* fix(datasource/npm): require public Cache-Control to cache responses
The npm datasource opts out of the authorization-header privacy check
(checkAuthorizationHeader: false) and relies on Cache-Control alone to
classify responses. Previously, when a registry omitted Cache-Control
entirely, cacheAllowed fell through to "cache it" — so private packages
served by GitHub Packages (which sends no Cache-Control header) were
cached in the shared package cache.
Flip the semantic of checkCacheControlHeader: true to require an
affirmative Cache-Control: public signal. Missing or non-public headers
now disallow caching. registry.npmjs.org is unaffected because it
already sends Cache-Control: public, max-age=...
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(cache): avoid renewing disallowed package cache on 304
* Revert "fix(cache): avoid renewing disallowed package cache on 304"
This reverts commit 64801bb036269352465aac580b9861c5b7716cc1.
Make the `checkKeysSorted` first-keys assertion unconditional by
defaulting the expected prefix to an empty array, so `expect` is no
longer nested inside an `if`.
Part of #43845
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
- Convert `param: T | undefined = undefined` to optional `param?: T`.
- Drop dead `= false` defaults on the required cache-provider options.
- Make `GraphqlPaginatedContent.nodes/edges` optional so the `= []`
fallbacks (load-bearing for partial GraphQL connections) are valid.
- Type the unchecked `default_branch` response field as optional so
the `'HEAD'` fallback is retained.
- Drop `tag = undefined` from the Forgejo/Gitea/GitLab preset configs.
Part of #43845
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Add distinct hints to the multi-snapshot tests flagged by the rule
and regenerate the affected snapshot files, then re-enable the rule.
Part of #43845
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* fix(manager/nuget): detect MSBuild SDK updates in sqlproj files
MSBuild SDK versions in `<Sdk>`, `<Import Sdk>`, and `<Project Sdk>`
elements are exact pins, but NuGet versioning treats bare versions as
minimum ranges (`>=`). That caused dependencies such as
`0.1.19-preview` to resolve to the latest release and skip updates.
Apply hybrid versioning to all `msbuild-sdk` dependencies at extract
time: use strict `semver` when the pin is valid semver, otherwise fall
back to `semver-coerced` for non-standard NuGet version strings (e.g.
four-segment revisions). Also add `.sqlproj` to the default manager
file patterns for SSDT SQL projects.
Changes:
- Add `applyMsbuildSdkVersioning()` helper and wire it through all
msbuild-sdk extract paths (XML, global.json, single-csharp-file)
- Extend `managerFilePatterns` to match `.sqlproj` files
- Add extract, util, index, and integration tests
- Document `.sqlproj` and MSBuild SDK extraction in nuget docs/readme
* fix(manager/nuget): use bump range strategy for msbuild-sdk deps
Replace hybrid semver versioning for MSBuild SDK pins with a default
package rule (`matchDepTypes: msbuild-sdk`, `rangeStrategy: bump`) per
review feedback. Remove `applyMsbuildSdkVersioning()` from all extract
paths and update tests accordingly. Sort nuget doc file extensions
alphabetically.
* fix: deno lockfile update in presence of private registries
Renovate was unable to update the lockfile when updating packages from
public registries if any packages from private registries were
referenced in the package file.
This commit fixes this by processing host rules and configuring the
`deno install` invocation for those private registries.
Note that this still doesn't mean support for updating packages from
private registries, it just unblocks lockfile updates in projects where
private registries are used in parallel to public registries.
* fixup! fix: deno lockfile update in presence of private registries
* fix(manager/mise): install resolver tools during mise lock
When binarySource=install, Containerbase only installs tools listed in
toolConstraints. mise lock can invoke npm, go, and gem CLIs while
resolving versions for those backends, but Renovate previously only
installed mise itself.
* fix(manager/mise): use go constraint for golang resolver
* test(manager/mise): remove redundant resolver constraint test
* test(manager/mise): cover resolver tool dynamic installs
* test(manager/mise): cover unconstrained resolver lock updates
* Update lib/modules/manager/mise/artifacts.ts
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
* style(manager/mise): fix prettier whitespace in JSDoc comment
* test(manager/mise): clarify what happens with no `constraints`
* chore(manager/mise): update JsDoc
---------
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io>
* feat(cache): use binary envelopes for package cache writes
* feat(cache): upgrade legacy file cache entries to envelopes on read
The file backend's cleanup decides what to keep from cacache index metadata
alone, so legacy entries (which store expiry inside the payload) would all be
purged on the first sweep after upgrade, cooling the cache.
Add a best-effort `upgradeLegacyEntry` hook on the base class, overridden only
by the file backend, that rewrites a still-valid legacy entry as an envelope
with the same expiry when it is read. The working set converts itself during the
run, so it survives cleanup. Redis and SQLite govern expiry natively and inherit
the no-op default.
* refactor(onboarding): extract a function for calculating packageFiles
As part of a future change, we'll introduce a "summary" view for larger
repositories, and having a function extracted makes intent clearer.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* refactor(onboarding): add a summary for detected package files
As part of future changes in #41502, we're introducing a
Platform-limit-aware onboarding/reconfigure flow that will provide a
summary where appropriate.
Before we do so, we can introduce the new functionality - but not
integrate it right now - to incrementally add support.
As a slightly better interface when we have a large list of detected
package files, we can provide a summary per Manager.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* refactor(onboarding): group 3+ files under a directory as a list
As it's a more readable summary, especially with i.e. GitHub Actions,
where all package files commonly share the same directory.
The use of `3` as the lower bound was chosen without any research or too much
thought put into it.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fix(datasource/crate): tolerate null metadata fields
crates.io returns `null` for unset crate metadata fields. `z.string().optional()`
rejects `null`, so a single null field (e.g. `documentation` on the `sentry` crate)
failed the whole metadata parse and discarded the valid `repository`, leaving
`sourceUrl` unset and breaking monorepo grouping. Use `.nullish()` so null fields
are tolerated.
* datasource/crate: Use `Nullish()` for metadata
* datasource/crate: Use `sentry` for null metadata test
* datasource/crate: Use `DeepNullish()` for metadata
renovate[bot]