In a similar fix to 06cf949974, this fixes
early versions of `https://registry.npmjs.org/fs-extra` returning an
array value for `homepage`, resulting in no caching for these responses.
* chore(workers/repository): provide more detail when rolling back
To help debug the case where rollbacks are being initiated, we can:
- add slightly more information to the `Filtered out ...` log line
- add `prBodyNotes` to the resulting PR
This requires we expose the `prBodyNotes` field to `LookupUpdate`, and
the `packageName` and `datasource` to `RollbackConfig`, so we can log
them.
* chore(modules/datasource): log `datasource` and `packageName` when filtering
For more context when reviewing the logs.
* chore(azure): simplify calculation for `getMergeMethod`
Instead of the complicated check we were previously performing which:
- recovered from errors if `policyConfigurations` wasn't undefined, or
other errors occurred
- trimmed the field names and checked if they were one of the
`GitPullRequestMergeStrategy` options
We can instead rewrite this with stronger types and compile time checks
to confirm that the mapping from a policy configuration matches the
different `GitPullRequestMergeStrategy`s.
This provides a clearer intent for what this code is doing.
This changes behaviour slightly - previously, the first JSON key defined
that was a `GitPullRequestMergeStrategy` would be used (which is JSON
implementation specific), whereas now it is a defined order.
We also add coverage for the new behaviour.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! chore(azure): simplify calculation for `getMergeMethod`
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
To aid with debugging, it would be useful to confirm what the resulting
method is, in both paths.
With help from GPT-4.1 to craft the enum-to-string conversion.
Co-authored-by: gpt-4.1 <jamie.tanna+github-copilot@mend.io>
As part of general work to reinforce the brand link between Mend and
Renovate, we can improve the default PR body footer to clarify this.
This feeds into #29885 and general naming, where we want to keep these
close, while also not being too "in your face".
This is still user-controlled, but provides a more reasonable default.
This also feeds into #26838 and #39305, where we should also remove the
"Bot" from the footer.
* fix(versioning/github-actions): don't parse `allowedVersion`-style ranges as a range
As noted in #42824, when using a range for `allowedVersion`, changes to
how ranges are parsed with `semver.coerce` led to incorrectly matching
this as a version that would like to be updated to.
We can guard this by making sure a SemVer style version number is used.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* perf(versioning/github-actions): create constants for regexes
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* test: skip coverage
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* fix(homebrew): allow subdirectories for Homebrew Formulas
* fix(homebrew): only allow up to 1 subdirectory
* fix(homebrew): double escape w (word character)
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* fix(versioning/github-actions): treat floating tags as equal
As noted in #42662, if a floating tag `@v2` is used, Renovate currently
tries to roll it back to `@v1`, as it doesn't see that `@v2 === @v2`.
* fix(versioning/github-actions): allow `v` prefix matching too
* feat: Gerrit supports gitUrl
This change adds support for the gitUrl parameter to the gerrit platform.
It queries the gerrit server to check what download options are available. If ssh is selected but not available, it will throw an error.
* feat: Gerrit supports gitUrl
This removes support for querying the supported download schemes and
instead hard-codes the default ssh port.
* fix: Review feedback
Addresses feedback left in review:
- constants for ports
- better SSH url creation
- more consistent util method usage
* fix: Review feedback
Addresses feedback left in review:
- Reverts SSH URL creation to ensure coverage target
* fix: Review feedback
Addresses feedback left in review:
- Convert switch statement to if/else
- Move endpointURL check into getGerritResponse
This makes the parse/clone calls unnecessary.
* fix: Review feedback
Addresses feedback left in review:
- Simplify ssh url creation
* chore(types): correct JSDoc
* chore(types): add missing `ConstraintName` enforcement
* fixup! chore(types): add missing `ConstraintName` enforcement
By simplifying this case, which should never happen, as the types
wouldn't allow it.
* chore: reorder for typechecking simplicity
* fixup! chore(types): add missing `ConstraintName` enforcement
* fix(versioning/github-actions): correctly handle `major.minor` and `major`
As part of the final set of changes needed to support Immutable Releases
with GitHub Actions and the `github-actions` versioning, we need to
modify how our versioning works to handle correctly surfacing the
shortest version available.
To make this more resilient, and help us test-drive the change, we'll
also add an integration test that:
- extracts from a GitHub Actions workflow
- performs a lookup (with mocked data)
- determines the available updates that would be proposed
This provides more confidence in the change itself, as well as
validates the intended changes.
This also moves `prefix` and `minLevel` to a single definition.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! fix(versioning/github-actions): correctly handle `major.minor` and `major`
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! fix(versioning/github-actions): correctly handle `major.minor` and `major`
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
So all lookups downstream can be performed in `O(1)` time.
Suggested by Claude Sonnet.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fix(datasource/pypi): sanitize GAR userinfo for authenticated lookups
Strip URL userinfo from Google Artifact Registry PyPI lookup URLs only when
Google auth is being applied. This avoids got-derived Basic auth conflicts for
uv-style index URLs while keeping the change narrowly scoped to authenticated
datasource requests.
* Test getAuthHeaders with invalid URL
* Parse the URL once
* Remove cast and ignore error
* Remove test and add v8 ignore comment
---------
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
fix(nuget): update lock files when Directory.Build.props is changed
Directory.Build.props is a standard MSBuild import file that can contain
PackageReference elements. When Renovate updates packages in this file,
lock file regeneration was skipped because updateArtifacts only handled
.csproj/.vbproj/.fsproj, Directory.Packages.props/Packages.props, and
global.json.
This extends the existing logic to treat Directory.Build.props the same
way as central management files — all project files under its parent
directory are restored to regenerate their lock files.
