This is a partial revert of da04b8edac.
With this change, we're now no longer correctly version pinning to
SemVer, as `versioning=semver-partial` doesn't require the minor/patch.
The changes in da04b8edac mostly worked,
but given `astral-sh/setup-uv` is now using Immutable Tags it _must_ be
resolved as `versioning=semver`, to make sure that version updates are
correctly raised.
However, we can't treat it as `versioning=semver`, as that will then
fail to parse the current version correctly.
Instead, we must use a `regex` versioning scheme, which allows us to
optionally parse the minor and patch versions.
This allows `newVersion` to be pinned accordingly to SemVer, but does
not require previous versions to be so.
We can do this - for now - with an explicit allowlist.
As per #42331, we should migrate to using `semver-partial` for GitHub
Actions' tags versions, instead of `docker`.
This mirrors actual usage of the way that the ecosystem tags Action
versions, and also has the benefit of automagically migrating users of
Actions that have enabled Immutable Tags, which now must be a full
SemVer tagged version.
As we're now specifying the `versioning: semver-partial`, we don't need
to specify it in `pinGitHubActionDigestsToSemver`.
* fix(package-rules): correctly merge `force.enabled`
As noted in #42666, after changes in
f8b4477335, we're skipping vulnerability
alert PRs when using the `security:only-security-updates` preset.
This happens because the `enabled=false` that exists on the all
dependencies are not correctly merged into the `force` config in the
`vulnerabilityAlert` update.
To fix this, we need to take `force.enabled` into account when merging
config options.
To slightly improve the type checking, we can also make sure that
`removeMatchers` knows that `force` is field we want typed, too.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* chore(package-rules): simplify condition
As we don't actually need to take into account whether the option is
currently enabled, as we can make sure the `skipReason` and `skipStage`
are always deleted if we're enabling the update.
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
As part of recent changes to how our logger is initialised, we
accidentally broke the propagation of OpenTelemtry `span_id` and
`trace_id` into the Bunyan log context.
We already registered `BunyanInstrumentation`, but because of the
`import`, the instrumentation could not man-in-the-middle the import and
register the instrumentation.
This is slightly more complex, and brittle, test, but does capture the
current behaviour of `BunyanInstrumentation`, if it were removed.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat: add XcodeGen manager for Swift package dependencies in project.yml files
* chore(xcodegen): inline project.yml fixture
* fix(xcodegen): use semver instead of swift versioning
* fix(xcodegen): use glob syntax for manager file pattern
* tests(xcodegen): expect logger is called on invalid packages
* tests(xcodegen): better assert extracted package contents
* chore(xcodegen): simplify regex usage
* chore(xcodegen): log projects without dependencies
* chore(xcodegen): simplify dependency resolving and remove regular expressions in favor of the `detectPlatform` helper function
* chore(xcodegen): use `coerceString` on package versions to simplify testing and improve coverage
* chore(xcodegen): address PR review comments.
---------
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* feat(manager/ant): add registry URL discovery from settingsFile and remoteRepository
Read Maven registry URLs from settingsFile attribute on dependency
blocks (parsed via Maven's extractRegistries) and from inline
<remoteRepository url="..." /> elements. Registries are merged,
deduplicated, and scoped to their dependency block.
* update java docs
* fix coverage
* apply suggestions
* fix ci issues
* fix(workers/repository): cleanup localDir before recursive retry after automerge
* add test for failed directory cleanup
* fix(git): don't pass extraCloneOpts to ls-remote when local clone exists
* refactor(cache): Remove obsolete compress flag
* Update terminology in package cache tests
Replace references to "current format" in test descriptions with
explicit mentions of payload values and expiries. Rename the
`compressedValue` variable to `payloadValue` to match the updated
descriptions.
* feat(manager/ant): add coords= attribute syntax support
Support Maven coords attribute format (group:artifact:version and
group:artifact:version:scope) as an alternative to separate
groupId/artifactId/version attributes.
* add trace logs
* fix coverage
* fix(logger): throwing when logging to file using pretty format
* Fix review comments
* Fix previously existing tests too
* Keep file.path
* Custom handle err.stack for readability
* Delete `file.path` since bunyan doesn't use it anyway
* Restore append flag for consistency with JSON format
* feat: timing statistics for getReleases
Adds collection and reporting of timing statistics for
`datasource.getReleases()` calls. Each call records the datasource, registryUrl,
packageName, and duration. The intent is to visibility into where
renovate is retrieving release information and how long that might take.
The report consists of a nested data-structure that provides increasing
detail as we descend datasource, registryUrl, and packageName.
The full report is logged at trace level
`getReleases statistics with packages`.
A summary report including only datasources and registryUrls is logged
at debug level `getReleases statistics summary`.
* add GetReleasesSpanProcessor
- Re-instrument getReleases calls using open telemetry.
