* chore: migrate from zod/v3 to zod/v4
This commit contains the logic changes
* chore: migrate imports from zod/v3 to zod/v4
This contains import updates and adds explicit record keys as zod/v4 requires these now
* ci: enforce usage of zod/v4
`checkForPendingVersions` (introduced in #41629) previously threw
`WORKER_FILE_UPDATE_FAILED` when the re-extracted dep had none of
`lockedVersion`, `newVersion`, `currentVersion`, or `currentValue`
populated. That aborts the entire `getUpdatedPackageFiles` flow for a
single dep we cannot verify, which is disproportionate to the intent of
the check (flag artifact updates that introduced a pending version).
Demote the abort to a warn-and-continue: if we cannot determine the
resolved version for a single dep, skip the pending-version check for
that dep only and let the rest of the update proceed. The remaining
deps in the same file can still be verified normally, and a
`logger.warn` makes the skip visible without taking down the update.
* test(presets): validate filename construction
Ahead of future changes to add JSONC support, we should cover explicitly
how the filename is constructed.
* feat(presets): support fetching `.jsonc` files
Similar to 6fb540d494, as we now support a
`.jsonc` file for configuration, we should make sure that we can also
use it for a preset.
We can also add additional tests across a few presets to make sure that
we have sufficient coverage.
As part of recent work around environment variable handling, it's clear
we should provide more user-facing documentation on how environment
variables are handled, and which are passed to child processes by
default.
We can create a "deep dive" page for this, with an autogenerated list of
the environment variables in `basicEnvVars` that are always passed to
child processes, if they're set.
We can also point self-hosted administrators and users alike to the
options they have to control this, too.
With help from GPT-4.1 for case-insensitive sorting.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
Co-authored-by: gpt-4.1 <jamie.tanna+github-copilot@mend.io>
* test(config): validate how many platform-specific filenames there are
As part of future changes, we're introducing `.jsonc` files.
Before we do this, we should make sure we have a test that fully
validates the platform-specific filenames for correct test coverage.
* feat(config): support explicit `.jsonc` file
As noted in #40868, and a follow-up to #36141, we should explicitly look
for a `.jsonc` file in the repository.
* ci: add local mkdocs-admonitions plugin for prettier to allow admonition preservation
* docs: remove uses of `prettier-ignore` for admonitions
* test: rather use await expect
* chore: use named group exclusively
* fix(maven): determing properly closed ranges
A Maven range like [1,2) contains various (usually pre-release) versions of the 2.x line.
By Maven definition the smallest possible 2.x version is 2-alpha, so a properly closed range that only allows 1.x versions
would be [1,2-alpha). This is now detected and properly advanced.
* Review Feedback Vol. 1
* Do not coerce as that will be fixed by #38895
* Ignore uncoverable if condition coverage
* Extract constant
* Review Feedback Vol. 2
* docs(manager/circleci): document YAML merge key parsing limitation
Signed-off-by: Ethan Setnik <esetnik@gmail.com>
* fix(manager/circleci): parse config files as YAML 1.1
CircleCI processes config files as YAML 1.1, but Renovate parsed them
as YAML 1.2. Configs that use YAML 1.1 features failed to parse and
the entire file was silently skipped, dropping every `docker` and `orb`
dep in it.
The most common trigger is a mapping with more than one `<<` merge key,
which YAML 1.2 rejects as a duplicate key. CircleCI's own processor
allows it, since merge keys are a YAML 1.1 feature.
Pass `{ version: '1.1' }` to `parseSingleYaml` so the parser matches
CircleCI's behavior, and add a regression test that covers the
duplicate-merge-key case.
Replaces the workaround note added in the previous commit on this
branch (per review feedback) — the config-side `%YAML 1.1` directive is
no longer needed.
---------
Signed-off-by: Ethan Setnik <esetnik@gmail.com>
* docs: ensure 2 spaces used for generated admonitions
As a follow-up to 4b0146ab7b and
1844916259b6dc17f532e491eb93f6116327c324., this correctly renders
admonitions with 2 spaces (1 indent).
