renovate 44.0.0-next.2 → 44.0.0

package/dist/workers/repository/process/vulnerabilities.js

@@ -1,41 +1,35 @@
 import { regEx } from "../../../util/regex.js";
 import { titleCase } from "../../../util/string.js";
 import { logger } from "../../../logger/index.js";
-import { all } from "../../../util/promises.js";
+import { getFixedVersionConstraint, getLastAffectedVersionConstraint } from "../../../util/vulnerability/utils.js";
+import { mergeChildConfig } from "../../../config/utils.js";
+import { instrument } from "../../../instrumentation/index.js";
 import { get } from "../../../modules/versioning/index.js";
+import { all } from "../../../util/promises.js";
 import { getDefaultVersioning } from "../../../modules/datasource/common.js";
-import { mergeChildConfig } from "../../../config/utils.js";
 import { getManagerConfig } from "../../../config/index.js";
 import { sanitizeMarkdown } from "../../../util/markdown.js";
+import { datasourceToOsvEcosystem } from "../../../util/vulnerability/ecosystem.js";
 import { isEmptyArray, isNonEmptyString, isNullOrUndefined, isTruthy } from "@sindresorhus/is";
-import { z } from "zod/v3";
+import { z } from "zod/v4";
 import { OsvOffline } from "@renovatebot/osv-offline";
 import * as _aeCvss from "ae-cvss-calculator";
-
 //#region lib/workers/repository/process/vulnerabilities.ts
-const { fromVector } = _aeCvss;
+const { fromVector } = _aeCvss.default;
 var Vulnerabilities = class Vulnerabilities {
+	static osvOffline;
 	osvOffline;
-	static datasourceEcosystemMap = {
-		crate: "crates.io",
-		go: "Go",
-		hackage: "Hackage",
-		hex: "Hex",
-		maven: "Maven",
-		npm: "npm",
-		nuget: "NuGet",
-		packagist: "Packagist",
-		pypi: "PyPI",
-		rubygems: "RubyGems"
-	};
-	constructor() {}
-	async initialize() {
-		this.osvOffline = await OsvOffline.create();
+	static datasourceEcosystemMap = datasourceToOsvEcosystem;
+	constructor(osvOffline) {
+		this.osvOffline = osvOffline;
+	}
+	static initialize() {
+		Vulnerabilities.osvOffline ??= OsvOffline.create();
+		return Vulnerabilities.osvOffline;
 	}
 	static async create() {
-		const instance = new Vulnerabilities();
-		await instance.initialize();
-		return instance;
+		const osvOffline = await Vulnerabilities.initialize();
+		return new Vulnerabilities(osvOffline);
 	}
 	async appendVulnerabilityPackageRules(config, packageFiles) {
 		const dependencyVulnerabilities = await this.fetchDependencyVulnerabilities(config, packageFiles);
@@ -89,10 +83,18 @@ var Vulnerabilities = class Vulnerabilities {
 			logger.trace(`Cannot map datasource ${dep.datasource} to OSV ecosystem`);
 			return null;
 		}
-		let packageName = dep.packageName ?? dep.depName;
-		if (ecosystem === "PyPI") packageName = packageName.toLowerCase().replace(regEx(/[_.-]+/g), "-");
+		const packageName = dep.packageName ?? dep.depName;
+		let osvPackageName = packageName;
+		if (ecosystem === "PyPI") osvPackageName = osvPackageName.toLowerCase().replace(regEx(/[_.-]+/g), "-");
+		else if (ecosystem === "Go" && packageName === "go") {
+			if (dep.depType !== "toolchain") return null;
+			osvPackageName = "stdlib";
+		}
 		try {
-			const osvVulnerabilities = await this.osvOffline?.getVulnerabilities(ecosystem, packageName);
+			const osvVulnerabilities = await instrument("get OSV vulnerabilities", () => this.osvOffline.getVulnerabilities(ecosystem, osvPackageName), { attributes: {
+				osvPackageName,
+				ecosystem
+			} });
 			if (isNullOrUndefined(osvVulnerabilities) || isEmptyArray(osvVulnerabilities)) {
 				logger.trace(`No vulnerabilities found in OSV database for ${packageName}`);
 				return null;
@@ -109,12 +111,14 @@ var Vulnerabilities = class Vulnerabilities {
 					logger.trace(`Skipping withdrawn vulnerability ${osvVulnerability.id}`);
 					continue;
 				}
+				this.skipMaliciousPackages(ecosystem, osvPackageName, depVersion, versioningApi, dep, packageFileConfig.manager, packageFileConfig.packageFile, osvVulnerability);
 				for (const affected of osvVulnerability.affected ?? []) {
-					if (!this.isPackageVulnerable(ecosystem, packageName, depVersion, affected, versioningApi)) continue;
+					if (!this.isPackageVulnerable(ecosystem, osvPackageName, depVersion, affected, versioningApi)) continue;
 					logger.debug(`Vulnerability ${osvVulnerability.id} affects ${packageName} ${depVersion}`);
 					const fixedVersion = this.getFixedVersion(ecosystem, depVersion, affected, versioningApi);
 					vulnerabilities.push({
 						packageName,
+						osvPackageName,
 						vulnerability: osvVulnerability,
 						affected,
 						depVersion,
@@ -136,6 +140,38 @@ var Vulnerabilities = class Vulnerabilities {
 			return null;
 		}
 	}
+	skipMaliciousPackages(ecosystem, osvPackageName, depVersion, versioningApi, dep, manager, packageFile, osvVulnerability) {
+		if (osvVulnerability.id.startsWith("MAL-")) for (const affected of osvVulnerability.affected ?? []) {
+			if (this.isPackageVulnerable(ecosystem, osvPackageName, depVersion, affected, versioningApi)) {
+				logger.debug({
+					packageFile,
+					depName: dep.depName,
+					packageName: dep.packageName,
+					manager,
+					datasource: dep.datasource,
+					currentVersion: depVersion
+				}, `Marking ${dep.depName} as skipReason=malicious-version-in-use, as it is affected by ${osvVulnerability.id}`);
+				dep.skipReason = "malicious-version-in-use";
+				dep.skipStage = "lookup";
+			}
+			for (const update of dep.updates ?? []) {
+				const newVersion = update.newVersion ?? update.newValue;
+				if (this.isPackageVulnerable(ecosystem, osvPackageName, newVersion, affected, versioningApi)) {
+					logger.debug({
+						packageFile,
+						depName: dep.depName,
+						packageName: dep.packageName,
+						manager,
+						datasource: dep.datasource,
+						currentVersion: depVersion,
+						newVersion
+					}, `Marking ${dep.depName}'s update to ${newVersion} as skipReason=malicious-update-proposed, as it is affected by ${osvVulnerability.id}`);
+					dep.skipReason = "malicious-update-proposed";
+					dep.skipStage = "lookup";
+				}
+			}
+		}
+	}
 	sortByFixedVersion(packageRules, versioningApi) {
 		const versionsCleaned = {};
 		for (const rule of packageRules) {
@@ -154,8 +190,8 @@ var Vulnerabilities = class Vulnerabilities {
 		if (zeroEvent) sortedCopy.unshift(zeroEvent);
 		return sortedCopy;
 	}
-	isPackageAffected(ecosystem, packageName, affected) {
-		return affected.package?.name === packageName && affected.package?.ecosystem === ecosystem;
+	isPackageAffected(ecosystem, osvPackageName, affected) {
+		return affected.package?.name === osvPackageName && affected.package?.ecosystem === ecosystem;
 	}
 	includedInVersions(depVersion, affected) {
 		return !!affected.versions?.includes(depVersion);
@@ -171,8 +207,8 @@ var Vulnerabilities = class Vulnerabilities {
 		}
 		return false;
 	}
-	isPackageVulnerable(ecosystem, packageName, depVersion, affected, versioningApi) {
-		return this.isPackageAffected(ecosystem, packageName, affected) && (this.includedInVersions(depVersion, affected) || this.includedInRanges(depVersion, affected, versioningApi));
+	isPackageVulnerable(ecosystem, osvPackageName, depVersion, affected, versioningApi) {
+		return this.isPackageAffected(ecosystem, osvPackageName, affected) && (this.includedInVersions(depVersion, affected) || this.includedInRanges(depVersion, affected, versioningApi));
 	}
 	getFixedVersion(ecosystem, depVersion, affected, versioningApi) {
 		const fixedVersions = [];
@@ -191,12 +227,10 @@ var Vulnerabilities = class Vulnerabilities {
 		return null;
 	}
 	getFixedVersionByEcosystem(fixedVersion, ecosystem) {
-		if (ecosystem === "Maven" || ecosystem === "NuGet") return `[${fixedVersion},)`;
-		return `>= ${fixedVersion}`;
+		return getFixedVersionConstraint(fixedVersion, ecosystem);
 	}
 	getLastAffectedByEcosystem(lastAffected, ecosystem) {
-		if (ecosystem === "Maven") return `(${lastAffected},)`;
-		return `> ${lastAffected}`;
+		return getLastAffectedVersionConstraint(lastAffected, ecosystem);
 	}
 	isVersionGt(version, other, versioningApi) {
 		return versioningApi.isVersion(version) && versioningApi.isVersion(other) && versioningApi.isGreaterThan(version, other);
@@ -210,12 +244,17 @@ var Vulnerabilities = class Vulnerabilities {
 			logger.debug(`No fixed version available for vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`);
 			return null;
 		}
-		logger.debug(`Setting allowed version ${fixedVersion} to fix vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`);
+		const versioning = getDefaultVersioning(datasource);
+		logger.debug({
+			datasource,
+			versioning
+		}, `Setting allowed version ${fixedVersion} to fix vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`);
 		const severityDetails = this.extractSeverityDetails(vulnerability, affected);
 		return {
 			matchDatasources: [datasource],
 			matchPackageNames: [packageName],
 			matchCurrentVersion: depVersion,
+			versioning,
 			allowedVersions: fixedVersion,
 			isVulnerabilityAlert: true,
 			vulnerabilitySeverity: severityDetails.severityLevel,
@@ -224,13 +263,13 @@ var Vulnerabilities = class Vulnerabilities {
 		};
 	}
 	static evaluateCvssVector(vector) {
-		const CvssJsonSchema = z.object({
+		const CvssJson = z.object({
 			baseScore: z.number().default(0),
 			baseSeverity: z.string().toUpperCase().default("UNKNOWN")
 		});
 		try {
 			const parsedCvssScore = fromVector(vector);
-			const res = CvssJsonSchema.parse(parsedCvssScore?.createJsonSchema());
+			const res = CvssJson.parse(parsedCvssScore?.createJsonSchema());
 			return [res.baseScore.toFixed(1), res.baseSeverity];
 		} catch {
 			logger.debug(`Error processing CVSS vector ${vector}`);
@@ -241,9 +280,9 @@ var Vulnerabilities = class Vulnerabilities {
 		let aliases = [vulnerability.id].concat(vulnerability.aliases ?? []).sort();
 		aliases = aliases.map((id) => {
 			if (id.startsWith("CVE-")) return `[${id}](https://nvd.nist.gov/vuln/detail/${id})`;
-			else if (id.startsWith("GHSA-")) return `[${id}](https://github.com/advisories/${id})`;
-			else if (id.startsWith("GO-")) return `[${id}](https://pkg.go.dev/vuln/${id})`;
-			else if (id.startsWith("RUSTSEC-")) return `[${id}](https://rustsec.org/advisories/${id}.html)`;
+			if (id.startsWith("GHSA-")) return `[${id}](https://github.com/advisories/${id})`;
+			if (id.startsWith("GO-")) return `[${id}](https://pkg.go.dev/vuln/${id})`;
+			if (id.startsWith("RUSTSEC-")) return `[${id}](https://rustsec.org/advisories/${id}.html)`;
 			return id;
 		});
 		let content = "\n\n---\n\n### ";
@@ -286,7 +325,7 @@ var Vulnerabilities = class Vulnerabilities {
 		};
 	}
 };
-
 //#endregion
 export { Vulnerabilities };
+
 //# sourceMappingURL=vulnerabilities.js.map

