Merge branch 'main' into feat/config-self-hosted-yaml-json5

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM containerbase/node:v14.18.1@sha256:b720748f7a35570e402a8741f37a5bd54ad485dd6b4aeaff04027ad761b1306d
+FROM containerbase/node:14.18.2@sha256:39288a62b456a381b12cf63aa207ec0b356a05410e95ee1b3fbbc2e1933b1ebc
 
 
 # renovate: datasource=npm

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -24,6 +24,7 @@ body:
       label: Is this a feature you are interested in implementing yourself?
       options:
         - 'Yes'
+        - 'Maybe'
         - 'No'
     validations:
       required: true

.github/workflows/build.yml

@@ -63,14 +63,14 @@ jobs:
           fetch-depth: 2
 
       - name: Set up Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@270253e841af726300e85d718a5f606959b2903c # renovate: tag=v2.4.1
+        uses: actions/setup-node@04c56d2f954f1e4c69436aa54cfef261a018f458 # renovate: tag=v2.5.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: yarn
 
       - name: Set up Java  ${{ env.JAVA_VERSION }}
         if: env.SKIP_JAVA_TESTS == 'false'
-        uses: actions/setup-java@8db439b6b47e5e12312bf036760bbaa6893481ac # renovate: tag=v2.3.1
+        uses: actions/setup-java@5f00602cd1b2819185d88dc7a1b1985f598c6705 # renovate: tag=v2.4.0
         with:
           java-version: ${{ env.JAVA_VERSION }}
           distribution: 'adopt'
@@ -119,7 +119,7 @@ jobs:
           fetch-depth: 2
 
       - name: Set up Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@270253e841af726300e85d718a5f606959b2903c # renovate: tag=v2.4.1
+        uses: actions/setup-node@04c56d2f954f1e4c69436aa54cfef261a018f458 # renovate: tag=v2.5.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: yarn
@@ -169,7 +169,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@270253e841af726300e85d718a5f606959b2903c # renovate: tag=v2.4.1
+        uses: actions/setup-node@04c56d2f954f1e4c69436aa54cfef261a018f458 # renovate: tag=v2.5.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: yarn

.github/workflows/codeql-analysis.yml

@@ -26,7 +26,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e095058bfa09de8070f94e98f5dc059531bc6235 # renovate: tag=v1.0.24
+        uses: github/codeql-action/init@546b30f35ae5a3db0e0be1843008c2224f71c3b0 # renovate: tag=v1.0.25
         with:
           config-file: ./.github/codeql/codeql-config.yml
 
@@ -36,7 +36,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@e095058bfa09de8070f94e98f5dc059531bc6235 # renovate: tag=v1.0.24
+        uses: github/codeql-action/autobuild@546b30f35ae5a3db0e0be1843008c2224f71c3b0 # renovate: tag=v1.0.25
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -50,4 +50,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e095058bfa09de8070f94e98f5dc059531bc6235 # renovate: tag=v1.0.24
+        uses: github/codeql-action/analyze@546b30f35ae5a3db0e0be1843008c2224f71c3b0 # renovate: tag=v1.0.25

.github/workflows/release-npm.yml

@@ -40,7 +40,7 @@ jobs:
           ref: ${{ env.GIT_SHA }}
 
       - name: Set up Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@270253e841af726300e85d718a5f606959b2903c # renovate: tag=v2.4.1
+        uses: actions/setup-node@04c56d2f954f1e4c69436aa54cfef261a018f458 # renovate: tag=v2.5.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: yarn

docs/usage/configuration-options.md

@@ -392,7 +392,7 @@ Configure this option to `false` if you prefer Renovate to open a new issue when
 
 ## constraints
 
-Constraints are used in package managers which use third party tools to update "artifacts" like lock files or checksum files.
+Constraints are used in package managers which use third-party tools to update "artifacts" like lock files or checksum files.
 Typically, the constraint is detected automatically by Renovate from files within the repository and there is no need to manually configure it.
 Manually specifying constraints is supported for `ruby`, `bundler`, `composer`, `go`, `npm`, `yarn`, `pnpm`, `python`, `pipenv`, and `poetry`.
 
@@ -1518,7 +1518,18 @@ Use this field to restrict rules to a particular datasource. e.g.
 