* fixup! docs: use 2-space indentation for Markdown (#43537)
Plus using 3-space for mixed-style `<ul>` and `<ol>`s.
* fixup! docs: use 2-space indentation for Markdown (#43537)
As otherwise it breaks the rendering of the table.
* docs: add "previously known as" to renamed options
To provide a more searchable set of docs in the case that we migrate a
config option, we can introduce a `previouslyKnownAs` field in the
resulting generated documentation.
This allows someone to search for the previous name and find the new
option name.
For now we'll also not implement `RENOVATE_X_` variables.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! docs: add "previously known as" to renamed options
This is a more involved change, which requires we handle the custom
coersion for `RENOVATE_REPOSITORY_CACHE_FORCE_LOCAL`.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(datasource/github-runners): stabilize arm64
Mark the Ubuntu ARM runners as stable.
* feat(datasource/github-runners): add test
Add test for upgrading ubuntu-22.04-arm runners.
* feat(datasource/github-runners): add windows-11-arm label
Add support for Windows 11 ARM runners in the GitHub Runners datasource.
* feat(datasource/github-runners): add test
Add test for extracting windows-11-arm runners.
* feat(datasource/github-runners): fix test
Update expected length.
* feat(pip-compile): support --constraint alias and --overrides for uv
uv accepts both --constraint and --constraints (clap aliases) and
records the exact form used into lockfile headers. Only --constraints
was in the uv allowlist, so --constraint headers were rejected.
Similarly, uv supports --override/--overrides for version overrides,
but neither form was recognized by Renovate at all.
This commit:
- adds --constraint to uvOptionsWithArguments (value handler already
handles both forms)
- adds --override and --overrides to uvOptionsWithArguments with a
value handler that parses overridesFiles
- tracks override files as dependencies in the file graph (like
constraints) so lockfiles are recompiled when overrides change
- uses dotted mermaid edges for overrides (same as constraints)
Ref: https://github.com/renovatebot/renovate/discussions/39488
Co-authored-by: Cursor <cursoragent@cursor.com>
* test(pip-compile): add coverage for overrides dependency tracking
Add a test case in extract.spec.ts that exercises the overridesFiles
loop in extractAllPackageFiles, fixing the codecov/patch failure.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(datasource/rust-version): skip blank lines in manifests.txt
`https://static.rust-lang.org/manifests.txt` ends with a trailing
newline, so `response.body.split('\n')` always yields an empty final
element. `parseManifestUrl('')` returns `null`, which triggered the
`Failed to parse manifest URL` warning on every run. The warning then
surfaces as a `Repository Problems` entry on the Dependency Dashboard
for any repo with a rust-version-tracked dep (`rust-toolchain.toml`,
or a custom-regex manager pointing at the `rust-version` datasource).
Skip blank/whitespace-only lines silently; keep warning on genuinely
malformed non-empty lines (covered by the existing
"ignores unexpected URLs" test).
* docs(datasource): condense comment
Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>
* Remove accidental newline
---------
Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
When we change configuration for what namespaces are possible to
override, there's no way for a self-hosted administrator to know this.
This leads to cases where an override can be left in configuration,
giving a false sense of security for caching.
Instead, we should inform self-hosted administrators when this happens,
using a config validation error, which will fail
`renovate-config-validator`, and add a WARN to the logs when failing.
* feat(self-hosted): make `user-agent` templatable
For Mend-hosted apps, it would be useful to provide a little bit more
information for where a Renovate HTTP request is coming from.
To provide more control over the generated field, we can make it
templatable, with the option to specify the `renovateVersion`.
As this now exposes Handlebars syntax to the user, we should be clear
that this `supportsTemplating`, and document with tests what this
allows.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! feat(self-hosted): make `user-agent` templatable
* fixup! feat(self-hosted): make `user-agent` templatable
As we're now returning the defaults in `GlobalConfig.get` calls.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
mado