* docs(constraints): list the possible `constraints` and `installTools`
Now we have a stronger type for what a valid tool constraint is, and
what additional constraints are, we should be very explicit with what
each option is, and specify them in the `constraints` as well as our
`installTools` docs.
* test: add coverage
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
As we do with the other modules, we should include Managers too.
Although there are many, it can be a little jarring not seeing the list
of Managers when viewing a specific one.
This requires we also show the "display name" (`Ansible`) in the
sidebar, and then use the more verbose `Automated Dependency Updates for
Ansible` as the header.
To do this, we can utilise the `sidebar_label` (which was previously
used in Docusarus, but unused by Material for MkDocs) via a custom hook
to inject the label for the sidebar.
Unfortunately this requires a custom hook, which will make moving away
from Material for MkDocs (to Zensical) a little less straightforward.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
As they are configuration options and can be quite code-y we should
render them like this.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* chore: move from volta.sh to mise
* !fixup chore: move from volta.sh to mise
* Update mise.toml
---------
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* feat(manager/ant): add registry URL discovery from settingsFile and remoteRepository
Read Maven registry URLs from settingsFile attribute on dependency
blocks (parsed via Maven's extractRegistries) and from inline
<remoteRepository url="..." /> elements. Registries are merged,
deduplicated, and scoped to their dependency block.
* update java docs
* fix coverage
* apply suggestions
* fix ci issues
* fix(workers/repository): don't include `skipReason`'d dependencies in flattened updates
When we're preparing the final, flattened, list of branches to prepare
updates for, we're not filtering out any dependencies that have a
`skipReason` in them.
In the case that, as part of future changes like #42510, a `skipReason`
may be added after the `lookup` phase, we can still get PRs raised even
when they shouldn't be.
We already filter out `enabled=false`, so we should make sure to also
filter anything with a `skipReason`.
* feat(osv): mark malicious packages with `skipReason`s
As part of current ongoing supply chain attacks, there have been cases
where Renovate updates packages to a malicious version.
We'll be introducing a more in-depth means to surface these, including
from different API sources, as part of the Enrichment functionality,
but in the short-term we can utilise osv.dev's ingestion of OpenSSF's
Malicious Packages data.
To do this, we need to:
- look for any `MAL-` advisories
- match it against the current dependency's version, and if affected, mark it
as `skipReason: malicious-version-in-use` (which will be unset in
the `lookup()` function, so we still perform updates
- match it against the dependency's available updates, and if any are
affected, mark the dependency
as `skipReason: malicious-update-proposed`
* fixup! feat(osv): mark malicious packages with `skipReason`s
* fixup! feat(osv): mark malicious packages with `skipReason`s
* test(workers/repository): add missing coverage
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
* chore: simplify type
* wip-opus
* Revert "wip-opus"
This reverts commit e7b5f297c9.
* simplify
* sq
* sq
* fixup
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
* docs: add Community Tools page with Renovate Operator
* docs(readme): link to Community Tools page
* docs(running): add link to community tools
---------
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io>
* docs: explicitly document `depTypes` each manager supports
A long-standing question we receive is "what `depTypes` can I match
against in my project".
Although the best recommendation we usually have is "check the
`packageFiles with updates" log line (as a very key log line for users),
we can go one step further and try and create a stronger contract.
To do this, I've used Claude Sonnet 4.6 to work through the codebase,
determine areas that a `depType` is set in a manager (statically or
dynamically) and generate a structured, typed, means to document how
they're used.
Through a few iterations of the process, and attempts at human-written
documentation, we've settled on:
- prioritising autogenerated documentation (for humans to read) to note
what `depTypes` are known, and what they are
- `knownDepTypes`, to describe any known, static, `depType`s and their
human-readable meaning
- with the `prettyDepType`, if used
- `supportsDynamicDepTypesNote`, to add a Markdown note to the generated
documentation
While here, we also:
- make sure to note this in the "adding a new package manager"
documentation
- remove any hand-written references to `depTypes` in each manager's
documentation page
- correct the Gleam `depTypes`
- make sure to use the `knownDepTypes`'s `prettyDepType` definition if
we know it, for a given `depType`
The descriptions have been generated by Claude Sonnet, with some
human-written tweaks where appropriate.
[0]: https://github.com/renovatebot/renovate/discussions/15176
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! docs: explicitly document `depTypes` each manager supports
* docs(manager): display `depTypes` documentation if none present
For consistency, and to make it more explicit.
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(datasource): add elm-package datasource
* refactor(elm): inline test fixtures
* fix(elm): correct import ordering in test file
* fix(elm): use zod/v3 import to match codebase conventions
* refactor(elm): rename types.ts to schema.ts
Follow project convention of using schema.ts for zod schema files.
* test(elm): add test for invalid JSON response
Use v8 ignore if directive and add test covering the null result
path when the API returns invalid JSON.
* refactor(elm): remove unreachable null check
* test(elm): add test for default registry URL fallback
* refactor(elm): guard against missing registryUrl instead of fallback
* fix(elm): handle ZodError gracefully instead of throwing
* feat(elm): add package cache for elm-package datasource
* feat(manager/npm): pass --before to npm install when minimumReleaseAge is set
* use logger metadata
* Apply suggestion from @viceice
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
---------
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* fix(cache): instrument repository cache load and save
Wrap repository cache `load()` and `save()` calls with the existing
`instrument()` helper to create OpenTelemetry spans for cache lifecycle
operations. This gives operators visibility into repository cache
performance, especially useful with S3 backends.
Refs #41760
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cache): instrument package cache init and destroy
Wrap package cache `init()` and `destroy()` with `instrument()` to
create OpenTelemetry spans, matching the repository cache instrumentation
from the previous commit. Covers redis, sqlite, and file backends.
Refs #41760
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* docs: document cache lifecycle tracing in OpenTelemetry guide
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Move destroy() outside init instrument span
Avoids nesting the package-cache.destroy span inside
package-cache.init, making them sibling spans instead.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Use 'verb NounClass' span naming convention
Rename instrument span names from dot-notation (e.g.
'package-cache.init') to 'verb NounClass' pattern (e.g.
'init PackageCache') per reviewer feedback.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: port Ubuntu versioning support to Debian container images
Resolves#27862.
Signed-off-by: Alexander Gil <pando855@gmail.com>
* refactor: Remove dead code in debian versioning
Signed-off-by: Alexander Gil <pando855@gmail.com>
* refactor: Rename groups to match
* perf: optimize isStable method by reusing getVersionByCodename result
* fix(debian): specify radix in parseInt for dated container image version
---------
Signed-off-by: Alexander Gil <pando855@gmail.com>
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io>
RahulGautamSingh