renovate-mcp 1.8.1 → 1.8.2

package/dist/data/presets.generated.js

@@ -22049,4 +22049,120 @@ export const PRESETS = {
         }
     }
 };
+/**
+ * Renovate's `removedPresets` map: renamed built-in presets map to their new
+ * name, removed ones map to null (Renovate resolves them to an empty config).
+ */
+export const REMOVED_PRESETS = {
+    ":app": "config:js-app",
+    ":autodetectPinVersions": null,
+    ":autodetectRangeStrategy": null,
+    ":automergeBranchMergeCommit": ":automergeBranch",
+    ":automergeBranchPush": ":automergeBranch",
+    ":base": "config:recommended",
+    ":disableLockFiles": ":skipArtifactsUpdate",
+    ":enableGradleLite": null,
+    ":js-app": "config:js-app",
+    ":library": "config:js-lib",
+    ":masterIssue": ":dependencyDashboard",
+    ":masterIssueApproval": ":dependencyDashboardApproval",
+    ":switchToGradleLite": null,
+    ":unpublishSafe": "npm:unpublishSafe",
+    "compatibility:additionalBranchPrefix": null,
+    "config:application": "config:js-app",
+    "config:base": "config:recommended",
+    "config:base-js": "config:recommended",
+    "config:library": "config:js-lib",
+    "default:app": "config:js-app",
+    "default:automergeBranchMergeCommit": ":automergeBranch",
+    "default:automergeBranchPush": ":automergeBranch",
+    "default:base": "config:recommended",
+    "default:js-app": "config:js-app",
+    "default:library": "config:js-lib",
+    "default:onlyNpm": null,
+    "default:unpublishSafe": "npm:unpublishSafe",
+    "github>whitesource/merge-confidence:beta": "mergeConfidence:all-badges",
+    "group:FontsourceMonorepo": "group:fontsourceMonorepo",
+    "group:HangfireMonorepo": "group:hangfireMonorepo",
+    "group:HotChocolateMonorepo": "group:hotchocolateMonorepo",
+    "group:MassTransitMonorepo": "group:masstransitMonorepo",
+    "group:OpenTelemetryDotnetMonorepo": "group:opentelemetry-dotnetMonorepo",
+    "group:SteeltoeMonorepo": "group:steeltoeMonorepo",
+    "group:SwashbuckleMonorepo": "group:swashbuckle-aspnetcoreMonorepo",
+    "group:System.IO.AbstractionsMonorepo": "group:system.io.abstractionsMonorepo",
+    "group:angular1Monorepo": "group:angularjsMonorepo",
+    "group:angularcliMonorepo": "group:angular-cliMonorepo",
+    "group:arcus background-jobsMonorepo": "group:arcus.background-jobsMonorepo",
+    "group:arcus event-gridMonorepo": "group:arcus.event-gridMonorepo",
+    "group:arcus messagingMonorepo": "group:arcus.messagingMonorepo",
+    "group:arcus observabilityMonorepo": "group:arcus.observabilityMonorepo",
+    "group:arcus securityMonorepo": "group:arcus.securityMonorepo",
+    "group:arcus webapiMonorepo": "group:arcus.webapiMonorepo",
+    "group:aspnet AspNetWebStackMonorepo": "group:aspnet aspnetwebstackMonorepo",
+    "group:aspnet ExtensionsMonorepo": "group:aspnet extensionsMonorepo",
+    "group:hamcrestMonorepo": "group:javahamcrestMonorepo",
+    "group:infrastructureMonorepo": "group:infrastructure-uiMonorepo",
+    "group:jsTestMonMajor": "group:jsTestNonMajor",
+    "group:junit5Monorepo": "group:junit-frameworkMonorepo",
+    "group:k8s-ioMonorepo": "group:kubernetesMonorepo",
+    "group:kubernetes": "group:kubernetesMonorepo",
+    "group:linguiMonorepo": "group:linguijsMonorepo",
+    "group:materialMonorepo": "group:material-components-webMonorepo",
+    "group:muiMonorepo": "group:material-uiMonorepo",
+    "group:nrwlMonorepo": "group:nxMonorepo",
