* added dart/pub constraintsFilter support
* updated documentation to include pub for constraintsFiltering
* only add extractedConstraints if its populated
* increased coverage
* handle non-nullable environment.sdk better
The `#(\d+)` -> `!$1` replacement added in #42758 over-matched any `#`
followed by digits, corrupting HTML entities such as `​` (becomes
`&!8203;`) and changelog URL anchors such as `CHANGELOG.md#4780` (becomes
`!4780`) in Azure DevOps PR bodies.
Only convert a standalone reference preceded by start-of-string, whitespace
or `(`, matching the boundary already used in util/markdown.ts.
* fix: `commitMessageExtra` not being honored
* Retain version for Maven property versions
* Fix PRs not being marked as immortal
* Revert "Fix PRs not being marked as immortal"
This reverts commit a17cc15342.
* Revert "Retain version for Maven property versions"
This reverts commit 3f14484f46.
* Revert "fix: `commitMessageExtra` not being honored"
This reverts commit 6c86357580.
* fix: avoid removing the version the PR title for Maven properties
* Do not consider Maven property updates as groups
---------
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io>
* chore(manager/mix): extract hardcoded Erlang version for updates
As noted in #44149, we're not performing updates to the version of
Erlang, which means that unless users specify a `constraints.erlang`,
they are resolved to Erlang 25.3.2.21 (2025-07-09).
To start getting updates more frequently, we can extract this with a
Custom Manager, with:
- `loose` versioning (per #26768) for the 4-part versioning
- `extractVersion` to make sure we only get the first major
- `separateMultipleMajor` to allow us control over how we update
- a `renovate:` comment for visibility
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! chore(manager/mix): extract hardcoded Erlang version for updates
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(config): set `groupSingleUpdates=false` by default
Although it didn't seem like this may be a breaking change when we
introduced this[0], there have been a number of follow-up Discussions
reported that have indicated there has been some breakage from the
changes.
Instead of continually fixing forward, we can revert this back to an
opt-in feature.
Once it's stable, we can look at re-enabling it (most likely in a major
release, unless we're confident no breakage should occur).
[0]: https://github.com/renovatebot/renovate/pull/43629#issuecomment-4594201274
* fixup! feat(config): set `groupSingleUpdates=false` by default
* test(util/exec): cover `Executing command` log line
As an important log line, we should make sure it doesn't change without
a test failing.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* chore(util/exec): log the environment variable names when exerting a command
When debugging, it's often unclear as to whether an environment variable
was passed to a command, unless we see the command fail (which includes
the environment variable names).
We can make sure we log the environment variable names themselves, when
executing the command, to make it more clear.
* fixup! chore(util/exec): log the environment variable names when exerting a command
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fix(workers/repository): use GlobalConfig for productLinks
PR #44098 added productLinks to GlobalConfig.OPTIONS, which moves it into
GlobalConfig and deletes it from the per-repo config. Several readers
were not migrated and now receive undefined from config.productLinks.
Most visibly, setStability and setConfidence build the status check
target_url from config.productLinks?.documentation. With it now empty the
URL becomes scheme-relative (e.g. "key-concepts/minimum-release-age/"),
which GitLab rejects with HTTP 400. That throws in setBranchStatus and
aborts the branch before its merge request is created.
Migrate the remaining readers to GlobalConfig.get('productLinks'),
matching #44098, and drop the now-redundant coerceString calls and
non-null assertions.
* refactor(config): drop productLinks from RenovateSharedConfig
productLinks is globalOnly and is now read via GlobalConfig.get. Leaving
it on the per-repo RenovateSharedConfig let callers read the (always
empty) config.productLinks, which is the footgun this PR fixes. Remove it
from the shared interface so it only exists on RepoGlobalConfig, and the
type now prevents reintroducing config.productLinks.
As noted in #43489, it's not currently possible to install the nightly
variant of Rust.
Although Containerbase does have support for `install-tool rust nightly`
it never gets that far, as the version lookup occurs through the
`docker` datasource.
We can instead make sure we move to the `rust-version` datasource and
its associated `rust-release-channel` versioning.
The result from the `rust-release-channel` returns a version like
`nightly-2026-06-19`, which needs extra handling in Containerbase.
We can also update **??** what supported Rust versions we'd accept.
* fix: not applying global options in object entries in `repositories` array
* Use isNonEmptyObject
* Add test for per-repo override
* Use AllConfig instead
As a follow-up to e1e5c398e0, we can make
sure that we remove references to hardcoded docs site URLs, by wiring in
the `GlobalConfig.get(...)` call.
