renovate

mirror of https://github.com/renovatebot/renovate.git synced 2026-10-25 15:01:49 +00:00

Files

T

History

Michael Kriese a9677c36f4 fix(util/git): use a non-empty password for token-only git credentials (#47077 )

* fix(util/git): use a non-empty password for token-only git credentials

Co-Authored-By: Claude Opus 5.5 <michael.kriese+claude-code@mend.io>

Co-Authored-By: Claude Sonnet 5.5 <michael.kriese+claude-code@mend.io>

* fix(util/git): pick token credentials from the host platform for manager host rules

Co-Authored-By: Claude Opus 5.5 <michael.kriese+claude-code@mend.io>

Co-Authored-By: Claude Sonnet 5.5 <michael.kriese+claude-code@mend.io>

---------

Co-authored-by: Claude Sonnet 5.5 <michael.kriese+claude-code@mend.io>

2026-10-15 12:06:10 +00:00

__fixtures__

fix(cargo): Support Git dependencies with a custom hostname (#38017 )

2025-12-03 18:28:49 +00:00

artifacts.spec.ts

fix(util/git): use a non-empty password for token-only git credentials (#47077 )

2026-10-15 12:06:10 +00:00

artifacts.ts

feat(datasource/crate): use host rule credentials for git index registries (#46574 )

2026-10-07 06:44:40 +00:00

extract.spec.ts

test: remove redundant hostRules.clear() calls (#46584 )

2026-09-30 11:22:18 +00:00

extract.ts

refactor(manager): type manager data of the remaining managers (#46639 )

2026-10-07 06:31:47 +00:00

index.ts

docs(manager): indicate where lockFileMaintenance runs external commands (#44914 )

2026-07-28 11:44:22 +00:00

locked-version.spec.ts

test: use expect().resolves instead of awaiting inside expect (#45672 )

2026-09-04 10:40:46 +00:00

locked-version.ts

refactor: Rewrite imports with .ts extensions (#40700 )

2026-01-26 22:48:17 +00:00

range.spec.ts

refactor: Rewrite imports with .ts extensions (#40700 )

2026-01-26 22:48:17 +00:00

range.ts

refactor: Rewrite imports with .ts extensions (#40700 )

2026-01-26 22:48:17 +00:00

readme.md

feat(datasource/crate): use host rule credentials for git index registries (#46574 )

2026-10-07 06:44:40 +00:00

schema.ts

refactor(manager): type manager data of the remaining managers (#46639 )

2026-10-07 06:31:47 +00:00

types.ts

refactor: Rewrite imports with .ts extensions (#40700 )

2026-01-26 22:48:17 +00:00

update-locked.spec.ts

refactor(lint): Organize imports with biome (#40966 )

2026-02-06 13:40:01 +00:00

update-locked.ts

refactor: Rewrite imports with .ts extensions (#40700 )

2026-01-26 22:48:17 +00:00

update.spec.ts

refactor: Rewrite imports with .ts extensions (#40700 )

2026-01-26 22:48:17 +00:00

update.ts

refactor: Rewrite imports with .ts extensions (#40700 )

2026-01-26 22:48:17 +00:00

utils.ts

feat(manager/cargo): support for cargo repository source replacement (#23956 )

2023-08-25 09:41:15 +00:00

readme.md

Extracts dependencies from Cargo.toml files, and also updates Cargo.lock files too if found.

When using the default rangeStrategy=auto:

If a "less than" instruction is found (e.g. <2) then rangeStrategy=widen will be selected,
Otherwise, rangeStrategy=update-lockfile will be selected.

The update-lockfile default means that most upgrades will update Cargo.lock files without the need to change the value in Cargo.toml.

Private Modules Authentication

Before running the cargo commands to update the cargo.lock, Renovate exports git insteadOf directives in environment variables.

Renovate uses this logic before it updates any "artifacts":

The token from the hostRules entry matching hostType=github and matchHost=api.github.com is added as the default authentication for github.com. For those running against github.com, this token will be the default platform token.

Next, all hostRules with both a token or username/password and matchHost will be fetched, except for any github.com one from above.

Rules from this list are converted to environment variable directives if they match any of these characteristics:

No hostType is defined, or
hostType is cargo or crate, or
hostType is a platform (github, gitlab, azure, etc.)

Git index registries

When Renovate clones a git index registry over http(s) to look up versions, it exports the same insteadOf directives as for artifact updates, with hostType=crate in place of hostType=cargo. Because artifact updates accept hostType=crate rules too, a single crate rule covers both the lookup and the Cargo.lock update. Git uses the credentials of the directive whose URL matches the index URL. Cloning a git index registry other than the crates.io index (https://index.crates.io/) requires allowCustomCrateGitRegistries. Sparse registries (sparse+https://) are fetched over HTTP, and use hostRules like other datasources.