renovate-mcp 1.3.2 → 1.4.0

package/dist/data/managers.generated.d.ts

@@ -1,4 +1,4 @@
-export declare const RENOVATE_VERSION = "43.252.0";
+export declare const RENOVATE_VERSION = "43.259.2";
 /**
  * All manager names accepted by Renovate's `matchManagers` /
  * `excludeManagers` fields. Includes both regular managers and custom

package/dist/data/managers.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-managers.mjs from renovate@43.252.0.
+// AUTO-GENERATED by scripts/generate-managers.mjs from renovate@43.259.2.
 // Do not edit by hand. Run `npm run generate:managers` to refresh.
-export const RENOVATE_VERSION = "43.252.0";
+export const RENOVATE_VERSION = "43.259.2";
 /**
  * All manager names accepted by Renovate's `matchManagers` /
  * `excludeManagers` fields. Includes both regular managers and custom

package/dist/data/migrations.generated.d.ts

@@ -1,4 +1,4 @@
-export declare const RENOVATE_VERSION = "43.252.0";
+export declare const RENOVATE_VERSION = "43.259.2";
 export interface DeprecatedKeyEntry {
     /** Key as it appeared in old configs. */
     readonly oldKey: string;

package/dist/data/migrations.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-migrations.mjs from renovate@43.252.0.
+// AUTO-GENERATED by scripts/generate-migrations.mjs from renovate@43.259.2.
 // Do not edit by hand. Run `npm run generate:migrations` to refresh.
-export const RENOVATE_VERSION = "43.252.0";
+export const RENOVATE_VERSION = "43.259.2";
 /**
  * Deprecated config keys with their current replacement. Sourced from
  * Renovate's `MigrationsService.renamedProperties` — the "RenamePropertyMigration"

package/dist/data/presets.generated.d.ts

@@ -3,6 +3,6 @@ export interface GeneratedPreset {
     description: string | null;
     body: Record<string, unknown>;
 }
-export declare const RENOVATE_VERSION = "43.252.0";
+export declare const RENOVATE_VERSION = "43.259.2";
 export declare const PRESETS: Record<string, GeneratedPreset>;
 export declare const PRESET_NAMES: readonly string[];