- Adds GetReleasesSpanProcessor, which can adapt
`getReleases` spans to GetReleasesStats.
* fixup instrumentation tests
* pr feedback
* pr feedback: naming
* pr feedback: comments
Support <import file="..."/> elements in Ant build files to follow
cross-file dependencies. Properties defined before the import are
available in the imported file. Cycle detection via visited-file
tracking prevents infinite loops.
* test(util/git): add test coverage for `X_CLEAR_HOOKS`
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
* fix(util/git): allow setting `config.hooksPath`
Since simple-git 3.35.2's update in #42588, the setting of
`config.hooksPath` is marked as "unsafe", and does not allow setting
this configuration.
This only affects users who specify the experimental self-hosted config
option, `RENOVATE_X_CLEAR_HOOKS`.
However, the primary user of this is Mend-hosted Renovate which, as
noted in #42628, resulted in all jobs failing to run.
We can instead conditionally set the `allowUnsafeHooksPath`
configuration if we're running with `RENOVATE_X_CLEAR_HOOKS`.
We need to refactor our test to make sure that we're re-initialising
`git` at the point the `RENOVATE_X_CLEAR_HOOKS` is set.
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
To provide more programmatic means to determine what environment
variables configure Renovate configuration options - and whether they're
Repo, Inherit or Global config options - we can expose these in two
forms:
- `getEnvOptionsMap()`
- a static JSON file, `renovate-env-options.ts`
This will provide programmatic use-cases from a plain JSON file that can
be used more readily - especially as it's distributed in the docs and
built package - as well as a function that can be used by users of
Renovate-as-a-library.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(bitbucket-pipelines):update file patterns to support shared configs
Signed-off-by: Adam Setch <adam.setch@outlook.com>
* feat(bitbucket-pipelines):update file patterns to support shared configs
Signed-off-by: Adam Setch <adam.setch@outlook.com>
* feat(bitbucket-pipelines):update file patterns to support shared configs
Signed-off-by: Adam Setch <adam.setch@outlook.com>
---------
Signed-off-by: Adam Setch <adam.setch@outlook.com>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* feat(PackageCacheFile): add a in-memory expiry map
This allows for faster expiry lookup, which makes for the bulk of
the loop on destroy(). Note that this doesn't remove the overhead
of looping through all entries, but at least doesn't load the
data from disk with a deserialization.
* deps: add lru-cache
* limit the size of the in-memory object
* remove benchmark
* fix(workers/repository): don't include `skipReason`'d dependencies in flattened updates
When we're preparing the final, flattened, list of branches to prepare
updates for, we're not filtering out any dependencies that have a
`skipReason` in them.
In the case that, as part of future changes like #42510, a `skipReason`
may be added after the `lookup` phase, we can still get PRs raised even
when they shouldn't be.
We already filter out `enabled=false`, so we should make sure to also
filter anything with a `skipReason`.
* feat(osv): mark malicious packages with `skipReason`s
As part of current ongoing supply chain attacks, there have been cases
where Renovate updates packages to a malicious version.
We'll be introducing a more in-depth means to surface these, including
from different API sources, as part of the Enrichment functionality,
but in the short-term we can utilise osv.dev's ingestion of OpenSSF's
Malicious Packages data.
To do this, we need to:
- look for any `MAL-` advisories
- match it against the current dependency's version, and if affected, mark it
as `skipReason: malicious-version-in-use` (which will be unset in
the `lookup()` function, so we still perform updates
- match it against the dependency's available updates, and if any are
affected, mark the dependency
as `skipReason: malicious-update-proposed`
* fixup! feat(osv): mark malicious packages with `skipReason`s
* fixup! feat(osv): mark malicious packages with `skipReason`s
* test(workers/repository): add missing coverage
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
* chore: simplify type
* wip-opus
* Revert "wip-opus"
This reverts commit e7b5f297c9.
* simplify
* sq
* sq
* fixup
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
* chore(types): add a strong type for `ToolName`s
Until #41849, we can use our local definitions of the tool names that
Containerbase supports by extracting out a `ToolName` type.
* fixup! chore(types): add a strong type for `ToolName`s
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
Co-authored-by: gpt-4.1 <jamie.tanna+github-copilot@mend.io>
* fixup! fixup! chore(types): add a strong type for `ToolName`s
* no-never
* simplify
* coverage
* sq
* warn
* sq
* fixup! sq
* sq
* fixup! sq
---------
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
Co-authored-by: gpt-4.1 <jamie.tanna+github-copilot@mend.io>
When we're preparing the final, flattened, list of branches to prepare
updates for, we're not filtering out any dependencies that have a
`skipReason` in them.
In the case that, as part of future changes like #42510, a `skipReason`
may be added after the `lookup` phase, we can still get PRs raised even
when they shouldn't be.
We already filter out `enabled=false`, so we should make sure to also
filter anything with a `skipReason`.
Jamie Tanna