* feat(managers/pep621): update pixi.lock if present
* test(managers/pep621): cover pixi requires-pixi from workspace table
* refactor(manager/pixi): extract shared pixi.lock update helper
* test(manager/pep621): use arrange-act-assert spacing in pixi tests
* refactor(manager/pixi): revert shared pixi.lock helper extraction
Move the extraction of the shared pixi.lock update helper into a
follow-up PR, as requested in review. The pep621 pixi processor and the
pixi manager again carry their own lock-update logic.
This reverts commit 743db204f2.
* feat(manager/pep621): gate pixi.lock updates behind allowedUnsafeExecutions
`pixi lock` can execute arbitrary code from conda package hooks, so the
pep621 manager now only updates `pixi.lock` when `pixi` is included in the
global `allowedUnsafeExecutions` option, following the same pattern as the
`mise` manager. When `pixi` is not allowed, PEP 621 dependencies in
`pyproject.toml` are still updated but `pixi.lock` is left unchanged.
https://pixi.prefix.dev/latest/security/#4-treat-package-hooks-as-code-execution
* feat(manager/pixi)!: gate pixi.lock updates behind allowedUnsafeExecutions
The pixi manager runs `pixi lock`, which can execute arbitrary code from
conda package hooks. Like the pep621 manager, it now only updates
`pixi.lock` when `pixi` is included in the global `allowedUnsafeExecutions`
option. When it is not allowed, the package file is still updated but
`pixi.lock` is left unchanged.
https://pixi.prefix.dev/latest/security/#4-treat-package-hooks-as-code-execution
BREAKING CHANGE: The `pixi` manager no longer updates `pixi.lock`
automatically. To keep `pixi.lock` updated, add `pixi` to the global
`allowedUnsafeExecutions` option.
feat(manager/pixi): gate pixi.lock updates behind allowedUnsafeExecutions
The pixi manager runs `pixi lock`, which can execute arbitrary code from
conda package hooks. It now only updates `pixi.lock` when `pixi` is
included in the global `allowedUnsafeExecutions` option, following the same
pattern as the `mise` manager. When `pixi` is not allowed, the package file
is still updated but `pixi.lock` is left unchanged.
https://pixi.prefix.dev/latest/security/#4-treat-package-hooks-as-code-execution
* feat(config): add commitTrailers option
Renovate's only way to add git trailers today is `commitBody`, but it's
broken on Gerrit: Renovate appends its own `Renovate-Branch`/`Change-Id`
block after the body, so user trailers end up in a non-final message
block and are not real trailers per git-interpret-trailers rules.
This adds a `commitTrailers: string[]` option (each entry a full
`Key: value` line), standardizes Gerrit's own trailers through the same
mechanism so user trailers and platform trailers merge into one final
block, and verifies the result at runtime with `git interpret-trailers`
(commitlint's trailer-exists rule uses the same approach). The
`:gitSignOff` preset is migrated from `commitBody` to `commitTrailers`
so sign-off works correctly on Gerrit too.
* Simplify a bit
* Simplify docs even more
* Simplify another bit
* Add comment about rawExec
* Drop runtime commit trailer verification
Bypass simple-git only to emit a proactive warn log is not worth the
extra surface area. Config validation already enforces Key: value form.
* test(git): cover string commit message with trailers
Codecov patch failed on the partial ternary branch that normalizes a
string message before appending trailers.
* test(gerrit): fix trailers test after scm rework
Align the commitTrailers merge test with the post-rework Gerrit SCM:
use fakeSha helpers and drop the removed force flag.
* Improve wording on gitSignOff docs
* Validate compiled commitTrailers as well
* Improve trailers example
* Use isString instead
* Update lib/util/git/index.ts
Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com>
* Update lib/workers/repository/onboarding/branch/create.ts
Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com>
* Format code
* Fix type-check
* Fix tests
---------
Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com>
As noted in #30714, and to make the Minimum Release Age page a
"one-stop-shop", we can generate the documentation accordingly.
Using an orange "maybe" for support helps nudge folks to checking which
registry they're using, and noting that it still doesn't necessarily
work, even if the Datasource supports it.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
* feat(instrumentation): allow exporting OTLP JSON file
We've recently been investing in improvements to Renovate's
OpenTelemetry instrumentation to improve debuggability and
supportability.