package/dist/workers/repository/process/vulnerabilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"vulnerabilities.js","names":["p.all","getVersioning"],"sources":["../../../../lib/workers/repository/process/vulnerabilities.ts"],"sourcesContent":["// TODO #22198\nimport type { Ecosystem, Osv } from '@renovatebot/osv-offline';\nimport { OsvOffline } from '@renovatebot/osv-offline';\nimport {\n  isEmptyArray,\n  isNonEmptyString,\n  isNullOrUndefined,\n  isTruthy,\n} from '@sindresorhus/is';\nimport type { CvssVector } from 'ae-cvss-calculator';\nimport * as _aeCvss from 'ae-cvss-calculator';\nimport { z } from 'zod/v3';\nimport { getManagerConfig, mergeChildConfig } from '../../../config/index.ts';\nimport type { PackageRule, RenovateConfig } from '../../../config/types.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { getDefaultVersioning } from '../../../modules/datasource/common.ts';\nimport type {\n  PackageDependency,\n  PackageFile,\n} from '../../../modules/manager/types.ts';\nimport type { VersioningApi } from '../../../modules/versioning/index.ts';\nimport { get as getVersioning } from '../../../modules/versioning/index.ts';\nimport { sanitizeMarkdown } from '../../../util/markdown.ts';\nimport * as p from '../../../util/promises.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { titleCase } from '../../../util/string.ts';\nimport type {\n  DependencyVulnerabilities,\n  SeverityDetails,\n  Vulnerability,\n} from './types.ts';\n\nconst { fromVector } = _aeCvss as unknown as typeof _aeCvss.default;\n\nexport class Vulnerabilities {\n  private osvOffline: OsvOffline | undefined;\n\n  private static readonly datasourceEcosystemMap: Record<\n    string,\n    Ecosystem | undefined\n  > = {\n    crate: 'crates.io',\n    go: 'Go',\n    hackage: 'Hackage',\n    hex: 'Hex',\n    maven: 'Maven',\n    npm: 'npm',\n    nuget: 'NuGet',\n    packagist: 'Packagist',\n    pypi: 'PyPI',\n    rubygems: 'RubyGems',\n  };\n\n  private constructor() {\n    // private constructor\n  }\n\n  private async initialize(): Promise<void> {\n    this.osvOffline = await OsvOffline.create();\n  }\n\n  static async create(): Promise<Vulnerabilities> {\n    const instance = new Vulnerabilities();\n    await instance.initialize();\n    return instance;\n  }\n\n  async appendVulnerabilityPackageRules(\n    config: RenovateConfig,\n    packageFiles: Record<string, PackageFile[]>,\n  ): Promise<void> {\n    const dependencyVulnerabilities = await this.fetchDependencyVulnerabilities(\n      config,\n      packageFiles,\n    );\n\n    config.packageRules ??= [];\n    for (const {\n      vulnerabilities,\n      versioningApi,\n    } of dependencyVulnerabilities) {\n      const groupPackageRules: PackageRule[] = [];\n      for (const vulnerability of vulnerabilities) {\n        const rule = this.vulnerabilityToPackageRules(vulnerability);\n        if (isNullOrUndefined(rule)) {\n          continue;\n        }\n        groupPackageRules.push(rule);\n      }\n      this.sortByFixedVersion(groupPackageRules, versioningApi);\n\n      config.packageRules.push(...groupPackageRules);\n    }\n  }\n\n  async fetchVulnerabilities(\n    config: RenovateConfig,\n    packageFiles: Record<string, PackageFile[]>,\n  ): Promise<Vulnerability[]> {\n    const groups = await this.fetchDependencyVulnerabilities(\n      config,\n      packageFiles,\n    );\n    return groups.flatMap((group) => group.vulnerabilities);\n  }\n\n  private async fetchDependencyVulnerabilities(\n    config: RenovateConfig,\n    packageFiles: Record<string, PackageFile[]>,\n  ): Promise<DependencyVulnerabilities[]> {\n    const managers = Object.keys(packageFiles);\n    const allManagerJobs = managers.map((manager) =>\n      this.fetchManagerVulnerabilities(config, packageFiles, manager),\n    );\n    return (await Promise.all(allManagerJobs)).flat();\n  }\n\n  private async fetchManagerVulnerabilities(\n    config: RenovateConfig,\n    packageFiles: Record<string, PackageFile[]>,\n    manager: string,\n  ): Promise<DependencyVulnerabilities[]> {\n    const managerConfig = getManagerConfig(config, manager);\n    const queue = packageFiles[manager].map(\n      (pFile) => (): Promise<DependencyVulnerabilities[]> =>\n        this.fetchManagerPackageFileVulnerabilities(managerConfig, pFile),\n    );\n    logger.trace(\n      { manager, queueLength: queue.length },\n      'fetchManagerVulnerabilities starting',\n    );\n    const result = (await p.all(queue)).flat();\n    logger.trace({ manager }, 'fetchManagerVulnerabilities finished');\n    return result;\n  }\n\n  private async fetchManagerPackageFileVulnerabilities(\n    managerConfig: RenovateConfig,\n    pFile: PackageFile,\n  ): Promise<DependencyVulnerabilities[]> {\n    const { packageFile } = pFile;\n    const packageFileConfig = mergeChildConfig(managerConfig, pFile);\n    const { manager } = packageFileConfig;\n    const queue = pFile.deps.map(\n      (dep) => (): Promise<DependencyVulnerabilities | null> =>\n        this.fetchDependencyVulnerability(packageFileConfig, dep),\n    );\n    logger.trace(\n      { manager, packageFile, queueLength: queue.length },\n      'fetchManagerPackageFileVulnerabilities starting with concurrency',\n    );\n\n    const result = await p.all(queue);\n    logger.trace(\n      { packageFile },\n      'fetchManagerPackageFileVulnerabilities finished',\n    );\n\n    return result.filter(isTruthy);\n  }\n\n  private async fetchDependencyVulnerability(\n    packageFileConfig: RenovateConfig & PackageFile,\n    dep: PackageDependency,\n  ): Promise<DependencyVulnerabilities | null> {\n    const ecosystem = Vulnerabilities.datasourceEcosystemMap[dep.datasource!];\n    if (!ecosystem) {\n      logger.trace(`Cannot map datasource ${dep.datasource!} to OSV ecosystem`);\n      return null;\n    }\n\n    let packageName = dep.packageName ?? dep.depName!;\n    if (ecosystem === 'PyPI') {\n      // https://peps.python.org/pep-0503/#normalized-names\n      packageName = packageName.toLowerCase().replace(regEx(/[_.-]+/g), '-');\n    }\n\n    try {\n      const osvVulnerabilities = await this.osvOffline?.getVulnerabilities(\n        ecosystem,\n        packageName,\n      );\n      if (\n        isNullOrUndefined(osvVulnerabilities) ||\n        isEmptyArray(osvVulnerabilities)\n      ) {\n        logger.trace(\n          `No vulnerabilities found in OSV database for ${packageName}`,\n        );\n        return null;\n      }\n\n      const depVersion =\n        dep.lockedVersion ?? dep.currentVersion ?? dep.currentValue!;\n\n      const versioning = dep.versioning ?? getDefaultVersioning(dep.datasource);\n      const versioningApi = getVersioning(versioning);\n\n      if (!versioningApi.isVersion(depVersion)) {\n        logger.debug(\n          `Skipping vulnerability lookup for package ${packageName} due to unsupported version ${depVersion}`,\n        );\n        return null;\n      }\n\n      const vulnerabilities: Vulnerability[] = [];\n      for (const osvVulnerability of osvVulnerabilities) {\n        if (osvVulnerability.withdrawn) {\n          logger.trace(\n            `Skipping withdrawn vulnerability ${osvVulnerability.id}`,\n          );\n          continue;\n        }\n\n        for (const affected of osvVulnerability.affected ?? []) {\n          const isVulnerable = this.isPackageVulnerable(\n            ecosystem,\n            packageName,\n            depVersion,\n            affected,\n            versioningApi,\n          );\n          if (!isVulnerable) {\n            continue;\n          }\n\n          logger.debug(\n            `Vulnerability ${osvVulnerability.id} affects ${packageName} ${depVersion}`,\n          );\n          const fixedVersion = this.getFixedVersion(\n            ecosystem,\n            depVersion,\n            affected,\n            versioningApi,\n          );\n\n          vulnerabilities.push({\n            packageName,\n            vulnerability: osvVulnerability,\n            affected,\n            depVersion,\n            fixedVersion,\n            datasource: dep.datasource!,\n            packageFileConfig,\n          });\n        }\n      }\n\n      return { vulnerabilities, versioningApi };\n    } catch (err) {\n      logger.warn(\n        { err, packageName },\n        'Error fetching vulnerability information for package',\n      );\n      return null;\n    }\n  }\n\n  private sortByFixedVersion(\n    packageRules: PackageRule[],\n    versioningApi: VersioningApi,\n  ): void {\n    const versionsCleaned: Record<string, string> = {};\n    for (const rule of packageRules) {\n      const version = rule.allowedVersions!;\n      versionsCleaned[version] = version.replace(regEx(/[(),=> ]+/g), '');\n    }\n    packageRules.sort((a, b) =>\n      versioningApi.sortVersions(\n        versionsCleaned[a.allowedVersions!],\n        versionsCleaned[b.allowedVersions!],\n      ),\n    );\n  }\n\n  // https://ossf.github.io/osv-schema/#affectedrangesevents-fields\n  private sortEvents(\n    events: Osv.Event[],\n    versioningApi: VersioningApi,\n  ): Osv.Event[] {\n    const sortedCopy: Osv.Event[] = [];\n    let zeroEvent: Osv.Event | null = null;\n\n    for (const event of events) {\n      if (event.introduced === '0') {\n        zeroEvent = event;\n      } else if (versioningApi.isVersion(Object.values(event)[0])) {\n        sortedCopy.push(event);\n      } else {\n        logger.debug({ event }, 'Skipping OSV event with invalid version');\n      }\n    }\n\n    sortedCopy.sort((a, b) =>\n      // no pre-processing, as there are only very few values to sort\n      versioningApi.sortVersions(Object.values(a)[0], Object.values(b)[0]),\n    );\n\n    if (zeroEvent) {\n      sortedCopy.unshift(zeroEvent);\n    }\n\n    return sortedCopy;\n  }\n\n  private isPackageAffected(\n    ecosystem: Ecosystem,\n    packageName: string,\n    affected: Osv.Affected,\n  ): boolean {\n    return (\n      affected.package?.name === packageName &&\n      affected.package?.ecosystem === ecosystem\n    );\n  }\n\n  private includedInVersions(\n    depVersion: string,\n    affected: Osv.Affected,\n  ): boolean {\n    return !!affected.versions?.includes(depVersion);\n  }\n\n  private includedInRanges(\n    depVersion: string,\n    affected: Osv.Affected,\n    versioningApi: VersioningApi,\n  ): boolean {\n    for (const range of affected.ranges ?? []) {\n      if (range.type === 'GIT') {\n        continue;\n      }\n\n      let vulnerable = false;\n      for (const event of this.sortEvents(range.events, versioningApi)) {\n        if (\n          isNonEmptyString(event.introduced) &&\n          (event.introduced === '0' ||\n            this.isVersionGtOrEq(depVersion, event.introduced, versioningApi))\n        ) {\n          vulnerable = true;\n        } else if (\n          isNonEmptyString(event.fixed) &&\n          this.isVersionGtOrEq(depVersion, event.fixed, versioningApi)\n        ) {\n          vulnerable = false;\n        } else if (\n          isNonEmptyString(event.last_affected) &&\n          this.isVersionGt(depVersion, event.last_affected, versioningApi)\n        ) {\n          vulnerable = false;\n        }\n      }\n\n      if (vulnerable) {\n        return true;\n      }\n    }\n\n    return false;\n  }\n\n  // https://ossf.github.io/osv-schema/#evaluation\n  private isPackageVulnerable(\n    ecosystem: Ecosystem,\n    packageName: string,\n    depVersion: string,\n    affected: Osv.Affected,\n    versioningApi: VersioningApi,\n  ): boolean {\n    return (\n      this.isPackageAffected(ecosystem, packageName, affected) &&\n      (this.includedInVersions(depVersion, affected) ||\n        this.includedInRanges(depVersion, affected, versioningApi))\n    );\n  }\n\n  private getFixedVersion(\n    ecosystem: Ecosystem,\n    depVersion: string,\n    affected: Osv.Affected,\n    versioningApi: VersioningApi,\n  ): string | null {\n    const fixedVersions: string[] = [];\n    const lastAffectedVersions: string[] = [];\n\n    for (const range of affected.ranges ?? []) {\n      if (range.type === 'GIT') {\n        continue;\n      }\n\n      for (const event of range.events) {\n        if (\n          isNonEmptyString(event.fixed) &&\n          versioningApi.isVersion(event.fixed)\n        ) {\n          fixedVersions.push(event.fixed);\n        } else if (\n          isNonEmptyString(event.last_affected) &&\n          versioningApi.isVersion(event.last_affected)\n        ) {\n          lastAffectedVersions.push(event.last_affected);\n        }\n      }\n    }\n\n    fixedVersions.sort((a, b) => versioningApi.sortVersions(a, b));\n    const fixedVersion = fixedVersions.find((version) =>\n      this.isVersionGt(version, depVersion, versioningApi),\n    );\n    if (fixedVersion) {\n      return this.getFixedVersionByEcosystem(fixedVersion, ecosystem);\n    }\n\n    lastAffectedVersions.sort((a, b) => versioningApi.sortVersions(a, b));\n    const lastAffected = lastAffectedVersions.find((version) =>\n      this.isVersionGtOrEq(version, depVersion, versioningApi),\n    );\n    if (lastAffected) {\n      return this.getLastAffectedByEcosystem(lastAffected, ecosystem);\n    }\n\n    return null;\n  }\n\n  private getFixedVersionByEcosystem(\n    fixedVersion: string,\n    ecosystem: Ecosystem,\n  ): string {\n    if (ecosystem === 'Maven' || ecosystem === 'NuGet') {\n      return `[${fixedVersion},)`;\n    }\n\n    // crates.io, Go, Hex, npm, RubyGems, PyPI\n    return `>= ${fixedVersion}`;\n  }\n\n  private getLastAffectedByEcosystem(\n    lastAffected: string,\n    ecosystem: Ecosystem,\n  ): string {\n    if (ecosystem === 'Maven') {\n      return `(${lastAffected},)`;\n    }\n\n    // crates.io, Go, Hex, npm, RubyGems, PyPI\n    return `> ${lastAffected}`;\n  }\n\n  private isVersionGt(\n    version: string,\n    other: string,\n    versioningApi: VersioningApi,\n  ): boolean {\n    return (\n      versioningApi.isVersion(version) &&\n      versioningApi.isVersion(other) &&\n      versioningApi.isGreaterThan(version, other)\n    );\n  }\n\n  private isVersionGtOrEq(\n    version: string,\n    other: string,\n    versioningApi: VersioningApi,\n  ): boolean {\n    return (\n      versioningApi.isVersion(version) &&\n      versioningApi.isVersion(other) &&\n      (versioningApi.equals(version, other) ||\n        versioningApi.isGreaterThan(version, other))\n    );\n  }\n\n  private vulnerabilityToPackageRules(vul: Vulnerability): PackageRule | null {\n    const {\n      vulnerability,\n      affected,\n      packageName,\n      depVersion,\n      fixedVersion,\n      datasource,\n      packageFileConfig,\n    } = vul;\n    if (isNullOrUndefined(fixedVersion)) {\n      logger.debug(\n        `No fixed version available for vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`,\n      );\n      return null;\n    }\n\n    logger.debug(\n      `Setting allowed version ${fixedVersion} to fix vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`,\n    );\n\n    const severityDetails = this.extractSeverityDetails(\n      vulnerability,\n      affected,\n    );\n\n    return {\n      matchDatasources: [datasource],\n      matchPackageNames: [packageName],\n      matchCurrentVersion: depVersion,\n      allowedVersions: fixedVersion,\n      isVulnerabilityAlert: true,\n      vulnerabilitySeverity: severityDetails.severityLevel,\n      prBodyNotes: this.generatePrBodyNotes(vulnerability, affected),\n      force: {\n        ...packageFileConfig.vulnerabilityAlerts,\n      },\n    };\n  }\n\n  static evaluateCvssVector(vector: string): [string, string] {\n    const CvssJsonSchema = z.object({\n      baseScore: z.number().default(0.0),\n      baseSeverity: z.string().toUpperCase().default('UNKNOWN'),\n    });\n\n    try {\n      const parsedCvssScore: CvssVector<any> | null = fromVector(vector);\n      const res = CvssJsonSchema.parse(parsedCvssScore?.createJsonSchema());\n\n      return [res.baseScore.toFixed(1), res.baseSeverity];\n    } catch {\n      logger.debug(`Error processing CVSS vector ${vector}`);\n    }\n\n    return ['', ''];\n  }\n\n  private generatePrBodyNotes(\n    vulnerability: Osv.Vulnerability,\n    affected: Osv.Affected,\n  ): string[] {\n    let aliases = [vulnerability.id].concat(vulnerability.aliases ?? []).sort();\n    aliases = aliases.map((id) => {\n      if (id.startsWith('CVE-')) {\n        return `[${id}](https://nvd.nist.gov/vuln/detail/${id})`;\n      } else if (id.startsWith('GHSA-')) {\n        return `[${id}](https://github.com/advisories/${id})`;\n      } else if (id.startsWith('GO-')) {\n        return `[${id}](https://pkg.go.dev/vuln/${id})`;\n      } else if (id.startsWith('RUSTSEC-')) {\n        return `[${id}](https://rustsec.org/advisories/${id}.html)`;\n      }\n\n      return id;\n    });\n\n    let content = '\\n\\n---\\n\\n### ';\n    content += vulnerability.summary ? `${vulnerability.summary}\\n` : '';\n    content += `${aliases.join(' / ')}\\n`;\n    content += `\\n<details>\\n<summary>More information</summary>\\n`;\n\n    const details = vulnerability.details?.replace(\n      regEx(/^#{1,4} /gm),\n      '##### ',\n    );\n    content += `#### Details\\n${details ?? 'No details.'}\\n`;\n\n    content += '#### Severity\\n';\n    const severityDetails = this.extractSeverityDetails(\n      vulnerability,\n      affected,\n    );\n\n    if (severityDetails.cvssVector) {\n      content += `- CVSS Score: ${severityDetails.score}\\n`;\n      content += `- Vector String: \\`${severityDetails.cvssVector}\\`\\n`;\n    } else {\n      content += `${titleCase(severityDetails.severityLevel)}\\n`;\n    }\n\n    content += `\\n#### References\\n${\n      vulnerability.references\n        ?.map((ref) => {\n          return `- [${ref.url}](${ref.url})`;\n        })\n        .join('\\n') ?? 'No references.'\n    }`;\n\n    let attribution = '';\n    if (vulnerability.id.startsWith('GHSA-')) {\n      attribution = ` and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md))`;\n    } else if (vulnerability.id.startsWith('GO-')) {\n      attribution = ` and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license))`;\n    } else if (vulnerability.id.startsWith('PYSEC-')) {\n      attribution = ` and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE))`;\n    } else if (vulnerability.id.startsWith('RUSTSEC-')) {\n      attribution = ` and the [Rust Advisory Database](https://github.com/RustSec/advisory-db) ([CC0 1.0](https://github.com/rustsec/advisory-db/blob/main/LICENSE.txt))`;\n    }\n    content += `\\n\\nThis data is provided by [OSV](https://osv.dev/vulnerability/${vulnerability.id})${attribution}.\\n`;\n    content += `</details>`;\n\n    return [sanitizeMarkdown(content)];\n  }\n\n  private extractSeverityDetails(\n    vulnerability: Osv.Vulnerability,\n    affected: Osv.Affected,\n  ): SeverityDetails {\n    let severityLevel = 'UNKNOWN';\n    let score = 'Unknown';\n\n    const cvssVector =\n      vulnerability.severity?.find((e) => e.type === 'CVSS_V4')?.score ??\n      vulnerability.severity?.find((e) => e.type === 'CVSS_V3')?.score ??\n      (affected.database_specific?.cvss as string); // RUSTSEC\n\n    if (cvssVector) {\n      const [baseScore, severity] =\n        Vulnerabilities.evaluateCvssVector(cvssVector);\n      severityLevel = severity ? severity.toUpperCase() : 'UNKNOWN';\n      score = baseScore\n        ? `${baseScore} / 10 (${titleCase(severityLevel)})`\n        : 'Unknown';\n    } else if (\n      vulnerability.id.startsWith('GHSA-') &&\n      vulnerability.database_specific?.severity\n    ) {\n      const severity = vulnerability.database_specific.severity as string;\n      severityLevel = severity.toUpperCase();\n    }\n\n    return {\n      cvssVector,\n      score,\n      severityLevel,\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAgCA,MAAM,EAAE,eAAe;AAEvB,IAAa,kBAAb,MAAa,gBAAgB;CAC3B,AAAQ;CAER,OAAwB,yBAGpB;EACF,OAAO;EACP,IAAI;EACJ,SAAS;EACT,KAAK;EACL,OAAO;EACP,KAAK;EACL,OAAO;EACP,WAAW;EACX,MAAM;EACN,UAAU;EACX;CAED,AAAQ,cAAc;CAItB,MAAc,aAA4B;AACxC,OAAK,aAAa,MAAM,WAAW,QAAQ;;CAG7C,aAAa,SAAmC;EAC9C,MAAM,WAAW,IAAI,iBAAiB;AACtC,QAAM,SAAS,YAAY;AAC3B,SAAO;;CAGT,MAAM,gCACJ,QACA,cACe;EACf,MAAM,4BAA4B,MAAM,KAAK,+BAC3C,QACA,aACD;AAED,SAAO,iBAAiB,EAAE;AAC1B,OAAK,MAAM,EACT,iBACA,mBACG,2BAA2B;GAC9B,MAAM,oBAAmC,EAAE;AAC3C,QAAK,MAAM,iBAAiB,iBAAiB;IAC3C,MAAM,OAAO,KAAK,4BAA4B,cAAc;AAC5D,QAAI,kBAAkB,KAAK,CACzB;AAEF,sBAAkB,KAAK,KAAK;;AAE9B,QAAK,mBAAmB,mBAAmB,cAAc;AAEzD,UAAO,aAAa,KAAK,GAAG,kBAAkB;;;CAIlD,MAAM,qBACJ,QACA,cAC0B;AAK1B,UAJe,MAAM,KAAK,+BACxB,QACA,aACD,EACa,SAAS,UAAU,MAAM,gBAAgB;;CAGzD,MAAc,+BACZ,QACA,cACsC;EAEtC,MAAM,iBADW,OAAO,KAAK,aAAa,CACV,KAAK,YACnC,KAAK,4BAA4B,QAAQ,cAAc,QAAQ,CAChE;AACD,UAAQ,MAAM,QAAQ,IAAI,eAAe,EAAE,MAAM;;CAGnD,MAAc,4BACZ,QACA,cACA,SACsC;EACtC,MAAM,gBAAgB,iBAAiB,QAAQ,QAAQ;EACvD,MAAM,QAAQ,aAAa,SAAS,KACjC,gBACC,KAAK,uCAAuC,eAAe,MAAM,CACpE;AACD,SAAO,MACL;GAAE;GAAS,aAAa,MAAM;GAAQ,EACtC,uCACD;EACD,MAAM,UAAU,MAAMA,IAAM,MAAM,EAAE,MAAM;AAC1C,SAAO,MAAM,EAAE,SAAS,EAAE,uCAAuC;AACjE,SAAO;;CAGT,MAAc,uCACZ,eACA,OACsC;EACtC,MAAM,EAAE,gBAAgB;EACxB,MAAM,oBAAoB,iBAAiB,eAAe,MAAM;EAChE,MAAM,EAAE,YAAY;EACpB,MAAM,QAAQ,MAAM,KAAK,KACtB,cACC,KAAK,6BAA6B,mBAAmB,IAAI,CAC5D;AACD,SAAO,MACL;GAAE;GAAS;GAAa,aAAa,MAAM;GAAQ,EACnD,mEACD;EAED,MAAM,SAAS,MAAMA,IAAM,MAAM;AACjC,SAAO,MACL,EAAE,aAAa,EACf,kDACD;AAED,SAAO,OAAO,OAAO,SAAS;;CAGhC,MAAc,6BACZ,mBACA,KAC2C;EAC3C,MAAM,YAAY,gBAAgB,uBAAuB,IAAI;AAC7D,MAAI,CAAC,WAAW;AACd,UAAO,MAAM,yBAAyB,IAAI,WAAY,mBAAmB;AACzE,UAAO;;EAGT,IAAI,cAAc,IAAI,eAAe,IAAI;AACzC,MAAI,cAAc,OAEhB,eAAc,YAAY,aAAa,CAAC,QAAQ,MAAM,UAAU,EAAE,IAAI;AAGxE,MAAI;GACF,MAAM,qBAAqB,MAAM,KAAK,YAAY,mBAChD,WACA,YACD;AACD,OACE,kBAAkB,mBAAmB,IACrC,aAAa,mBAAmB,EAChC;AACA,WAAO,MACL,gDAAgD,cACjD;AACD,WAAO;;GAGT,MAAM,aACJ,IAAI,iBAAiB,IAAI,kBAAkB,IAAI;GAGjD,MAAM,gBAAgBC,IADH,IAAI,cAAc,qBAAqB,IAAI,WAAW,CAC1B;AAE/C,OAAI,CAAC,cAAc,UAAU,WAAW,EAAE;AACxC,WAAO,MACL,6CAA6C,YAAY,8BAA8B,aACxF;AACD,WAAO;;GAGT,MAAM,kBAAmC,EAAE;AAC3C,QAAK,MAAM,oBAAoB,oBAAoB;AACjD,QAAI,iBAAiB,WAAW;AAC9B,YAAO,MACL,oCAAoC,iBAAiB,KACtD;AACD;;AAGF,SAAK,MAAM,YAAY,iBAAiB,YAAY,EAAE,EAAE;AAQtD,SAAI,CAPiB,KAAK,oBACxB,WACA,aACA,YACA,UACA,cACD,CAEC;AAGF,YAAO,MACL,iBAAiB,iBAAiB,GAAG,WAAW,YAAY,GAAG,aAChE;KACD,MAAM,eAAe,KAAK,gBACxB,WACA,YACA,UACA,cACD;AAED,qBAAgB,KAAK;MACnB;MACA,eAAe;MACf;MACA;MACA;MACA,YAAY,IAAI;MAChB;MACD,CAAC;;;AAIN,UAAO;IAAE;IAAiB;IAAe;WAClC,KAAK;AACZ,UAAO,KACL;IAAE;IAAK;IAAa,EACpB,uDACD;AACD,UAAO;;;CAIX,AAAQ,mBACN,cACA,eACM;EACN,MAAM,kBAA0C,EAAE;AAClD,OAAK,MAAM,QAAQ,cAAc;GAC/B,MAAM,UAAU,KAAK;AACrB,mBAAgB,WAAW,QAAQ,QAAQ,MAAM,aAAa,EAAE,GAAG;;AAErE,eAAa,MAAM,GAAG,MACpB,cAAc,aACZ,gBAAgB,EAAE,kBAClB,gBAAgB,EAAE,iBACnB,CACF;;CAIH,AAAQ,WACN,QACA,eACa;EACb,MAAM,aAA0B,EAAE;EAClC,IAAI,YAA8B;AAElC,OAAK,MAAM,SAAS,OAClB,KAAI,MAAM,eAAe,IACvB,aAAY;WACH,cAAc,UAAU,OAAO,OAAO,MAAM,CAAC,GAAG,CACzD,YAAW,KAAK,MAAM;MAEtB,QAAO,MAAM,EAAE,OAAO,EAAE,0CAA0C;AAItE,aAAW,MAAM,GAAG,MAElB,cAAc,aAAa,OAAO,OAAO,EAAE,CAAC,IAAI,OAAO,OAAO,EAAE,CAAC,GAAG,CACrE;AAED,MAAI,UACF,YAAW,QAAQ,UAAU;AAG/B,SAAO;;CAGT,AAAQ,kBACN,WACA,aACA,UACS;AACT,SACE,SAAS,SAAS,SAAS,eAC3B,SAAS,SAAS,cAAc;;CAIpC,AAAQ,mBACN,YACA,UACS;AACT,SAAO,CAAC,CAAC,SAAS,UAAU,SAAS,WAAW;;CAGlD,AAAQ,iBACN,YACA,UACA,eACS;AACT,OAAK,MAAM,SAAS,SAAS,UAAU,EAAE,EAAE;AACzC,OAAI,MAAM,SAAS,MACjB;GAGF,IAAI,aAAa;AACjB,QAAK,MAAM,SAAS,KAAK,WAAW,MAAM,QAAQ,cAAc,CAC9D,KACE,iBAAiB,MAAM,WAAW,KACjC,MAAM,eAAe,OACpB,KAAK,gBAAgB,YAAY,MAAM,YAAY,cAAc,EAEnE,cAAa;YAEb,iBAAiB,MAAM,MAAM,IAC7B,KAAK,gBAAgB,YAAY,MAAM,OAAO,cAAc,CAE5D,cAAa;YAEb,iBAAiB,MAAM,cAAc,IACrC,KAAK,YAAY,YAAY,MAAM,eAAe,cAAc,CAEhE,cAAa;AAIjB,OAAI,WACF,QAAO;;AAIX,SAAO;;CAIT,AAAQ,oBACN,WACA,aACA,YACA,UACA,eACS;AACT,SACE,KAAK,kBAAkB,WAAW,aAAa,SAAS,KACvD,KAAK,mBAAmB,YAAY,SAAS,IAC5C,KAAK,iBAAiB,YAAY,UAAU,cAAc;;CAIhE,AAAQ,gBACN,WACA,YACA,UACA,eACe;EACf,MAAM,gBAA0B,EAAE;EAClC,MAAM,uBAAiC,EAAE;AAEzC,OAAK,MAAM,SAAS,SAAS,UAAU,EAAE,EAAE;AACzC,OAAI,MAAM,SAAS,MACjB;AAGF,QAAK,MAAM,SAAS,MAAM,OACxB,KACE,iBAAiB,MAAM,MAAM,IAC7B,cAAc,UAAU,MAAM,MAAM,CAEpC,eAAc,KAAK,MAAM,MAAM;YAE/B,iBAAiB,MAAM,cAAc,IACrC,cAAc,UAAU,MAAM,cAAc,CAE5C,sBAAqB,KAAK,MAAM,cAAc;;AAKpD,gBAAc,MAAM,GAAG,MAAM,cAAc,aAAa,GAAG,EAAE,CAAC;EAC9D,MAAM,eAAe,cAAc,MAAM,YACvC,KAAK,YAAY,SAAS,YAAY,cAAc,CACrD;AACD,MAAI,aACF,QAAO,KAAK,2BAA2B,cAAc,UAAU;AAGjE,uBAAqB,MAAM,GAAG,MAAM,cAAc,aAAa,GAAG,EAAE,CAAC;EACrE,MAAM,eAAe,qBAAqB,MAAM,YAC9C,KAAK,gBAAgB,SAAS,YAAY,cAAc,CACzD;AACD,MAAI,aACF,QAAO,KAAK,2BAA2B,cAAc,UAAU;AAGjE,SAAO;;CAGT,AAAQ,2BACN,cACA,WACQ;AACR,MAAI,cAAc,WAAW,cAAc,QACzC,QAAO,IAAI,aAAa;AAI1B,SAAO,MAAM;;CAGf,AAAQ,2BACN,cACA,WACQ;AACR,MAAI,cAAc,QAChB,QAAO,IAAI,aAAa;AAI1B,SAAO,KAAK;;CAGd,AAAQ,YACN,SACA,OACA,eACS;AACT,SACE,cAAc,UAAU,QAAQ,IAChC,cAAc,UAAU,MAAM,IAC9B,cAAc,cAAc,SAAS,MAAM;;CAI/C,AAAQ,gBACN,SACA,OACA,eACS;AACT,SACE,cAAc,UAAU,QAAQ,IAChC,cAAc,UAAU,MAAM,KAC7B,cAAc,OAAO,SAAS,MAAM,IACnC,cAAc,cAAc,SAAS,MAAM;;CAIjD,AAAQ,4BAA4B,KAAwC;EAC1E,MAAM,EACJ,eACA,UACA,aACA,YACA,cACA,YACA,sBACE;AACJ,MAAI,kBAAkB,aAAa,EAAE;AACnC,UAAO,MACL,gDAAgD,cAAc,GAAG,MAAM,YAAY,GAAG,aACvF;AACD,UAAO;;AAGT,SAAO,MACL,2BAA2B,aAAa,wBAAwB,cAAc,GAAG,MAAM,YAAY,GAAG,aACvG;EAED,MAAM,kBAAkB,KAAK,uBAC3B,eACA,SACD;AAED,SAAO;GACL,kBAAkB,CAAC,WAAW;GAC9B,mBAAmB,CAAC,YAAY;GAChC,qBAAqB;GACrB,iBAAiB;GACjB,sBAAsB;GACtB,uBAAuB,gBAAgB;GACvC,aAAa,KAAK,oBAAoB,eAAe,SAAS;GAC9D,OAAO,EACL,GAAG,kBAAkB,qBACtB;GACF;;CAGH,OAAO,mBAAmB,QAAkC;EAC1D,MAAM,iBAAiB,EAAE,OAAO;GAC9B,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAI;GAClC,cAAc,EAAE,QAAQ,CAAC,aAAa,CAAC,QAAQ,UAAU;GAC1D,CAAC;AAEF,MAAI;GACF,MAAM,kBAA0C,WAAW,OAAO;GAClE,MAAM,MAAM,eAAe,MAAM,iBAAiB,kBAAkB,CAAC;AAErE,UAAO,CAAC,IAAI,UAAU,QAAQ,EAAE,EAAE,IAAI,aAAa;UAC7C;AACN,UAAO,MAAM,gCAAgC,SAAS;;AAGxD,SAAO,CAAC,IAAI,GAAG;;CAGjB,AAAQ,oBACN,eACA,UACU;EACV,IAAI,UAAU,CAAC,cAAc,GAAG,CAAC,OAAO,cAAc,WAAW,EAAE,CAAC,CAAC,MAAM;AAC3E,YAAU,QAAQ,KAAK,OAAO;AAC5B,OAAI,GAAG,WAAW,OAAO,CACvB,QAAO,IAAI,GAAG,qCAAqC,GAAG;YAC7C,GAAG,WAAW,QAAQ,CAC/B,QAAO,IAAI,GAAG,kCAAkC,GAAG;YAC1C,GAAG,WAAW,MAAM,CAC7B,QAAO,IAAI,GAAG,4BAA4B,GAAG;YACpC,GAAG,WAAW,WAAW,CAClC,QAAO,IAAI,GAAG,mCAAmC,GAAG;AAGtD,UAAO;IACP;EAEF,IAAI,UAAU;AACd,aAAW,cAAc,UAAU,GAAG,cAAc,QAAQ,MAAM;AAClE,aAAW,GAAG,QAAQ,KAAK,MAAM,CAAC;AAClC,aAAW;EAEX,MAAM,UAAU,cAAc,SAAS,QACrC,MAAM,aAAa,EACnB,SACD;AACD,aAAW,iBAAiB,WAAW,cAAc;AAErD,aAAW;EACX,MAAM,kBAAkB,KAAK,uBAC3B,eACA,SACD;AAED,MAAI,gBAAgB,YAAY;AAC9B,cAAW,iBAAiB,gBAAgB,MAAM;AAClD,cAAW,sBAAsB,gBAAgB,WAAW;QAE5D,YAAW,GAAG,UAAU,gBAAgB,cAAc,CAAC;AAGzD,aAAW,sBACT,cAAc,YACV,KAAK,QAAQ;AACb,UAAO,MAAM,IAAI,IAAI,IAAI,IAAI,IAAI;IACjC,CACD,KAAK,KAAK,IAAI;EAGnB,IAAI,cAAc;AAClB,MAAI,cAAc,GAAG,WAAW,QAAQ,CACtC,eAAc;WACL,cAAc,GAAG,WAAW,MAAM,CAC3C,eAAc;WACL,cAAc,GAAG,WAAW,SAAS,CAC9C,eAAc;WACL,cAAc,GAAG,WAAW,WAAW,CAChD,eAAc;AAEhB,aAAW,oEAAoE,cAAc,GAAG,GAAG,YAAY;AAC/G,aAAW;AAEX,SAAO,CAAC,iBAAiB,QAAQ,CAAC;;CAGpC,AAAQ,uBACN,eACA,UACiB;EACjB,IAAI,gBAAgB;EACpB,IAAI,QAAQ;EAEZ,MAAM,aACJ,cAAc,UAAU,MAAM,MAAM,EAAE,SAAS,UAAU,EAAE,SAC3D,cAAc,UAAU,MAAM,MAAM,EAAE,SAAS,UAAU,EAAE,SAC1D,SAAS,mBAAmB;AAE/B,MAAI,YAAY;GACd,MAAM,CAAC,WAAW,YAChB,gBAAgB,mBAAmB,WAAW;AAChD,mBAAgB,WAAW,SAAS,aAAa,GAAG;AACpD,WAAQ,YACJ,GAAG,UAAU,SAAS,UAAU,cAAc,CAAC,KAC/C;aAEJ,cAAc,GAAG,WAAW,QAAQ,IACpC,cAAc,mBAAmB,SAGjC,iBADiB,cAAc,kBAAkB,SACxB,aAAa;AAGxC,SAAO;GACL;GACA;GACA;GACD"}
+{"version":3,"file":"vulnerabilities.js","names":["p.all","getVersioning"],"sources":["../../../../lib/workers/repository/process/vulnerabilities.ts"],"sourcesContent":["// TODO #22198\nimport type { Ecosystem, Osv } from '@renovatebot/osv-offline';\nimport { OsvOffline } from '@renovatebot/osv-offline';\nimport {\n  isEmptyArray,\n  isNonEmptyString,\n  isNullOrUndefined,\n  isTruthy,\n} from '@sindresorhus/is';\nimport type { CvssVector } from 'ae-cvss-calculator';\nimport * as _aeCvss from 'ae-cvss-calculator';\nimport { z } from 'zod/v4';\nimport { getManagerConfig, mergeChildConfig } from '../../../config/index.ts';\nimport type { PackageRule, RenovateConfig } from '../../../config/types.ts';\nimport { instrument } from '../../../instrumentation/index.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { getDefaultVersioning } from '../../../modules/datasource/common.ts';\nimport type {\n  PackageDependency,\n  PackageFile,\n} from '../../../modules/manager/types.ts';\nimport type { VersioningApi } from '../../../modules/versioning/index.ts';\nimport { get as getVersioning } from '../../../modules/versioning/index.ts';\nimport { sanitizeMarkdown } from '../../../util/markdown.ts';\nimport * as p from '../../../util/promises.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { titleCase } from '../../../util/string.ts';\nimport { datasourceToOsvEcosystem } from '../../../util/vulnerability/ecosystem.ts';\nimport {\n  getFixedVersionConstraint,\n  getLastAffectedVersionConstraint,\n} from '../../../util/vulnerability/utils.ts';\nimport type {\n  DependencyVulnerabilities,\n  SeverityDetails,\n  Vulnerability,\n} from './types.ts';\n\nconst { fromVector } = (_aeCvss as unknown as { default: typeof _aeCvss })\n  .default;\n\nexport class Vulnerabilities {\n  private static osvOffline: Promise<OsvOffline> | undefined;\n\n  private osvOffline: OsvOffline;\n\n  private static readonly datasourceEcosystemMap = datasourceToOsvEcosystem;\n\n  private constructor(osvOffline: OsvOffline) {\n    this.osvOffline = osvOffline;\n  }\n\n  private static initialize(): Promise<OsvOffline> {\n    // no async here, so osv promise will only be created once\n    Vulnerabilities.osvOffline ??