* feat(manager/npm): read private registries from pnpm-workspace.yaml
Honor the `registry` and `registries` settings (pnpm v11+) declared in pnpm-workspace.yaml, applying them to workspace catalog/override deps and member package.json deps. Registry values containing ${...} are ignored, matching pnpm v11.5.3+.
* refactor(manager/npm): share pnpm registry resolution across extract paths
Extract a single applyPnpmWorkspaceRegistries helper so both the
pnpm-workspace catalog path and the package.json extract path apply
registries through one chokepoint, with env-var registry URLs filtered
once and consistently.
* refactor(manager/npm): filter pnpm env-var registries in schema
Move the env-var registry filtering into the PnpmWorkspaceFile schema as a
transform so registries are filtered once at parse time, and use the Nullish
helper for the registry/registries fields.
* refactor(manager/npm): simplify pnpm-workspace check and log parse errors
* ci(linter): add prefer-partial-in-specs oxlint rule
Flags object literals cast to `any` (`{...} as any`) in spec/test files and steers toward `partial<T>()` from `test/util`. Enabled at error in the spec-files override so CI blocks new occurrences.
Closes#44646
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test: drop unnecessary object-literal `as any` casts
The casts masked values already assignable to the expected type (migration configs accepted as Record<string, unknown>, all-optional param types, etc.); removing them restores real type checking.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test: replace object-literal `as any` casts with partial<T>()
Uses partial<T>() from test/util so incomplete mock/config objects keep proper typing. Azure API mocks switch to mockResolvedValue(partial<T>()) and their inner method mocks to mockResolvedValue(), matching the sibling-file idiom.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test: suppress prefer-partial-in-specs for intentionally-invalid inputs
Some tests deliberately pass malformed or legacy data to exercise validation/error paths, where no real type fits; keep the cast with a reasoned oxlint-disable-next-line.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* fix(terraform): normalize lock file constraint order after provider update
Terraform and OpenTofu reject a .terraform.lock.hcl whose constraints are
not in normalized form. When a provider version is updated in place, a bumped
exact pin can overtake an inherited `~>` range, leaving e.g.
"5.9.0, ~> 5.0" which fails "init" with "must be written in normalized form".
Re-sort the sub-constraints (boundary version ascending, ties broken by
operator priority) to match Terraform's canonical serialization.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(terraform): address review on constraint normalization
- link the Terraform source the sort logic mirrors
- avoid a regex lookahead in constrainToZero (RE2 wrapper compatibility)
- resolve the hashicorp versioning API once at module load
* Update lib/modules/manager/terraform/lockfile/util.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Revert "build: fix docker build cross-compilation after pnpm v11 (#43984)"
This reverts commit 7cababa859.
* chore(deps): update dependency pnpm to 11.7.0
* Fix overrides $ warning
* Extract protobufjs to pnpm catalog too
* Remove all overrides, none seem still relevant
* build: drop catalog changes from this PR
Keep only the docker cross-compilation workaround revert;
leave catalog/overrides as on main.
* ci(linter): add renovate/logger-static-message rule
Adds a custom oxlint rule that enforces a static msg component for
logger.warn/error/fatal calls (including logger.once variants) so the
messages can be grouped in metrics and error catching services, per
docs/development/best-practices.md. It also flags metadata properties
named 'error' that hold error-ish values, because the bunyan serializer
only handles the 'err' key.
The rule is enabled as an error for lib/ production code and disabled
for spec files. All 33 pre-existing violations are fixed by moving
interpolated values into the metadata object, making messages static,
and renaming 'error' metadata keys to 'err'. Affected log-message
assertions in co-located specs are updated accordingly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: ignore validator output
* fixup new merged in log messages
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* ci: apply disk cleanup workaround to build-docker job too
* ci: fold disk-space cleanup into setup-docker action
* ci: fix typo in setup-docker step name
* Another casing fix
* ci: show final disk usage in build-docker even on failure
* Trigger pipeline (empty commit)
* Trigger pipeline (empty commit)
* Trigger pipeline (empty commit)
* TEMP: Forcefully run cleanup
* Revert "TEMP: Forcefully run cleanup"
This reverts commit 062b76e39c.
* refactor(config): move checkedBranches and rebaseAllOpenBranches into GlobalConfig
Both options are globalOnly but were being read directly off the
repository config object instead of GlobalConfig, so they weren't
part of the RepoGlobalConfig contract enforced elsewhere.
* test: reset GlobalConfig in beforeEach instead of per-test
Matches the pattern used elsewhere (common.spec.ts, error-config.spec.ts,
prune.spec.ts) and resets before each test instead of after, so a failed
assertion can't leak state into the next test.
* refactor: use isNonEmptyArray instead of .length check
* feat: add `--rebase-all-open-branches`
* feat: mark rebaseAllOpenBranches as cli: true explicitly
* feat: mark checkedBranches as cli: true explicitly
* fix(platform/azure): guard against null work item on issue creation
The Azure DevOps REST client resolves createWorkItem to null (instead of
throwing) on a 404 or any 2xx response with an empty/non-JSON body, such
as a 203 sign-in page returned by an expired token or an SSO/proxy in
front of the instance. ensureIssue then dereferenced newWorkItem.id
unconditionally, crashing the dependency dashboard run with
"Cannot read properties of null (reading 'id')".
Guard the result and skip the issue with a warning instead.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* feat(platform/azure): detect missing Issue work item type
Check that the project's process defines the 'Issue' work item type
before attempting to create one. Processes such as Scrum do not define
it, so createWorkItem returned a 404 that the REST client surfaces as
null, producing a cryptic crash. Log an actionable warning instead.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* test(platform/azure): mock getWorkItemTypes in ensureIssue create test
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
As part of an investigation around `commitHourlyLimit` performing slowly
on a repository with many branches, we can introduce more
instrumentation to be able to debug further.
* fix: misleading log message when updatePr is called due to autoApprove
* Log "PR body changed" only if PR body changed
* Revert "Log "PR body changed" only if PR body changed"
This reverts commit b4bd3de3d2.
* Add log assertion ot test
* ci(linter): add renovate/codeblock-in-spec-fixtures rule
Add a custom oxlint rule that requires the codeBlock (or stripIndent)
template helper from common-tags for multi-line string fixtures in spec
files (enabled for **/*.spec.ts and test/** only).
The rule only flags shapes whose value can round-trip through the
common-tags helpers unchanged, since both codeBlock and stripIndent trim
the end result and strip the shortest line indentation:
- only literals spanning multiple source lines are flagged (escaped \n
one-liners are left alone: tagging them is not value-preserving in
general and gains nothing)
- values with leading/trailing whitespace (e.g. fixtures ending in a
newline) are not flagged
- tagged templates, describe/it titles, and inline snapshot arguments
are skipped
All 55 pre-existing violations (22 files) were fixed with a one-off
codemod that re-emits each fixture indented to the statement depth and
verifies value preservation by evaluating codeBlock on the rewritten
template (substitutions kept as opaque placeholders). One site
(pip_requirements/artifacts.spec.ts) mixes line continuations with
escaped newlines and was tagged verbatim instead of re-indented.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci(linter): address review findings
Make getSimpleRequirementsFile in pip-compile/extract.spec.ts
value-preserving again: tagging the whole template with codeBlock
trimmed the trailing blank line when deps is empty (the headerOnly.txt
case), silently changing the fixture from ending in '#\n\n' to '#'.
Tag only the static header and append the deps section via a
single-line template, which reproduces the original string exactly
for both empty and non-empty deps (verified by executing old vs new
in node).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Felipe Santos