Merge branch 'main' into feat/flux-chartref

.devcontainer/Dockerfile

@@ -1 +1 @@
-FROM ghcr.io/containerbase/devcontainer:13.5.11
+FROM ghcr.io/containerbase/devcontainer:13.6.0

.github/workflows/codeql-analysis.yml

@@ -41,7 +41,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
+        uses: github/codeql-action/init@d68b2d4edb4189fd2a5366ac14e72027bd4b37dd # v3.28.2
         with:
           languages: javascript
 
@@ -51,7 +51,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
+        uses: github/codeql-action/autobuild@d68b2d4edb4189fd2a5366ac14e72027bd4b37dd # v3.28.2
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -65,4 +65,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
+        uses: github/codeql-action/analyze@d68b2d4edb4189fd2a5366ac14e72027bd4b37dd # v3.28.2

.github/workflows/scorecard.yml

@@ -51,6 +51,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: 'Upload to code-scanning'
-        uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
+        uses: github/codeql-action/upload-sarif@d68b2d4edb4189fd2a5366ac14e72027bd4b37dd # v3.28.2
         with:
           sarif_file: results.sarif

.github/workflows/trivy.yml

@@ -31,7 +31,7 @@ jobs:
           format: 'sarif'
           output: 'trivy-results.sarif'
 
-      - uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
+      - uses: github/codeql-action/upload-sarif@d68b2d4edb4189fd2a5366ac14e72027bd4b37dd # v3.28.2
         with:
           sarif_file: trivy-results.sarif
           category: 'docker-image-${{ matrix.tag }}'

.nvmrc

@@ -1 +1 @@
-22.13.0
+22.13.1

docs/usage/examples/opentelemetry.md

@@ -36,7 +36,7 @@ services:
   otel-collector:
     # Using the Contrib version to access the spanmetrics connector.
     # If you don't need the spanmetrics connector, you can use the standard version
-    image: otel/opentelemetry-collector-contrib:0.117.0
+    image: otel/opentelemetry-collector-contrib:0.118.0
     volumes:
       - ./otel-collector-config.yml:/etc/otelcol-contrib/config.yaml
     ports:

docs/usage/mend-hosted/hosted-apps-config.md

@@ -1,7 +1,5 @@
 # Mend-hosted Apps Configuration
 
-The Mend-hosted apps ([Renovate App on GitHub](/~https://github.com/apps/renovate) and [Mend App on Bitbucket](https://marketplace.atlassian.com/apps/1232072/mend)) are popular ways to use Renovate on the cloud.
-
 This page:
 
 - covers all non-default Renovate behavior of these Mend-hosted apps
@@ -74,12 +72,12 @@ This change causes Renovate to create an Onboarding PR, even if Renovate does no
 
 ## Fork Processing
 
-If an Organization installs Renovate with the "All repositories" option, then `forkProcessing` will remain set to its default value `false`.
+If an Organization installs Renovate with the "All repositories" option, then `forkProcessing` will remain set to its default value `disabled`.
 This means forked repositories are _not_ onboarded, Renovate ignores them.
-To change this behavior, push a `renovate.json` file to the repository with `"forkProcessing": true`.
+To change this behavior, push a `renovate.json` file to the repository with `"forkProcessing": "enabled"`.
 
 If an Organization installs Renovate with "Selected repositories", we assume the organization wants to onboard _all_ of the selected repositories, even forked repositories.
-Therefore we set `forkProcessing` to `true`.
+Therefore we set `forkProcessing` to "enabled".
 
 ## Inherited config
 

docs/usage/nuget.md

@@ -47,13 +47,16 @@ You can set alternative feeds:
 
 ```json
 {
-  "nuget": {
-    "registryUrls": [
-      "https://api.nuget.org/v3/index.json",
-      "https://example1.com/nuget/",
-      "https://example2.com/nuget/v3/index.json"
-    ]
-  }
+  "packageRules": [
+    {
+      "matchDatasources": ["nuget"],
+      "registryUrls": [
+        "https://api.nuget.org/v3/index.json",
+        "https://example1.com/nuget/",
+        "https://example2.com/nuget/v3/index.json"
+      ]
+    }
+  ]
 }
 ```
 