+    "group:openfeignMonorepo": "group:feignMonorepo",
+    "group:opentelemetryMonorepo": "group:opentelemetry-jsMonorepo",
+    "group:picassoMonorepo": "group:picassojsMonorepo",
+    "group:reactrouterMonorepo": "group:react-routerMonorepo",
+    "group:sentryMonorepo": "group:sentry-javascriptMonorepo",
+    "group:strykerMonorepo": "group:stryker-jsMonorepo",
+    "helpers:oddIsUnstable": null,
+    "helpers:oddIsUnstablePackages": null,
+    "monorepo:Fontsource": "monorepo:fontsource",
+    "monorepo:Hangfire": "monorepo:hangfire",
+    "monorepo:HotChocolate": "monorepo:hotchocolate",
+    "monorepo:MassTransit": "monorepo:masstransit",
+    "monorepo:OpenTelemetryDotnet": "monorepo:opentelemetry-dotnet",
+    "monorepo:Steeltoe": "monorepo:steeltoe",
+    "monorepo:Swashbuckle": "monorepo:swashbuckle-aspnetcore",
+    "monorepo:System.IO.Abstractions": "monorepo:system.io.abstractions",
+    "monorepo:angular1": "monorepo:angularjs",
+    "monorepo:angularcli": "monorepo:angular-cli",
+    "monorepo:arcus background-jobs": "monorepo:arcus.background-jobs",
+    "monorepo:arcus event-grid": "monorepo:arcus.event-grid",
+    "monorepo:arcus messaging": "monorepo:arcus.messaging",
+    "monorepo:arcus observability": "monorepo:arcus.observability",
+    "monorepo:arcus security": "monorepo:arcus.security",
+    "monorepo:arcus webapi": "monorepo:arcus.webapi",
+    "monorepo:aspnet AspNetWebStack": "monorepo:aspnet aspnetwebstack",
+    "monorepo:aspnet Extensions": "monorepo:aspnet extensions",
+    "monorepo:hamcrest": "monorepo:javahamcrest",
+    "monorepo:infrastructure": "monorepo:infrastructure-ui",
+    "monorepo:junit5": "monorepo:junit-framework",
+    "monorepo:k8s-io": "monorepo:kubernetes",
+    "monorepo:lingui": "monorepo:linguijs",
+    "monorepo:material": "monorepo:material-components-web",
+    "monorepo:mui": "monorepo:material-ui",
+    "monorepo:nrwl": "monorepo:nx",
+    "monorepo:openfeign": "monorepo:feign",
+    "monorepo:opentelemetry": "monorepo:opentelemetry-js",
+    "monorepo:picasso": "monorepo:picassojs",
+    "monorepo:reactrouter": "monorepo:react-router",
+    "monorepo:sentry": "monorepo:sentry-javascript",
+    "monorepo:stryker": "monorepo:stryker-js",
+    "npm:unpublishSafe": "security:minimumReleaseAgeNpm",
+    "regexManagers:azurePipelinesVersions": "customManagers:azurePipelinesVersions",
+    "regexManagers:biomeVersions": "customManagers:biomeVersions",
+    "regexManagers:bitbucketPipelinesVersions": "customManagers:bitbucketPipelinesVersions",
+    "regexManagers:dockerfileVersions": "customManagers:dockerfileVersions",
+    "regexManagers:githubActionsVersions": "customManagers:githubActionsVersions",
+    "regexManagers:gitlabPipelineVersions": "customManagers:gitlabPipelineVersions",
+    "regexManagers:helmChartYamlAppVersions": "customManagers:helmChartYamlAppVersions",
+    "regexManagers:mavenPropertyVersions": "customManagers:mavenPropertyVersions",
+    "regexManagers:tfvarsVersions": "customManagers:tfvarsVersions",
+    "regexManagers:tsconfigNodeVersions": "customManagers:tsconfigNodeVersions",
+    "replacements:messageFormat-{{package}}-to-@messageformat/{{package}}": "replacements:messageFormat-to-scoped",
+    "replacements:ojdbc10-to-ojdbc11": "replacements:ojdbc-to-ojdbc11",
+    "workarounds:reduceRepologyServerLoad": null
+};
 export const PRESET_NAMES = Object.freeze(Object.keys(PRESETS));

