On a sufficiently large repository, this log line would lead to the Node
process being killed due to reaching the Node VM's maximum string
length, as per:
import { constants } from 'node:buffer';
console.log(constants.MAX_STRING_LENGTH); // ~536MB
This happens because for each update we're including in
`reconfigureBranchCache.ExtractResult`, we include the `BranchConfig`
which is effectively all Renovate config options.
On a sufficiently large repository, this hits size limits, but given
this isn't a particularly widely used log line for debugging, moving
this to a TRACE is a sufficient step.
We can continue to keep the `reconfigureBranchSha` and `isConfigValid`
fields in the original log line (albeit now top-level).
* feat(rust-toolchain): Implement `rust-toolchain` manager
* feat(rust-toolchain): Add support for legacy filename
* feat(rust-toolchain): Add support for legacy file format
* refactor(rust-toolchain): Reject empty `channel` strings at parse stage
* tests(rust-toolchain): Cover valid TOML missing `[toolchain]` or `channel`
* refactor(rust-toolchain): Log legacy format fallback at `trace` level
* refactor(rust-toolchain): Reject empty and multi-line legacy files explicitly
* tests(rust-toolchain): Cover unparseable channel value
* tests(rust-toolchain): Use `codeBlock` for multi-line fixtures
* docs(rust-toolchain): Scope pin example to `rust-toolchain` manager
Co-authored-by: Sergei Zharinov <1239644+zharinov@users.noreply.github.com>
* tests(rust-toolchain): Use `codeBlock` for schema fixtures too
---------
Co-authored-by: Sergei Zharinov <1239644+zharinov@users.noreply.github.com>
* feat(mise): add lock file support
- Add lockfile.ts with getLockFileName() for deriving lock file paths
- Add artifacts.ts with updateArtifacts() and updateLockedDependency()
- Add MiseLockFile Zod schema for parsing lock files
- Update extract.ts to be async and extract lockedVersion from lock files
- Export supportsLockFileMaintenance, lockFileNames, updateArtifacts, updateLockedDependency
* refactor(mise): remove redundant comments
Remove comments that simply restate what the code already clearly
communicates. Keep valuable comments that explain non-obvious behavior
(e.g., why temporary errors are rethrown) and move helpful examples
into JSDoc comments.
* fix(mise): improve lock file version lookup and add tests
- Fix lock file key lookup for non-registry tools (aqua:, ubi:, etc.)
Registry tools use short names (node), non-registry use full names
(aqua:cli/cli). New getLockedVersion() tries both patterns.
- Add injection prevention test for shell quoting
- Add update-failed test for error handling
- Add comprehensive tests for getLockedVersion()
- Add null check for depName in updateLockedDependency
- Add JSDoc to updateArtifacts and extractPackageFile
- Add lock file support documentation to README
- Remove code duplication by consolidating into lockfile.ts
* fix(mise): pass --local flag and MISE_ENV for env/local config files
When updating mise.local.toml, `mise lock` updates mise.lock, not
mise.local.lock. Add --local flag to target the correct lock file.
For env-specific configs (mise.test.toml), set MISE_ENV=test so mise
reads and locks the correct configuration.
Extracted getConfigType() from getLockFileName() to share the parsing
logic between lock file name derivation and command flag generation.
Builds on #42099 by altendky.
* test(mise): cover tool absent from lock file
* refactor(mise): remove dead branches in extractPackageFile
tools is required by MiseFile schema so if(tools) is always true.
depName is always set by createDependency so if(dep.depName) is always true.
Add test for tool absent from lock file to cover the lockedVersion
assignment branch.
* fix(mise): address review feedback on lock file support
* fix(mise): remove unsupported tool constraint
* fix(mise): add containerbase tool definition
* fix(mise): add typed exec constraint support
* fix(config): restore requireConfig typing
* test(mise): await registry extraction cases
* Update lib/modules/manager/mise/artifacts.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* fix: revert unrelated types cleanup
* fix: drop missing VersioningName import
* fix(mise): use npm versioning string after import removal
* test(mise): set binarySource=global in artifacts spec
GlobalConfig.get now returns defaults; without explicit binarySource the
test fell into containerbase dynamic install and tried to resolve the
mise version via the github-releases datasource, causing missing HTTP
mock errors. Force binarySource=global so the spec only exercises the
mocked exec path.
---------
Co-authored-by: Kyle Altendorf <sda@fstab.net>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io>
As noted in #43445, there are cases where:
- an infrequently updated repository prepares a GitHub Release by
creating a draft release
- some time passes, and the maintainers publish the Release
- no new commits are pushed to the release branch (i.e. `main`) in that
time
In this case, Renovate would previously use the `created_at` of the Git
tag (according to the GitHub API) rather than the `published_at` time
from the GitHub Release.
