renovate-mcp 1.6.7 → 1.6.8

package/dist/data/managers.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-managers.mjs from renovate@44.166.0.
+// AUTO-GENERATED by scripts/generate-managers.mjs from renovate@44.181.5.
 // Do not edit by hand. Run `npm run generate:managers` to refresh.
-export const RENOVATE_VERSION = "44.166.0";
+export const RENOVATE_VERSION = "44.181.5";
 /**
  * All manager names accepted by Renovate's `matchManagers` /
  * `excludeManagers` fields. Includes both regular managers and custom

package/dist/data/migrations.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-migrations.mjs from renovate@44.166.0.
+// AUTO-GENERATED by scripts/generate-migrations.mjs from renovate@44.181.5.
 // Do not edit by hand. Run `npm run generate:migrations` to refresh.
-export const RENOVATE_VERSION = "44.166.0";
+export const RENOVATE_VERSION = "44.181.5";
 /**
  * Deprecated config keys. Sourced from Renovate's `MigrationsService`:
  * `renamedProperties` (plain renames, with `newKey`) plus every

package/dist/data/options.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-options.mjs from renovate@44.166.0.
+// AUTO-GENERATED by scripts/generate-options.mjs from renovate@44.181.5.
 // Do not edit by hand. Run `npm run generate:options` to refresh.
-export const RENOVATE_VERSION = "44.166.0";
+export const RENOVATE_VERSION = "44.181.5";
 export const OPTIONS = {
     "abandonmentThreshold": {
         "description": "Flags packages that have not been updated within this period as abandoned.",
@@ -1006,7 +1006,7 @@ export const OPTIONS = {
         "description": "Configuration object to define language or manager version constraints.",
         "type": "object",
         "default": {
-            "ghActionsLock": "v0.2.0"
+            "ghActionsLock": "v0.4.0"
         },
         "supportedManagers": [
             "bundler",
@@ -1403,7 +1403,7 @@ export const OPTIONS = {
     "dockerSidecarImage": {
         "description": "Change this value to override the default Renovate sidecar image.",
         "type": "string",
-        "default": "ghcr.io/renovatebot/base-image:13.133.0",
+        "default": "ghcr.io/renovatebot/base-image:13.142.5",
         "globalOnly": true,
         "deprecationMsg": "The usage of `binarySource=docker` is deprecated, and will be removed in the future"
     },
@@ -1464,6 +1464,129 @@ export const OPTIONS = {
         "description": "A list of package managers to enable. Only managers on the list are enabled.",
         "type": "array",
         "subType": "string",
+        "allowedValues": [
+            "ansible",
+            "ansible-galaxy",
+            "ant",
+            "apm",
+            "argocd",
+            "asdf",
+            "azure-pipelines",
+            "batect",
+            "batect-wrapper",
+            "bazel",
+            "bazel-module",
+            "bazelisk",
+            "bicep",
+            "bitbucket-pipelines",
+            "bitrise",
+            "buildkite",
+            "buildpacks",
+            "bun",
+            "bun-version",
+            "bundler",
+            "cake",
+            "cargo",
+            "cdnurl",
+            "circleci",
+            "cloudbuild",
+            "cocoapods",
+            "composer",
+            "conan",
+            "copier",
+            "cpanfile",
+            "crossplane",
+            "crow",
+            "deno",
+            "deps-edn",
+            "devbox",
+            "devcontainer",
+            "docker-compose",
+            "dockerfile",
+            "droneci",
+            "fleet",
+            "flux",
+            "fvm",
+            "git-submodules",
+            "github-actions",
+            "gitlabci",
+            "gitlabci-include",
+            "glasskube",
+            "gleam",
+            "gomod",
+            "gradle",
+            "gradle-wrapper",
+            "haskell-cabal",
+            "helm-requirements",
+            "helm-values",
