chore(deps): update renovate group to v43 (major) #97
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #97 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 3 3
Lines 99 99
=========================================
Hits 99 99 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
msclock-bot
bot
force-pushed
the
renovate-github/major-renovate-group
branch
7 times, most recently
from
cf71bfb to
d85de39
Compare
msclock-bot
bot
force-pushed
the
renovate-github/major-renovate-group
branch
6 times, most recently
from
efc082e to
ea5090d
Compare
msclock-bot
bot
force-pushed
the
renovate-github/major-renovate-group
branch
8 times, most recently
from
01a4e42 to
128dee3
Compare
msclock-bot
bot
force-pushed
the
renovate-github/major-renovate-group
branch
4 times, most recently
from
acd2636 to
5c448d5
Compare
msclock-bot
bot
force-pushed
the
renovate-github/major-renovate-group
branch
3 times, most recently
from
a9420ee to
bcf372a
Compare
msclock-bot
bot
force-pushed
the
renovate-github/major-renovate-group
branch
7 times, most recently
from
0946b99 to
dc066d5
Compare
msclock-bot
bot
changed the title
msclock-bot
bot
force-pushed
the
renovate-github/major-renovate-group
branch
8 times, most recently
from
0e58302 to
f08bb83
Compare
msclock-bot
bot
force-pushed
the
renovate-github/major-renovate-group
branch
7 times, most recently
from
2caf1f4 to
cc64ac9
Compare
msclock-bot
bot
force-pushed
the
renovate-github/major-renovate-group
branch
from
cc64ac9 to
7eaeb60
Compare
msclock-bot
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
40.45.2->43.0.740.45.1->43.0.6Note: The
pre-commitmanager in Renovate is not supported by thepre-commitmaintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.Release Notes
renovatebot/renovate (ghcr.io/renovatebot/renovate)
v43.0.7Compare Source
Code Refactoring
Build System
v43.0.6Compare Source
Miscellaneous Chores
Build System
v43.0.5Compare Source
Bug Fixes
v43.0.4Compare Source
Bug Fixes
v43.0.3Compare Source
Bug Fixes
Miscellaneous Chores
prHourlyLimit(#39443) (991fdbf)v43.0.2Compare Source
Bug Fixes
Documentation
v43.0.1Compare Source
Bug Fixes
Documentation
v43.0.0Compare Source
Breaking changes for 43
Allowlisting required for "unsafe commands" #40684
Prior to Renovate 43, when performing updates in a repository that used Gradle, Renovate would execute the Gradle Wrapper (
./gradleworgradlew.bat).This is a well-documented "insider attack" risk that could lead to remote code execution in the context of the Renovate process, as execution of the Gradle buildscript:
This can occur during updates to the Gradle wrapper or using Gradle's Dependency Verification Metadata when updating Gradle dependencies.
As of Renovate 43, this long-standing risk is disabled by default to make Renovate more "secure by default".
Self-hosted administrators can re-enable this using the global self-hosted configuration
allowedUnsafeExecutions.postUpgradeTaskswill no longer run withshellmode by default #40230As noted in #40403 and GHSA-pfq2-hh62-7m96, existing access to a repository could lead to remote code execution due to incorrectly quoted shell commands.
The fix for GHSA-pfq2-hh62-7m96 applied to commands invoked by Renovate, but did not cover
postUpgradeTasks, which are allowlisted by a self-hosted administrator.To provide a safer default, commands that run through
postUpgradeTaskswill no longer run inside a shell.Self-hosted administrators can re-enable this using the global self-hosted configuration
allowShellExecutorForPostUpgradeCommands=true.binarySource=dockeris officially deprecated #40735As noted in #40747, we have now officially deprecated the
binarySource=dockeroption.There is no timeline decided on the removal of the functionality.
For more details and/or to provide feedback on your use case and why
binarySource=installdoes not work for you, please see #40747.Renovate now ships as ESM (ECMAScript Modules) #9890 / #40756
This should not affect users, only cases where Renovate is imported as a library. Given our previous support of Node 22, ESM can still be imported from Common JS (CJS) files.
Out of caution and for visibility, this is part of the major release.
config:best-practiceswill now perform weekly lockfile maintenance #40735As part of the Renovate maintainers' opinionated "best practices" configuration, Renovate will now perform a weekly lockfile maintenance task, keeping your lockfiles updated.
This is due to an increase in package managers using lock files, but users not necessarily being aware of the need to enable this explicitly.
If this is not applicable to you, you can use
ignorePresets, i.e.{ "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ "config:best-practices" ], "ignorePresets": [ ":maintainLockFilesWeekly" ] }JSON Schema split for repo or global configuration #38619
Renovate now has separate JSON Schemas for repository configuration, repository configuration (and inherit config) for writing
org-inherited-config.json, and global self-hosted configuration:This provides better validation for your editor/agent, as you now only see documentation for the relevant configuration type you're writing.
You can read more in the Renovate JSON Schema documentation.
This does not affect
renovate-config-validator.Replacements cannot be grouped with other updates #40758
To prevent replacements being grouped in with other updates, which can sometimes lead to them failing to correctly replace a package, they will no longer be grouped.
This may lead to some PRs being modified/created when you upgrade to this version of Renovate.
Lock file maintenance cannot be grouped with other updates #40781
To prevent lock file maintenance being grouped in with other updates, which can sometimes lead to them failing to perform the lock file maintenance.
This may lead to some PRs being modified/created when you upgrade to this version of Renovate.
Use
wasm-javabuild of Bouncy Castle #40678To improve performance for encryption/decryption of secrets, as well as supporting AEAD, we have moved the default Bouncy Castle build to use
wasm-java.Renovate now requires a minimum of Node 24 #40675
The existing requirements of Node 24.11.0 has not changed.
