44e862a926
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.11 (main) ( #45187 )
...
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.11
| datasource | package | from | to |
| ---------- | ------------------------------ | -------- | -------- |
| docker | ghcr.io/renovatebot/base-image | 13.82.10 | 13.82.11 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-10 05:28:15 +00:00
2346d989ab
chore(deps): update ghcr.io/containerbase/devcontainer docker tag to v14.13.20 (main) ( #45186 )
...
chore(deps): update ghcr.io/containerbase/devcontainer docker tag to v14.13.20
| datasource | package | from | to |
| ---------- | ---------------------------------- | -------- | -------- |
| docker | ghcr.io/containerbase/devcontainer | 14.13.19 | 14.13.20 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-10 04:27:19 +00:00
8964a664b7
docs: update references to renovatebot/github-action to v46.2.2 (main) ( #45185 )
...
docs: update references to renovatebot/github-action to v46.2.2
| datasource | package | from | to |
| ----------- | ------------------------- | ------- | ------- |
| github-tags | renovatebot/github-action | v46.2.1 | v46.2.2 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-10 02:27:25 +00:00
21ae7852f4
chore(deps): lock file maintenance (main) ( #45183 )
...
chore(deps): lock file maintenance
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-10 01:29:16 +00:00
742b3b3213
docs: update references to renovate/renovate (main) ( #45182 )
...
docs: update references to renovate/renovate
| datasource | package | from | to |
| ---------- | ----------------- | ------ | ------- |
| docker | renovate/renovate | 44.7.2 | 44.17.1 |
| docker | renovate/renovate | 44.7 | 44.17 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-10 01:27:55 +00:00
3952363a57
docs: update references to otel/opentelemetry-collector-contrib to v0.158.0 (main) ( #45180 )
...
docs: update references to otel/opentelemetry-collector-contrib to v0.158.0
| datasource | package | from | to |
| ---------- | ------------------------------------ | ------- | ------- |
| docker | otel/opentelemetry-collector-contrib | 0.157.0 | 0.158.0 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-10 00:27:27 +00:00
5ca534a0c8
docs: update references to python to 3a9d2dd (main) ( #45179 )
...
docs: update references to python to 3a9d2dd
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-10 00:26:08 +00:00
30cd3d8b8c
chore(deps): update pnpm/setup action to v2.0.2 (main) ( #45178 )
...
chore(deps): update pnpm/setup action to v2.0.2
| datasource | package | from | to |
| ----------- | ---------- | ------ | ------ |
| github-tags | pnpm/setup | v2.0.1 | v2.0.2 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-09 23:25:51 +00:00
ef843fd3e1
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.10 (main) ( #45175 )
...
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.10
| datasource | package | from | to |
| ---------- | ------------------------------ | ------- | -------- |
| docker | ghcr.io/renovatebot/base-image | 13.82.9 | 13.82.10 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-09 18:26:22 +00:00
4b27160815
chore(deps): update ghcr.io/containerbase/devcontainer docker tag to v14.13.19 (main) ( #45174 )
...
chore(deps): update ghcr.io/containerbase/devcontainer docker tag to v14.13.19
| datasource | package | from | to |
| ---------- | ---------------------------------- | -------- | -------- |
| docker | ghcr.io/containerbase/devcontainer | 14.13.18 | 14.13.19 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-09 17:26:52 +00:00
a484d01201
feat(presets): add replacement for deprecated password pusher images ( #45172 )
...
* feat: replace deprecated Password Pusher images
* fix: target final Password Pusher legacy release
* feat: add Password Pusher migration guidance
2026-08-09 15:40:06 +00:00
5e5dd4f0d2
chore(deps): update dependency @containerbase/istanbul-reports-html to v2.0.15 (main) ( #45173 )
...
chore(deps): update dependency @containerbase/istanbul-reports-html to v2.0.15
| datasource | package | from | to |
| ---------- | ------------------------------------ | ------ | ------ |
| npm | @containerbase/istanbul-reports-html | 2.0.14 | 2.0.15 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-09 15:28:09 +00:00
0243c9d65d
chore(deps): update dependency vitest-mock-extended to v5.1.1 (main) ( #44856 )
...
chore(deps): update dependency vitest-mock-extended to v5.1.1
| datasource | package | from | to |
| ---------- | -------------------- | ----- | ----- |
| npm | vitest-mock-extended | 5.0.0 | 5.1.1 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-09 10:27:00 +00:00
42cd249823
fix(presets/monorepo): add new datatables.net source repos ( #45090 )
...
add new source urls
2026-08-09 09:24:12 +00:00
e869eecc4d
feat(presets): add Flue monorepo ( #45137 )
...
