renovate 44.155.1 → 44.155.2

package/dist/modules/datasource/gitea-tags/base.js

@@ -1,6 +1,9 @@
+import { logger } from "../../../logger/index.js";
 import { buildCacheKey } from "../../../util/cache/package/key.js";
 import { parseUrl } from "../../../util/url.js";
 import { withCache } from "../../../util/cache/package/with-cache.js";
+import { RequestError } from "../../../util/http/got.js";
+import "../../../util/http/index.js";
 import { Datasource } from "../datasource.js";
 import { GiteaHttp } from "../../../util/http/gitea.js";
 import { Commits, Tag } from "./schema.js";
@@ -76,11 +79,23 @@ var GiteaDatasource = class GiteaDatasource extends Datasource {
 		}, () => this._getTagCommit(resolvedUrl, repo, tag));
 	}
 	async _getDigest(registryUrl, repo, newValue) {
-		if (newValue?.length) return this.getTagCommit(registryUrl, repo, newValue);
-		const url = `${getApiUrl(registryUrl)}repos/${repo}/commits?stat=false&verification=false&files=false&page=1&limit=1`;
-		const { body } = await this.http.getJson(url, Commits);
-		if (body.length === 0) return null;
-		return body[0].sha;
+		try {
+			if (newValue?.length) return await this.getTagCommit(registryUrl, repo, newValue);
+			const url = `${getApiUrl(registryUrl)}repos/${repo}/commits?stat=false&verification=false&files=false&page=1&limit=1`;
+			const { body } = await this.http.getJson(url, Commits);
+			if (body.length === 0) return null;
+			return body[0].sha;
+		} catch (err) {
+			if (err instanceof RequestError && err.response?.statusCode === 404) {
+				logger.debug({
+					giteaRepo: repo,
+					err,
+					registryUrl
+				}, "Gitea repo or ref not found when getting commit");
+				return null;
+			}
+			this.handleGenericErrors(err);
+		}
 	}
 	getDigest({ packageName: repo, registryUrl }, newValue) {
 		const resolvedUrl = this.getRegistryUrl(registryUrl);

package/dist/modules/datasource/gitea-tags/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","names":[],"sources":["../../../../lib/modules/datasource/gitea-tags/base.ts"],"sourcesContent":["import { buildCacheKey } from '../../../util/cache/package/key.ts';\nimport type { PackageCacheNamespace } from '../../../util/cache/package/types.ts';\nimport { withCache } from '../../../util/cache/package/with-cache.ts';\nimport { GiteaHttp } from '../../../util/http/gitea.ts';\nimport { parseUrl } from '../../../util/url.ts';\nimport { Datasource } from '../datasource.ts';\nimport type {\n  DigestConfig,\n  GetReleasesConfig,\n  ReleaseResult,\n} from '../types.ts';\nimport { Commits, Tag } from './schema.ts';\nimport { getApiUrl, getSourceUrl } from './util.ts';\n\n/**\n * Shared implementation of the datasources which speak the Gitea API.\n *\n * Forgejo is a fork of Gitea and serves the same API, so the Forgejo\n * datasources extend the Gitea ones and only differ in their id, their default\n * registry URL and their cache namespace. The digest lookup and the caching of\n * `getReleases()` are the same for tags and releases, so they live here and a\n * subclass only fetches and maps the releases of its own endpoint.\n */\nexport abstract class GiteaDatasource extends Datasource<GiteaHttp> {\n  static readonly defaultRegistryUrls = ['https://gitea.com'];\n\n  override getDefaultRegistryUrls(_packageName: string): string[] {\n    return GiteaDatasource.defaultRegistryUrls;\n  }\n\n  protected abstract override readonly cacheNamespace: PackageCacheNamespace;\n\n  override readonly releaseTimestampSupport = true;\n  override readonly releaseTimestampNote: string;\n  override readonly sourceUrlSupport = 'package';\n  override readonly sourceUrlNote =\n    'The source URL is determined by using the `packageName` and `registryUrl`.';\n\n  /** Discriminates the cache keys of the two endpoints. */\n  private readonly cacheKeyType: string;\n\n  /**\n   * @param endpoint describes the endpoint `getReleases()` reads: the\n   * discriminator of its cache keys, and the field the release timestamp comes\n   * from, which is rendered into the generated documentation.\n   * @param http lets a subclass for another Gitea-compatible host supply a\n   * client scoped to its own host type.\n   */\n  protected constructor(\n    id: string,\n    endpoint: { cacheKeyType: string; releaseTimestampField: string },\n    http: GiteaHttp = new GiteaHttp(id),\n  ) {\n    super(id, http);\n    this.cacheKeyType = endpoint.cacheKeyType;\n    this.releaseTimestampNote = `The release timestamp is determined from the \\`${endpoint.releaseTimestampField}\\` field in the results.`;\n  }\n\n  static getSourceUrl(packageName: string, registryUrl?: string): string {\n    return getSourceUrl(\n      packageName,\n      registryUrl ?? this.defaultRegistryUrls[0],\n    );\n  }\n\n  /** Falls back to the default registry URL when none is configured. */\n  protected getRegistryUrl(registryUrl?: string): string {\n    return registryUrl ?? this.getDefaultRegistryUrls('')[0];\n  }\n\n  /**\n   * Only results from the public default instance may be written to the\n   * shared package cache; a self-hosted instance may serve private\n   * repositories.