This is correct when using a plain Git tag, as we only have metadata to
indicate when the commit the tag points to was created.
However, when we have GitHub Release information, we should use that to
take precedence.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
As noted in #43280, there may be cases where users attempt to perform
config validation via stdin, or in a directory that doesn't contain any
configuration files, and it may be unexpected to see that the `Config
validated successfully`, if we didn't actually process anything.
To improve this, we can track how many file(s) are being validated, and
more visibly note when 0 files have been validated.
In 01bcd4fd43 we introduced knowledge of
the Maven Central mirror, but haven't taken it into account when looking
at rate limit errors.
To prevent this in the future, we can introduce a new helper function,
`isMavenCentral`, for other usage.
As a way of indicating how fresh our list of supported tools in the
registry is, we can make sure we populate the version into a note above
the table.
We can extract a type to make it easier to reference the parsed JSON
file.
This requires a small tweak to handle `content`'s table insertion.
The git-submodules extractor was setting sourceUrl to the raw git HTTP URL,
including the .git suffix (e.g. https://github.com/owner/repo.git).
This caused the 'githubDigestChangelogs' preset's changelogUrl template
'{{sourceUrl}}/compare/{{currentDigest}}..{{newDigest}}' to produce
invalid URLs like:
https://github.com/owner/repo.git/compare/abc123..def456
which 404s because GitHub compare URLs don't support the .git suffix.
Other managers (bundler, deps-edn, flux) already strip .git from sourceUrl.
This fix follows the same pattern.
* feat(manager/swift): support SSH URLs in Package.swift extraction and artifact matching
Swift packages can use SSH URLs (e.g. `git@github.com:owner/repo.git`) for
dependencies, but the Swift manager only supported HTTPS URLs. This caused
SSH-based dependencies to be silently ignored during extraction, and
Package.resolved pin matching to fail when protocols differed.
- Convert SCP-style SSH and `ssh://` URLs to HTTPS in `parseUrl()` using
the existing `getHttpUrl()` utility before platform detection
- Enhance `normalizeUrl()` in artifacts to use `parseGitUrl()` for
protocol-agnostic URL comparison (falls back to basic normalization
when parsed components are incomplete)
* test(manager/swift): add edge case tests to improve coverage
- Add test for unparseable SSH URL in extraction
- Add test for host-only URL fallback in artifact matching
* fix(manager/swift): remove redundant .git stripping in normalizeUrl
parseGitUrl() already strips the .git suffix from full_name,
so the additional regex replacement is unnecessary.
* test(manager/swift): add ssh:// protocol test for artifact matching
Cover the ssh://git@github.com/... URL format in addition to the
existing git@ SCP-style test for Package.resolved pin matching.
* refactor(manager/swift): use trimTrailingSlash helper in normalizeUrl
* refactor(manager/swift): always normalize URLs in parseUrl
* fix(datasource/maven): cache 404s on `maven-metadata.xml` for 24h
As part of efforts to reduce the general overload on Maven Central[0]
from Renovate, we can look to reduce unnecessary HTTP lookups.
The Maven Datasource will use the `registryStrategy=merge`, which leads
to looking up a package in each of our registries, and merging them if
present.
However, this means that when looking up a package that /will only ever
be in a given registry/ (such as in
01bcd4fd43) we're hitting other registries
with packages they are unlikely to have.
This is unnecessary, significantly increases traffic to Maven Central,
and leads to us re-fetching the same 404s which count towards rate
limits, and increased, unnecessary, server load on Maven Central.
We can instead introduce a new cache for 404s for the
`maven-metadata.xml`, for 24 hours, which should reduce traffic to Maven
Central (and other configured registries) if they only have a subset of
dependencies.
[0]: https://www.sonatype.com/blog/maven-central-and-the-tragedy-of-the-commons
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! fix(datasource/maven): cache 404s on `maven-metadata.xml` for 24h
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* cache-down
* perf(datasource/maven): add jitter
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* sq
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
fix(datasource/maven): cache `.pom` URLs for 7 days
As part of efforts to reduce the general overload on Maven Central[0]
from Renovate, we can look to reduce unnecessary HTTP lookups.
For instance, when a `.pom` URL is retrieved, it is re-checked every 15
minutes in case it has been updated.
This is unnecessary, significantly increases traffic to Maven Central,
and leads to us re-checking constantly for artifacts that are not
updating.