= OsvOffline.create();\n    return Vulnerabilities.osvOffline;\n  }\n\n  static async create(): Promise<Vulnerabilities> {\n    // intialize osv only once\n    const osvOffline = await Vulnerabilities.initialize();\n\n    const instance = new Vulnerabilities(osvOffline);\n    return instance;\n  }\n\n  async appendVulnerabilityPackageRules(\n    config: RenovateConfig,\n    packageFiles: Record<string, PackageFile[]>,\n  ): Promise<void> {\n    const dependencyVulnerabilities = await this.fetchDependencyVulnerabilities(\n      config,\n      packageFiles,\n    );\n\n    config.packageRules ??= [];\n    for (const {\n      vulnerabilities,\n      versioningApi,\n    } of dependencyVulnerabilities) {\n      const groupPackageRules: PackageRule[] = [];\n      for (const vulnerability of vulnerabilities) {\n        const rule = this.vulnerabilityToPackageRules(vulnerability);\n        if (isNullOrUndefined(rule)) {\n          continue;\n        }\n        groupPackageRules.push(rule);\n      }\n      this.sortByFixedVersion(groupPackageRules, versioningApi);\n\n      config.packageRules.push(...groupPackageRules);\n    }\n  }\n\n  async fetchVulnerabilities(\n    config: RenovateConfig,\n    packageFiles: Record<string, PackageFile[]>,\n  ): Promise<Vulnerability[]> {\n    const groups = await this.fetchDependencyVulnerabilities(\n      config,\n      packageFiles,\n    );\n    return groups.flatMap((group) => group.vulnerabilities);\n  }\n\n  private async fetchDependencyVulnerabilities(\n    config: RenovateConfig,\n    packageFiles: Record<string, PackageFile[]>,\n  ): Promise<DependencyVulnerabilities[]> {\n    const managers = Object.keys(packageFiles);\n    const allManagerJobs = managers.map((manager) =>\n      this.fetchManagerVulnerabilities(config, packageFiles, manager),\n    );\n    return (await Promise.all(allManagerJobs)).flat();\n  }\n\n  private async fetchManagerVulnerabilities(\n    config: RenovateConfig,\n    packageFiles: Record<string, PackageFile[]>,\n    manager: string,\n  ): Promise<DependencyVulnerabilities[]> {\n    const managerConfig = getManagerConfig(config, manager);\n    const queue = packageFiles[manager].map(\n      (pFile) => (): Promise<DependencyVulnerabilities[]> =>\n        this.fetchManagerPackageFileVulnerabilities(managerConfig, pFile),\n    );\n    logger.trace(\n      { manager, queueLength: queue.length },\n      'fetchManagerVulnerabilities starting',\n    );\n    const result = (await p.all(queue)).flat();\n    logger.trace({ manager }, 'fetchManagerVulnerabilities finished');\n    return result;\n  }\n\n  private async fetchManagerPackageFileVulnerabilities(\n    managerConfig: RenovateConfig,\n    pFile: PackageFile,\n  ): Promise<DependencyVulnerabilities[]> {\n    const { packageFile } = pFile;\n    const packageFileConfig = mergeChildConfig(managerConfig, pFile);\n    const { manager } = packageFileConfig;\n    const queue = pFile.deps.map(\n      (dep) => (): Promise<DependencyVulnerabilities | null> =>\n        this.fetchDependencyVulnerability(packageFileConfig, dep),\n    );\n    logger.trace(\n      { manager, packageFile, queueLength: queue.length },\n      'fetchManagerPackageFileVulnerabilities starting with concurrency',\n    );\n\n    const result = await p.all(queue);\n    logger.trace(\n      { packageFile },\n      'fetchManagerPackageFileVulnerabilities finished',\n    );\n\n    return result.filter(isTruthy);\n  }\n\n  private async fetchDependencyVulnerability(\n    packageFileConfig: RenovateConfig & PackageFile,\n    dep: PackageDependency,\n  ): Promise<DependencyVulnerabilities | null> {\n    const ecosystem = Vulnerabilities.datasourceEcosystemMap[dep.datasource!];\n    if (!ecosystem) {\n      logger.trace(`Cannot map datasource ${dep.datasource!} to OSV ecosystem`);\n      return null;\n    }\n\n    const packageName = dep.packageName ?? dep.depName!;\n    let osvPackageName = packageName;\n    if (ecosystem === 'PyPI') {\n      // https://peps.python.org/pep-0503/#normalized-names\n      osvPackageName = osvPackageName\n        .toLowerCase()\n        .replace(regEx(/[_.-]+/g), '-');\n    } else if (ecosystem === 'Go' && packageName === 'go') {\n      if (dep.depType !== 'toolchain') {\n        // The `go` directive is source compatibility, not the build toolchain, so we skip it\n        return null;\n      }\n      osvPackageName = 'stdlib';\n    }\n\n    try {\n      const osvVulnerabilities = await instrument(\n        'get OSV vulnerabilities',\n        () => this.osvOffline.getVulnerabilities(ecosystem, osvPackageName),\n        {\n          attributes: {\n            osvPackageName,\n            ecosystem,\n          },\n        },\n      );\n      if (\n        isNullOrUndefined(osvVulnerabilities) ||\n        isEmptyArray(osvVulnerabilities)\n      ) {\n        logger.trace(\n          `No vulnerabilities found in OSV database for ${packageName}`,\n        );\n        return null;\n      }\n\n      const depVersion =\n        dep.lockedVersion ?? dep.currentVersion ?? dep.currentValue!;\n\n      const versioning = dep.versioning ?? getDefaultVersioning(dep.datasource);\n      const versioningApi = getVersioning(versioning);\n\n      if (!versioningApi.isVersion(depVersion)) {\n        logger.debug(\n          `Skipping vulnerability lookup for package ${packageName} due to unsupported version ${depVersion}`,\n        );\n        return null;\n      }\n\n      const vulnerabilities: Vulnerability[] = [];\n      for (const osvVulnerability of osvVulnerabilities) {\n        if (osvVulnerability.withdrawn) {\n          logger.trace(\n            `Skipping withdrawn vulnerability ${osvVulnerability.id}`,\n          );\n          continue;\n        }\n\n        this.skipMaliciousPackages(\n          ecosystem,\n          osvPackageName,\n          depVersion,\n          versioningApi,\n          dep,\n          packageFileConfig.manager,\n          packageFileConfig.packageFile,\n          osvVulnerability,\n        );\n\n        for (const affected of osvVulnerability.affected ?? []) {\n          const isVulnerable = this.isPackageVulnerable(\n            ecosystem,\n            osvPackageName,\n            depVersion,\n            affected,\n            versioningApi,\n          );\n          if (!isVulnerable) {\n            continue;\n          }\n\n          logger.debug(\n            `Vulnerability ${osvVulnerability.id} affects ${packageName} ${depVersion}`,\n          );\n          const fixedVersion = this.getFixedVersion(\n            ecosystem,\n            depVersion,\n            affected,\n            versioningApi,\n          );\n\n          vulnerabilities.push({\n            packageName,\n            osvPackageName,\n            vulnerability: osvVulnerability,\n            affected,\n            depVersion,\n            fixedVersion,\n            datasource: dep.datasource!,\n            packageFileConfig,\n          });\n        }\n      }\n\n      return { vulnerabilities, versioningApi };\n    } catch (err) {\n      logger.warn(\n        { err, packageName },\n        'Error fetching vulnerability information for package',\n      );\n      return null;\n    }\n  }\n\n  private skipMaliciousPackages(\n    ecosystem: Ecosystem,\n    osvPackageName: string,\n    depVersion: string,\n    versioningApi: VersioningApi,\n    dep: PackageDependency,\n    manager: string | undefined,\n    packageFile: string,\n    osvVulnerability: Osv.Vulnerability,\n  ): void {\n    // the OpenSSF's Malicious Packages (https://github.com/ossf/malicious-packages) is a source of advisories through osv.dev, which takes various sources of advisories, and will re-publish them with more specific information about their malicious usage\n    if (osvVulnerability.id.startsWith('MAL-')) {\n      // is the current dependency vulnerable?\n      for (const affected of osvVulnerability.affected ?? []) {\n        // is the current dependency vulnerable?\n        const isVulnerable = this.isPackageVulnerable(\n          ecosystem,\n          osvPackageName,\n          depVersion,\n          affected,\n          versioningApi,\n        );\n\n        if (isVulnerable) {\n          logger.debug(\n            {\n              packageFile: packageFile,\n              depName: dep.depName,\n              packageName: dep.packageName,\n              manager: manager,\n              datasource: dep.datasource,\n              currentVersion: depVersion,\n            },\n            `Marking ${dep.depName} as skipReason=malicious-version-in-use, as it is affected by ${osvVulnerability.id}`,\n          );\n          dep.skipReason = 'malicious-version-in-use';\n          dep.skipStage = 'lookup';\n        }\n\n        // or are any of the updates vulnerable?\n        for (const update of dep.updates ?? []) {\n          const newVersion = update.newVersion ?? update.newValue!;\n\n          const isUpdateVulnerable = this.isPackageVulnerable(\n            ecosystem,\n            osvPackageName,\n            newVersion,\n            affected,\n            versioningApi,\n          );\n\n          if (isUpdateVulnerable) {\n            logger.debug(\n              {\n                packageFile: packageFile,\n                depName: dep.depName,\n                packageName: dep.packageName,\n                manager: manager,\n                datasource: dep.datasource,\n                currentVersion: depVersion,\n                newVersion,\n              },\n              `Marking ${dep.depName}'s update to ${newVersion} as skipReason=malicious-update-proposed, as it is affected by ${osvVulnerability.id}`,\n            );\n            dep.skipReason = 'malicious-update-proposed';\n            dep.skipStage = 'lookup';\n          }\n        }\n      }\n    }\n  }\n\n  private sortByFixedVersion(\n    packageRules: PackageRule[],\n    versioningApi: VersioningApi,\n  ): void {\n    const versionsCleaned: Record<string, string> = {};\n    for (const rule of packageRules) {\n      const version = rule.allowedVersions!;\n      versionsCleaned[version] = version.replace(regEx(/[(),=> ]+/g), '');\n    }\n    packageRules.sort((a, b) =>\n      versioningApi.sortVersions(\n        versionsCleaned[a.allowedVersions!],\n        versionsCleaned[b.allowedVersions!],\n      ),\n    );\n  }\n\n  // https://ossf.github.io/osv-schema/#affectedrangesevents-fields\n  private sortEvents(\n    events: Osv.Event[],\n    versioningApi: VersioningApi,\n  ): Osv.Event[] {\n    const sortedCopy: Osv.Event[] = [];\n    let zeroEvent: Osv.Event | null = null;\n\n    for (const event of events) {\n      if (event.introduced === '0') {\n        zeroEvent = event;\n      } else if (versioningApi.isVersion(Object.values(event)[0])) {\n        sortedCopy.push(event);\n      } else {\n        logger.debug({ event }, 'Skipping OSV event with invalid version');\n      }\n    }\n\n    sortedCopy.sort((a, b) =>\n      // no pre-processing, as there are only very few values to sort\n      versioningApi.sortVersions(Object.values(a)[0], Object.values(b)[0]),\n    );\n\n    if (zeroEvent) {\n      sortedCopy.unshift(zeroEvent);\n    }\n\n    return sortedCopy;\n  }\n\n  private isPackageAffected(\n    ecosystem: Ecosystem,\n    osvPackageName: string,\n    affected: Osv.Affected,\n  ): boolean {\n    return (\n      affected.package?.name === osvPackageName &&\n      affected.package?.ecosystem === ecosystem\n    );\n  }\n\n  private includedInVersions(\n    depVersion: string,\n    affected: Osv.Affected,\n  ): boolean {\n    return !!affected.versions?.includes(depVersion);\n  }\n\n  private includedInRanges(\n    depVersion: string,\n    affected: Osv.Affected,\n    versioningApi: VersioningApi,\n  ): boolean {\n    for (const range of affected.ranges ?? []) {\n      if (range.type === 'GIT') {\n        continue;\n      }\n\n      let vulnerable = false;\n      for (const event of this.sortEvents(range.events, versioningApi)) {\n        if (\n          isNonEmptyString(event.introduced) &&\n          (event.introduced === '0' ||\n            this.isVersionGtOrEq(depVersion, event.introduced, versioningApi))\n        ) {\n          vulnerable = true;\n        } else if (\n          isNonEmptyString(event.fixed) &&\n          this.isVersionGtOrEq(depVersion, event.fixed, versioningApi)\n        ) {\n          vulnerable = false;\n        } else if (\n          isNonEmptyString(event.last_affected) &&\n          this.isVersionGt(depVersion, event.last_affected, versioningApi)\n        ) {\n          vulnerable = false;\n        }\n      }\n\n      if (vulnerable) {\n        return true;\n      }\n    }\n\n    return false;\n  }\n\n  // https://ossf.github.io/osv-schema/#evaluation\n  private isPackageVulnerable(\n    ecosystem: Ecosystem,\n    osvPackageName: string,\n    depVersion: string,\n    affected: Osv.Affected,\n    versioningApi: VersioningApi,\n  ): boolean {\n    return (\n      this.isPackageAffected(ecosystem, osvPackageName, affected) &&\n      (this.includedInVersions(depVersion, affected) ||\n        this.includedInRanges(depVersion, affected, versioningApi))\n    );\n  }\n\n  private getFixedVersion(\n    ecosystem: Ecosystem,\n    depVersion: string,\n    affected: Osv.Affected,\n    versioningApi: VersioningApi,\n  ): string | null {\n    const fixedVersions: string[] = [];\n    const lastAffectedVersions: string[] = [];\n\n    for (const range of affected.ranges ?? []) {\n      if (range.type === 'GIT') {\n        continue;\n      }\n\n      for (const event of range.events) {\n        if (\n          isNonEmptyString(event.fixed) &&\n          versioningApi.isVersion(event.fixed)\n        ) {\n          fixedVersions.push(event.fixed);\n        } else if (\n          isNonEmptyString(event.last_affected) &&\n          versioningApi.isVersion(event.last_affected)\n        ) {\n          lastAffectedVersions.push(event.last_affected);\n        }\n      }\n    }\n\n    fixedVersions.sort((a, b) => versioningApi.sortVersions(a, b));\n    const fixedVersion = fixedVersions.find((version) =>\n      this.isVersionGt(version, depVersion, versioningApi),\n    );\n    if (fixedVersion) {\n      return this.getFixedVersionByEcosystem(fixedVersion, ecosystem);\n    }\n\n    lastAffectedVersions.sort((a, b) => versioningApi.sortVersions(a, b));\n    const lastAffected = lastAffectedVersions.find((version) =>\n      this.isVersionGtOrEq(version, depVersion, versioningApi),\n    );\n    if (lastAffected) {\n      return this.getLastAffectedByEcosystem(lastAffected, ecosystem);\n    }\n\n    return null;\n  }\n\n  private getFixedVersionByEcosystem(\n    fixedVersion: string,\n    ecosystem: Ecosystem,\n  ): string {\n    return getFixedVersionConstraint(fixedVersion, ecosystem);\n  }\n\n  private getLastAffectedByEcosystem(\n    lastAffected: string,\n    ecosystem: Ecosystem,\n  ): string {\n    return getLastAffectedVersionConstraint(lastAffected, ecosystem);\n  }\n\n  private isVersionGt(\n    version: string,\n    other: