renovate-mcp 1.5.5 → 1.6.0

package/README.md

@@ -32,7 +32,7 @@ Restart your client and try the prompt: *"List the namespaces available under `r
 
 - **Read and explain configs** — locate the active `renovate.json*`, expand every `extends` preset offline, and trace which preset set each field.
 - **Discover presets from intent** — describe what you want ("automerge patches, group dev deps") and get ranked built-in (and your own local-repo) presets, plus a draft config skeleton when nothing fits.
-- **Preview custom managers** before running Renovate — regex and JSONata, with file/line hits and extracted dep info.
+- **Preview custom managers** before running Renovate — regex and JSONata, with Renovate's `managerFilePatterns` glob/regex file selection, file/line hits and extracted dep info.
 - **Validate and lint** — schema validation plus a semantic lint pass for Renovate-specific footguns (unwrapped regexes, unknown manager names, deprecated keys).
 - **Dry-run** against a local checkout or a remote GitHub/GitLab — see exactly which PRs Renovate would open.
 - **Save back atomically** — round-trip writes preserve comments and key order in existing JSON-with-comments files.
@@ -80,7 +80,7 @@ Seventeen tools, six resources, and three workflow prompts. Each tool name below
 - **Linux or macOS.** Windows is not supported — `package.json` declares `"os": ["darwin", "linux"]`, so `npm i` surfaces an `EBADPLATFORM` warning on Windows and the server exits with a clear stderr message at startup. Use WSL2 or a Linux/macOS host instead.
 - **Node.js ≥ 24** (aligns with Renovate's own engine requirement).
 
-Renovate ships bundled — the `renovate` package is a runtime dependency, so `validate_config`, `dry_run`, and `write_config` work out of the box with no separate install. The offline tools (`read_config`, `suggest_presets`, `resolve_config`, `explain_config`, `resolve_config_diff`, `preview_custom_manager`, `lint_config`, `explain_dependency`) never spawn Renovate at all.
+Renovate ships bundled — the `renovate` package is a runtime dependency, so `validate_config`, `dry_run`, and `write_config` work out of the box with no separate install. The offline tools (`read_config`, `suggest_presets`, `resolve_config`, `explain_config`, `resolve_config_diff`, `test_package_rules`, `preview_custom_manager`, `lint_config`, `dry_run_diff`, `annotate_dry_run`, `explain_dependency`, `migrate_config`) never spawn Renovate at all — nor do `check_setup` (by default it reads version metadata from the bundled install instead of spawning) or `get_version` (it only reports the renovate-mcp server's own version).
 
 **Optional env vars:**
 
@@ -156,8 +156,9 @@ Once the server is wired up, try prompts like these. Written for Claude but work
 
 **Authoring a custom manager (regex or JSONata)**
 
-- "I have `# renovate: datasource=docker depName=...` comments above image tags in my Dockerfiles. Draft a `customManagers` regex entry and preview it against this repo so I can see what it extracts."
-- "Here's a `customManagers` entry — preview it and tell me which files match, which lines hit each `matchStrings` regex, and what dep info gets extracted."
+- "I have `# renovate: datasource=docker depName=...` comments above image tags in my Dockerfiles. Draft a `customManagers` regex entry with `managerFilePatterns: ["**/Dockerfile"]` and preview it against this repo so I can see what it extracts."
+- "Here's a `customManagers` entry — preview it and tell me which files match `managerFilePatterns`, which lines hit each `matchStrings` regex, and what dep info gets extracted."
+- "My custom manager still uses `fileMatch`. Lint the config, then run `migrate_config` so it becomes `managerFilePatterns`."
 - "Draft a `customType: \"jsonata\"` customManager with `fileFormat: \"yaml\"` to extract Helm chart dependencies (`name`, `version`, `repository`) from `Chart.yaml`, and preview it against this repo."
 
 **Validating, previewing, saving**
@@ -173,8 +174,8 @@ A transcript-style walkthrough: design a Dockerfile custom manager from scratch,
 
 > **You:** I've got `# renovate: datasource=docker depName=<image>` comments above `FROM` lines in my Dockerfiles. Draft a `customManagers` entry and preview it against this repo.