Also renames the isCentralManagement parameter to isPropsFile for
clarity, since it now covers both central management and
Directory.Build.props files.
Relates to #15696, #8010
When using `docker` versioning, we correctly treat a `v1.2` -> `v1.3`
version update as valid.
However, when using the previous implementation of `github-actions`'
versioning, we would silently ignore them, filtering them in
`filterValidVersions`.
This leads to cases where a `v1.2` would be upgraded to `v1.3.0`, which
wasn't correct.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* Take nuget.config into account for registryUrls of nuget packages
* Remove 'afterEach' in tests
* Fix PR remarks
* Remove 'any' as suggested in code review
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Update lib/modules/manager/cake/index.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Verify mock parameters in cake manager tests
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
GitHub Actions' versioning somewhat mirrors the SemVer-style versioning,
but doesn't quite.
This is in the case that it's common to use (mutable) tags like `v7` or
`v4.2`, as well as full SemVer style` `v1.2.3` and `v1.3.4-rc2`, doesn't
quite match it.
In addition, with GitHub's recent move to introduce Immutable Tags,
these require new releases to be a full SemVer `major.minor.patch` tag.
However, we don't currently have a way to take users from `@v7` to
`@v8.1.1`, in the case they're using Immutable Tags.
Given this isn't currently straightforward with any of our existing
SemVer-y versioning modules like `semver-coerced` or `semver-partial`,
we should instead introduce a specific Versioning module.
This mostly covers the functionality that `semver-partial` has, but
needs to take advantage of the `allVersions` parameter to find the
"shortest" possible tag for a given resolved Semantic Version.
This was previously attempted in previous changes, but reverted in
db64cc6de0 due to additional complexity.
We won't turn it on by default right now, but as a future change.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
As part of future changes, we'll introduce a new Versioning module for
GitHub Actions, which requires knowing if the version it's proposing
actually exists.
This is a more useful concept for Versioning modules to be able to take
advantage of, so we can expose this as an optional capability that
Versioning modules can use.
The changes in da04b8edac mostly worked,
but given `astral-sh/setup-uv` is now using Immutable Tags it _must_ be
resolved as `versioning=semver`, to make sure that version updates are
correctly raised.
However, we can't treat it as `versioning=semver`, as that will then
fail to parse the current version correctly.
Instead, we must use a `regex` versioning scheme, which allows us to
optionally parse the minor and patch versions.
This allows `newVersion` to be pinned accordingly to SemVer, but does
not require previous versions to be so.
We can do this - for now - with an explicit allowlist.
As per #42331, we should migrate to using `semver-partial` for GitHub
Actions' tags versions, instead of `docker`.
This mirrors actual usage of the way that the ecosystem tags Action
versions, and also has the benefit of automagically migrating users of
Actions that have enabled Immutable Tags, which now must be a full
SemVer tagged version.
As we're now specifying the `versioning: semver-partial`, we don't need
to specify it in `pinGitHubActionDigestsToSemver`.
* feat: add XcodeGen manager for Swift package dependencies in project.yml files
* chore(xcodegen): inline project.yml fixture
* fix(xcodegen): use semver instead of swift versioning
* fix(xcodegen): use glob syntax for manager file pattern
* tests(xcodegen): expect logger is called on invalid packages
* tests(xcodegen): better assert extracted package contents
* chore(xcodegen): simplify regex usage
* chore(xcodegen): log projects without dependencies
* chore(xcodegen): simplify dependency resolving and remove regular expressions in favor of the `detectPlatform` helper function
* chore(xcodegen): use `coerceString` on package versions to simplify testing and improve coverage
* chore(xcodegen): address PR review comments.
---------
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* feat(manager/ant): add registry URL discovery from settingsFile and remoteRepository
Read Maven registry URLs from settingsFile attribute on dependency
blocks (parsed via Maven's extractRegistries) and from inline
<remoteRepository url="..." /> elements. Registries are merged,
deduplicated, and scoped to their dependency block.
* update java docs
* fix coverage
* apply suggestions
* fix ci issues
* feat(manager/ant): add coords= attribute syntax support
Support Maven coords attribute format (group:artifact:version and
group:artifact:version:scope) as an alternative to separate
groupId/artifactId/version attributes.
* add trace logs
* fix coverage
* feat: timing statistics for getReleases
Adds collection and reporting of timing statistics for
`datasource.getReleases()` calls. Each call records the datasource, registryUrl,
packageName, and duration. The intent is to visibility into where
renovate is retrieving release information and how long that might take.
The report consists of a nested data-structure that provides increasing
detail as we descend datasource, registryUrl, and packageName.
The full report is logged at trace level
`getReleases statistics with packages`.
A summary report including only datasources and registryUrls is logged
at debug level `getReleases statistics summary`.
* add GetReleasesSpanProcessor
- Re-instrument getReleases calls using open telemetry.
- Adds GetReleasesSpanProcessor, which can adapt
`getReleases` spans to GetReleasesStats.
* fixup instrumentation tests
* pr feedback
* pr feedback: naming
* pr feedback: comments
Support <import file="..."/> elements in Ant build files to follow
cross-file dependencies. Properties defined before the import are
available in the imported file. Cycle detection via visited-file
tracking prevents infinite loops.
* feat(bitbucket-pipelines):update file patterns to support shared configs
Signed-off-by: Adam Setch <adam.setch@outlook.com>
* feat(bitbucket-pipelines):update file patterns to support shared configs
Signed-off-by: Adam Setch <adam.setch@outlook.com>
* feat(bitbucket-pipelines):update file patterns to support shared configs
Signed-off-by: Adam Setch <adam.setch@outlook.com>
---------
Signed-off-by: Adam Setch <adam.setch@outlook.com>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
RahulGautamSingh