However, not everyone has an immediately available OpenTelemetry
Collector, so the added instrumentation isn't useful to those users.
Instead, we can provide a way to export to the OTLP file format, which
provides a means to export the data to disk and then consume it later.
This will also support use-cases like running in a CI platform like
GitHub Actions and GitLab CI, where OpenTelemetry Collectors may not be
exposed in that environment, but a post-run execution can export it.
We now need to make sure that `RENOVATE_USE_CLOUD_METADATA_SERVICES` is
never set, as `isTracingEnabled` will now resolve true, and the Cloud
Metadata Resource Detectors will be used.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
* fixup! feat(instrumentation): allow exporting OTLP JSON file
* fixup! fixup! feat(instrumentation): allow exporting OTLP JSON file
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
* fixup! feat(instrumentation): allow exporting OTLP JSON file
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(gitlab): add gitlab codeowners role support
* chore: use named group in roleRegex
* Update lib/config/options/index.ts
Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com>
* Update lib/modules/platform/gitlab/roles.ts
Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com>
* chore: rename getMembers to getGroupMembers
* chore: refactor getRoleMemberUsernames
* chore: adjust test chaining
---------
Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com>
* feat(manager/npm): read private registries from pnpm-workspace.yaml
Honor the `registry` and `registries` settings (pnpm v11+) declared in pnpm-workspace.yaml, applying them to workspace catalog/override deps and member package.json deps. Registry values containing ${...} are ignored, matching pnpm v11.5.3+.
* refactor(manager/npm): share pnpm registry resolution across extract paths
Extract a single applyPnpmWorkspaceRegistries helper so both the
pnpm-workspace catalog path and the package.json extract path apply
registries through one chokepoint, with env-var registry URLs filtered
once and consistently.
* refactor(manager/npm): filter pnpm env-var registries in schema
Move the env-var registry filtering into the PnpmWorkspaceFile schema as a
transform so registries are filtered once at parse time, and use the Nullish
helper for the registry/registries fields.
* refactor(manager/npm): simplify pnpm-workspace check and log parse errors
* feat: add `--rebase-all-open-branches`
* feat: mark rebaseAllOpenBranches as cli: true explicitly
* feat: mark checkedBranches as cli: true explicitly
* fix(manager/nuget): detect MSBuild SDK updates in sqlproj files
MSBuild SDK versions in `<Sdk>`, `<Import Sdk>`, and `<Project Sdk>`
elements are exact pins, but NuGet versioning treats bare versions as
minimum ranges (`>=`). That caused dependencies such as
`0.1.19-preview` to resolve to the latest release and skip updates.
Apply hybrid versioning to all `msbuild-sdk` dependencies at extract
time: use strict `semver` when the pin is valid semver, otherwise fall
back to `semver-coerced` for non-standard NuGet version strings (e.g.
four-segment revisions). Also add `.sqlproj` to the default manager
file patterns for SSDT SQL projects.
Changes:
- Add `applyMsbuildSdkVersioning()` helper and wire it through all
msbuild-sdk extract paths (XML, global.json, single-csharp-file)
- Extend `managerFilePatterns` to match `.sqlproj` files
- Add extract, util, index, and integration tests
- Document `.sqlproj` and MSBuild SDK extraction in nuget docs/readme
* fix(manager/nuget): use bump range strategy for msbuild-sdk deps
Replace hybrid semver versioning for MSBuild SDK pins with a default
package rule (`matchDepTypes: msbuild-sdk`, `rangeStrategy: bump`) per
review feedback. Remove `applyMsbuildSdkVersioning()` from all extract
paths and update tests accordingly. Sort nuget doc file extensions
alphabetically.
When folks are using the pre-built Mkdocs site, it can be confusing that
the client-side rendered "latest" version of the Renovate CLI doesn't
match the version used for the pre-built docs.
As we have a version noted in the footer of the exact version of the
Renovate version these docs correspond to, we should recommend folks
lean on that instead.
Additionally, on the public docs.renovatebot.com site, we're always at
the version anyway, so it's not worthwhile showing this.
* added dart/pub constraintsFilter support
* updated documentation to include pub for constraintsFiltering
* only add extractedConstraints if its populated
* increased coverage
* handle non-nullable environment.sdk better
* feat(config): set `groupSingleUpdates=false` by default
Although it didn't seem like this may be a breaking change when we
introduced this[0], there have been a number of follow-up Discussions
reported that have indicated there has been some breakage from the
changes.