package/dist/data/presets.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-presets.mjs from renovate@43.252.0.
+// AUTO-GENERATED by scripts/generate-presets.mjs from renovate@43.259.2.
 // Do not edit by hand. Run `npm run generate:presets` to refresh.
-export const RENOVATE_VERSION = "43.252.0";
+export const RENOVATE_VERSION = "43.259.2";
 export const PRESETS = {
     "abandonments:recommended": {
         "namespace": "abandonments",
@@ -5363,6 +5363,27 @@ export const PRESETS = {
             ]
         }
     },
+    "group:graphql-platformMonorepo": {
+        "namespace": "group",
+        "description": null,
+        "body": {
+            "packageRules": [
+                {
+                    "description": "Group packages from graphql-platform monorepo together.",
+                    "extends": [
+                        "monorepo:graphql-platform"
+                    ],
+                    "groupName": "graphql-platform monorepo",
+                    "matchUpdateTypes": [
+                        "digest",
+                        "patch",
+                        "minor",
+                        "major"
+                    ]
+                }
+            ]
+        }
+    },
     "group:graphql-toolsMonorepo": {
         "namespace": "group",
         "description": null,
@@ -5797,27 +5818,6 @@ export const PRESETS = {
             ]
         }
     },
-    "group:hotchocolateMonorepo": {
-        "namespace": "group",
-        "description": null,
-        "body": {
-            "packageRules": [
-                {
-                    "description": "Group packages from hotchocolate monorepo together.",
-                    "extends": [
-                        "monorepo:hotchocolate"
-                    ],
-                    "groupName": "hotchocolate monorepo",
-                    "matchUpdateTypes": [
-                        "digest",
-                        "patch",
-                        "minor",
-                        "major"
-                    ]
-                }
-            ]
-        }
-    },
     "group:html-eslintMonorepo": {
         "namespace": "group",
         "description": null,
@@ -7380,6 +7380,7 @@ export const PRESETS = {
                 "group:graphql-hive-gatewayMonorepo",
                 "group:graphql-meshMonorepo",
                 "group:graphql-modulesMonorepo",
+                "group:graphql-platformMonorepo",
                 "group:graphql-toolsMonorepo",
                 "group:graphql-yogaMonorepo",
                 "group:graphqlcodegeneratorMonorepo",
@@ -7664,7 +7665,6 @@ export const PRESETS = {
                 "group:embroiderMonorepo",
                 "group:forgeMonorepo",
                 "group:fullcalendarMonorepo",
-                "group:hotchocolateMonorepo",
                 "group:oracle-databaseMonorepo",
                 "group:oxlintMonorepo",
                 "group:prometheus-simpleclientMonorepo",
@@ -14859,6 +14859,15 @@ export const PRESETS = {
             ]
         }
     },
+    "monorepo:graphql-platform": {
+        "namespace": "monorepo",
+        "description": "graphql-platform monorepo",
+        "body": {
+            "matchSourceUrls": [
+                "https://github.com/ChilliCream/graphql-platform"
+            ]
+        }
+    },
     "monorepo:graphql-tools": {
         "namespace": "monorepo",
         "description": "graphql-tools monorepo",
@@ -15023,15 +15032,6 @@ export const PRESETS = {
             ]
         }
     },
-    "monorepo:hotchocolate": {
-        "namespace": "monorepo",
-        "description": "hotchocolate monorepo",
-        "body": {
-            "matchPackageNames": [
-                "/^HotChocolate\\./"
-            ]
-        }
-    },
     "monorepo:html-eslint": {
         "namespace": "monorepo",
         "description": "html-eslint monorepo",
@@ -18160,6 +18160,25 @@ export const PRESETS = {
             ]
         }
     },
+    "replacements:corentinmusard-otel-cicd-action-to-dash0hq": {
+        "namespace": "replacements",
+        "description": "`corentinmusard/otel-cicd-action` was transferred to `dash0hq/otel-cicd-action`.",
+        "body": {
+            "packageRules": [
+                {
+                    "matchDatasources": [
+                        "github-releases",
+                        "github-tags"
+                    ],
+                    "matchPackageNames": [
+                        "corentinmusard/otel-cicd-action"
+                    ],
+                    "replacementName": "dash0hq/otel-cicd-action",
+                    "replacementVersion": "4.0.1"
+                }
+            ]
+        }
+    },
     "replacements:cpx-to-maintenance-fork": {
         "namespace": "replacements",
         "description": "Maintenance fork of `cpx`",
@@ -20221,6 +20240,48 @@ export const PRESETS = {
             ]
         }
     },
+    "security:gomodIndirectSecurityUpdates": {
+        "namespace": "security",
+        "description": "Enable go.mod indirect dependency updates only when vulnerabilities have been detected.",
+        "body": {
+            "extends": [
+                ":enableVulnerabilityAlerts"
+            ],
+            "packageRules": [
+                {
+                    "description": "Enable lookups for indirect go.mod dependencies",
+                    "enabled": true,
+                    "matchDepTypes": [
+                        "indirect"
+                    ],
+                    "matchManagers": [
+                        "gomod"
+                    ]
+                },
+                {
+                    "description": "Disable non-security updates for indirect go.mod dependencies (vulnerability alerts use force to override this)",
+                    "enabled": false,
+                    "matchDepTypes": [
+                        "indirect"
+                    ],
+                    "matchManagers": [
+                        "gomod"
+                    ],
+                    "matchUpdateTypes": [
+                        "major",
+                        "minor",
+                        "patch",
+                        "pin",
+                        "digest",
+                        "pinDigest",
+                        "lockFileMaintenance",
+                        "rollback",
+                        "replacement"
+                    ]
+                }
+            ]
+        }
+    },
     "security:minimumReleaseAgeNpm": {
         "namespace": "security",
         "description": "Wait until the npm package is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behaviour in packages, and b) prevents the maintainer and/or NPM from unpublishing a package you already upgraded to, breaking builds.",

package/dist/lib/inputLimits.d.ts

@@ -9,6 +9,8 @@ export declare const CONFIG_JSON_MAX_BYTES = 1000000;
 export declare const REPORT_JSON_MAX_BYTES = 10000000;
 export declare const HOST_RULES_MAX_ITEMS = 256;
 export declare const HOST_RULE_JSON_MAX_BYTES = 64000;
+export declare const BASE_BRANCHES_MAX_ITEMS = 50;
+export declare const BRANCH_NAME_MAX_BYTES = 256;
 export declare const pathString: (description: string) => z.ZodString;
 export declare const tokenString: (description: string) => z.ZodString;
 export declare const endpointString: (description: string) => z.ZodString;

