renovate 44.177.0 → 44.178.0

package/dist/config/presets/internal/config.preset.js

@@ -32,6 +32,7 @@ const presets = {
 			"mergeConfidence:age-confidence-badges",
 			"replacements:all",
 			"workarounds:all",
+			"security:php2shell",
 			"helpers:forgejoDigestChangelogs",
 			"helpers:giteaDigestChangelogs",
 			"helpers:githubDigestChangelogs",

package/dist/config/presets/internal/config.preset.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.preset.js","names":[],"sources":["../../../../lib/config/presets/internal/config.preset.ts"],"sourcesContent":["import type { Preset } from '../types.ts';\n\nexport const presets: Record<string, Preset> = {\n  'best-practices': {\n    description:\n      'Preset with best practices from the Renovate maintainers. Recommended for advanced users, who want to follow our best practices.',\n    extends: [\n      'config:recommended',\n      'docker:pinDigests',\n      'helpers:pinGitHubActionDigests',\n      ':configMigration',\n      ':pinDevDependencies',\n      'abandonments:recommended',\n      'security:minimumReleaseAgeNpm',\n      ':maintainLockFilesWeekly',\n    ],\n  },\n  'js-app': {\n    description: 'Default configuration for webapps.',\n    extends: ['config:recommended', ':pinAllExceptPeerDependencies'],\n  },\n  'js-lib': {\n    description: 'Default configuration for libraries.',\n    extends: ['config:recommended', ':pinOnlyDevDependencies'],\n  },\n  recommended: {\n    description:\n      'Recommended configuration for most users. It does not matter what programming language you use.',\n    extends: [\n      ':dependencyDashboard',\n      ':semanticPrefixFixDepsChoreOthers',\n      ':ignoreModulesAndTests',\n      'group:monorepos',\n      'group:recommended',\n      'mergeConfidence:age-confidence-badges',\n      'replacements:all',\n      'workarounds:all',\n      'helpers:forgejoDigestChangelogs',\n      'helpers:giteaDigestChangelogs',\n      'helpers:githubDigestChangelogs',\n      'helpers:gitlabDigestChangelogs',\n      'helpers:goXPackagesChangelogLink',\n      'helpers:goXPackagesNameLink',\n      'helpers:renovateChangelog',\n    ],\n  },\n  semverAllMonthly: {\n    description:\n      'Preserve SemVer ranges and update everything together once a month. (excluding replacements and lockfile maintenance)',\n    extends: [\n      ':preserveSemverRanges',\n      'group:all',\n      'schedule:monthly',\n      ':maintainLockFilesMonthly',\n    ],\n    lockFileMaintenance: {\n      commitMessageAction: 'Update',\n    },\n    separateMajorMinor: false,\n  },\n  semverAllWeekly: {\n    description:\n      'Preserve SemVer ranges and update everything together once a week (excluding replacements and lockfile maintenance).',\n    extends: [\n      ':preserveSemverRanges',\n      'group:all',\n      'schedule:weekly',\n      ':maintainLockFilesWeekly',\n    ],\n    lockFileMaintenance: {\n      commitMessageAction: 'Update',\n    },\n    separateMajorMinor: false,\n  },\n};\n"],"mappings":";AAEA,MAAa,UAAkC;CAC7C,kBAAkB;EAChB,aACE;EACF,SAAS;GACP;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF;CACF;CACA,UAAU;EACR,aAAa;EACb,SAAS,CAAC,sBAAsB,+BAA+B;CACjE;CACA,UAAU;EACR,aAAa;EACb,SAAS,CAAC,sBAAsB,yBAAyB;CAC3D;CACA,aAAa;EACX,aACE;EACF,SAAS;GACP;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF;CACF;CACA,kBAAkB;EAChB,aACE;EACF,SAAS;GACP;GACA;GACA;GACA;EACF;EACA,qBAAqB,EACnB,qBAAqB,SACvB;EACA,oBAAoB;CACtB;CACA,iBAAiB;EACf,aACE;EACF,SAAS;GACP;GACA;GACA;GACA;EACF;EACA,qBAAqB,EACnB,qBAAqB,SACvB;EACA,oBAAoB;CACtB;AACF"}
+{"version":3,"file":"config.preset.js","names":[],"sources":["../../../../lib/config/presets/internal/config.preset.ts"],"sourcesContent":["import type { Preset } from '../types.ts';\n\nexport const presets: Record<string, Preset> = {\n  'best-practices': {\n    description:\n      'Preset with best practices from the Renovate maintainers. Recommended for advanced users, who want to follow our best practices.',\n    extends: [\n      'config:recommended',\n      'docker:pinDigests',\n      'helpers:pinGitHubActionDigests',\n      ':configMigration',\n      ':pinDevDependencies',\n      'abandonments:recommended',\n      'security:minimumReleaseAgeNpm',\n      ':maintainLockFilesWeekly',\n    ],\n  },\n  'js-app': {\n    description: 'Default configuration for webapps.',\n    extends: ['config:recommended', ':pinAllExceptPeerDependencies'],\n  },\n  'js-lib': {\n    description: 'Default configuration for libraries.',\n    extends: ['config:recommended', ':pinOnlyDevDependencies'],\n  },\n  recommended: {\n    description:\n      'Recommended configuration for most users. It does not matter what programming language you use.',\n    extends: [\n      ':dependencyDashboard',\n      ':semanticPrefixFixDepsChoreOthers',\n      ':ignoreModulesAndTests',\n      'group:monorepos',\n      'group:recommended',\n      'mergeConfidence:age-confidence-badges',\n      'replacements:all',\n      'workarounds:all',\n      'security:php2shell',\n      'helpers:forgejoDigestChangelogs',\n      'helpers:giteaDigestChangelogs',\n      'helpers:githubDigestChangelogs',\n      'helpers:gitlabDigestChangelogs',\n      'helpers:goXPackagesChangelogLink',\n      'helpers:goXPackagesNameLink',\n      'helpers:renovateChangelog',\n    ],\n  },\n  semverAllMonthly: {\n    description:\n      'Preserve SemVer ranges and update everything together once a month. (excluding replacements and lockfile maintenance)',\n    extends: [\n      ':preserveSemverRanges',\n      'group:all',\n      'schedule:monthly',\n      ':maintainLockFilesMonthly',\n    ],\n    lockFileMaintenance: {\n      commitMessageAction: 'Update',\n    },\n    separateMajorMinor: false,\n  },\n  semverAllWeekly: {\n    description:\n      'Preserve SemVer ranges and update everything together once a week (excluding replacements and lockfile maintenance).',\n    extends: [\n      ':preserveSemverRanges',\n      'group:all',\n      'schedule:weekly',\n      ':maintainLockFilesWeekly',\n    ],\n    lockFileMaintenance: {\n      commitMessageAction: 'Update',\n    },\n    separateMajorMinor: false,\n  },\n};\n"],"mappings":";AAEA,MAAa,UAAkC;CAC7C,kBAAkB;EAChB,aACE;EACF,SAAS;GACP;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF;CACF;CACA,UAAU;EACR,aAAa;EACb,SAAS,CAAC,sBAAsB,+BAA+B;CACjE;CACA,UAAU;EACR,aAAa;EACb,SAAS,CAAC,sBAAsB,yBAAyB;CAC3D;CACA,aAAa;EACX,aACE;EACF,SAAS;GACP;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF;CACF;CACA,kBAAkB;EAChB,aACE;EACF,SAAS;GACP;GACA;GACA;GACA;EACF;EACA,qBAAqB,EACnB,qBAAqB,SACvB;EACA,oBAAoB;CACtB;CACA,iBAAiB;EACf,aACE;EACF,SAAS;GACP;GACA;GACA;GACA;EACF;EACA,qBAAqB,EACnB,qBAAqB,SACvB;EACA,oBAAoB;CACtB;AACF"}

package/dist/config/presets/internal/security.preset.js

@@ -1,5 +1,39 @@
 import { UpdateTypesOptions } from "../../types.js";
 //#region lib/config/presets/internal/security.preset.ts
+const php2shellPatchedVersions = JSON.stringify({
+	"8.2": 35,
+	"8.3": 36,
+	"8.4": 27,
+	"8.5": 12
+});
+const php2shellVulnerableVersion = `(
+  $value := (manager = "mise" and isLockfileOnly) ? lockedVersion : currentValue;
+  $version := datasource = "docker" ? $split($value, "-")[0] : $value;
+  $parts := $match($version, /^(8\\.[2-5])\\.(\\d+)$/).groups;
+
+  $not(vulnerabilityAlerts.enabled = false) and $exists($parts)
+    and $number($parts[1]) < $lookup(${php2shellPatchedVersions}, $parts[0])
+)`;
+const php2shellRule = {
+	isVulnerabilityAlert: true,
+	matchJsonata: [`${php2shellVulnerableVersion} and (
+      $version := datasource = "docker" ? $split(newVersion, "-")[0] : newVersion;
+      $parts := $match($version, /^(8\\.[2-5])\\.(\\d+)$/).groups;
+
+      $exists($parts) and $number($parts[1]) >= $lookup(${php2shellPatchedVersions}, $parts[0])
+    )`],
+	matchUpdateTypes: [
+		"patch",
+		"minor",
+		"major"
+	],
+	prBodyNotes: [[
+		"> ⚠️ PHP2Shell vulnerabilities can allow remote code execution. This PR updates affected PHP versions to patched releases. Rebuild affected images, deploy the updates, and restart PHP workers.",
+		">",
+		"> Details: [CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and [CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)."
+	].join("\n")],
+	schedule: []
+};
 /**
 * Datasources for which we expose a `security:minimumReleaseAge*` preset.
 *
@@ -121,6 +155,52 @@ const presets = {
 			],
 			prBodyDefinitions: { OpenSSF: "[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/{{sourceRepo}}/badge)](https://securityscorecards.dev/viewer/?uri=github.com/{{sourceRepo}})" }
 		}]
+	},
+	php2shell: {
+		customManagers: [{
+			customType: "regex",
+			datasourceTemplate: "github-tags",
+			depNameTemplate: "php",
+			depTypeTemplate: "php2shell-runtime",
+			extractVersionTemplate: "^php-(?<version>\\S+)",
+			managerFilePatterns: ["/(^|/)\\.php-version$/"],
+			matchStrings: ["^\\s*(?<currentValue>8\\.[2-5]\\.\\d+)\\s*$"],
+			packageNameTemplate: "php/php-src"
+		}, {
+			customType: "jsonata",
+			datasourceTemplate: "github-tags",
+			depNameTemplate: "php",
+			depTypeTemplate: "php2shell-runtime",
+			extractVersionTemplate: "^php-(?<version>\\S+)",
+			fileFormat: "yaml",
+			managerFilePatterns: ["/(^|/)(workflow-templates|\\.(?:github|gitea|forgejo)/(?:workflows|actions))/.+\\.ya?ml$/", "/(^|/)action\\.ya?ml$/"],
+			matchStrings: ["**[uses and $exists($match(uses, /^shivammathur\\/setup-php@/))].with.\"php-version\"[$type($) = \"string\" and $exists($match($, /^8\\.[2-5]\\.\\d+$/))].{\"currentValue\": $}"],
+			packageNameTemplate: "php/php-src"
+		}],
+		description: "Update vulnerable PHP runtime pins for CVE-2026-109618 and CVE-2026-109619.",
+		packageRules: [
+			{
+				enabled: false,
+				matchDepTypes: ["php2shell-runtime"],
+				matchManagers: ["custom.regex", "custom.jsonata"]
+			},
+			{
+				enabled: true,
+				matchDepTypes: ["php2shell-runtime"],
+				matchJsonata: [php2shellVulnerableVersion],
+				matchManagers: ["custom.regex", "custom.jsonata"]
+			},
+			{
+				...php2shellRule,
+				matchDatasources: ["github-tags"],
+				matchPackageNames: ["containerbase/php-prebuild", "php/php-src"]
+			},
+			{
+				...php2shellRule,
+				matchDatasources: ["docker"],
+				matchPackageNames: ["/^(?:(?:docker\\.io|index\\.docker\\.io)\\/)?(?:library\\/)?php$/"]
+			}
+		]
 	}
 };
 Object.keys(minimumReleaseAgeDatasources);