Instead of continually fixing forward, we can revert this back to an
opt-in feature.
Once it's stable, we can look at re-enabling it (most likely in a major
release, unless we're confident no breakage should occur).
[0]: https://github.com/renovatebot/renovate/pull/43629#issuecomment-4594201274
* fixup! feat(config): set `groupSingleUpdates=false` by default
* docs: restructure `postUpdateOptions` table into headers
Replace the wide markdown table under `postUpdateOptions` with
individual `###` headers per option, sorted alphabetically. This
improves readability and makes each option directly linkable.
Update `getConfigOptionSubHeaders` to handle backtick-wrapped
section and sub-header names. Add a test ensuring every
`allowedValues` entry has a corresponding sorted header.
* Update docs/usage/configuration-options.md
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
---------
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
* feat: add generic statusCheckWhen option to control any renovate status check
Replace the artifacts-specific `artifactsCheckWhen` option with a generic
`statusCheckWhen` object that can control when ANY Renovate status check is
emitted. Keys mirror `statusCheckNames`: `artifactError`, `configValidation`,
`mergeConfidence`, `minimumReleaseAge`.
Each key accepts: "always" | "never" | "failed"
- always: set check on every commit (green on success, red on failure)
- never: skip the check entirely
- failed: only set the check when there is a failure (silent on success)
Default values preserve existing behavior:
- artifactError: "failed" (only report failures, as before)
- configValidation: "always"
- mergeConfidence: "always"
- minimumReleaseAge: "always"
The defaults table in docs is autogenerated from the option's `default`
field via `tools/docs` so the docs cannot drift from the source of truth.
Logging is gated so that "skipping" debug lines only fire when there is
something to skip (errors / status set), keeping logs quiet on every
branch run when a check is set to "never".
Example configuration:
```json
{
"statusCheckWhen": {
"artifactError": "always",
"mergeConfidence": "never"
}
}
```
Signed-off-by: Pierluigi Lenoci <pierluigilenoci@gmail.com>
* refactor(docs): address viceice review — single replace marker, coerceObject, simplify replaceContent call
- Use single replace marker instead of begin/end pair in docs and config.ts
- Use coerceObject from lib/util/object.ts instead of manual (val ?? {}) as Type
- Refactor replaceContent call to match upstream API signature (string, not object)
Signed-off-by: Pierluigi Lenoci <pierluigilenoci@gmail.com>
* fix: fix test for never mode with no errors and format docs
- Add missing config.artifactErrors = [] in test that checks
'skips status entirely when mode is never with no errors' (beforeEach
sets artifactErrors to [{fileName: 'some'}], test needs no errors)
- Reformat note block in docs from 4-space to 2-space indent to match
prettier formatting (custom mkdocs-admonitions plugin expectation)
Signed-off-by: Pierluigi Lenoci <pierluigilenoci@gmail.com>
---------
Signed-off-by: Pierluigi Lenoci <pierluigilenoci@gmail.com>
* feat(config): add github to gitUrl supportedPlatforms
Declare GitHub as a supported platform for the gitUrl option so users
can configure ssh/endpoint URL resolution on github.com and GHES.
Wiring in the github platform module follows in subsequent commits.
Refs: renovatebot/renovate#43086
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(platform/github): fetch sshUrl from repoInfoQuery
Add sshUrl to the GraphQL repository query and to the GhRepo type so
the platform can resolve SSH-based git remotes. Typed as nullable
to match the gitlab pattern and to allow a missing-field error path.
Refs: renovatebot/renovate#43086
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(platform/github): add getRepoUrl helper
Introduce a getRepoUrl helper that returns the repository git URL based
on the gitUrl option:
- 'ssh' uses the sshUrl from the GraphQL repo response; throws
CONFIG_GIT_URL_UNAVAILABLE if not available
- 'default' and 'endpoint' build an https URL from the configured
endpoint with credentials embedded (current behavior)
The helper is unused in this commit; initRepo wiring follows.
Refs: renovatebot/renovate#43086
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(platform/github): support gitUrl in initRepo
Destructure gitUrl from RepoParams and replace the inline URL
construction with getRepoUrl calls. The working URL uses the fork's
ssh_url when running in fork mode, otherwise the GraphQL repo.sshUrl.
