mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-31 17:51:49 +00:00
Sebastian Poxhofer
6e03e8326f
* feat(lint): add renovate/prefer-is-helpers and renovate/prefer-is-object rules Flag ad-hoc type checks that have @sindresorhus/is equivalents: - .filter(Boolean) -> .filter(isTruthy) - typeof x === 'string' -> isString(x) - x === null || x === undefined -> isNullOrUndefined(x) (and negation) The typeof x === 'object' shape lives in a separate suggestion-only rule (renovate/prefer-is-object, kept at warn) because isObject()/isPlainObject() are not drop-in equivalents: null, arrays and functions behave differently. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: fix renovate/prefer-is-helpers violations Replace ad-hoc type checks with @sindresorhus/is helpers across lib/: - 13x .filter(Boolean) -> .filter(isTruthy) - 36x typeof x ==/!== 'string' -> isString(x) / !isString(x) - 6x x === null || x === undefined -> isNullOrUndefined(x) (and negation) Promote renovate/prefer-is-helpers to error now that the codebase is clean. renovate/prefer-is-object stays at warn: its 15 remaining sites guard parsed YAML/JSON or unknown values where isObject()/isPlainObject() are not provably equivalent (null/array/function semantics). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: enforce renovate/prefer-is-object at error level Resolve the 15 remaining warnings and raise the rule from warn to error: - Migrate 10 sites to isObject() where the guarded value provably cannot be a function (parsed YAML/JSON, typed exec command arguments, or test-controlled fixtures): helm-values, woodpecker, bun, pre-commit managers, exec utils, file package cache, and the github http spec. In the bun manager this also fixes a latent crash where a null `workspaces` value would throw on the `in` operator. - Keep 5 sites as reasoned oxlint-disable comments where excluding functions is load-bearing: the byte-exact fingerprint canonicalizer (2), the circularity walker, the zod result guard, and the generic hasKey helper. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(lint): add renovate/inline-single-use-fixtures rule In spec files, a module-scope const fixture that is referenced from exactly one it()/test() block should be inlined into that test so the test is self-contained. The rule is a warn-level nudge (naming for clarity is a valid exception) with no autofix (moving code is risky). Uses oxlint jsPlugins scope analysis (getDeclaredVariables) for exact, shadowing-safe reference counting and bails out conservatively: only top-level non-exported single-declarator consts with multiline, non-function initializers whose every reference sits inside the callback function of one and the same test call are flagged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: inline single-use spec fixtures into their tests Fix 26 renovate/inline-single-use-fixtures warnings in specs where the move is mechanical and value-preserving: codeBlock fixtures were re-indented uniformly (codeBlock strips the common indentation, so the produced string is unchanged) and Fixtures.get() calls resolve relative to the spec file, so relocating them inside the test body has no effect. The remaining 59 warnings are left for per-site judgment, as the rule is a warn-level nudge by design. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: inline remaining relocation-safe single-use spec fixtures Move the 24 remaining single-use module-scope fixtures whose initializer is a codeBlock tagged template or a Fixtures accessor call into the one it() block that uses them. Both shapes are value-preserving to relocate: codeBlock strips the common leading indentation, so the uniformly re-indented templates produce identical strings, and Fixtures.get() resolves relative to the spec file, not the call site's position in it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(lint): enforce inline-single-use-fixtures as error Narrow the rule to the initializer shapes where moving the declaration into the test body is provably value-preserving and unambiguously an improvement: codeBlock/stripIndent tagged templates (indentation- normalizing, so re-indenting is safe) and Fixtures accessor calls (resolve relative to the spec file). Plain object/array literals, untagged template literals (whose leading-newline formatting would need ugly re-indentation) and arbitrary call expressions remain per-site judgment calls and are no longer flagged. With the rule reduced to true defects and all remaining violations inlined, bump it from warn to error in the spec override block. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: inline contents of fixtures relocated into single-use tests The previous commits moved single-use module-scope Fixtures.get() consts into their one it() block, which only relocated the file indirection. Replace those relocated Fixtures.get() calls with the fixture file's actual content — codeBlock tagged templates for text fixtures — so the tests are self-contained, and delete the fixture files that no longer have any references. Relocated fixtures too large to inline comfortably (terraform-provider releases, sbt private-variable file, nuget v2 pkg list, bundled package-lock) keep their Fixtures.get() calls. Value preservation was verified by unchanged vitest results for every touched spec; all consumers parse the content, so codeBlock's trailing newline normalization is behavior-neutral. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: inline remaining large single-use fixtures Inline the four Fixtures.get() sites that were previously exempted for size, so every single-use fixture is now inlined regardless of size: - nuget v2_withoutProjectUrl.xml -> codeBlock (served via http mock) - terraform-provider releaseBackendIndexGoogleBeta.json -> plain object literal passed to the nock reply - npm locked-dependency bundled.package-lock.json -> codeBlock JSON string (consumed as raw lockFileContent) - sbt private-variable-dependency-file.scala -> codeBlock All consumers parse the content, so codeBlock's trailing-newline normalization is behavior-neutral; vitest results are unchanged for every touched spec, including the two pre-existing nuget failures. The nuget, terraform-provider and sbt fixture files have no remaining references and are deleted. bundled.package-lock.json is kept because package-lock/get-locked.spec.ts still reads it via Fixtures.getJson(). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: keep large bundled package-lock fixture in a file The bundled package-lock.json inlined into the "fails remediation if bundled" test is ~150 KB (~4,400 lines); inlining it as a codeBlock hurts readability more than it helps. Read it via Fixtures.get inside the test block instead — the inline-single-use-fixtures rule permits a Fixtures.get() call in test scope, and the fixture file is still present. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
What is the Mend Renovate CLI?