package/dist/config/presets/internal/security.preset.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.preset.js","names":[],"sources":["../../../../lib/config/presets/internal/security.preset.ts"],"sourcesContent":["import type { DatasourceName } from '../../../datasource-list.generated.ts';\nimport type { PackageRule } from '../../types.ts';\nimport { UpdateTypesOptions } from '../../types.ts';\nimport type { Preset } from '../types.ts';\n\ninterface MinimumReleaseAgeDatasource {\n  description: string;\n  minimumReleaseAge: string;\n}\n\n/**\n * Datasources for which we expose a `security:minimumReleaseAge*` preset.\n *\n * Only supported for Datasources that have `releaseTimestampSupport`.\n */\nconst minimumReleaseAgeDatasources: Partial<\n  Record<DatasourceName, MinimumReleaseAgeDatasource>\n> = {\n  crate: {\n    description:\n      \"Wait until the Crate version is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behaviour in crates, and b) reduces the risk of upgrading to a newly published crate that its owner deletes during crates.io's initial 72-hour deletion window.\",\n    minimumReleaseAge: '3 days',\n  },\n  npm: {\n    description:\n      'Wait until the npm package is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behaviour in packages, and b) prevents the maintainer and/or NPM from unpublishing a package you already upgraded to, breaking builds.',\n    minimumReleaseAge: '3 days',\n  },\n  pypi: {\n    description:\n      'Wait until the Python package is three days old before raising the update. This introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behaviour in packages.',\n    minimumReleaseAge: '3 days',\n  },\n};\n\n/**\n * Certain update types don't currently support `releaseTimestamp`s, so applying `minimumReleaseAge` to them results in updates that will never come.\n *\n * Instead, we opt them out of `minimumReleaseAge`, and add a warning for the user.\n *\n * This must stay in sync with the update types documented as _not_ supported (❌) in `docs/usage/key-concepts/minimum-release-age.md`, so we opt-out any unsupported `updateType`s.\n *\n * These rules are datasource-agnostic (`matchDatasources` is added per preset), so they are shared across every generated `security:minimumReleaseAge*` preset to keep the warnings consistent.\n */\nconst unsupportedUpdateTypeRules: PackageRule[] = [\n  {\n    description:\n      'Do not require Minimum Release Age for update types that are controlled by the package manager',\n    matchUpdateTypes: ['lockFileMaintenance'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's lock file maintenance functionality does not support validating Minimum Release Age, as the package manager performs the required changes to update package(s). Confirm whether your package manager perform its own validation for the Minimum Release Age of packages.\",\n    ],\n  },\n  // TODO #39400\n  {\n    description: 'Do not require Minimum Release Age for package replacements',\n    matchUpdateTypes: ['replacement'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's replacement functionality [does not currently](https://github.com/renovatebot/renovate/issues/39400) wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).\",\n    ],\n  },\n  // TODO #40288\n  {\n    description: 'Do not require Minimum Release Age for package pinning',\n    matchUpdateTypes: ['pin'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's pin functionality [does not currently](https://github.com/renovatebot/renovate/issues/40288) wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).\",\n    ],\n  },\n  {\n    description:\n      'Do not require Minimum Release Age for update types that do not provide a release timestamp',\n    matchUpdateTypes: ['bump', 'lockfileUpdate', 'rollback'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      '⚠️ Renovate does not enforce Minimum Release Age for `bump`, `lockfileUpdate`, or `rollback` updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).',\n    ],\n  },\n];\n\nfunction buildMinimumReleaseAgePreset(\n  datasource: string,\n  { description, minimumReleaseAge }: MinimumReleaseAgeDatasource,\n): Preset {\n  const packageRules: PackageRule[] = [\n    {\n      internalChecksFilter: 'strict',\n      matchDatasources: [datasource],\n      minimumReleaseAge,\n    },\n    ...unsupportedUpdateTypeRules.map((rule): PackageRule => ({\n      ...rule,\n      matchDatasources: [datasource],\n    })),\n  ];\n\n  return { description, packageRules };\n}\n\nfunction loadMinimumReleaseAgePresets(): Record<string, Preset> {\n  const presets: Record<string, Preset> = {};\n\n  for (const [datasource, config] of Object.entries(\n    minimumReleaseAgeDatasources,\n  )) {\n    const suffix = datasource[0].toUpperCase() + datasource.slice(1);\n    presets[`minimumReleaseAge${suffix}`] = buildMinimumReleaseAgePreset(\n      datasource,\n      config,\n    );\n  }\n\n  return presets;\n}\n\nexport const presets: Record<string, Preset> = {\n  gomodIndirectSecurityUpdates: {\n    description:\n      'Enable go.mod indirect dependency updates only when vulnerabilities have been detected.',\n    extends: [':enableVulnerabilityAlerts'],\n    packageRules: [\n      {\n        description: 'Enable lookups for indirect go.mod dependencies',\n        enabled: true,\n        matchDepTypes: ['indirect'],\n        matchManagers: ['gomod'],\n      },\n      {\n        description:\n          'Disable non-security updates for indirect go.mod dependencies (vulnerability alerts use force to override this)',\n        enabled: false,\n        matchDepTypes: ['indirect'],\n        matchManagers: ['gomod'],\n        matchUpdateTypes: [...UpdateTypesOptions],\n      },\n    ],\n  },\n  ...loadMinimumReleaseAgePresets(),\n  'only-security-updates': {\n    description:\n      'Only update dependencies if vulnerabilities have been detected.',\n    extends: ['config:recommended'],\n    osvVulnerabilityAlerts: true,\n    packageRules: [\n      {\n        enabled: false,\n        matchPackageNames: ['*'],\n      },\n    ],\n    vulnerabilityAlerts: {\n      enabled: true,\n    },\n  },\n  'openssf-scorecard': {\n    description: 'Show OpenSSF badge on pull requests.',\n    packageRules: [\n      {\n        matchSourceUrls: ['https://github.com/**'],\n        prBodyColumns: [\n          'Package',\n          'Type',\n          'Update',\n          'Change',\n          'Pending',\n          'OpenSSF',\n        ],\n        prBodyDefinitions: {\n          OpenSSF:\n            '[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/{{sourceRepo}}/badge)](https://securityscorecards.dev/viewer/?uri=github.com/{{sourceRepo}})',\n        },\n      },\n    ],\n  },\n};\n\nexport const minimumReleaseAgeDatasourceNames = Object.keys(\n  minimumReleaseAgeDatasources,\n);\n"],"mappings":";;;;;;;AAeA,MAAM,+BAEF;CACF,OAAO;EACL,aACE;EACF,mBAAmB;CACrB;CACA,KAAK;EACH,aACE;EACF,mBAAmB;CACrB;CACA,MAAM;EACJ,aACE;EACF,mBAAmB;CACrB;AACF;;;;;;;;;;AAWA,MAAM,6BAA4C;CAChD;EACE,aACE;EACF,kBAAkB,CAAC,qBAAqB;EACxC,mBAAmB;EACnB,aAAa,CACX,wRACF;CACF;CAEA;EACE,aAAa;EACb,kBAAkB,CAAC,aAAa;EAChC,mBAAmB;EACnB,aAAa,CACX,yRACF;CACF;CAEA;EACE,aAAa;EACb,kBAAkB,CAAC,KAAK;EACxB,mBAAmB;EACnB,aAAa,CACX,iRACF;CACF;CACA;EACE,aACE;EACF,kBAAkB;GAAC;GAAQ;GAAkB;EAAU;EACvD,mBAAmB;EACnB,aAAa,CACX,iPACF;CACF;AACF;AAEA,SAAS,6BACP,YACA,EAAE,aAAa,qBACP;CAaR,OAAO;EAAE;EAAa,cAAA,CAXpB;GACE,sBAAsB;GACtB,kBAAkB,CAAC,UAAU;GAC7B;EACF,GACA,GAAG,2BAA2B,KAAK,UAAuB;GACxD,GAAG;GACH,kBAAkB,CAAC,UAAU;EAC/B,EAAE,CAG6B;CAAE;AACrC;AAEA,SAAS,+BAAuD;CAC9D,MAAM,UAAkC,CAAC;CAEzC,KAAK,MAAM,CAAC,YAAY,WAAW,OAAO,QACxC,4BACF,GAAG;EACD,MAAM,SAAS,WAAW,EAAE,CAAC,YAAY,IAAI,WAAW,MAAM,CAAC;EAC/D,QAAQ,oBAAoB,YAAY,6BACtC,YACA,MACF;CACF;CAEA,OAAO;AACT;AAEA,MAAa,UAAkC;CAC7C,8BAA8B;EAC5B,aACE;EACF,SAAS,CAAC,4BAA4B;EACtC,cAAc,CACZ;GACE,aAAa;GACb,SAAS;GACT,eAAe,CAAC,UAAU;GAC1B,eAAe,CAAC,OAAO;EACzB,GACA;GACE,aACE;GACF,SAAS;GACT,eAAe,CAAC,UAAU;GAC1B,eAAe,CAAC,OAAO;GACvB,kBAAkB,CAAC,GAAG,kBAAkB;EAC1C,CACF;CACF;CACA,GAAG,6BAA6B;CAChC,yBAAyB;EACvB,aACE;EACF,SAAS,CAAC,oBAAoB;EAC9B,wBAAwB;EACxB,cAAc,CACZ;GACE,SAAS;GACT,mBAAmB,CAAC,GAAG;EACzB,CACF;EACA,qBAAqB,EACnB,SAAS,KACX;CACF;CACA,qBAAqB;EACnB,aAAa;EACb,cAAc,CACZ;GACE,iBAAiB,CAAC,uBAAuB;GACzC,eAAe;IACb;IACA;IACA;IACA;IACA;IACA;GACF;GACA,mBAAmB,EACjB,SACE,4KACJ;EACF,CACF;CACF;AACF;AAEgD,OAAO,KACrD,4BACF"}
+{"version":3,"file":"security.preset.js","names":[],"sources":["../../../../lib/config/presets/internal/security.preset.ts"],"sourcesContent":["import type { DatasourceName } from '../../../datasource-list.generated.ts';\nimport type { PackageRule } from '../../types.ts';\nimport { UpdateTypesOptions } from '../../types.ts';\nimport type { Preset } from '../types.ts';\n\nconst php2shellPatchedVersions = JSON.stringify({\n  '8.2': 35,\n  '8.3': 36,\n  '8.4': 27,\n  '8.5': 12,\n});\n\nconst php2shellVulnerableVersion = `(\n  $value := (manager = \"mise\" and isLockfileOnly) ? lockedVersion : currentValue;\n  $version := datasource = \"docker\" ? $split($value, \"-\")[0] : $value;\n  $parts := $match($version, /^(8\\\\.[2-5])\\\\.(\\\\d+)$/).groups;\n\n  $not(vulnerabilityAlerts.enabled = false) and $exists($parts)\n    and $number($parts[1]) < $lookup(${php2shellPatchedVersions}, $parts[0])\n)`;\n\nconst php2shellRule = {\n  isVulnerabilityAlert: true,\n  matchJsonata: [\n    `${php2shellVulnerableVersion} and (\n      $version := datasource = \"docker\" ? $split(newVersion, \"-\")[0] : newVersion;\n      $parts := $match($version, /^(8\\\\.[2-5])\\\\.(\\\\d+)$/).groups;\n\n      $exists($parts) and $number($parts[1]) >= $lookup(${php2shellPatchedVersions}, $parts[0])\n    )`,\n  ],\n  matchUpdateTypes: ['patch', 'minor', 'major'],\n  prBodyNotes: [\n    [\n      '> ⚠️ PHP2Shell vulnerabilities can allow remote code execution. This PR updates affected PHP versions to patched releases. Rebuild affected images, deploy the updates, and restart PHP workers.',\n      '>',\n      '> Details: [CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and [CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp).',\n    ].join('\\n'),\n  ],\n  schedule: [],\n} satisfies PackageRule;\n\ninterface MinimumReleaseAgeDatasource {\n  description: string;\n  minimumReleaseAge: string;\n}\n\n/**\n * Datasources for which we expose a `security:minimumReleaseAge*` preset.\n *\n * Only supported for Datasources that have `releaseTimestampSupport`.