feat!: remove skipInstalls config option

docs/usage/configuration-options.md

@@ -1855,28 +1855,28 @@ Example:
 
 The above rule will group together the `neutrino` package and any package matching `@neutrino/*`.
 
-Path rules are convenient to use if you wish to apply configuration rules to certain package files using patterns.
+File name matches are convenient to use if you wish to apply configuration rules to certain package or lock files using patterns.
 For example, if you have an `examples` directory and you want all updates to those examples to use the `chore` prefix instead of `fix`, then you could add this configuration:
 
 ```json
 {
   "packageRules": [
     {
-      "matchPaths": ["examples/**"],
+      "matchFileNames": ["examples/**"],
       "extends": [":semanticCommitTypeAll(chore)"]
     }
   ]
 }
 ```
 
-If you wish to limit Renovate to apply configuration rules to certain files in the root repository directory, you have to use `matchPaths` with a `minimatch` pattern or use [`matchFiles`](#matchfiles) with an exact match.
+If you wish to limit Renovate to apply configuration rules to certain files in the root repository directory, you have to use `matchFileNames` with a `minimatch` pattern (which can include an exact file name match).
 For example you have multiple `package.json` and want to use `dependencyDashboardApproval` only on the root `package.json`:
 
 ```json
 {
   "packageRules": [
     {
-      "matchFiles": ["package.json"],
+      "matchFileNames": ["package.json"],
       "dependencyDashboardApproval": true
     }
   ]
@@ -2171,23 +2171,50 @@ Use the syntax `!/ /` like this:
 }
 ```
 
-### matchFiles
+### matchFileNames
 
-Renovate will compare `matchFiles` for an exact match against the dependency's package file or lock file.
+Renovate will compare `matchFileNames` glob matching against the dependency's package file or lock file.
 
-For example the following would match `package.json` but not `package/frontend/package.json`:
+The following example matches `package.json` but _not_ `package/frontend/package.json`:
 
 ```json
 {
   "packageRules": [
     {
-      "matchFiles": ["package.json"]
+      "matchFileNames": ["package.json"],
+      "labels": ["npm"]
     }
   ]
 }
 ```
 
-Use [`matchPaths`](#matchpaths) instead if you need more flexible matching.
+The following example matches any `package.json`, including files like `backend/package.json`:
+
+```json
+{
+  "packageRules": [
+    {
+      "description": "Group dependencies from package.json files",
+      "matchFileNames": ["**/package.json"],
+      "groupName": "All package.json changes"
+    }
+  ]
+}
+```
+
+The following example matches any file in directories starting with `app/`:
+
+```json
+{
+  "packageRules": [
+    {
+      "description": "Group all dependencies from the app directory",
+      "matchFileNames": ["app/**"],
+      "groupName": "App dependencies"
+    }
+  ]
+}
+```
 
 ### matchDepNames
 
@@ -2247,43 +2274,6 @@ See also `excludePackagePrefixes`.
 
 Just like the earlier `matchPackagePatterns` example, the above will configure `rangeStrategy` to `replace` for any package starting with `angular`.
 
-### matchPaths
-
-Renovate finds the file(s) listed in `matchPaths` with a `minimatch` glob pattern.
-
-For example the following matches any `package.json`, including files like `backend/package.json`:
-
-```json
-{
-  "packageRules": [
-    {
-      "description": "Group dependencies from package.json files",
-      "matchPaths": ["**/package.json"],
-      "groupName": "All package.json changes"
-    }
-  ]
-}
-```
-
-The following matches any file in directories starting with `app/`:
-
-```json
-{
-  "packageRules": [
-    {
-      "description": "Group all dependencies from the app directory",
-      "matchPaths": ["app/**"],
-      "groupName": "App dependencies"
-    }
-  ]
-}
-```
-
-<!-- prettier-ignore -->
-!!! warning
-    Partial matches for `matchPaths` are deprecated.
-    Please use a `minimatch` glob pattern or switch to [`matchFiles`](#matchfiles) if you need exact matching.
-
 ### matchSourceUrlPrefixes
 
 Here's an example of where you use this to group together all packages from the `renovatebot` GitHub org:
@@ -2505,28 +2495,28 @@ If enabled Renovate will pin Docker images or GitHub Actions by means of their S
 ## platformAutomerge
 
 <!-- prettier-ignore -->
-!!! warning
-    Before you enable `platformAutomerge` you should enable your Git hosting platform's capabilities to enforce test passing before PR merge.
+!!! note
+    If you use the default `platformAutomerge=true` then you should enable your Git hosting platform's capabilities to enforce test passing before PR merge.
     If you don't do this, the platform might merge Renovate PRs even if the repository's tests haven't started, are in still in progress, or possibly even when they have failed.
     On GitHub this is called "Require status checks before merging", which you can find in the "Branch protection rules" section of the settings for your repository.
     [GitHub docs, about protected branches](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches)
     [GitHub docs, require status checks before merging](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches#require-status-checks-before-merging)
     If you're using another platform, search their documentation for a similar feature.
 
