Victor Sollerhed
7a03427c7e
* feat(manager/apm): scope per-package tags to their own package APM packages are often published from monorepos that tag each package separately (`foo--v1.2.0`, `bar--v3.0.0`). A dependency pinned to such a tag was looked up against every tag in the repository under the default versioning, which reads any prefixed tag as unstable, because `isStable` only accepts values starting with `v` or a digit. Two wrong outcomes follow from that, depending on what else the repository is tagged with: - Only per-package tags: the unstable-current filter keeps only releases with the same major.minor.patch, so nothing is proposed and the dependency looks up to date. - Per-package tags plus repository-wide ones: every stable `vX.Y.Z` passes that filter, so `foo--v1.0.0` is proposed an update to the unrelated `v2.0.0`. For a pinned tag of the form `<name>--v<version>`, `<name>-v<version>` or `<name>_v<version>`, the forms `apm outdated` resolves, the extractor now sets a `versionCompatibility` whose `compatibility` group is the package prefix. Only tags with the same prefix are candidates, and the new value keeps it. This covers SHA pins too, through the tag in their trailing comment. The compatibility is only set when the pinned tag matches, since `versionCompatibility` also filters the datasource's releases and would drop every release of a dependency on repository-wide tags. Those keep their existing behaviour. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RZk1J7hJZRCXMBEwByp5fu * docs(manager/apm): keep the lockfile paragraph out of the monorepo section The new heading sat above the existing lockfile paragraph, which then read as part of "Per-package tags in monorepos". Move the section to the end of the readme. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RZk1J7hJZRCXMBEwByp5fu * refactor(manager/apm): apply review suggestions Shorter comments, no readme section, and a looser per-package tag pattern whose version part is anything starting with a digit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RZk1J7hJZRCXMBEwByp5fu * refactor(manager/apm): use a regex literal for per-package tags Brings back the full x.y.z version part, so a ref like foo-v1 is compared as-is again, and passes the pattern on through its source. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RZk1J7hJZRCXMBEwByp5fu * refactor(manager/apm): drop the redundant -- alternative The lazy .+?[-_] already captures foo-- for foo--v1.0.0. The SHA pin test now also checks that the pin gets a versionCompatibility, so it fails if the SHA branch stops scoping the tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RZk1J7hJZRCXMBEwByp5fu --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
The apm manager keeps APM (Agent Package Manager) dependencies up to date.
Renovate reads the apm.yml manifest and updates the git-pinned entries under dependencies.apm and devDependencies.apm.
Each entry uses the form [host/]owner/repo[/subpath]#<ref>, for example:
name: your-project
version: 1.0.0
dependencies:
apm:
- microsoft/apm-sample-package#v1.0.0
- gitlab.com/team/project#v2.3.0
devDependencies:
apm:
- owner/repo#v1.2.3
Only entries that pin an exact #<ref> are updated.
Entries without a #<ref> are skipped because there is no version to bump.
APM also documents pinning to a commit SHA with the release tag kept as a trailing comment (owner/repo#<sha> # v2.0.0).
With pinDigests enabled (part of the config:best-practices preset) Renovate keeps both the SHA and the tag comment current, the same way it does for github-actions (uses: owner/action@<sha> # v4).
A SHA pin without a tag comment is skipped, as there is no version to track.
When an apm.lock.yaml lockfile is present, Renovate refreshes it by running apm install after updating the manifest.
This requires the apm CLI to be available (for example, with binarySource=global).