\n */\nconst minimumReleaseAgeDatasources: Partial<\n  Record<DatasourceName, MinimumReleaseAgeDatasource>\n> = {\n  crate: {\n    description:\n      \"Wait until the Crate version is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behaviour in crates, and b) reduces the risk of upgrading to a newly published crate that its owner deletes during crates.io's initial 72-hour deletion window.\",\n    minimumReleaseAge: '3 days',\n  },\n  npm: {\n    description:\n      'Wait until the npm package is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behaviour in packages, and b) prevents the maintainer and/or NPM from unpublishing a package you already upgraded to, breaking builds.',\n    minimumReleaseAge: '3 days',\n  },\n  pypi: {\n    description:\n      'Wait until the Python package is three days old before raising the update. This introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behaviour in packages.',\n    minimumReleaseAge: '3 days',\n  },\n};\n\n/**\n * Certain update types don't currently support `releaseTimestamp`s, so applying `minimumReleaseAge` to them results in updates that will never come.\n *\n * Instead, we opt them out of `minimumReleaseAge`, and add a warning for the user.\n *\n * This must stay in sync with the update types documented as _not_ supported (❌) in `docs/usage/key-concepts/minimum-release-age.md`, so we opt-out any unsupported `updateType`s.\n *\n * These rules are datasource-agnostic (`matchDatasources` is added per preset), so they are shared across every generated `security:minimumReleaseAge*` preset to keep the warnings consistent.\n */\nconst unsupportedUpdateTypeRules: PackageRule[] = [\n  {\n    description:\n      'Do not require Minimum Release Age for update types that are controlled by the package manager',\n    matchUpdateTypes: ['lockFileMaintenance'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's lock file maintenance functionality does not support validating Minimum Release Age, as the package manager performs the required changes to update package(s). Confirm whether your package manager perform its own validation for the Minimum Release Age of packages.\",\n    ],\n  },\n  // TODO #39400\n  {\n    description: 'Do not require Minimum Release Age for package replacements',\n    matchUpdateTypes: ['replacement'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's replacement functionality [does not currently](https://github.com/renovatebot/renovate/issues/39400) wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).\",\n    ],\n  },\n  // TODO #40288\n  {\n    description: 'Do not require Minimum Release Age for package pinning',\n    matchUpdateTypes: ['pin'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's pin functionality [does not currently](https://github.com/renovatebot/renovate/issues/40288) wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).\",\n    ],\n  },\n  {\n    description:\n      'Do not require Minimum Release Age for update types that do not provide a release timestamp',\n    matchUpdateTypes: ['bump', 'lockfileUpdate', 'rollback'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      '⚠️ Renovate does not enforce Minimum Release Age for `bump`, `lockfileUpdate`, or `rollback` updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).',\n    ],\n  },\n];\n\nfunction buildMinimumReleaseAgePreset(\n  datasource: string,\n  { description, minimumReleaseAge }: MinimumReleaseAgeDatasource,\n): Preset {\n  const packageRules: PackageRule[] = [\n    {\n      internalChecksFilter: 'strict',\n      matchDatasources: [datasource],\n      minimumReleaseAge,\n    },\n    ...unsupportedUpdateTypeRules.map((rule): PackageRule => ({\n      ...rule,\n      matchDatasources: [datasource],\n    })),\n  ];\n\n  return { description, packageRules };\n}\n\nfunction loadMinimumReleaseAgePresets(): Record<string, Preset> {\n  const presets: Record<string, Preset> = {};\n\n  for (const [datasource, config] of Object.entries(\n    minimumReleaseAgeDatasources,\n  )) {\n    const suffix = datasource[0].toUpperCase() + datasource.slice(1);\n    presets[`minimumReleaseAge${suffix}`] = buildMinimumReleaseAgePreset(\n      datasource,\n      config,\n    );\n  }\n\n  return presets;\n}\n\nexport const presets: Record<string, Preset> = {\n  gomodIndirectSecurityUpdates: {\n    description:\n      'Enable go.mod indirect dependency updates only when vulnerabilities have been detected.',\n    extends: [':enableVulnerabilityAlerts'],\n    packageRules: [\n      {\n        description: 'Enable lookups for indirect go.mod dependencies',\n        enabled: true,\n        matchDepTypes: ['indirect'],\n        matchManagers: ['gomod'],\n      },\n      {\n        description:\n          'Disable non-security updates for indirect go.mod dependencies (vulnerability alerts use force to override this)',\n        enabled: false,\n        matchDepTypes: ['indirect'],\n        matchManagers: ['gomod'],\n        matchUpdateTypes: [...UpdateTypesOptions],\n      },\n    ],\n  },\n  ...loadMinimumReleaseAgePresets(),\n  'only-security-updates': {\n    description:\n      'Only update dependencies if vulnerabilities have been detected.',\n    extends: ['config:recommended'],\n    osvVulnerabilityAlerts: true,\n    packageRules: [\n      {\n        enabled: false,\n        matchPackageNames: ['*'],\n      },\n    ],\n    vulnerabilityAlerts: {\n      enabled: true,\n    },\n  },\n  'openssf-scorecard': {\n    description: 'Show OpenSSF badge on pull requests.',\n    packageRules: [\n      {\n        matchSourceUrls: ['https://github.com/**'],\n        prBodyColumns: [\n          'Package',\n          'Type',\n          'Update',\n          'Change',\n          'Pending',\n          'OpenSSF',\n        ],\n        prBodyDefinitions: {\n          OpenSSF:\n            '[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/{{sourceRepo}}/badge)](https://securityscorecards.dev/viewer/?uri=github.com/{{sourceRepo}})',\n        },\n      },\n    ],\n  },\n  php2shell: {\n    customManagers: [\n      {\n        customType: 'regex',\n        datasourceTemplate: 'github-tags',\n        depNameTemplate: 'php',\n        depTypeTemplate: 'php2shell-runtime',\n        extractVersionTemplate: '^php-(?<version>\\\\S+)',\n        managerFilePatterns: ['/(^|/)\\\\.php-version$/'],\n        matchStrings: ['^\\\\s*(?<currentValue>8\\\\.[2-5]\\\\.\\\\d+)\\\\s*$'],\n        packageNameTemplate: 'php/php-src',\n      },\n      {\n        customType: 'jsonata',\n        datasourceTemplate: 'github-tags',\n        depNameTemplate: 'php',\n        depTypeTemplate: 'php2shell-runtime',\n        extractVersionTemplate: '^php-(?<version>\\\\S+)',\n        fileFormat: 'yaml',\n        managerFilePatterns: [\n          '/(^|/)(workflow-templates|\\\\.(?:github|gitea|forgejo)/(?:workflows|actions))/.+\\\\.ya?ml$/',\n          '/(^|/)action\\\\.ya?ml$/',\n        ],\n        matchStrings: [\n          '**[uses and $exists($match(uses, /^shivammathur\\\\/setup-php@/))].with.\"php-version\"[$type($) = \"string\" and $exists($match($, /^8\\\\.[2-5]\\\\.\\\\d+$/))].{\"currentValue\": $}',\n        ],\n        packageNameTemplate: 'php/php-src',\n      },\n    ],\n    description:\n      'Update vulnerable PHP runtime pins for CVE-2026-109618 and CVE-2026-109619.',\n    packageRules: [\n      {\n        enabled: false,\n        matchDepTypes: ['php2shell-runtime'],\n        matchManagers: ['custom.regex', 'custom.jsonata'],\n      },\n      {\n        enabled: true,\n        matchDepTypes: ['php2shell-runtime'],\n        matchJsonata: [php2shellVulnerableVersion],\n        matchManagers: ['custom.regex', 'custom.jsonata'],\n      },\n      {\n        ...php2shellRule,\n        matchDatasources: ['github-tags'],\n        matchPackageNames: ['containerbase/php-prebuild', 'php/php-src'],\n      },\n      {\n        ...php2shellRule,\n        matchDatasources: ['docker'],\n        matchPackageNames: [\n          '/^(?:(?:docker\\\\.io|index\\\\.docker\\\\.io)\\\\/)?(?:library\\\\/)?php$/',\n        ],\n      },\n    ],\n  },\n};\n\nexport const minimumReleaseAgeDatasourceNames = Object.keys(\n  minimumReleaseAgeDatasources,\n);\n"],"mappings":";;AAKA,MAAM,2BAA2B,KAAK,UAAU;CAC9C,OAAO;CACP,OAAO;CACP,OAAO;CACP,OAAO;AACT,CAAC;AAED,MAAM,6BAA6B;;;;;;uCAMI,yBAAyB;;AAGhE,MAAM,gBAAgB;CACpB,sBAAsB;CACtB,cAAc,CACZ,GAAG,2BAA2B;;;;0DAIwB,yBAAyB;MAEjF;CACA,kBAAkB;EAAC;EAAS;EAAS;CAAO;CAC5C,aAAa,CACX;EACE;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI,CACb;CACA,UAAU,CAAC;AACb;;;;;;AAYA,MAAM,+BAEF;CACF,OAAO;EACL,aACE;EACF,mBAAmB;CACrB;CACA,KAAK;EACH,aACE;EACF,mBAAmB;CACrB;CACA,MAAM;EACJ,aACE;EACF,mBAAmB;CACrB;AACF;;;;;;;;;;AAWA,MAAM,6BAA4C;CAChD;EACE,aACE;EACF,kBAAkB,CAAC,qBAAqB;EACxC,mBAAmB;EACnB,aAAa,CACX,wRACF;CACF;CAEA;EACE,aAAa;EACb,kBAAkB,CAAC,aAAa;EAChC,mBAAmB;EACnB,aAAa,CACX,yRACF;CACF;CAEA;EACE,aAAa;EACb,kBAAkB,CAAC,KAAK;EACxB,mBAAmB;EACnB,aAAa,CACX,iRACF;CACF;CACA;EACE,aACE;EACF,kBAAkB;GAAC;GAAQ;GAAkB;EAAU;EACvD,mBAAmB;EACnB,aAAa,CACX,iPACF;CACF;AACF;AAEA,SAAS,6BACP,YACA,EAAE,aAAa,qBACP;CAaR,OAAO;EAAE;EAAa,cAAA,CAXpB;GACE,sBAAsB;GACtB,kBAAkB,CAAC,UAAU;GAC7B;EACF,GACA,GAAG,2BAA2B,KAAK,UAAuB;GACxD,GAAG;GACH,kBAAkB,CAAC,UAAU;EAC/B,EAAE,CAG6B;CAAE;AACrC;AAEA,SAAS,+BAAuD;CAC9D,MAAM,UAAkC,CAAC;CAEzC,KAAK,MAAM,CAAC,YAAY,WAAW,OAAO,QACxC,4BACF,GAAG;EACD,MAAM,SAAS,WAAW,EAAE,CAAC,YAAY,IAAI,WAAW,MAAM,CAAC;EAC/D,QAAQ,oBAAoB,YAAY,6BACtC,YACA,MACF;CACF;CAEA,OAAO;AACT;AAEA,MAAa,UAAkC;CAC7C,8BAA8B;EAC5B,aACE;EACF,SAAS,CAAC,4BAA4B;EACtC,cAAc,CACZ;GACE,aAAa;GACb,SAAS;GACT,eAAe,CAAC,UAAU;GAC1B,eAAe,CAAC,OAAO;EACzB,GACA;GACE,aACE;GACF,SAAS;GACT,eAAe,CAAC,UAAU;GAC1B,eAAe,CAAC,OAAO;GACvB,kBAAkB,CAAC,GAAG,kBAAkB;EAC1C,CACF;CACF;CACA,GAAG,6BAA6B;CAChC,yBAAyB;EACvB,aACE;EACF,SAAS,CAAC,oBAAoB;EAC9B,wBAAwB;EACxB,cAAc,CACZ;GACE,SAAS;GACT,mBAAmB,CAAC,GAAG;EACzB,CACF;EACA,qBAAqB,EACnB,SAAS,KACX;CACF;CACA,qBAAqB;EACnB,aAAa;EACb,cAAc,CACZ;GACE,iBAAiB,CAAC,uBAAuB;GACzC,eAAe;IACb;IACA;IACA;IACA;IACA;IACA;GACF;GACA,mBAAmB,EACjB,SACE,4KACJ;EACF,CACF;CACF;CACA,WAAW;EACT,gBAAgB,CACd;GACE,YAAY;GACZ,oBAAoB;GACpB,iBAAiB;GACjB,iBAAiB;GACjB,wBAAwB;GACxB,qBAAqB,CAAC,wBAAwB;GAC9C,cAAc,CAAC,6CAA6C;GAC5D,qBAAqB;EACvB,GACA;GACE,YAAY;GACZ,oBAAoB;GACpB,iBAAiB;GACjB,iBAAiB;GACjB,wBAAwB;GACxB,YAAY;GACZ,qBAAqB,CACnB,6FACA,wBACF;GACA,cAAc,CACZ,iLACF;GACA,qBAAqB;EACvB,CACF;EACA,aACE;EACF,cAAc;GACZ;IACE,SAAS;IACT,eAAe,CAAC,mBAAmB;IACnC,eAAe,CAAC,gBAAgB,gBAAgB;GAClD;GACA;IACE,SAAS;IACT,eAAe,CAAC,mBAAmB;IACnC,cAAc,CAAC,0BAA0B;IACzC,eAAe,CAAC,gBAAgB,gBAAgB;GAClD;GACA;IACE,GAAG;IACH,kBAAkB,CAAC,aAAa;IAChC,mBAAmB,CAAC,8BAA8B,aAAa;GACjE;GACA;IACE,GAAG;IACH,kBAAkB,CAAC,QAAQ;IAC3B,mBAAmB,CACjB,mEACF;GACF;EACF;CACF;AACF;AAEgD,OAAO,KACrD,4BACF"}

