* fix: not applying global options in object entries in `repositories` array
* Use isNonEmptyObject
* Add test for per-repo override
* Use AllConfig instead
As a follow-up to e1e5c398e0, we can make
sure that we remove references to hardcoded docs site URLs, by wiring in
the `GlobalConfig.get(...)` call.
To do this, we need to make sure that `productLinks` exists to be called
by `GlobalConfig.get`.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* ci(close-answered: use `.cjs` for script
Since ~2026-01-29, this job has been failing, as:
Unhandled error: ReferenceError: module is not defined in ES module scope
We can work around this by using a `.cjs` file.
* lint(close-answered): address linting
As there were some findings that weren't previously picked up on, due to
the `.js` suffix.
mise tool versions are plain version strings (e.g. `"aqua:pnpm/pnpm" = "11.6.0"`)
with no syntax to attach a commit digest, so a digest can never be written to a
mise config file. Backends such as aqua and core resolve to the github-tags
datasource, which exposes `getDigest`, so a global `pinDigests: true` makes
Renovate emit `pinDigest` updates for mise tools. These updates produce no file
change and then fail post-update verification with "Digest is not updated" ->
"Error updating branch: update failure" on every run.
Disable digest pinning at the manager level, matching terraform, gomod, and the
other managers whose dependencies have no place to store a digest.
* chore: ensure we use `productLinks` for docs site links where possible
Where possible, we should be making sure that we're using the
`productLinks`' configuration for the documentation site, especially
where self-hosted users may create a mirror of their docs[0].
To make sure we catch this in the future, we can introduce a custom
linting rule with Oxlint to enforce this.
Where we (currently) can't wire in the config, we can disable it against
that line.
[0]: https://www.jvt.me/posts/2024/11/19/renovate-private-docs/
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! chore: ensure we use `productLinks` for docs site links where possible
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! chore: ensure we use `productLinks` for docs site links where possible
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
chore: don't include announcement bar in release notes' attachment
When building the docs site in CI on `main` (or a release branch), we
currently package up the docs site into the GitHub Release.
However, this includes the "announcement bar", which can include stale
info.
In the case where a user is looking to add a mirror for their Renovate
CLI docs[0], this means they now see an announcement bar which includes
unhelpful - and possibly outdated - information.
As noted in #44030, we can improve this to:
- not include the announcement bar when preparing the attachment for the
release
- include the announcement bar only when we're updating the docs site
To do this, we need to:
- add a new `--no-announcement` flag (which ensures the default is "do
add the announcement")
- log when we're not using announcements
- detect the environment variable when building the mkdocs site locally
This means we'll always be rebuilding the docs site (to inject the
announcement bar) which is ~16s as of a recent run.
[0]: https://www.jvt.me/posts/2024/11/19/renovate-private-docs/
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
When attempting to perform dependency updates on the `tmp` package,
parsing a previous version's Zod schema results in a lookup failure, as
it had an incorrect form of `repository` as of tmp@0.0.4.
We can handle this by treating it more loosely to convert an array of
repositories into a single element, and handle this on both a
per-version and per-package lookup.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(datasource/packagist): mark abandoned packages as deprecated
Parse Packagist's `abandoned` field and surface it via `isDeprecated`
and `deprecationMessage`, matching how the npm datasource handles npm's
`deprecated` field. When `abandoned` is a replacement package name, the
message suggests it.
This is an official registry signal, so it maps to Renovate's
deprecation mechanism, not the timestamp-based abandonment heuristic.
* test(datasource/packagist): drop incorrect output-type annotation on raw input
* update tests
* Update lib/modules/datasource/packagist/schema.ts
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
---------
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
* fix(docker): handle 405 maxResults error on auth probe for ECR-compatible proxies
Some private Docker registries that front ECR reject `n=10000` on the tags
URL even during the auth-probe request, returning a 405 with the ECR-style
"Member must have value less than or equal to 1000" error body.
`getAuthHeaders` had no handler for this case and returned null, so the
lookup aborted before the main fetch loop's existing n=1000 retry could fire.
Fix: extract `isECRMaxResultsResponse` from `isECRMaxResultsError` in ecr.ts
and use it in `getAuthHeaders` to detect the 405 pattern. When matched, fall
back to probing the base `/v2/` endpoint for auth, then let the existing
`isECRMaxResultsError` retry in the tag-fetch loop handle the n=1000 fallback.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(docker): address PR review comments on ECR proxy auth probe fix
- Shorten test token to 'abc' to avoid CodeQL secret-detection false positive
- Replace HttpResponse<any> with HttpResponse<unknown> in common.ts and ecr.ts
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(docker): replace HttpResponse<any> with HttpResponse<unknown> in isECRMaxResultsResponse
Cast body to a typed shape inline instead of widening the whole response to any.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* test(docker): replace toMatchInlineSnapshot with toEqual in ECR auth probe test
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
As it may lead to re-Slacking when there's a new label added to an
already `mend-app`'d Discussion.
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
* fix(platform/forgejo): replace getJsonUnchecked with validated getJson
Migrate all getJsonUnchecked calls in the Forgejo platform module to use
getJson with Zod schemas for response validation. Add comprehensive Zod
schemas to schema.ts and update test mocks to use proper data formats.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* simplify by using infered types
* first pass on reducing duplications
* move PrStatus and CommitStatus to schema
* remove code handling BranchStatus values now ensured by schema
* remove now unreachable code
* fix coverage
* use forgejo schemas instead gitea for changelog fetching
* feat: do not abort repo on unrecognized default merge style
* refactor: instead of usages of `?? {}` with a default parameter
* tighten required parameters and move contentString generation to schema
* refactor: merge both content schemas and use a discriminated union
* refactor: move patchJson and postJson to schema validation
* Make body field required
* make schema more strict
* use DeepNullish
* simplify catch
* revert the gitea Content type change
* unify User
* log more nicely if accidentally not a file has been referenced
* Use fakeSha and LongCommitSha schema
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Per #40738 and #44034, we're seeing recent changes to
`renovate-config-validator` that have led to either a gap in
functionality or a breaking change that makes
`renovate-config-validator` unusable.
To make sure that we ensure that we're always making reasonable changes
to `renovate-config-validator`, we can introduce an integration test
harness to validate the call end-to-end.
We can make sure to handle:
- `--version`
- using global/repo config files
- any of the known config filenames (#44034)
- explicitly test a JSONC and JSON5 file with their respective example
content
Due to the full end-to-end run of `renovate-config-validator`, which
creates a full Node process, we can run the tests concurrently to ensure
that we speed up the test runs, as they're fairly slow in comparison to
regular tests.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fix(workers/global): parse `.jsonc` files
As noted in #44033, this leads to cases where
`renovate-config-validator` can't parse a repo's `renovate.jsonc`.
This doesn't currently affect when Renovate itself runs fully.
* test(workers/global): add coverage for `getParsedContent`
This test also validates that the fix introduced in the previous commit
correctly fixes the issue.
This also makes sure that if we change the default JSON-like filenames,
we'll validate that it can be parsed, based on the filename.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
Adam Gutglick