 ### matchCurrentVersion
 
-`matchCurrentVersion` can be an exact SemVer version or a SemVer range.
+`matchCurrentVersion` can be an exact SemVer version or a SemVer range:
+
+```json
+{
+  "packageRules": [
+    {
+      "matchCurrentVersion": ">=1.0.0",
+      "matchPackageNames": ["angular"]
+    }
+  ]
+}
+```
 
 This field also supports Regular Expressions which must begin and end with `/`.
 For example, the following enforces that only `1.*` versions will be used:
@@ -1740,6 +1751,8 @@ For example, GitHub might automerge a Renovate branch even if it's behind the ba
 
 ## postUpgradeTasks
 
+Note: post-upgrade tasks can only be used on self-hosted Renovate instances.
+
 Post-upgrade tasks are commands that are executed by Renovate after a dependency has been updated but before the commit is created.
 The intention is to run any additional command line tools that would modify existing files or generate new files when a dependency changes.
 
@@ -1762,16 +1775,17 @@ The `postUpgradeTasks` configuration consists of three fields:
 
 ### commands
 
-A list of commands that are executed after Renovate has updated a dependency but before the commit it made
+A list of commands that are executed after Renovate has updated a dependency but before the commit is made.
 
 ### fileFilters
 
-A list of glob-style matchers that determine which files will be included in the final commit made by Renovate
+A list of glob-style matchers that determine which files will be included in the final commit made by Renovate.
 
 ### executionMode
 
-Defaults to `update`, but can also be set to `branch`. This sets the level the postUpgradeTask runs on, if set to `update` the postUpgradeTask
-will be executed for every dependency on the branch. If set to `branch` the postUpgradeTask is executed for the whole branch.
+Defaults to `update`, but can also be set to `branch`.
+This sets the level the postUpgradeTask runs on, if set to `update` the postUpgradeTask will be executed for every dependency on the branch.
+If set to `branch` the postUpgradeTask is executed for the whole branch.
 
 ## prBodyColumns
 

docs/usage/docker.md

@@ -229,7 +229,7 @@ To get access to the token a custom Renovate Docker image is needed that include
 The Dockerfile to create such an image can look like this:
 
 ```Dockerfile
-FROM renovate/renovate:29.14.1
+FROM renovate/renovate:29.32.4
 # Include the "Docker tip" which you can find here https://cloud.google.com/sdk/docs/install
 # under "Installation" for "Debian/Ubuntu"
 RUN ...

docs/usage/examples/self-hosting.md

@@ -15,7 +15,7 @@ If you want to use these package managers to update your lockfiles, you must ens
 npm install -g yarn pnpm
 ```
 
-The same goes for any other third party binary tool like `gradle` or `poetry` - you need to make sure they are installed and the appropriate version before running Renovate.
+The same goes for any other third-party binary tool like `gradle` or `poetry` - you need to make sure it is installed and the appropriate version before running Renovate.
 
 ### Docker
 

docs/usage/getting-started/running.md

@@ -22,8 +22,8 @@ Self-hosting Renovate means that you are the "administrator" of the bot, which e
 
 Renovate's Open Source CLI is built and distributed as the npm package `renovate`.
 You can run this directly in any Node.js environment - even via `npx` - and it will process all the repositories it is configured with, before exiting.
-When you install Renovate from npm it naturally does not come bundled with any third party tools or languages such as Ruby, Python, Composer, Bundler, Poetry, etc.
-Therefore if you need Renovate to support any non-npm lock files like Bundler then you'll need to make sure all required third party tools are pre-installed in the same environment alongside Renovate before you run it.
+When you install Renovate from npm it naturally does not come bundled with any third-party tools or languages such as Ruby, Python, Composer, Bundler, Poetry, etc.
+Therefore if you need Renovate to support any non-npm lock files like Bundler then you'll need to make sure all required third-party tools are pre-installed in the same environment alongside Renovate before you run it.
 
 The `renovate` npm package is compatible with all of Renovate's supported platforms.
 

docs/usage/key-concepts/dashboard.md

@@ -29,7 +29,7 @@ To turn on the Dashboard manually, add the `:dependencyDashboard` preset to your
 
 Or set `dependencyDashboard` to `true`:
 
-```
+```json
 {
   "dependencyDashboard": true
 }

docs/usage/modules/manager.md

@@ -3,7 +3,7 @@
 Renovate is based around the concept of "package managers", or "managers" for short.
 These range from traditional package managers like npm, Bundler and Composer through to less traditional concepts like CircleCI or Travis config files.
 
-The goal of Renovate is to detect and maintain all third party dependencies in your repositories, through the use of managers.
+The goal of Renovate is to detect and maintain all third-party dependencies in your repositories, through the use of managers.
 
 ## Supported Managers
 

docs/usage/self-hosted-configuration.md

@@ -104,10 +104,10 @@ e.g.
 
 ## binarySource
 
-Renovate often needs to use third party binaries in its PRs, e.g. `npm` to update `package-lock.json` or `go` to update `go.sum`.
+Renovate often needs to use third-party binaries in its PRs, e.g. `npm` to update `package-lock.json` or `go` to update `go.sum`.
 By default, Renovate will use a child process to run such tools, so they need to be pre-installed before running Renovate and available in the path.
 