+            "helmfile",
+            "helmsman",
+            "helmv3",
+            "hermit",
+            "homeassistant-manifest",
+            "homebrew",
+            "html",
+            "jenkins",
+            "jsonnet-bundler",
+            "kotlin-script",
+            "kubernetes",
+            "kustomize",
+            "leiningen",
+            "maven",
+            "maven-wrapper",
+            "meteor",
+            "mint",
+            "mise",
+            "mix",
+            "nix",
+            "nodenv",
+            "npm",
+            "nuget",
+            "nvm",
+            "ocb",
+            "osgi",
+            "pep621",
+            "pep723",
+            "pip-compile",
+            "pip_requirements",
+            "pip_setup",
+            "pipenv",
+            "pixi",
+            "poetry",
+            "pre-commit",
+            "proto",
+            "pub",
+            "puppet",
+            "pyenv",
+            "quadlet",
+            "renovate-config",
+            "ruby-version",
+            "runtime-version",
+            "rust-toolchain",
+            "sbt",
+            "scalafmt",
+            "setup-cfg",
+            "smithy",
+            "sveltos",
+            "swift",
+            "tekton",
+            "terraform",
+            "terraform-version",
+            "terragrunt",
+            "terragrunt-version",
+            "tflint-plugin",
+            "travis",
+            "typst",
+            "unity3d",
+            "velaci",
+            "vendir",
+            "woodpecker",
+            "xcodegen",
+            "jsonata",
+            "regex",
+            "custom.jsonata",
+            "custom.regex"
+        ],
         "stage": "repository"
     },
     "enableHttp2": {
@@ -1726,8 +1849,11 @@ export const OPTIONS = {
         "type": "string",
         "default": "json",
         "allowedValues": [
+            "html",
             "json",
-            "plain"
+            "plain",
+            "toml",
+            "yaml"
         ],
         "parents": [
             "customDatasources"
@@ -2793,6 +2919,7 @@ export const OPTIONS = {
             "pinDigest",
             "digest",
             "lockFileMaintenance",
+            "lockfileUpdate",
             "rollback",
             "bump",
             "replacement"
@@ -4544,6 +4671,9 @@ export const OPTIONS = {
         "description": "Whether to update internal dep versions in a monorepo. Works on Yarn Workspaces.",
         "type": "boolean",
         "default": false,
+        "supportedManagers": [
+            "npm"
+        ],
         "stage": "package"
     },
     "updateNotScheduled": {

package/dist/data/presets.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-presets.mjs from renovate@44.166.0.
+// AUTO-GENERATED by scripts/generate-presets.mjs from renovate@44.181.5.
 // Do not edit by hand. Run `npm run generate:presets` to refresh.
-export const RENOVATE_VERSION = "44.166.0";
+export const RENOVATE_VERSION = "44.181.5";
 export const PRESETS = {
     "abandonments:recommended": {
         "namespace": "abandonments",
@@ -92,6 +92,7 @@ export const PRESETS = {
                 "mergeConfidence:age-confidence-badges",
                 "replacements:all",
                 "workarounds:all",
+                "security:php2shell",
                 "helpers:forgejoDigestChangelogs",
                 "helpers:giteaDigestChangelogs",
                 "helpers:githubDigestChangelogs",
@@ -21070,6 +21071,112 @@ export const PRESETS = {
             ]
         }
     },
+    "security:php2shell": {
+        "namespace": "security",
+        "description": "Update vulnerable PHP runtime pins for CVE-2026-109618 and CVE-2026-109619.",
+        "body": {
+            "customManagers": [
+                {
+                    "customType": "regex",
+                    "datasourceTemplate": "github-tags",
+                    "depNameTemplate": "php",