@@ -93,9 +96,12 @@ If a `v3` feed URL does not end with `index.json`, you must specify the version
 
   ```json
   {
-    "nuget": {
-      "registryUrls": ["http://myV3feed#protocolVersion=3"]
-    }
+    "packageRules": [
+      {
+        "matchDatasources": ["nuget"],
+        "registryUrls": ["https://example1.com/nuget/#protocolVersion=3"]
+      }
+    ]
   }
   ```
 

lib/config/options/index.ts

@@ -516,7 +516,7 @@ const options: RenovateOptions[] = [
     description:
       'Change this value to override the default Renovate sidecar image.',
     type: 'string',
-    default: 'ghcr.io/containerbase/sidecar:13.5.11',
+    default: 'ghcr.io/containerbase/sidecar:13.6.0',
     globalOnly: true,
   },
   {

lib/config/presets/internal/custom-managers.ts

@@ -24,7 +24,7 @@ export const presets: Record<string, Preset> = {
         customType: 'regex',
         fileMatch: ['(^|/)bitbucket-pipelines\\.ya?ml$'],
         matchStrings: [
-          '# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?(?: registryUrl=(?<registryUrl>[^\\s]+?))?\\s+.*\\s+[A-Za-z0-9_]+?_VERSION[ =:]\\s?["\']?(?<currentValue>.+?)["\']?\\s',
+          '# renovate: datasource=(?<datasource>[a-zA-Z0-9-._]+?) depName=(?<depName>[^\\s]+?)(?: (lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?(?: registryUrl=(?<registryUrl>[^\\s]+?))?\\s+.*\\s+[A-Za-z0-9_]+?_VERSION[ =:]\\s?["\']?(?<currentValue>.+?)["\']?\\s',
         ],
       },
     ],
@@ -39,7 +39,7 @@ export const presets: Record<string, Preset> = {
           '(^|/)([Dd]ocker|[Cc]ontainer)file[^/]*$',
         ],
         matchStrings: [
-          '# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?(?: registryUrl=(?<registryUrl>[^\\s]+?))?\\s(?:ENV|ARG)\\s+[A-Za-z0-9_]+?_VERSION[ =]["\']?(?<currentValue>.+?)["\']?\\s',
+          '# renovate: datasource=(?<datasource>[a-zA-Z0-9-._]+?) depName=(?<depName>[^\\s]+?)(?: (lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?(?: registryUrl=(?<registryUrl>[^\\s]+?))?\\s(?:ENV|ARG)\\s+[A-Za-z0-9_]+?_VERSION[ =]["\']?(?<currentValue>.+?)["\']?\\s',
         ],
       },
     ],
@@ -54,7 +54,7 @@ export const presets: Record<string, Preset> = {
           '(^|/)action\\.ya?ml$',
         ],
         matchStrings: [
-          '# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:\\s*["\']?(?<currentValue>.+?)["\']?\\s',
+          '# renovate: datasource=(?<datasource>[a-zA-Z0-9-._]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:\\s*["\']?(?<currentValue>.+?)["\']?\\s',
         ],
       },
     ],
@@ -67,7 +67,7 @@ export const presets: Record<string, Preset> = {
         customType: 'regex',
         fileMatch: ['\\.gitlab-ci\\.ya?ml$'],
         matchStrings: [
-          '# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?(?: registryUrl=(?<registryUrl>[^\\s]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:\\s*["\']?(?<currentValue>.+?)["\']?\\s',
+          '# renovate: datasource=(?<datasource>[a-zA-Z0-9-._]+?) depName=(?<depName>[^\\s]+?)(?: (?:packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?(?: registryUrl=(?<registryUrl>[^\\s]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:\\s*["\']?(?<currentValue>.+?)["\']?\\s',
         ],
       },
     ],
@@ -98,7 +98,7 @@ export const presets: Record<string, Preset> = {
           '\\.mk$',
         ],
         matchStrings: [
-          '# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?(?: registryUrl=(?<registryUrl>[^\\s]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:*\\??=\\s*["\']?(?<currentValue>.+?)["\']?\\s',
+          '# renovate: datasource=(?<datasource>[a-zA-Z0-9-._]+?) depName=(?<depName>[^\\s]+?)(?: (?:packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?(?: registryUrl=(?<registryUrl>[^\\s]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:*\\??=\\s*["\']?(?<currentValue>.+?)["\']?\\s',
         ],
       },
     ],
@@ -112,7 +112,7 @@ export const presets: Record<string, Preset> = {
           '{{#if datasource}}{{{datasource}}}{{else}}maven{{/if}}',
         fileMatch: ['(^|/)pom\\.xml$'],
         matchStrings: [
-          '<!--\\s?renovate:( datasource=(?<datasource>[a-z-.]+?))? depName=(?<depName>[^\\s]+?)(?: packageName=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?\\s+-->\\s+<.+\\.version>(?<currentValue>.+)<\\/.+\\.version>',
+          '<!--\\s?renovate:( datasource=(?<datasource>[a-zA-Z0-9-._]+?))? depName=(?<depName>[^\\s]+?)(?: packageName=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?\\s+-->\\s+<.+\\.version>(?<currentValue>.+)<\\/.+\\.version>',
         ],
         versioningTemplate: '{{#if versioning}}{{{versioning}}}{{/if}}',
       },

