renovate 43.109.4 → 43.109.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -4,34 +4,29 @@ import { NugetDatasource } from "../../modules/datasource/nuget/index.js";
|
|
|
4
4
|
/**
|
|
5
5
|
* Ecosystems/datasources that use Maven-style inclusive ranges for fixed versions: `[version,)`
|
|
6
6
|
*/
|
|
7
|
-
const mavenStyleFixedEcosystems = new Set([
|
|
8
|
-
"Maven",
|
|
9
|
-
"NuGet",
|
|
10
|
-
MavenDatasource.id,
|
|
11
|
-
NugetDatasource.id
|
|
12
|
-
]);
|
|
7
|
+
const mavenStyleFixedEcosystems = new Set([MavenDatasource.id, NugetDatasource.id]);
|
|
13
8
|
/**
|
|
14
9
|
* Ecosystems/datasources that use Maven-style exclusive ranges for last-affected versions: `(version,)`
|
|
15
10
|
*/
|
|
16
|
-
const mavenStyleLastAffectedEcosystems = new Set([
|
|
11
|
+
const mavenStyleLastAffectedEcosystems = new Set([MavenDatasource.id]);
|
|
17
12
|
/**
|
|
18
13
|
* Formats a fixed version as an allowed-version constraint appropriate for the ecosystem.
|
|
19
14
|
*
|
|
20
15
|
* @param fixedVersion - The first version that contains the fix
|
|
21
|
-
* @param ecosystem - Ecosystem or datasource name (e.g., '
|
|
16
|
+
* @param ecosystem - Ecosystem or datasource name (e.g., 'maven', 'npm', 'nuget'). Checked in a case-insensitive manner.
|
|
22
17
|
*/
|
|
23
18
|
function getFixedVersionConstraint(fixedVersion, ecosystem) {
|
|
24
|
-
if (mavenStyleFixedEcosystems.has(ecosystem)) return `[${fixedVersion},)`;
|
|
19
|
+
if (mavenStyleFixedEcosystems.has(ecosystem.toLowerCase())) return `[${fixedVersion},)`;
|
|
25
20
|
return `>= ${fixedVersion}`;
|
|
26
21
|
}
|
|
27
22
|
/**
|
|
28
23
|
* Formats a last-affected version as an allowed-version constraint appropriate for the ecosystem.
|
|
29
24
|
*
|
|
30
25
|
* @param lastAffected - The last version known to be affected
|
|
31
|
-
* @param ecosystem - Ecosystem or datasource name. Checked in a case-
|
|
26
|
+
* @param ecosystem - Ecosystem or datasource name. Checked in a case-insensitive manner.
|
|
32
27
|
*/
|
|
33
28
|
function getLastAffectedVersionConstraint(lastAffected, ecosystem) {
|
|
34
|
-
if (mavenStyleLastAffectedEcosystems.has(ecosystem)) return `(${lastAffected},)`;
|
|
29
|
+
if (mavenStyleLastAffectedEcosystems.has(ecosystem.toLowerCase())) return `(${lastAffected},)`;
|
|
35
30
|
return `> ${lastAffected}`;
|
|
36
31
|
}
|
|
37
32
|
const severityOrder = {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"utils.js","names":[],"sources":["../../../lib/util/vulnerability/utils.ts"],"sourcesContent":["import { MavenDatasource } from '../../modules/datasource/maven/index.ts';\nimport { NugetDatasource } from '../../modules/datasource/nuget/index.ts';\n\n/**\n * Ecosystems/datasources that use Maven-style inclusive ranges for fixed versions: `[version,)`\n */\nconst mavenStyleFixedEcosystems = new Set([\n
|
|
1
|
+
{"version":3,"file":"utils.js","names":[],"sources":["../../../lib/util/vulnerability/utils.ts"],"sourcesContent":["import { MavenDatasource } from '../../modules/datasource/maven/index.ts';\nimport { NugetDatasource } from '../../modules/datasource/nuget/index.ts';\n\n/**\n * Ecosystems/datasources that use Maven-style inclusive ranges for fixed versions: `[version,)`\n */\nconst mavenStyleFixedEcosystems = new Set([\n MavenDatasource.id,\n NugetDatasource.id,\n]);\n\n/**\n * Ecosystems/datasources that use Maven-style exclusive ranges for last-affected versions: `(version,)`\n */\nconst mavenStyleLastAffectedEcosystems = new Set([MavenDatasource.id]);\n\n/**\n * Formats a fixed version as an allowed-version constraint appropriate for the ecosystem.