* docs(constraints): list the possible `constraints` and `installTools`
Now we have a stronger type for what a valid tool constraint is, and
what additional constraints are, we should be very explicit with what
each option is, and specify them in the `constraints` as well as our
`installTools` docs.
* test: add coverage
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
As we do with the other modules, we should include Managers too.
Although there are many, it can be a little jarring not seeing the list
of Managers when viewing a specific one.
This requires we also show the "display name" (`Ansible`) in the
sidebar, and then use the more verbose `Automated Dependency Updates for
Ansible` as the header.
To do this, we can utilise the `sidebar_label` (which was previously
used in Docusarus, but unused by Material for MkDocs) via a custom hook
to inject the label for the sidebar.
Unfortunately this requires a custom hook, which will make moving away
from Material for MkDocs (to Zensical) a little less straightforward.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
As they are configuration options and can be quite code-y we should
render them like this.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(manager/ant): add registry URL discovery from settingsFile and remoteRepository
Read Maven registry URLs from settingsFile attribute on dependency
blocks (parsed via Maven's extractRegistries) and from inline
<remoteRepository url="..." /> elements. Registries are merged,
deduplicated, and scoped to their dependency block.
* update java docs
* fix coverage
* apply suggestions
* fix ci issues
* fix(workers/repository): don't include `skipReason`'d dependencies in flattened updates
When we're preparing the final, flattened, list of branches to prepare
updates for, we're not filtering out any dependencies that have a
`skipReason` in them.
In the case that, as part of future changes like #42510, a `skipReason`
may be added after the `lookup` phase, we can still get PRs raised even
when they shouldn't be.
We already filter out `enabled=false`, so we should make sure to also
filter anything with a `skipReason`.
* feat(osv): mark malicious packages with `skipReason`s
As part of current ongoing supply chain attacks, there have been cases
where Renovate updates packages to a malicious version.
We'll be introducing a more in-depth means to surface these, including
from different API sources, as part of the Enrichment functionality,
but in the short-term we can utilise osv.dev's ingestion of OpenSSF's
Malicious Packages data.
To do this, we need to:
- look for any `MAL-` advisories
- match it against the current dependency's version, and if affected, mark it
as `skipReason: malicious-version-in-use` (which will be unset in
the `lookup()` function, so we still perform updates
- match it against the dependency's available updates, and if any are
affected, mark the dependency
as `skipReason: malicious-update-proposed`
* fixup! feat(osv): mark malicious packages with `skipReason`s
* fixup! feat(osv): mark malicious packages with `skipReason`s
* test(workers/repository): add missing coverage
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
* chore: simplify type
* wip-opus
* Revert "wip-opus"
This reverts commit e7b5f297c9.
* simplify
* sq
* sq
* fixup
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
* docs: add Community Tools page with Renovate Operator
* docs(readme): link to Community Tools page
* docs(running): add link to community tools
---------
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io>
* feat(datasource): add elm-package datasource
* refactor(elm): inline test fixtures
* fix(elm): correct import ordering in test file
* fix(elm): use zod/v3 import to match codebase conventions
* refactor(elm): rename types.ts to schema.ts
Follow project convention of using schema.ts for zod schema files.
* test(elm): add test for invalid JSON response
Use v8 ignore if directive and add test covering the null result
path when the API returns invalid JSON.
* refactor(elm): remove unreachable null check
* test(elm): add test for default registry URL fallback
* refactor(elm): guard against missing registryUrl instead of fallback
* fix(elm): handle ZodError gracefully instead of throwing
* feat(elm): add package cache for elm-package datasource
* feat(manager/npm): pass --before to npm install when minimumReleaseAge is set
* use logger metadata
* Apply suggestion from @viceice
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
---------
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* fix(cache): instrument repository cache load and save
Wrap repository cache `load()` and `save()` calls with the existing
`instrument()` helper to create OpenTelemetry spans for cache lifecycle
operations. This gives operators visibility into repository cache
performance, especially useful with S3 backends.
Refs #41760
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cache): instrument package cache init and destroy
Wrap package cache `init()` and `destroy()` with `instrument()` to
create OpenTelemetry spans, matching the repository cache instrumentation
from the previous commit. Covers redis, sqlite, and file backends.
Refs #41760
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* docs: document cache lifecycle tracing in OpenTelemetry guide
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Move destroy() outside init instrument span
Avoids nesting the package-cache.destroy span inside
package-cache.init, making them sibling spans instead.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Use 'verb NounClass' span naming convention
Rename instrument span names from dot-notation (e.g.
'package-cache.init') to 'verb NounClass' pattern (e.g.
'init PackageCache') per reviewer feedback.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: port Ubuntu versioning support to Debian container images
Resolves#27862.
Signed-off-by: Alexander Gil <pando855@gmail.com>
* refactor: Remove dead code in debian versioning
Signed-off-by: Alexander Gil <pando855@gmail.com>
* refactor: Rename groups to match
* perf: optimize isStable method by reusing getVersionByCodename result
* fix(debian): specify radix in parseInt for dated container image version
---------
Signed-off-by: Alexander Gil <pando855@gmail.com>
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io>
Add template compilation support for sourceUrl in package rules,
allowing users to dynamically construct source URLs using template
syntax. This enables use cases like OpenTofu providers where the
source URL needs to be constructed from the package name.
RahulGautamSingh