package/dist/config/utils.js

@@ -17,7 +17,7 @@ function mergeChildConfig(parent, child) {
 			...parentConfig,
 			...childConfig
 		};
-		if (config?.isVulnerabilityAlert) config.vulnerabilitySeverity = getHighestVulnerabilitySeverity(parent, child);
+		if (config.isVulnerabilityAlert && (parent.vulnerabilitySeverity !== void 0 || child.vulnerabilitySeverity !== void 0)) config.vulnerabilitySeverity = getHighestVulnerabilitySeverity(parent, child);
 		for (const option of getOptions()) if (option.mergeable && childConfig[option.name] && parentConfig[option.name]) {
 			logger.trace(`mergeable option: ${option.name}`);
 			if (option.name === "constraints") config[option.name] = {

package/dist/config/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":["options.getOptions"],"sources":["../../lib/config/utils.ts"],"sourcesContent":["import { instrument } from '../instrumentation/index.ts';\nimport { logger } from '../logger/index.ts';\nimport { clone } from '../util/clone.ts';\nimport { getHighestVulnerabilitySeverity } from '../util/vulnerability/utils.ts';\nimport * as options from './options/index.ts';\nimport type { RenovateConfig } from './types.ts';\n\nexport function mergeChildConfig<\n  T extends Record<string, any>,\n  TChild extends Record<string, any> | undefined,\n>(parent: T, child: TChild): T & TChild {\n  return instrument('mergeChildConfig', () => {\n    logger.trace({ parent, child }, `mergeChildConfig`);\n    if (!child) {\n      return parent as never;\n    }\n    const parentConfig = clone(parent);\n    const childConfig = clone(child);\n    const config: Record<string, any> = { ...parentConfig, ...childConfig };\n\n    // Ensure highest severity survives parent / child merge\n    if (config?.isVulnerabilityAlert) {\n      config.vulnerabilitySeverity = getHighestVulnerabilitySeverity(\n        parent,\n        child,\n      );\n    }\n\n    for (const option of options.getOptions()) {\n      if (\n        option.mergeable &&\n        childConfig[option.name] &&\n        parentConfig[option.name]\n      ) {\n        logger.trace(`mergeable option: ${option.name}`);\n\n        if (option.name === 'constraints') {\n          config[option.name] = {\n            ...parentConfig[option.name],\n            ...childConfig[option.name],\n          };\n        } else if (option.type === 'array') {\n          config[option.name] = (parentConfig[option.name] as unknown[]).concat(\n            config[option.name],\n          );\n        } else {\n          config[option.name] = mergeChildConfig(\n            parentConfig[option.name] as RenovateConfig,\n            childConfig[option.name] as RenovateConfig,\n          );\n        }\n        logger.trace(\n          { result: config[option.name] },\n          `Merged config.${option.name}`,\n        );\n      }\n    }\n    return { ...config, ...config.force };\n  });\n}\n"],"mappings":";;;;;;AAOA,SAAgB,iBAGd,QAAW,OAA2B;CACtC,OAAO,WAAW,0BAA0B;EAC1C,OAAO,MAAM;GAAE;GAAQ;EAAM,GAAG,kBAAkB;EAClD,IAAI,CAAC,OACH,OAAO;EAET,MAAM,eAAe,MAAM,MAAM;EACjC,MAAM,cAAc,MAAM,KAAK;EAC/B,MAAM,SAA8B;GAAE,GAAG;GAAc,GAAG;EAAY;EAGtE,IAAI,QAAQ,sBACV,OAAO,wBAAwB,gCAC7B,QACA,KACF;EAGF,KAAK,MAAM,UAAUA,WAAmB,GACtC,IACE,OAAO,aACP,YAAY,OAAO,SACnB,aAAa,OAAO,OACpB;GACA,OAAO,MAAM,qBAAqB,OAAO,MAAM;GAE/C,IAAI,OAAO,SAAS,eAClB,OAAO,OAAO,QAAQ;IACpB,GAAG,aAAa,OAAO;IACvB,GAAG,YAAY,OAAO;GACxB;QACK,IAAI,OAAO,SAAS,SACzB,OAAO,OAAO,QAAS,aAAa,OAAO,KAAK,CAAe,OAC7D,OAAO,OAAO,KAChB;QAEA,OAAO,OAAO,QAAQ,iBACpB,aAAa,OAAO,OACpB,YAAY,OAAO,KACrB;GAEF,OAAO,MACL,EAAE,QAAQ,OAAO,OAAO,MAAM,GAC9B,iBAAiB,OAAO,MAC1B;EACF;EAEF,OAAO;GAAE,GAAG;GAAQ,GAAG,OAAO;EAAM;CACtC,CAAC;AACH"}
+{"version":3,"file":"utils.js","names":["options.getOptions"],"sources":["../../lib/config/utils.ts"],"sourcesContent":["import { instrument } from '../instrumentation/index.ts';\nimport { logger } from '../logger/index.ts';\nimport { clone } from '../util/clone.ts';\nimport { getHighestVulnerabilitySeverity } from '../util/vulnerability/utils.ts';\nimport * as options from './options/index.ts';\nimport type { RenovateConfig } from './types.ts';\n\nexport function mergeChildConfig<\n  T extends Record<string, any>,\n  TChild extends Record<string, any> | undefined,\n>(parent: T, child: TChild): T & TChild {\n  return instrument('mergeChildConfig', () => {\n    logger.trace({ parent, child }, `mergeChildConfig`);\n    if (!child) {\n      return parent as never;\n    }\n    const parentConfig = clone(parent);\n    const childConfig = clone(child);\n    const config: Record<string, any> = { ...parentConfig, ...childConfig };\n\n    // Ensure highest severity survives parent / child merge\n    if (\n      config.isVulnerabilityAlert &&\n      (parent.vulnerabilitySeverity !== undefined ||\n        child.vulnerabilitySeverity !== undefined)\n    ) {\n      config.vulnerabilitySeverity = getHighestVulnerabilitySeverity(\n        parent,\n        child,\n      );\n    }\n\n    for (const option of options.getOptions()) {\n      if (\n        option.mergeable &&\n        childConfig[option.name] &&\n        parentConfig[option.name]\n      ) {\n        logger.trace(`mergeable option: ${option.name}`);\n\n        if (option.name === 'constraints') {\n          config[option.name] = {\n            ...parentConfig[option.name],\n            ...childConfig[option.name],\n          };\n        } else if (option.type === 'array') {\n          config[option.name] = (parentConfig[option.name] as unknown[]).concat(\n            config[option.name],\n          );\n        } else {\n          config[option.name] = mergeChildConfig(\n            parentConfig[option.name] as RenovateConfig,\n            childConfig[option.name] as RenovateConfig,\n          );\n        }\n        logger.trace(\n          { result: config[option.name] },\n          `Merged config.${option.name}`,\n        );\n      }\n    }\n    return { ...config, ...config.force };\n  });\n}\n"],"mappings":";;;;;;AAOA,SAAgB,iBAGd,QAAW,OAA2B;CACtC,OAAO,WAAW,0BAA0B;EAC1C,OAAO,MAAM;GAAE;GAAQ;EAAM,GAAG,kBAAkB;EAClD,IAAI,CAAC,OACH,OAAO;EAET,MAAM,eAAe,MAAM,MAAM;EACjC,MAAM,cAAc,MAAM,KAAK;EAC/B,MAAM,SAA8B;GAAE,GAAG;GAAc,GAAG;EAAY;EAGtE,IACE,OAAO,yBACN,OAAO,0BAA0B,KAAA,KAChC,MAAM,0BAA0B,KAAA,IAElC,OAAO,wBAAwB,gCAC7B,QACA,KACF;EAGF,KAAK,MAAM,UAAUA,WAAmB,GACtC,IACE,OAAO,aACP,YAAY,OAAO,SACnB,aAAa,OAAO,OACpB;GACA,OAAO,MAAM,qBAAqB,OAAO,MAAM;GAE/C,IAAI,OAAO,SAAS,eAClB,OAAO,OAAO,QAAQ;IACpB,GAAG,aAAa,OAAO;IACvB,GAAG,YAAY,OAAO;GACxB;QACK,IAAI,OAAO,SAAS,SACzB,OAAO,OAAO,QAAS,aAAa,OAAO,KAAK,CAAe,OAC7D,OAAO,OAAO,KAChB;QAEA,OAAO,OAAO,QAAQ,iBACpB,aAAa,OAAO,OACpB,YAAY,OAAO,KACrB;GAEF,OAAO,MACL,EAAE,QAAQ,OAAO,OAAO,MAAM,GAC9B,iBAAiB,OAAO,MAC1B;EACF;EAEF,OAAO;GAAE,GAAG;GAAQ,GAAG,OAAO;EAAM;CACtC,CAAC;AACH"}

package/dist/util/exec/index.js

@@ -90,7 +90,7 @@ async function prepareRawExec(cmd, opts, sideCarImage) {
 			}
 		};
 	}
-	if (GlobalConfig.get("binarySource") === "global" && opts.toolConstraints?.length) logger.once.debug({ toolConstraints: opts.toolConstraints }, "Ignoring tool contraints because of `binarySource=global`");
+	if (GlobalConfig.get("binarySource") === "global" && opts.toolConstraints?.length) logger.once.debug({ toolConstraints: opts.toolConstraints }, "Ignoring tool constraints because of `binarySource=global`");
 	return {
 		rawCommands,
 		rawOptions