string,\n    versioningApi: VersioningApi,\n  ): boolean {\n    return (\n      versioningApi.isVersion(version) &&\n      versioningApi.isVersion(other) &&\n      versioningApi.isGreaterThan(version, other)\n    );\n  }\n\n  private isVersionGtOrEq(\n    version: string,\n    other: string,\n    versioningApi: VersioningApi,\n  ): boolean {\n    return (\n      versioningApi.isVersion(version) &&\n      versioningApi.isVersion(other) &&\n      (versioningApi.equals(version, other) ||\n        versioningApi.isGreaterThan(version, other))\n    );\n  }\n\n  private vulnerabilityToPackageRules(vul: Vulnerability): PackageRule | null {\n    const {\n      vulnerability,\n      affected,\n      packageName,\n      depVersion,\n      fixedVersion,\n      datasource,\n      packageFileConfig,\n    } = vul;\n    if (isNullOrUndefined(fixedVersion)) {\n      logger.debug(\n        `No fixed version available for vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`,\n      );\n      return null;\n    }\n\n    // we don't know if the dependency has a `versioning` applied to it already, so we have to use the default for the datasource\n    const versioning = getDefaultVersioning(datasource);\n\n    logger.debug(\n      {\n        datasource,\n        versioning,\n      },\n\n      `Setting allowed version ${fixedVersion} to fix vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`,\n    );\n\n    const severityDetails = this.extractSeverityDetails(\n      vulnerability,\n      affected,\n    );\n\n    return {\n      matchDatasources: [datasource],\n      matchPackageNames: [packageName],\n      matchCurrentVersion: depVersion,\n      versioning,\n      allowedVersions: fixedVersion,\n      isVulnerabilityAlert: true,\n      vulnerabilitySeverity: severityDetails.severityLevel,\n      prBodyNotes: this.generatePrBodyNotes(vulnerability, affected),\n      force: {\n        ...packageFileConfig.vulnerabilityAlerts,\n      },\n    };\n  }\n\n  static evaluateCvssVector(vector: string): [string, string] {\n    const CvssJson = z.object({\n      baseScore: z.number().default(0.0),\n      baseSeverity: z.string().toUpperCase().default('UNKNOWN'),\n    });\n\n    try {\n      const parsedCvssScore: CvssVector<any> | null = fromVector(vector);\n      const res = CvssJson.parse(parsedCvssScore?.createJsonSchema());\n\n      return [res.baseScore.toFixed(1), res.baseSeverity];\n    } catch {\n      logger.debug(`Error processing CVSS vector ${vector}`);\n    }\n\n    return ['', ''];\n  }\n\n  private generatePrBodyNotes(\n    vulnerability: Osv.Vulnerability,\n    affected: Osv.Affected,\n  ): string[] {\n    let aliases = [vulnerability.id].concat(vulnerability.aliases ?? []).sort();\n    aliases = aliases.map((id) => {\n      if (id.startsWith('CVE-')) {\n        return `[${id}](https://nvd.nist.gov/vuln/detail/${id})`;\n      }\n      if (id.startsWith('GHSA-')) {\n        return `[${id}](https://github.com/advisories/${id})`;\n      }\n      if (id.startsWith('GO-')) {\n        return `[${id}](https://pkg.go.dev/vuln/${id})`;\n      }\n      if (id.startsWith('RUSTSEC-')) {\n        return `[${id}](https://rustsec.org/advisories/${id}.html)`;\n      }\n\n      return id;\n    });\n\n    let content = '\\n\\n---\\n\\n### ';\n    content += vulnerability.summary ? `${vulnerability.summary}\\n` : '';\n    content += `${aliases.join(' / ')}\\n`;\n    content += `\\n<details>\\n<summary>More information</summary>\\n`;\n\n    const details = vulnerability.details?.replace(\n      regEx(/^#{1,4} /gm),\n      '##### ',\n    );\n    content += `#### Details\\n${details ?? 'No details.'}\\n`;\n\n    content += '#### Severity\\n';\n    const severityDetails = this.extractSeverityDetails(\n      vulnerability,\n      affected,\n    );\n\n    if (severityDetails.cvssVector) {\n      content += `- CVSS Score: ${severityDetails.score}\\n`;\n      content += `- Vector String: \\`${severityDetails.cvssVector}\\`\\n`;\n    } else {\n      content += `${titleCase(severityDetails.severityLevel)}\\n`;\n    }\n\n    content += `\\n#### References\\n${\n      vulnerability.references\n        ?.map((ref) => {\n          return `- [${ref.url}](${ref.url})`;\n        })\n        .join('\\n') ?? 'No references.'\n    }`;\n\n    let attribution = '';\n    if (vulnerability.id.startsWith('GHSA-')) {\n      attribution = ` and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md))`;\n    } else if (vulnerability.id.startsWith('GO-')) {\n      attribution = ` and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license))`;\n    } else if (vulnerability.id.startsWith('PYSEC-')) {\n      attribution = ` and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE))`;\n    } else if (vulnerability.id.startsWith('RUSTSEC-')) {\n      attribution = ` and the [Rust Advisory Database](https://github.com/RustSec/advisory-db) ([CC0 1.0](https://github.com/rustsec/advisory-db/blob/main/LICENSE.txt))`;\n    }\n    content += `\\n\\nThis data is provided by [OSV](https://osv.dev/vulnerability/${vulnerability.id})${attribution}.\\n`;\n    content += `</details>`;\n\n    return [sanitizeMarkdown(content)];\n  }\n\n  private extractSeverityDetails(\n    vulnerability: Osv.Vulnerability,\n    affected: Osv.Affected,\n  ): SeverityDetails {\n    let severityLevel = 'UNKNOWN';\n    let score = 'Unknown';\n\n    const cvssVector =\n      vulnerability.severity?.find((e) => e.type === 'CVSS_V4')?.score ??\n      vulnerability.severity?.find((e) => e.type === 'CVSS_V3')?.score ??\n      (affected.database_specific?.cvss as string); // RUSTSEC\n\n    if (cvssVector) {\n      const [baseScore, severity] =\n        Vulnerabilities.evaluateCvssVector(cvssVector);\n      severityLevel = severity ? severity.toUpperCase() : 'UNKNOWN';\n      score = baseScore\n        ? `${baseScore} / 10 (${titleCase(severityLevel)})`\n        : 'Unknown';\n    } else if (\n      vulnerability.id.startsWith('GHSA-') &&\n      vulnerability.database_specific?.severity\n    ) {\n      const severity = vulnerability.database_specific.severity as string;\n      severityLevel = severity.toUpperCase();\n    }\n\n    return {\n      cvssVector,\n      score,\n      severityLevel,\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,MAAM,EAAE,eAAgB,QACrB;AAEH,IAAa,kBAAb,MAAa,gBAAgB;CAC3B,OAAe;CAEf;CAEA,OAAwB,yBAAyB;CAEjD,YAAoB,YAAwB;EAC1C,KAAK,aAAa;CACpB;CAEA,OAAe,aAAkC;EAE/C,gBAAgB,eAAe,WAAW,OAAO;EACjD,OAAO,gBAAgB;CACzB;CAEA,aAAa,SAAmC;EAE9C,MAAM,aAAa,MAAM,gBAAgB,WAAW;EAGpD,OAAO,IADc,gBAAgB,UACvB;CAChB;CAEA,MAAM,gCACJ,QACA,cACe;EACf,MAAM,4BAA4B,MAAM,KAAK,+BAC3C,QACA,YACF;EAEA,OAAO,iBAAiB,CAAC;EACzB,KAAK,MAAM,EACT,iBACA,mBACG,2BAA2B;GAC9B,MAAM,oBAAmC,CAAC;GAC1C,KAAK,MAAM,iBAAiB,iBAAiB;IAC3C,MAAM,OAAO,KAAK,4BAA4B,aAAa;IAC3D,IAAI,kBAAkB,IAAI,GACxB;IAEF,kBAAkB,KAAK,IAAI;GAC7B;GACA,KAAK,mBAAmB,mBAAmB,aAAa;GAExD,OAAO,aAAa,KAAK,GAAG,iBAAiB;EAC/C;CACF;CAEA,MAAM,qBACJ,QACA,cAC0B;EAK1B,QAAO,MAJc,KAAK,+BACxB,QACA,YACF,EAAA,CACc,SAAS,UAAU,MAAM,eAAe;CACxD;CAEA,MAAc,+BACZ,QACA,cACsC;EAEtC,MAAM,iBADW,OAAO,KAAK,YACC,CAAC,CAAC,KAAK,YACnC,KAAK,4BAA4B,QAAQ,cAAc,OAAO,CAChE;EACA,QAAQ,MAAM,QAAQ,IAAI,cAAc,EAAA,CAAG,KAAK;CAClD;CAEA,MAAc,4BACZ,QACA,cACA,SACsC;EACtC,MAAM,gBAAgB,iBAAiB,QAAQ,OAAO;EACtD,MAAM,QAAQ,aAAa,QAAQ,CAAC,KACjC,gBACC,KAAK,uCAAuC,eAAe,KAAK,CACpE;EACA,OAAO,MACL;GAAE;GAAS,aAAa,MAAM;EAAO,GACrC,sCACF;EACA,MAAM,UAAU,MAAMA,IAAM,KAAK,EAAA,CAAG,KAAK;EACzC,OAAO,MAAM,EAAE,QAAQ,GAAG,sCAAsC;EAChE,OAAO;CACT;CAEA,MAAc,uCACZ,eACA,OACsC;EACtC,MAAM,EAAE,gBAAgB;EACxB,MAAM,oBAAoB,iBAAiB,eAAe,KAAK;EAC/D,MAAM,EAAE,YAAY;EACpB,MAAM,QAAQ,MAAM,KAAK,KACtB,cACC,KAAK,6BAA6B,mBAAmB,GAAG,CAC5D;EACA,OAAO,MACL;GAAE;GAAS;GAAa,aAAa,MAAM;EAAO,GAClD,kEACF;EAEA,MAAM,SAAS,MAAMA,IAAM,KAAK;EAChC,OAAO,MACL,EAAE,YAAY,GACd,iDACF;EAEA,OAAO,OAAO,OAAO,QAAQ;CAC/B;CAEA,MAAc,6BACZ,mBACA,KAC2C;EAC3C,MAAM,YAAY,gBAAgB,uBAAuB,IAAI;EAC7D,IAAI,CAAC,WAAW;GACd,OAAO,MAAM,yBAAyB,IAAI,WAAY,kBAAkB;GACxE,OAAO;EACT;EAEA,MAAM,cAAc,IAAI,eAAe,IAAI;EAC3C,IAAI,iBAAiB;EACrB,IAAI,cAAc,QAEhB,iBAAiB,eACd,YAAY,CAAC,CACb,QAAQ,MAAM,SAAS,GAAG,GAAG;OAC3B,IAAI,cAAc,QAAQ,gBAAgB,MAAM;GACrD,IAAI,IAAI,YAAY,aAElB,OAAO;GAET,iBAAiB;EACnB;EAEA,IAAI;GACF,MAAM,qBAAqB,MAAM,WAC/B,iCACM,KAAK,WAAW,mBAAmB,WAAW,cAAc,GAClE,EACE,YAAY;IACV;IACA;GACF,EACF,CACF;GACA,IACE,kBAAkB,kBAAkB,KACpC,aAAa,kBAAkB,GAC/B;IACA,OAAO,MACL,gDAAgD,aAClD;IACA,OAAO;GACT;GAEA,MAAM,aACJ,IAAI,iBAAiB,IAAI,kBAAkB,IAAI;GAGjD,MAAM,gBAAgBC,IADH,IAAI,cAAc,qBAAqB,IAAI,UAAU,CAC1B;GAE9C,IAAI,CAAC,cAAc,UAAU,UAAU,GAAG;IACxC,OAAO,MACL,6CAA6C,YAAY,8BAA8B,YACzF;IACA,OAAO;GACT;GAEA,MAAM,kBAAmC,CAAC;GAC1C,KAAK,MAAM,oBAAoB,oBAAoB;IACjD,IAAI,iBAAiB,WAAW;KAC9B,OAAO,MACL,oCAAoC,iBAAiB,IACvD;KACA;IACF;IAEA,KAAK,sBACH,WACA,gBACA,YACA,eACA,KACA,kBAAkB,SAClB,kBAAkB,aAClB,gBACF;IAEA,KAAK,MAAM,YAAY,iBAAiB,YAAY,CAAC,GAAG;KAQtD,IAAI,CAPiB,KAAK,oBACxB,WACA,gBACA,YACA,UACA,aAEc,GACd;KAGF,OAAO,MACL,iBAAiB,iBAAiB,GAAG,WAAW,YAAY,GAAG,YACjE;KACA,MAAM,eAAe,KAAK,gBACxB,WACA,YACA,UACA,aACF;KAEA,gBAAgB,KAAK;MACnB;MACA;MACA,eAAe;MACf;MACA;MACA;MACA,YAAY,IAAI;MAChB;KACF,CAAC;IACH;GACF;GAEA,OAAO;IAAE;IAAiB;GAAc;EAC1C,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK;GAAY,GACnB,sDACF;GACA,OAAO;EACT;CACF;CAEA,sBACE,WACA,gBACA,YACA,eACA,KACA,SACA,aACA,kBACM;EAEN,IAAI,iBAAiB,GAAG,WAAW,MAAM,GAEvC,KAAK,MAAM,YAAY,iBAAiB,YAAY,CAAC,GAAG;GAUtD,IARqB,KAAK,oBACxB,WACA,gBACA,YACA,UACA,aAGa,GAAG;IAChB,OAAO,MACL;KACe;KACb,SAAS,IAAI;KACb,aAAa,IAAI;KACR;KACT,YAAY,IAAI;KAChB,gBAAgB;IAClB,GACA,WAAW,IAAI,QAAQ,gEAAgE,iBAAiB,IAC1G;IACA,IAAI,aAAa;IACjB,IAAI,YAAY;GAClB;GAGA,KAAK,MAAM,UAAU,IAAI,WAAW,CAAC,GAAG;IACtC,MAAM,aAAa,OAAO,cAAc,OAAO;IAU/C,IAR2B,KAAK,oBAC9B,WACA,gBACA,YACA,UACA,aAGmB,GAAG;KACtB,OAAO,MACL;MACe;MACb,SAAS,IAAI;MACb,aAAa,IAAI;MACR;MACT,YAAY,IAAI;MAChB,gBAAgB;MAChB;KACF,GACA,WAAW,IAAI,QAAQ,eAAe,WAAW,iEAAiE,iBAAiB,IACrI;KACA,IAAI,aAAa;KACjB,IAAI,YAAY;IAClB;GACF;EACF;CAEJ;CAEA,mBACE,cACA,eACM;EACN,MAAM,kBAA0C,CAAC;EACjD,KAAK,MAAM,QAAQ,cAAc;GAC/B,MAAM,UAAU,KAAK;GACrB,gBAAgB,WAAW,QAAQ,QAAQ,MAAM,YAAY,GAAG,EAAE;EACpE;EACA,aAAa,MAAM,GAAG,MACpB,cAAc,aACZ,gBAAgB,EAAE,kBAClB,gBAAgB,EAAE,gBACpB,CACF;CACF;CAGA,WACE,QACA,eACa;EACb,MAAM,aAA0B,CAAC;EACjC,IAAI,YAA8B;EAElC,KAAK,MAAM,SAAS,QAClB,IAAI,MAAM,eAAe,KACvB,YAAY;OACP,IAAI,cAAc,UAAU,OAAO,OAAO,KAAK,CAAC,CAAC,EAAE,GACxD,WAAW,KAAK,KAAK;OAErB,OAAO,MAAM,EAAE,MAAM,GAAG,yCAAyC;EAIrE,WAAW,MAAM,GAAG,MAElB,cAAc,aAAa,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CACrE;EAEA,IAAI,WACF,WAAW,QAAQ,SAAS;EAG9B,OAAO;CACT;CAEA,kBACE,WACA,gBACA,UACS;EACT,OACE,SAAS,SAAS,SAAS,kBAC3B,SAAS,SAAS,cAAc;CAEpC;CAEA,mBACE,YACA,UACS;EACT,OAAO,CAAC,CAAC,SAAS,UAAU,SAAS,UAAU;CACjD;CAEA,iBACE,YACA,UACA,eACS;EACT,KAAK,MAAM,SAAS,SAAS,UAAU,CAAC,GAAG;GACzC,IAAI,MAAM,SAAS,OACjB;GAGF,IAAI,aAAa;GACjB,KAAK,MAAM,SAAS,KAAK,WAAW,MAAM,QAAQ,aAAa,GAC7D,IACE,iBAAiB,MAAM,UAAU,MAChC,MAAM,eAAe,OACpB,KAAK,gBAAgB,YAAY,MAAM,YAAY,aAAa,IAElE,aAAa;QACR,IACL,iBAAiB,MAAM,KAAK,KAC5B,KAAK,gBAAgB,YAAY,MAAM,OAAO,aAAa,GAE3D,aAAa;QACR,IACL,iBAAiB,MAAM,aAAa,KACpC,KAAK,YAAY,YAAY,MAAM,eAAe,aAAa,GAE/D,aAAa;GAIjB,IAAI,YACF,OAAO;EAEX;EAEA,OAAO;CACT;CAGA,oBACE,WACA,gBACA,YACA,UACA,eACS;EACT,OACE,KAAK,kBAAkB,WAAW,gBAAgB,QAAQ,MACzD,KAAK,mBAAmB,YAAY,QAAQ,KAC3C,KAAK,iBAAiB,YAAY,UAAU,aAAa;CAE/D;CAEA,gBACE,WACA,YACA,UACA,eACe;EACf,MAAM,gBAA0B,CAAC;EACjC,MAAM,uBAAiC,CAAC;EAExC,KAAK,MAAM,SAAS,SAAS,UAAU,CAAC,GAAG;GACzC,IAAI,MAAM,SAAS,OACjB;GAGF,KAAK,MAAM,SAAS,MAAM,QACxB,IACE,iBAAiB,MAAM,KAAK,KAC5B,cAAc,UAAU,MAAM,KAAK,GAEnC,cAAc,KAAK,MAAM,KAAK;QACzB,IACL,iBAAiB,MAAM,aAAa,KACpC,cAAc,UAAU,MAAM,aAAa,GAE3C,qBAAqB,KAAK,MAAM,aAAa;EAGnD;EAEA,cAAc,MAAM,GAAG,MAAM,cAAc,aAAa,GAAG,CAAC,CAAC;EAC7D,MAAM,eAAe,cAAc,MAAM,YACvC,KAAK,YAAY,SAAS,YAAY,aAAa,CACrD;EACA,IAAI,cACF,OAAO,KAAK,2BAA2B,cAAc,SAAS;EAGhE,qBAAqB,MAAM,GAAG,MAAM,cAAc,aAAa,GAAG,CAAC,CAAC;EACpE,MAAM,eAAe,qBAAqB,MAAM,YAC9C,KAAK,gBAAgB,SAAS,YAAY,aAAa,CACzD;EACA,IAAI,cACF,OAAO,KAAK,2BAA2B,cAAc,SAAS;EAGhE,OAAO;CACT;CAEA,2BACE,cACA,WACQ;EACR,OAAO,0BAA0B,cAAc,SAAS;CAC1D;CAEA,2BACE,cACA,WACQ;EACR,OAAO,iCAAiC,cAAc,SAAS;CACjE;CAEA,YACE,SACA,OACA,eACS;EACT,OACE,cAAc,UAAU,OAAO,KAC/B,cAAc,UAAU,KAAK,KAC7B,cAAc,cAAc,SAAS,KAAK;CAE9C;CAEA,gBACE,SACA,OACA,eACS;EACT,OACE,cAAc,UAAU,OAAO,KAC/B,cAAc,UAAU,KAAK,MAC5B,cAAc,OAAO,SAAS,KAAK,KAClC,cAAc,cAAc,SAAS,KAAK;CAEhD;CAEA,4BAAoC,KAAwC;EAC1E,MAAM,EACJ,eACA,UACA,aACA,YACA,cACA,YACA,sBACE;EACJ,IAAI,kBAAkB,YAAY,GAAG;GACnC,OAAO,MACL,gDAAgD,cAAc,GAAG,MAAM,YAAY,GAAG,YACxF;GACA,OAAO;EACT;EAGA,MAAM,aAAa,qBAAqB,UAAU;EAElD,OAAO,MACL;GACE;GACA;EACF,GAEA,2BAA2B,aAAa,wBAAwB,cAAc,GAAG,MAAM,YAAY,GAAG,YACxG;EAEA,MAAM,kBAAkB,KAAK,uBAC3B,eACA,QACF;EAEA,OAAO;GACL,kBAAkB,CAAC,UAAU;GAC7B,mBAAmB,CAAC,WAAW;GAC/B,qBAAqB;GACrB;GACA,iBAAiB;GACjB,sBAAsB;GACtB,uBAAuB,gBAAgB;GACvC,aAAa,KAAK,oBAAoB,eAAe,QAAQ;GAC7D,OAAO,EACL,GAAG,kBAAkB,oBACvB;EACF;CACF;CAEA,OAAO,mBAAmB,QAAkC;EAC1D,MAAM,WAAW,EAAE,OAAO;GACxB,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAG;GACjC,cAAc,EAAE,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,SAAS;EAC1D,CAAC;EAED,IAAI;GACF,MAAM,kBAA0C,WAAW,MAAM;GACjE,MAAM,MAAM,SAAS,MAAM,iBAAiB,iBAAiB,CAAC;GAE9D,OAAO,CAAC,IAAI,UAAU,QAAQ,CAAC,GAAG,IAAI,YAAY;EACpD,QAAQ;GACN,OAAO,MAAM,gCAAgC,QAAQ;EACvD;EAEA,OAAO,CAAC,IAAI,EAAE;CAChB;CAEA,oBACE,eACA,UACU;EACV,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,cAAc,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;EAC1E,UAAU,QAAQ,KAAK,OAAO;GAC5B,IAAI,GAAG,WAAW,MAAM,GACtB,OAAO,IAAI,GAAG,qCAAqC,GAAG;GAExD,IAAI,GAAG,WAAW,OAAO,GACvB,OAAO,IAAI,GAAG,kCAAkC,GAAG;GAErD,IAAI,GAAG,WAAW,KAAK,GACrB,OAAO,IAAI,GAAG,4BAA4B,GAAG;GAE/C,IAAI,GAAG,WAAW,UAAU,GAC1B,OAAO,IAAI,GAAG,mCAAmC,GAAG;GAGtD,OAAO;EACT,CAAC;EAED,IAAI,UAAU;EACd,WAAW,cAAc,UAAU,GAAG,cAAc,QAAQ,MAAM;EAClE,WAAW,GAAG,QAAQ,KAAK,KAAK,EAAE;EAClC,WAAW;EAEX,MAAM,UAAU,cAAc,SAAS,QACrC,MAAM,YAAY,GAClB,QACF;EACA,WAAW,iBAAiB,WAAW,cAAc;EAErD,WAAW;EACX,MAAM,kBAAkB,KAAK,uBAC3B,eACA,QACF;EAEA,IAAI,gBAAgB,YAAY;GAC9B,WAAW,iBAAiB,gBAAgB,MAAM;GAClD,WAAW,sBAAsB,gBAAgB,WAAW;EAC9D,OACE,WAAW,GAAG,UAAU,gBAAgB,aAAa,EAAE;EAGzD,WAAW,sBACT,cAAc,YACV,KAAK,QAAQ;GACb,OAAO,MAAM,IAAI,IAAI,IAAI,IAAI,IAAI;EACnC,CAAC,CAAC,CACD,KAAK,IAAI,KAAK;EAGnB,IAAI,cAAc;EAClB,IAAI,cAAc,GAAG,WAAW,OAAO,GACrC,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,KAAK,GAC1C,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,QAAQ,GAC7C,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,UAAU,GAC/C,cAAc;EAEhB,WAAW,oEAAoE,cAAc,GAAG,GAAG,YAAY;EAC/G,WAAW;EAEX,OAAO,CAAC,iBAAiB,OAAO,CAAC;CACnC;CAEA,uBACE,eACA,UACiB;EACjB,IAAI,gBAAgB;EACpB,IAAI,QAAQ;EAEZ,MAAM,aACJ,cAAc,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,SAC3D,cAAc,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,SAC1D,SAAS,mBAAmB;EAE/B,IAAI,YAAY;GACd,MAAM,CAAC,WAAW,YAChB,gBAAgB,mBAAmB,UAAU;GAC/C,gBAAgB,WAAW,SAAS,YAAY,IAAI;GACpD,QAAQ,YACJ,GAAG,UAAU,SAAS,UAAU,aAAa,EAAE,KAC/C;EACN,OAAO,IACL,cAAc,GAAG,WAAW,OAAO,KACnC,cAAc,mBAAmB,UAGjC,gBADiB,cAAc,kBAAkB,SACxB,YAAY;EAGvC,OAAO;GACL;GACA;GACA;EACF;CACF;AACF"}