\n   */\n  protected isPublicRegistry(registryUrl: string): boolean {\n    return (\n      parseUrl(registryUrl)?.hostname ===\n      parseUrl(this.getDefaultRegistryUrls('')[0])?.hostname\n    );\n  }\n\n  /** Fetches and maps the releases of the endpoint; `getReleases()` caches them. */\n  protected abstract _getReleases(\n    registryUrl: string,\n    repo: string,\n  ): Promise<ReleaseResult | null>;\n\n  getReleases({\n    registryUrl,\n    packageName: repo,\n  }: GetReleasesConfig): Promise<ReleaseResult | null> {\n    const resolvedUrl = this.getRegistryUrl(registryUrl);\n    return withCache(\n      {\n        namespace: this.cacheNamespace,\n        key: buildCacheKey(resolvedUrl, repo, this.cacheKeyType),\n        fallback: true,\n        cacheable: this.isPublicRegistry(resolvedUrl),\n      },\n      () => this._getReleases(resolvedUrl, repo),\n    );\n  }\n\n  // getTagCommit fetches the commit hash for the specified tag\n  private async _getTagCommit(\n    registryUrl: string,\n    repo: string,\n    tag: string,\n  ): Promise<string | null> {\n    const url = `${getApiUrl(registryUrl)}repos/${repo}/tags/${tag}`;\n\n    const { body } = await this.http.getJson(url, Tag);\n\n    return body.commit.sha;\n  }\n\n  getTagCommit(\n    registryUrl: string | undefined,\n    repo: string,\n    tag: string,\n  ): Promise<string | null> {\n    const resolvedUrl = this.getRegistryUrl(registryUrl);\n    return withCache(\n      {\n        namespace: this.cacheNamespace,\n        key: buildCacheKey(resolvedUrl, repo, 'tag', tag),\n        cacheable: this.isPublicRegistry(resolvedUrl),\n      },\n      () => this._getTagCommit(resolvedUrl, repo, tag),\n    );\n  }\n\n  // getDigest fetches the latest commit for the repository's main branch,\n  // however, if newValue is provided, then getTagCommit is called\n  private async _getDigest(\n    registryUrl: string,\n    repo: string,\n    newValue?: string,\n  ): Promise<string | null> {\n    if (newValue?.length) {\n      return this.getTagCommit(registryUrl, repo, newValue);\n    }\n\n    const url = `${getApiUrl(\n      registryUrl,\n    )}repos/${repo}/commits?stat=false&verification=false&files=false&page=1&limit=1`;\n    const { body } = await this.http.getJson(url, Commits);\n\n    if (body.length === 0) {\n      return null;\n    }\n\n    return body[0].sha;\n  }\n\n  override getDigest(\n    { packageName: repo, registryUrl }: DigestConfig,\n    newValue?: string,\n  ): Promise<string | null> {\n    const resolvedUrl = this.getRegistryUrl(registryUrl);\n    return withCache(\n      {\n        namespace: this.cacheNamespace,\n        key: buildCacheKey(resolvedUrl, repo, 'digest', newValue),\n        fallback: true,\n        cacheable: this.isPublicRegistry(resolvedUrl),\n      },\n      () => this._getDigest(resolvedUrl, repo, newValue),\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAuBA,IAAsB,kBAAtB,MAAsB,wBAAwB,WAAsB;CAClE,OAAgB,sBAAsB,CAAC,mBAAmB;CAE1D,uBAAgC,cAAgC;EAC9D,OAAO,gBAAgB;CACzB;CAIA,0BAA4C;CAC5C;CACA,mBAAqC;CACrC,gBACE;;CAGF;;;;;;;;CASA,YACE,IACA,UACA,OAAkB,IAAI,UAAU,EAAE,GAClC;EACA,MAAM,IAAI,IAAI;EACd,KAAK,eAAe,SAAS;EAC7B,KAAK,uBAAuB,kDAAkD,SAAS,sBAAsB;CAC/G;CAEA,OAAO,aAAa,aAAqB,aAA8B;EACrE,OAAO,aACL,aACA,eAAe,KAAK,oBAAoB,EAC1C;CACF;;CAGA,eAAyB,aAA8B;EACrD,OAAO,eAAe,KAAK,uBAAuB,EAAE,CAAC,CAAC;CACxD;;;;;;CAOA,iBAA2B,aAA8B;EACvD,OACE,SAAS,WAAW,CAAC,EAAE,aACvB,SAAS,KAAK,uBAAuB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE;CAElD;CAQA,YAAY,EACV,aACA,aAAa,QACsC;EACnD,MAAM,cAAc,KAAK,eAAe,WAAW;EACnD,OAAO,UACL;GACE,WAAW,KAAK;GAChB,KAAK,cAAc,aAAa,MAAM,KAAK,YAAY;GACvD,UAAU;GACV,WAAW,KAAK,iBAAiB,WAAW;EAC9C,SACM,KAAK,aAAa,aAAa,IAAI,CAC3C;CACF;CAGA,MAAc,cACZ,aACA,MACA,KACwB;EACxB,MAAM,MAAM,GAAG,UAAU,WAAW,EAAE,QAAQ,KAAK,QAAQ;EAE3D,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,QAAQ,KAAK,GAAG;EAEjD,OAAO,KAAK,OAAO;CACrB;CAEA,aACE,aACA,MACA,KACwB;EACxB,MAAM,cAAc,KAAK,eAAe,WAAW;EACnD,OAAO,UACL;GACE,WAAW,KAAK;GAChB,KAAK,cAAc,aAAa,MAAM,OAAO,GAAG;GAChD,WAAW,KAAK,iBAAiB,WAAW;EAC9C,SACM,KAAK,cAAc,aAAa,MAAM,GAAG,CACjD;CACF;CAIA,MAAc,WACZ,aACA,MACA,UACwB;EACxB,IAAI,UAAU,QACZ,OAAO,KAAK,aAAa,aAAa,MAAM,QAAQ;EAGtD,MAAM,MAAM,GAAG,UACb,WACF,EAAE,QAAQ,KAAK;EACf,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,QAAQ,KAAK,OAAO;EAErD,IAAI,KAAK,WAAW,GAClB,OAAO;EAGT,OAAO,KAAK,EAAE,CAAC;CACjB;CAEA,UACE,EAAE,aAAa,MAAM,eACrB,UACwB;EACxB,MAAM,cAAc,KAAK,eAAe,WAAW;EACnD,OAAO,UACL;GACE,WAAW,KAAK;GAChB,KAAK,cAAc,aAAa,MAAM,UAAU,QAAQ;GACxD,UAAU;GACV,WAAW,KAAK,iBAAiB,WAAW;EAC9C,SACM,KAAK,WAAW,aAAa,MAAM,QAAQ,CACnD;CACF;AACF"}
+{"version":3,"file":"base.js","names":["HttpError"],"sources":["../../../../lib/modules/datasource/gitea-tags/base.ts"],"sourcesContent":["import { logger } from '../../../logger/index.ts';\nimport { buildCacheKey } from '../../../util/cache/package/key.ts';\nimport type { PackageCacheNamespace } from '../../../util/cache/package/types.ts';\nimport { withCache } from '../../../util/cache/package/with-cache.ts';\nimport { GiteaHttp } from '../../../util/http/gitea.ts';\nimport { HttpError } from '../../../util/http/index.ts';\nimport { parseUrl } from '../../../util/url.ts';\nimport { Datasource } from '../datasource.ts';\nimport type {\n  DigestConfig,\n  GetReleasesConfig,\n  ReleaseResult,\n} from '../types.ts';\nimport { Commits, Tag } from './schema.ts';\nimport { getApiUrl, getSourceUrl } from './util.ts';\n\n/**\n * Shared implementation of the datasources which speak the Gitea API.\n *\n * Forgejo is a fork of Gitea and serves the same API, so the Forgejo\n * datasources extend the Gitea ones and only differ in their id, their default\n * registry URL and their cache namespace. The digest lookup and the caching of\n * `getReleases()` are the same for tags and releases, so they live here and a\n * subclass only fetches and maps the releases of its own endpoint.\n */\nexport abstract class GiteaDatasource extends Datasource<GiteaHttp> {\n  static readonly defaultRegistryUrls = ['https://gitea.com'];\n\n  override getDefaultRegistryUrls(_packageName: string): string[] {\n    return GiteaDatasource.defaultRegistryUrls;\n  }\n\n  protected abstract override readonly cacheNamespace: PackageCacheNamespace;\n\n  override readonly releaseTimestampSupport = true;\n  override readonly releaseTimestampNote: string;\n  override readonly sourceUrlSupport = 'package';\n  override readonly sourceUrlNote =\n    'The source URL is determined by using the `packageName` and `registryUrl`.';\n\n  /** Discriminates the cache keys of the two endpoints. */\n  private readonly cacheKeyType: string;\n\n  /**\n   * @param endpoint describes the endpoint `getReleases()` reads: the\n   * discriminator of its cache keys, and the field the release timestamp comes\n   * from, which is rendered into the generated documentation.