package/dist/util/exec/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../lib/util/exec/index.ts"],"sourcesContent":["import { isNonEmptyString, isString } from '@sindresorhus/is';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../config/global.ts';\nimport type { RepoToolSettingsOptions } from '../../config/types.ts';\nimport { TEMPORARY_ERROR } from '../../constants/error-messages.ts';\nimport { logger } from '../../logger/index.ts';\nimport { coerceArray } from '../array.ts';\nimport { getCustomEnv, getUserEnv } from '../env.ts';\nimport { coerceObject } from '../object.ts';\nimport { rawExec } from './common.ts';\nimport { generateInstallCommands, isDynamicInstall } from './containerbase.ts';\nimport {\n  generateDockerCommand,\n  removeDockerContainer,\n} from './docker/index.ts';\nimport { hardcodedProcessEnv } from './env.ts';\nimport { getHermitEnvs, isHermit } from './hermit.ts';\nimport type {\n  CommandWithOptions,\n  DockerOptions,\n  ExecOptions,\n  ExecResult,\n  ExtraEnv,\n  Opt,\n  RawExecOptions,\n} from './types.ts';\nimport { getChildEnv } from './utils.ts';\n\nfunction dockerEnvVars(extraEnv: ExtraEnv, childEnv: ExtraEnv): string[] {\n  const extraEnvKeys = Object.keys(extraEnv);\n  return extraEnvKeys.filter((key) => isNonEmptyString(childEnv[key]));\n}\n\nfunction getCwd({ cwd, cwdFile }: ExecOptions): string | undefined {\n  // TODO: types (#22198)\n  const defaultCwd = GlobalConfig.get('localDir');\n  const paramCwd = cwdFile\n    ? upath.join(defaultCwd, upath.dirname(cwdFile))\n    : cwd;\n  return paramCwd ?? defaultCwd;\n}\n\nfunction getRawExecOptions(opts: ExecOptions): RawExecOptions {\n  const defaultExecutionTimeout = GlobalConfig.get('executionTimeout');\n  const childEnv = getChildEnv(opts);\n  const cwd = getCwd(opts);\n  let timeout = opts.timeout;\n  timeout ??= defaultExecutionTimeout * 60 * 1000;\n\n  // Set default max buffer size to 10MB\n  const maxBuffer = opts.maxBuffer ?? 10 * 1024 * 1024;\n\n  return {\n    cwd,\n    env: childEnv,\n    maxBuffer,\n    timeout,\n    ...(opts.shell !== undefined && { shell: opts.shell }),\n    stdin: 'pipe',\n    stdout: opts.ignoreStdout ? 'ignore' : 'pipe',\n    stderr: 'pipe',\n  };\n}\n\nfunction isDocker(docker: Opt<DockerOptions>): docker is DockerOptions {\n  return GlobalConfig.get('binarySource') === 'docker' && !!docker;\n}\n\ninterface RawExecArguments {\n  rawCommands: (string | CommandWithOptions)[];\n  rawOptions: RawExecOptions;\n}\n\nasync function prepareRawExec(\n  cmd:\n    string | string[] | CommandWithOptions[] | (string | CommandWithOptions)[],\n  opts: ExecOptions,\n  sideCarImage: string,\n): Promise<RawExecArguments> {\n  const { docker } = opts;\n  const preCommands = coerceArray(opts.preCommands);\n  const customEnvVariables = getCustomEnv();\n  const userConfiguredEnv = getUserEnv();\n  const { containerbaseDir, binarySource } = GlobalConfig.get();\n\n  if (binarySource === 'docker' || binarySource === 'install') {\n    logger.debug(`Setting CONTAINERBASE_CACHE_DIR to ${containerbaseDir!}`);\n    opts.env ??= {};\n    opts.env.CONTAINERBASE_CACHE_DIR = containerbaseDir;\n  }\n\n  let rawOptions = getRawExecOptions(opts);\n\n  let rawCommands = isString(cmd) ? [cmd] : cmd;\n\n  if (isDocker(docker)) {\n    logger.debug({ image: sideCarImage }, 'Using docker to execute');\n    const extraEnv = {\n      ...hardcodedProcessEnv,\n      ...opts.extraEnv,\n      ...customEnvVariables,\n      ...userConfiguredEnv,\n    };\n    const childEnv = getChildEnv(opts);\n    const envVars = [\n      ...dockerEnvVars(extraEnv, childEnv),\n      ...coerceArray(docker.envVars),\n      'CONTAINERBASE_CACHE_DIR',\n    ];\n    const cwd = getCwd(opts);\n    const dockerOptions: DockerOptions = { ...docker, cwd, envVars };\n    const dockerCommand = await generateDockerCommand(\n      rawCommands,\n      [\n        ...(await generateInstallCommands(opts.toolConstraints)),\n        ...preCommands,\n      ],\n      dockerOptions,\n      sideCarImage,\n    );\n    rawCommands = [dockerCommand];\n  } else if (isDynamicInstall(opts.toolConstraints)) {\n    logger.debug('Using containerbase dynamic installs');\n    rawCommands = [\n      ...(await generateInstallCommands(opts.toolConstraints, true)),\n      ...preCommands,\n      ...rawCommands,\n    ];\n  } else if (isHermit()) {\n    const hermitEnvVars = await getHermitEnvs(rawOptions);\n    logger.debug(\n      { hermitEnvVars },\n      'merging hermit environment variables into the execution options',\n    );\n    rawOptions = {\n      ...rawOptions,\n      env: {\n        ...rawOptions.env,\n        ...hermitEnvVars,\n      },\n    };\n  }\n\n  if (\n    GlobalConfig.get('binarySource') === 'global' &&\n    opts.toolConstraints?.length\n  ) {\n    logger.once.debug(\n      { toolConstraints: opts.toolConstraints },\n      'Ignoring tool contraints because of `binarySource=global`',\n    );\n  }\n\n  return { rawCommands, rawOptions };\n}\n\nexport async function exec(\n  cmd:\n    string | string[] | CommandWithOptions[] | (string | CommandWithOptions)[],\n  opts: ExecOptions = {},\n): Promise<ExecResult> {\n  const { docker } = opts;\n  const dockerChildPrefix = GlobalConfig.get('dockerChildPrefix');\n  const sideCarImage = GlobalConfig.get('dockerSidecarImage');\n\n  const { rawCommands, rawOptions } = await prepareRawExec(\n    cmd,\n    opts,\n    sideCarImage,\n  );\n  const useDocker = isDocker(docker);\n\n  let res: ExecResult = { stdout: '', stderr: '' };\n  for (const rawCmd of rawCommands) {\n    const startTime = Date.now();\n    if (useDocker) {\n      await removeDockerContainer(sideCarImage, dockerChildPrefix);\n    }\n    logger.debug(\n      { command: rawCmd, env: Object.keys(coerceObject(rawOptions.env)) },\n      'Executing command',\n    );\n    logger.trace({ commandOptions: rawOptions }, 'Command options');\n    try {\n      res = await rawExec(rawCmd, rawOptions);\n    } catch (err) {\n      const durationMs = Math.round(Date.now() - startTime);\n      logger.debug({ err, durationMs }, 'rawExec err');\n      if (useDocker) {\n        await removeDockerContainer(sideCarImage, dockerChildPrefix).catch(\n          (removeErr: Error) => {\n            const message: string = err.message;\n            throw new Error(\n              `Error: \"${removeErr.message}\" - Original Error: \"${message}\"`,\n            );\n          },\n        );\n      }\n      if (err.signal === `SIGTERM`) {\n        logger.debug(\n          { err },\n          'exec interrupted by SIGTERM - run needs to be aborted',\n        );\n        throw new Error(TEMPORARY_ERROR);\n      }\n      throw err;\n    }\n    const durationMs = Math.round(Date.now() - startTime);\n    logger.debug(\n      {\n        durationMs,\n        stdout: res.stdout,\n        stderr: res.stderr,\n      },\n      'exec completed',\n    );\n  }\n\n  return res;\n}\n\n/**\n * When we resolve `toolSettings` in `getToolSettingsOptions`, we provide a stronger type than our input types, because we set defaults on config options.\n *\n * We do not have a default that is set for `nodeMaxMemory`, so it must remain as optional.\n */\ntype ResolvedToolSettingsOptions = Required<\n  Omit<RepoToolSettingsOptions, 'nodeMaxMemory'>\n> &\n  Pick<RepoToolSettingsOptions, 'nodeMaxMemory'>;\n\nexport function getToolSettingsOptions(\n  repoConfig?: RepoToolSettingsOptions,\n): ResolvedToolSettingsOptions {\n  let defaults = GlobalConfig.get('toolSettings');\n  defaults ??= {\n    jvmMaxMemory: 512,\n    jvmMemory: 512,\n  };\n\n  const jvmMaxMemory = defaults?.jvmMaxMemory ?? 512;\n  const options: ResolvedToolSettingsOptions = {\n    jvmMaxMemory,\n    jvmMemory: defaults?.jvmMemory ?? jvmMaxMemory,\n    nodeMaxMemory: defaults?.nodeMaxMemory,\n  };\n\n  if (repoConfig !