 >
-> **Claude** calls `preview_custom_manager` with a first-draft `fileMatch` + `matchStrings`.
-> → 4 Dockerfiles matched `fileMatch`, 0 lines matched `matchStrings`. The regex anchored on `ARG`, but the Dockerfiles use `FROM`.
+> **Claude** calls `preview_custom_manager` with a first-draft `managerFilePatterns` (`**/Dockerfile`) + `matchStrings`.
+> → 4 Dockerfiles matched `managerFilePatterns`, 0 lines matched `matchStrings`. The regex anchored on `ARG`, but the Dockerfiles use `FROM`.
 >
 > **You:** Rewrite `matchStrings` to anchor on the renovate comment, then `FROM <image>:<version>` on the next line.
 >
@@ -207,6 +208,7 @@ npm run generate:presets        # regenerate src/data/presets.generated.ts
 npm run generate:managers       # regenerate src/data/managers.generated.ts
 npm run generate:migrations     # regenerate src/data/migrations.generated.ts
 npm run generate:options        # regenerate src/data/options.generated.ts
+npm run sync:jsonata-pin        # sync package.json's jsonata pin to Renovate's own
 npm run check:snapshot-versions # fail if any src/data/*.generated.ts is stale vs installed renovate
 ```
 
@@ -225,5 +227,5 @@ See [`docs/development.md`](docs/development.md) for snapshot-file mechanics, CI
 
 - **Not a Renovate replacement.** This server doesn't open PRs, run scheduled updates, or execute in CI — it's a design-time companion for a local `renovate.json`. Use the real Renovate for the actual dependency-update pipeline.
 - **`resolve_config` merges faithfully.** Preset expansion runs offline against a committed snapshot, then folds with Renovate's real `mergeChildConfig` in a worker thread — `mergeQuality: "faithful"` (it falls back to an approximate in-process merge as `"preview"` only if the worker is unavailable). Template substitution still implements only positional `{{argN}}` placeholders — non-positional tokens and Handlebars helpers are flagged in `warnings` and pass through verbatim. For full config resolution (datasource lookups, etc.), run `dry_run`.
-- **`preview_custom_manager` is a subset of Renovate's custom managers.** It covers `customType: "regex"` (with `matchStringsStrategy` of `any` / `combination` / `recursive`) and `customType: "jsonata"` (with `fileFormat: "json" | "yaml" | "toml"`). Template substitution is `{{groupName}}` only — full Handlebars helpers/conditionals are not implemented. Other custom types (e.g. `html`) are out of scope. Use it for fast iteration; confirm with `dry_run`. Full coverage matrix in [`docs/tools.md#preview_custom_manager`](docs/tools.md#preview_custom_manager).
-- **`validate_config` / `dry_run` aren't exercised end-to-end in CI.** The bundled Renovate is available (it's a runtime dep), but the integration tests use fake binaries via `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` env overrides for determinism and speed. Run the tools locally against a real config to validate behaviour.
+- **`preview_custom_manager` is a subset of Renovate's custom managers.** It covers `customType: "regex"` (with `matchStringsStrategy` of `any` / `combination` / `recursive`) and `customType: "jsonata"` (with `fileFormat: "json" | "yaml" | "toml"`). File selection follows Renovate's `managerFilePatterns` semantics (globs or `/regex/`, entries unioned like Renovate's extract phase); the deprecated `fileMatch` is still accepted with a warning. Template substitution is `{{groupName}}` only — full Handlebars helpers/conditionals are not implemented. Other custom types (e.g. `html`) are out of scope. Use it for fast iteration; confirm with `dry_run`. Full coverage matrix in [`docs/tools.md#preview_custom_manager`](docs/tools.md#preview_custom_manager).
+- **`dry_run` still uses fake binaries in CI.** The bundled Renovate is available (it's a runtime dependency), and `validate_config` / `write_config` now have one real-validator integration test (`test/integration/realValidator.test.ts`) exercising the actual bundled `renovate-config-validator` — but `dry_run` itself still runs per-PR against fake binaries via `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` env overrides, for determinism and speed. A separate nightly workflow re-runs the full suite against `renovate@latest` end-to-end. Run `dry_run` locally against a real config to validate behaviour.

