As part of follow-up changes in #45706, we want the `apk` / `apt`
parsing in the `dockerfile` manager to attempt to determine which
distribution - and therefore registry - to look up dependencies for.
When there is an image that we don't know how to resolve, we want to
treat them as a `skipReason: unknown-registry`.
However, this doesn't provide any way for the user to say "I know which
registry you should look up updates for".
To handle this, we can treat `unknown-registry` differently, allowing it
to un-skip itself when there are any `registryUrls`s defined.
This allows for general usage, where if Renovate doesn't know how to
interact with a given registry, but a user does, then the user can
override the registry with a `packageRules` entry.
We continue skipping a dependency when `unknown-registry` is set
alongside a dependency's `registryUrl`.
We add this un-skipping logic into `applyPackageRules()`, but need to
make sure that we also gate it inside `lookup()`, so a dependency that's
passed through `applyPackageRules()` is re-checked to ensure that the
check is enforced.
Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io>
* fix(merge-confidence): don't require auth in `platform=local`
When dry-running Renovate against a repository to validate it[0], if a
repository is using `matchConfidence`, the whole Renovate run is aborted
due to missing API credentials.
This can be frustrating, and the workaround available is to temporarily
remove all package rules use `matchConfidence`, which isn't the best
experience.
Instead, we should follow the existing pattern to return `null` when
loading a Package Rule with `matchConfidence`, as well as DEBUG logging
to inform the user why this is happening.
[0]: https://www.jvt.me/posts/2026/03/08/renovate-test-config/
* fixup! fix(merge-confidence): don't validate auth in a
With debugging from Claude to work out how to get the test to pass.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
perf(package-rules): avoid re-cloning packageRules array on every rule merge
applyPackageRules() merges each matching rule via mergeChildConfig(),
which deep-clones the entire accumulated config — including the
invariant packageRules array itself. On repos with many dependency
instances and large rule arrays (e.g. vulnerabilityAlerts force-rules
embedding advisory texts), this cloning dominates the whole run
(observed at ~66% of total CPU in a production profile).
Exclude packageRules from the working config while rules are applied
and restore it afterwards, preserving the previous merge semantics for
rules that themselves carry nested packageRules, and for null/empty/
absent inputs.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* refactor(linters): add prefer-coerce-array rule
Refs #45217
`x ?? []` and `coerceArray(x)` say the same thing, but only the second
one is searchable and consistent. The rule flags a `??` whose default is
a bare `[]` literal; a non-empty default or an asserted `([] as Foo[])`
still passes.
Applying it across `lib/` surfaced three spots the helper cannot cover,
which keep `?? []` with a disable comment or a narrower fix:
- `package-files.ts` destructures a tuple, which `coerceArray()` widens
- `generate.spec.ts` defaults `matchAll()`, an iterator rather than an array
- `mise/upgradeable-tooling.ts` declares a `Record` return, so its
`?? []` fallback was wrong to begin with and becomes `coerceObject()`
* refactor(platform/github): hoist the GHE version header lookup
`Object.entries(...).find()` returns a tuple, and defaulting it with
`?? []` only to destructure the second element reads as an array
default when it is not one. Name the found entry instead, which drops
the `?? []` rather than routing a tuple through `coerceArray()`.
fix(data): update react and react-native source URLs to react/react org
The react and react-native repositories moved from the facebook org to
the react org on GitHub
See https://github.com/renovatebot/renovate/discussions/44772
As a follow-up to e1e5c398e0, we can make
sure that we remove references to hardcoded docs site URLs, by wiring in
the `GlobalConfig.get(...)` call.
To do this, we need to make sure that `productLinks` exists to be called
by `GlobalConfig.get`.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* chore: ensure we use `productLinks` for docs site links where possible
Where possible, we should be making sure that we're using the
`productLinks`' configuration for the documentation site, especially
where self-hosted users may create a mirror of their docs[0].
To make sure we catch this in the future, we can introduce a custom
linting rule with Oxlint to enforce this.
Where we (currently) can't wire in the config, we can disable it against
that line.
[0]: https://www.jvt.me/posts/2024/11/19/renovate-private-docs/
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! chore: ensure we use `productLinks` for docs site links where possible
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! chore: ensure we use `productLinks` for docs site links where possible
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fix(package-rules): correctly merge `force.enabled`
As noted in #42666, after changes in
f8b4477335, we're skipping vulnerability
alert PRs when using the `security:only-security-updates` preset.
This happens because the `enabled=false` that exists on the all
dependencies are not correctly merged into the `force` config in the
`vulnerabilityAlert` update.
To fix this, we need to take `force.enabled` into account when merging
config options.
To slightly improve the type checking, we can also make sure that
`removeMatchers` knows that `force` is field we want typed, too.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* chore(package-rules): simplify condition
As we don't actually need to take into account whether the option is
currently enabled, as we can make sure the `skipReason` and `skipStage`
are always deleted if we're enabling the update.
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
Add template compilation support for sourceUrl in package rules,
allowing users to dynamically construct source URLs using template
syntax. This enables use cases like OpenTofu providers where the
source URL needs to be constructed from the package name.
This also makes sure that our URL fragments should be more consistent
over the years, as duplicate names (across parent and child options)
cannot clash.
This also corrects links from the code to include the new fragment.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
Removes fallback to checking depName for all matchPackageX and excludePackageX rules.
BREAKING CHANGE: matchPackageNames and related functions no longer fall back to checking depName. Rewrite packageRules to use matchDepNames instead.
Jamie Tanna