Jiri Daněk
def09c2661
* fix(github): use base_tree in pushFiles to avoid org ruleset file-path restrictions (#42554) pushFiles sent the entire repo tree to POST /git/trees without base_tree. GitHub validates all file paths against org rulesets, rejecting the tree when it contains protected files (e.g. semgrep.yaml) — even if Renovate only changed unrelated paths. Use base_tree (parent commit's tree) with only the changed files from git diff-tree, so unchanged protected files are inherited without validation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * test(git): add coverage for getCommitTreeSha and diffCommitTree Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(test): assert specific files instead of hardcoding diff count The test fixture creates 2 known files between develop and defaultBranch (master_file, file_to_delete), but CI produces 3 changed files — likely a .gitattributes from the CI environment. Assert on the known files rather than the total count. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(git): handle renames, copies, and submodules in diffCommitTree - Regex now matches multi-char status codes (R100, C100) and tab-separated source/target paths for renames and copies. - Renames emit a deletion for the source path + addition for target. - Derive tree item type from mode: 160000→commit, 040000→tree, otherwise blob. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor(git): address review comments in diffCommitTree Keep git utility types centralized and make diff status handling easier to follow. Made-with: Cursor * test(git): cover rename handling in diffCommitTree Verify that renamed files are emitted as a deletion for the old path and an addition for the new path, matching the tree delta expected by GitHub. Made-with: Cursor * fix(git): validate parsed tree SHA Fail fast when commit output cannot be parsed into a tree SHA so pushFiles does not propagate an invalid base_tree, and cover the failure path in tests. Made-with: Cursor * fix(git): enable rename detection and cover remaining diffCommitTree branches Add -M to diff-tree so Git emits R status for renames, exercising the existing case 'R' handler. Add focused tests for rename parsing, submodule mode (160000), and tree mode (040000). Made-with: Cursor * fix(git): clarify copy vs rename comment in diffCommitTree R uses both tab-separated paths (delete old + add new), while C falls through to default where only the target path matters. Made-with: Cursor * refactor(git): remove dead listCommitTree and TreeItem Nothing imports listCommitTree after the switch to diffCommitTree with base_tree. Remove the function, its regex, its test, and the TreeItem interface. Made-with: Cursor * refactor(git): tighten DiffTreeItem.type to GitObjectType union Define GitObjectType = 'blob' | 'tree' | 'commit' and use it in DiffTreeItem and treeTypeFromMode instead of plain string. Made-with: Cursor * fix(git): remove unreachable nullish coalescing in getCommitTreeSha split()[0] on a non-empty string is always defined, so the ?? '' fallback was unreachable and caused an uncovered branch in Codecov. Made-with: Cursor * fix(git): add v8 ignore for partial branch on throw template literal v8 reports template literal interpolations inside throw as partial branch coverage even when the line is tested. Use the established v8 ignore pattern to suppress the false positive. Made-with: Cursor * fix(github): guard pushFiles against empty diff from diffCommitTree GitHub's POST /git/trees rejects an empty tree array with 422 "Invalid tree info". While prepareCommit already prevents no-op commits from reaching pushFiles, add a defensive early return so the failure mode is a clear log message instead of a swallowed 422. Made-with: Cursor * docs(github): document hybrid git/REST commit strategy in pushFiles Restore architectural knowledge from PRs #13824 and #14271 that was lost when the old "for reasons unknown" comments were replaced. The push-then-recreate pattern exists because custom refs avoid CI triggers, REST-created commits get GitHub signing, and GraphQL lacks force-push and file mode support. Made-with: Cursor * fix(git): wrap bare regex literals in regEx() in tests Use the project's regEx() helper instead of bare /pattern/ in toMatch and stringMatching calls, consistent with repo conventions. Made-with: Cursor * fix(git): revert regEx() in expect.stringMatching (only accepts bare RegExp) expect.stringMatching() is a Vitest/Jest API that requires a native RegExp, not the wrapped object from Renovate's regEx() helper. Made-with: Cursor * fix(git): drop line count from v8 ignore next Vitest uses ast-v8-to-istanbul which is AST-aware: it ignores the entire next AST node (here the whole throw statement), making the line count unnecessary. Made-with: Cursor * refactor(git): replace magic mode strings with GitTreeMode enum Introduce a documented GitTreeMode enum in types.ts and use it in treeTypeFromMode, replacing raw '160000'/'040000' literals with named members linked to the git data model documentation. Made-with: Cursor * fix(git): use const object instead of enum for GitTreeMode Node's TypeScript strip-only mode does not support enum syntax. Use `as const` object pattern consistent with the rest of the codebase. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
What is the Mend Renovate CLI?