package/dist/lib/inputLimits.js

@@ -14,6 +14,8 @@ export const CONFIG_JSON_MAX_BYTES = 1_000_000;
 export const REPORT_JSON_MAX_BYTES = 10_000_000;
 export const HOST_RULES_MAX_ITEMS = 256;
 export const HOST_RULE_JSON_MAX_BYTES = 64_000;
+export const BASE_BRANCHES_MAX_ITEMS = 50;
+export const BRANCH_NAME_MAX_BYTES = 256;
 export const pathString = (description) => z.string().max(PATH_MAX_BYTES).describe(description);
 export const tokenString = (description) => z.string().max(TOKEN_MAX_BYTES).describe(description);
 export const endpointString = (description) => z.string().max(ENDPOINT_MAX_BYTES).describe(description);

package/dist/lib/version.d.ts

@@ -1,4 +1,4 @@
-export declare const SERVER_VERSION = "1.3.2";
+export declare const SERVER_VERSION = "1.4.0";
 export type BuildMode = "local" | "released";
 export interface VersionInfo {
     version: string;

package/dist/lib/version.js

@@ -1,5 +1,5 @@
 import { fileURLToPath } from "node:url";
-export const SERVER_VERSION = "1.3.2"; // x-release-please-version
+export const SERVER_VERSION = "1.4.0"; // x-release-please-version
 // "released" = the server is running from a `node_modules/` install (global
 // `npm i -g`, project-local `npm i`, or `npx renovate-mcp`). Anything else —
 // most commonly an MCP config of `{"command": "node", "args": [".../dist/index.js"]}`

