mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-26 15:31:53 +00:00
a1971afa78
* ci(linter): add renovate/require-regex-util rule Adds a custom oxlint rule that flags raw RegExp usage in lib/ production code: any `new RegExp(...)` call and any regex literal that is not the direct first argument of `regEx(...)`. The regEx() helper from lib/util/regex.ts uses the RE2 engine for ReDoS-safe matching and caches compiled patterns. lib/util/regex.ts itself is exempt. The rule is disabled for **/*.spec.ts, test/**, and tools/** via config overrides, because vitest APIs such as expect.stringMatching need bare RegExp instances (a past commit reverted regEx() there). Severity is set to "warn" instead of "error": the repo currently has 197 pre-existing violations (above the agreed mechanical-fix threshold of 80), and a number of them are deliberately RE2-incompatible patterns (lookahead/lookbehind/named backreferences, see TODO #12872/#12875 markers in e.g. lib/modules/versioning/rez/ pattern.ts and lib/modules/manager/dockerfile/extract.ts) that need per-site judgment before they can be wrapped in regEx() or suppressed with a justified disable comment. No violation fixes are included in this commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(linter): enforce renovate/require-regex-util at error Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: use regEx() for regex literals and RegExp construction in lib Burn down all renovate/require-regex-util violations (197): - wrap RE2-compatible regex literals and RegExp constructions in regEx() - rewrite lookaround patterns where behavior is provably preserved: goproxy separator split, sbt-package link extraction, leiningen comment stripping and keyword search, npm GitHub owner validation (unit-count bound replaced by an explicit length check) - keep native RegExp with disable comments where RE2 cannot be used: moo / good-enough-parser lexer patterns (moo rejects RE2 instances), MigrationsService propertyName (matched via isRegExp, which RE2 instances fail), rez named backreferences and lookaheads, GitHub markdown link negative lookbehind, emoji astral-plane matching - drop stale TODO #12875 comments for patterns current re2 handles Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: reduce require-regex-util disable comments Rewrite the github massage-markdown-links URL regex to capture an optional `api.` prefix in a named group (skipped in code) instead of relying on a negative lookbehind, so both the base and global variants can use regEx()/RE2 and their two disable comments are removed. Add spec cases for api-prefixed URLs that match the URL shape. Consolidate the four related line disables in rez/pattern.ts (bound and range patterns emulating Python conditional patterns via named backreferences and lookaheads, which RE2 cannot express) into a single block disable/enable pair, matching the treatment of the lexer files. Disable comment count drops from 13 to 8. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(datasource/sbt-package): use named capture group in link regex Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(manager/cake): restore original multiLineComment regex spelling The [^] -> [\\s\\S] rewrite was only needed for an RE2 wrap that was later reverted; keep the diff minimal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(datasource/go): skip empty GOPROXY segments The switch from a lookahead split to a capture-group split (needed because RE2 has no lookahead support) changed how empty GOPROXY segments parse: `a|,b` yielded `{ url: ',', fallback: '|' }` before and `{ url: '', fallback: ',' }` after. The comma fallback only continues on 404/410, so a failing proxy ahead of an empty segment silently stopped the lookup instead of falling through to the remaining proxies. Empty segments carry no url to query, so drop them. * refactor(datasource/go): use isTruthy for empty segment filter * fix(datasource/go): filter empty segments before mapping Filtering after the map broke the contextual typing from the GoproxyItem[] annotation, widening fallback to string. * refactor(platform/github): use regEx() for merge queue query stripping --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