Signed-off-by: Jonah Snider <jonah@jonahsnider.com >
2026-08-09 09:09:57 +00:00
2f1b9514ae
chore(deps): update dependency @types/semver to v7.8.0 (main) ( #45164 )
...
chore(deps): update dependency @types/semver to v7.8.0
| datasource | package | from | to |
| ---------- | ------------- | ----- | ----- |
| npm | @types/semver | 7.7.1 | 7.8.0 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-09 08:28:07 +00:00
25a09ecb7e
feat(data): automatic update of static data ( #45163 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-09 08:17:28 +00:00
1b99a61a38
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.9 (main) ( #45156 )
...
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.9
| datasource | package | from | to |
| ---------- | ------------------------------ | ------- | ------- |
| docker | ghcr.io/renovatebot/base-image | 13.82.8 | 13.82.9 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-08 15:26:50 +00:00
7a4aac6f03
chore(deps): update ghcr.io/containerbase/devcontainer docker tag to v14.13.18 (main) ( #45155 )
...
chore(deps): update ghcr.io/containerbase/devcontainer docker tag to v14.13.18
| datasource | package | from | to |
| ---------- | ---------------------------------- | -------- | -------- |
| docker | ghcr.io/containerbase/devcontainer | 14.13.17 | 14.13.18 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-08 14:26:14 +00:00
ecadb0c88e
chore(deps): update dependency @types/luxon to v3.7.3 (main) ( #45154 )
...
chore(deps): update dependency @types/luxon to v3.7.3
| datasource | package | from | to |
| ---------- | ------------ | ----- | ----- |
| npm | @types/luxon | 3.7.2 | 3.7.3 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-08 09:27:43 +00:00
2f2dd98b44
chore(deps): update dependency @types/lodash to v4.17.25 (main) ( #45151 )
...
chore(deps): update dependency @types/lodash to v4.17.25
| datasource | package | from | to |
| ---------- | ------------- | ------- | ------- |
| npm | @types/lodash | 4.17.24 | 4.17.25 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-08 04:27:34 +00:00
952ec8d366
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.8 (main) ( #45150 )
...
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.8
| datasource | package | from | to |
| ---------- | ------------------------------ | ------- | ------- |
| docker | ghcr.io/renovatebot/base-image | 13.82.7 | 13.82.8 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-08 01:27:09 +00:00
f306402533
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.7 (main) ( #45149 )
...
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.7
| datasource | package | from | to |
| ---------- | ------------------------------ | ------- | ------- |
| docker | ghcr.io/renovatebot/base-image | 13.82.6 | 13.82.7 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-08 00:27:28 +00:00
b726beb7a7
chore(deps): update ghcr.io/containerbase/devcontainer docker tag to v14.13.17 (main) ( #45148 )
...
chore(deps): update ghcr.io/containerbase/devcontainer docker tag to v14.13.17
| datasource | package | from | to |
| ---------- | ---------------------------------- | -------- | -------- |
| docker | ghcr.io/containerbase/devcontainer | 14.13.16 | 14.13.17 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-08 00:27:09 +00:00
84ef069a60
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.6 (main) ( #45147 )
...
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.6
| datasource | package | from | to |
| ---------- | ------------------------------ | ------- | ------- |
| docker | ghcr.io/renovatebot/base-image | 13.82.5 | 13.82.6 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-07 23:27:28 +00:00
4c492d3ef0
chore(deps): update ghcr.io/containerbase/devcontainer docker tag to v14.13.16 (main) ( #45145 )
...
chore(deps): update ghcr.io/containerbase/devcontainer docker tag to v14.13.16
| datasource | package | from | to |
| ---------- | ---------------------------------- | -------- | -------- |
| docker | ghcr.io/containerbase/devcontainer | 14.13.15 | 14.13.16 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-07 22:27:51 +00:00
ee9e688256
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.5 (main) ( #45141 )
...