-If you have enabled `automerge` and set `automergeType=pr` in the Renovate config, then you can also set `platformAutomerge` to `true` to speed up merging via the platform's native automerge functionality.
+If you have enabled `automerge` and set `automergeType=pr` in the Renovate config, then leaving `platformAutomerge` as `true` speeds up merging via the platform's native automerge functionality.
 
 Renovate tries platform-native automerge only when it initially creates the PR.
 Any PR that is being updated will be automerged with the Renovate-based automerge.
 
 `platformAutomerge` will configure PRs to be merged after all (if any) branch policies have been met.
-This option is available for Azure, GitHub and GitLab.
+This option is available for Azure, Gitea, GitHub and GitLab.
 It falls back to Renovate-based automerge if the platform-native automerge is not available.
 
 You can also fine-tune the behavior by setting `packageRules` if you want to use it selectively (e.g. per-package).
 
 Note that the outcome of `rebaseWhen=auto` can differ when `platformAutomerge=true`.
 Normally when you set `rebaseWhen=auto` Renovate rebases any branch that's behind the base branch automatically, and some people rely on that.
-This behavior is no longer guaranteed when you enable `platformAutomerge` because the platform might automerge a branch which is not up-to-date.
+This behavior is no longer guaranteed when `platformAutomerge` is `true` because the platform might automerge a branch which is not up-to-date.
 For example, GitHub might automerge a Renovate branch even if it's behind the base branch at the time.
 
 Please check platform specific docs for version requirements.
@@ -2588,7 +2578,7 @@ The `postUpgradeTasks` configuration consists of three fields:
 
 A list of commands that are executed after Renovate has updated a dependency but before the commit is made.
 
-You can use variable templating in your commands if [`allowPostUpgradeCommandTemplating`](https://docs.renovatebot.com/self-hosted-configuration/#allowpostupgradecommandtemplating) is enabled.
+You can use variable templating in your commands as long as [`allowPostUpgradeCommandTemplating`](https://docs.renovatebot.com/self-hosted-configuration/#allowpostupgradecommandtemplating) is enabled.
 
 <!-- prettier-ignore -->
 !!! note
@@ -2597,6 +2587,7 @@ You can use variable templating in your commands if [`allowPostUpgradeCommandTem
 ### fileFilters
 
 A list of glob-style matchers that determine which files will be included in the final commit made by Renovate.
+Dotfiles are included.
 
 ### executionMode
 
@@ -3250,9 +3241,8 @@ There are times when a dependency version in use by a project gets removed from
 For some registries, existing releases or even whole packages can be removed or "yanked" at any time, while for some registries only very new or unused releases can be removed.
 Renovate's "rollback" feature exists to propose a downgrade to the next-highest release if the current release is no longer found in the registry.
 
-Renovate does not create these rollback PRs by default, with one exception: npm packages get a rollback PR if needed.
-
-You can configure the `rollbackPrs` property globally, per-language, or per-package to override the default behavior.
+Renovate does not create these rollback PRs by default, so this functionality needs to be opted-into.
+We recommend you do this selectively with `packageRules` and not globally.
 
 ## ruby
 

docs/usage/key-concepts/automerge.md

@@ -100,9 +100,8 @@ Say you want to automerge `patch` and `minor` updates for packages in the `group
 
 ### Faster merges with platform-native automerge
 
-You can speed up merges by letting Renovate use your platform's native automerge.
-The config option is called `platformAutomerge`.
-If `automerge=true` and `automergeType=pr` then you can set `platformAutomerge=true`.
+By default, Renovate uses platform-native automerge to speed up automerging.
+If you don't want Renovate to use the platform-native automerge, then set `platformAutomerge` to `false`.
 
 For example:
 
@@ -112,7 +111,7 @@ For example:
     "enabled": true,
     "automerge": true,
     "automergeType": "pr",
-    "platformAutomerge": true
+    "platformAutomerge": false
   }
 }
 ```
@@ -155,11 +154,10 @@ On `github.com`, go to your repository's "homepage", click on Settings, scroll d
 Then go to your repository's branch protection rules for your base branch (usually `main`) and enable the "Require merge queue" setting.
 Confirm you've set the correct "required checks" for your base branch.
 
-Finally, allow Renovate to automerge by setting `automerge=true` and `platformAutomerge=true` in your Renovate config file, for example:
+Finally, allow Renovate to automerge by setting `automerge=true` in your Renovate config file, for example:
 
 ```json
 {
-  "platformAutomerge": true,
   "packageRules": [
     {
       "description": "Automerge non-major updates",
@@ -180,7 +178,7 @@ On `github.com`, go to your repository's "homepage", click on Settings, scroll d
 Go to your repository's branch protection rules for your base branch (usually `main`) and enable the "Require merge queue" setting.
 Confirm you've set the correct "required checks" for your base branch.
 