package/dist/data/managers.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-managers.mjs from renovate@44.103.6.
+// AUTO-GENERATED by scripts/generate-managers.mjs from renovate@44.115.10.
 // Do not edit by hand. Run `npm run generate:managers` to refresh.
-export const RENOVATE_VERSION = "44.103.6";
+export const RENOVATE_VERSION = "44.115.10";
 /**
  * All manager names accepted by Renovate's `matchManagers` /
  * `excludeManagers` fields. Includes both regular managers and custom

package/dist/data/migrations.generated.js

@@ -1,12 +1,13 @@
-// AUTO-GENERATED by scripts/generate-migrations.mjs from renovate@44.103.6.
+// AUTO-GENERATED by scripts/generate-migrations.mjs from renovate@44.115.10.
 // Do not edit by hand. Run `npm run generate:migrations` to refresh.
-export const RENOVATE_VERSION = "44.103.6";
+export const RENOVATE_VERSION = "44.115.10";
 /**
- * Deprecated config keys with their current replacement. Sourced from
- * Renovate's `MigrationsService.renamedProperties` — the "RenamePropertyMigration"
- * subset only. Value coercions (e.g. `stabilityDays` → `minimumReleaseAge`)
- * and structural transformations are deliberately excluded; `migrate_config`
- * is the right tool for those.
+ * Deprecated config keys. Sourced from Renovate's `MigrationsService`:
+ * `renamedProperties` (plain renames, with `newKey`) plus every
+ * `customMigrations` class flagged `deprecated` (value coercions such as
+ * `stabilityDays` → `minimumReleaseAge`, structural rewrites such as
+ * `fileMatch` → `managerFilePatterns`; no `newKey` — `migrate_config`
+ * shows the replacement).
  */
 export const DEPRECATED_KEYS = Object.freeze([
     {
@@ -21,14 +22,29 @@ export const DEPRECATED_KEYS = Object.freeze([
         "oldKey": "allowedPostUpgradeCommands",
         "newKey": "allowedCommands"
     },
+    {
+        "oldKey": "automergeMajor"
+    },
+    {
+        "oldKey": "automergeMinor"
+    },
+    {
+        "oldKey": "automergePatch"
+    },
     {
         "oldKey": "azureAutoApprove",
         "newKey": "autoApprove"
     },
+    {
+        "oldKey": "baseBranch"
+    },
     {
         "oldKey": "baseBranches",
         "newKey": "baseBranchPatterns"
     },
+    {
+        "oldKey": "compatibility"
+    },
     {
         "oldKey": "customChangelogUrl",
         "newKey": "changelogUrl"
@@ -45,6 +61,24 @@ export const DEPRECATED_KEYS = Object.freeze([
         "oldKey": "exposeEnv",
         "newKey": "exposeAllEnv"
     },
+    {
+        "oldKey": "fetchReleaseNotes"
+    },
+    {
+        "oldKey": "fileMatch"
+    },
+    {
+        "oldKey": "gomodTidy"
+    },
+    {
+        "oldKey": "ignoreNodeModules"
+    },
+    {
+        "oldKey": "ignoreNpmrcFile"
+    },
+    {
+        "oldKey": "includeForks"
+    },
     {
         "oldKey": "keepalive",
         "newKey": "keepAlive"
@@ -89,6 +123,33 @@ export const DEPRECATED_KEYS = Object.freeze([
         "oldKey": "multipleMajorPrs",
         "newKey": "separateMultipleMajor"
     },
+    {
+        "oldKey": "packageFiles"
+    },
+    {
+        "oldKey": "packageName"
+    },
+    {
+        "oldKey": "packagePattern"
+    },
+    {
+        "oldKey": "packages"
+    },
+    {
+        "oldKey": "pathRules"
+    },
+    {
+        "oldKey": "pinVersions"
+    },
+    {
+        "oldKey": "rebaseConflictedPrs"
+    },
+    {
+        "oldKey": "rebaseStalePrs"