package/dist/lib/externalPresetFetcher.js

@@ -60,14 +60,30 @@ function dispatch(parsed, options) {
             return Promise.resolve({ ok: false, reason: `Unknown preset source: ${parsed.source}` });
     }
 }
+/** GitHub, Gitea and Bitbucket address repositories as exactly two path segments (nested groups are a GitLab thing). */
+const OWNER_REPO_RE = /^[^/]+\/[^/]+$/;
+/** GitLab projects live under a namespace that may itself be nested (`group/sub/project`). */
+const GITLAB_PROJECT_RE = /^[^/]+(\/[^/]+)+$/;
+/**
+ * Rejects empty, `.` and `..` segments. URL parsing collapses dot segments
+ * (also when spelled `%2e`), and `encodeURIComponent` leaves `.` alone, so
+ * without this a preset string could steer a token-bearing request to any
+ * path on the API host.
+ */
+function isSafePath(path) {
+    return path.split("/").every((seg) => seg !== "" && seg !== "." && seg !== "..");
+}
 async function fetchGitHub(parsed, timeoutMs, fetchImpl, endpoint) {
-    if (!parsed.repoPath || !parsed.repoPath.includes("/")) {
+    const file = presetFileName(parsed);
+    if (!parsed.repoPath ||
+        !OWNER_REPO_RE.test(parsed.repoPath) ||
+        !isSafePath(parsed.repoPath) ||
+        !isSafePath(file)) {
         return { ok: false, reason: `Invalid github preset: ${parsed.original}` };
     }
-    const file = presetFileName(parsed);
     const ref = parsed.ref ?? "HEAD";
     const apiBase = endpoint ?? DEFAULT_API_BASE.github;
-    const url = `${apiBase}/repos/${parsed.repoPath}/contents/${encodeFilePath(file)}?ref=${encodeURIComponent(ref)}`;
+    const url = `${apiBase}/repos/${encodeFilePath(parsed.repoPath)}/contents/${encodeFilePath(file)}?ref=${encodeURIComponent(ref)}`;
     const credential = resolveCredential(["RENOVATE_TOKEN", "GITHUB_TOKEN"]);
     const headers = {
         Accept: "application/vnd.github.raw",
@@ -79,10 +95,13 @@ async function fetchGitHub(parsed, timeoutMs, fetchImpl, endpoint) {
     return fetchJson(url, headers, timeoutMs, parsed.original, fetchImpl, "github", sendAuth ? credential : suppressCredential(credential));
 }
 async function fetchGitLab(parsed, timeoutMs, fetchImpl, endpoint) {
-    if (!parsed.repoPath) {
+    const file = presetFileName(parsed);
+    if (!parsed.repoPath ||
+        !GITLAB_PROJECT_RE.test(parsed.repoPath) ||
+        !isSafePath(parsed.repoPath) ||
+        !isSafePath(file)) {
         return { ok: false, reason: `Invalid gitlab preset: ${parsed.original}` };
     }
-    const file = presetFileName(parsed);
     const ref = parsed.ref ?? "HEAD";
     const apiBase = endpoint ?? DEFAULT_API_BASE.gitlab;
     const url = `${apiBase}/projects/${encodeURIComponent(parsed.repoPath)}/repository/files/${encodeURIComponent(file)}/raw?ref=${encodeURIComponent(ref)}`;
@@ -93,14 +112,15 @@ async function fetchGitLab(parsed, timeoutMs, fetchImpl, endpoint) {
         headers["PRIVATE-TOKEN"] = credential.token;
     return fetchJson(url, headers, timeoutMs, parsed.original, fetchImpl, "gitlab", sendAuth ? credential : suppressCredential(credential));
 }
-/** Gitea and Bitbucket address repositories as exactly two path segments (nested groups are a GitLab thing). */
-const OWNER_REPO_RE = /^[^/]+\/[^/]+$/;
 /** Gitea's raw-contents API, which Forgejo serves unchanged; the two differ only in default host and token var. */
 async function fetchGitea(parsed, timeoutMs, fetchImpl, endpoint, platform) {
-    if (!parsed.repoPath || !OWNER_REPO_RE.test(parsed.repoPath)) {
+    const file = presetFileName(parsed);
+    if (!parsed.repoPath ||
+        !OWNER_REPO_RE.test(parsed.repoPath) ||
+        !isSafePath(parsed.repoPath) ||
+        !isSafePath(file)) {
         return { ok: false, reason: `Invalid ${platform} preset: ${parsed.original}` };
     }
-    const file = presetFileName(parsed);
     const apiBase = endpoint ?? DEFAULT_API_BASE[platform];
     // No `ref` means the repository's default branch, as in Renovate.
     const refQuery = parsed.ref ? `?ref=${encodeURIComponent(parsed.ref)}` : "";
@@ -124,12 +144,21 @@ async function fetchGitea(parsed, timeoutMs, fetchImpl, endpoint, platform) {
  * if anyone needs it.
  */
 async function fetchBitbucket(parsed, timeoutMs, fetchImpl, endpoint) {
-    if (!parsed.repoPath || !OWNER_REPO_RE.test(parsed.repoPath)) {
+    const file = presetFileName(parsed);
+    // The ref is a single encoded path segment here (a query parameter elsewhere), so only an
+    // empty or dot ref can shape the path.
+    const rawRef = parsed.ref ?? "HEAD";
+    if (!parsed.repoPath ||
+        !OWNER_REPO_RE.test(parsed.repoPath) ||
+        !isSafePath(parsed.repoPath) ||
+        !isSafePath(file) ||
+        rawRef === "" ||
+        rawRef === "." ||
+        rawRef === "..") {
         return { ok: false, reason: `Invalid bitbucket preset: ${parsed.original}` };
     }
-    const file = presetFileName(parsed);
     const apiBase = endpoint ?? DEFAULT_API_BASE.bitbucket;
-    const ref = encodeURIComponent(parsed.ref ?? "HEAD");
+    const ref = encodeURIComponent(rawRef);
     const url = `${apiBase}/2.0/repositories/${encodeFilePath(parsed.repoPath)}/src/${ref}/${encodeFilePath(file)}`;
     const credential = resolveCredential(["RENOVATE_TOKEN", "BITBUCKET_TOKEN"]);
     const headers = { "User-Agent": "renovate-mcp" };

