As the test case appears to be wrong (we return an error, not a warning)
and doesn't seem to be exercising a field we've had available in recent
Renovate releases, since this test was introduced in
bb6c27faf8.
* docs(manger/github-actions): reword "community actions" section
As some follow-ups to 27a3f5871f, we
can slightly reword the intro to add some more information about what
these target.
* docs(manager/github-actions): document why there may not be a `packageName`
* docs(manager/github-actions): generate a table for Actions and their `with`s
To provide further clarity on how each of the Actions' `with`s are used,
we can make this more explicit in our autogenerated docs, providing:
- which field(s) are extracted, taken from their Zod schema (with help
from Claude Opus to extract this)
- note the dependency updating, and where it may be determined from the
given `withSchema`
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
* test(config/validation): remove `platformConfig` test
As the test case appears to be wrong (we return an error, not a warning)
and doesn't seem to be exercising a field we've had available in recent
Renovate releases, since this test was introduced in
bb6c27faf8.
* test(config/validation): use a valid cache namespace for test
To prevent unnecessary errors, when we start validating all
`warnings`/`errors`.
* test(config/validation): validate all `warnings`/`errors`
To make sure that we've got coverage to shows us any potential breaking
changes as new validation is added.
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
Add regression tests for the fix that allows a null or missing
home_page in PyPI JSON responses (#43814). Covers both the schema
parser and the datasource, asserting that homepage is left unset and
sourceUrl/changelogUrl fall back to project_urls when home_page is null.
* fix(datasource/pypi): allow null home_page in PyPI JSON response
PyPI returns "home_page": null for projects that declare only
project_urls. The strict z.string().optional() schema threw a ZodError
in getDependency, aborting the JSON-API lookup and resolving such
packages to no-result. Use .nullish() to accept null, matching how
requires_python already handles PyPI's nulls.
* fix(datasource/pypi): allow missing home_page in PyPI JSON response
Apply the suggestion to chain `.optional()` and `.nullish()`.
* test(config/validation): explicitly check error/warning messages
Previously, we had a number of tests checking for i.e.
`expect(warnings).toHaveLength(1);` which wouldn't necessarily be the
warning that we were expecting to see, nor would break if the message
changed (un)intentionally.
We can refactor this and:
- assert on the contents of `errors`/`warnings`
- check the `topic` only if it's interesting - for instance if it's a
`Configuration Error`, but under `warnings`
- removed a `bumpVersion` test that doesn't make sense
- removed snapshot tests
This also reduces our usage of snapshot tests, as we're trying to remove
them where possible.
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
* test(config/validation): use `toBeEmptyArray`
As it's a little clearer when looking in the file, and asserts that it's
an array.
* test(config/validation): expect new validation errors
---------
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
As a follow-up to #43804, we can make sure that our configuration no
longer needs migrations.
If there are migrations needed, we can see the resulting configuration
and amend it.
* fix(config): drop removed rebaseStalePrs from lockFileMaintenance default
* fix(config): set rebaseWhen behind-base-branch in lockFileMaintenance default
The previous commit only removed rebaseStalePrs. Restore the default's
intent by setting its documented equivalent rebaseWhen: behind-base-branch
(the same mapping used by the rebaseStalePrs migration and the
:rebaseStalePrs preset).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(config): just remove deprecated rebaseStalePrs, no default change
Per maintainer feedback on the PR: keep this to removing the dead key
so lockFileMaintenance keeps tracking the global rebaseWhen default.
Revisit behind-base-branch in a future major.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The test for this has been broken for some time, and only highlighted
when we start to look at the reason the test is failing - we're
providing a `bumpVersion` but we're intending it to be the
`bumpVersions` config.
Even if we fix the code, this then highlights that we have no validation
code in place, so the tests fail.
We'll follow-up to re-add validation in the future, but for now we can
remove a test that isn't testing what we're intending it to.
As part of future changes, we want to perform strict validation on
the `allowedValues` for all config options as part of Config Validation.
Before we do this, per #40805, we should make sure that the config
options are all marked accordingly.
The list of relevant config options that support pattern matching has
been determined by Claude Opus.
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
* fix(datasource/npm): tolerate non-string `time` entries in packument
JFrog Artifactory npm registries emit `"unpublished": null` under the
packument `time` field. Since the schema declared `time` values as
`z.string()`, the `null` failed validation and Zod rejected the entire
packument, so every package lookup returned no-result.
Strip non-string `time` entries via a shared `PackumentTime` transform so
a stray metadata key cannot invalidate the whole packument, while keeping
the real version->timestamp entries the datasource relies on.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(datasource/npm): use LooseRecord for packument time
Per PR review.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Stylelint come with two official config packages maintained separately.