257 lines
7.2 KiB
TypeScript
257 lines
7.2 KiB
TypeScript
import { isString } from '@sindresorhus/is';
|
|
import semver from 'semver';
|
|
import semverUtils from 'semver-utils';
|
|
import { logger } from '../../../logger/index.ts';
|
|
import { regEx } from '../../../util/regex.ts';
|
|
import { isSemVerXRange, normalizeLegacyXRanges } from '../semver/common.ts';
|
|
import type { NewValueConfig } from '../types.ts';
|
|
|
|
const {
|
|
inc: increment,
|
|
valid: isVersion,
|
|
major,
|
|
minor,
|
|
patch,
|
|
prerelease,
|
|
satisfies,
|
|
} = semver;
|
|
|
|
function replaceCaretValue(oldValue: string, newValue: string): string {
|
|
const toVersionMajor = major(newValue);
|
|
const toVersionMinor = minor(newValue);
|
|
const toVersionPatch = patch(newValue);
|
|
|
|
const currentMajor = major(oldValue);
|
|
const currentMinor = minor(oldValue);
|
|
const currentPatch = patch(oldValue);
|
|
|
|
const oldTuple = [currentMajor, currentMinor, currentPatch];
|
|
const newTuple = [toVersionMajor, toVersionMinor, toVersionPatch];
|
|
const resultTuple = [];
|
|
|
|
let leadingZero = true;
|
|
let needReplace = false;
|
|
for (let idx = 0; idx < 3; idx += 1) {
|
|
const oldVal = oldTuple[idx];
|
|
const newVal = newTuple[idx];
|
|
|
|
let leadingDigit = false;
|
|
if ((oldVal !== 0 || newVal !== 0) && leadingZero) {
|
|
leadingZero = false;
|
|
leadingDigit = true;
|
|
}
|
|
|
|
if (leadingDigit && newVal > oldVal) {
|
|
needReplace = true;
|
|
}
|
|
|
|
if (!needReplace && newVal < oldVal) {
|
|
return newValue;
|
|
}
|
|
|
|
resultTuple.push(leadingDigit ? newVal : 0);
|
|
}
|
|
|
|
return needReplace ? resultTuple.join('.') : oldValue;
|
|
}
|
|
|
|
function stripV(value: string): string {
|
|
return value.replace(regEx(/^v/), '');
|
|
}
|
|
|
|
function satisfiesRange(version: string, range: string): boolean {
|
|
return satisfies(version, normalizeLegacyXRanges(range));
|
|
}
|
|
|
|
// TODO: #22198
|
|
export function getNewValue({
|
|
currentValue,
|
|
rangeStrategy,
|
|
currentVersion,
|
|
newVersion,
|
|
}: NewValueConfig): string | null {
|
|
if (rangeStrategy !== 'update-lockfile' && isSemVerXRange(currentValue)) {
|
|
return null;
|
|
}
|
|
if (isVersion(currentValue)) {
|
|
return newVersion;
|
|
}
|
|
if (rangeStrategy === 'update-lockfile') {
|
|
if (satisfiesRange(newVersion, currentValue)) {
|
|
return currentValue;
|
|
}
|
|
return getNewValue({
|
|
currentValue,
|
|
rangeStrategy: 'replace',
|
|
currentVersion,
|
|
newVersion,
|
|
});
|
|
}
|
|
const parsedRange = semverUtils.parseRange(currentValue);
|
|
const element = parsedRange.at(-1)!;
|
|
if (rangeStrategy === 'widen') {
|
|
if (satisfiesRange(newVersion, currentValue)) {
|
|
return currentValue;
|
|
}
|
|
const newValue = getNewValue({
|
|
currentValue,
|
|
rangeStrategy: 'replace',
|
|
currentVersion,
|
|
newVersion,
|
|
});
|
|
if (element.operator?.startsWith('<')) {
|
|
// TODO fix this
|
|
const splitCurrent = currentValue.split(element.operator);
|
|
splitCurrent.pop();
|
|
// TODO: types (#22198)
|
|
return `${splitCurrent.join(element.operator)}${newValue!}`;
|
|
}
|
|
if (parsedRange.length > 1) {
|
|
const previousElement = parsedRange.at(-2)!;
|
|
if (previousElement.operator === '-') {
|
|
const splitCurrent = currentValue.split('-');
|
|
splitCurrent.pop();
|
|
// TODO: types (#22198)
|
|
return `${splitCurrent.join('-')}- ${newValue!}`;
|
|
}
|
|
if (element.operator?.startsWith('>')) {
|
|
logger.warn(`Complex ranges ending in greater than are not supported`);