-As an alternative, Renovate can use "sidecar" containers for third party tools.
+As an alternative, Renovate can use "sidecar" containers for third-party tools.
 If configured, Renovate will use `docker run` to create containers such as Node.js or Python to run tools within as-needed.
 For this to work, `docker` needs to be installed and the Docker socket available to Renovate.
 

jest.config.ts

@@ -34,6 +34,7 @@ const config: InitialOptionsTsJest = {
   snapshotSerializers: ['<rootDir>/test/newline-snapshot-serializer.ts'],
   testEnvironment: 'node',
   testRunner: 'jest-circus/runner',
+  watchPathIgnorePatterns: ['<rootDir>/.cache/', '<rootDir>/coverage/'],
   globals: {
     'ts-jest': {
       tsconfig: '<rootDir>/tsconfig.spec.json',

lib/config/options/index.ts

@@ -262,7 +262,7 @@ const options: RenovateOptions[] = [
   {
     name: 'binarySource',
     description:
-      'Controls whether third party tools like npm or Gradle are called directly, or via Docker sidecar containers.',
+      'Controls whether third-party tools like npm or Gradle are called directly, or via Docker sidecar containers.',
     globalOnly: true,
     type: 'string',
     allowedValues: ['global', 'docker'],

lib/config/presets/internal/monorepo.ts

@@ -34,6 +34,7 @@ const repoGroups = {
   deno: 'https://github.com/denoland/deno',
   'devextreme-reactive': 'https://github.com/DevExpress/devextreme-reactive',
   'dnd-kit': 'https://github.com/clauderic/dnd-kit',
+  'elastic-apm-agent-rum-js': 'https://github.com/elastic/apm-agent-rum-js',
   'electron-forge': 'https://github.com/electron-userland/electron-forge',
   'ember-decorators': 'https://github.com/ember-decorators/ember-decorators',
   'graphql-modules': 'https://github.com/Urigo/graphql-modules',

lib/config/presets/internal/replacements.ts

@@ -3,7 +3,11 @@ import type { Preset } from '../types';
 export const presets: Record<string, Preset> = {
   all: {
     description: 'All replacements',
-    extends: ['replacements:jade-to-pug', 'replacements:cucumber-to-scoped'],
+    extends: [
+      'replacements:jade-to-pug',
+      'replacements:cucumber-to-scoped',
+      'replacements:rollup-node-resolve-to-scoped',
+    ],
   },
   'jade-to-pug': {
     description: 'Jade was renamed to Pug',
@@ -27,4 +31,15 @@ export const presets: Record<string, Preset> = {
       },
     ],
   },
+  'rollup-node-resolve-to-scoped': {
+    description: 'the node-resolve plugin for rollup became scoped',
+    packageRules: [
+      {
+        matchDatasources: ['npm'],
+        matchPackageNames: ['rollup-plugin-node-resolve'],
+        replacementName: '@rollup/plugin-node-resolve',
+        replacementVersion: '6.0.0',
+      },
+    ],
+  },
 };

lib/datasource/artifactory/index.ts

@@ -109,6 +109,6 @@ export class ArtifactoryDatasource extends Datasource {
   }
 
   private static parseReleaseTimestamp(rawText: string): string {
-    return rawText.trim().replace(regEx(/ ?-$/), ''); // TODO #12071
+    return rawText.trim().replace(regEx(/ ?-$/), '') + 'Z'; // TODO #12071
   }
 }

lib/datasource/artifactory/readme.md

@@ -3,3 +3,5 @@ Artifactory is the recommended registry for Conan packages.
 This datasource returns releases from given custom `registryUrl`(s).
 
 The target URL is composed by the `registryUrl` and the `lookupName`, which defaults to `depName` when `lookupName` is not defined.
+
+The release timestamp is taken from the date in the directory listing, and is assumed to be in UTC time.

lib/datasource/crate/index.ts

@@ -7,6 +7,7 @@ import * as memCache from '../../util/cache/memory';
 import { cache } from '../../util/cache/package/decorator';
 import { privateCacheDir, readFile } from '../../util/fs';
 import { simpleGitConfig } from '../../util/git/config';
+import { regEx } from '../../util/regex';
 import * as cargoVersioning from '../../versioning/cargo';
 import { Datasource } from '../datasource';
 import type { GetReleasesConfig, Release, ReleaseResult } from '../types';
@@ -143,7 +144,7 @@ export class CrateDatasource extends Datasource {
    * clone the repository.
    */
   private static cacheDirFromUrl(url: URL): string {
-    const proto = url.protocol.replace(/:$/, ''); // TODO #12070
+    const proto = url.protocol.replace(regEx(/:$/), '');
     const host = url.hostname;
     const hash = hasha(url.pathname, {
       algorithm: 'sha256',