+    },
+    {
+        "oldKey": "recreateClosed"
+    },
     {
         "oldKey": "regexManagers",
         "newKey": "customManagers"
@@ -97,12 +158,39 @@ export const DEPRECATED_KEYS = Object.freeze([
         "oldKey": "renovate-config-presets",
         "newKey": "renovate-config"
     },
+    {
+        "oldKey": "renovateFork"
+    },
+    {
+        "oldKey": "requiredStatusChecks"
+    },
+    {
+        "oldKey": "semanticPrefix"
+    },
     {
         "oldKey": "separatePatchReleases",
         "newKey": "separateMinorPatch"
     },
+    {
+        "oldKey": "stabilityDays"
+    },
+    {
+        "oldKey": "trustLevel"
+    },
+    {
+        "oldKey": "unpublishSafe"
+    },
+    {
+        "oldKey": "updateLockFiles"
+    },
+    {
+        "oldKey": "upgradeInRange"
+    },
     {
         "oldKey": "versionScheme",
         "newKey": "versioning"
+    },
+    {
+        "oldKey": "versionStrategy"
     }
 ]);

package/dist/data/options.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-options.mjs from renovate@44.103.6.
+// AUTO-GENERATED by scripts/generate-options.mjs from renovate@44.115.10.
 // Do not edit by hand. Run `npm run generate:options` to refresh.
-export const RENOVATE_VERSION = "44.103.6";
+export const RENOVATE_VERSION = "44.115.10";
 export const OPTIONS = {
     "abandonmentThreshold": {
         "description": "Flags packages that have not been updated within this period as abandoned.",
@@ -1403,7 +1403,7 @@ export const OPTIONS = {
     "dockerSidecarImage": {
         "description": "Change this value to override the default Renovate sidecar image.",
         "type": "string",
-        "default": "ghcr.io/renovatebot/base-image:13.99.5",
+        "default": "ghcr.io/renovatebot/base-image:13.102.5",
         "globalOnly": true,
         "deprecationMsg": "The usage of `binarySource=docker` is deprecated, and will be removed in the future"
     },
@@ -2905,6 +2905,16 @@ export const OPTIONS = {
         "cli": false,
         "env": false
     },
+    "matchIsBreaking": {
+        "description": "Matches only if the update is considered breaking (e.g. major, or minor for 0.x in ecosystems like Cargo) when `true`, or non-breaking when `false`. Valid only within a `packageRules` object.",
+        "type": "boolean",
+        "parents": [
+            "packageRules"
+        ],
+        "stage": "package",
+        "cli": false,
+        "env": false
+    },
     "matchJsonata": {
         "description": "A JSONata expression to match against the full config object. Valid only within a `packageRules` object.",
         "type": "array",

package/dist/data/presets.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-presets.mjs from renovate@44.103.6.
+// AUTO-GENERATED by scripts/generate-presets.mjs from renovate@44.115.10.
 // Do not edit by hand. Run `npm run generate:presets` to refresh.
-export const RENOVATE_VERSION = "44.103.6";
+export const RENOVATE_VERSION = "44.115.10";
 export const PRESETS = {
     "abandonments:recommended": {
         "namespace": "abandonments",

package/dist/lib/configExplainer.js

@@ -1,7 +1,7 @@
-import { collectMergeSteps, OWN_SOURCE, } from "./presetResolver.js";
+import { collectMergeSteps, } from "./presetResolver.js";
 import { runMerge } from "./mergeWorker.js";
-// Re-exported for callers that historically imported the sentinel from here.