package/dist/tools/dryRun.js

@@ -11,7 +11,7 @@ import { detectLookupProblems } from "../lib/lookupProblems.js";
 import { collectSecrets, scrubSecrets, writeHostRulesConfig, } from "../lib/hostRulesConfig.js";
 import { extractRenovateLogMsg, buildDryRunHeartbeatMessage, } from "../lib/dryRunProgress.js";
 import { classifyReportProblem } from "../lib/runtimeWarnings.js";
-import { HOST_RULES_MAX_ITEMS, endpointString, hostRuleRecord, pathString, repositoryString, tokenString, } from "../lib/inputLimits.js";
+import { BASE_BRANCHES_MAX_ITEMS, BRANCH_NAME_MAX_BYTES, HOST_RULES_MAX_ITEMS, endpointString, hostRuleRecord, pathString, repositoryString, tokenString, } from "../lib/inputLimits.js";
 /**
  * Verbatim advisory warning emitted by `dry_run` when an inline secret is
  * detected on the tool input (the top-level `token` parameter or any non-empty
@@ -152,7 +152,7 @@ function countUpdates(report) {
 export function registerDryRun(server) {
     server.registerTool("dry_run", {
         title: "Dry-run Renovate",
-        description: "Run Renovate in dry-run mode to preview what it would do — no PRs opened, no git pushes. Returns a structured JSON report plus a top-level `ok` boolean (false when the CLI failed OR the report records a validation/error-level problem, even if the exit code was 0). RE2 native-module fallback noise and Renovate's `Unsupported node environment` notice are filtered out of `reportErrors` — the former flows into `warnings` (still actionable, still surfaced), the latter into a separate `environmentWarnings[]` since the run still produced a usable report.\n\nEffective platform = `platform` input → `RENOVATE_PLATFORM` env → `local`. The `platformSource` field on the result echoes which step won; preflight errors and the env-overrides-default advisory both reference it so callers don't have to read the source to find where a surprising `gitlab`/`github` came from.\n\nThe full structured report ships inline by default. For large repos that is bigger than most MCP clients' response-content cap (≈75 KB on Claude Desktop) and the middle of the JSON is silently truncated. Pass `reportOutputPath` to redirect the structured report to a file (mode 0600), in which case `summary.report` collapses to `{ reportPath, repoCount, updateCount }` and `dry_run_diff` can pick it up via `{ reportPath: … }`. Pair with `summaryOnly: true` to also strip per-repo upgrade arrays from the inline payload when you only need the path + counts. `warnings`, `problems`, `reportErrors`, and `environmentWarnings` always stay inline regardless of these flags — those are the actionable bits.\n\n**Auth — prefer env vars.** Set `RENOVATE_TOKEN` (or `GITHUB_TOKEN` / `GITLAB_TOKEN`, auto-translated to `RENOVATE_TOKEN` for the spawned Renovate CLI) on the MCP server's env via `claude_desktop_config.json` / `.mcp.json`. This matches the precedence `resolve_config` uses, so a single `GITLAB_TOKEN` in `.mcp.json` works for both tools. The `token` input is retained as an ad-hoc / testing fallback — when supplied inline it is persisted in the MCP tool transcript that the client may share, replay, or feed back into the LLM, so an advisory entry is appended to the result `warnings` array steering callers toward env-var auth. For a remote-platform run, an actionable preflight error is returned before spawning Renovate when no token can be resolved at all.\n\nDefault mode runs `--platform=local` against the filesystem at `repoPath`. If your config extends `local>…` presets, pass `platform` (`github` or `gitlab`), `endpoint` (API base URL), `token`, and `repository` to run as a real platform client that can actually fetch those presets — Renovate still runs with `--dry-run`, so no PRs are opened. If you only need `gitlab>…` / `github>…` presets resolved against a self-hosted host (not a full remote run), pass just `endpoint` (and `token` if needed) while leaving `platform` unset — both flow through to Renovate in local mode too, which is enough to redirect those preset shortcuts away from the public defaults. The tool preflight-checks for `local>` presets under `--platform=local` (in `lookup` and `full` modes) and fails fast with remediation guidance rather than spawning a Renovate run that would fail opaquely with `config-validation`. The preflight is skipped for `dryRunMode=extract` so manifest-only extraction can be attempted regardless.\n\nCredentials for private registries (e.g. `COMPOSER_AUTH` for Packagist/Satis proxies, `NPM_TOKEN` / `.npmrc` for npm, Docker registry creds, `RENOVATE_HOST_RULES` for anything else) must be set on the MCP server process itself — via the `env` key in `claude_desktop_config.json` / `.mcp.json`, not your shell, since the MCP server runs as a child of Claude and does not inherit shell env. Alternatively, encode credentials as `hostRules` in the Renovate config, or pass them per-call via the `hostRules` input on this tool (written to a mode-0600 temp file that is cleaned up after the run; token/password values — including the platform `token` input — are scrubbed from `logTail` and `problems`). Per-call `hostRules` are appended to any the repo's own config already declares. If a lookup can't auth to a registry, Renovate often reports 0 updates without a loud error; when that happens this tool surfaces detected auth failures under `problems` in the output so callers can distinguish a genuine \"no updates\" from a silent registry-auth failure.",