package/dist/workers/repository/process/write.d.ts

@@ -1,3 +1,3 @@
-import "../../../config/types.js";
 import "../../types.js";
-import "../../../util/cache/repository/types.js";
+import "../../../util/cache/repository/types.js";
+import "../../../config/types.js";

package/dist/workers/repository/process/write.js

@@ -1,6 +1,6 @@
 import { addMeta, logger, removeMeta } from "../../../logger/index.js";
-import { getCache } from "../../../util/cache/repository/index.js";
 import { instrument } from "../../../instrumentation/index.js";
+import { getCache } from "../../../util/cache/repository/index.js";
 import { incCountValue, setCount } from "../../global/limits.js";
 import { scm } from "../../../modules/platform/scm.js";
 import { hashMap } from "../../../modules/manager/fingerprint.generated.js";
@@ -12,7 +12,6 @@ import { upgradeFingerprintFields } from "./fingerprint-fields.js";
 import { getCommitsHourlyCount, getConcurrentBranchesCount, getConcurrentPrsCount, getPrHourlyCount } from "./limits.js";
 import { isString } from "@sindresorhus/is";
 import { ATTR_VCS_REF_BASE_TYPE, ATTR_VCS_REF_HEAD_NAME, ATTR_VCS_REF_TYPE } from "@opentelemetry/semantic-conventions/incubating";
-
 //#region lib/workers/repository/process/write.ts
 function generateCommitFingerprintConfig(branch) {
 	return branch.upgrades.map((upgrade) => {
@@ -119,7 +118,7 @@ async function writeUpdates(config, allBranches) {
 	removeMeta(["branch", "baseBranch"]);
 	return "done";
 }
-
 //#endregion
-export { writeUpdates };
+export { compareCacheFingerprint, generateCommitFingerprintConfig, syncBranchState, writeUpdates };
+
 //# sourceMappingURL=write.js.map

package/dist/workers/repository/process/write.js.map

@@ -1 +1 @@
-{"version":3,"file":"write.js","names":[],"sources":["../../../../lib/workers/repository/process/write.ts"],"sourcesContent":["import {\n  ATTR_VCS_REF_BASE_TYPE,\n  ATTR_VCS_REF_HEAD_NAME,\n  ATTR_VCS_REF_TYPE,\n} from '@opentelemetry/semantic-conventions/incubating';\nimport { isString } from '@sindresorhus/is';\nimport type { RenovateConfig } from '../../../config/types.ts';\nimport { instrument } from '../../../instrumentation/index.ts';\nimport { addMeta, logger, removeMeta } from '../../../logger/index.ts';\nimport { hashMap } from '../../../modules/manager/index.ts';\nimport { scm } from '../../../modules/platform/scm.ts';\nimport { getCache } from '../../../util/cache/repository/index.ts';\nimport type { BranchCache } from '../../../util/cache/repository/types.ts';\nimport { fingerprint } from '../../../util/fingerprint.ts';\nimport { setBranchNewCommit } from '../../../util/git/set-branch-commit.ts';\nimport { incCountValue, setCount } from '../../global/limits.ts';\nimport type {\n  BranchConfig,\n  CacheFingerprintMatchResult,\n  UpgradeFingerprintConfig,\n} from '../../types.ts';\nimport { processBranch } from '../update/branch/index.ts';\nimport { upgradeFingerprintFields } from './fingerprint-fields.ts';\nimport {\n  getCommitsHourlyCount,\n  getConcurrentBranchesCount,\n  getConcurrentPrsCount,\n  getPrHourlyCount,\n} from './limits.ts';\n\nexport type WriteUpdateResult = 'done' | 'automerged';\n\nexport function generateCommitFingerprintConfig(\n  branch: BranchConfig,\n): UpgradeFingerprintConfig[] {\n  const res = branch.upgrades.map((upgrade) => {\n    const filteredUpgrade = {} as UpgradeFingerprintConfig;\n    for (const field of upgradeFingerprintFields) {\n      filteredUpgrade[field] = upgrade[field];\n    }\n    return filteredUpgrade;\n  });\n\n  return res;\n}\n\nexport function compareCacheFingerprint(\n  branchState: BranchCache,\n  commitFingerprint: string,\n): CacheFingerprintMatchResult {\n  if (!branchState.commitFingerprint) {\n    logger.trace('branch.isUpToDate(): no fingerprint');\n    return 'no-fingerprint';\n  }\n\n  if (commitFingerprint !== branchState.commitFingerprint) {\n    logger.debug('branch.isUpToDate(): needs recalculation');\n    return 'no-match';\n  }\n\n  logger.debug('branch.isUpToDate(): using cached result \"true\"');\n  return 'matched';\n}\n\nexport async function syncBranchState(\n  branchName: string,\n  baseBranch: string,\n): Promise<BranchCache> {\n  logger.debug('syncBranchState()');\n  const branchSha = await scm.getBranchCommit(branchName);\n  const baseBranchSha = await scm.getBranchCommit(baseBranch);\n\n  const cache = getCache();\n  cache.branches ??= [];\n  const { branches: cachedBranches } = cache;\n  let branchState = cachedBranches.find((br) => br.branchName === branchName);\n  if (!branchState) {\n    logger.debug(\n      'syncBranchState(): Branch cache not found, creating minimal branchState',\n    );\n    // create a minimal branch state\n    branchState = {\n      branchName,\n      sha: branchSha,\n      baseBranch,\n      baseBranchSha,\n    } as BranchCache;\n    cachedBranches.push(branchState);\n  }\n\n  // if base branch name has changed invalidate cached isModified state\n  if (baseBranch !== branchState.baseBranch) {\n    logger.debug('syncBranchState(): update baseBranch name');\n    branchState.baseBranch = baseBranch;\n    delete branchState.isModified;\n    branchState.pristine = false;\n  }\n\n  // if base branch sha has changed invalidate cached isBehindBase state\n  if (baseBranchSha !== branchState.baseBranchSha) {\n    logger.debug('syncBranchState(): update baseBranchSha');\n    delete branchState.isBehindBase;\n    delete branchState.isConflicted;\n\n    // update cached branchSha\n    branchState.baseBranchSha = baseBranchSha;\n    branchState.pristine = false;\n  }\n\n  // if branch sha has changed invalidate all cached states\n  if (branchSha !== branchState.sha) {\n    logger.debug('syncBranchState(): update branchSha');\n    delete branchState.isBehindBase;\n    delete branchState.isConflicted;\n    delete branchState.isModified;\n    delete branchState.commitFingerprint;\n\n    // Update commit timestamp when SHA changes\n    const commitDate = await scm.getBranchUpdateDate(branchName);\n    if (commitDate) {\n      branchState.commitTimestamp = commitDate.toISO()!;\n    }\n\n    // update cached branchSha\n    branchState.sha = branchSha;\n    branchState.pristine = false;\n  }\n\n  return branchState;\n}\n\nexport async function writeUpdates(\n  config: RenovateConfig,\n  allBranches: BranchConfig[],\n): Promise<WriteUpdateResult> {\n  const branches = allBranches;\n  logger.debug(\n    `Processing ${branches.length} branch${\n      branches.length === 1 ? '' : 'es'\n    }: ${branches\n      .map((b) => b.branchName)\n      .sort()\n      .join(', ')}`,\n  );\n\n  const concurrentPrsCount = await getConcurrentPrsCount(config, branches);\n  setCount('ConcurrentPRs', concurrentPrsCount);\n\n  const concurrentBranchesCount = await getConcurrentBranchesCount(branches);\n  setCount('Branches', concurrentBranchesCount);\n\n  const prsThisHourCount = await getPrHourlyCount(config);\n  setCount('HourlyPRs', prsThisHourCount);\n\n  const commitsThisHourCount = await getCommitsHourlyCount(branches);\n  setCount('HourlyCommits', commitsThisHourCount);\n\n  for (const branch of branches) {\n    const { baseBranch, branchName } = branch;\n    const res = await instrument(\n      branchName,\n      async () => {\n        const meta: Record<string, string> = { branch: branchName };\n        if (config.baseBranchPatterns?.length && baseBranch) {\n          meta.baseBranch = baseBranch;\n        }\n        addMeta(meta);\n        const branchExisted = await scm.branchExists(branchName);\n        const branchState = await syncBranchState(branchName, baseBranch);\n\n        const managers = [\n          ...new Set(\n            branch.upgrades\n              .map((upgrade) => hashMap.get(upgrade.manager) ?? upgrade.manager)\n              .filter(isString),\n          ),\n        ].sort();\n        const commitFingerprint = fingerprint({\n          commitFingerprintConfig: generateCommitFingerprintConfig(branch),\n          managers,\n        });\n        branch.cacheFingerprintMatch = compareCacheFingerprint(\n          branchState,\n          commitFingerprint,\n        );\n\n        const res = await processBranch(branch);\n        branch.prBlockedBy = res?.prBlockedBy;\n        branch.prNo = res?.prNo;\n        branch.result = res?.result;\n        branch.commitFingerprint = res?.updatesVerified\n          ? commitFingerprint\n          : branchState.commitFingerprint;\n\n        if (res?.commitSha) {\n          // Get the commit timestamp for the new commit\n          const commitDate = await scm.getBranchUpdateDate(branchName);\n          setBranchNewCommit(branchName, baseBranch, res.commitSha, commitDate);\n        }\n        if (\n          branch.result === 'automerged' &&\n          branch.automergeType !== 'pr-comment'\n        ) {\n          // Stop processing other branches because base branch has been changed\n          return 'automerged';\n        }\n        if (!branchExisted && (await scm.branchExists(branch.branchName))) {\n          incCountValue('Branches');\n        }\n      },\n      {\n        attributes: {\n          [ATTR_VCS_REF_TYPE]: 'branch',\n          [ATTR_VCS_REF_BASE_TYPE]: 'branch',\n          [ATTR_VCS_REF_HEAD_NAME]: branchName,\n        },\n      },\n    );\n\n    if (res !== undefined) {\n      return res;\n    }\n  }\n  removeMeta(['branch', 'baseBranch']);\n  return 'done';\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAgCA,SAAgB,gCACd,QAC4B;AAS5B,QARY,OAAO,SAAS,KAAK,YAAY;EAC3C,MAAM,kBAAkB,EAAE;AAC1B,OAAK,MAAM,SAAS,yBAClB,iBAAgB,SAAS,QAAQ;AAEnC,SAAO;GACP;;AAKJ,SAAgB,wBACd,aACA,mBAC6B;AAC7B,KAAI,CAAC,YAAY,mBAAmB;AAClC,SAAO,MAAM,sCAAsC;AACnD,SAAO;;AAGT,KAAI,sBAAsB,YAAY,mBAAmB;AACvD,SAAO,MAAM,2CAA2C;AACxD,SAAO;;AAGT,QAAO,MAAM,oDAAkD;AAC/D,QAAO;;AAGT,eAAsB,gBACpB,YACA,YACsB;AACtB,QAAO,MAAM,oBAAoB;CACjC,MAAM,YAAY,MAAM,IAAI,gBAAgB,WAAW;CACvD,MAAM,gBAAgB,MAAM,IAAI,gBAAgB,WAAW;CAE3D,MAAM,QAAQ,UAAU;AACxB,OAAM,aAAa,EAAE;CACrB,MAAM,EAAE,UAAU,mBAAmB;CACrC,IAAI,cAAc,eAAe,MAAM,OAAO,GAAG,eAAe,WAAW;AAC3E,KAAI,CAAC,aAAa;AAChB,SAAO,MACL,0EACD;AAED,gBAAc;GACZ;GACA,KAAK;GACL;GACA;GACD;AACD,iBAAe,KAAK,YAAY;;AAIlC,KAAI,eAAe,YAAY,YAAY;AACzC,SAAO,MAAM,4CAA4C;AACzD,cAAY,aAAa;AACzB,SAAO,YAAY;AACnB,cAAY,WAAW;;AAIzB,KAAI,kBAAkB,YAAY,eAAe;AAC/C,SAAO,MAAM,0CAA0C;AACvD,SAAO,YAAY;AACnB,SAAO,YAAY;AAGnB,cAAY,gBAAgB;AAC5B,cAAY,WAAW;;AAIzB,KAAI,cAAc,YAAY,KAAK;AACjC,SAAO,MAAM,sCAAsC;AACnD,SAAO,YAAY;AACnB,SAAO,YAAY;AACnB,SAAO,YAAY;AACnB,SAAO,YAAY;EAGnB,MAAM,aAAa,MAAM,IAAI,oBAAoB,WAAW;AAC5D,MAAI,WACF,aAAY,kBAAkB,WAAW,OAAO;AAIlD,cAAY,MAAM;AAClB,cAAY,WAAW;;AAGzB,QAAO;;AAGT,eAAsB,aACpB,QACA,aAC4B;CAC5B,MAAM,WAAW;AACjB,QAAO,MACL,cAAc,SAAS,OAAO,SAC5B,SAAS,WAAW,IAAI,KAAK,KAC9B,IAAI,SACF,KAAK,MAAM,EAAE,WAAW,CACxB,MAAM,CACN,KAAK,KAAK,GACd;AAGD,UAAS,iBADkB,MAAM,sBAAsB,QAAQ,SAAS,CAC3B;AAG7C,UAAS,YADuB,MAAM,2BAA2B,SAAS,CAC7B;AAG7C,UAAS,aADgB,MAAM,iBAAiB,OAAO,CAChB;AAGvC,UAAS,iBADoB,MAAM,sBAAsB,SAAS,CACnB;AAE/C,MAAK,MAAM,UAAU,UAAU;EAC7B,MAAM,EAAE,YAAY,eAAe;EACnC,MAAM,MAAM,MAAM,WAChB,YACA,YAAY;GACV,MAAM,OAA+B,EAAE,QAAQ,YAAY;AAC3D,OAAI,OAAO,oBAAoB,UAAU,WACvC,MAAK,aAAa;AAEpB,WAAQ,KAAK;GACb,MAAM,gBAAgB,MAAM,IAAI,aAAa,WAAW;GACxD,MAAM,cAAc,MAAM,gBAAgB,YAAY,WAAW;GAEjE,MAAM,WAAW,CACf,GAAG,IAAI,IACL,OAAO,SACJ,KAAK,YAAY,QAAQ,IAAI,QAAQ,QAAQ,IAAI,QAAQ,QAAQ,CACjE,OAAO,SAAS,CACpB,CACF,CAAC,MAAM;GACR,MAAM,oBAAoB,YAAY;IACpC,yBAAyB,gCAAgC,OAAO;IAChE;IACD,CAAC;AACF,UAAO,wBAAwB,wBAC7B,aACA,kBACD;GAED,MAAM,MAAM,MAAM,cAAc,OAAO;AACvC,UAAO,cAAc,KAAK;AAC1B,UAAO,OAAO,KAAK;AACnB,UAAO,SAAS,KAAK;AACrB,UAAO,oBAAoB,KAAK,kBAC5B,oBACA,YAAY;AAEhB,OAAI,KAAK,WAAW;IAElB,MAAM,aAAa,MAAM,IAAI,oBAAoB,WAAW;AAC5D,uBAAmB,YAAY,YAAY,IAAI,WAAW,WAAW;;AAEvE,OACE,OAAO,WAAW,gBAClB,OAAO,kBAAkB,aAGzB,QAAO;AAET,OAAI,CAAC,iBAAkB,MAAM,IAAI,aAAa,OAAO,WAAW,CAC9D,eAAc,WAAW;KAG7B,EACE,YAAY;IACT,oBAAoB;IACpB,yBAAyB;IACzB,yBAAyB;GAC3B,EACF,CACF;AAED,MAAI,QAAQ,OACV,QAAO;;AAGX,YAAW,CAAC,UAAU,aAAa,CAAC;AACpC,QAAO"}
+{"version":3,"file":"write.js","names":[],"sources":["../../../../lib/workers/repository/process/write.ts"],"sourcesContent":["import {\n  ATTR_VCS_REF_BASE_TYPE,\n  ATTR_VCS_REF_HEAD_NAME,\n  ATTR_VCS_REF_TYPE,\n} from '@opentelemetry/semantic-conventions/incubating';\nimport { isString } from '@sindresorhus/is';\nimport type { RenovateConfig } from '../../../config/types.ts';\nimport { instrument } from '../../../instrumentation/index.ts';\nimport { addMeta, logger, removeMeta } from '../../../logger/index.ts';\nimport { hashMap } from '../../../modules/manager/index.ts';\nimport { scm } from '../../../modules/platform/scm.ts';\nimport { getCache } from '../../../util/cache/repository/index.ts';\nimport type { BranchCache } from '../../../util/cache/repository/types.ts';\nimport { fingerprint } from '../../../util/fingerprint.ts';\nimport { setBranchNewCommit } from '../../../util/git/set-branch-commit.ts';\nimport { incCountValue, setCount } from '../../global/limits.ts';\nimport type {\n  BranchConfig,\n  CacheFingerprintMatchResult,\n  UpgradeFingerprintConfig,\n} from '../../types.ts';\nimport { processBranch } from '../update/branch/index.ts';\nimport { upgradeFingerprintFields } from './fingerprint-fields.ts';\nimport {\n  getCommitsHourlyCount,\n  getConcurrentBranchesCount,\n  getConcurrentPrsCount,\n  getPrHourlyCount,\n} from './limits.ts';\n\nexport type WriteUpdateResult = 'done' | 'automerged';\n\nexport function generateCommitFingerprintConfig(\n  branch: BranchConfig,\n): UpgradeFingerprintConfig[] {\n  const res = branch.upgrades.map((upgrade) => {\n    const filteredUpgrade = {} as UpgradeFingerprintConfig;\n    for (const field of upgradeFingerprintFields) {\n      // TS cannot narrow the type here\n      filteredUpgrade[field] = upgrade[field]!;\n    }\n    return filteredUpgrade;\n  });\n\n  return res;\n}\n\nexport function compareCacheFingerprint(\n  branchState: BranchCache,\n  commitFingerprint: string,\n): CacheFingerprintMatchResult {\n  if (!branchState.commitFingerprint) {\n    logger.trace('branch.isUpToDate(): no fingerprint');\n    return 'no-fingerprint';\n  }\n\n  if (commitFingerprint !== branchState.commitFingerprint) {\n    logger.debug('branch.isUpToDate(): needs recalculation');\n    return 'no-match';\n  }\n\n  logger.debug('branch.isUpToDate(): using cached result \"true\"');\n  return 'matched';\n}\n\nexport async function syncBranchState(\n  branchName: string,\n  baseBranch: string,\n): Promise<BranchCache> {\n  logger.debug('syncBranchState()');\n  const branchSha = await scm.getBranchCommit(branchName);\n  const baseBranchSha = await scm.getBranchCommit(baseBranch);\n\n  const cache = getCache();\n  cache.branches ??= [];\n  const { branches: cachedBranches } = cache;\n  let branchState = cachedBranches.find((br) => br.branchName === branchName);\n  if (!branchState) {\n    logger.debug(\n      'syncBranchState(): Branch cache not found, creating minimal branchState',\n    );\n    // create a minimal branch state\n    branchState = {\n      branchName,\n      sha: branchSha,\n      baseBranch,\n      baseBranchSha,\n    } as BranchCache;\n    cachedBranches.push(branchState);\n  }\n\n  // if base branch name has changed invalidate cached isModified state\n  if (baseBranch !== branchState.baseBranch) {\n    logger.debug('syncBranchState(): update baseBranch name');\n    branchState.baseBranch = baseBranch;\n    delete branchState.isModified;\n    branchState.pristine = false;\n  }\n\n  // if base branch sha has changed invalidate cached isBehindBase state\n  if (baseBranchSha !== branchState.baseBranchSha) {\n    logger.debug('syncBranchState(): update baseBranchSha');\n    delete branchState.isBehindBase;\n    delete branchState.isConflicted;\n\n    // update cached branchSha\n    branchState.baseBranchSha = baseBranchSha;\n    branchState.pristine = false;\n  }\n\n  // if branch sha has changed invalidate all cached states\n  if (branchSha !== branchState.sha) {\n    logger.debug('syncBranchState(): update branchSha');\n    delete branchState.isBehindBase;\n    delete branchState.isConflicted;\n    delete branchState.isModified;\n    delete branchState.commitFingerprint;\n\n    // Update commit timestamp when SHA changes\n    const commitDate = await scm.getBranchUpdateDate(branchName);\n    if (commitDate) {\n      branchState.commitTimestamp = commitDate.toISO()!;\n    }\n\n    // update cached branchSha\n    branchState.sha = branchSha;\n    branchState.pristine = false;\n  }\n\n  return branchState;\n}\n\nexport async function writeUpdates(\n  config: RenovateConfig,\n  allBranches: BranchConfig[],\n): Promise<WriteUpdateResult> {\n  const branches = allBranches;\n  logger.debug(\n    `Processing ${branches.length} branch${\n      branches.length === 1 ? '' : 'es'\n    }: ${branches\n      .map((b) => b.branchName)\n      .sort()\n      .join(', ')}`,\n  );\n\n  const concurrentPrsCount = await getConcurrentPrsCount(config, branches);\n  setCount('ConcurrentPRs', concurrentPrsCount);\n\n  const concurrentBranchesCount = await getConcurrentBranchesCount(branches);\n  setCount('Branches', concurrentBranchesCount);\n\n  const prsThisHourCount = await getPrHourlyCount(config);\n  setCount('HourlyPRs', prsThisHourCount);\n\n  const commitsThisHourCount = await getCommitsHourlyCount(branches);\n  setCount('HourlyCommits', commitsThisHourCount);\n\n  for (const branch of branches) {\n    const { baseBranch, branchName } = branch;\n    const res = await instrument(\n      branchName,\n      async () => {\n        const meta: Record<string, string> = { branch: branchName };\n        if (config.baseBranchPatterns?.length && baseBranch) {\n          meta.baseBranch = baseBranch;\n        }\n        addMeta(meta);\n        const branchExisted = await scm.branchExists(branchName);\n        const branchState = await syncBranchState(branchName, baseBranch);\n\n        const managers = [\n          ...new Set(\n            branch.upgrades\n              .map((upgrade) => hashMap.get(upgrade.manager) ?? upgrade.manager)\n              .filter(isString),\n          ),\n        ].sort();\n        const commitFingerprint = fingerprint({\n          commitFingerprintConfig: generateCommitFingerprintConfig(branch),\n          managers,\n        });\n        branch.cacheFingerprintMatch = compareCacheFingerprint(\n          branchState,\n          commitFingerprint,\n        );\n\n        const res = await processBranch(branch);\n        branch.prBlockedBy = res?.prBlockedBy;\n        branch.prNo = res?.prNo;\n        branch.result = res?.result;\n        branch.commitFingerprint = res?.updatesVerified\n          ? commitFingerprint\n          : branchState.commitFingerprint;\n\n        if (res?.commitSha) {\n          // Get the commit timestamp for the new commit\n          const commitDate = await scm.getBranchUpdateDate(branchName);\n          setBranchNewCommit(branchName, baseBranch, res.commitSha, commitDate);\n        }\n        if (\n          branch.result === 'automerged' &&\n          branch.automergeType !== 'pr-comment'\n        ) {\n          // Stop processing other branches because base branch has been changed\n          return 'automerged';\n        }\n        if (!branchExisted && (await scm.branchExists(branch.branchName))) {\n          incCountValue('Branches');\n        }\n      },\n      {\n        attributes: {\n          [ATTR_VCS_REF_TYPE]: 'branch',\n          [ATTR_VCS_REF_BASE_TYPE]: 'branch',\n          [ATTR_VCS_REF_HEAD_NAME]: branchName,\n        },\n      },\n    );\n\n    if (res !== undefined) {\n      return res;\n    }\n  }\n  removeMeta(['branch', 'baseBranch']);\n  return 'done';\n}\n"],"mappings":";;;;;;;;;;;;;;;AAgCA,SAAgB,gCACd,QAC4B;CAU5B,OATY,OAAO,SAAS,KAAK,YAAY;EAC3C,MAAM,kBAAkB,CAAC;EACzB,KAAK,MAAM,SAAS,0BAElB,gBAAgB,SAAS,QAAQ;EAEnC,OAAO;CACT,CAES;AACX;AAEA,SAAgB,wBACd,aACA,mBAC6B;CAC7B,IAAI,CAAC,YAAY,mBAAmB;EAClC,OAAO,MAAM,qCAAqC;EAClD,OAAO;CACT;CAEA,IAAI,sBAAsB,YAAY,mBAAmB;EACvD,OAAO,MAAM,0CAA0C;EACvD,OAAO;CACT;CAEA,OAAO,MAAM,mDAAiD;CAC9D,OAAO;AACT;AAEA,eAAsB,gBACpB,YACA,YACsB;CACtB,OAAO,MAAM,mBAAmB;CAChC,MAAM,YAAY,MAAM,IAAI,gBAAgB,UAAU;CACtD,MAAM,gBAAgB,MAAM,IAAI,gBAAgB,UAAU;CAE1D,MAAM,QAAQ,SAAS;CACvB,MAAM,aAAa,CAAC;CACpB,MAAM,EAAE,UAAU,mBAAmB;CACrC,IAAI,cAAc,eAAe,MAAM,OAAO,GAAG,eAAe,UAAU;CAC1E,IAAI,CAAC,aAAa;EAChB,OAAO,MACL,yEACF;EAEA,cAAc;GACZ;GACA,KAAK;GACL;GACA;EACF;EACA,eAAe,KAAK,WAAW;CACjC;CAGA,IAAI,eAAe,YAAY,YAAY;EACzC,OAAO,MAAM,2CAA2C;EACxD,YAAY,aAAa;EACzB,OAAO,YAAY;EACnB,YAAY,WAAW;CACzB;CAGA,IAAI,kBAAkB,YAAY,eAAe;EAC/C,OAAO,MAAM,yCAAyC;EACtD,OAAO,YAAY;EACnB,OAAO,YAAY;EAGnB,YAAY,gBAAgB;EAC5B,YAAY,WAAW;CACzB;CAGA,IAAI,cAAc,YAAY,KAAK;EACjC,OAAO,MAAM,qCAAqC;EAClD,OAAO,YAAY;EACnB,OAAO,YAAY;EACnB,OAAO,YAAY;EACnB,OAAO,YAAY;EAGnB,MAAM,aAAa,MAAM,IAAI,oBAAoB,UAAU;EAC3D,IAAI,YACF,YAAY,kBAAkB,WAAW,MAAM;EAIjD,YAAY,MAAM;EAClB,YAAY,WAAW;CACzB;CAEA,OAAO;AACT;AAEA,eAAsB,aACpB,QACA,aAC4B;CAC5B,MAAM,WAAW;CACjB,OAAO,MACL,cAAc,SAAS,OAAO,SAC5B,SAAS,WAAW,IAAI,KAAK,KAC9B,IAAI,SACF,KAAK,MAAM,EAAE,UAAU,CAAC,CACxB,KAAK,CAAC,CACN,KAAK,IAAI,GACd;CAGA,SAAS,iBAAiB,MADO,sBAAsB,QAAQ,QAAQ,CAC3B;CAG5C,SAAS,YAAY,MADiB,2BAA2B,QAAQ,CAC7B;CAG5C,SAAS,aAAa,MADS,iBAAiB,MAAM,CAChB;CAGtC,SAAS,iBAAiB,MADS,sBAAsB,QAAQ,CACnB;CAE9C,KAAK,MAAM,UAAU,UAAU;EAC7B,MAAM,EAAE,YAAY,eAAe;EACnC,MAAM,MAAM,MAAM,WAChB,YACA,YAAY;GACV,MAAM,OAA+B,EAAE,QAAQ,WAAW;GAC1D,IAAI,OAAO,oBAAoB,UAAU,YACvC,KAAK,aAAa;GAEpB,QAAQ,IAAI;GACZ,MAAM,gBAAgB,MAAM,IAAI,aAAa,UAAU;GACvD,MAAM,cAAc,MAAM,gBAAgB,YAAY,UAAU;GAEhE,MAAM,WAAW,CACf,GAAG,IAAI,IACL,OAAO,SACJ,KAAK,YAAY,QAAQ,IAAI,QAAQ,OAAO,KAAK,QAAQ,OAAO,CAAC,CACjE,OAAO,QAAQ,CACpB,CACF,CAAC,CAAC,KAAK;GACP,MAAM,oBAAoB,YAAY;IACpC,yBAAyB,gCAAgC,MAAM;IAC/D;GACF,CAAC;GACD,OAAO,wBAAwB,wBAC7B,aACA,iBACF;GAEA,MAAM,MAAM,MAAM,cAAc,MAAM;GACtC,OAAO,cAAc,KAAK;GAC1B,OAAO,OAAO,KAAK;GACnB,OAAO,SAAS,KAAK;GACrB,OAAO,oBAAoB,KAAK,kBAC5B,oBACA,YAAY;GAEhB,IAAI,KAAK,WAAW;IAElB,MAAM,aAAa,MAAM,IAAI,oBAAoB,UAAU;IAC3D,mBAAmB,YAAY,YAAY,IAAI,WAAW,UAAU;GACtE;GACA,IACE,OAAO,WAAW,gBAClB,OAAO,kBAAkB,cAGzB,OAAO;GAET,IAAI,CAAC,iBAAkB,MAAM,IAAI,aAAa,OAAO,UAAU,GAC7D,cAAc,UAAU;EAE5B,GACA,EACE,YAAY;IACT,oBAAoB;IACpB,yBAAyB;IACzB,yBAAyB;EAC5B,EACF,CACF;EAEA,IAAI,QAAQ,KAAA,GACV,OAAO;CAEX;CACA,WAAW,CAAC,UAAU,YAAY,CAAC;CACnC,OAAO;AACT"}