-export { OWN_SOURCE };
+import { isRecord } from "./util.js";
+import { isDeepStrictEqual } from "node:util";
 /**
  * Inverse of `resolveConfig`: instead of collapsing the preset tree into a flat
  * resolved object, annotate each leaf field with the chain of presets that set
@@ -89,16 +89,16 @@ function diffLeaves(before, after, path, onContribution) {
     for (const [key, afterVal] of Object.entries(after)) {
         const beforeVal = before[key];
         const childPath = [...path, key];
-        if (isPlainObject(afterVal)) {
-            diffLeaves(isPlainObject(beforeVal) ? beforeVal : {}, afterVal, childPath, onContribution);
+        if (isRecord(afterVal)) {
+            diffLeaves(isRecord(beforeVal) ? beforeVal : {}, afterVal, childPath, onContribution);
             continue;
         }
-        if (jsonEqual(beforeVal, afterVal))
+        if (isDeepStrictEqual(beforeVal, afterVal))
             continue;
         if (Array.isArray(beforeVal) &&
             Array.isArray(afterVal) &&
             afterVal.length > beforeVal.length &&
-            jsonEqual(afterVal.slice(0, beforeVal.length), beforeVal)) {
+            isDeepStrictEqual(afterVal.slice(0, beforeVal.length), beforeVal)) {
             // Mergeable-array concatenation: record only the tail this step appended.
             onContribution(childPath, afterVal.slice(beforeVal.length));
         }
@@ -113,7 +113,7 @@ function diffLeaves(before, after, path, onContribution) {
  * values) plus the path→contributions map produced by `diffLeaves`.
  */
 function buildAnnotated(node, path, contribByPath) {
-    if (isPlainObject(node)) {
+    if (isRecord(node)) {
         const out = {};
         for (const [key, child] of Object.entries(node)) {
             out[key] = buildAnnotated(child, [...path, key], contribByPath);
@@ -122,9 +122,6 @@ function buildAnnotated(node, path, contribByPath) {
     }
     return { value: node, setBy: contribByPath.get(JSON.stringify(path)) ?? [] };
 }
-function jsonEqual(a, b) {
-    return JSON.stringify(a) === JSON.stringify(b);
-}
 /**
  * Approximate annotated merge — the fallback when the faithful worker is
  * unavailable. Arrays concat (and concat their `setBy`), plain objects recurse,
@@ -133,7 +130,7 @@ function jsonEqual(a, b) {
  * tool produced before.
  */
 function annotateValue(value, source, via) {
-    if (isPlainObject(value)) {
+    if (isRecord(value)) {
         const out = {};
         for (const [k, v] of Object.entries(value)) {
             out[k] = annotateValue(v, source, via);
@@ -175,6 +172,3 @@ function isAnnotatedLeaf(node) {
         return false;
     return Array.isArray(node.setBy);
 }
-function isPlainObject(v) {
-    return typeof v === "object" && v !== null && !Array.isArray(v);
-}

package/dist/lib/configLinter.js

@@ -1,5 +1,6 @@
 import { ALL_MANAGERS, CUSTOM_MANAGERS } from "../data/managers.generated.js";
-import { DEPRECATED_KEYS } from "../data/migrations.generated.js";
+import { DEPRECATED_KEYS, } from "../data/migrations.generated.js";
+import { isRecord } from "./util.js";
 const REGEX_AWARE_FIELDS = new Set([
     "matchPackageNames",
     "matchDepNames",
@@ -11,7 +12,7 @@ const VALID_MANAGER_NAMES = new Set([
     ...ALL_MANAGERS,
     ...CUSTOM_MANAGERS.map((m) => `custom.${m}`),
 ]);
-const DEPRECATED_KEY_LOOKUP = new Map(DEPRECATED_KEYS.map((e) => [e.oldKey, e.newKey]));
+const DEPRECATED_KEY_LOOKUP = new Map(DEPRECATED_KEYS.map((e) => [e.oldKey, e]));
 // Hand-maintained snapshot of keys that count as "actions" on a packageRules entry
 // (i.e. keys whose presence means the rule actually *does* something to the matched
 // deps). Source of truth: `node_modules/renovate/dist/config/options/index.js` —
@@ -251,12 +252,12 @@ function isSelectorKey(key) {
         key === "excludePaths");
 }
 function checkPackageRuleWithoutAction(config, findings) {
-    if (!isPlainObject(config))
+    if (!isRecord(config))
         return;
     if (!Array.isArray(config.packageRules))
         return;
     config.packageRules.forEach((entry, i) => {
-        if (!isPlainObject(entry))
+        if (!isRecord(entry))
             return;
