a16858be0d
refactor(workers): allow extractedConstraints on PackageDependency ( #43252 )
...
* refactor(workers): allow extractedConstraints on PackageDependency
Mirror the existing PackageFileContent.extractedConstraints field on
PackageDependency so managers can attach per-dep constraints (e.g.
python_version markers from PEP 508 dependencies) without overloading
the user-facing constraints field. In fetch.ts these dep-level
constraints are merged on top of the file/global constraints before
lookup, so the most specific source wins while user packageRules can
still override afterwards.
Extracted from #42701 at the reviewer's request so the type-level
change can land independently of the pep621/poetry feature work that
consumes it.
* fix(workers): prefer configured constraints over extracted values
Preserve configured constraints when extraction provides values for
the same names.
User configuration must take precedence over metadata discovered during
package extraction so users retain control over dependency lookup
behavior.
---------
Co-authored-by: wwade <wwade@users.noreply.github.com >
2026-08-03 18:08:26 +00:00
b9087cb072
fix(schema): allow object entries in repositories array ( #44589 )
...
Align renovate-global-schema with runtime: entries may be a string or
an object with required `repository` plus full global/repo config.
2026-08-03 18:07:32 +00:00
b708c86d28
feat(deps): update ghcr.io/renovatebot/base-image docker tag to v13.80.0 (main) ( #45044 )
...
feat(deps): update ghcr.io/renovatebot/base-image docker tag to v13.80.0
| datasource | package | from | to |
| ---------- | ------------------------------ | ------- | ------- |
| docker | ghcr.io/renovatebot/base-image | 13.79.0 | 13.80.0 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-03 17:29:46 +00:00
8688710c78
build(deps): update node.js to v24.19.0 (main) ( #45039 )
...
build(deps): update dependency node to v24.19.0
| datasource | package | from | to |
| --------------- | --------------------------- | -------- | -------- |
| github-releases | containerbase/node-prebuild | 24.18.1 | 24.19.0 |
| node-version | node | v24.18.1 | v24.19.0 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-03 16:26:39 +00:00
89f526e0b1
fix(datasource/npm): handle absent homepages ( #44999 )
...
* fix(datasource/npm): handle absent `homepage`s
As noted in #44991 , for some private packages.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io >
* fixup! fix(datasource/npm): handle absent `homepage`s
* fixup! fix(datasource/npm): handle absent `homepage`s
---------
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io >
2026-08-03 16:24:15 +00:00
87ee522cae
chore(deps): update pnpm/action-setup action to v6.0.10 (main) ( #45038 )
...
chore(deps): update pnpm/action-setup action to v6.0.10
| datasource | package | from | to |
| ----------- | ----------------- | ------ | ------- |
| github-tags | pnpm/action-setup | v6.0.9 | v6.0.10 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-03 12:36:26 +00:00
3cc91b0063
chore(deps): update github/codeql-action action to v4.37.5 (main) ( #45036 )
...
chore(deps): update github/codeql-action action to v4.37.5
| datasource | package | from | to |
| ----------- | -------------------- | ------- | ------- |
| github-tags | github/codeql-action | v4.37.4 | v4.37.5 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-03 11:34:39 +00:00
8393b3de4f
chore: add PR comments AI disclosure to PR template ( #45032 )
...
Via [0], we can make it a new required stage to disclose where you're
using AI to interact with the project in PR comments.
This was previously already a requirement, but this now makes it
even clearer.
[0]: https://github.com/cli/cli/blob/e83adbc0642994fae7c39a9a012eb34b8c81f4f1/.github/PULL_REQUEST_TEMPLATE.md
2026-08-03 10:05:58 +00:00
49fa2289b6
fix(datasource/npm): handle old-style dependencies/devDependencies ( #44998 )
...
As found when we read i.e. `deep-diff`, via #44991 .
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io >
2026-08-03 10:05:00 +00:00
f89efb2233
feat(presets): add security:minimumReleaseAgePypi ( #44992 )
...
Per suggestion in #42610 .
2026-08-03 10:04:56 +00:00
7843511b8f
chore(datasource/npm): log packageName and registryUrl on Unknown npm lookup error ( #44996 )
...