To do this, we need to make sure that `productLinks` exists to be called
by `GlobalConfig.get`.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
mise tool versions are plain version strings (e.g. `"aqua:pnpm/pnpm" = "11.6.0"`)
with no syntax to attach a commit digest, so a digest can never be written to a
mise config file. Backends such as aqua and core resolve to the github-tags
datasource, which exposes `getDigest`, so a global `pinDigests: true` makes
Renovate emit `pinDigest` updates for mise tools. These updates produce no file
change and then fail post-update verification with "Digest is not updated" ->
"Error updating branch: update failure" on every run.
Disable digest pinning at the manager level, matching terraform, gomod, and the
other managers whose dependencies have no place to store a digest.
* chore: ensure we use `productLinks` for docs site links where possible
Where possible, we should be making sure that we're using the
`productLinks`' configuration for the documentation site, especially
where self-hosted users may create a mirror of their docs[0].
To make sure we catch this in the future, we can introduce a custom
linting rule with Oxlint to enforce this.
Where we (currently) can't wire in the config, we can disable it against
that line.
[0]: https://www.jvt.me/posts/2024/11/19/renovate-private-docs/
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! chore: ensure we use `productLinks` for docs site links where possible
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! chore: ensure we use `productLinks` for docs site links where possible
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
When attempting to perform dependency updates on the `tmp` package,
parsing a previous version's Zod schema results in a lookup failure, as
it had an incorrect form of `repository` as of tmp@0.0.4.
We can handle this by treating it more loosely to convert an array of
repositories into a single element, and handle this on both a
per-version and per-package lookup.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(datasource/packagist): mark abandoned packages as deprecated
Parse Packagist's `abandoned` field and surface it via `isDeprecated`
and `deprecationMessage`, matching how the npm datasource handles npm's
`deprecated` field. When `abandoned` is a replacement package name, the
message suggests it.
This is an official registry signal, so it maps to Renovate's
deprecation mechanism, not the timestamp-based abandonment heuristic.
* test(datasource/packagist): drop incorrect output-type annotation on raw input
* update tests
* Update lib/modules/datasource/packagist/schema.ts
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
---------
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
* fix(docker): handle 405 maxResults error on auth probe for ECR-compatible proxies
Some private Docker registries that front ECR reject `n=10000` on the tags
URL even during the auth-probe request, returning a 405 with the ECR-style
"Member must have value less than or equal to 1000" error body.
`getAuthHeaders` had no handler for this case and returned null, so the
lookup aborted before the main fetch loop's existing n=1000 retry could fire.
Fix: extract `isECRMaxResultsResponse` from `isECRMaxResultsError` in ecr.ts
and use it in `getAuthHeaders` to detect the 405 pattern. When matched, fall
back to probing the base `/v2/` endpoint for auth, then let the existing
`isECRMaxResultsError` retry in the tag-fetch loop handle the n=1000 fallback.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(docker): address PR review comments on ECR proxy auth probe fix
- Shorten test token to 'abc' to avoid CodeQL secret-detection false positive
- Replace HttpResponse<any> with HttpResponse<unknown> in common.ts and ecr.ts
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(docker): replace HttpResponse<any> with HttpResponse<unknown> in isECRMaxResultsResponse
Cast body to a typed shape inline instead of widening the whole response to any.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* test(docker): replace toMatchInlineSnapshot with toEqual in ECR auth probe test
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(platform/forgejo): replace getJsonUnchecked with validated getJson
Migrate all getJsonUnchecked calls in the Forgejo platform module to use
getJson with Zod schemas for response validation. Add comprehensive Zod
schemas to schema.ts and update test mocks to use proper data formats.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* simplify by using infered types
* first pass on reducing duplications
* move PrStatus and CommitStatus to schema
* remove code handling BranchStatus values now ensured by schema
* remove now unreachable code
* fix coverage
* use forgejo schemas instead gitea for changelog fetching
* feat: do not abort repo on unrecognized default merge style
* refactor: instead of usages of `?? {}` with a default parameter
* tighten required parameters and move contentString generation to schema
* refactor: merge both content schemas and use a discriminated union
* refactor: move patchJson and postJson to schema validation
* Make body field required
* make schema more strict
* use DeepNullish
* simplify catch
* revert the gitea Content type change
* unify User
* log more nicely if accidentally not a file has been referenced
* Use fakeSha and LongCommitSha schema
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Per #40738 and #44034, we're seeing recent changes to
`renovate-config-validator` that have led to either a gap in
functionality or a breaking change that makes
`renovate-config-validator` unusable.
To make sure that we ensure that we're always making reasonable changes
to `renovate-config-validator`, we can introduce an integration test
harness to validate the call end-to-end.
We can make sure to handle:
- `--version`
- using global/repo config files
- any of the known config filenames (#44034)
- explicitly test a JSONC and JSON5 file with their respective example
content
Due to the full end-to-end run of `renovate-config-validator`, which
creates a full Node process, we can run the tests concurrently to ensure
that we speed up the test runs, as they're fairly slow in comparison to
regular tests.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
Sebastian Poxhofer