lib/config/types.ts

@@ -271,6 +271,7 @@ export interface RenovateConfig
   packageFile?: string;
   packageRules?: PackageRule[];
   postUpdateOptions?: string[];
+  branchConcurrentLimit?: number | null;
   prConcurrentLimit?: number;
   prHourlyLimit?: number;
   forkModeDisallowMaintainerEdits?: boolean;

lib/data/monorepo.json

@@ -26,6 +26,7 @@
     "arcus.observability": "/~https://github.com/arcus-azure/arcus.observability",
     "arcus.security": "/~https://github.com/arcus-azure/arcus.security",
     "arcus.webapi": "/~https://github.com/arcus-azure/arcus.webapi",
+    "arrow-kt": "/~https://github.com/arrow-kt/arrow",
     "aspire": "/~https://github.com/dotnet/aspire",
     "aspnet aspnetwebstack": "/~https://github.com/aspnet/AspNetWebStack",
     "aspnet extensions": "/~https://github.com/aspnet/Extensions",
@@ -325,6 +326,7 @@
     "happy-dom": "/~https://github.com/capricorn86/happy-dom",
     "Hangfire": "/~https://github.com/HangfireIO/Hangfire",
     "hickory-dns": "/~https://github.com/hickory-dns/hickory-dns",
+    "html-eslint": "/~https://github.com/yeonjuan/html-eslint",
     "infrastructure-ui": "/~https://github.com/instructure/instructure-ui",
     "ionic-native": "/~https://github.com/ionic-team/ionic-native",
     "istanbuljs": "/~https://github.com/istanbuljs/istanbuljs",

lib/modules/manager/bundler/artifacts.spec.ts

@@ -679,71 +679,6 @@ describe('modules/manager/bundler/artifacts', () => {
         ]);
       });
 
-      it('handles failure of strict updating for version solving', async () => {
-        const execError = new ExecError('Exec error', {
-          cmd: '',
-          stdout: '',
-          stderr: 'version solving has failed',
-          options: { encoding: 'utf8' },
-        });
-        fs.readLocalFile.mockResolvedValue('Current Gemfile.lock');
-        const execSnapshots = mockExecSequence([
-          execError,
-          { stdout: '', stderr: '' },
-        ]);
-        git.getRepoStatus.mockResolvedValueOnce(
-          partial<StatusResult>({
-            modified: ['Gemfile.lock'],
-          }),
-        );
-
-        const res = await updateArtifacts({
-          packageFileName: 'Gemfile',
-          updatedDeps: [{ depName: 'foo', updateType: 'minor' }],
-          newPackageFileContent: '{}',
-          config,
-        });
-
-        expect(res).toMatchObject([{ file: { path: 'Gemfile.lock' } }]);
-        expect(execSnapshots).toMatchObject([
-          { cmd: 'bundler lock --minor --strict --update foo' },
-          { cmd: 'bundler lock --minor --conservative --update foo' },
-        ]);
-      });
-
-      it('handles failure of strict updating for missing gem', async () => {
-        // See /~https://github.com/rubygems/rubygems/issues/7369
-        const execError = new ExecError('Exec error', {
-          cmd: '',
-          stdout: '',
-          stderr: "Could not find gems matching 'foo ",
-          options: { encoding: 'utf8' },
-        });
-        fs.readLocalFile.mockResolvedValue('Current Gemfile.lock');
-        const execSnapshots = mockExecSequence([
-          execError,
-          { stdout: '', stderr: '' },
-        ]);
-        git.getRepoStatus.mockResolvedValueOnce(
-          partial<StatusResult>({
-            modified: ['Gemfile.lock'],
-          }),
-        );
-
-        const res = await updateArtifacts({
-          packageFileName: 'Gemfile',
-          updatedDeps: [{ depName: 'foo', updateType: 'minor' }],
-          newPackageFileContent: '{}',
-          config,
-        });
-
-        expect(res).toMatchObject([{ file: { path: 'Gemfile.lock' } }]);
-        expect(execSnapshots).toMatchObject([
-          { cmd: 'bundler lock --minor --strict --update foo' },
-          { cmd: 'bundler lock --minor --conservative --update foo' },
-        ]);
-      });
-
       it('updates the Gemfile.lock when upgrading ruby', async () => {
         // See /~https://github.com/renovatebot/renovate/issues/15114
         fs.readLocalFile.mockResolvedValue('Current Gemfile.lock');