Which would be helpful when trying to debug #44991 .
2026-08-03 08:39:49 +00:00
b6625c651c
build(deps): update dependency node to v24.18.1 (main) ( #44956 )
...
build(deps): update dependency node to v24.18.1
| datasource | package | from | to |
| --------------- | --------------------------- | ------- | ------- |
| github-releases | containerbase/node-prebuild | 24.18.0 | 24.18.1 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-03 07:39:51 +00:00
c4fe59478a
docs: update references to renovate/renovate (main) ( #45018 )
...
docs: update references to renovate/renovate
| datasource | package | from | to |
| ---------- | ----------------- | ------ | ------ |
| docker | renovate/renovate | 44.0.1 | 44.7.2 |
| docker | renovate/renovate | 44.0 | 44.7 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-03 07:21:40 +00:00
edc22ea62d
fix(manager/pre-commit): remove category ( #45005 )
2026-08-03 07:21:30 +00:00
8af53eb629
fix(presets): add missing updateTypes to exclusions in security:minimumReleaseAge* ( #44990 )
...
As these have been out-of-sync with what is and is not currently
supported per our documentation.
Co-authored-by: Claude Opus 4.8 <jamie.tanna+claude-code@mend.io >
2026-08-03 07:19:35 +00:00
e2ce72edca
chore(deps): update dependency markdownlint-cli2 to v0.23.2 (main) ( #45022 )
...
chore(deps): update dependency markdownlint-cli2 to v0.23.2
| datasource | package | from | to |
| ---------- | ----------------- | ------ | ------ |
| npm | markdownlint-cli2 | 0.23.1 | 0.23.2 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-03 05:31:51 +00:00
ef31bb43d2
chore(deps): lock file maintenance (main) ( #45021 )
...
chore(deps): lock file maintenance
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-03 03:32:51 +00:00
2817236767
docs: update references to renovatebot/github-action to v46.2.1 (main) ( #45020 )
...
docs: update references to renovatebot/github-action to v46.2.1
| datasource | package | from | to |
| ----------- | ------------------------- | ------- | ------- |
| github-tags | renovatebot/github-action | v46.2.0 | v46.2.1 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-03 02:31:36 +00:00
a5ac833ce4
docs: update references to renovatebot/github-action to v46.2.0 (main) ( #45019 )
...
docs: update references to renovatebot/github-action to v46.2.0
| datasource | package | from | to |
| ----------- | ------------------------- | -------- | ------- |
| github-tags | renovatebot/github-action | v46.1.21 | v46.2.0 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-03 01:34:33 +00:00
9fbe473bb0
docs: update references to prom/prometheus to v3.13.2 (main) ( #45017 )
...
docs: update references to prom/prometheus to v3.13.2
| datasource | package | from | to |
| ---------- | --------------- | ------- | ------- |
| docker | prom/prometheus | v3.13.1 | v3.13.2 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-03 00:29:11 +00:00
7aeacebe37
build(deps): update dependency fs-extra to v11.4.0 (main) ( #44978 )
...
build(deps): update dependency fs-extra to v11.4.0
| datasource | package | from | to |
| ---------- | -------- | ------ | ------ |
| npm | fs-extra | 11.3.6 | 11.4.0 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-02 22:14:24 +00:00
d396090231
ci: remove auto:pls-merge-main ( #44964 )
...
As it doesn't work, as commits from `github-actions[bot]` can't be used
to trigger CI, and we don't want to use a PAT (as it'll then shows as
an author on PRs).
2026-08-02 22:12:59 +00:00
2c71bb2220
chore(deps): update dependency @containerbase/istanbul-reports-html to v2.0.14 (main) ( #45013 )
...
chore(deps): update dependency @containerbase/istanbul-reports-html to v2.0.14
| datasource | package | from | to |
| ---------- | ------------------------------------ | ------ | ------ |
| npm | @containerbase/istanbul-reports-html | 2.0.13 | 2.0.14 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-02 16:24:12 +00:00
786c2ee5f2
fix(presets): refactor security:minimumReleaseAge* to reduce duplication ( #44989 )
...