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.5
| datasource | package | from | to |
| ---------- | ------------------------------ | ------- | ------- |
| docker | ghcr.io/renovatebot/base-image | 13.82.4 | 13.82.5 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-07 18:29:40 +00:00
c92c7e2d3a
refactor(types): make return type for getToolSettingsOptions stricter ( #45133 )
...
As part of future changes, it makes it easier to work with the resulting
types, because it's clear when they are optional/required.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io >
2026-08-07 17:33:17 +00:00
f1e08d3a1a
chore(deps): update dependency astral-sh/uv to v0.12.3 (main) ( #45139 )
...
chore(deps): update dependency astral-sh/uv to v0.12.3
| datasource | package | from | to |
| --------------- | ------------ | ------ | ------ |
| github-releases | astral-sh/uv | 0.12.2 | 0.12.3 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-07 17:30:27 +00:00
58c581bd63
chore(deps): update dependency uv to v0.12.3 (main) ( #45140 )
...
chore(deps): update dependency uv to v0.12.3
| datasource | package | from | to |
| --------------- | ------------ | ------ | ------ |
| github-releases | astral-sh/uv | 0.12.2 | 0.12.3 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-07 17:30:23 +00:00
e510b9a64d
chore: add no-unquoted-exec-interpolation linting rule
...
To avoid the risk of shell injection being introduced into future `exec`
calls, we can add a linter to scan for common variable inputs that may
be malicious.
The fields to look for come from the generated `templatableFields`, so we
track the config options a repository can influence rather than restating
them, with credentials and manager-specific fields - which no shared list
covers - carried alongside. Booleans and numbers are dropped, as they can't
carry shell metacharacters.
A value is treated as escaped only when it actually is: `quote()`,
`shlex.quote()`, shlex's `join()`, or `.map(quote).join()`. A bare
`.join()` isn't, as `Array.prototype.join` escapes nothing, and we look
through calls like `String(depName)` so wrapping a value doesn't hide it.
Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io >
2026-08-07 14:28:34 +01:00
df7a014c91
refactor: generate the list of templatable fields
...
As part of follow-up changes, we need a list of fields that could be
used in templates as part of a linting rule.
To avoid the `tools` directory importing from `lib`, we can make sure
that we generate the list of fields.
Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io >
2026-08-07 14:28:32 +01:00
b017c7548a
fix(exec/docker): single-quote the sidecar bash command
...
When executing commands for `binarySource=docker`, we have two areas
that a command could have shell expansion/injection:
- on the host (when constructing the `bash -l -c`)
- in the container (when running a manager-specific command)
When constructing the host's command, we previously would escape the
`"`, which allows Bash syntax for `${VAR}` and `$(...)` syntax inside
it.
While managers use `quote()` to make the inputs safer, the use of `"`
around that would not provide any protection, and lead to cases where
the `quote()` could be expanded on the host, before `docker run`
executes.
After recent changes to each manager - and removal of `shell: true` -
this doesn't seem to be exploitable, but this hardens it further.
Additionally, we never escaped `\`, so a value containing `\"` produces
a command that `shlex.split` rejects, and the update fails rather than
running.
Instead, we can quote the whole `-c` argument with `quote()`, which
round-trips through both `shlex.split` - the default, no-shell path - and
a real shell.
This removes the `lgtm [js/incomplete-sanitization]` suppression as
we're now correctly sanitising this.
Note this doesn't remove the need for the managers to quote their own
values, as the second area above is still a real shell.
Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io >
2026-08-07 14:25:42 +01:00
6d2fa815b7
fix(manager/npm): quote package spec in corepack command
...
To prevent the possibility of a npm package name including shell
metacharacters (which is unlikely, but potentially possible through a
well-crafted payload), which could lead to command execution, we can
make sure they are quoted appropriately.
Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io >
2026-08-07 14:25:41 +01:00
3793e3bab9
fix(manager/deno): quote allow-import host list in install command
...
A malicious Host Rule could be crafted to inject shell metacharacters
which could lead to command execution, we can make sure they are quoted
appropriately.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io >
2026-08-07 14:25:40 +01:00
521d325afd
fix(manager/nix): quote GitHub token in flake update command
...
A malicious Host Rule could be crafted to inject shell metacharacters
which could lead to command execution, we can make sure they are quoted
appropriately.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io >
2026-08-07 14:22:55 +01:00
7279744cd6
fix(manager/maven-wrapper): quote distribution type in wrapper command
...