However, some major release of one of the config packages require the
latest major release of the stylelint tool and vice versa.
On that case, Renovate will propose separated update merge requests that
will never be solvable because of dependencies conflict during npm
install.
Also, as stylelint is not a mono-repo and use a completly different
releases history from its related config package, we MUST ensure
major/minor separation is deactivated to get the group process working
correctly.
* fix(datasource): replace getJsonUnchecked with validated getJson in npm/Node/PyPI/Go
Replace all getJsonUnchecked calls in npm, Node.js, PyPI, and Go datasources
with Zod-validated getJson calls:
- datasource/npm: add NpmResponseSchema to schema.ts (shared with presets)
- config/presets/npm: migrate to NpmResponseSchema with passthrough version fields
- datasource/node-version: add NodeReleasesSchema using LooseArray
- datasource/pypi: add PypiJSONSchema (nullable+catch for lenient empty-body handling)
- datasource/go: add VersionInfoSchema for both versionInfo and getLatestVersion calls
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* some manual cleaning up
* removing schema level catch
* removing some more types
* refactor: rename schema
* fix linter errors
* remove schema suffix which hasn't been catched by linter
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(datasource): replace getJsonUnchecked with validated getJson in misc+merge-confidence group
Replaces all getJsonUnchecked calls with Zod-validated getJson calls in:
- crate: adds CrateMetadataSchema to existing schema.ts
- conan: uses existing ConanJSON schema directly
- puppet-forge: new schema.ts with PuppetModuleSchema
- conda: new schema.ts with CondaPackageSchema
- repology: new schema.ts with RepologyPackagesSchema
- jenkins-plugins: new schema.ts, parameterizes helper with ZodType<T>
- custom/formats/json: uses z.unknown() for user-defined responses
- merge-confidence: adds inline MergeConfidenceResponseSchema
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: correct nullable/optional schema fields for crate, jenkins-plugins, puppet-forge
- crate: remove .optional() from all CrateMetadata fields to match string|null type
- jenkins-plugins: use .default({}) instead of .optional() for plugins fields so schemas match required Record types; widen ZodType input to unknown; update JenkinsPluginVersion.releaseTimestamp to Timestamp|null to match MaybeTimestamp output
- puppet-forge: change releases from .optional() to .default([]) to match Release[] type
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore: migrate zod/v3 imports to zod/v4 in misc datasources and merge-confidence
Update remaining zod/v3 imports in files added/modified by the getJsonUnchecked
migration to use zod/v4 as required after the upstream migration.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore minor improvements
* remove unnecessary types and reintroduce nullable where necessary
* refactor: move logic into transform
* test: add tests to improve coverage
* chore removed some unused types
* remove type declaration
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* Add support for Azure DevOps in dependency dashboards feature
related #9592
* Add missing test for got wrapper
* Apply all current CR suggestions
* fix: resolve eslint and tsx issues in Azure platform code
* test: add coverage for issue.number undefined cases
Add test cases to ensure proper handling when:
- Trying to reopen an issue without a number
- Trying to update an issue without a number
This improves code coverage for the null checks added in previous commit.
* test: fix and add tests of azure/issue.ts to up coverage
there was mismatch in mock resulting in testing of different code branch
* refactor: address review feedback
* fix: type-check
* refactor: address review feedback round 2
* apply suggestions
* Apply suggestions from code review
Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com>
* refactor: use partial helper and remove host-rules mock in issue.spec.ts
* more changes from suggestions
* Update lib/modules/platform/azure/issue.spec.ts
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
---------
Co-authored-by: Viktorie Novotná <viktorie.novotna@drmax.eu>
Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* fix(nuget): replace getJsonUnchecked with validated getJson
Migrate NuGet v3 datasource from unvalidated HTTP responses to Zod-schema
validated ones. Creates schema.ts with ServicesIndexRaw, CatalogPage, and
PackageRegistration schemas derived from the existing TypeScript interfaces.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(nuget): migrate zod import from v3 to v4
Update schema.ts to use 'zod/v4' instead of 'zod/v3' following the
upstream migration in renovatebot/renovate PR #43691.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore: some manual improvements
* refactor: rename schema
* fix linter errors
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(terraform-provider): replace getJsonUnchecked with validated getJson
Convert all five TypeScript interfaces (TerraformProviderVersions,
TerraformProviderReleaseBackend, TerraformRegistryVersions,
TerraformRegistryBuildResponse, VersionDetailResponse) to co-located
Zod schemas in schema.ts and update all five call sites in index.ts to
use the typed http.getJson() overload. Types are now derived with
z.infer<> to prevent interface/schema drift.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix linting errors
* remove types
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
As part of future changes, we'll be making further tweaks to how the
onboarding PR is generated.
However, recent changes to the onboarding PR has proved that the
generation of the hash is quite awkward to work with.