Renovate is an automated dependency update tool. It helps to update dependencies in your code without needing to do it manually. When Renovate runs on your repo, it looks for references to dependencies (both public and private) and, if there are newer versions available, Renovate can create pull requests to update your versions automatically.
Features
- Delivers update PRs directly to your repo
- Relevant package files are discovered automatically
- Pull Requests automatically generated in your repo
- Provides useful information to help you decide which updates to accept (age, adoption, pass rates, merge confidence)
- Highly configurable and flexible to fit in with your needs and repository standards
- Largest collection of languages and platforms (listed below)
- Connects with private repositories and package registries
Languages
Renovate can provide updates for most popular languages, platforms, and registries including: npm, Java, Python, .NET, Scala, Ruby, Go, Docker and more. Supports over 90 different package managers.
Platforms
Renovate updates code repositories on the following platforms: GitHub, GitLab, Bitbucket, Azure DevOps, AWS Code Commit (experimental), Gitea, Forgejo, Gerrit (experimental), SCM-Manager (experimental)
Ways to run Renovate
The most effective way to run Renovate is to use an automated job scheduling system that regularly runs Renovate on all enabled repositories and responds with priority to user activity. Mend offers cloud-hosted and self-hosted solutions. See the options below.
Mend Renovate Community (Cloud-Hosted)
Supports: GitHub.com, Bitbucket Cloud
Hosted by Mend.io. No setup is needed. Community plan available (Free)
- GitHub Cloud: Install the Renovate Cloud-Hosted App on your GitHub org, then select the repos to enable
- Bitbucket Cloud: Add the Mend App to your Workspace, then add the Mend Renovate user to the projects you want to enable
Mend Renovate Community (Self-hosted)
Supports: GitHub, GitLab, Bitbucket Data Center
Install and run your own Renovate server. Access internal packages.
- Mend Renovate Community Self-Hosted (Free)
- Mend Renovate Enterprise (Paid plan)
Other ways to run Renovate
If you can’t use a pre-built job scheduling system, or want to build your own, the following options are available:
Run Renovate on your Pipeline
Mend provides a GitHub Action or a GitLab Runner to help you run Renovate as a CI pipeline job.
- GitHub Action: renovatebot/github-action.
- GitLab Runner: Renovate Runner project
- AzureDevOps action: Renovate Me extension
Note: This extension is created and maintained personally by a Renovate developer/user. Support requests for the extension will not be answered directly in the main Renovate repository. - Custom pipeline: You can create a custom pipeline with a yml definition that triggers npx renovate. More details on how to configure the pipeline.
Run Renovate CLI
There are several ways to run the Renovate CLI directly. See docs: Running Renovate for all options.
Supports: all platforms
For additional community-maintained options, see the Community Tools page.
Docs
More about Renovate
- Renovate basics
- Supported platforms and languages
- Advanced Renovate usage
Renovate Docs
Comparisons
Get involved
Issues and Discussions
Please open a Discussion to get help, suggest a new feature, or to report a bug. We only want maintainers to open Issues.
Contributing
To contribute to Renovate, or run a local copy, please read the contributing guidelines.
- Guidelines for Contributing
- Items that need contribution: good first issues
Contact and Social Media
The Renovate project is proudly supported and actively maintained by Mend.io.
- Contact Mend.io for commercial support questions.
Follow us on:
- Twitter: x.com/mend_io
- LinkedIn: linkedin.com/company/mend-io
Security / Disclosure
If you find any bug with Renovate that may be a security problem, please report it through the GitHub Security Advisories process. This way we can evaluate the bug and hopefully fix it before it gets abused. Please give us enough time to investigate the bug before you report it anywhere else.
If you would like to discuss a potential finding before raising the Advisory, then e-mail us at: renovate-disclosure@mend.io.