         const keys = Object.keys(entry);
         const selectors = [];
@@ -283,14 +284,14 @@ function checkPackageRuleWithoutAction(config, findings) {
     });
 }
 function checkContradictoryDisabled(config, findings) {
-    if (!isPlainObject(config))
+    if (!isRecord(config))
         return;
     if (config.enabled !== false)
         return;
     if (!Array.isArray(config.packageRules))
         return;
     config.packageRules.forEach((entry, i) => {
-        if (!isPlainObject(entry))
+        if (!isRecord(entry))
             return;
         if (entry.enabled !== true)
             return;
@@ -315,7 +316,7 @@ function makeAutomergeFinding(path) {
     };
 }
 function checkAutomergeWithoutType(config, findings) {
-    if (!isPlainObject(config))
+    if (!isRecord(config))
         return;
     if (config.automerge === true && !("automergeType" in config)) {
         findings.push(makeAutomergeFinding("automerge"));
@@ -323,7 +324,7 @@ function checkAutomergeWithoutType(config, findings) {
     const pkgRules = config.packageRules;
     if (Array.isArray(pkgRules)) {
         pkgRules.forEach((entry, i) => {
-            if (!isPlainObject(entry))
+            if (!isRecord(entry))
                 return;
             if (entry.automerge === true && !("automergeType" in entry)) {
                 findings.push(makeAutomergeFinding(`packageRules[${i}].automerge`));
@@ -332,7 +333,7 @@ function checkAutomergeWithoutType(config, findings) {
     }
 }
 function checkAutomergeIncludesMajor(config, findings) {
-    if (!isPlainObject(config))
+    if (!isRecord(config))
         return;
     const pkgRules = config.packageRules;
     if (!Array.isArray(pkgRules))
@@ -344,7 +345,7 @@ function checkAutomergeIncludesMajor(config, findings) {
     // findings for unrelated entries. Upgrade path: track guard ordering /
     // selector overlap per-entry if false negatives show up in practice.
     const hasLaterMajorGuard = pkgRules.some((entry) => {
-        if (!isPlainObject(entry))
+        if (!isRecord(entry))
             return false;
         if (entry.automerge !== false)
             return false;
@@ -354,7 +355,7 @@ function checkAutomergeIncludesMajor(config, findings) {
     if (hasLaterMajorGuard)
         return;
     pkgRules.forEach((entry, i) => {
-        if (!isPlainObject(entry))
+        if (!isRecord(entry))
             return;
         if (entry.automerge !== true)
             return;
@@ -393,12 +394,12 @@ function normalizeSelectorValue(v) {
     return v;
 }
 function checkDuplicatePackageRuleMatchers(config, findings) {
-    if (!isPlainObject(config))
+    if (!isRecord(config))
         return;
     const pkgRules = config.packageRules;
     if (!Array.isArray(pkgRules))
         return;
-    const signatures = pkgRules.map((entry) => isPlainObject(entry) ? selectorSignature(entry) : null);
+    const signatures = pkgRules.map((entry) => isRecord(entry) ? selectorSignature(entry) : null);
     for (let i = 0; i < signatures.length; i++) {
         if (signatures[i] === null)
             continue;
@@ -423,13 +424,13 @@ function checkDuplicatePackageRuleMatchers(config, findings) {
 }
 const HOST_RULE_SECRET_FIELDS = ["token", "password"];
 function checkHostRuleInlineSecret(config, findings) {
-    if (!isPlainObject(config))
+    if (!isRecord(config))
         return;
     const hostRules = config.hostRules;
     if (!Array.isArray(hostRules))
         return;
     hostRules.forEach((entry, i) => {
-        if (!isPlainObject(entry))
+        if (!isRecord(entry))
             return;
         for (const field of HOST_RULE_SECRET_FIELDS) {
             const value = entry[field];
@@ -450,10 +451,18 @@ function checkHostRuleInlineSecret(config, findings) {
         }
     });
 }
-function isPlainObject(v) {
-    return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function makeDeprecatedKeyFinding(oldKey, newKey, path) {
+function makeDeprecatedKeyFinding({ oldKey, newKey }, path) {
+    // Plain renames carry the replacement; custom migrations (value coercions,
+    // structural rewrites) only tell us the key is deprecated.