== undefined) {\n    if (repoConfig.jvmMaxMemory) {\n      if (repoConfig.jvmMaxMemory > options.jvmMaxMemory) {\n        logger.once.debug(\n          `A higher jvmMaxMemory (${repoConfig.jvmMaxMemory}) than the global configuration (${options.jvmMaxMemory}) is not permitted for Java VM invocations. Using global configuration instead`,\n        );\n      }\n\n      options.jvmMaxMemory = Math.min(\n        options.jvmMaxMemory,\n        repoConfig.jvmMaxMemory,\n      );\n    }\n\n    if (repoConfig.jvmMemory) {\n      options.jvmMemory = repoConfig.jvmMemory;\n    }\n\n    if (repoConfig.nodeMaxMemory) {\n      if (\n        options.nodeMaxMemory &&\n        repoConfig.nodeMaxMemory > options.nodeMaxMemory\n      ) {\n        logger.once.debug(\n          `A higher nodeMaxMemory (${repoConfig.nodeMaxMemory}) than the global configuration (${options.nodeMaxMemory}) is not permitted for Node invocations. Using global configuration instead`,\n        );\n      } else {\n        options.nodeMaxMemory = repoConfig.nodeMaxMemory;\n      }\n    }\n  }\n\n  options.jvmMaxMemory = Math.floor(options.jvmMaxMemory);\n  options.jvmMemory = Math.floor(options.jvmMemory);\n  if (options.nodeMaxMemory) {\n    options.nodeMaxMemory = Math.floor(options.nodeMaxMemory);\n  }\n\n  // make sure that the starting memory can't be more than the max memory\n  options.jvmMemory = Math.min(options.jvmMemory, options.jvmMaxMemory);\n\n  if (options.jvmMaxMemory < 512 || options.jvmMemory < 512) {\n    options.jvmMaxMemory = Math.max(options.jvmMaxMemory, 512);\n\n    logger.once.debug(\n      'Overriding low memory settings for Java VM invocations to a minimum of 512M',\n    );\n    options.jvmMemory = Math.max(options.jvmMemory, 512);\n  }\n\n  return options;\n}\n\nexport function gradleJvmArg(config: RepoToolSettingsOptions): string {\n  return ` -Dorg.gradle.jvmargs=\"-Xms${config.jvmMemory}m -Xmx${config.jvmMaxMemory}m\"`;\n}\n"],"mappings":";;;;;;;;;;;;;;;AA4BA,SAAS,cAAc,UAAoB,UAA8B;CAEvE,OADqB,OAAO,KAAK,QACf,CAAC,CAAC,QAAQ,QAAQ,iBAAiB,SAAS,IAAI,CAAC;AACrE;AAEA,SAAS,OAAO,EAAE,KAAK,WAA4C;CAEjE,MAAM,aAAa,aAAa,IAAI,UAAU;CAI9C,QAHiB,UACb,MAAM,KAAK,YAAY,MAAM,QAAQ,OAAO,CAAC,IAC7C,QACe;AACrB;AAEA,SAAS,kBAAkB,MAAmC;CAC5D,MAAM,0BAA0B,aAAa,IAAI,kBAAkB;CACnE,MAAM,WAAW,YAAY,IAAI;CACjC,MAAM,MAAM,OAAO,IAAI;CACvB,IAAI,UAAU,KAAK;CACnB,YAAY,0BAA0B,KAAK;CAK3C,OAAO;EACL;EACA,KAAK;EACL,WALgB,KAAK,aAAa;EAMlC;EACA,GAAI,KAAK,UAAU,KAAA,KAAa,EAAE,OAAO,KAAK,MAAM;EACpD,OAAO;EACP,QAAQ,KAAK,eAAe,WAAW;EACvC,QAAQ;CACV;AACF;AAEA,SAAS,SAAS,QAAqD;CACrE,OAAO,aAAa,IAAI,cAAc,MAAM,YAAY,CAAC,CAAC;AAC5D;AAOA,eAAe,eACb,KAEA,MACA,cAC2B;CAC3B,MAAM,EAAE,WAAW;CACnB,MAAM,cAAc,YAAY,KAAK,WAAW;CAChD,MAAM,qBAAqB,aAAa;CACxC,MAAM,oBAAoB,WAAW;CACrC,MAAM,EAAE,kBAAkB,iBAAiB,aAAa,IAAI;CAE5D,IAAI,iBAAiB,YAAY,iBAAiB,WAAW;EAC3D,OAAO,MAAM,sCAAsC,kBAAmB;EACtE,KAAK,QAAQ,CAAC;EACd,KAAK,IAAI,0BAA0B;CACrC;CAEA,IAAI,aAAa,kBAAkB,IAAI;CAEvC,IAAI,cAAc,SAAS,GAAG,IAAI,CAAC,GAAG,IAAI;CAE1C,IAAI,SAAS,MAAM,GAAG;EACpB,OAAO,MAAM,EAAE,OAAO,aAAa,GAAG,yBAAyB;EAQ/D,MAAM,UAAU;GACd,GAAG,cAAc;IAPjB,GAAG;IACH,GAAG,KAAK;IACR,GAAG;IACH,GAAG;GAIqB,GAFT,YAAY,IAEO,CAAC;GACnC,GAAG,YAAY,OAAO,OAAO;GAC7B;EACF;EACA,MAAM,MAAM,OAAO,IAAI;EACvB,MAAM,gBAA+B;GAAE,GAAG;GAAQ;GAAK;EAAQ;EAU/D,cAAc,CAAC,MATa,sBAC1B,aACA,CACE,GAAI,MAAM,wBAAwB,KAAK,eAAe,GACtD,GAAG,WACL,GACA,eACA,YACF,CAC4B;CAC9B,OAAO,IAAI,iBAAiB,KAAK,eAAe,GAAG;EACjD,OAAO,MAAM,sCAAsC;EACnD,cAAc;GACZ,GAAI,MAAM,wBAAwB,KAAK,iBAAiB,IAAI;GAC5D,GAAG;GACH,GAAG;EACL;CACF,OAAO,IAAI,SAAS,GAAG;EACrB,MAAM,gBAAgB,MAAM,cAAc,UAAU;EACpD,OAAO,MACL,EAAE,cAAc,GAChB,iEACF;EACA,aAAa;GACX,GAAG;GACH,KAAK;IACH,GAAG,WAAW;IACd,GAAG;GACL;EACF;CACF;CAEA,IACE,aAAa,IAAI,cAAc,MAAM,YACrC,KAAK,iBAAiB,QAEtB,OAAO,KAAK,MACV,EAAE,iBAAiB,KAAK,gBAAgB,GACxC,2DACF;CAGF,OAAO;EAAE;EAAa;CAAW;AACnC;AAEA,eAAsB,KACpB,KAEA,OAAoB,CAAC,GACA;CACrB,MAAM,EAAE,WAAW;CACnB,MAAM,oBAAoB,aAAa,IAAI,mBAAmB;CAC9D,MAAM,eAAe,aAAa,IAAI,oBAAoB;CAE1D,MAAM,EAAE,aAAa,eAAe,MAAM,eACxC,KACA,MACA,YACF;CACA,MAAM,YAAY,SAAS,MAAM;CAEjC,IAAI,MAAkB;EAAE,QAAQ;EAAI,QAAQ;CAAG;CAC/C,KAAK,MAAM,UAAU,aAAa;EAChC,MAAM,YAAY,KAAK,IAAI;EAC3B,IAAI,WACF,MAAM,sBAAsB,cAAc,iBAAiB;EAE7D,OAAO,MACL;GAAE,SAAS;GAAQ,KAAK,OAAO,KAAK,aAAa,WAAW,GAAG,CAAC;EAAE,GAClE,mBACF;EACA,OAAO,MAAM,EAAE,gBAAgB,WAAW,GAAG,iBAAiB;EAC9D,IAAI;GACF,MAAM,MAAM,QAAQ,QAAQ,UAAU;EACxC,SAAS,KAAK;GACZ,MAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,SAAS;GACpD,OAAO,MAAM;IAAE;IAAK;GAAW,GAAG,aAAa;GAC/C,IAAI,WACF,MAAM,sBAAsB,cAAc,iBAAiB,CAAC,CAAC,OAC1D,cAAqB;IACpB,MAAM,UAAkB,IAAI;IAC5B,MAAM,IAAI,MACR,WAAW,UAAU,QAAQ,uBAAuB,QAAQ,EAC9D;GACF,CACF;GAEF,IAAI,IAAI,WAAW,WAAW;IAC5B,OAAO,MACL,EAAE,IAAI,GACN,uDACF;IACA,MAAM,IAAI,MAAM,eAAe;GACjC;GACA,MAAM;EACR;EACA,MAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,SAAS;EACpD,OAAO,MACL;GACE;GACA,QAAQ,IAAI;GACZ,QAAQ,IAAI;EACd,GACA,gBACF;CACF;CAEA,OAAO;AACT;AAYA,SAAgB,uBACd,YAC6B;CAC7B,IAAI,WAAW,aAAa,IAAI,cAAc;CAC9C,aAAa;EACX,cAAc;EACd,WAAW;CACb;CAEA,MAAM,eAAe,UAAU,gBAAgB;CAC/C,MAAM,UAAuC;EAC3C;EACA,WAAW,UAAU,aAAa;EAClC,eAAe,UAAU;CAC3B;CAEA,IAAI,eAAe,KAAA,GAAW;EAC5B,IAAI,WAAW,cAAc;GAC3B,IAAI,WAAW,eAAe,QAAQ,cACpC,OAAO,KAAK,MACV,0BAA0B,WAAW,aAAa,mCAAmC,QAAQ,aAAa,+EAC5G;GAGF,QAAQ,eAAe,KAAK,IAC1B,QAAQ,cACR,WAAW,YACb;EACF;EAEA,IAAI,WAAW,WACb,QAAQ,YAAY,WAAW;EAGjC,IAAI,WAAW,eAAe;GAC5B,IACE,QAAQ,iBACR,WAAW,gBAAgB,QAAQ,eAEnC,OAAO,KAAK,MACV,2BAA2B,WAAW,cAAc,mCAAmC,QAAQ,cAAc,4EAC/G;QAEA,QAAQ,gBAAgB,WAAW;EAEvC;CACF;CAEA,QAAQ,eAAe,KAAK,MAAM,QAAQ,YAAY;CACtD,QAAQ,YAAY,KAAK,MAAM,QAAQ,SAAS;CAChD,IAAI,QAAQ,eACV,QAAQ,gBAAgB,KAAK,MAAM,QAAQ,aAAa;CAI1D,QAAQ,YAAY,KAAK,IAAI,QAAQ,WAAW,QAAQ,YAAY;CAEpE,IAAI,QAAQ,eAAe,OAAO,QAAQ,YAAY,KAAK;EACzD,QAAQ,eAAe,KAAK,IAAI,QAAQ,cAAc,GAAG;EAEzD,OAAO,KAAK,MACV,6EACF;EACA,QAAQ,YAAY,KAAK,IAAI,QAAQ,WAAW,GAAG;CACrD;CAEA,OAAO;AACT;AAEA,SAAgB,aAAa,QAAyC;CACpE,OAAO,8BAA8B,OAAO,UAAU,QAAQ,OAAO,aAAa;AACpF"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../lib/util/exec/index.ts"],"sourcesContent":["import { isNonEmptyString, isString } from '@sindresorhus/is';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../config/global.ts';\nimport type { RepoToolSettingsOptions } from '../../config/types.ts';\nimport { TEMPORARY_ERROR } from '../../constants/error-messages.ts';\nimport { logger } from '../../logger/index.ts';\nimport { coerceArray } from '../array.ts';\nimport { getCustomEnv, getUserEnv } from '../env.ts';\nimport { coerceObject } from '../object.ts';\nimport { rawExec } from './common.ts';\nimport { generateInstallCommands, isDynamicInstall } from './containerbase.ts';\nimport {\n  generateDockerCommand,\n  removeDockerContainer,\n} from './docker/index.ts';\nimport { hardcodedProcessEnv } from './env.ts';\nimport { getHermitEnvs, isHermit } from './hermit.ts';\nimport type {\n  CommandWithOptions,\n  DockerOptions,\n  ExecOptions,\n  ExecResult,\n  ExtraEnv,\n  Opt,\n  RawExecOptions,\n} from './types.ts';\nimport { getChildEnv } from './utils.ts';\n\nfunction dockerEnvVars(extraEnv: ExtraEnv, childEnv: ExtraEnv): string[] {\n  const extraEnvKeys = Object.keys(extraEnv);\n  return extraEnvKeys.filter((key) => isNonEmptyString(childEnv[key]));\n}\n\nfunction getCwd({ cwd, cwdFile }: ExecOptions): string | undefined {\n  // TODO: types (#22198)\n  const defaultCwd = GlobalConfig.get('localDir');\n  const paramCwd = cwdFile\n    ? upath.join(defaultCwd, upath.dirname(cwdFile))\n    : cwd;\n  return paramCwd ?? defaultCwd;\n}\n\nfunction getRawExecOptions(opts: ExecOptions): RawExecOptions {\n  const defaultExecutionTimeout = GlobalConfig.get('executionTimeout');\n  const childEnv = getChildEnv(opts);\n  const cwd = getCwd(opts);\n  let timeout = opts.timeout;\n  timeout ??= defaultExecutionTimeout * 60 * 1000;\n\n  // Set default max buffer size to 10MB\n  const maxBuffer = opts.maxBuffer ?? 10 * 1024 * 1024;\n\n  return {\n    cwd,\n    env: childEnv,\n    maxBuffer,\n    timeout,\n    ...(opts.shell !== undefined && { shell: opts.shell }),\n    stdin: 'pipe',\n    stdout: opts.ignoreStdout ? 'ignore' : 'pipe',\n    stderr: 'pipe',\n  };\n}\n\nfunction isDocker(docker: Opt<DockerOptions>): docker is DockerOptions {\n  return GlobalConfig.get('binarySource') === 'docker' && !!docker;\n}\n\ninterface RawExecArguments {\n  rawCommands: (string | CommandWithOptions)[];\n  rawOptions: RawExecOptions;\n}\n\nasync function prepareRawExec(\n  cmd:\n    string | string[] | CommandWithOptions[] | (string | CommandWithOptions)[],\n  opts: ExecOptions,\n  sideCarImage: string,\n): Promise<RawExecArguments> {\n  const { docker } = opts;\n  const preCommands = coerceArray(opts.preCommands);\n  const customEnvVariables = getCustomEnv();\n  const userConfiguredEnv = getUserEnv();\n  const { containerbaseDir, binarySource } = GlobalConfig.get();\n\n  if (binarySource === 'docker' || binarySource === 'install') {\n    logger.debug(`Setting CONTAINERBASE_CACHE_DIR to ${containerbaseDir!}`);\n    opts.env ??= {};\n    opts.env.CONTAINERBASE_CACHE_DIR = containerbaseDir;\n  }\n\n  let rawOptions = getRawExecOptions(opts);\n\n  let rawCommands = isString(cmd) ? [cmd] : cmd;\n\n  if (isDocker(docker)) {\n    logger.debug({ image: sideCarImage }, 'Using docker to execute');\n    const extraEnv = {\n      ...hardcodedProcessEnv,\n      ...opts.extraEnv,\n      ...customEnvVariables,\n      ...userConfiguredEnv,\n    };\n    const childEnv = getChildEnv(opts);\n    const envVars = [\n      ...dockerEnvVars(extraEnv, childEnv),\n      ...coerceArray(docker.envVars),\n      'CONTAINERBASE_CACHE_DIR',\n    ];\n    const cwd = getCwd(opts);\n    const dockerOptions: DockerOptions = { ...docker, cwd, envVars };\n    const dockerCommand = await generateDockerCommand(\n      rawCommands,\n      [\n        ...(await generateInstallCommands(opts.toolConstraints)),\n        ...preCommands,\n      ],\n      dockerOptions,\n      sideCarImage,\n    );\n    rawCommands = [dockerCommand];\n  } else if (isDynamicInstall(opts.toolConstraints)) {\n    logger.debug('Using containerbase dynamic installs');\n    rawCommands = [\n      ...