\n   * @param http lets a subclass for another Gitea-compatible host supply a\n   * client scoped to its own host type.\n   */\n  protected constructor(\n    id: string,\n    endpoint: { cacheKeyType: string; releaseTimestampField: string },\n    http: GiteaHttp = new GiteaHttp(id),\n  ) {\n    super(id, http);\n    this.cacheKeyType = endpoint.cacheKeyType;\n    this.releaseTimestampNote = `The release timestamp is determined from the \\`${endpoint.releaseTimestampField}\\` field in the results.`;\n  }\n\n  static getSourceUrl(packageName: string, registryUrl?: string): string {\n    return getSourceUrl(\n      packageName,\n      registryUrl ?? this.defaultRegistryUrls[0],\n    );\n  }\n\n  /** Falls back to the default registry URL when none is configured. */\n  protected getRegistryUrl(registryUrl?: string): string {\n    return registryUrl ?? this.getDefaultRegistryUrls('')[0];\n  }\n\n  /**\n   * Only results from the public default instance may be written to the\n   * shared package cache; a self-hosted instance may serve private\n   * repositories.\n   */\n  protected isPublicRegistry(registryUrl: string): boolean {\n    return (\n      parseUrl(registryUrl)?.hostname ===\n      parseUrl(this.getDefaultRegistryUrls('')[0])?.hostname\n    );\n  }\n\n  /** Fetches and maps the releases of the endpoint; `getReleases()` caches them. */\n  protected abstract _getReleases(\n    registryUrl: string,\n    repo: string,\n  ): Promise<ReleaseResult | null>;\n\n  getReleases({\n    registryUrl,\n    packageName: repo,\n  }: GetReleasesConfig): Promise<ReleaseResult | null> {\n    const resolvedUrl = this.getRegistryUrl(registryUrl);\n    return withCache(\n      {\n        namespace: this.cacheNamespace,\n        key: buildCacheKey(resolvedUrl, repo, this.cacheKeyType),\n        fallback: true,\n        cacheable: this.isPublicRegistry(resolvedUrl),\n      },\n      () => this._getReleases(resolvedUrl, repo),\n    );\n  }\n\n  // getTagCommit fetches the commit hash for the specified tag\n  private async _getTagCommit(\n    registryUrl: string,\n    repo: string,\n    tag: string,\n  ): Promise<string | null> {\n    const url = `${getApiUrl(registryUrl)}repos/${repo}/tags/${tag}`;\n\n    const { body } = await this.http.getJson(url, Tag);\n\n    return body.commit.sha;\n  }\n\n  getTagCommit(\n    registryUrl: string | undefined,\n    repo: string,\n    tag: string,\n  ): Promise<string | null> {\n    const resolvedUrl = this.getRegistryUrl(registryUrl);\n    return withCache(\n      {\n        namespace: this.cacheNamespace,\n        key: buildCacheKey(resolvedUrl, repo, 'tag', tag),\n        cacheable: this.isPublicRegistry(resolvedUrl),\n      },\n      () => this._getTagCommit(resolvedUrl, repo, tag),\n    );\n  }\n\n  // getDigest fetches the latest commit for the repository's main branch,\n  // however, if newValue is provided, then getTagCommit is called\n  private async _getDigest(\n    registryUrl: string,\n    repo: string,\n    newValue?: string,\n  ): Promise<string | null> {\n    try {\n      if (newValue?.length) {\n        return await this.getTagCommit(registryUrl, repo, newValue);\n      }\n\n      const url = `${getApiUrl(\n        registryUrl,\n      )}repos/${repo}/commits?stat=false&verification=false&files=false&page=1&limit=1`;\n      const { body } = await this.http.getJson(url, Commits);\n\n      if (body.length === 0) {\n        return null;\n      }\n\n      return body[0].sha;\n    } catch (err) {\n      if (err instanceof HttpError && err.response?.statusCode === 404) {\n        logger.debug(\n          { giteaRepo: repo, err, registryUrl },\n          'Gitea repo or ref not found when getting commit',\n        );\n        return null;\n      }\n      this.handleGenericErrors(err);\n    }\n  }\n\n  override getDigest(\n    { packageName: repo, registryUrl }: DigestConfig,\n    newValue?: string,\n  ): Promise<string | null> {\n    const resolvedUrl = this.getRegistryUrl(registryUrl);\n    return withCache(\n      {\n        namespace: this.cacheNamespace,\n        key: buildCacheKey(resolvedUrl, repo, 'digest', newValue),\n        fallback: true,\n        cacheable: this.isPublicRegistry(resolvedUrl),\n      },\n      () => this._getDigest(resolvedUrl, repo, newValue),\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyBA,IAAsB,kBAAtB,MAAsB,wBAAwB,WAAsB;CAClE,OAAgB,sBAAsB,CAAC,mBAAmB;CAE1D,uBAAgC,cAAgC;EAC9D,OAAO,gBAAgB;CACzB;CAIA,0BAA4C;CAC5C;CACA,mBAAqC;CACrC,gBACE;;CAGF;;;;;;;;CASA,YACE,IACA,UACA,OAAkB,IAAI,UAAU,EAAE,GAClC;EACA,MAAM,IAAI,IAAI;EACd,KAAK,eAAe,SAAS;EAC7B,KAAK,uBAAuB,kDAAkD,SAAS,sBAAsB;CAC/G;CAEA,OAAO,aAAa,aAAqB,aAA8B;EACrE,OAAO,aACL,aACA,eAAe,KAAK,oBAAoB,EAC1C;CACF;;CAGA,eAAyB,aAA8B;EACrD,OAAO,eAAe,KAAK,uBAAuB,EAAE,CAAC,CAAC;CACxD;;;;;;CAOA,iBAA2B,aAA8B;EACvD,OACE,SAAS,WAAW,CAAC,EAAE,aACvB,SAAS,KAAK,uBAAuB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE;CAElD;CAQA,YAAY,EACV,aACA,aAAa,QACsC;EACnD,MAAM,cAAc,KAAK,eAAe,WAAW;EACnD,OAAO,UACL;GACE,WAAW,KAAK;GAChB,KAAK,cAAc,aAAa,MAAM,KAAK,YAAY;GACvD,UAAU;GACV,WAAW,KAAK,iBAAiB,WAAW;EAC9C,SACM,KAAK,aAAa,aAAa,IAAI,CAC3C;CACF;CAGA,MAAc,cACZ,aACA,MACA,KACwB;EACxB,MAAM,MAAM,GAAG,UAAU,WAAW,EAAE,QAAQ,KAAK,QAAQ;EAE3D,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,QAAQ,KAAK,GAAG;EAEjD,OAAO,KAAK,OAAO;CACrB;CAEA,aACE,aACA,MACA,KACwB;EACxB,MAAM,cAAc,KAAK,eAAe,WAAW;EACnD,OAAO,UACL;GACE,WAAW,KAAK;GAChB,KAAK,cAAc,aAAa,MAAM,OAAO,GAAG;GAChD,WAAW,KAAK,iBAAiB,WAAW;EAC9C,SACM,KAAK,cAAc,aAAa,MAAM,GAAG,CACjD;CACF;CAIA,MAAc,WACZ,aACA,MACA,UACwB;EACxB,IAAI;GACF,IAAI,UAAU,QACZ,OAAO,MAAM,KAAK,aAAa,aAAa,MAAM,QAAQ;GAG5D,MAAM,MAAM,GAAG,UACb,WACF,EAAE,QAAQ,KAAK;GACf,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,QAAQ,KAAK,OAAO;GAErD,IAAI,KAAK,WAAW,GAClB,OAAO;GAGT,OAAO,KAAK,EAAE,CAAC;EACjB,SAAS,KAAK;GACZ,IAAI,eAAeA,gBAAa,IAAI,UAAU,eAAe,KAAK;IAChE,OAAO,MACL;KAAE,WAAW;KAAM;KAAK;IAAY,GACpC,iDACF;IACA,OAAO;GACT;GACA,KAAK,oBAAoB,GAAG;EAC9B;CACF;CAEA,UACE,EAAE,aAAa,MAAM,eACrB,UACwB;EACxB,MAAM,cAAc,KAAK,eAAe,WAAW;EACnD,OAAO,UACL;GACE,WAAW,KAAK;GAChB,KAAK,cAAc,aAAa,MAAM,UAAU,QAAQ;GACxD,UAAU;GACV,WAAW,KAAK,iBAAiB,WAAW;EAC9C,SACM,KAAK,WAAW,aAAa,MAAM,QAAQ,CACnD;CACF;AACF"}