As a means to make it easier - in the future - to add new
`security:minimumReleaseAge*` presets, we can refactor the 2 mostly
duplicated presets into dynamically generated presets.
Although this is not quite a "rule of 3" scenario, this shape does look
consistent, and so we can perform an early refactor.
Although this should be like-for-like, we can release this as a `fix` to
get early feedback on whether it changes anything.
Co-authored-by: Claude Opus 4.8 <jamie.tanna+claude-code@mend.io >
2026-08-02 12:56:35 +00:00
df2b4c16c0
feat(data): automatic update of static data ( #45012 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-02 07:33:42 +00:00
60259686df
feat(deps): update ghcr.io/renovatebot/base-image docker tag to v13.79.0 (main) ( #45011 )
...
feat(deps): update ghcr.io/renovatebot/base-image docker tag to v13.79.0
| datasource | package | from | to |
| ---------- | ------------------------------ | ------- | ------- |
| docker | ghcr.io/renovatebot/base-image | 13.78.8 | 13.79.0 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-01 22:41:46 +00:00
2e669257ac
chore(deps): update zizmor (main) ( #45010 )
...
chore(deps): update zizmor
| datasource | package | from | to |
| ----------- | ------------------------- | ------ | ------ |
| docker | ghcr.io/zizmorcore/zizmor | 1.28.0 | 1.29.0 |
| github-tags | zizmorcore/zizmor-action | v0.6.1 | v0.6.2 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-01 22:28:41 +00:00
d94d55e105
chore(deps): update jdx/mise-action action to v4.2.4 (main) ( #45008 )
...
chore(deps): update jdx/mise-action action to v4.2.4
| datasource | package | from | to |
| ----------- | --------------- | ------ | ------ |
| github-tags | jdx/mise-action | v4.2.3 | v4.2.4 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-01 11:28:12 +00:00
34a83b9209
build(deps): update aws-sdk-js-v3 monorepo to v3.1095.0 (main) ( #45007 )
...
build(deps): update aws-sdk-js-v3 monorepo to v3.1095.0
| datasource | package | from | to |
| ---------- | ----------------------------- | -------- | -------- |
| npm | @aws-sdk/client-codecommit | 3.1075.0 | 3.1095.0 |
| npm | @aws-sdk/client-ec2 | 3.1075.0 | 3.1095.0 |
| npm | @aws-sdk/client-ecr | 3.1075.0 | 3.1095.0 |
| npm | @aws-sdk/client-eks | 3.1075.0 | 3.1095.0 |
| npm | @aws-sdk/client-rds | 3.1075.0 | 3.1095.0 |
| npm | @aws-sdk/client-s3 | 3.1075.0 | 3.1095.0 |
| npm | @aws-sdk/credential-providers | 3.1075.0 | 3.1095.0 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-01 00:30:06 +00:00
2e9431465f
chore(deps): update dependency @smithy/util-stream to v4.7.14 (main) ( #45006 )
...
chore(deps): update dependency @smithy/util-stream to v4.7.14
| datasource | package | from | to |
| ---------- | ------------------- | ------ | ------ |
| npm | @smithy/util-stream | 4.7.13 | 4.7.14 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-31 23:30:57 +00:00
022f765192
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.78.8 (main) ( #45004 )
...
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.78.8
| datasource | package | from | to |
| ---------- | ------------------------------ | ------- | ------- |
| docker | ghcr.io/renovatebot/base-image | 13.78.7 | 13.78.8 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-31 21:29:42 +00:00
027e4b6f85
chore(deps): update dependency uv to v0.12.1 (main) ( #45003 )
...
chore(deps): update dependency uv to v0.12.1
| datasource | package | from | to |
| --------------- | ------------ | ------ | ------ |
| github-releases | astral-sh/uv | 0.12.0 | 0.12.1 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-31 20:45:02 +00:00
292f98b68d
chore(deps): update dependency astral-sh/uv to v0.12.1 (main) ( #45002 )
...
