renovate

mirror of https://github.com/renovatebot/renovate.git synced 2026-11-07 12:40:49 +00:00

Files

T

Zack Kanter 371412d4c1 fix(datasource/npm): require public Cache-Control to cache responses (#42822 )

* fix(datasource/npm): require public Cache-Control to cache responses

The npm datasource opts out of the authorization-header privacy check
(checkAuthorizationHeader: false) and relies on Cache-Control alone to
classify responses. Previously, when a registry omitted Cache-Control
entirely, cacheAllowed fell through to "cache it" — so private packages
served by GitHub Packages (which sends no Cache-Control header) were
cached in the shared package cache.

Flip the semantic of checkCacheControlHeader: true to require an
affirmative Cache-Control: public signal. Missing or non-public headers
now disallow caching. registry.npmjs.org is unaffected because it
already sends Cache-Control: public, max-age=...

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(cache): avoid renewing disallowed package cache on 304

* Revert "fix(cache): avoid renewing disallowed package cache on 304"

This reverts commit 64801bb036269352465aac580b9861c5b7716cc1.

2026-07-07 19:27:47 +00:00

config

refactor(oxlint): enable vitest/require-to-throw-message (#44421 )

2026-07-07 17:47:04 +00:00

constants

build: lazy load and initialize logger (#41425 )

2026-03-10 16:57:29 +00:00

data

refactor(oxlint): enable vitest/no-conditional-expect (#44416 )

2026-07-07 16:52:54 +00:00

instrumentation

refactor(logger): use expose to load bunyan (#42714 )