+                    "depTypeTemplate": "php2shell-runtime",
+                    "extractVersionTemplate": "^php-(?<version>\\S+)",
+                    "managerFilePatterns": [
+                        "/(^|/)\\.php-version$/"
+                    ],
+                    "matchStrings": [
+                        "^\\s*(?<currentValue>8\\.[2-5]\\.\\d+)\\s*$"
+                    ],
+                    "packageNameTemplate": "php/php-src"
+                },
+                {
+                    "customType": "jsonata",
+                    "datasourceTemplate": "github-tags",
+                    "depNameTemplate": "php",
+                    "depTypeTemplate": "php2shell-runtime",
+                    "extractVersionTemplate": "^php-(?<version>\\S+)",
+                    "fileFormat": "yaml",
+                    "managerFilePatterns": [
+                        "/(^|/)(workflow-templates|\\.(?:github|gitea|forgejo)/(?:workflows|actions))/.+\\.ya?ml$/",
+                        "/(^|/)action\\.ya?ml$/"
+                    ],
+                    "matchStrings": [
+                        "**[uses and $exists($match(uses, /^shivammathur\\/setup-php@/))].with.\"php-version\"[$type($) = \"string\" and $exists($match($, /^8\\.[2-5]\\.\\d+$/))].{\"currentValue\": $}"
+                    ],
+                    "packageNameTemplate": "php/php-src"
+                }
+            ],
+            "packageRules": [
+                {
+                    "enabled": false,
+                    "matchDepTypes": [
+                        "php2shell-runtime"
+                    ],
+                    "matchManagers": [
+                        "custom.regex",
+                        "custom.jsonata"
+                    ]
+                },
+                {
+                    "enabled": true,
+                    "matchDepTypes": [
+                        "php2shell-runtime"
+                    ],
+                    "matchJsonata": [
+                        "(\n  $value := (manager = \"mise\" and isLockfileOnly) ? lockedVersion : currentValue;\n  $version := datasource = \"docker\" ? $split($value, \"-\")[0] : $value;\n  $parts := $match($version, /^(8\\.[2-5])\\.(\\d+)$/).groups;\n\n  $not(vulnerabilityAlerts.enabled = false) and $exists($parts)\n    and $number($parts[1]) < $lookup({\"8.2\":35,\"8.3\":36,\"8.4\":27,\"8.5\":12}, $parts[0])\n)"
+                    ],
+                    "matchManagers": [
+                        "custom.regex",
+                        "custom.jsonata"
+                    ]
+                },
+                {
+                    "isVulnerabilityAlert": true,
+                    "matchJsonata": [
+                        "(\n  $value := (manager = \"mise\" and isLockfileOnly) ? lockedVersion : currentValue;\n  $version := datasource = \"docker\" ? $split($value, \"-\")[0] : $value;\n  $parts := $match($version, /^(8\\.[2-5])\\.(\\d+)$/).groups;\n\n  $not(vulnerabilityAlerts.enabled = false) and $exists($parts)\n    and $number($parts[1]) < $lookup({\"8.2\":35,\"8.3\":36,\"8.4\":27,\"8.5\":12}, $parts[0])\n) and (\n      $version := datasource = \"docker\" ? $split(newVersion, \"-\")[0] : newVersion;\n      $parts := $match($version, /^(8\\.[2-5])\\.(\\d+)$/).groups;\n\n      $exists($parts) and $number($parts[1]) >= $lookup({\"8.2\":35,\"8.3\":36,\"8.4\":27,\"8.5\":12}, $parts[0])\n    )"
+                    ],
+                    "matchUpdateTypes": [
+                        "patch",
+                        "minor",
+                        "major"
+                    ],
+                    "prBodyNotes": [
+                        "> ⚠️ PHP2Shell vulnerabilities can allow remote code execution. This PR updates affected PHP versions to patched releases. Rebuild affected images, deploy the updates, and restart PHP workers.\n>\n> Details: [CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and [CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)."