package/dist/workers/repository/process/extract-update.js

@@ -1,6 +1,7 @@
 import { cleanDatasourceKeys } from "../../../util/cache/memory/index.js";
 import { isNotNullOrUndefined } from "../../../util/array.js";
 import { logger } from "../../../logger/index.js";
+import { clone } from "../../../util/clone.js";
 import { instrument } from "../../../instrumentation/index.js";
 import { getCache } from "../../../util/cache/repository/index.js";
 import { checkGithubToken } from "../../../util/check-token.js";
@@ -81,16 +82,8 @@ async function extract(config, overwriteCache = true) {
 	cache.scan ??= {};
 	const cachedExtract = cache.scan[baseBranch];
 	const configHash = instrument("fingerprint", () => fingerprint(generateFingerprintConfig(config)));
-	// istanbul ignore if
-	if (overwriteCache && isCacheExtractValid(baseBranchSha, configHash, cachedExtract)) {
-		packageFiles = cachedExtract.packageFiles;
-		try {
-			for (const files of Object.values(packageFiles)) for (const file of files) for (const dep of file.deps) delete dep.updates;
-			logger.debug("Deleted cached dep updates");
-		} catch (err) {
-			logger.info({ err }, "Error deleting cached dep updates");
-		}
-	} else {
+	if (overwriteCache && isCacheExtractValid(baseBranchSha, configHash, cachedExtract)) packageFiles = clone(cachedExtract.packageFiles);
+	else {
 		await instrument("checkoutBranch", async () => await scm.checkoutBranch(baseBranch));
 		const extractResult = await instrument("extractAllDependencies", async () => await extractAllDependencies(config) || {});
 		packageFiles = extractResult.packageFiles;
@@ -100,7 +93,7 @@ async function extract(config, overwriteCache = true) {
 			sha: baseBranchSha,
 			configHash,
 			extractionFingerprints,
-			packageFiles
+			packageFiles: clone(packageFiles)
 		};
 		const baseBranches = isNonEmptyArray(config.baseBranches) ? config.baseBranches : [baseBranch];
 		Object.keys(cache.scan).forEach((branchName) => {

package/dist/workers/repository/process/extract-update.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract-update.js","names":[],"sources":["../../../../lib/workers/repository/process/extract-update.ts"],"sourcesContent":["import { isNonEmptyArray } from '@sindresorhus/is';\nimport type { RenovateConfig } from '../../../config/types.ts';\nimport { instrument } from '../../../instrumentation/index.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { hashMap } from '../../../modules/manager/index.ts';\nimport type { PackageFile } from '../../../modules/manager/types.ts';\nimport { scm } from '../../../modules/platform/scm.ts';\nimport { isNotNullOrUndefined } from '../../../util/array.ts';\nimport * as memCache from '../../../util/cache/memory/index.ts';\nimport { getCache } from '../../../util/cache/repository/index.ts';\nimport type { BaseBranchCache } from '../../../util/cache/repository/types.ts';\nimport { checkGithubToken as ensureGithubToken } from '../../../util/check-token.ts';\nimport { fingerprint } from '../../../util/fingerprint.ts';\nimport type { BranchConfig } from '../../types.ts';\nimport { generateFingerprintConfig } from '../extract/extract-fingerprint-config.ts';\nimport { extractAllDependencies } from '../extract/index.ts';\nimport { branchifyUpgrades } from '../updates/branchify.ts';\nimport { fetchUpdates } from './fetch.ts';\nimport { calculateLibYears } from './libyear.ts';\nimport { sortBranches } from './sort.ts';\nimport { Vulnerabilities } from './vulnerabilities.ts';\nimport type { WriteUpdateResult } from './write.ts';\nimport { writeUpdates } from './write.ts';\n\n// Increment this if needing to cache bust ALL extract caches\nexport const EXTRACT_CACHE_REVISION = 1;\n\nexport interface ExtractResult {\n  branches: BranchConfig[];\n  branchList: string[];\n  packageFiles: Record<string, PackageFile[]>;\n}\n\nexport interface StatsResult {\n  fileCount: number;\n  depCount: number;\n}\n\nexport interface Stats {\n  managers: Record<string, StatsResult>;\n  total: StatsResult;\n}\n\n// istanbul ignore next\nfunction extractStats(\n  packageFiles: Record<string, PackageFile[]>,\n): Stats | null {\n  if (!packageFiles) {\n    return null;\n  }\n  const stats: Stats = {\n    managers: {},\n    total: {\n      fileCount: 0,\n      depCount: 0,\n    },\n  };\n  for (const [manager, managerPackageFiles] of Object.entries(packageFiles)) {\n    const fileCount = managerPackageFiles.length;\n    let depCount = 0;\n    for (const file of managerPackageFiles) {\n      depCount += file.deps.length;\n    }\n    stats.managers[manager] = {\n      fileCount,\n      depCount,\n    };\n    stats.total.fileCount += fileCount;\n    stats.total.depCount += depCount;\n  }\n  return stats;\n}\n\nexport function isCacheExtractValid(\n  baseBranchSha: string,\n  configHash: string,\n  cachedExtract?: BaseBranchCache,\n): boolean {\n  if (!cachedExtract) {\n    return false;\n  }\n\n  if (!cachedExtract.revision) {\n    logger.debug('Cached extract is missing revision, so cannot be used');\n    return false;\n  }\n\n  if (cachedExtract.revision !== EXTRACT_CACHE_REVISION) {\n    logger.debug(\n      `Extract cache revision has changed (old=${cachedExtract.revision}, new=${EXTRACT_CACHE_REVISION})`,\n    );\n    return false;\n  }\n\n  if (!(cachedExtract.sha && cachedExtract.configHash)) {\n    return false;\n  }\n  if (cachedExtract.sha !== baseBranchSha) {\n    logger.debug(\n      `Cached extract result cannot be used due to base branch SHA change (old=${cachedExtract.sha}, new=${baseBranchSha})`,\n    );\n    return false;\n  }\n  if (cachedExtract.configHash !