To prevent the possibility of the `distributionType` in a given
repository including shell metacharacters, which could lead to command
execution, we can make sure they are quoted appropriately.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io >
2026-08-07 14:22:55 +01:00
b3f7846c16
fix(manager/gradle-wrapper): quote distribution URL in wrapper command
...
To prevent the possibility of the `distributionUrl` in a given
repository including shell metacharacters, which could lead to command
execution, we can make sure they are quoted appropriately.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io >
2026-08-07 14:22:55 +01:00
c9cec1affb
fix(manager/gomod): quote module path in import path update command
...
To prevent the possibility of a Go module name including
shell metacharacters (which is unlikely, but potentially possible
through a well-crafted payload), which could lead to command execution,
we can make sure they are quoted appropriately.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io >
2026-08-07 14:22:55 +01:00
ff3e99ef53
fix(manager/mix): quote hex organization and token in auth command
...
To prevent the possibility of an `organization` or `token` including
shell metacharacters, which could lead to command execution, we can make
sure they are quoted appropriately.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io >
2026-08-07 14:22:55 +01:00
2668a65dae
chore(deps): update dependency nock to v14.0.17 (main) ( #45121 )
...
chore(deps): update dependency nock to v14.0.17
| datasource | package | from | to |
| ---------- | ------- | ------- | ------- |
| npm | nock | 14.0.16 | 14.0.17 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-07 13:03:07 +00:00
d8aa95fe64
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.4 (main) ( #45131 )
...
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.4
| datasource | package | from | to |
| ---------- | ------------------------------ | ------- | ------- |
| docker | ghcr.io/renovatebot/base-image | 13.82.3 | 13.82.4 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-07 13:03:00 +00:00
0dac257b65
docs: Do not recommend to use prCreation=not-pending with automerge ( #45088 )
...
Do not recommend to use prCreation=not-pending with automerge
This recommendation contradicts https://github.com/renovatebot/renovate/blob/ce414fb3b02d3d91ff046ea101c8d168bd0d7403/docs/usage/key-concepts/minimum-release-age.md?plain=1#L122
2026-08-07 12:57:06 +00:00
3bcc84bb65
chore(deps): update ghcr.io/containerbase/devcontainer docker tag to v14.13.15 (main) ( #45120 )
...
chore(deps): update ghcr.io/containerbase/devcontainer docker tag to v14.13.15
| datasource | package | from | to |
| ---------- | ---------------------------------- | -------- | -------- |
| docker | ghcr.io/containerbase/devcontainer | 14.13.12 | 14.13.15 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-07 12:34:15 +00:00
a28ecdc122
refactor(types): clarify ToolSettings has two levels of config ( #45125 )
...
As part of future changes, we'll add options that do not require the
Global option to take precedence and/or be used as an upper limit.
To make this clearer, we can split out the options into Global and Repo
variants.
2026-08-07 12:21:13 +00:00
78fa7af1d1
docs: add link to Containerbase' "new tool" documentation ( #45127 )
2026-08-07 12:20:08 +00:00
ed81456807
chore(deps): update pnpm/setup action to v2.0.1 (main) ( #45129 )
...
chore(deps): update pnpm/setup action to v2.0.1
| datasource | package | from | to |
| ----------- | ---------- | ------ | ------ |
| github-tags | pnpm/setup | v2.0.0 | v2.0.1 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-07 11:29:42 +00:00
4230fe3132
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.3 (main) ( #45122 )
...
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.82.3
| datasource | package | from | to |
| ---------- | ------------------------------ | ------- | ------- |
| docker | ghcr.io/renovatebot/base-image | 13.82.2 | 13.82.3 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-07 10:04:59 +00:00
8126773463
chore(deps): update dependency pnpm to v11.19.0 (main) ( #45128 )
...
chore(deps): update dependency pnpm to v11.19.0
| datasource | package | from | to |
| ---------- | ------- | ------- | ------- |
| npm | pnpm | 11.18.0 | 11.19.0 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-07 09:47:08 +00:00
4a62cdaaa3
chore(deps): update dependency lint-staged to v17.3.0 (main) ( #45126 )
...
chore(deps): update dependency lint-staged to v17.3.0
| datasource | package | from | to |
| ---------- | ----------- | ------ | ------ |
| npm | lint-staged | 17.2.0 | 17.3.0 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-07 09:33:02 +00:00
renovate[bot]