+        description: "Run Renovate in dry-run mode to preview what it would do — no PRs opened, no git pushes. Returns a structured JSON report plus a top-level `ok` boolean (false when the CLI failed OR the report records a validation/error-level problem, even if the exit code was 0). RE2 native-module fallback noise and Renovate's `Unsupported node environment` notice are filtered out of `reportErrors` — the former flows into `warnings` (still actionable, still surfaced), the latter into a separate `environmentWarnings[]` since the run still produced a usable report.\n\nEffective platform = `platform` input → `RENOVATE_PLATFORM` env → `local`. The `platformSource` field on the result echoes which step won; preflight errors and the env-overrides-default advisory both reference it so callers don't have to read the source to find where a surprising `gitlab`/`github` came from.\n\nThe full structured report ships inline by default. For large repos that is bigger than most MCP clients' response-content cap (≈75 KB on Claude Desktop) and the middle of the JSON is silently truncated. Pass `reportOutputPath` to redirect the structured report to a file (mode 0600), in which case `summary.report` collapses to `{ reportPath, repoCount, updateCount }` and `dry_run_diff` can pick it up via `{ reportPath: … }`. Pair with `summaryOnly: true` to also strip per-repo upgrade arrays from the inline payload when you only need the path + counts. `warnings`, `problems`, `reportErrors`, and `environmentWarnings` always stay inline regardless of these flags — those are the actionable bits.\n\n**Custom base branches.** By default Renovate evaluates the repository's default branch. Pass `baseBranches` to evaluate other branches instead — this is how you dry-run a Renovate config change that lives on a feature branch before merging it. Entries are exact branch names; regex requires `/…/` wrapping (e.g. `/^renovate\\/.+/`, negate with `!/…/`) — bare `^foo` is matched literally, not as regex. `$default` expands to the default branch. With `readConfigFromBaseBranch` (default true) Renovate also reads its config FROM those branches (`useBaseBranchConfig=merge`), so the branch's edited config is what gets evaluated; set it false to scan the branches' manifests using the default branch's config. Base-branch selection only applies to remote-platform runs (`platform: 'github'`/`'gitlab'`) — it is ignored (with a warning) under `platform=local`.\n\n**Auth — prefer env vars.** Set `RENOVATE_TOKEN` (or `GITHUB_TOKEN` / `GITLAB_TOKEN`, auto-translated to `RENOVATE_TOKEN` for the spawned Renovate CLI) on the MCP server's env via `claude_desktop_config.json` / `.mcp.json`. This matches the precedence `resolve_config` uses, so a single `GITLAB_TOKEN` in `.mcp.json` works for both tools. The `token` input is retained as an ad-hoc / testing fallback — when supplied inline it is persisted in the MCP tool transcript that the client may share, replay, or feed back into the LLM, so an advisory entry is appended to the result `warnings` array steering callers toward env-var auth. For a remote-platform run, an actionable preflight error is returned before spawning Renovate when no token can be resolved at all.\n\nDefault mode runs `--platform=local` against the filesystem at `repoPath`. If your config extends `local>…` presets, pass `platform` (`github` or `gitlab`), `endpoint` (API base URL), `token`, and `repository` to run as a real platform client that can actually fetch those presets — Renovate still runs with `--dry-run`, so no PRs are opened. If you only need `gitlab>…` / `github>…` presets resolved against a self-hosted host (not a full remote run), pass just `endpoint` (and `token` if needed) while leaving `platform` unset — both flow through to Renovate in local mode too, which is enough to redirect those preset shortcuts away from the public defaults. The tool preflight-checks for `local>` presets under `--platform=local` (in `lookup` and `full` modes) and fails fast with remediation guidance rather than spawning a Renovate run that would fail opaquely with `config-validation`. The preflight is skipped for `dryRunMode=extract` so manifest-only extraction can be attempted regardless.\n\nCredentials for private registries (e.g. `COMPOSER_AUTH` for Packagist/Satis proxies, `NPM_TOKEN` / `.npmrc` for npm, Docker registry creds, `RENOVATE_HOST_RULES` for anything else) must be set on the MCP server process itself — via the `env` key in `claude_desktop_config.json` / `.mcp.json`, not your shell, since the MCP server runs as a child of Claude and does not inherit shell env. Alternatively, encode credentials as `hostRules` in the Renovate config, or pass them per-call via the `hostRules` input on this tool (written to a mode-0600 temp file that is cleaned up after the run; token/password values — including the platform `token` input — are scrubbed from `logTail` and `problems`). Per-call `hostRules` are appended to any the repo's own config already declares. If a lookup can't auth to a registry, Renovate often reports 0 updates without a loud error; when that happens this tool surfaces detected auth failures under `problems` in the output so callers can distinguish a genuine \"no updates\" from a silent registry-auth failure.",
         inputSchema: {
             repoPath: pathString("Absolute path to the repository root. Required for the default `platform=local` mode. When `platform` is overridden (e.g. `gitlab` / `github`), Renovate runs against the remote `repository` instead — `repoPath` is still used as the child's working directory but its manifest files are ignored."),
             dryRunMode: z
@@ -184,8 +184,17 @@ export function registerDryRun(server) {
                 .boolean()
                 .optional()