Each time we perform the lookup, we'll use the ETag result to do an
`If-None-Match`, but this still introduces an HTTP call upstream that
counts towards rate limits, and server load on Maven Central.
Instead, we can wrap the lookups for immutable pom.xml results with a 28
day soft cache. In a rare case where a `.pom` URL is updated, we'll then
re-fetch it after 28 days, but until then, it'll be safely returned from
cache.
[0]: https://www.sonatype.com/blog/maven-central-and-the-tragedy-of-the-commons
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fix(config/global): return default values for `GlobalConfig.get`
As noted in #39949, it can be awkward working with in `GlobalConfig.get`, where
we would previously need to specify the default value when calling `.get`,
which could lead to drift with the defaults for a given config option.
To reduce this risk, we can rely on a given `default` for a configuration
option, providing that as a default.
Because this now definitely returns a value that matches the config option, it
now allows us to remove `!` assertions.
* fixup! fix(config/global): return default values for `GlobalConfig.get`
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fixup! fix(config/global): return default values for `GlobalConfig.get`
* test(presets): remove impossible test
As it's now not possible to set a value as `undefined` (as
`GlobalConfig` will then use the default), this test no longer validates
anything.
* test(workers/repository): add mock
Now `platform` defaults to `github`, we need to mock out the call to
fetch config.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* test: coverage
* test: coverage
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
As noted in #41214, it would be convenient to not have to manually
update this list.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* test: ensure we set `binarySource=global`
As part of future changes, we'll correctly return the default value from
`GlobalConfig.get`, instead of `undefined` if no default is provided in
the `get` call.
As `binarySource=install` is the default, this then leads to these tests
failing, as they're intended to run with `binarySource=global`.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! test: ensure we set `binarySource=global`
* fixup! fixup! test: ensure we set `binarySource=global`
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* docs: add inline JSDoc for `RegistryStrategy`
Noticed while making other changes, that it wasn't clear looking at the
type what these values meant.
We can use a `@see` annotation to move the inline documentation from the
`DatasourceApi` to use our source-of-truth.
* docs: update `RegistryStrategy` docs in line with implementation
With help from Claude Sonnet to derive more information from the
implementation.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fix(datasource/maven): don't look up potential Gradle Plugins in Maven Central
As part of efforts to reduce the general overload on Maven Central[0]
from Renovate, we can look to avoid lookups that we know are likely to
never resolve.
For instance, via #43146, we can skip any packages that appear to be a
Gradle Plugin, as they will only ever be sourced from the Gradle Plugin
Portal.
[0]: https://www.sonatype.com/blog/maven-central-and-the-tragedy-of-the-commons
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* Update lib/modules/datasource/maven/readme.md
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* test(noNewURL): add new rule enforcing parseUrl() from 'lib/util/url.ts'
* replace newURL with parseUrl
* remove non-null assertions marks if appropiate
* test: add additional tests
* test: add additional tests and ignore where it makes sense
* implement suggestions
* test: further improve coverage
* apply suggestion
* refactor(docs): don't use an `end` for autogenerated docs
As part of #42910, we wanted to avoid needing a "begin" and "end" to
each of our autogenerated docs replacements.
While looking into it, we're not actually using the "end" for anything,
so we can instead refactor this to be a single-line replacement.
To simplify the code and docs, we can remove this. At the point we need
this again, we can re-add the functionality.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! Merge remote-tracking branch 'origin/HEAD' into chore/no-replaceStop
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fix(github): set commit message explicitly for platform automerge
When GitHub's "Use PR title and body as commit message" setting is
enabled, the verbose Renovate PR description gets used as the squash
commit body. Pass `commitHeadline` and `commitBody` to the
`enablePullRequestAutoMerge` GraphQL mutation so the actual commit
message is used instead.
* add REBASE test
* pr feedback
* fix(git): allow customEnvVariables to override GIT_SSH_COMMAND
* test: simplify env cleanup, rely on beforeEach reset
* refactor(git): use extraEnv for GIT_SSH_COMMAND default
Move GIT_SSH_COMMAND from forcedEnv to extraEnv (lowest priority)
so that both process.env and customEnvVariables override the default
naturally, without conditional logic.
Suggested-by: viceice
As noted in #43304, when using `osvVulnerabilityAlerts`, we can
sometimes produce an `allowedVersions` that is valid for the ecosystem,
but without setting the `versioning`, we produce an invalid rule, which
then results in a `config-validation` result, breaking any updates on
the repo.
When this happens, it's unclear which `versioning` is used to validate
this, so we should add this to the error message.
Jamie Tanna