(await generateInstallCommands(opts.toolConstraints, true)),\n      ...preCommands,\n      ...rawCommands,\n    ];\n  } else if (isHermit()) {\n    const hermitEnvVars = await getHermitEnvs(rawOptions);\n    logger.debug(\n      { hermitEnvVars },\n      'merging hermit environment variables into the execution options',\n    );\n    rawOptions = {\n      ...rawOptions,\n      env: {\n        ...rawOptions.env,\n        ...hermitEnvVars,\n      },\n    };\n  }\n\n  if (\n    GlobalConfig.get('binarySource') === 'global' &&\n    opts.toolConstraints?.length\n  ) {\n    logger.once.debug(\n      { toolConstraints: opts.toolConstraints },\n      'Ignoring tool constraints because of `binarySource=global`',\n    );\n  }\n\n  return { rawCommands, rawOptions };\n}\n\nexport async function exec(\n  cmd:\n    string | string[] | CommandWithOptions[] | (string | CommandWithOptions)[],\n  opts: ExecOptions = {},\n): Promise<ExecResult> {\n  const { docker } = opts;\n  const dockerChildPrefix = GlobalConfig.get('dockerChildPrefix');\n  const sideCarImage = GlobalConfig.get('dockerSidecarImage');\n\n  const { rawCommands, rawOptions } = await prepareRawExec(\n    cmd,\n    opts,\n    sideCarImage,\n  );\n  const useDocker = isDocker(docker);\n\n  let res: ExecResult = { stdout: '', stderr: '' };\n  for (const rawCmd of rawCommands) {\n    const startTime = Date.now();\n    if (useDocker) {\n      await removeDockerContainer(sideCarImage, dockerChildPrefix);\n    }\n    logger.debug(\n      { command: rawCmd, env: Object.keys(coerceObject(rawOptions.env)) },\n      'Executing command',\n    );\n    logger.trace({ commandOptions: rawOptions }, 'Command options');\n    try {\n      res = await rawExec(rawCmd, rawOptions);\n    } catch (err) {\n      const durationMs = Math.round(Date.now() - startTime);\n      logger.debug({ err, durationMs }, 'rawExec err');\n      if (useDocker) {\n        await removeDockerContainer(sideCarImage, dockerChildPrefix).catch(\n          (removeErr: Error) => {\n            const message: string = err.message;\n            throw new Error(\n              `Error: \"${removeErr.message}\" - Original Error: \"${message}\"`,\n            );\n          },\n        );\n      }\n      if (err.signal === `SIGTERM`) {\n        logger.debug(\n          { err },\n          'exec interrupted by SIGTERM - run needs to be aborted',\n        );\n        throw new Error(TEMPORARY_ERROR);\n      }\n      throw err;\n    }\n    const durationMs = Math.round(Date.now() - startTime);\n    logger.debug(\n      {\n        durationMs,\n        stdout: res.stdout,\n        stderr: res.stderr,\n      },\n      'exec completed',\n    );\n  }\n\n  return res;\n}\n\n/**\n * When we resolve `toolSettings` in `getToolSettingsOptions`, we provide a stronger type than our input types, because we set defaults on config options.\n *\n * We do not have a default that is set for `nodeMaxMemory`, so it must remain as optional.\n */\ntype ResolvedToolSettingsOptions = Required<\n  Omit<RepoToolSettingsOptions, 'nodeMaxMemory'>\n> &\n  Pick<RepoToolSettingsOptions, 'nodeMaxMemory'>;\n\nexport function getToolSettingsOptions(\n  repoConfig?: RepoToolSettingsOptions,\n): ResolvedToolSettingsOptions {\n  let defaults = GlobalConfig.get('toolSettings');\n  defaults ??= {\n    jvmMaxMemory: 512,\n    jvmMemory: 512,\n  };\n\n  const jvmMaxMemory = defaults?.jvmMaxMemory ?? 512;\n  const options: ResolvedToolSettingsOptions = {\n    jvmMaxMemory,\n    jvmMemory: defaults?.jvmMemory ?? jvmMaxMemory,\n    nodeMaxMemory: defaults?.nodeMaxMemory,\n  };\n\n  if (repoConfig !== undefined) {\n    if (repoConfig.jvmMaxMemory) {\n      if (repoConfig.jvmMaxMemory > options.jvmMaxMemory) {\n        logger.once.debug(\n          `A higher jvmMaxMemory (${repoConfig.jvmMaxMemory}) than the global configuration (${options.jvmMaxMemory}) is not permitted for Java VM invocations. Using global configuration instead`,\n        );\n      }\n\n      options.jvmMaxMemory = Math.min(\n        options.jvmMaxMemory,\n        repoConfig.jvmMaxMemory,\n      );\n    }\n\n    if (repoConfig.jvmMemory) {\n      options.jvmMemory = repoConfig.jvmMemory;\n    }\n\n    if (repoConfig.nodeMaxMemory) {\n      if (\n        options.nodeMaxMemory &&\n        repoConfig.nodeMaxMemory > options.nodeMaxMemory\n      ) {\n        logger.once.debug(\n          `A higher nodeMaxMemory (${repoConfig.nodeMaxMemory}) than the global configuration (${options.nodeMaxMemory}) is not permitted for Node invocations. Using global configuration instead`,\n        );\n      } else {\n        options.nodeMaxMemory = repoConfig.nodeMaxMemory;\n      }\n    }\n  }\n\n  options.jvmMaxMemory = Math.floor(options.jvmMaxMemory);\n  options.jvmMemory = Math.floor(options.jvmMemory);\n  if (options.nodeMaxMemory) {\n    options.nodeMaxMemory = Math.floor(options.nodeMaxMemory);\n  }\n\n  // make sure that the starting memory can't be more than the max memory\n  options.jvmMemory = Math.min(options.jvmMemory, options.jvmMaxMemory);\n\n  if (options.jvmMaxMemory < 512 || options.jvmMemory < 512) {\n    options.jvmMaxMemory = Math.max(options.jvmMaxMemory, 512);\n\n    logger.once.debug(\n      'Overriding low memory settings for Java VM invocations to a minimum of 512M',\n    );\n    options.jvmMemory = Math.max(options.jvmMemory, 512);\n  }\n\n  return options;\n}\n\nexport function gradleJvmArg(config: RepoToolSettingsOptions): string {\n  return ` -Dorg.gradle.jvmargs=\"-Xms${config.jvmMemory}m -Xmx${config.jvmMaxMemory}m\"`;\n}\n"],"mappings":";;;;;;;;;;;;;;;AA4BA,SAAS,cAAc,UAAoB,UAA8B;CAEvE,OADqB,OAAO,KAAK,QACf,CAAC,CAAC,QAAQ,QAAQ,iBAAiB,SAAS,IAAI,CAAC;AACrE;AAEA,SAAS,OAAO,EAAE,KAAK,WAA4C;CAEjE,MAAM,aAAa,aAAa,IAAI,UAAU;CAI9C,QAHiB,UACb,MAAM,KAAK,YAAY,MAAM,QAAQ,OAAO,CAAC,IAC7C,QACe;AACrB;AAEA,SAAS,kBAAkB,MAAmC;CAC5D,MAAM,0BAA0B,aAAa,IAAI,kBAAkB;CACnE,MAAM,WAAW,YAAY,IAAI;CACjC,MAAM,MAAM,OAAO,IAAI;CACvB,IAAI,UAAU,KAAK;CACnB,YAAY,0BAA0B,KAAK;CAK3C,OAAO;EACL;EACA,KAAK;EACL,WALgB,KAAK,aAAa;EAMlC;EACA,GAAI,KAAK,UAAU,KAAA,KAAa,EAAE,OAAO,KAAK,MAAM;EACpD,OAAO;EACP,QAAQ,KAAK,eAAe,WAAW;EACvC,QAAQ;CACV;AACF;AAEA,SAAS,SAAS,QAAqD;CACrE,OAAO,aAAa,IAAI,cAAc,MAAM,YAAY,CAAC,CAAC;AAC5D;AAOA,eAAe,eACb,KAEA,MACA,cAC2B;CAC3B,MAAM,EAAE,WAAW;CACnB,MAAM,cAAc,YAAY,KAAK,WAAW;CAChD,MAAM,qBAAqB,aAAa;CACxC,MAAM,oBAAoB,WAAW;CACrC,MAAM,EAAE,kBAAkB,iBAAiB,aAAa,IAAI;CAE5D,IAAI,iBAAiB,YAAY,iBAAiB,WAAW;EAC3D,OAAO,MAAM,sCAAsC,kBAAmB;EACtE,KAAK,QAAQ,CAAC;EACd,KAAK,IAAI,0BAA0B;CACrC;CAEA,IAAI,aAAa,kBAAkB,IAAI;CAEvC,IAAI,cAAc,SAAS,GAAG,IAAI,CAAC,GAAG,IAAI;CAE1C,IAAI,SAAS,MAAM,GAAG;EACpB,OAAO,MAAM,EAAE,OAAO,aAAa,GAAG,yBAAyB;EAQ/D,MAAM,UAAU;GACd,GAAG,cAAc;IAPjB,GAAG;IACH,GAAG,KAAK;IACR,GAAG;IACH,GAAG;GAIqB,GAFT,YAAY,IAEO,CAAC;GACnC,GAAG,YAAY,OAAO,OAAO;GAC7B;EACF;EACA,MAAM,MAAM,OAAO,IAAI;EACvB,MAAM,gBAA+B;GAAE,GAAG;GAAQ;GAAK;EAAQ;EAU/D,cAAc,CAAC,MATa,sBAC1B,aACA,CACE,GAAI,MAAM,wBAAwB,KAAK,eAAe,GACtD,GAAG,WACL,GACA,eACA,YACF,CAC4B;CAC9B,OAAO,IAAI,iBAAiB,KAAK,eAAe,GAAG;EACjD,OAAO,MAAM,sCAAsC;EACnD,cAAc;GACZ,GAAI,MAAM,wBAAwB,KAAK,iBAAiB,IAAI;GAC5D,GAAG;GACH,GAAG;EACL;CACF,OAAO,IAAI,SAAS,GAAG;EACrB,MAAM,gBAAgB,MAAM,cAAc,UAAU;EACpD,OAAO,MACL,EAAE,cAAc,GAChB,iEACF;EACA,aAAa;GACX,GAAG;GACH,KAAK;IACH,GAAG,WAAW;IACd,GAAG;GACL;EACF;CACF;CAEA,IACE,aAAa,IAAI,cAAc,MAAM,YACrC,KAAK,iBAAiB,QAEtB,OAAO,KAAK,MACV,EAAE,iBAAiB,KAAK,gBAAgB,GACxC,4DACF;CAGF,OAAO;EAAE;EAAa;CAAW;AACnC;AAEA,eAAsB,KACpB,KAEA,OAAoB,CAAC,GACA;CACrB,MAAM,EAAE,WAAW;CACnB,MAAM,oBAAoB,aAAa,IAAI,mBAAmB;CAC9D,MAAM,eAAe,aAAa,IAAI,oBAAoB;CAE1D,MAAM,EAAE,aAAa,eAAe,MAAM,eACxC,KACA,MACA,YACF;CACA,MAAM,YAAY,SAAS,MAAM;CAEjC,IAAI,MAAkB;EAAE,QAAQ;EAAI,QAAQ;CAAG;CAC/C,KAAK,MAAM,UAAU,aAAa;EAChC,MAAM,YAAY,KAAK,IAAI;EAC3B,IAAI,WACF,MAAM,sBAAsB,cAAc,iBAAiB;EAE7D,OAAO,MACL;GAAE,SAAS;GAAQ,KAAK,OAAO,KAAK,aAAa,WAAW,GAAG,CAAC;EAAE,GAClE,mBACF;EACA,OAAO,MAAM,EAAE,gBAAgB,WAAW,GAAG,iBAAiB;EAC9D,IAAI;GACF,MAAM,MAAM,QAAQ,QAAQ,UAAU;EACxC,SAAS,KAAK;GACZ,MAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,SAAS;GACpD,OAAO,MAAM;IAAE;IAAK;GAAW,GAAG,aAAa;GAC/C,IAAI,WACF,MAAM,sBAAsB,cAAc,iBAAiB,CAAC,CAAC,OAC1D,cAAqB;IACpB,MAAM,UAAkB,IAAI;IAC5B,MAAM,IAAI,MACR,WAAW,UAAU,QAAQ,uBAAuB,QAAQ,EAC9D;GACF,CACF;GAEF,IAAI,IAAI,WAAW,WAAW;IAC5B,OAAO,MACL,EAAE,IAAI,GACN,uDACF;IACA,MAAM,IAAI,MAAM,eAAe;GACjC;GACA,MAAM;EACR;EACA,MAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,SAAS;EACpD,OAAO,MACL;GACE;GACA,QAAQ,IAAI;GACZ,QAAQ,IAAI;EACd,GACA,gBACF;CACF;CAEA,OAAO;AACT;AAYA,SAAgB,uBACd,YAC6B;CAC7B,IAAI,WAAW,aAAa,IAAI,cAAc;CAC9C,aAAa;EACX,cAAc;EACd,WAAW;CACb;CAEA,MAAM,eAAe,UAAU,gBAAgB;CAC/C,MAAM,UAAuC;EAC3C;EACA,WAAW,UAAU,aAAa;EAClC,eAAe,UAAU;CAC3B;CAEA,IAAI,eAAe,KAAA,GAAW;EAC5B,IAAI,WAAW,cAAc;GAC3B,IAAI,WAAW,eAAe,QAAQ,cACpC,OAAO,KAAK,MACV,0BAA0B,WAAW,aAAa,mCAAmC,QAAQ,aAAa,+EAC5G;GAGF,QAAQ,eAAe,KAAK,IAC1B,QAAQ,cACR,WAAW,YACb;EACF;EAEA,IAAI,WAAW,WACb,QAAQ,YAAY,WAAW;EAGjC,IAAI,WAAW,eAAe;GAC5B,IACE,QAAQ,iBACR,WAAW,gBAAgB,QAAQ,eAEnC,OAAO,KAAK,MACV,2BAA2B,WAAW,cAAc,mCAAmC,QAAQ,cAAc,4EAC/G;QAEA,QAAQ,gBAAgB,WAAW;EAEvC;CACF;CAEA,QAAQ,eAAe,KAAK,MAAM,QAAQ,YAAY;CACtD,QAAQ,YAAY,KAAK,MAAM,QAAQ,SAAS;CAChD,IAAI,QAAQ,eACV,QAAQ,gBAAgB,KAAK,MAAM,QAAQ,aAAa;CAI1D,QAAQ,YAAY,KAAK,IAAI,QAAQ,WAAW,QAAQ,YAAY;CAEpE,IAAI,QAAQ,eAAe,OAAO,QAAQ,YAAY,KAAK;EACzD,QAAQ,eAAe,KAAK,IAAI,QAAQ,cAAc,GAAG;EAEzD,OAAO,KAAK,MACV,6EACF;EACA,QAAQ,YAAY,KAAK,IAAI,QAAQ,WAAW,GAAG;CACrD;CAEA,OAAO;AACT;AAEA,SAAgB,aAAa,QAAyC;CACpE,OAAO,8BAA8B,OAAO,UAAU,QAAQ,OAAO,aAAa;AACpF"}

