* fix(datasource/rust-version): skip blank lines in manifests.txt
`https://static.rust-lang.org/manifests.txt` ends with a trailing
newline, so `response.body.split('\n')` always yields an empty final
element. `parseManifestUrl('')` returns `null`, which triggered the
`Failed to parse manifest URL` warning on every run. The warning then
surfaces as a `Repository Problems` entry on the Dependency Dashboard
for any repo with a rust-version-tracked dep (`rust-toolchain.toml`,
or a custom-regex manager pointing at the `rust-version` datasource).
Skip blank/whitespace-only lines silently; keep warning on genuinely
malformed non-empty lines (covered by the existing
"ignores unexpected URLs" test).
* docs(datasource): condense comment
Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>
* Remove accidental newline
---------
Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
As found in #43361, otherwise the GitHub Action fails to build, as the
upstream maintainers require explicit allowlisting of new Zizmor
versions, which is good security practice.
When we change configuration for what namespaces are possible to
override, there's no way for a self-hosted administrator to know this.
This leads to cases where an override can be left in configuration,
giving a false sense of security for caching.
Instead, we should inform self-hosted administrators when this happens,
using a config validation error, which will fail
`renovate-config-validator`, and add a WARN to the logs when failing.
* feat(self-hosted): make `user-agent` templatable
For Mend-hosted apps, it would be useful to provide a little bit more
information for where a Renovate HTTP request is coming from.
To provide more control over the generated field, we can make it
templatable, with the option to specify the `renovateVersion`.
As this now exposes Handlebars syntax to the user, we should be clear
that this `supportsTemplating`, and document with tests what this
allows.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! feat(self-hosted): make `user-agent` templatable
* fixup! feat(self-hosted): make `user-agent` templatable
As we're now returning the defaults in `GlobalConfig.get` calls.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
On a sufficiently large repository, this log line would lead to the Node
process being killed due to reaching the Node VM's maximum string
length, as per:
import { constants } from 'node:buffer';
console.log(constants.MAX_STRING_LENGTH); // ~536MB
This happens because for each update we're including in
`reconfigureBranchCache.ExtractResult`, we include the `BranchConfig`
which is effectively all Renovate config options.
On a sufficiently large repository, this hits size limits, but given
this isn't a particularly widely used log line for debugging, moving
this to a TRACE is a sufficient step.
We can continue to keep the `reconfigureBranchSha` and `isConfigValid`
fields in the original log line (albeit now top-level).
* feat(rust-toolchain): Implement `rust-toolchain` manager
* feat(rust-toolchain): Add support for legacy filename
* feat(rust-toolchain): Add support for legacy file format
* refactor(rust-toolchain): Reject empty `channel` strings at parse stage
* tests(rust-toolchain): Cover valid TOML missing `[toolchain]` or `channel`
* refactor(rust-toolchain): Log legacy format fallback at `trace` level
* refactor(rust-toolchain): Reject empty and multi-line legacy files explicitly
* tests(rust-toolchain): Cover unparseable channel value
* tests(rust-toolchain): Use `codeBlock` for multi-line fixtures
* docs(rust-toolchain): Scope pin example to `rust-toolchain` manager
Co-authored-by: Sergei Zharinov <1239644+zharinov@users.noreply.github.com>
* tests(rust-toolchain): Use `codeBlock` for schema fixtures too
---------
Co-authored-by: Sergei Zharinov <1239644+zharinov@users.noreply.github.com>
* docs(presets): Define presets as reusable bits of JSON
Mention difference between included and custom presets too
* fix(docs): Use relative link to preset defaults
* Apply suggestions from code review
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
---------
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
* feat(mise): add lock file support
- Add lockfile.ts with getLockFileName() for deriving lock file paths
- Add artifacts.ts with updateArtifacts() and updateLockedDependency()
- Add MiseLockFile Zod schema for parsing lock files
- Update extract.ts to be async and extract lockedVersion from lock files
- Export supportsLockFileMaintenance, lockFileNames, updateArtifacts, updateLockedDependency
* refactor(mise): remove redundant comments
Remove comments that simply restate what the code already clearly
communicates. Keep valuable comments that explain non-obvious behavior
(e.g., why temporary errors are rethrown) and move helpful examples
into JSDoc comments.
* fix(mise): improve lock file version lookup and add tests
- Fix lock file key lookup for non-registry tools (aqua:, ubi:, etc.)
Registry tools use short names (node), non-registry use full names
(aqua:cli/cli). New getLockedVersion() tries both patterns.
