarations
- dynamic `import()` expressions
- vitest module APIs: `vi.mock`, `vi.doMock`, `vi.unmock`,
`vi.doUnmock`, `vi.importActual`, `vi.importMock`
Both relative paths (`./`, `../`) and path aliases (`~test/`)
are treated as local. Package imports are ignored.
Also fixes 26 pre-existing violations across 18 spec files.
* Update tools/lint/rules/enforce-ts-extension.js
Co-authored-by: Anne Stellingwerf <1637358+astellingwerf@users.noreply.github.com>
---------
Co-authored-by: Anne Stellingwerf <1637358+astellingwerf@users.noreply.github.com>
* feat(onboarding): make `Add your custom config to ...` more prominent
As part of work to improve the Onboarding flow as part of larger repos,
we noticed that the `Add your custom config to ...` comment may be
missed.
We can make this more prominent by moving it up to the top of the PR.
* fixup! feat(onboarding): make `Add your custom config to ...` more prominent
* test(pr): add test coverage for `automergeSchedule`
* test(pr): validate full `Schedule` text
As part of a future change, we'll be modifying this, so we should
clarify the exact behaviour.
* feat(pr): break `Schedule` definition over multiple lines
To provide a more readable set of `schedule` and `automergeSchedule`
configuration options, we can break these over multiple lines, which
makes it clearer where there are multiple schedules that may apply at
a given time, as well as making it clearer between branch creation vs
automerge, which isn't necessarily clear.
* feat(pr): show cron syntax in code blocks
As it can make it clearer, as well as avoiding potential interpretation
as Markdown.
* fix(pr): ensure enough whitespace between elements
Although it's unlikely to hit our currently used Platforms, it's worth
making sure we do it right.
* test: add additional case for attestation changes
* fix: correctly warn when an attestation is missing
As noted in #37258, when a package registry had previously seen an
attestation for authenticity of a given package release, Renovate should
warn if future updates then lose authenticity.
Our previous attempt at this didn't quite pass around the current
package's attestation, which results in no warnings.
Given recent supply chain attacks where an attestation was removed (such
as Axios in MSC-2026-3522), we should make sure that this logic does
work correctly, and flags to our users.
In the future, we'll add more checks and a failing status check.
By introducing `hasAttestation` in the `LookupUpdate`, this can now be
matched on with `matchJsonata`, as well as providing visibility in the
`packageFiles with updates` log line.
* fixup! fix: correctly warn when an attestation is missing
> Run `pnpm run jest
> lib/workers/repository/process/lookup/index.spec.ts` and handle any test
> failures - the implementation is correct, so update the tests
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* test: clarify that we don't check for intermediate releases
Which we'll look to improve as part of future changes.
* chore: fix typo
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
As a means to make the dry-run functionality a little more useful, we
can log out what commit(s) a given Renovate run would have created
outside of Dry Run.
Because the meta key `contents` is automagically replaced with
`[contents]`, we need to move this into a new field, `rawContents`.
This can also lead to longer lines being output, but provides additional
utility that we've had requests for before.
Johannes Feichtner