chore(deps): update dependency astral-sh/uv to v0.12.1
| datasource | package | from | to |
| --------------- | ------------ | ------ | ------ |
| github-releases | astral-sh/uv | 0.12.0 | 0.12.1 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-31 20:30:08 +00:00
84c75fb820
build(deps): update dependency sax to v1.6.1 (main) ( #45001 )
...
build(deps): update dependency sax to v1.6.1
| datasource | package | from | to |
| ---------- | ------- | ----- | ----- |
| npm | sax | 1.6.0 | 1.6.1 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-31 19:37:28 +00:00
2810dfbf81
chore(deps): update dependency tar to v7.5.22 (main) ( #44995 )
...
chore(deps): update dependency tar to v7.5.22
| datasource | package | from | to |
| ---------- | ------- | ------ | ------ |
| npm | tar | 7.5.21 | 7.5.22 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-31 16:34:23 +00:00
b98703e8fc
chore(deps): update docker/dockerfile docker tag to v1.26.0 (main) ( #44993 )
...
chore(deps): update docker/dockerfile docker tag to v1.26.0
| datasource | package | from | to |
| ---------- | ----------------- | ------ | ------ |
| docker | docker/dockerfile | 1.25.0 | 1.26.0 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-31 15:37:33 +00:00
fa7f6ec002
feat(presets): add security:minimumReleaseAgeCrate preset ( #44659 )
...
* feat(presets): add `security:minimumReleaseAgeCrates` preset
This adds a three-day minimum release age for the `crate` datasource and preserves the existing exception for pin updates.
The preset is based on the existing `security:minimumReleaseAgeNpm` preset, with its exceptions limited to update types relevant to crates.io.
It accounts for the initial 72-hour crates.io deletion window and gives scanners time to identify malicious releases.
* fix(presets): scope crate release age by update type
This replaces the pin-specific override with one package rule for `major`, `minor`, and `patch` crate updates. It keeps updates without release timestamps out of the cooldown.
The focused tests cover included and excluded update types.
* fix(presets): warn about unsupported crate update types
This exempts lock file maintenance, replacement, and pin updates from the crate minimum release age policy. It adds PR body notes that explain why each update requires manual age validation.
* fix(presets): use singular crate release age name
This renames `security:minimumReleaseAgeCrates` to `security:minimumReleaseAgeCrate`. It aligns the preset with the `crate` datasource name before release.
* Update lib/config/presets/internal/security.preset.ts
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk >
---------
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io >
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk >
2026-07-31 13:19:53 +00:00
d1d254c25b
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.78.7 (main) ( #44986 )
...
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.78.7
| datasource | package | from | to |
| ---------- | ------------------------------ | ------- | ------- |
| docker | ghcr.io/renovatebot/base-image | 13.78.6 | 13.78.7 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-31 06:29:03 +00:00
4c7bb14852
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.78.6 (main) ( #44983 )
...
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.78.6
| datasource | package | from | to |
| ---------- | ------------------------------ | ------- | ------- |
| docker | ghcr.io/renovatebot/base-image | 13.78.5 | 13.78.6 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-30 23:44:56 +00:00
58ce6fadc5
build(deps): update dependency google-auth-library to v10.9.1 (main) ( #44982 )
...
build(deps): update dependency google-auth-library to v10.9.1
| datasource | package | from | to |
| ---------- | ------------------- | ------ | ------ |
| npm | google-auth-library | 10.9.0 | 10.9.1 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-30 23:31:24 +00:00
dfcc47a4e0
build(deps): update dependency @renovatebot/osv-offline to v3.0.10 (main) ( #44980 )
...
build(deps): update dependency @renovatebot/osv-offline to v3.0.10
| datasource | package | from | to |
| ---------- | ------------------------ | ----- | ------ |
| npm | @renovatebot/osv-offline | 3.0.9 | 3.0.10 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-30 21:31:58 +00:00
e2dc290dc4
build(deps): update dependency @opentelemetry/instrumentation-bunyan to v0.66.0 (main) ( #44977 )
...