package/dist/lib/presetResolver.js

@@ -1,4 +1,4 @@
-import { PRESETS } from "../data/presets.generated.js";
+import { PRESETS, REMOVED_PRESETS } from "../data/presets.generated.js";
 import { fetchExternalPreset } from "./externalPresetFetcher.js";
 import { HOSTED_PLATFORMS } from "./gitRemote.js";
 import { runMerge } from "./mergeWorker.js";
@@ -130,7 +130,29 @@ async function collectSteps(input, ownerName, viaChain, ctx) {
                 });
                 continue;
             }
-            const parsed = parsePreset(entry);
+            const redirect = followRemovedPresets(entry);
+            if (redirect.kind === "cycle") {
+                ctx.presetsUnresolved.push({
+                    preset: entry,
+                    reason: `Cycle detected in Renovate's removed/renamed preset map: ${redirect.chain.join(" → ")}`,
+                });
+                continue;
+            }
+            if (redirect.kind === "removed") {
+                ctx.warnings.push({
+                    preset: entry,
+                    message: `Preset "${entry}" was removed in Renovate and is ignored (it resolves to nothing); remove it from \`extends\` (migrate_config does this).`,
+                });
+                ctx.presetsResolved.push(entry);
+                continue;
+            }
+            const renamedTo = redirect.kind === "renamed" ? redirect.target : null;
+            // The target carries no args, so the original entry's args never apply
+            // (same as Renovate). `original` stays what the user wrote so unresolved
+            // records and labels name the entry as written.
+            const parsed = renamedTo === null
+                ? parsePreset(entry)
+                : { ...parsePreset(renamedTo), original: entry };
             if (ctx.stack.includes(parsed.key)) {
                 ctx.presetsUnresolved.push({
                     preset: entry,
@@ -138,7 +160,21 @@ async function collectSteps(input, ownerName, viaChain, ctx) {
                 });
                 continue;
             }
+            const unresolvedBefore = ctx.presetsUnresolved.length;
             const body = await loadPresetBody(parsed, ctx);
+            if (renamedTo !== null) {
+                if (!body) {
+                    for (const u of ctx.presetsUnresolved.slice(unresolvedBefore)) {
+                        u.reason += ` (Renovate renamed "${entry}" to "${renamedTo}".)`;
+                    }
+                }
+                else {
+                    ctx.warnings.push({
+                        preset: entry,
+                        message: `Preset "${entry}" was renamed in Renovate to "${renamedTo}" and was resolved as that preset; update \`extends\` (migrate_config does this).`,
+                    });
+                }
+            }
             if (!body)
                 continue;
             const { value, missingArgs, unknownTemplates } = applyArgs(body, parsed.args);
@@ -160,6 +196,30 @@ async function collectSteps(input, ownerName, viaChain, ctx) {
         });
     }
 }
+/**
+ * Follow Renovate's `removedPresets` map on the exact raw entry (args included,
+ * no trimming), repeatedly like Renovate's recursive lookup. A string value is a
+ * rename, null means Renovate drops the preset. Bounded by a visited set.
+ */
+function followRemovedPresets(entry) {
+    const lookup = (name) => Object.hasOwn(REMOVED_PRESETS, name) ? REMOVED_PRESETS[name] : undefined;
+    const seen = [entry];
+    let current = entry;
+    for (;;) {
+        const next = lookup(current);
+        // Renovate treats an empty-string value as falsy, i.e. not a redirect.
+        if (next === undefined || next === "") {
+            return current === entry ? { kind: "none" } : { kind: "renamed", target: current };
+        }
+        if (next === null) {
+            return { kind: "removed" };
+        }
+        if (seen.includes(next))
+            return { kind: "cycle", chain: [...seen, next] };