- Add injection prevention test for shell quoting
- Add update-failed test for error handling
- Add comprehensive tests for getLockedVersion()
- Add null check for depName in updateLockedDependency
- Add JSDoc to updateArtifacts and extractPackageFile
- Add lock file support documentation to README
- Remove code duplication by consolidating into lockfile.ts
* fix(mise): pass --local flag and MISE_ENV for env/local config files
When updating mise.local.toml, `mise lock` updates mise.lock, not
mise.local.lock. Add --local flag to target the correct lock file.
For env-specific configs (mise.test.toml), set MISE_ENV=test so mise
reads and locks the correct configuration.
Extracted getConfigType() from getLockFileName() to share the parsing
logic between lock file name derivation and command flag generation.
Builds on #42099 by altendky.
* test(mise): cover tool absent from lock file
* refactor(mise): remove dead branches in extractPackageFile
tools is required by MiseFile schema so if(tools) is always true.
depName is always set by createDependency so if(dep.depName) is always true.
Add test for tool absent from lock file to cover the lockedVersion
assignment branch.
* fix(mise): address review feedback on lock file support
* fix(mise): remove unsupported tool constraint
* fix(mise): add containerbase tool definition
* fix(mise): add typed exec constraint support
* fix(config): restore requireConfig typing
* test(mise): await registry extraction cases
* Update lib/modules/manager/mise/artifacts.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* fix: revert unrelated types cleanup
* fix: drop missing VersioningName import
* fix(mise): use npm versioning string after import removal
* test(mise): set binarySource=global in artifacts spec
GlobalConfig.get now returns defaults; without explicit binarySource the
test fell into containerbase dynamic install and tried to resolve the
mise version via the github-releases datasource, causing missing HTTP
mock errors. Force binarySource=global so the spec only exercises the
mocked exec path.
---------
Co-authored-by: Kyle Altendorf <sda@fstab.net>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io>
As noted in #43445, there are cases where:
- an infrequently updated repository prepares a GitHub Release by
creating a draft release
- some time passes, and the maintainers publish the Release
- no new commits are pushed to the release branch (i.e. `main`) in that
time
In this case, Renovate would previously use the `created_at` of the Git
tag (according to the GitHub API) rather than the `published_at` time
from the GitHub Release.
This is correct when using a plain Git tag, as we only have metadata to
indicate when the commit the tag points to was created.
However, when we have GitHub Release information, we should use that to
take precedence.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
At some point in the past, mise's support for the short name `kafka` was
removed.
We can warn our users that this is no longer supported, but keep our
custom logic for it, in case it returns in the future.
As noted in #43280, there may be cases where users attempt to perform
config validation via stdin, or in a directory that doesn't contain any
configuration files, and it may be unexpected to see that the `Config
validated successfully`, if we didn't actually process anything.
To improve this, we can track how many file(s) are being validated, and
more visibly note when 0 files have been validated.
* docs(development): add start of contribution guidelines
As part of an increase in AI-generated Issues/Discussions/PRs, we can
start to draft some contribution guidelines to reduce the burden on
maintainers needing to nudge users to provide the relevant information,
or follow repo guidelines.
Co-authored-by: Claude Sonnet 4.7 <jamie.tanna+claude-code@mend.io>
* chore: symlink `CLAUDE.md`
* docs(development): move AI disclosure to PR template
Per suggestion from Sergei.
* docs(development): add reference to PR template
Per suggestion from Sergei.
* docs(development): reference filenames for Discussion templates
---------
Co-authored-by: Claude Sonnet 4.7 <jamie.tanna+claude-code@mend.io>
In 01bcd4fd43 we introduced knowledge of
the Maven Central mirror, but haven't taken it into account when looking
at rate limit errors.
To prevent this in the future, we can introduce a new helper function,
`isMavenCentral`, for other usage.
As a way of indicating how fresh our list of supported tools in the
registry is, we can make sure we populate the version into a note above
the table.
We can extract a type to make it easier to reference the parsed JSON
file.
This requires a small tweak to handle `content`'s table insertion.
The git-submodules extractor was setting sourceUrl to the raw git HTTP URL,
including the .git suffix (e.g. https://github.com/owner/repo.git).
This caused the 'githubDigestChangelogs' preset's changelogUrl template
'{{sourceUrl}}/compare/{{currentDigest}}..{{newDigest}}' to produce
invalid URLs like:
https://github.com/owner/repo.git/compare/abc123..def456
which 404s because GitHub compare URLs don't support the .git suffix.
Other managers (bundler, deps-edn, flux) already strip .git from sourceUrl.
This fix follows the same pattern.
renovate[bot]