The upstream URL (used when forkCreation and a parentRepo is set)
uses repo.sshUrl, which is the parent's URL because the GraphQL
query runs before the fork swap.
GhRestRepo gains an ssh_url field so findFork/createFork responses
can carry the fork's SSH URL forward.
Refs: renovatebot/renovate#43086
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* test(platform/github): cover gitUrl branches
Add unit tests for getRepoUrl in utils.spec.ts and three integration
tests in index.spec.ts that exercise initRepo with gitUrl=ssh:
- ssh URL is forwarded to git.initRepo
- missing sshUrl with gitUrl=ssh throws CONFIG_GIT_URL_UNAVAILABLE
- fork mode uses the fork's ssh_url for url and the parent's sshUrl
for upstreamUrl
initRepoMock and forkInitRepoMock now include sshUrl in the GraphQL
response so existing tests continue to populate the field that the
new code path reads.
Refs: renovatebot/renovate#43086
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* docs: note github-specific gitUrl behavior
Document that 'default' and 'endpoint' produce the same URL on GitHub,
that 'ssh' uses the repository's sshUrl, and that fork mode propagates
SSH selection to both the working URL and the upstream URL.
Refs: renovatebot/renovate#43086
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(platform/github): pass parsed URL to getRepoUrl
Accept a pre-parsed URL in getRepoUrl instead of re-parsing the
endpoint string inside the helper. The endpoint is validated during
initPlatform so the helper no longer needs its own null check. The
caller now parses once and passes the URL to both initRepo call
sites; the helper clones it before mutating.
Also assert config.repository as non-null at the initRepo call site,
fixing the TS2345 error reported by the lint-other job.
* Update docs/usage/self-hosted-configuration.md
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* docs: skip validation on JSON files that aren't Renovate config
As part of future changes, we'll enable validation on all JSON code
snippets to run Config Validation.
Before we do that, we should opt-out JSON snippets that aren't anything
related to Renovate config.
* docs: don't validate invalid Renovate config
As it's intentionally referencing a manager that doesn't exist.
* docs: don't validate partial Renovate config
As part of future changes, we'll enable validation on all JSON code
snippets to run Config Validation.
There are several code snippets we have that are part of a Renovate JSON,
but it doesn't make sense to convert these to a fully passing config, as
it'd reduce clarity on what we're trying to explain.
* docs: convert `baseBranchPatterns` snippets to code blocks
So we can validate them.
* docs: make sure that `datasourceTemplate` is set
So this passes validation.
* docs: clarify that `force` is global config
As it may not be clear, so we can make it extra clear with a `.js` file,
and note that it's global self-hosted config.
* docs: make sure `packageRules` is an array
* docs: `matchBaseBranches` needs `baseBranchPatterns` to be set
* docs: correct typo for `prBodyColumns`
* docs: mark global config snippets as such
As part of future changes, we'll use this to detect whether it's global
self-hosted configuration.
* docs: make sure `packageRules` wraps its children
* docs: add `allowedHeaders`
* docs: ignore deprecation warnings
As part of future changes, we'll use this to note that we don't care
about the validation warnings.
* docs: make sure `customManagers` wraps its children
* docs: make sure `fleet` wraps its children
* docs: validate JSON snippets are valid Renovate config
To make sure that we're always presenting valid JSON configuration to
our users, we can validate them as part of `check-fenced-code`.
As well as configuration errors we can warn for warnings, but allow code
blocks to opt-out, for instance when there's a known deprecation
affecting the code block.
We need to make sure to set `allowedEnv` for various code snippets that
reference environment variables.
* docs(development): document fenced code block checks
* docs: wrap `configType` and `ignoreConfigWarnings` in `{ ... }`
As otherwise we see build failures i.e.
WARNING - Doc file 'modules/platform/gitlab/index.md' contains a link
'../../../self-hosted-configuration.md#autodiscoverrepoorder', but the doc
'self-hosted-configuration.md' does not contain an anchor '#autodiscoverrepoorder'.
This needs to be wrapped alongside all other options like `title`.
* fixup! docs: wrap `configType` and `ignoreConfigWarnings` in `{ ... }`
renovate[bot]