build(deps): update dependency @opentelemetry/instrumentation-bunyan to v0.66.0
| datasource | package | from | to |
| ---------- | ------------------------------------- | ------ | ------ |
| npm | @opentelemetry/instrumentation-bunyan | 0.65.0 | 0.66.0 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-30 19:35:00 +00:00
8e1603a2a5
build(deps): update opentelemetry-js-contrib monorepo (main) ( #44976 )
...
build(deps): update opentelemetry-js-contrib monorepo
| datasource | package | from | to |
| ---------- | -------------------------------------- | ------ | ------ |
| npm | @opentelemetry/instrumentation-redis | 0.68.0 | 0.69.0 |
| npm | @opentelemetry/resource-detector-aws | 2.20.0 | 2.21.0 |
| npm | @opentelemetry/resource-detector-azure | 0.28.0 | 0.29.0 |
| npm | @opentelemetry/resource-detector-gcp | 0.55.0 | 0.56.0 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-30 18:36:55 +00:00
7a05b9a4df
chore(deps): update dependency tsdown to v0.22.14 (main) ( #44975 )
...
chore(deps): update dependency tsdown to v0.22.14
| datasource | package | from | to |
| ---------- | ------- | ------- | ------- |
| npm | tsdown | 0.22.13 | 0.22.14 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-30 18:36:08 +00:00
9f453df110
chore(deps): update dependency pnpm to v11.17.0 (main) ( #44973 )
...
chore(deps): update dependency pnpm to v11.17.0
| datasource | package | from | to |
| ---------- | ------- | ------- | ------- |
| npm | pnpm | 11.16.0 | 11.17.0 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-30 17:33:05 +00:00
2c786a2cb7
chore(deps): update dependency @smithy/util-stream to v4.7.13 (main) ( #44972 )
...
chore(deps): update dependency @smithy/util-stream to v4.7.13
| datasource | package | from | to |
| ---------- | ------------------- | ------ | ------ |
| npm | @smithy/util-stream | 4.7.12 | 4.7.13 |
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-30 17:32:25 +00:00
69a629031b
feat(templates): always expose renovateVersion ( #44969 )
...
As noted in #44756 , this would allow templates across Renovate's
different usages to be able to use the `renovateVersion` string as a
template variable.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io >
2026-07-30 16:01:51 +00:00
33f51391f0
fix(workers/repository): apply minimumReleaseAge to pinDigest updates ( #44968 )
...
As per #44820 , `pinDigest` updates currently don't get
`minimumReleaseAge` checks applied to them.
We can extend the recent support for `digest`s being handled by also
introducing support for `pinDigest`s to receive `minimumReleaseAge`
enforcement.
This will:
- enforce `minimumReleaseAge` on all updates that `pinDigest`s has
pending
- consider the newest resolved version's timestamp, ignoring
`rangeStrategy`-related logic
- allow unversioned releases like `latest` to /not/ be bound by
`minimumReleaseAge`, as they'll potentially not have a release
timestamp and will be unpinned forever, which is less safe (and
reduces reproducibility)
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io >
2026-07-30 16:00:12 +00:00
9d4166813e
docs(contributing): clarify the "don't merge main" ( #44963 )
...
* docs(contributing): clarify the "don't merge `main`"
* docs: note "don't merge `main`" in PR template
In case folks have missed it from the new, more explicit, note in the
contributing docs.
* docs(contributing): clarify merge queue failures
2026-07-30 15:56:59 +00:00
14c81bb298
fix(util/markdown): undo zero-width space chars when used inside codeblocks ( #44933 )
...
* fix(changelog): undo zero-width space chars when used inside codeblocks
Signed-off-by: Adam Setch <adam.setch@outlook.com >
* fix: undo zero-width space chars when used inside codeblocks
Signed-off-by: Adam Setch <adam.setch@outlook.com >
* use codeblock
Signed-off-by: Adam Setch <adam.setch@outlook.com >
* fix test
Signed-off-by: Adam Setch <adam.setch@outlook.com >
* fix test
Signed-off-by: Adam Setch <adam.setch@outlook.com >
---------
Signed-off-by: Adam Setch <adam.setch@outlook.com >
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io >
2026-07-30 15:48:23 +00:00
Wade Carpenter