As found in #40942, we've been seeing increased memory usage by pnpm and
Yarn in recent months on Mend-hosted apps.
As a way to provide more control to test + validate fixes, as well as
provide self-serve for other environments, we can allowlist
`PNPM_WORKERS`/`PNPM_MAX_WORKERS` in both the "basic env vars" and the
allowed `global:safeEnv`.
* feat(manager/renovate-config): extract `constraints`
As noted in #41571, it would be useful to detect and suggest updates
when specifying `constraints` in Renovate config, where it's a known
tool we provide versioning information for.
We can extend our existing `renovate-config` manager to add support for
`constraints` that are known Containerbase tools.
We can support top-level `constraints` as well as `constraints` inside
`packageRules`.
* refactor(renovate-config): remove nesting
When a Go dependency uses a pseudo-version (v0.0.0-timestamp-hash) and
Renovate detects a newer pseudo-version, updateType is set to 'digest'
via the gomod special-case in lookup/index.ts. The digest update code
path was then writing only the 12-character bare commit hash, producing
invalid go.mod syntax:
- knative.dev/pkg v0.0.0-20250312035536-b7bbf4be5dbd
+ knative.dev/pkg 4a022ed9999a
Historical cause:
In 2018, the Go module proxy did not yet exist. Renovate queried the
GitHub API for the latest commit SHA and had no way to obtain the correct
commit timestamp, so it fabricated a pseudo-version using the wall-clock
time when Renovate ran. The result was syntactically valid but semantically
wrong. Go 1.11 and 1.12 did not validate pseudo-version timestamps, and
`go get` would normalise the fabricated version to the correct one anyway,
so this worked in practice.
Go 1.13 (2019) introduced strict pseudo-version timestamp validation,
rejecting any pseudo-version whose timestamp does not match the actual
commit time. Renovate's fix (31ce47297) was to drop the fabricated
timestamp entirely and write just the bare commit hash, then rely on
`go get` to expand it into a canonical pseudo-version. However, when
the `go get` command or other subsequent operations fail, Renovate may
leave the go.mod file containing dependencies pinned to bare commit hashes.
Why the fix is now safe:
Since the 2024 goproxy datasource changes, both newValue and newDigest are
extracted from the same proxy version string via pseudoVersionToRelease().
They always reference the same commit, so writing newValue directly produces
correct, syntactically valid go.mod output without depending on `go get` to
clean it up afterward.
Signed-off-by: Qixiang Wan <qwan@outlook.com>
* feat: remove `(major)` suffix from PR title when there's a version already
* Use isNonEmptyStringAndNotWhitespace
* Ensure commitMessageExtra is actually a version
* fix(log): last log lines of config-validator not being written to file
* Use simpler write
* Simplify RenovateStream now that it only writes to stdout
* Rename RenovateStream to PrettyStdoutStream
* Simplify comment
* feat(vulnerability): Add vulnerability alerts to deps-end + lein
deps-edn and lein both essentially use maven upstream for several
packages. Some packages come from clojars directly but others are
typical java packages. If there is an OSV alert for a maven package
however, it will not propagate to the deps-edn or lein dependency update
from renovate. This tries to adjust that so that clojure can derive
dependency alerts from maven as well so that those dependencies are
treated the same way.
* chore: Code review feedback
* chore: Make ecosystem to datasource one to many
Technically datasource to ecosystem was already many to one in a way, as
maven appeared in the values twice. Once for clojure and once for maven
itself. This changes it so that the ecosystem to datasource is the same
way and looking up by ecosystem you will get multiple datasources
(should match the map above the modified code).
Then to make this work, instead of keying off of datasource for
vulnerabilities we key off of ecosystem so that all of the datasources
that are part of that ecosystem inherit the vulnerabilities for the same
dependency.
* chore: Tweaking to try to force CI/CD retry
* fix(poetry): perform deepmerge to fully enrich projectDep with info from poetryDep
previously, just additional `managerData` from the poetryDep was merged into the projectDep specification
* test(poetry): verify 'invalid-dependency-specification' if constraints specified twice
In cases where the process ends very quickly after a log line is
written, it could lead to cases where that log line doesn't appear on
`stdout`.
We can make sure that we always explicitly call the callback.
This only affected the "pretty" output in the CLI, and only when log
lines were written fairly close to process end.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(update-date-cache): implement caching for branch update dates
* Try fix coverage
* Fix some test style inconsistencies
* Fix coverage
* Fix test
* Fix test testing the same path
When running Renovate in a shared environment, such as Mend-hosted
Renovate, if relying on the new functionality for `constraintsFiltering`
checks in the Go datasource, it's possible to get data without
the `constraints` embedded in them.
This is due to us using a cache key that doesn't take into account
whether we are `constraintsFiltering`, which controls whether we look up
the `go` directive for a given Go module.
We can fix this by introducing an additional entry into the cache key
for the `constraintsFiltering` value.
We can make sure that this doesn't modify existing
(non-`constraintsFiltering`) entries, and only add additional keys if
`constraintsFiltering` is set to something other than the default.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(managers): rename `renovate-config-presets` to `renovate-config`
As part of future changes, we'll extend this support to cover other
functionality. Instead of having multiple managers for this
functionality, we'll use a single, shared, manager for all Renovate
config management.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! feat(managers): rename `renovate-config-presets` to `renovate-config`
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
Johannes Feichtner