Renovate is an automated dependency update tool. It helps to update dependencies in your code without needing to do it manually. When Renovate runs on your repo, it looks for references to dependencies (both public and private) and, if there are newer versions available, Renovate can create pull requests to update your versions automatically.
Features
- Delivers update PRs directly to your repo
- Relevant package files are discovered automatically
- Pull Requests automatically generated in your repo
- Provides useful information to help you decide which updates to accept (age, adoption, pass rates, merge confidence)
- Highly configurable and flexible to fit in with your needs and repository standards
- Largest collection of languages and platforms (listed below)
- Connects with private repositories and package registries
Languages
Renovate can provide updates for most popular languages, platforms, and registries including: npm, Java, Python, .NET, Scala, Ruby, Go, Docker and more. Supports over 90 different package managers.
Platforms
Renovate updates code repositories on the following platforms: GitHub, GitLab, Bitbucket, Azure DevOps, AWS Code Commit (experimental), Gitea, Forgejo, Gerrit (experimental), SCM-Manager (experimental)
Ways to run Renovate
The most effective way to run Renovate is to use an automated job scheduling system that regularly runs Renovate on all enabled repositories and responds with priority to user activity. Mend offers cloud-hosted and self-hosted solutions. See the options below.
Mend Renovate Community (Cloud-Hosted)
Supports: GitHub.com, Bitbucket Cloud
Hosted by Mend.io. No setup is needed. Community plan available (Free)
- GitHub Cloud: Install the Renovate Cloud-Hosted App on your GitHub org, then select the repos to enable
- Bitbucket Cloud: Add the Mend App to your Workspace, then add the Mend Renovate user to the projects you want to enable
Mend Renovate Community (Self-hosted)
Supports: GitHub, GitLab, Bitbucket Data Center
Install and run your own Renovate server. Access internal packages.
- Mend Renovate Community Self-Hosted (Free)
- Mend Renovate Enterprise (Paid plan)
Other ways to run Renovate
If you can’t use a pre-built job scheduling system, or want to build your own, the following options are available:
Run Renovate on your Pipeline
Mend provides a GitHub Action or a GitLab Runner to help you run Renovate as a CI pipeline job.
- GitHub Action: renovatebot/github-action.
- GitLab Runner: Renovate Runner project
- AzureDevOps action: Renovate Me extension
Note: This extension is created and maintained personally by a Renovate developer/user. Support requests for the extension will not be answered directly in the main Renovate repository. - Custom pipeline: You can create a custom pipeline with a yml definition that triggers npx renovate. More details on how to configure the pipeline.
Run Renovate CLI
There are several ways to run the Renovate CLI directly. See docs: Running Renovate for all options.
Supports: all platforms
For additional community-maintained options, see the Community Tools page.
Docs
More about Renovate
- Renovate basics
- Supported platforms and languages
- Advanced Renovate usage
Renovate Docs
Comparisons
Get involved
Issues and Discussions
Please open a Discussion to get help, suggest a new feature, or to report a bug. We only want maintainers to open Issues.
Contributing
To contribute to Renovate, or run a local copy, please read the contributing guidelines.
- Guidelines for Contributing
- Items that need contribution: good first issues
Contact and Social Media
The Renovate project is proudly supported and actively maintained by Mend.io.
- Contact Mend.io for commercial support questions.
Follow us on:
- Twitter: x.com/mend_io
- LinkedIn: linkedin.com/company/mend-io
Security / Disclosure
If you find any bug with Renovate that may be a security problem, please report it through the GitHub Security Advisories process. This way we can evaluate the bug and hopefully fix it before it gets abused. Please give us enough time to investigate the bug before you report it anywhere else.
If you would like to discuss a potential finding before raising the Advisory, then e-mail us at: renovate-disclosure@mend.io.