package/dist/workers/repository/reconfigure/comment.js

@@ -5,9 +5,9 @@ import { ensureComment } from "../../../modules/platform/comment.js";
 import { getDepWarningsOnboardingPR, getErrors, getWarnings } from "../errors-warnings.js";
 import { getBaseBranchDesc } from "../onboarding/pr/base-branch.js";
 import { getScheduleDesc } from "../onboarding/pr/config-description.js";
-import { getExpectedPrList } from "../onboarding/pr/pr-list.js";
+import { getPackageFilesDesc, getPackageFilesSummary } from "../onboarding/pr/package-files.js";
+import { getExpectedPrList, getExpectedPrListSummary } from "../onboarding/pr/pr-list.js";
 import { isArray, isString } from "@sindresorhus/is";
-
 //#region lib/workers/repository/reconfigure/comment.ts
 async function ensureReconfigurePrComment(config, packageFiles, branches, branchName, pr) {
 	logger.debug("ensureReconfigurePrComment()");
@@ -23,11 +23,9 @@ async function ensureReconfigurePrComment(config, packageFiles, branches, branch
 {{ERRORS}}
 `;
 	let prBody = prCommentTemplate;
-	if (packageFiles && Object.entries(packageFiles).length) {
-		let files = [];
-		for (const [manager, managerFiles] of Object.entries(packageFiles)) files = files.concat(managerFiles.map((file) => ` * \`${file.packageFile}\` (${manager})`));
-		prBody = prBody.replace("{{PACKAGE FILES}}", "### Detected Package Files\n\n" + files.join("\n")) + "\n";
-	} else prBody = prBody.replace("{{PACKAGE FILES}}\n", "");
+	const packageFilesDesc = getPackageFilesDesc(packageFiles);
+	if (packageFilesDesc) prBody = `${prBody.replace("{{PACKAGE FILES}}", packageFilesDesc)}\n`;
+	else prBody = prBody.replace("{{PACKAGE FILES}}\n", "");
 	let configDesc = "";
 	if (GlobalConfig.get("dryRun")) logger.info(`DRY-RUN: Would check branch ${branchName}`);
 	else configDesc = getConfigDesc(config);
@@ -35,8 +33,14 @@ async function ensureReconfigurePrComment(config, packageFiles, branches, branch
 	prBody = prBody.replace("{{WARNINGS}}\n", getWarnings(config) + getDepWarningsOnboardingPR(packageFiles, config));
 	prBody = prBody.replace("{{ERRORS}}\n", getErrors(config));
 	prBody = prBody.replace("{{BASEBRANCH}}\n", getBaseBranchDesc(config));
-	prBody = prBody.replace("{{PRLIST}}\n", getExpectedPrList(config, branches));
-	logger.trace("prBody:\n" + prBody);
+	const prList = getExpectedPrList(config, branches);
+	prBody = prBody.replace("{{PRLIST}}\n", prList);
+	if (prBody.length > platform.maxBodyLength()) {
+		logger.debug("Reconfigure PR body exceeds platform limit, switching to summary PR list and package files");
+		prBody = prBody.replace(prList, getExpectedPrListSummary(config, branches));
+		if (packageFilesDesc) prBody = prBody.replace(packageFilesDesc, `### Detected Package Files\n\n${getPackageFilesSummary(packageFiles)}`);
+	}
+	logger.trace(`prBody:\n${prBody}`);
 	prBody = platform.massageMarkdown(prBody);
 	if (GlobalConfig.get("dryRun")) {
 		logger.info("DRY-RUN: Would ensure comment");
@@ -69,7 +73,7 @@ function getConfigDesc(config) {
 	desc += "\n\n---\n";
 	return desc;
 }
-
 //#endregion
-export { ensureReconfigurePrComment };
+export { ensureReconfigurePrComment, getConfigDesc };
+
 //# sourceMappingURL=comment.js.map