\n *\n * @param fixedVersion - The first version that contains the fix\n * @param ecosystem - Ecosystem or datasource name (e.g., 'maven', 'npm', 'nuget'). Checked in a case-insensitive manner.\n */\nexport function getFixedVersionConstraint(\n fixedVersion: string,\n ecosystem: string,\n): string {\n if (mavenStyleFixedEcosystems.has(ecosystem.toLowerCase())) {\n return `[${fixedVersion},)`;\n }\n return `>= ${fixedVersion}`;\n}\n\n/**\n * Formats a last-affected version as an allowed-version constraint appropriate for the ecosystem.\n *\n * @param lastAffected - The last version known to be affected\n * @param ecosystem - Ecosystem or datasource name. Checked in a case-insensitive manner.\n */\nexport function getLastAffectedVersionConstraint(\n lastAffected: string,\n ecosystem: string,\n): string {\n if (mavenStyleLastAffectedEcosystems.has(ecosystem.toLowerCase())) {\n return `(${lastAffected},)`;\n }\n return `> ${lastAffected}`;\n}\n\nconst severityOrder: Record<string, number> = {\n LOW: 1,\n MEDIUM: 2,\n MODERATE: 2,\n HIGH: 3,\n CRITICAL: 4,\n UNKNOWN: 5,\n};\n\nexport function getHighestVulnerabilitySeverity<\n T extends Record<string, any>,\n TChild extends Record<string, any> | undefined,\n>(parent: T, child: TChild): string {\n const parentVulSeverity = parent.vulnerabilitySeverity?.toUpperCase();\n const childVulSeverity = child?.vulnerabilitySeverity?.toUpperCase();\n\n if (childVulSeverity === undefined) {\n return parentVulSeverity;\n }\n\n if (parentVulSeverity === undefined) {\n return childVulSeverity;\n }\n\n return severityOrder[parentVulSeverity] >= severityOrder[childVulSeverity]\n ? parentVulSeverity\n : childVulSeverity;\n}\n"],"mappings":";;;;;;AAMA,MAAM,4BAA4B,IAAI,IAAI,CACxC,gBAAgB,IAChB,gBAAgB,GACjB,CAAC;;;;AAKF,MAAM,mCAAmC,IAAI,IAAI,CAAC,gBAAgB,GAAG,CAAC;;;;;;;AAQtE,SAAgB,0BACd,cACA,WACQ;AACR,KAAI,0BAA0B,IAAI,UAAU,aAAa,CAAC,CACxD,QAAO,IAAI,aAAa;AAE1B,QAAO,MAAM;;;;;;;;AASf,SAAgB,iCACd,cACA,WACQ;AACR,KAAI,iCAAiC,IAAI,UAAU,aAAa,CAAC,CAC/D,QAAO,IAAI,aAAa;AAE1B,QAAO,KAAK;;AAGd,MAAM,gBAAwC;CAC5C,KAAK;CACL,QAAQ;CACR,UAAU;CACV,MAAM;CACN,UAAU;CACV,SAAS;CACV;AAED,SAAgB,gCAGd,QAAW,OAAuB;CAClC,MAAM,oBAAoB,OAAO,uBAAuB,aAAa;CACrE,MAAM,mBAAmB,OAAO,uBAAuB,aAAa;AAEpE,KAAI,qBAAqB,KAAA,EACvB,QAAO;AAGT,KAAI,sBAAsB,KAAA,EACxB,QAAO;AAGT,QAAO,cAAc,sBAAsB,cAAc,oBACrD,oBACA"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "renovate",
|
|
3
3
|
"description": "Automated dependency updates. Flexible so you don't need to be.",
|
|
4
|
-
"version": "43.109.
|
|
4
|
+
"version": "43.109.5",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
7
7
|
"renovate": "dist/renovate.js",
|
|
@@ -121,7 +121,7 @@
|
|
|
121
121
|
"@redis/client": "5.11.0",
|
|
122
122
|
"@renovatebot/detect-tools": "3.0.0",
|
|
123
123
|
"@renovatebot/good-enough-parser": "2.0.0",
|
|
124
|
-
"@renovatebot/osv-offline": "2.4.
|
|
124
|
+
"@renovatebot/osv-offline": "2.4.1",
|
|
125
125
|
"@renovatebot/pep440": "4.2.2",
|
|
126
126
|
"@renovatebot/pgp": "1.3.4",
|
|
127
127
|
"@renovatebot/ruby-semver": "4.1.2",
|
package/renovate-schema.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"$id": "https://docs.renovatebot.com/renovate-schema.json",
|
|
3
|
-
"title": "JSON schema for Renovate 43.109.
|
|
3
|
+
"title": "JSON schema for Renovate 43.109.5 config files (https://renovatebot.com/)",
|
|
4
4
|
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
5
|
-
"x-renovate-version": "43.109.
|
|
5
|
+
"x-renovate-version": "43.109.5",
|
|
6
6
|
"allowComments": true,
|
|
7
7
|
"type": "object",
|
|
8
8
|
"properties": {
|