-Finally, allow Renovate to automerge by setting `automerge=true` and `platformAutomerge=true` in your Renovate config file (see earlier example).
+Finally, allow Renovate to automerge by setting `automerge=true` in your Renovate config file (see earlier example).
 
 ## Automerging and scheduling
 

docs/usage/self-hosted-configuration.md

@@ -19,22 +19,17 @@ Please also see [Self-Hosted Experimental Options](./self-hosted-experimental.md
 
 ## allowPostUpgradeCommandTemplating
 
-Set to `true` to allow templating of dependency level post-upgrade commands.
-
 Let's look at an example of configuring packages with existing Angular migrations.
 
-Add two properties to `config.js`: `allowPostUpgradeCommandTemplating` and `allowedPostUpgradeCommands`:
-
 ```javascript
 module.exports = {
-  allowPostUpgradeCommandTemplating: true,
   allowedPostUpgradeCommands: ['^npm ci --ignore-scripts$', '^npx ng update'],
 };
 ```
 
 In the `renovate.json` file, define the commands and files to be included in the final commit.
 
-The command to install dependencies (`npm ci --ignore-scripts`) is needed because, by default, the installation of dependencies is skipped (see the `skipInstalls` global option).
+The command to install dependencies (`npm ci --ignore-scripts`) is needed because, by default, the installation of dependencies is skipped.
 
 ```json
 {
@@ -60,6 +55,9 @@ npm ci --ignore-scripts
 npx ng update @angular/core --from=10.0.0 --to=11.0.0 --migrate-only --allow-dirty --force
 ```
 
+If you wish to disable templating because of any security or performance concern, you may set `allowPostUpgradeCommandTemplating` to `false`.
+But before you disable templating completely, try the `allowedPostUpgradeCommands` config option to limit what commands are allowed to run.
+
 ## allowScripts
 
 ## allowedPostUpgradeCommands
@@ -798,12 +796,6 @@ It could then be used in a repository config or preset like so:
 
 Secret names must start with an upper or lower case character and can have only characters, digits, or underscores.
 
-## skipInstalls
-
-By default, Renovate will use the most efficient approach to updating package files and lock files, which in most cases skips the need to perform a full module install by the bot.
-If this is set to false, then a full install of modules will be done.
-This is currently applicable to `npm` and `lerna`/`npm` only, and only used in cases where bugs in `npm` result in incorrect lock files being updated.
-
 ## token
 
 ## unicodeEmoji

lib/config/__snapshots__/migration.spec.ts.snap

@@ -164,7 +164,7 @@ exports[`config/migration migrateConfig(config, parentConfig) migrates config 1`
         "extends": [
           "node",
         ],
-        "matchPaths": [
+        "matchFileNames": [
           "node/**",
         ],
       },
@@ -211,7 +211,7 @@ exports[`config/migration migrateConfig(config, parentConfig) migrates config 1`
       "extends": [
         "foo",
       ],
-      "matchPaths": [
+      "matchFileNames": [
         "examples/**",
       ],
     },
@@ -293,7 +293,7 @@ exports[`config/migration migrateConfig(config, parentConfig) migrates more pack
       "matchDepTypes": [
         "devDependencies",
       ],
-      "matchPaths": [
+      "matchFileNames": [
         "package.json",
       ],
       "rangeStrategy": "pin",
@@ -302,7 +302,7 @@ exports[`config/migration migrateConfig(config, parentConfig) migrates more pack
       "matchDepTypes": [
         "dependencies",
       ],
-      "matchPaths": [
+      "matchFileNames": [
         "package.json",
       ],
       "rangeStrategy": "pin",
@@ -332,13 +332,13 @@ exports[`config/migration migrateConfig(config, parentConfig) migrates packageFi
   ],
   "packageRules": [
     {
-      "matchPaths": [
+      "matchFileNames": [
         "backend/package.json",
       ],
       "rangeStrategy": "replace",
     },
     {
-      "matchPaths": [
+      "matchFileNames": [
         "frontend/package.json",
       ],
       "rangeStrategy": "pin",
@@ -347,7 +347,7 @@ exports[`config/migration migrateConfig(config, parentConfig) migrates packageFi
       "matchDepTypes": [
         "devDependencies",
       ],
-      "matchPaths": [
+      "matchFileNames": [
         "other/package.json",
       ],
       "rangeStrategy": "pin",
@@ -356,7 +356,7 @@ exports[`config/migration migrateConfig(config, parentConfig) migrates packageFi
       "matchDepTypes": [
         "dependencies",
       ],
-      "matchPaths": [
+      "matchFileNames": [
         "other/package.json",
       ],
       "rangeStrategy": "pin",

lib/config/index.spec.ts

@@ -91,7 +91,6 @@ describe('config/index', () => {
       const config = getManagerConfig(parentConfig, 'npm');
       expect(config).toContainEntries([
         ['fileMatch', ['(^|/)package\\.json$']],
-        ['rollbackPrs', true],
       ]);
       expect(getManagerConfig(parentConfig, 'html')).toContainEntries([
         ['fileMatch', ['\\.html?$']],