+        seen.push(next);
+        current = next;
+    }
+}
 export function recordTemplateWarnings(entry, suppliedArgs, missingArgs, unknownTemplates, warningsList) {
     for (const idx of [...missingArgs].sort((a, b) => a - b)) {
         warningsList.push({
@@ -203,7 +263,13 @@ export async function loadPresetBody(parsed, ctx) {
         : parsed;
     const classification = classifyExternalSource(effective.source);
     if (!classification.fetchable) {
-        unresolvedList.push({ preset: parsed.original, reason: classification.reason });
+        const bareNote = parsed.source === "local" && !/^local>/i.test(parsed.original.trim())
+            ? ` Renovate treats a prefix-less \`owner/repo\` entry as \`local>owner/repo\`.`
+            : "";
+        unresolvedList.push({
+            preset: parsed.original,
+            reason: classification.reason + bareNote,
+        });
         return null;
     }
     if (!ctx.fetchExternal) {
@@ -235,6 +301,35 @@ const KNOWN_SOURCES = new Set([
     "local",
     "npm",
 ]);
+// Renovate's internal preset namespaces, verbatim from its parser
+// (`config/presets/parse.ts`). It checks these before treating a
+// slash-containing entry as `local>`, so e.g. `group:foo/bar` stays a built-in
+// lookup. Hard-coded rather than derived from the catalogue: `compatibility`
+// and `npm` have no presets but are still internal to the parser.
+const BUILTIN_NAMESPACES = new Set([
+    "abandonments",
+    "compatibility",
+    "config",
+    "customManagers",
+    "default",
+    "docker",
+    "global",
+    "group",
+    "helpers",
+    "mergeConfidence",
+    "monorepo",
+    "npm",
+    "packages",
+    "preview",
+    "replacements",
+    "schedule",
+    "security",
+    "workarounds",
+]);
+/** True when Renovate would treat `entry` as a `local>` preset (prefixed or bare `owner/repo`). */
+export function isLocalPreset(entry) {
+    return parsePreset(entry).source === "local";
+}
 export function parsePreset(raw) {
     const original = raw;
     let rest = raw.trim();
@@ -252,9 +347,39 @@ export function parsePreset(raw) {
     if (srcMatch) {
         return parseExternal(rest, original, args, srcMatch[1].toLowerCase());
     }
+    // Entries without a `<source>>` prefix follow Renovate's preset parser for
+    // the source split: relative path, then http(s) URL, then `:`-prefixed
+    // built-in, then `@scope/pkg` npm, then anything else containing `/` (outside
+    // a built-in namespace) as a `local>` preset. The rest deliberately differs:
+    // any other `foo:bar` is looked up as a built-in (Renovate would try the npm
+    // package `renovate-config-foo`), which gives a clearer typo message.
+    if (/^\.{0,2}\//.test(rest)) {
+        return {
+            key: original,
+            original,
+            args,
+            unresolvableReason: "Relative presets are not supported by resolve_config; run dry_run for full-fidelity resolution.",
+        };
+    }
+    if (/^https?:\/\//i.test(rest)) {
+        return {
+            key: original,
+            original,
+            args,
+            unresolvableReason: "URL (http) presets are not supported by resolve_config; run dry_run for full-fidelity resolution.",
+        };
+    }
+    if (!rest.startsWith(":")) {
+        if (rest.startsWith("@")) {
+            return parseExternal(`npm>${rest}`, original, args, "npm");
+        }
+        if (rest.includes("/") && !BUILTIN_NAMESPACES.has(rest.split(":", 1)[0])) {
+            return parseExternal(`local>${rest}`, original, args, "local");
+        }
+    }
     // Built-in: `:foo` is shorthand for `default:foo`.
     const key = rest.startsWith(":") ? `default${rest}` : rest;
-    // An entry with no `>` prefix and no `:` namespace is an npm preset.
+    // Otherwise an entry with no `:` namespace is an npm preset.
     if (!key.includes(":")) {
         return {
             key: `npm>${key}`,