lib/modules/manager/bundler/artifacts.ts

@@ -105,8 +105,8 @@ export async function updateArtifacts(
       }
 
       const updateTypes = {
-        patch: '--patch --strict ',
-        minor: '--minor --strict ',
+        patch: '--patch ',
+        minor: '--minor ',
         major: '',
       };
       for (const [updateType, updateArg] of Object.entries(updateTypes)) {
@@ -120,12 +120,9 @@ export async function updateArtifacts(
           additionalArgs = '--conservative ';
         }
         if (deps.length) {
-          let cmd = `bundler lock ${updateArg}${additionalArgs}--update ${deps
+          const cmd = `bundler lock ${updateArg}${additionalArgs}--update ${deps
             .map(quote)
             .join(' ')}`;
-          if (cmd.includes(' --conservative ')) {
-            cmd = cmd.replace(' --strict', '');
-          }
           commands.push(cmd);
         }
       }
@@ -226,29 +223,6 @@ export async function updateArtifacts(
       memCache.set('bundlerArtifactsError', BUNDLER_INVALID_CREDENTIALS);
       throw new Error(BUNDLER_INVALID_CREDENTIALS);
     }
-    if (
-      recursionLimit > 0 &&
-      (output.includes('version solving has failed') ||
-        output.includes('Could not find gem'))
-    ) {
-      logger.debug('Failed to lock strictly, retrying non-strict');
-      const newConfig = {
-        ...config,
-        postUpdateOptions: [
-          ...(config.postUpdateOptions ?? []),
-          'bundlerConservative',
-        ],
-      };
-      return updateArtifacts(
-        {
-          packageFileName,
-          updatedDeps,
-          newPackageFileContent,
-          config: newConfig,
-        },
-        recursionLimit - 1,
-      );
-    }
     const resolveMatches: string[] = getResolvedPackages(output).filter(
       (depName) => !updatedDepNames.includes(depName),
     );

lib/modules/manager/haskell-cabal/extract.spec.ts

@@ -2,10 +2,19 @@ import {
   countPackageNameLength,
   countPrecedingIndentation,
   extractNamesAndRanges,
+  findDepends,
   findExtents,
   splitSingleDependency,
 } from './extract';
 
+const commentCabalFile = `build-depends:
+  -- leading
+ base,
+-- middle
+ other,
+ -- trailing
+ other2`;
+
 describe('modules/manager/haskell-cabal/extract', () => {
   describe('countPackageNameLength', () => {
     it.each`
@@ -91,4 +100,14 @@ describe('modules/manager/haskell-cabal/extract', () => {
       ]);
     });
   });
+
+  describe('findDepends()', () => {
+    it('strips comments', () => {
+      const res = findDepends(commentCabalFile + '\na: b');
+      expect(res).toEqual({
+        buildDependsContent: '\n base,\n other,\n other2',
+        lengthProcessed: commentCabalFile.length,
+      });
+    });
+  });
 });