== configHash) {\n    logger.debug('Cached extract result cannot be used due to config change');\n    return false;\n  }\n  if (!cachedExtract.extractionFingerprints) {\n    logger.debug(\n      'Cached extract is missing extractionFingerprints, so cannot be used',\n    );\n    return false;\n  }\n  const changedManagers = new Set();\n  for (const [manager, fingerprint] of Object.entries(\n    cachedExtract.extractionFingerprints,\n  )) {\n    if (fingerprint !== hashMap.get(manager)) {\n      changedManagers.add(manager);\n    }\n  }\n  if (changedManagers.size > 0) {\n    logger.debug(\n      { changedManagers: [...changedManagers] },\n      'Manager fingerprint(s) have changed, extract cache cannot be reused',\n    );\n    return false;\n  }\n  logger.debug(\n    `Cached extract for sha=${baseBranchSha} is valid and can be used`,\n  );\n  return true;\n}\n\nexport async function extract(\n  config: RenovateConfig,\n  overwriteCache = true,\n): Promise<Record<string, PackageFile[]>> {\n  logger.debug('extract()');\n  const { baseBranch } = config;\n  const baseBranchSha = await scm.getBranchCommit(baseBranch!);\n  let packageFiles: Record<string, PackageFile[]>;\n  const cache = getCache();\n  cache.scan ??= {};\n  const cachedExtract = cache.scan[baseBranch!];\n  const configHash = instrument('fingerprint', () =>\n    fingerprint(generateFingerprintConfig(config)),\n  );\n  // istanbul ignore if\n  if (\n    overwriteCache &&\n    isCacheExtractValid(baseBranchSha!, configHash, cachedExtract)\n  ) {\n    packageFiles = cachedExtract.packageFiles;\n    try {\n      for (const files of Object.values(packageFiles)) {\n        for (const file of files) {\n          for (const dep of file.deps) {\n            delete dep.updates;\n          }\n        }\n      }\n      logger.debug('Deleted cached dep updates');\n    } catch (err) {\n      logger.info({ err }, 'Error deleting cached dep updates');\n    }\n  } else {\n    await instrument(\n      'checkoutBranch',\n      async () => await scm.checkoutBranch(baseBranch!),\n    );\n    const extractResult = await instrument(\n      'extractAllDependencies',\n      async () => (await extractAllDependencies(config)) || {},\n    );\n    packageFiles = extractResult.packageFiles;\n    const { extractionFingerprints } = extractResult;\n\n    if (overwriteCache) {\n      // TODO: fix types (#22198)\n      cache.scan[baseBranch!] = {\n        revision: EXTRACT_CACHE_REVISION,\n        sha: baseBranchSha!,\n        configHash,\n        extractionFingerprints,\n        packageFiles,\n      };\n    }\n\n    // Clean up cached branch extracts\n    const baseBranches = isNonEmptyArray(config.baseBranches)\n      ? config.baseBranches\n      : [baseBranch];\n    Object.keys(cache.scan).forEach((branchName) => {\n      if (!baseBranches.includes(branchName)) {\n        delete cache.scan![branchName];\n      }\n    });\n  }\n  const stats = extractStats(packageFiles);\n  logger.info(\n    { baseBranch: config.baseBranch, stats },\n    `Dependency extraction complete`,\n  );\n  logger.trace({ config: packageFiles }, 'packageFiles');\n  ensureGithubToken(packageFiles);\n  return packageFiles;\n}\n\nasync function fetchVulnerabilities(\n  config: RenovateConfig,\n  packageFiles: Record<string, PackageFile[]>,\n): Promise<void> {\n  if (config.osvVulnerabilityAlerts) {\n    logger.debug('fetchVulnerabilities() - osvVulnerabilityAlerts=true');\n    try {\n      const vulnerabilities = await Vulnerabilities.create();\n      await vulnerabilities.appendVulnerabilityPackageRules(\n        config,\n        packageFiles,\n      );\n    } catch (err) {\n      logger.warn({ err }, 'Unable to read vulnerability information');\n    }\n  }\n}\n\nexport async function lookup(\n  config: RenovateConfig,\n  packageFiles: Record<string, PackageFile[]>,\n): Promise<ExtractResult> {\n  await fetchVulnerabilities(config, packageFiles);\n  await fetchUpdates(config, packageFiles);\n  // call this twice, as the second time, the updates will be availalbe for malicious package checks\n  // TODO: this will be refactored as part of #42423\n  await fetchVulnerabilities(config, packageFiles);\n  memCache.cleanDatasourceKeys();\n  calculateLibYears(config, packageFiles);\n  const { branches, branchList } = await branchifyUpgrades(\n    config,\n    packageFiles,\n  );\n  reportMaliciousSkippedDependencies(packageFiles);\n  logger.debug(\n    { baseBranch: config.baseBranch, config: packageFiles },\n    'packageFiles with updates',\n  );\n  sortBranches(branches);\n  return { branches, branchList, packageFiles };\n}\n\nexport function reportMaliciousSkippedDependencies(\n  allPackageFiles: Record<string, PackageFile[]>,\n): void {\n  if (allPackageFiles === undefined) {\n    return;\n  }\n\n  for (const [manager, packageFiles] of Object.entries(allPackageFiles)) {\n    for (const packageFile of packageFiles) {\n      for (const dep of packageFile.deps) {\n        if (dep.skipReason === 'malicious-version-in-use') {\n          logger.warn(\n            {\n              packageFile: packageFile.packageFile,\n              depName: dep.depName,\n              packageName: dep.packageName,\n              manager: manager,\n              datasource: dep.datasource,\n            },\n            'Dependency is currently using a malicious version',\n          );\n\n          // and make sure that it then gets updates proposed in the update phase\n          delete dep.skipReason;\n          delete dep.skipStage;\n        } else if (dep.skipReason === 'malicious-update-proposed') {\n          const newVersions = dep.updates\n            ?.map((u) => u.newVersion ?? u.newValue)\n            .filter(isNotNullOrUndefined);\n          logger.warn(\n            {\n              packageFile: packageFile.packageFile,\n              depName: dep.depName,\n              packageName: dep.packageName,\n              manager: manager,\n              datasource: dep.datasource,\n              newVersions,\n            },\n            'Dependency has update(s) proposed which would update you to a malicious version - skipping',\n          );\n        }\n      }\n    }\n  }\n}\n\nexport function update(\n  config: RenovateConfig,\n  branches: BranchConfig[],\n): Promise<WriteUpdateResult> {\n  return writeUpdates(config, branches);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA4CA,SAAS,aACP,cACc;CACd,IAAI,CAAC,cACH,OAAO;CAET,MAAM,QAAe;EACnB,UAAU,CAAC;EACX,OAAO;GACL,WAAW;GACX,UAAU;EACZ;CACF;CACA,KAAK,MAAM,CAAC,SAAS,wBAAwB,OAAO,QAAQ,YAAY,GAAG;EACzE,MAAM,YAAY,oBAAoB;EACtC,IAAI,WAAW;EACf,KAAK,MAAM,QAAQ,qBACjB,YAAY,KAAK,KAAK;EAExB,MAAM,SAAS,WAAW;GACxB;GACA;EACF;EACA,MAAM,MAAM,aAAa;EACzB,MAAM,MAAM,YAAY;CAC1B;CACA,OAAO;AACT;AAEA,SAAgB,oBACd,eACA,YACA,eACS;CACT,IAAI,CAAC,eACH,OAAO;CAGT,IAAI,CAAC,cAAc,UAAU;EAC3B,OAAO,MAAM,uDAAuD;EACpE,OAAO;CACT;CAEA,IAAI,cAAc,aAAA,GAAqC;EACrD,OAAO,MACL,2CAA2C,cAAc,SAAS,SACpE;EACA,OAAO;CACT;CAEA,IAAI,EAAE,cAAc,OAAO,cAAc,aACvC,OAAO;CAET,IAAI,cAAc,QAAQ,eAAe;EACvC,OAAO,MACL,2EAA2E,cAAc,IAAI,QAAQ,cAAc,EACrH;EACA,OAAO;CACT;CACA,IAAI,cAAc,eAAe,YAAY;EAC3C,OAAO,MAAM,2DAA2D;EACxE,OAAO;CACT;CACA,IAAI,CAAC,cAAc,wBAAwB;EACzC,OAAO,MACL,qEACF;EACA,OAAO;CACT;CACA,MAAM,kCAAkB,IAAI,IAAI;CAChC,KAAK,MAAM,CAAC,SAAS,gBAAgB,OAAO,QAC1C,cAAc,sBAChB,GACE,IAAI,gBAAgB,QAAQ,IAAI,OAAO,GACrC,gBAAgB,IAAI,OAAO;CAG/B,IAAI,gBAAgB,OAAO,GAAG;EAC5B,OAAO,MACL,EAAE,iBAAiB,CAAC,GAAG,eAAe,EAAE,GACxC,qEACF;EACA,OAAO;CACT;CACA,OAAO,MACL,0BAA0B,cAAc,0BAC1C;CACA,OAAO;AACT;AAEA,eAAsB,QACpB,QACA,iBAAiB,MACuB;CACxC,OAAO,MAAM,WAAW;CACxB,MAAM,EAAE,eAAe;CACvB,MAAM,gBAAgB,MAAM,IAAI,gBAAgB,UAAW;CAC3D,IAAI;CACJ,MAAM,QAAQ,SAAS;CACvB,MAAM,SAAS,CAAC;CAChB,MAAM,gBAAgB,MAAM,KAAK;CACjC,MAAM,aAAa,WAAW,qBAC5B,YAAY,0BAA0B,MAAM,CAAC,CAC/C;;CAEA,IACE,kBACA,oBAAoB,eAAgB,YAAY,aAAa,GAC7D;EACA,eAAe,cAAc;EAC7B,IAAI;GACF,KAAK,MAAM,SAAS,OAAO,OAAO,YAAY,GAC5C,KAAK,MAAM,QAAQ,OACjB,KAAK,MAAM,OAAO,KAAK,MACrB,OAAO,IAAI;GAIjB,OAAO,MAAM,4BAA4B;EAC3C,SAAS,KAAK;GACZ,OAAO,KAAK,EAAE,IAAI,GAAG,mCAAmC;EAC1D;CACF,OAAO;EACL,MAAM,WACJ,kBACA,YAAY,MAAM,IAAI,eAAe,UAAW,CAClD;EACA,MAAM,gBAAgB,MAAM,WAC1B,0BACA,YAAa,MAAM,uBAAuB,MAAM,KAAM,CAAC,CACzD;EACA,eAAe,cAAc;EAC7B,MAAM,EAAE,2BAA2B;EAEnC,IAAI,gBAEF,MAAM,KAAK,cAAe;GACxB,UAAA;GACA,KAAK;GACL;GACA;GACA;EACF;EAIF,MAAM,eAAe,gBAAgB,OAAO,YAAY,IACpD,OAAO,eACP,CAAC,UAAU;EACf,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,eAAe;GAC9C,IAAI,CAAC,aAAa,SAAS,UAAU,GACnC,OAAO,MAAM,KAAM;EAEvB,CAAC;CACH;CACA,MAAM,QAAQ,aAAa,YAAY;CACvC,OAAO,KACL;EAAE,YAAY,OAAO;EAAY;CAAM,GACvC,gCACF;CACA,OAAO,MAAM,EAAE,QAAQ,aAAa,GAAG,cAAc;CACrD,iBAAkB,YAAY;CAC9B,OAAO;AACT;AAEA,eAAe,qBACb,QACA,cACe;CACf,IAAI,OAAO,wBAAwB;EACjC,OAAO,MAAM,sDAAsD;EACnE,IAAI;GAEF,OAAM,MADwB,gBAAgB,OAAO,EAAA,CAC/B,gCACpB,QACA,YACF;EACF,SAAS,KAAK;GACZ,OAAO,KAAK,EAAE,IAAI,GAAG,0CAA0C;EACjE;CACF;AACF;AAEA,eAAsB,OACpB,QACA,cACwB;CACxB,MAAM,qBAAqB,QAAQ,YAAY;CAC/C,MAAM,aAAa,QAAQ,YAAY;CAGvC,MAAM,qBAAqB,QAAQ,YAAY;CAC/C,oBAA6B;CAC7B,kBAAkB,QAAQ,YAAY;CACtC,MAAM,EAAE,UAAU,eAAe,MAAM,kBACrC,QACA,YACF;CACA,mCAAmC,YAAY;CAC/C,OAAO,MACL;EAAE,YAAY,OAAO;EAAY,QAAQ;CAAa,GACtD,2BACF;CACA,aAAa,QAAQ;CACrB,OAAO;EAAE;EAAU;EAAY;CAAa;AAC9C;AAEA,SAAgB,mCACd,iBACM;CACN,IAAI,oBAAoB,KAAA,GACtB;CAGF,KAAK,MAAM,CAAC,SAAS,iBAAiB,OAAO,QAAQ,eAAe,GAClE,KAAK,MAAM,eAAe,cACxB,KAAK,MAAM,OAAO,YAAY,MAC5B,IAAI,IAAI,eAAe,4BAA4B;EACjD,OAAO,KACL;GACE,aAAa,YAAY;GACzB,SAAS,IAAI;GACb,aAAa,IAAI;GACR;GACT,YAAY,IAAI;EAClB,GACA,mDACF;EAGA,OAAO,IAAI;EACX,OAAO,IAAI;CACb,OAAO,IAAI,IAAI,eAAe,6BAA6B;EACzD,MAAM,cAAc,IAAI,SACpB,KAAK,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CACvC,OAAO,oBAAoB;EAC9B,OAAO,KACL;GACE,aAAa,YAAY;GACzB,SAAS,IAAI;GACb,aAAa,IAAI;GACR;GACT,YAAY,IAAI;GAChB;EACF,GACA,4FACF;CACF;AAIR;AAEA,SAAgB,OACd,QACA,UAC4B;CAC5B,OAAO,aAAa,QAAQ,QAAQ;AACtC"}
+{"version":3,"file":"extract-update.js","names":[],"sources":["../../../../lib/workers/repository/process/extract-update.ts"],"sourcesContent":["import { isNonEmptyArray } from '@sindresorhus/is';\nimport type { RenovateConfig } from '../../../config/types.ts';\nimport { instrument } from '../../../instrumentation/index.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { hashMap } from '../../../modules/manager/index.ts';\nimport type { PackageFile } from '../../../modules/manager/types.ts';\nimport { scm } from '../../../modules/platform/scm.ts';\nimport { isNotNullOrUndefined } from '../../../util/array.ts';\nimport * as memCache from '../../../util/cache/memory/index.ts';\nimport { getCache } from '../../../util/cache/repository/index.ts';\nimport type { BaseBranchCache } from '../../../util/cache/repository/types.ts';\nimport { checkGithubToken as ensureGithubToken } from '../../../util/check-token.ts';\nimport { clone } from '../../../util/clone.ts';\nimport { fingerprint } from '../../../util/fingerprint.ts';\nimport type { BranchConfig } from '../../types.ts';\nimport { generateFingerprintConfig } from '../extract/extract-fingerprint-config.ts';\nimport { extractAllDependencies } from '../extract/index.ts';\nimport { branchifyUpgrades } from '../updates/branchify.ts';\nimport { fetchUpdates } from './fetch.ts';\nimport { calculateLibYears } from './libyear.ts';\nimport { sortBranches } from './sort.ts';\nimport { Vulnerabilities } from './vulnerabilities.ts';\nimport type { WriteUpdateResult } from './write.ts';\nimport { writeUpdates } from './write.ts';\n\n// Increment this if needing to cache bust ALL extract caches\nexport const EXTRACT_CACHE_REVISION = 1;\n\nexport interface ExtractResult {\n  branches: BranchConfig[];\n  branchList: string[];\n  packageFiles: Record<string, PackageFile[]>;\n}\n\nexport interface StatsResult {\n  fileCount: number;\n  depCount: number;\n}\n\nexport interface Stats {\n  managers: Record<string, StatsResult>;\n  total: StatsResult;\n}\n\n// istanbul ignore next\nfunction extractStats(\n  packageFiles: Record<string, PackageFile[]>,\n): Stats | null {\n  if (!packageFiles) {\n    return null;\n  }\n  const stats: Stats = {\n    managers: {},\n    total: {\n      fileCount: 0,\n      depCount: 0,\n    },\n  };\n  for (const [manager, managerPackageFiles] of Object.entries(packageFiles)) {\n    const fileCount = managerPackageFiles.length;\n    let depCount = 0;\n    for (const file of managerPackageFiles) {\n      depCount += file.deps.length;\n    }\n    stats.managers[manager] = {\n      fileCount,\n      depCount,\n    };\n    stats.total.fileCount += fileCount;\n    stats.total.depCount += depCount;\n  }\n  return stats;\n}\n\nexport function isCacheExtractValid(\n  baseBranchSha: string,\n  configHash: string,\n  cachedExtract?: BaseBranchCache,\n): boolean {\n  if (!cachedExtract) {\n    return false;\n  }\n\n  if (!cachedExtract.revision) {\n    logger.debug('Cached extract is missing revision, so cannot be used');\n    return false;\n  }\n\n  if (cachedExtract.revision !== EXTRACT_CACHE_REVISION) {\n    logger.debug(\n      `Extract cache revision has changed (old=${cachedExtract.revision}, new=${EXTRACT_CACHE_REVISION})`,\n    );\n    return false;\n  }\n\n  if (!(cachedExtract.sha && cachedExtract.configHash)) {\n    return false;\n  }\n  if (cachedExtract.sha !== baseBranchSha) {\n    logger.debug(\n      `Cached extract result cannot be used due to base branch SHA change (old=${cachedExtract.sha}, new=${baseBranchSha})`,\n    );\n    return false;\n  }\n  if (cachedExtract.configHash !== configHash) {\n    logger.debug('Cached extract result cannot be used due to config change');\n    return false;\n  }\n  if (!cachedExtract.extractionFingerprints) {\n    logger.debug(\n      'Cached extract is missing extractionFingerprints, so cannot be used',\n    );\n    return false;\n  }\n  const changedManagers = new Set();\n  for (const [manager, fingerprint] of Object.entries(\n    cachedExtract.extractionFingerprints,\n  )) {\n    if (fingerprint !== hashMap.get(manager)) {\n      changedManagers.add(manager);\n    }\n  }\n  if (changedManagers.size > 0) {\n    logger.debug(\n      { changedManagers: [...changedManagers] },\n      'Manager fingerprint(s) have changed, extract cache cannot be reused',\n    );\n    return false;\n  }\n  logger.debug(\n    `Cached extract for sha=${baseBranchSha} is valid and can be used`,\n  );\n  return true;\n}\n\nexport async function extract(\n  config: RenovateConfig,\n  overwriteCache = true,\n): Promise<Record<string, PackageFile[]>> {\n  logger.debug('extract()');\n  const { baseBranch } = config;\n  const baseBranchSha = await scm.getBranchCommit(baseBranch!);\n  let packageFiles: Record<string, PackageFile[]>;\n  const cache = getCache();\n  cache.scan ??= {};\n  const cachedExtract = cache.scan[baseBranch!];\n  const configHash = instrument('fingerprint', () =>\n    fingerprint(generateFingerprintConfig(config)),\n  );\n  if (\n    overwriteCache &&\n    isCacheExtractValid(baseBranchSha!, configHash, cachedExtract)\n  ) {\n    packageFiles = clone(cachedExtract.packageFiles);\n  } else {\n    await instrument(\n      'checkoutBranch',\n      async () => await scm.checkoutBranch(baseBranch!),\n    );\n    const extractResult = await instrument(\n      'extractAllDependencies',\n      async () => (await extractAllDependencies(config)) || {},\n    );\n    packageFiles = extractResult.packageFiles;\n    const { extractionFingerprints } = extractResult;\n\n    if (overwriteCache) {\n      // TODO: fix types (#22198)\n      cache.scan[baseBranch!] = {\n        revision: EXTRACT_CACHE_REVISION,\n        sha: baseBranchSha!,\n        configHash,\n        extractionFingerprints,\n        packageFiles: clone(packageFiles),\n      };\n    }\n\n    // Clean up cached branch extracts\n    const baseBranches = isNonEmptyArray(config.baseBranches)\n      ? config.baseBranches\n      : [baseBranch];\n    Object.keys(cache.scan).forEach((branchName) => {\n      if (!baseBranches.includes(branchName)) {\n        delete cache.scan![branchName];\n      }\n    });\n  }\n  const stats = extractStats(packageFiles);\n  logger.info(\n    { baseBranch: config.baseBranch, stats },\n    `Dependency extraction complete`,\n  );\n  logger.trace({ config: packageFiles }, 'packageFiles');\n  ensureGithubToken(packageFiles);\n  return packageFiles;\n}\n\nasync function fetchVulnerabilities(\n  config: RenovateConfig,\n  packageFiles: Record<string, PackageFile[]>,\n): Promise<void> {\n  if (config.osvVulnerabilityAlerts) {\n    logger.debug('fetchVulnerabilities() - osvVulnerabilityAlerts=true');\n    try {\n      const vulnerabilities = await Vulnerabilities.create();\n      await vulnerabilities.appendVulnerabilityPackageRules(\n        config,\n        packageFiles,\n      );\n    } catch (err) {\n      logger.warn({ err }, 'Unable to read vulnerability information');\n    }\n  }\n}\n\nexport async function lookup(\n  config: RenovateConfig,\n  packageFiles: Record<string, PackageFile[]>,\n): Promise<ExtractResult> {\n  await fetchVulnerabilities(config, packageFiles);\n  await fetchUpdates(config, packageFiles);\n  // call this twice, as the second time, the updates will be availalbe for malicious package checks\n  // TODO: this will be refactored as part of #42423\n  await fetchVulnerabilities(config, packageFiles);\n  memCache.cleanDatasourceKeys();\n  calculateLibYears(config, packageFiles);\n  const { branches, branchList } = await branchifyUpgrades(\n    config,\n    packageFiles,\n  );\n  reportMaliciousSkippedDependencies(packageFiles);\n  logger.debug(\n    { baseBranch: config.baseBranch, config: packageFiles },\n    'packageFiles with updates',\n  );\n  sortBranches(branches);\n  return { branches, branchList, packageFiles };\n}\n\nexport function