package/dist/lib/version.js

@@ -1,5 +1,5 @@
 import { fileURLToPath } from "node:url";
-export const SERVER_VERSION = "1.8.1"; // x-release-please-version
+export const SERVER_VERSION = "1.8.2"; // x-release-please-version
 // "released" = the server is running from a `node_modules/` install (global
 // `npm i -g`, project-local `npm i`, or `npx renovate-mcp`). Anything else —
 // most commonly an MCP config of `{"command": "node", "args": [".../dist/index.js"]}`

package/dist/tools/dryRun.js

@@ -6,6 +6,7 @@ import { randomUUID } from "node:crypto";
 import { run, resolveRenovateTool, formatMissingBinaryError, formatTimeoutError, CommandTimeoutError, } from "../lib/renovateCli.js";
 import { resolveCredential } from "../lib/credentialResolver.js";
 import { validateEndpoint } from "../lib/endpointValidator.js";
+import { isLocalPreset } from "../lib/presetResolver.js";
 import { locateConfig } from "../lib/configLocations.js";
 import { assertRepoDir, NETWORK_READ_ONLY_ANNOTATIONS } from "../lib/toolInputs.js";
 import { detectLookupProblems } from "../lib/lookupProblems.js";
@@ -80,7 +81,8 @@ function collectReportProblems(report) {
 }
 /**
  * Scan the repo's Renovate config for `extends` entries of the form
- * `local>owner/repo[:preset]` and return them along with the config-file path
+ * `local>owner/repo[:preset]` (or the bare `owner/repo[:preset]` spelling
+ * Renovate also treats as local) and return them along with the config-file path
  * they were found in. Returns `null` if no config is found (Renovate will
  * handle that case itself with its usual error). Silently returns `null` on
  * parse errors too — we don't want preflight to be stricter than Renovate's
@@ -99,7 +101,7 @@ async function detectUnresolvableLocalPresets(repoPath) {
     const extendsRaw = located.config.extends;
     if (!Array.isArray(extendsRaw))
         return null;
-    const presets = extendsRaw.filter((entry) => typeof entry === "string" && entry.startsWith("local>"));
+    const presets = extendsRaw.filter((entry) => typeof entry === "string" && isLocalPreset(entry));
     return { relPath: located.relPath, presets };
 }
 function countRepositories(report) {

package/dist/tools/writeConfig.js

@@ -137,8 +137,41 @@ export function registerWriteConfig(server) {
             ? `${target}.renovate-mcp-slice-${randomUUID()}.json`
             : undefined;
         await fs.mkdir(path.dirname(target), { recursive: true });
-        await fs.writeFile(tmp, payload, { flag: "wx", mode: 0o600 });
+        // rename() keeps tmp's inode, so tmp's mode becomes the target's. Capture
+        // an existing regular file's permission bits so an overwrite does not
+        // silently tighten e.g. 0644 to 0600. `stat` (not `lstat`): `target` is
+        // already a realpath, and a dangling link must read as ENOENT (new file).
+        // A concurrent chmod between this stat and the rename is lost; benign.
+        let targetMode = undefined;
         try {
+            const st = await fs.stat(target);
+            if (st.isFile())
+                targetMode = st.mode & 0o777;
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+        // Create tmp 0o600 when copying a mode over it (owner-only until the
+        // fchmod below); for a new file ask for 0o666 so the kernel applies the
+        // process umask, avoiding the deprecated no-arg process.umask(). While the
+        // validator runs, tmp is as readable as the written file would be (also
+        // when validation then refuses the write); it never exceeds that. The
+        // mode is set through the open handle (fchmod), never `fs.chmod(tmp)`,
+        // which would re-resolve the path and follow a symlink swapped in at
+        // that name. The open stays outside the
+        // try: on EEXIST the entry at tmp is not ours, so `finally` must not
+        // unlink it.
+        const fh = await fs.open(tmp, "wx", targetMode === undefined ? 0o666 : 0o600);
+        try {
+            try {
+                await fh.writeFile(payload);
+                if (targetMode !== undefined)
+                    await fh.chmod(targetMode);
+            }
+            finally {
+                await fh.close();
+            }
             if (sliceTmp) {
                 await fs.writeFile(sliceTmp, JSON.stringify(config, null, 2) + "\n", {
                     flag: "wx",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "renovate-mcp",
-  "version": "1.8.1",
+  "version": "1.8.2",
   "description": "MCP server for designing Renovate configurations interactively.",
   "type": "module",
   "bin": {