Jamie Tanna
29a7b9c5f5
To harden Renovate from being able to access internal hosts, we can add a level of enforcement on all outgoing requests. We can split this into two types of traffic: - where the response becomes configuration (i.e. `extends`) - where the response does not become configuration (i.e. `customDatasources`) To harden this, we enforce on every outbound HTTP request: - check the resolved URL before anything, including cache lookups, can proceed - catching IP-literal hosts in every spelling the WHATWG URL parser normalizes - blocking known Cloud metadata IPs, too - a `dnsLookup` wrapper validates every address a hostname resolves to, on every new connection, which also defeats DNS rebinding - a `beforeRedirect` hook re-runs the URL check on each redirect target, with the new host getting its own grant lookup rather than inheriting the original host's verdict We default this enforcement to `warn`, to not break existing deployments and instead give them visibility into required configuration before a future major version (major+1) enables `block` by default. We'll also remove allow in a future major version (major+2), to give time for admins to migrate over. When a request is blocked, this degrades like an unreachable registry, so a Renovate run isn't aborted by a blocked request. As part of this, we can also provide a worked example of the different cases that do/do not need allowing via `hostRules`. Requests through an admin-configured proxy resolve DNS at the proxy, so `dnsLookup` never runs for them, so we can resolve the hostname locally and validate every address before the request instead. This doesn't catch everything, especially as the proxy may resolve the name to a different result, and if we can't resolve the name - possible in locked-down corporate environments - we fail open. Child processes aren't currently able to route traffic through Renovate's HTTP layer, so are unrestricted. Co-authored-by: Claude Fable 5 <jamie.tanna+claude-code@mend.io> Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io> Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
With Repology you can look up package versions from many package repositories. You can combine Repology with regex managers to update dependencies which are not supported by Renovate.
The packageName field should be constructed using the repository identifier and the actual package name separated by a slash.
For example: alpine_3_12/gcc would look for a binary (or source package) called gcc within the alpine_3_12 repository.
A list of all supported repositories can be found on the Repology homepage.
To find the correct identifier, select the repository you want and copy the identifier in the URL: https://repology.org/repository/<identifier>.
For example, the Alpine Linux 3.12 repository has this URL: https://repology.org/repository/alpine_3_12 and has this repository identifier: alpine_3_12.
Usage Example
Say you're using system packages in a Dockerfile and want to update them with Repology. With the Repology datasource you can "pin" each dependency, and get automatic updates.
First you would set a custom manager in your renovate.json file for Dockerfile:
{
"customManagers": [
{
"customType": "regex",
"managerFilePatterns": ["/^Dockerfile$/"],
"matchStrings": [
"#\\s*renovate:\\s*datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?\\sENV .*?_VERSION=\"(?<currentValue>.*)\"\\s"
],
"versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver{{/if}}"
}
]
}
Then you would put comments in your Dockerfile, to tell Renovate where to find the updates:
FROM alpine:3.12.0@sha256:a15790640a6690aa1730c38cf0a440e2aa44aaca9b0e8931a9f2b0d7cc90fd65
# renovate: datasource=repology depName=alpine_3_12/gcc versioning=loose
ENV GCC_VERSION="9.3.0-r2"
# renovate: datasource=repology depName=alpine_3_12/musl-dev versioning=loose
ENV MUSL_DEV_VERSION="1.1.24-r8"
RUN apk add --no-cache \
gcc="${GCC_VERSION}" \
musl-dev="${MUSL_DEV_VERSION}"
When the operating system package for gcc of Alpine Linux 3.12 is updated, Renovate updates the environment variable.
!!! tip
We recommend you try loose or deb versioning for distribution packages first.
This is because the version number usually doesn't match Renovate's default semver-coerced specification.