+                    ],
+                    "schedule": [],
+                    "matchDatasources": [
+                        "github-tags"
+                    ],
+                    "matchPackageNames": [
+                        "containerbase/php-prebuild",
+                        "php/php-src"
+                    ]
+                },
+                {
+                    "isVulnerabilityAlert": true,
+                    "matchJsonata": [
+                        "(\n  $value := (manager = \"mise\" and isLockfileOnly) ? lockedVersion : currentValue;\n  $version := datasource = \"docker\" ? $split($value, \"-\")[0] : $value;\n  $parts := $match($version, /^(8\\.[2-5])\\.(\\d+)$/).groups;\n\n  $not(vulnerabilityAlerts.enabled = false) and $exists($parts)\n    and $number($parts[1]) < $lookup({\"8.2\":35,\"8.3\":36,\"8.4\":27,\"8.5\":12}, $parts[0])\n) and (\n      $version := datasource = \"docker\" ? $split(newVersion, \"-\")[0] : newVersion;\n      $parts := $match($version, /^(8\\.[2-5])\\.(\\d+)$/).groups;\n\n      $exists($parts) and $number($parts[1]) >= $lookup({\"8.2\":35,\"8.3\":36,\"8.4\":27,\"8.5\":12}, $parts[0])\n    )"
+                    ],
+                    "matchUpdateTypes": [
+                        "patch",
+                        "minor",
+                        "major"
+                    ],
+                    "prBodyNotes": [
+                        "> ⚠️ PHP2Shell vulnerabilities can allow remote code execution. This PR updates affected PHP versions to patched releases. Rebuild affected images, deploy the updates, and restart PHP workers.\n>\n> Details: [CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and [CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)."
+                    ],
+                    "schedule": [],
+                    "matchDatasources": [
+                        "docker"
+                    ],
+                    "matchPackageNames": [
+                        "/^(?:(?:docker\\.io|index\\.docker\\.io)\\/)?(?:library\\/)?php$/"
+                    ]
+                }
+            ]
+        }
+    },
     "workarounds:all": {
         "namespace": "workarounds",
         "description": null,
@@ -21095,7 +21202,8 @@ export const PRESETS = {
                 "workarounds:rke2KubernetesVersioning",
                 "workarounds:libericaJdkDockerVersioning",
                 "workarounds:ubuntuDockerVersioning",
-                "workarounds:groupings"
+                "workarounds:groupings",
+                "workarounds:helmDocs"
             ],
             "overrideDescription": [
                 "Apply crowd-sourced workarounds for known problems with packages."
@@ -21280,6 +21388,20 @@ export const PRESETS = {
             ]
         }
     },
+    "workarounds:helmDocs": {
+        "namespace": "workarounds",
+        "description": "Block helm-docs calver-like versions from 2019",
+        "body": {
+            "packageRules": [
+                {
+                    "allowedVersions": "!/^19\\.(0614|0110)$/",
+                    "matchPackageNames": [
+                        "norwoodj/helm-docs"
+                    ]
+                }
+            ]
+        }
+    },
     "workarounds:ignoreHttp4sDigestMilestones": {
         "namespace": "workarounds",
         "description": "Ignore `http4s` digest-based `1.x` milestones.",

package/dist/lib/version.js

@@ -1,5 +1,5 @@
 import { fileURLToPath } from "node:url";
-export const SERVER_VERSION = "1.6.7"; // x-release-please-version
+export const SERVER_VERSION = "1.6.8"; // x-release-please-version
 // "released" = the server is running from a `node_modules/` install (global
 // `npm i -g`, project-local `npm i`, or `npx renovate-mcp`). Anything else —
 // most commonly an MCP config of `{"command": "node", "args": [".../dist/index.js"]}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "renovate-mcp",
-  "version": "1.6.7",
+  "version": "1.6.8",
   "description": "MCP server for designing Renovate configurations interactively.",
   "type": "module",
   "bin": {
@@ -65,7 +65,7 @@
     "jsonata": "2.2.1",
     "jsonc-parser": "^3.3.1",
     "minimatch": "^10.2.6",
-    "renovate": "44.166.0",
+    "renovate": "44.181.5",
     "smol-toml": "^1.6.1",
     "yaml": "^2.9.0",
     "zod": "^4.0.0"