reportMaliciousSkippedDependencies(\n  allPackageFiles: Record<string, PackageFile[]>,\n): void {\n  if (allPackageFiles === undefined) {\n    return;\n  }\n\n  for (const [manager, packageFiles] of Object.entries(allPackageFiles)) {\n    for (const packageFile of packageFiles) {\n      for (const dep of packageFile.deps) {\n        if (dep.skipReason === 'malicious-version-in-use') {\n          logger.warn(\n            {\n              packageFile: packageFile.packageFile,\n              depName: dep.depName,\n              packageName: dep.packageName,\n              manager: manager,\n              datasource: dep.datasource,\n            },\n            'Dependency is currently using a malicious version',\n          );\n\n          // and make sure that it then gets updates proposed in the update phase\n          delete dep.skipReason;\n          delete dep.skipStage;\n        } else if (dep.skipReason === 'malicious-update-proposed') {\n          const newVersions = dep.updates\n            ?.map((u) => u.newVersion ?? u.newValue)\n            .filter(isNotNullOrUndefined);\n          logger.warn(\n            {\n              packageFile: packageFile.packageFile,\n              depName: dep.depName,\n              packageName: dep.packageName,\n              manager: manager,\n              datasource: dep.datasource,\n              newVersions,\n            },\n            'Dependency has update(s) proposed which would update you to a malicious version - skipping',\n          );\n        }\n      }\n    }\n  }\n}\n\nexport function update(\n  config: RenovateConfig,\n  branches: BranchConfig[],\n): Promise<WriteUpdateResult> {\n  return writeUpdates(config, branches);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA6CA,SAAS,aACP,cACc;CACd,IAAI,CAAC,cACH,OAAO;CAET,MAAM,QAAe;EACnB,UAAU,CAAC;EACX,OAAO;GACL,WAAW;GACX,UAAU;EACZ;CACF;CACA,KAAK,MAAM,CAAC,SAAS,wBAAwB,OAAO,QAAQ,YAAY,GAAG;EACzE,MAAM,YAAY,oBAAoB;EACtC,IAAI,WAAW;EACf,KAAK,MAAM,QAAQ,qBACjB,YAAY,KAAK,KAAK;EAExB,MAAM,SAAS,WAAW;GACxB;GACA;EACF;EACA,MAAM,MAAM,aAAa;EACzB,MAAM,MAAM,YAAY;CAC1B;CACA,OAAO;AACT;AAEA,SAAgB,oBACd,eACA,YACA,eACS;CACT,IAAI,CAAC,eACH,OAAO;CAGT,IAAI,CAAC,cAAc,UAAU;EAC3B,OAAO,MAAM,uDAAuD;EACpE,OAAO;CACT;CAEA,IAAI,cAAc,aAAA,GAAqC;EACrD,OAAO,MACL,2CAA2C,cAAc,SAAS,SACpE;EACA,OAAO;CACT;CAEA,IAAI,EAAE,cAAc,OAAO,cAAc,aACvC,OAAO;CAET,IAAI,cAAc,QAAQ,eAAe;EACvC,OAAO,MACL,2EAA2E,cAAc,IAAI,QAAQ,cAAc,EACrH;EACA,OAAO;CACT;CACA,IAAI,cAAc,eAAe,YAAY;EAC3C,OAAO,MAAM,2DAA2D;EACxE,OAAO;CACT;CACA,IAAI,CAAC,cAAc,wBAAwB;EACzC,OAAO,MACL,qEACF;EACA,OAAO;CACT;CACA,MAAM,kCAAkB,IAAI,IAAI;CAChC,KAAK,MAAM,CAAC,SAAS,gBAAgB,OAAO,QAC1C,cAAc,sBAChB,GACE,IAAI,gBAAgB,QAAQ,IAAI,OAAO,GACrC,gBAAgB,IAAI,OAAO;CAG/B,IAAI,gBAAgB,OAAO,GAAG;EAC5B,OAAO,MACL,EAAE,iBAAiB,CAAC,GAAG,eAAe,EAAE,GACxC,qEACF;EACA,OAAO;CACT;CACA,OAAO,MACL,0BAA0B,cAAc,0BAC1C;CACA,OAAO;AACT;AAEA,eAAsB,QACpB,QACA,iBAAiB,MACuB;CACxC,OAAO,MAAM,WAAW;CACxB,MAAM,EAAE,eAAe;CACvB,MAAM,gBAAgB,MAAM,IAAI,gBAAgB,UAAW;CAC3D,IAAI;CACJ,MAAM,QAAQ,SAAS;CACvB,MAAM,SAAS,CAAC;CAChB,MAAM,gBAAgB,MAAM,KAAK;CACjC,MAAM,aAAa,WAAW,qBAC5B,YAAY,0BAA0B,MAAM,CAAC,CAC/C;CACA,IACE,kBACA,oBAAoB,eAAgB,YAAY,aAAa,GAE7D,eAAe,MAAM,cAAc,YAAY;MAC1C;EACL,MAAM,WACJ,kBACA,YAAY,MAAM,IAAI,eAAe,UAAW,CAClD;EACA,MAAM,gBAAgB,MAAM,WAC1B,0BACA,YAAa,MAAM,uBAAuB,MAAM,KAAM,CAAC,CACzD;EACA,eAAe,cAAc;EAC7B,MAAM,EAAE,2BAA2B;EAEnC,IAAI,gBAEF,MAAM,KAAK,cAAe;GACxB,UAAA;GACA,KAAK;GACL;GACA;GACA,cAAc,MAAM,YAAY;EAClC;EAIF,MAAM,eAAe,gBAAgB,OAAO,YAAY,IACpD,OAAO,eACP,CAAC,UAAU;EACf,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,eAAe;GAC9C,IAAI,CAAC,aAAa,SAAS,UAAU,GACnC,OAAO,MAAM,KAAM;EAEvB,CAAC;CACH;CACA,MAAM,QAAQ,aAAa,YAAY;CACvC,OAAO,KACL;EAAE,YAAY,OAAO;EAAY;CAAM,GACvC,gCACF;CACA,OAAO,MAAM,EAAE,QAAQ,aAAa,GAAG,cAAc;CACrD,iBAAkB,YAAY;CAC9B,OAAO;AACT;AAEA,eAAe,qBACb,QACA,cACe;CACf,IAAI,OAAO,wBAAwB;EACjC,OAAO,MAAM,sDAAsD;EACnE,IAAI;GAEF,OAAM,MADwB,gBAAgB,OAAO,EAAA,CAC/B,gCACpB,QACA,YACF;EACF,SAAS,KAAK;GACZ,OAAO,KAAK,EAAE,IAAI,GAAG,0CAA0C;EACjE;CACF;AACF;AAEA,eAAsB,OACpB,QACA,cACwB;CACxB,MAAM,qBAAqB,QAAQ,YAAY;CAC/C,MAAM,aAAa,QAAQ,YAAY;CAGvC,MAAM,qBAAqB,QAAQ,YAAY;CAC/C,oBAA6B;CAC7B,kBAAkB,QAAQ,YAAY;CACtC,MAAM,EAAE,UAAU,eAAe,MAAM,kBACrC,QACA,YACF;CACA,mCAAmC,YAAY;CAC/C,OAAO,MACL;EAAE,YAAY,OAAO;EAAY,QAAQ;CAAa,GACtD,2BACF;CACA,aAAa,QAAQ;CACrB,OAAO;EAAE;EAAU;EAAY;CAAa;AAC9C;AAEA,SAAgB,mCACd,iBACM;CACN,IAAI,oBAAoB,KAAA,GACtB;CAGF,KAAK,MAAM,CAAC,SAAS,iBAAiB,OAAO,QAAQ,eAAe,GAClE,KAAK,MAAM,eAAe,cACxB,KAAK,MAAM,OAAO,YAAY,MAC5B,IAAI,IAAI,eAAe,4BAA4B;EACjD,OAAO,KACL;GACE,aAAa,YAAY;GACzB,SAAS,IAAI;GACb,aAAa,IAAI;GACR;GACT,YAAY,IAAI;EAClB,GACA,mDACF;EAGA,OAAO,IAAI;EACX,OAAO,IAAI;CACb,OAAO,IAAI,IAAI,eAAe,6BAA6B;EACzD,MAAM,cAAc,IAAI,SACpB,KAAK,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CACvC,OAAO,oBAAoB;EAC9B,OAAO,KACL;GACE,aAAa,YAAY;GACzB,SAAS,IAAI;GACb,aAAa,IAAI;GACR;GACT,YAAY,IAAI;GAChB;EACF,GACA,4FACF;CACF;AAIR;AAEA,SAAgB,OACd,QACA,UAC4B;CAC5B,OAAO,aAAa,QAAQ,QAAQ;AACtC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "renovate",
   "description": "Automated dependency updates. Flexible so you don't need to be.",
-  "version": "44.155.1",
+  "version": "44.155.2",
   "type": "module",
   "bin": {
     "renovate": "dist/renovate.js",
@@ -289,7 +289,7 @@
     "type-fest": "5.10.0",
     "typescript": "7.0.2",
     "unified": "11.0.5",
-    "vite": "8.3.2",
+    "vite": "8.3.3",
     "vitest": "4.1.11",
     "vitest-mock-extended": "5.1.1",
     "yazl": "3.3.1"

package/renovate-schema.json

@@ -1,8 +1,8 @@
 {
   "$id": "https://docs.renovatebot.com/renovate-schema.json",
-  "title": "JSON schema for Renovate 44.155.1 config files (https://renovatebot.com/)",
+  "title": "JSON schema for Renovate 44.155.2 config files (https://renovatebot.com/)",
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "x-renovate-version": "44.155.1",
+  "x-renovate-version": "44.155.2",
   "allowComments": true,
   "type": "object",
   "definitions": {