This only drops support for Node 22.x.
Package name for Node.JS in Mise has changed to
node#40466To be more consistent with other package managers, the Node.JS package has been renamed to
node.This ensures that updates to NodeJS (when using Mise) are grouped with other package updates.
The
useCloudMetadataServicesconfiguration is now environment variable only #40638As a first step towards solving #38604, we have migrated this configuration option to being environment variable configuration only.
Note that technically Renovate will still detect it if it's set in a
config.js, but with changes in #38604 it will not affect the execution.Default tool version updates #39100
For users of the upstream Renovate container images, the following tools have been updated to new major versions:
Commentary for 43
There aren't any big changes as part of this release to call out - this is a fairly "routine" major version, where we're doing a little cleanup, making some improvements to be "secure by default", and updating our default tool versions.
Deprecations
As part of this release, we want to make you aware of deprecated features which will be removed as of Renovate 44:
x-access-token:prefix for GitHub⚠ BREAKING CHANGES
binarySource=docker(#40754)maintainLockFilesWeeklytobest-practicespreset (#40735)useCloudMetadataServicesenvironment-only (#40638)shell: trueforpostUpgradeTasks(#40230)hostType=githubto:githubComToken(#38975)wasm-javabuild of Bouncy Castle (#40678)nodejstonode(#40466)Features
binarySource=docker(#40754) (3644ac8), closes #40747hostType=githubto:githubComToken(#38975) (0d912db), closes #38961maintainLockFilesWeeklytobest-practicespreset (#40735) (28dccba)wasm-javabuild of Bouncy Castle (#40678) (4e19e7c)Bug Fixes
useCloudMetadataServicesenvironment-only (#40638) (a630187), closes #38604nodejstonode(#40466) (8dc1133)shell: trueforpostUpgradeTasks(#40230) (cb49754)Documentation
Miscellaneous Chores
updateTypein log message (d1e3f13)v42.95.2Compare Source
Bug Fixes
Build System
v42.95.1Compare Source
Bug Fixes
pnpm-lock.yamlfound (#40780) (0c49124), closes #40774Miscellaneous Chores
Continuous Integration
v42.95.0Compare Source
Features
renovatebot/base-imageinstead ofcontainerbase/sidecar(#40772) (cd0426b)Bug Fixes
Build System
v42.94.7Compare Source
Bug Fixes
v42.94.6Compare Source
Bug Fixes
v42.94.5Compare Source
Bug Fixes
v42.94.4Compare Source
Build System
v42.94.3Compare Source
Bug Fixes
Miscellaneous Chores
azure-devops-node-api(#40762) (e36d080)Code Refactoring
simpleGitimports (#40759) (17a1bba)v42.94.2Compare Source
Bug Fixes
deprecationMsgas a warning if present (#40753) (e049e56)Miscellaneous Chores
Code Refactoring
Tests
v42.94.1Compare Source
Bug Fixes
Code Refactoring
v42.94.0Compare Source
Features
Bug Fixes
Documentation
binarySource=installfor Mend-hosted (#40740) (783002c)Miscellaneous Chores
v42.93.1Compare Source
Bug Fixes
v42.93.0Compare Source
Features
onboardingAutoCloseAge(#40086) (c58c16f)Documentation
Miscellaneous Chores
URL.parse(#40703) (e958373)v42.92.14Compare Source
Bug Fixes
Code Refactoring
v42.92.13Compare Source
Bug Fixes
allowedUnsafeExecutions(#40719) (3e70904)v42.92.12Compare Source
Bug Fixes
workingDirTemplatemust be relative to the repo root (#40068) (bde55d5)v42.92.11Compare Source
Bug Fixes
Miscellaneous Chores
Code Refactoring
.tsextensions (#40700) (930cf66)v42.92.10Compare Source
Bug Fixes
onboardingConfigFileName(#40619) (1b6c63a)Documentation
--no-global(#40584) (30b7421)Miscellaneous Chores
URL.resolve(#40702) (18bd321)v42.92.9Compare Source
Bug Fixes
v42.92.8Compare Source
Miscellaneous Chores
Code Refactoring
nanoidwithcrypto.randomUUID(#40695) (5c796e1)Build System
tsdownfor.d.tsgeneration (#40696) (98d0b0f)v42.92.7Compare Source
Bug Fixes
v42.92.6Compare Source
Bug Fixes
Miscellaneous Chores
Build System
v42.92.5Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
@renovatebot/good-enough-parser(#40623) (ae49b7a)v42.92.4Compare Source
Miscellaneous Chores
Build System
v42.92.3Compare Source
Tests
Build System
v42.92.2Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
ProcessStatus(#40637) (e799a4c)Code Refactoring
Build System
Continuous Integration
v42.92.1Compare Source
Bug Fixes
Miscellaneous Chores
Tests
v42.92.0Compare Source
Features
pubtimewhen available (#40621) (69d80fd)rust-release-channelversioning scheme (#39859) (b637846)Bug Fixes
Code Refactoring
Continuous Integration
v42.91.0Compare Source
Features
Bug Fixes
Tests
Continuous Integration
v42.90.2Compare Source
Bug Fixes
minimumReleaseAgeExclude(#40613) (30eece1), closes #40611Documentation
v42.90.1Compare Source
Bug Fixes
Miscellaneous Chores
checkscript (#40185) (015ce80)v42.90.0Compare Source
Features
Miscellaneous Chores
v42.89.4Compare Source
Bug Fixes
Miscellaneous Chores
v42.89.3Compare Source
Bug Fixes
minimumReleaseAgeExclude(#40612) (8752c28), closes #40610Miscellaneous Chores
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Renovate Bot.