+    if (newKey === undefined) {
+        return {
+            ruleId: "deprecated-key",
+            severity: "warn",
+            path,
+            value: oldKey,
+            message: `Key '${oldKey}' is deprecated; Renovate migrates it automatically — run migrate_config to see the replacement.`,
+        };
+    }
     return {
         ruleId: "deprecated-key",
         severity: "warn",
@@ -464,25 +473,24 @@ function makeDeprecatedKeyFinding(oldKey, newKey, path) {
     };
 }
 function checkDeprecatedKeys(config, findings) {
-    if (!isPlainObject(config))
+    if (!isRecord(config))
         return;
     for (const key of Object.keys(config)) {
-        const replacement = DEPRECATED_KEY_LOOKUP.get(key);
-        if (replacement !== undefined) {
-            findings.push(makeDeprecatedKeyFinding(key, replacement, key));
-        }
+        const entry = DEPRECATED_KEY_LOOKUP.get(key);
+        if (entry)
+            findings.push(makeDeprecatedKeyFinding(entry, key));
     }
     for (const container of DEPRECATED_KEY_CONTAINERS) {
         const arr = config[container];
         if (!Array.isArray(arr))
             continue;
-        arr.forEach((entry, i) => {
-            if (!isPlainObject(entry))
+        arr.forEach((item, i) => {
+            if (!isRecord(item))
                 return;
-            for (const key of Object.keys(entry)) {
-                const replacement = DEPRECATED_KEY_LOOKUP.get(key);
-                if (replacement !== undefined) {
-                    findings.push(makeDeprecatedKeyFinding(key, replacement, `${container}[${i}].${key}`));
+            for (const key of Object.keys(item)) {
+                const entry = DEPRECATED_KEY_LOOKUP.get(key);
+                if (entry) {
+                    findings.push(makeDeprecatedKeyFinding(entry, `${container}[${i}].${key}`));
                 }
             }
         });

package/dist/lib/configLocations.js

@@ -1,6 +1,7 @@
 import { promises as fs } from "node:fs";
 import path from "node:path";
 import JSON5 from "json5";
+import { isRecord } from "./util.js";
 const CANDIDATES = [
     { path: "renovate.json", format: "json" },
     { path: "renovate.json5", format: "json5" },
@@ -17,8 +18,11 @@ export async function locateConfig(repoPath) {
         const abs = path.join(repoPath, candidate.path);
         try {
             const raw = await fs.readFile(abs, "utf8");
-            const config = candidate.format === "json5" ? JSON5.parse(raw) : JSON.parse(raw);
-            if (!isPlainObject(config)) {
+            // Renovate parses every candidate JSONC-then-JSON5 regardless of
+            // extension (and write_config round-trips comments into renovate.json);
+            // JSON5 is a superset of JSONC, so one parser covers all of them.
+            const config = JSON5.parse(raw);
+            if (!isRecord(config)) {
                 throw new Error(`${candidate.path} does not contain a JSON object`);
             }
             return {
@@ -38,9 +42,9 @@ export async function locateConfig(repoPath) {
     try {
         const raw = await fs.readFile(pkgAbs, "utf8");
         const pkg = JSON.parse(raw);
-        if (isPlainObject(pkg) &&
+        if (isRecord(pkg) &&
             "renovate" in pkg &&
-            isPlainObject(pkg.renovate)) {
+            isRecord(pkg.renovate)) {
             return {
                 absPath: pkgAbs,
                 relPath: "package.json",
@@ -56,6 +60,3 @@ export async function locateConfig(repoPath) {
     }
     return null;
 }
-function isPlainObject(v) {
-    return typeof v === "object" && v !== null && !Array.isArray(v);
-}