We can use Claude Sonnet's help to refactor this and introduce a test
that helps us understand what the new hashes should be if there are
changes.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* test(workers/repository): use more explicit test case
Otherwise this could pass unnecessarily if either `schedule` or
`automergeScheudle` renders to this.
* test(workers/repository): document `force` doesn't apply in this function
As it should've been performed higher up in the configuration merging.
* fix(workers/repository): correctly render `schedule` for vulnerability alerts
Otherwise we see i.e.
- Branch creation
- ""
- Automerge
- At any time (no schedule defined)
When the `init` phase encounters an error, we're currently processing it
twice.
This leads to "Action Required" Issues losing any error context (as only
the `errorRes`, not the full `error` is returned), making them much less
useful.
We can refactor to:
- not duplicate the handling
- pass around the full `error` so we can log it outside of the `init`
phase
As noted in #43558.
* docs: skip validation on JSON files that aren't Renovate config
As part of future changes, we'll enable validation on all JSON code
snippets to run Config Validation.
Before we do that, we should opt-out JSON snippets that aren't anything
related to Renovate config.
* docs: don't validate invalid Renovate config
As it's intentionally referencing a manager that doesn't exist.
* docs: don't validate partial Renovate config
As part of future changes, we'll enable validation on all JSON code
snippets to run Config Validation.
There are several code snippets we have that are part of a Renovate JSON,
but it doesn't make sense to convert these to a fully passing config, as
it'd reduce clarity on what we're trying to explain.
* docs: convert `baseBranchPatterns` snippets to code blocks
So we can validate them.
* docs: make sure that `datasourceTemplate` is set
So this passes validation.
* docs: clarify that `force` is global config
As it may not be clear, so we can make it extra clear with a `.js` file,
and note that it's global self-hosted config.
* docs: make sure `packageRules` is an array
* docs: `matchBaseBranches` needs `baseBranchPatterns` to be set
* docs: correct typo for `prBodyColumns`
* docs: mark global config snippets as such
As part of future changes, we'll use this to detect whether it's global
self-hosted configuration.
* docs: make sure `packageRules` wraps its children
* docs: add `allowedHeaders`
* docs: ignore deprecation warnings
As part of future changes, we'll use this to note that we don't care
about the validation warnings.
* docs: make sure `customManagers` wraps its children
* docs: make sure `fleet` wraps its children
* docs: validate JSON snippets are valid Renovate config
To make sure that we're always presenting valid JSON configuration to
our users, we can validate them as part of `check-fenced-code`.
As well as configuration errors we can warn for warnings, but allow code
blocks to opt-out, for instance when there's a known deprecation
affecting the code block.
We need to make sure to set `allowedEnv` for various code snippets that
reference environment variables.
* docs(development): document fenced code block checks
* docs: wrap `configType` and `ignoreConfigWarnings` in `{ ... }`
As otherwise we see build failures i.e.
WARNING - Doc file 'modules/platform/gitlab/index.md' contains a link
'../../../self-hosted-configuration.md#autodiscoverrepoorder', but the doc
'self-hosted-configuration.md' does not contain an anchor '#autodiscoverrepoorder'.
This needs to be wrapped alongside all other options like `title`.
* fixup! docs: wrap `configType` and `ignoreConfigWarnings` in `{ ... }`
This was a regression as part of
321965a7fa, which inadvertently made the
validation too strict.
We can make sure that we use the example config we use in our
documentation to indicate what should be possible.
* feat: add `groupSingleUpdates` option
* Add test coverage for comment
* Remove extra documentation, the description should probably be enough
* Group single updates by default
* Increment docs
* fix(util/http): remove workaround for `onCancel`
As we're now past the necessary verison of Got, we can remove this
workaround.
* fixup! fix(util/http): remove workaround for `onCancel`
* feat(presets): link to Octochangelog for updates to Renovate itself
Related to #41809, and a recommendation I personally have for folks
updating their version of Renovate via Renovate, we can use
Octochangelog to provide a nicer breakdown of Renovate CLI release
notes, grouping them by headers i.e. "Features" and "Bug Fixes" across
all version(s) being updated.
This overrides the default link i.e.
```
https://app.renovatebot.com/package-diff?name=renovate&from=43.198.0&to=43.206.1
```
to:
```
https://octochangelog.com/compare?repo=renovatebot%2Frenovate&from=43.198.0&to=43.206.1
```
As this is a strong recommendation, we add it into `config:recommended`.
* fixup! feat(presets): link to Octochangelog for updates to Renovate itself
* fix(types): allow `gitUrl` in global config
* Keep it in repo config otherwise platform init won't have it
* Set the type in RenovateConfig instead
* Move to AllConfig
Jamie Tanna