Files
renovate/lib/modules/datasource
Punsoong Khut 795d083264 feat(datasource): add APK datasource support (#40250)
* feat(datasource): add APK datasource support

* remove missing manager link for now

* lint docs

* update tests

* replace binary fixtures

* fix coverage

* Update lib/modules/datasource/apk/readme.md

Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>

* Apply suggestion from @viceice

Co-authored-by: Michael Kriese <michael.kriese@gmx.de>

* use tar instead of tar-stream

* use codeBlock

* add ignore back

* make method private

* use an async extract instead of list

* add usage example

* stream apkindex download and parse line-by-line

* refactor(datasource): address review comments on APK datasource

Co-authored-by: Cursor <cursoragent@cursor.com>

* chore: sync pnpm-lock.yaml after merge

Co-authored-by: Cursor <cursoragent@cursor.com>

* test: remove ignored lines

As they seem to be covered, anyway.

* fixup! Merge remote-tracking branch 'origin/HEAD' into apk-datasource

* fixup! fixup! Merge remote-tracking branch 'origin/HEAD' into apk-datasource

* lint: use `node:` prefix

* Update lib/modules/datasource/apk/index.ts

Co-authored-by: Michael Kriese <michael.kriese@gmx.de>

* refactor(datasource/apk): use asTimestamp millis instead of new Date

Co-authored-by: Cursor <cursoragent@cursor.com>

* refactor(datasource/apk): rename uncached method to _getPackages

Co-authored-by: Cursor <cursoragent@cursor.com>

* refactor(datasource/apk): encode registry URL parts as query parameters

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(datasource/apk): reject invalid registry URLs, skip caching empty indexes

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(datasource/apk): throw on unparseable registry URL and drop unset sourceUrl support

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs(datasource/apk): show how registry URL parameters build the index URLs

Co-authored-by: Cursor <cursoragent@cursor.com>

* Apply suggestions from code review

Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>

* fix(datasource/apk): keep credentials and port in component URLs

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(datasource/apk): extract APKINDEX by basename and key packages by name

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(datasource/apk): report a version served by two components only once

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io>
Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>
2026-09-04 12:25:21 +00:00
..

Datasources

Datasources are used in Renovate primarily to fetch released versions of packages.

Follow the class-based programming style

New datasources must follow the class-based programming style. Use the java-version datasource as a reference.

Add the datasource to the API in api.ts so that the new datasource is usable. If you find Unused HTTP mocks errors in the Vitest tests and your mocked URLs are correct, make sure the datasource is correctly registered.

getReleases

The minimum exported interface for a datasource is a function called getReleases that takes a lookup config as input.

The config has:

  • packageName: the package's full name including scope if present (e.g. @foo/bar)
  • registryUrls: an array of registry URLs to try

getReleases should return an object having:

  • releases: an array of strings of matched versions. This is the only mandatory field
  • deprecationMessage: a string description of the package's deprecation notice, if applicable
  • sourceUrl: a HTTP URL pointing to the source code (for example on GitHub)
  • homepage: a HTTP URL for the package's homepage. Ideally should be empty if the homepage and sourceUrl are the same
  • changelogUrl: a URL pointing to the package's changelog (could be a Markdown file, for example). If not present then Renovate will search the sourceUrl for a changelog file
  • tags: an object mapping tag → version, for example tags: { latest: '3.0.0' }. This is only used by the followTags function

getDigest

Datasources that support digests (like Docker digests and Git commit hashes) can export a getDigest function.

The getDigest function has two inputs:

  • config: the Renovate config for the package being updated, has the same fields as getReleases
  • newValue: the version or value to retrieve the digest for

The getDigest function returns a string output representing the digest value. If no digest is found, the getDigest function should return null.