package/dist/workers/repository/reconfigure/comment.js.map

@@ -1 +1 @@
-{"version":3,"file":"comment.js","names":[],"sources":["../../../../lib/workers/repository/reconfigure/comment.ts"],"sourcesContent":["import { isArray, isString } from '@sindresorhus/is';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport type { RenovateConfig } from '../../../config/types.ts';\nimport { logger } from '../../../logger/index.ts';\nimport type { PackageFile } from '../../../modules/manager/types.ts';\nimport { ensureComment } from '../../../modules/platform/comment.ts';\nimport type { Pr } from '../../../modules/platform/index.ts';\nimport { platform } from '../../../modules/platform/index.ts';\nimport type { BranchConfig } from '../../types.ts';\nimport {\n  getDepWarningsOnboardingPR,\n  getErrors,\n  getWarnings,\n} from '../errors-warnings.ts';\nimport { getBaseBranchDesc } from '../onboarding/pr/base-branch.ts';\nimport { getScheduleDesc } from '../onboarding/pr/config-description.ts';\nimport { getExpectedPrList } from '../onboarding/pr/pr-list.ts';\n\nexport async function ensureReconfigurePrComment(\n  config: RenovateConfig,\n  packageFiles: Record<string, PackageFile[]> | null,\n  branches: BranchConfig[],\n  branchName: string,\n  pr: Pr,\n): Promise<boolean> {\n  logger.debug('ensureReconfigurePrComment()');\n  logger.trace({ config });\n  let prCommentTemplate = `This is a reconfigure PR comment to help you understand and re-configure your renovate bot settings. If this Reconfigure PR were to be merged, we'd expect to see the following outcome:\\n\\n`;\n\n  // TODO #22198\n  prCommentTemplate += `\n---\n{{PACKAGE FILES}}\n{{CONFIG}}\n{{BASEBRANCH}}\n{{PRLIST}}\n{{WARNINGS}}\n{{ERRORS}}\n`;\n  let prBody = prCommentTemplate;\n  if (packageFiles && Object.entries(packageFiles).length) {\n    let files: string[] = [];\n    for (const [manager, managerFiles] of Object.entries(packageFiles)) {\n      files = files.concat(\n        managerFiles.map((file) => ` * \\`${file.packageFile}\\` (${manager})`),\n      );\n    }\n    prBody =\n      prBody.replace(\n        '{{PACKAGE FILES}}',\n        '### Detected Package Files\\n\\n' + files.join('\\n'),\n      ) + '\\n';\n  } else {\n    prBody = prBody.replace('{{PACKAGE FILES}}\\n', '');\n  }\n  let configDesc = '';\n  if (GlobalConfig.get('dryRun')) {\n    logger.info(`DRY-RUN: Would check branch ${branchName}`);\n  } else {\n    configDesc = getConfigDesc(config);\n  }\n  prBody = prBody.replace('{{CONFIG}}\\n', configDesc);\n  prBody = prBody.replace(\n    '{{WARNINGS}}\\n',\n    getWarnings(config) + getDepWarningsOnboardingPR(packageFiles!, config),\n  );\n  prBody = prBody.replace('{{ERRORS}}\\n', getErrors(config));\n  prBody = prBody.replace('{{BASEBRANCH}}\\n', getBaseBranchDesc(config));\n  prBody = prBody.replace('{{PRLIST}}\\n', getExpectedPrList(config, branches));\n  logger.trace('prBody:\\n' + prBody);\n\n  prBody = platform.massageMarkdown(prBody);\n\n  if (GlobalConfig.get('dryRun')) {\n    logger.info('DRY-RUN: Would ensure comment');\n    return true;\n  }\n\n  return await ensureComment({\n    number: pr.number,\n    topic: 'Reconfigure PR Results',\n    content: prBody,\n  });\n}\n\nfunction getDescriptionArray(config: RenovateConfig): string[] {\n  logger.debug('getDescriptionArray()');\n  logger.trace({ config });\n  const desc = isArray(config.description, isString) ? config.description : [];\n  return desc.concat(getScheduleDesc(config));\n}\n\nexport function getConfigDesc(config: RenovateConfig): string {\n  logger.debug('getConfigDesc()');\n  logger.trace({ config });\n  const descriptionArr = getDescriptionArray(config);\n  if (!descriptionArr.length) {\n    logger.debug('No config description found');\n    return '';\n  }\n  logger.debug(`Found description array with length:${descriptionArr.length}`);\n  let desc = `\\n### Configuration Summary\\n\\nBased on the default config's presets, Renovate will:\\n\\n`;\n  descriptionArr.forEach((d) => {\n    desc += `  - ${d}\\n`;\n  });\n  desc += '\\n\\n---\\n';\n  return desc;\n}\n"],"mappings":";;;;;;;;;;;AAkBA,eAAsB,2BACpB,QACA,cACA,UACA,YACA,IACkB;AAClB,QAAO,MAAM,+BAA+B;AAC5C,QAAO,MAAM,EAAE,QAAQ,CAAC;CACxB,IAAI,oBAAoB;AAGxB,sBAAqB;;;;;;;;;CASrB,IAAI,SAAS;AACb,KAAI,gBAAgB,OAAO,QAAQ,aAAa,CAAC,QAAQ;EACvD,IAAI,QAAkB,EAAE;AACxB,OAAK,MAAM,CAAC,SAAS,iBAAiB,OAAO,QAAQ,aAAa,CAChE,SAAQ,MAAM,OACZ,aAAa,KAAK,SAAS,QAAQ,KAAK,YAAY,MAAM,QAAQ,GAAG,CACtE;AAEH,WACE,OAAO,QACL,qBACA,mCAAmC,MAAM,KAAK,KAAK,CACpD,GAAG;OAEN,UAAS,OAAO,QAAQ,uBAAuB,GAAG;CAEpD,IAAI,aAAa;AACjB,KAAI,aAAa,IAAI,SAAS,CAC5B,QAAO,KAAK,+BAA+B,aAAa;KAExD,cAAa,cAAc,OAAO;AAEpC,UAAS,OAAO,QAAQ,gBAAgB,WAAW;AACnD,UAAS,OAAO,QACd,kBACA,YAAY,OAAO,GAAG,2BAA2B,cAAe,OAAO,CACxE;AACD,UAAS,OAAO,QAAQ,gBAAgB,UAAU,OAAO,CAAC;AAC1D,UAAS,OAAO,QAAQ,oBAAoB,kBAAkB,OAAO,CAAC;AACtE,UAAS,OAAO,QAAQ,gBAAgB,kBAAkB,QAAQ,SAAS,CAAC;AAC5E,QAAO,MAAM,cAAc,OAAO;AAElC,UAAS,SAAS,gBAAgB,OAAO;AAEzC,KAAI,aAAa,IAAI,SAAS,EAAE;AAC9B,SAAO,KAAK,gCAAgC;AAC5C,SAAO;;AAGT,QAAO,MAAM,cAAc;EACzB,QAAQ,GAAG;EACX,OAAO;EACP,SAAS;EACV,CAAC;;AAGJ,SAAS,oBAAoB,QAAkC;AAC7D,QAAO,MAAM,wBAAwB;AACrC,QAAO,MAAM,EAAE,QAAQ,CAAC;AAExB,SADa,QAAQ,OAAO,aAAa,SAAS,GAAG,OAAO,cAAc,EAAE,EAChE,OAAO,gBAAgB,OAAO,CAAC;;AAG7C,SAAgB,cAAc,QAAgC;AAC5D,QAAO,MAAM,kBAAkB;AAC/B,QAAO,MAAM,EAAE,QAAQ,CAAC;CACxB,MAAM,iBAAiB,oBAAoB,OAAO;AAClD,KAAI,CAAC,eAAe,QAAQ;AAC1B,SAAO,MAAM,8BAA8B;AAC3C,SAAO;;AAET,QAAO,MAAM,uCAAuC,eAAe,SAAS;CAC5E,IAAI,OAAO;AACX,gBAAe,SAAS,MAAM;AAC5B,UAAQ,OAAO,EAAE;GACjB;AACF,SAAQ;AACR,QAAO"}
+{"version":3,"file":"comment.js","names":[],"sources":["../../../../lib/workers/repository/reconfigure/comment.ts"],"sourcesContent":["import { isArray, isString } from '@sindresorhus/is';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport type { RenovateConfig } from '../../../config/types.ts';\nimport { logger } from '../../../logger/index.ts';\nimport type { PackageFile } from '../../../modules/manager/types.ts';\nimport { ensureComment } from '../../../modules/platform/comment.ts';\nimport type { Pr } from '../../../modules/platform/index.ts';\nimport { platform } from '../../../modules/platform/index.ts';\nimport type { BranchConfig } from '../../types.ts';\nimport {\n  getDepWarningsOnboardingPR,\n  getErrors,\n  getWarnings,\n} from '../errors-warnings.ts';\nimport { getBaseBranchDesc } from '../onboarding/pr/base-branch.ts';\nimport { getScheduleDesc } from '../onboarding/pr/config-description.ts';\nimport {\n  getPackageFilesDesc,\n  getPackageFilesSummary,\n} from '../onboarding/pr/package-files.ts';\nimport {\n  getExpectedPrList,\n  getExpectedPrListSummary,\n} from '../onboarding/pr/pr-list.ts';\n\nexport async function ensureReconfigurePrComment(\n  config: RenovateConfig,\n  packageFiles: Record<string, PackageFile[]> | null,\n  branches: BranchConfig[],\n  branchName: string,\n  pr: Pr,\n): Promise<boolean> {\n  logger.debug('ensureReconfigurePrComment()');\n  logger.trace({ config });\n  let prCommentTemplate = `This is a reconfigure PR comment to help you understand and re-configure your renovate bot settings. If this Reconfigure PR were to be merged, we'd expect to see the following outcome:\\n\\n`;\n\n  // TODO #22198\n  prCommentTemplate += `\n---\n{{PACKAGE FILES}}\n{{CONFIG}}\n{{BASEBRANCH}}\n{{PRLIST}}\n{{WARNINGS}}\n{{ERRORS}}\n`;\n  let prBody = prCommentTemplate;\n  const packageFilesDesc = getPackageFilesDesc(packageFiles);\n  if (packageFilesDesc) {\n    prBody = `${prBody.replace('{{PACKAGE FILES}}', packageFilesDesc)}\\n`;\n  } else {\n    prBody = prBody.replace('{{PACKAGE FILES}}\\n', '');\n  }\n  let configDesc = '';\n  if (GlobalConfig.get('dryRun')) {\n    logger.info(`DRY-RUN: Would check branch ${branchName}`);\n  } else {\n    configDesc = getConfigDesc(config);\n  }\n  prBody = prBody.replace('{{CONFIG}}\\n', configDesc);\n  prBody = prBody.replace(\n    '{{WARNINGS}}\\n',\n    getWarnings(config) + getDepWarningsOnboardingPR(packageFiles!, config),\n  );\n  prBody = prBody.replace('{{ERRORS}}\\n', getErrors(config));\n  prBody = prBody.replace('{{BASEBRANCH}}\\n', getBaseBranchDesc(config));\n  const prList = getExpectedPrList(config, branches);\n  prBody = prBody.replace('{{PRLIST}}\\n', prList);\n\n  if (prBody.length > platform.maxBodyLength()) {\n    logger.debug(\n      'Reconfigure PR body exceeds platform limit, switching to summary PR list and package files',\n    );\n    prBody = prBody.replace(prList, getExpectedPrListSummary(config, branches));\n    if (packageFilesDesc) {\n      prBody = prBody.replace(\n        packageFilesDesc,\n        `### Detected Package Files\\n\\n${getPackageFilesSummary(packageFiles)}`,\n      );\n    }\n  }\n\n  logger.trace(`prBody:\\n${prBody}`);\n\n  prBody = platform.massageMarkdown(prBody);\n\n  if (GlobalConfig.get('dryRun')) {\n    logger.info('DRY-RUN: Would ensure comment');\n    return true;\n  }\n\n  return await ensureComment({\n    number: pr.number,\n    topic: 'Reconfigure PR Results',\n    content: prBody,\n  });\n}\n\nfunction getDescriptionArray(config: RenovateConfig): string[] {\n  logger.debug('getDescriptionArray()');\n  logger.trace({ config });\n  const desc = isArray(config.description, isString) ? config.description : [];\n  return desc.concat(getScheduleDesc(config));\n}\n\nexport function getConfigDesc(config: RenovateConfig): string {\n  logger.debug('getConfigDesc()');\n  logger.trace({ config });\n  const descriptionArr = getDescriptionArray(config);\n  if (!descriptionArr.length) {\n    logger.debug('No config description found');\n    return '';\n  }\n  logger.debug(`Found description array with length:${descriptionArr.length}`);\n  let desc = `\\n### Configuration Summary\\n\\nBased on the default config's presets, Renovate will:\\n\\n`;\n  descriptionArr.forEach((d) => {\n    desc += `  - ${d}\\n`;\n  });\n  desc += '\\n\\n---\\n';\n  return desc;\n}\n"],"mappings":";;;;;;;;;;;AAyBA,eAAsB,2BACpB,QACA,cACA,UACA,YACA,IACkB;CAClB,OAAO,MAAM,8BAA8B;CAC3C,OAAO,MAAM,EAAE,OAAO,CAAC;CACvB,IAAI,oBAAoB;CAGxB,qBAAqB;;;;;;;;;CASrB,IAAI,SAAS;CACb,MAAM,mBAAmB,oBAAoB,YAAY;CACzD,IAAI,kBACF,SAAS,GAAG,OAAO,QAAQ,qBAAqB,gBAAgB,EAAE;MAElE,SAAS,OAAO,QAAQ,uBAAuB,EAAE;CAEnD,IAAI,aAAa;CACjB,IAAI,aAAa,IAAI,QAAQ,GAC3B,OAAO,KAAK,+BAA+B,YAAY;MAEvD,aAAa,cAAc,MAAM;CAEnC,SAAS,OAAO,QAAQ,gBAAgB,UAAU;CAClD,SAAS,OAAO,QACd,kBACA,YAAY,MAAM,IAAI,2BAA2B,cAAe,MAAM,CACxE;CACA,SAAS,OAAO,QAAQ,gBAAgB,UAAU,MAAM,CAAC;CACzD,SAAS,OAAO,QAAQ,oBAAoB,kBAAkB,MAAM,CAAC;CACrE,MAAM,SAAS,kBAAkB,QAAQ,QAAQ;CACjD,SAAS,OAAO,QAAQ,gBAAgB,MAAM;CAE9C,IAAI,OAAO,SAAS,SAAS,cAAc,GAAG;EAC5C,OAAO,MACL,4FACF;EACA,SAAS,OAAO,QAAQ,QAAQ,yBAAyB,QAAQ,QAAQ,CAAC;EAC1E,IAAI,kBACF,SAAS,OAAO,QACd,kBACA,iCAAiC,uBAAuB,YAAY,GACtE;CAEJ;CAEA,OAAO,MAAM,YAAY,QAAQ;CAEjC,SAAS,SAAS,gBAAgB,MAAM;CAExC,IAAI,aAAa,IAAI,QAAQ,GAAG;EAC9B,OAAO,KAAK,+BAA+B;EAC3C,OAAO;CACT;CAEA,OAAO,MAAM,cAAc;EACzB,QAAQ,GAAG;EACX,OAAO;EACP,SAAS;CACX,CAAC;AACH;AAEA,SAAS,oBAAoB,QAAkC;CAC7D,OAAO,MAAM,uBAAuB;CACpC,OAAO,MAAM,EAAE,OAAO,CAAC;CAEvB,QADa,QAAQ,OAAO,aAAa,QAAQ,IAAI,OAAO,cAAc,CAAC,EAAA,CAC/D,OAAO,gBAAgB,MAAM,CAAC;AAC5C;AAEA,SAAgB,cAAc,QAAgC;CAC5D,OAAO,MAAM,iBAAiB;CAC9B,OAAO,MAAM,EAAE,OAAO,CAAC;CACvB,MAAM,iBAAiB,oBAAoB,MAAM;CACjD,IAAI,CAAC,eAAe,QAAQ;EAC1B,OAAO,MAAM,6BAA6B;EAC1C,OAAO;CACT;CACA,OAAO,MAAM,uCAAuC,eAAe,QAAQ;CAC3E,IAAI,OAAO;CACX,eAAe,SAAS,MAAM;EAC5B,QAAQ,OAAO,EAAE;CACnB,CAAC;CACD,QAAQ;CACR,OAAO;AACT"}

package/dist/workers/repository/reconfigure/index.js

@@ -1,10 +1,10 @@
 import { GlobalConfig } from "../../../config/global.js";
 import { logger } from "../../../logger/index.js";
+import { applySecretsAndVariablesToConfig } from "../../../config/secrets.js";
 import { getCache } from "../../../util/cache/repository/index.js";
 import { getBranchCommit } from "../../../util/git/index.js";
 import { scm } from "../../../modules/platform/scm.js";
 import { platform } from "../../../modules/platform/index.js";
-import { applySecretsAndVariablesToConfig } from "../../../config/secrets.js";
 import { mergeRenovateConfig } from "../init/merge.js";
 import { mergeInheritedConfig } from "../init/inherited.js";
 import { extractDependencies } from "../process/index.js";
@@ -12,7 +12,6 @@ import { ensureReconfigurePrComment } from "./comment.js";
 import { deleteReconfigureBranchCache, setReconfigureBranchCache } from "./reconfigure-cache.js";
 import { getReconfigureBranchName, getReconfigureConfig, setBranchStatus } from "./utils.js";
 import { validateReconfigureBranch } from "./validate.js";
-
 //#region lib/workers/repository/reconfigure/index.ts
 async function checkReconfigureBranch(config, repoConfig) {
 	logger.debug("checkReconfigureBranch()");
@@ -35,11 +34,9 @@ async function checkReconfigureBranch(config, repoConfig) {
 	});
 	const branchSha = getBranchCommit(reconfigureBranch);
 	const reconfigureCache = getCache().reconfigureBranchCache;
-	if (reconfigureCache?.reconfigureBranchSha === branchSha) {
-		if (!existingPr || reconfigureCache.extractResult) {
-			logger.debug("Skipping validation check as branch sha is unchanged");
-			return;
-		}
+	if (reconfigureCache?.reconfigureBranchSha === branchSha && (!existingPr || reconfigureCache.extractResult)) {
+		logger.debug("Skipping validation check as branch sha is unchanged");
+		return;
 	}
 	const result = await getReconfigureConfig(reconfigureBranch);
 	if (!result.ok) {
@@ -83,7 +80,7 @@ async function checkReconfigureBranch(config, repoConfig) {
 	setReconfigureBranchCache(branchSha, true, extractResult);
 	await scm.checkoutBranch(config.defaultBranch);
 }
-
 //#endregion
 export { checkReconfigureBranch };
+
 //# sourceMappingURL=index.js.map