|
|
return null;
|
|
}
|
|
}
|
|
// TODO: types (#22198)
|
|
return `${currentValue} || ${newValue!}`;
|
|
}
|
|
const toVersionMajor = major(newVersion);
|
|
const toVersionMinor = minor(newVersion);
|
|
const toVersionPatch = patch(newVersion);
|
|
const toNewVersion = prerelease(newVersion);
|
|
const suffix = toNewVersion ? `-${toNewVersion[0]}` : '';
|
|
// Simple range
|
|
if (rangeStrategy === 'bump') {
|
|
if (parsedRange.length === 1) {
|
|
if (!element.operator) {
|
|
return stripV(newVersion);
|
|
}
|
|
if (element.operator === '^') {
|
|
return `^${stripV(newVersion)}`;
|
|
}
|
|
if (element.operator === '~') {
|
|
return `~${stripV(newVersion)}`;
|
|
}
|
|
if (element.operator === '=') {
|
|
return `=${stripV(newVersion)}`;
|
|
}
|
|
if (element.operator === '>=') {
|
|
return currentValue.includes('>= ')
|
|
? `>= ${stripV(newVersion)}`
|
|
: `>=${stripV(newVersion)}`;
|
|
}
|
|
if (element.operator.startsWith('<')) {
|
|
return currentValue;
|
|
}
|
|
} else {
|
|
return semverUtils
|
|
.parseRange(currentValue)
|
|
.map((x) => x.semver)
|
|
.filter(isString)
|
|
.map((subRange) => {
|
|
const bumpedSubRange = getNewValue({
|
|
currentValue: subRange,
|
|
rangeStrategy: 'bump',
|
|
currentVersion,
|
|
newVersion,
|
|
});
|
|
if (bumpedSubRange && satisfiesRange(newVersion, bumpedSubRange)) {
|
|
return bumpedSubRange;
|
|
}
|
|
|
|
return getNewValue({
|
|
currentValue: subRange,
|
|
rangeStrategy: 'replace',
|
|
currentVersion,
|
|
newVersion,
|
|
});
|
|
})
|
|
.filter((x) => x !== null && x !== '')
|
|
.join(' ');
|
|
}
|
|
logger.debug(
|
|
`Unsupported range type for rangeStrategy=bump: ${currentValue}`,
|
|
);
|
|
return null;
|
|
}
|
|
if (element.operator === '~>') {
|
|
return `~> ${toVersionMajor}.${toVersionMinor}.0`;
|
|
}
|
|
if (element.operator === '^') {
|
|
if (suffix.length || !currentVersion) {
|
|
return `^${toVersionMajor}.${toVersionMinor}.${toVersionPatch}${suffix}`;
|
|
}
|
|
return `^${replaceCaretValue(currentVersion, newVersion)}`;
|
|
}
|
|
if (element.operator === '=') {
|
|
return `=${stripV(newVersion)}`;
|
|
}
|
|
if (element.operator === '~') {
|
|
if (suffix.length) {
|
|
return `~${toVersionMajor}.${toVersionMinor}.${toVersionPatch}${suffix}`;
|
|
}
|
|
return `~${toVersionMajor}.${toVersionMinor}.0`;
|
|
}
|
|
if (element.operator === '<=') {
|
|
let res;
|
|
if (!!element.patch || suffix.length) {
|
|
res = `<=${stripV(newVersion)}`;
|
|
} else if (element.minor) {
|
|
res = `<=${toVersionMajor}.${toVersionMinor}`;
|
|
} else {
|
|
res = `<=${toVersionMajor}`;
|
|
}
|
|
if (currentValue.includes('<= ')) {
|
|
res = res.replace('<=', '<= ');
|
|
}
|
|
return res;
|
|
}
|
|
if (element.operator === '<') {
|
|
let res;
|
|
if (currentValue.endsWith('.0.0')) {
|
|
const newMajor = toVersionMajor + 1;
|
|
res = `<${newMajor}.0.0`;
|
|
} else if (currentValue.endsWith('.0')) {
|
|
const newMinor = toVersionMinor + 1;
|
|
res = `<${toVersionMajor}.${newMinor}${element.patch ? '.0' : ''}`;
|
|
} else if (element.patch) {
|
|
// TODO: types (#22198)
|
|
res = `<${increment(newVersion, 'patch')!}`;
|
|
} else if (element.minor) {
|
|
res = `<${toVersionMajor}.${toVersionMinor + 1}`;
|
|
} else {
|
|
res = `<${toVersionMajor + 1}`;
|
|
}
|
|
if (currentValue.includes('< ')) {
|
|
res = res.replace(regEx(/</g), '< ');
|
|
}
|
|
return res;
|
|
}
|
|
if (!element.operator) {
|
|
if (element.minor) {
|
|
if (element.minor === 'x') {
|
|
return `${toVersionMajor}.x`;
|
|
}
|
|
if (element.minor === '*') {
|
|
return `${toVersionMajor}.*`;
|
|
}
|
|
if (element.patch === 'x') {
|
|
return `${toVersionMajor}.${toVersionMinor}.x`;
|
|
}
|
|
if (element.patch === '*') {
|
|
return `${toVersionMajor}.${toVersionMinor}.*`;
|
|
}
|
|
return `${toVersionMajor}.${toVersionMinor}`;
|
|
}
|
|
return `${toVersionMajor}`;
|
|
}
|
|
return newVersion;
|
|
}
|