                 .describe("Only meaningful in combination with `reportOutputPath`. When true, also strips per-repo `branches[]`/`packageFiles` arrays from the inline summary so the response is purely the path + counts + actionable lists. No effect when `reportOutputPath` is unset."),
+            baseBranches: z
+                .array(z.string().min(1).max(BRANCH_NAME_MAX_BYTES))
+                .max(BASE_BRANCHES_MAX_ITEMS)
+                .optional()
+                .describe("One or more base branches to evaluate instead of the repository's default branch (Renovate's `baseBranchPatterns`). Each entry is an EXACT branch name unless it is wrapped in slashes: only `/…/`-delimited entries are treated as regex (optionally `!/…/` to negate) — a bare `^release/.*` is matched literally as a branch named `^release/.*` and will never match. The magic value `$default` expands to the repository's default branch. This is what lets you dry-run a Renovate config change that lives on a non-default branch (e.g. a feature branch) before it is merged. Maps to the `RENOVATE_BASE_BRANCH_PATTERNS` env var — `baseBranchPatterns` is not a CLI flag. Only applies to remote-platform runs (`platform: 'github'`/`'gitlab'`); ignored under `platform=local`, which always inspects the working tree at `repoPath`. See also `readConfigFromBaseBranch`."),
+            readConfigFromBaseBranch: z
+                .boolean()
+                .optional()
+                .describe("Only meaningful together with `baseBranches`. When true (default), Renovate reads its config (renovate.json/.json5) FROM each base branch — `useBaseBranchConfig=merge` — so a config edit that only exists on that branch is actually evaluated. Set false to scan the base branches' manifests while still using the default branch's config."),
         },
-    }, async ({ repoPath, dryRunMode, logLevel, timeoutMs, platform, endpoint, token, repository, hostRules, reportOutputPath, summaryOnly, }, extra) => {
+    }, async ({ repoPath, dryRunMode, logLevel, timeoutMs, platform, endpoint, token, repository, hostRules, reportOutputPath, summaryOnly, baseBranches, readConfigFromBaseBranch, }, extra) => {
         if (endpoint !== undefined) {
             try {
                 validateEndpoint(endpoint);
@@ -376,6 +385,36 @@ export function registerDryRun(server) {
                 // and passing it crashes the CLI with "unknown option".
                 childEnv.RENOVATE_CONFIG_FILE = hostRulesConfigPath;
             }
+            // Base-branch selection. `baseBranchPatterns` (the option formerly
+            // known as `baseBranches`) is `cli:false` in Renovate, so it can only
+            // be supplied via env, not a flag. Renovate coerces the array option
+            // from a JSON5/JSON string (falling back to comma-split), so a JSON
+            // array is the unambiguous encoding even for branch names with commas.
+            // Base branches are a remote concept — under `--platform=local`
+            // Renovate inspects the working tree at `repoPath` and never resolves
+            // branches, so the input would silently do nothing; warn instead.
+            if (baseBranches !== undefined) {
+                if (baseBranches.length === 0) {
+                    mcpWarnings.push("`baseBranches` was ignored: an empty array has no effect. Pass at least one exact branch name or a `/…/`-wrapped regex pattern.");
+                }
+                else if (isRemotePlatform) {
+                    childEnv.RENOVATE_BASE_BRANCH_PATTERNS = JSON.stringify(baseBranches);
+                    // Patterns alone only change WHICH branches are scanned for
+                    // manifests; Renovate still reads its config from the default
+                    // branch unless `useBaseBranchConfig=merge`. Enable it by default
+                    // so a config change living on a non-default branch is actually
+                    // evaluated — the headline use case for this input.
+                    if (readConfigFromBaseBranch ?? true) {
+                        childEnv.RENOVATE_USE_BASE_BRANCH_CONFIG = "merge";
+                    }
+                }
+                else {
+                    mcpWarnings.push("`baseBranches` was ignored: base-branch selection requires a remote-platform run (`platform: 'github'` / `'gitlab'`). Under `platform=local` Renovate only inspects the working tree at `repoPath`.");
+                }
+            }
+            else if (readConfigFromBaseBranch !== undefined) {
+                mcpWarnings.push("`readConfigFromBaseBranch` was ignored: it only has an effect together with `baseBranches`.");
+            }
             if (progressEnabled) {
                 emit(`Starting Renovate dry-run (${dryRunMode})`);
                 heartbeat = setInterval(() => emit(buildDryRunHeartbeatMessage(Date.now() - startedAt, lastLogMsg)), HEARTBEAT_MS);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "renovate-mcp",
-  "version": "1.3.2",
+  "version": "1.4.0",
   "description": "MCP server for designing Renovate configurations interactively.",
   "type": "module",
   "bin": {
@@ -64,7 +64,7 @@
     "json5": "^2.2.3",
     "jsonata": "2.2.1",
     "jsonc-parser": "^3.3.1",
-    "renovate": "^43.252.0",
+    "renovate": "^43.259.2",
     "smol-toml": "^1.6.1",
     "yaml": "^2.9.0",
     "zod": "^4.0.0"
@@ -77,7 +77,7 @@
   "devDependencies": {
     "@types/node": "^24.0.0",
     "@vitest/coverage-v8": "^4.1.0",
-    "typescript": "^6.0.0",
+    "typescript": "^7.0.0",
     "vitest": "^4.1.0"
   },
   "license": "MIT"