lib/datasource/go/releases-goproxy.ts

@@ -37,9 +37,9 @@ export function parseGoproxy(
   }
 
   const result: GoproxyItem[] = input
-    .split(/([^,|]*(?:,|\|))/) // TODO: #12070
+    .split(regEx(/([^,|]*(?:,|\|))/))
     .filter(Boolean)
-    .map((s) => s.split(/(?=,|\|)/)) // TODO: #12070
+    .map((s) => s.split(/(?=,|\|)/)) // TODO: #12872 lookahead
     .map(([url, separator]) => ({
       url,
       fallback:
@@ -56,7 +56,7 @@ export function parseGoproxy(
 const lexer = moo.states({
   main: {
     separator: {
-      match: /\s*?,\s*?/, // TODO #12070
+      match: /\s*?,\s*?/, // TODO #12870
       value: (_: string) => '|',
     },
     asterisk: {
@@ -77,14 +77,14 @@ const lexer = moo.states({
       value: (s: string) => s.replace(regEx('\\.', 'g'), '\\.'),
     },
     escapedChar: {
-      match: /\\./, // TODO #12070
+      match: /\\./, // TODO #12870
       value: (s: string) => s.slice(1),
     },
   },
   characterRange: {
-    char: /[^\\\]\n]/, // TODO #12070
+    char: /[^\\\]\n]/, // TODO #12870
     escapedChar: {
-      match: /\\./, // TODO #12070
+      match: /\\./, // TODO #12870
       value: (s: string) => s.slice(1),
     },
     characterRangeEnd: {

lib/datasource/maven/index.ts

@@ -306,7 +306,7 @@ export async function getReleases({
   registryUrl,
 }: GetReleasesConfig): Promise<ReleaseResult | null> {
   const dependency = getDependencyParts(lookupName);
-  const repoUrl = registryUrl.replace(/\/?$/, '/'); // TODO #12070
+  const repoUrl = registryUrl.replace(/\/?$/, '/'); // TODO #12071
 
   logger.debug(`Looking up ${dependency.display} in repository ${repoUrl}`);
 

lib/datasource/metadata.spec.ts

@@ -1,5 +1,5 @@
 import * as datasourceMaven from './maven';
-import { addMetaData } from './metadata';
+import { addMetaData, massageGithubUrl } from './metadata';
 import * as datasourceNpm from './npm';
 import { PypiDatasource } from './pypi';
 import type { ReleaseResult } from './types';
@@ -227,4 +227,30 @@ describe('datasource/metadata', () => {
       { releaseTimestamp: '2000-01-03T12:34:56.000Z' },
     ]);
   });
+
+  it('Should massage github git@ url to valid https url', () => {
+    expect(massageGithubUrl('[email protected]:foo/bar')).toMatch(
+      'https://example.com/foo/bar'
+    );
+  });
+  it('Should massage github http url to valid https url', () => {
+    expect(massageGithubUrl('http://example.com/foo/bar')).toMatch(
+      'https://example.com/foo/bar'
+    );
+  });
+  it('Should massage github http and git url to valid https url', () => {
+    expect(massageGithubUrl('http+git://example.com/foo/bar')).toMatch(
+      'https://example.com/foo/bar'
+    );
+  });
+  it('Should massage github ssh git@ url to valid https url', () => {
+    expect(massageGithubUrl('ssh://[email protected]/foo/bar')).toMatch(
+      'https://example.com/foo/bar'
+    );
+  });
+  it('Should massage github git url to valid https url', () => {
+    expect(massageGithubUrl('git://example.com/foo/bar')).toMatch(
+      'https://example.com/foo/bar'
+    );
+  });
 });

lib/datasource/metadata.ts

@@ -110,11 +110,18 @@ const manualSourceUrls = {
 const githubPages = regEx('^https://([^.]+).github.com/([^/]+)$');
 const gitPrefix = regEx('^git:/?/?');
 
-function massageGithubUrl(url: string): string {
-  return url
+export function massageGithubUrl(url: string): string {
+  let massagedUrl = url;
+
+  if (url.startsWith('git@')) {
+    massagedUrl = url.replace(':', '/').replace('git@', 'https://');
+  }
+
+  return massagedUrl
     .replace('http:', 'https:')
     .replace('http+git:', 'https:')
     .replace('https+git:', 'https:')
+    .replace('ssh://git@', 'https://')
     .replace(gitPrefix, 'https://')
     .replace(githubPages, 'https://github.com/$1/$2')
     .replace('www.github.com', 'github.com')