package/dist/workers/global/initialize.js

@@ -10,6 +10,7 @@ import { setEmojiConfig } from "../../util/emoji.js";
 import { initPlatform } from "../../modules/platform/index.js";
 import { initMergeConfidence } from "../../util/merge-confidence/index.js";
 import fs from "fs-extra";
+import { isContainerbase, validateContainerbaseVersion } from "@renovatebot/base-image";
 import upath from "upath";
 import os from "node:os";
 //#region lib/workers/global/initialize.ts
@@ -42,8 +43,31 @@ function limitCommitsPerRun(config) {
 	const limit = config.prCommitsPerRunLimit;
 	setMaxLimit("Commits", typeof limit === "number" && limit > 0 ? limit : null);
 }
+/**
+* Checks that the Containerbase image version is compatible with Renovate.
+*
+* Can be skipped using `RENOVATE_X_IGNORE_CONTAINERBASE_VERSION`, which is
+* read from the process environment only.
+*/
+async function checkContainerbaseVersion() {
+	if (!isContainerbase()) return;
+	if (process.env.RENOVATE_X_IGNORE_CONTAINERBASE_VERSION) {
+		logger.info("Containerbase version check is skipped via RENOVATE_X_IGNORE_CONTAINERBASE_VERSION");
+		return;
+	}
+	try {
+		const version = await validateContainerbaseVersion();
+		logger.debug({ version }, "Containerbase image version is compatible");
+	} catch (err) {
+		throw new Error(`Init: containerbase image version check failed: ${err.message}. Upgrade your version of Containerbase, or set \`RENOVATE_X_IGNORE_CONTAINERBASE_VERSION\` to skip the check.`);
+	}
+}
+/**
+* Checks the versions of the tools and the image Renovate depends on.
+*/
 async function checkVersions() {
 	if (!await validateGitVersion()) throw new Error("Init: git version needs upgrading");
+	await checkContainerbaseVersion();
 }
 function setGlobalHostRules(config) {
 	if (config.hostRules) {

package/dist/workers/global/initialize.js.map

@@ -1 +1 @@
-{"version":3,"file":"initialize.js","names":["packageCache.init","packageCache.cleanup"],"sources":["../../../lib/workers/global/initialize.ts"],"sourcesContent":["import os from 'node:os';\nimport fs from 'fs-extra';\nimport upath from 'upath';\nimport { applySecretsAndVariablesToConfig } from '../../config/secrets.ts';\nimport type { AllConfig, RenovateConfig } from '../../config/types.ts';\nimport { logger } from '../../logger/index.ts';\nimport { resetGlobalLogLevelRemaps } from '../../logger/remap.ts';\nimport { initPlatform } from '../../modules/platform/index.ts';\nimport * as packageCache from '../../util/cache/package/index.ts';\nimport { setEmojiConfig } from '../../util/emoji.ts';\nimport { validateGitVersion } from '../../util/git/index.ts';\nimport * as hostRules from '../../util/host-rules.ts';\nimport { setHttpRateLimits } from '../../util/http/rate-limits.ts';\nimport { initMergeConfidence } from '../../util/merge-confidence/index.ts';\nimport { setMaxLimit } from './limits.ts';\n\nasync function setDirectories(input: AllConfig): Promise<AllConfig> {\n  const config: AllConfig = { ...input };\n  process.env.TMPDIR = process.env.RENOVATE_TMPDIR ?? os.tmpdir();\n  if (config.baseDir) {\n    logger.debug(`Using configured baseDir: ${config.baseDir}`);\n  } else {\n    config.baseDir = upath.join(process.env.TMPDIR, 'renovate');\n    logger.debug(`Using baseDir: ${config.baseDir}`);\n  }\n  await fs.ensureDir(config.baseDir);\n  if (config.cacheDir) {\n    logger.debug(`Using configured cacheDir: ${config.cacheDir}`);\n  } else {\n    config.cacheDir = upath.join(config.baseDir, 'cache');\n    logger.debug(`Using cacheDir: ${config.cacheDir}`);\n  }\n  await fs.ensureDir(config.cacheDir);\n  if (config.binarySource === 'docker' || config.binarySource === 'install') {\n    if (config.containerbaseDir) {\n      logger.debug(\n        `Using configured containerbaseDir: ${config.containerbaseDir}`,\n      );\n    } else {\n      config.containerbaseDir = upath.join(config.cacheDir, 'containerbase');\n      logger.debug(`Using containerbaseDir: ${config.containerbaseDir}`);\n    }\n    await fs.ensureDir(config.containerbaseDir);\n  }\n  return config;\n}\n\nfunction limitCommitsPerRun(config: RenovateConfig): void {\n  const limit = config.prCommitsPerRunLimit;\n  setMaxLimit('Commits', typeof limit === 'number' && limit > 0 ? limit : null);\n}\n\nasync function checkVersions(): Promise<void> {\n  const validGitVersion = await validateGitVersion();\n  if (!validGitVersion) {\n    throw new Error('Init: git version needs upgrading');\n  }\n}\n\nfunction setGlobalHostRules(config: AllConfig): void {\n  if (config.hostRules) {\n    logger.debug('Setting global hostRules');\n    applySecretsAndVariablesToConfig({\n      config,\n      deleteVariables: false,\n      deleteSecrets: false,\n    });\n    for (const rule of config.hostRules) {\n      // the self-hosted admin's own rules: `trusted`, so that their `headers` are applied over any a repository or preset sets for the same host, and exempt from `allowedHeaders` altogether - `allowedHeaders` constrains what a repository or preset may set, not the administrator, mirroring how `allowedEnv` does not constrain the administrator's own `env`\n      hostRules.add(rule, { trusted: true });\n    }\n  }\n}\n\nfunction configureThirdPartyLibraries(config: AllConfig): void {\n  // Not using early return style to make clear what's the criterion to set the variables,\n  // especially when there is more stuff added here in the future.\n  if (!config.useCloudMetadataServices) {\n    logger.debug('Disabling the use of cloud metadata services');\n    process.env.AWS_EC2_METADATA_DISABLED = 'true'; // See https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html#envvars-list\n    process.env.METADATA_SERVER_DETECTION = 'none'; // See https://cloud.google.com/nodejs/docs/reference/gcp-metadata/latest#environment-variables\n  }\n}\n\nexport async function globalInitialize(\n  config_: AllConfig,\n): Promise<RenovateConfig> {\n  let config = config_;\n  setHttpRateLimits();\n  await checkVersions();\n  setGlobalHostRules(config);\n  config = await initPlatform(config);\n  config = await setDirectories(config);\n  await packageCache.init(config);\n  limitCommitsPerRun(config);\n  setEmojiConfig(config);\n  // registered a second time in case initialization changed them\n  setGlobalHostRules(config);\n  configureThirdPartyLibraries(config);\n  await initMergeConfidence(config);\n  return config;\n}\n\nexport async function globalFinalize(config: RenovateConfig): Promise<void> {\n  await packageCache.cleanup(config);\n  resetGlobalLogLevelRemaps();\n}\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,eAAe,eAAe,OAAsC;CAClE,MAAM,SAAoB,EAAE,GAAG,MAAM;CACrC,QAAQ,IAAI,SAAS,QAAQ,IAAI,mBAAmB,GAAG,OAAO;CAC9D,IAAI,OAAO,SACT,OAAO,MAAM,6BAA6B,OAAO,SAAS;MACrD;EACL,OAAO,UAAU,MAAM,KAAK,QAAQ,IAAI,QAAQ,UAAU;EAC1D,OAAO,MAAM,kBAAkB,OAAO,SAAS;CACjD;CACA,MAAM,GAAG,UAAU,OAAO,OAAO;CACjC,IAAI,OAAO,UACT,OAAO,MAAM,8BAA8B,OAAO,UAAU;MACvD;EACL,OAAO,WAAW,MAAM,KAAK,OAAO,SAAS,OAAO;EACpD,OAAO,MAAM,mBAAmB,OAAO,UAAU;CACnD;CACA,MAAM,GAAG,UAAU,OAAO,QAAQ;CAClC,IAAI,OAAO,iBAAiB,YAAY,OAAO,iBAAiB,WAAW;EACzE,IAAI,OAAO,kBACT,OAAO,MACL,sCAAsC,OAAO,kBAC/C;OACK;GACL,OAAO,mBAAmB,MAAM,KAAK,OAAO,UAAU,eAAe;GACrE,OAAO,MAAM,2BAA2B,OAAO,kBAAkB;EACnE;EACA,MAAM,GAAG,UAAU,OAAO,gBAAgB;CAC5C;CACA,OAAO;AACT;AAEA,SAAS,mBAAmB,QAA8B;CACxD,MAAM,QAAQ,OAAO;CACrB,YAAY,WAAW,OAAO,UAAU,YAAY,QAAQ,IAAI,QAAQ,IAAI;AAC9E;AAEA,eAAe,gBAA+B;CAE5C,IAAI,CAAC,MADyB,mBAAmB,GAE/C,MAAM,IAAI,MAAM,mCAAmC;AAEvD;AAEA,SAAS,mBAAmB,QAAyB;CACnD,IAAI,OAAO,WAAW;EACpB,OAAO,MAAM,0BAA0B;EACvC,iCAAiC;GAC/B;GACA,iBAAiB;GACjB,eAAe;EACjB,CAAC;EACD,KAAK,MAAM,QAAQ,OAAO,WAExB,IAAc,MAAM,EAAE,SAAS,KAAK,CAAC;CAEzC;AACF;AAEA,SAAS,6BAA6B,QAAyB;CAG7D,IAAI,CAAC,OAAO,0BAA0B;EACpC,OAAO,MAAM,8CAA8C;EAC3D,QAAQ,IAAI,4BAA4B;EACxC,QAAQ,IAAI,4BAA4B;CAC1C;AACF;AAEA,eAAsB,iBACpB,SACyB;CACzB,IAAI,SAAS;CACb,kBAAkB;CAClB,MAAM,cAAc;CACpB,mBAAmB,MAAM;CACzB,SAAS,MAAM,aAAa,MAAM;CAClC,SAAS,MAAM,eAAe,MAAM;CACpC,MAAMA,KAAkB,MAAM;CAC9B,mBAAmB,MAAM;CACzB,eAAe,MAAM;CAErB,mBAAmB,MAAM;CACzB,6BAA6B,MAAM;CACnC,MAAM,oBAAoB,MAAM;CAChC,OAAO;AACT;AAEA,eAAsB,eAAe,QAAuC;CAC1E,MAAMC,QAAqB,MAAM;CACjC,0BAA0B;AAC5B"}
+{"version":3,"file":"initialize.js","names":["packageCache.init","packageCache.cleanup"],"sources":["../../../lib/workers/global/initialize.ts"],"sourcesContent":["import os from 'node:os';\nimport {\n  isContainerbase,\n  validateContainerbaseVersion,\n} from '@renovatebot/base-image';\nimport fs from 'fs-extra';\nimport upath from 'upath';\nimport { applySecretsAndVariablesToConfig } from '../../config/secrets.ts';\nimport type { AllConfig, RenovateConfig } from '../../config/types.ts';\nimport { logger } from '../../logger/index.ts';\nimport { resetGlobalLogLevelRemaps } from '../../logger/remap.ts';\nimport { initPlatform } from '../../modules/platform/index.ts';\nimport * as packageCache from '../../util/cache/package/index.ts';\nimport { setEmojiConfig } from '../../util/emoji.ts';\nimport { validateGitVersion } from '../../util/git/index.ts';\nimport * as hostRules from '../../util/host-rules.ts';\nimport { setHttpRateLimits } from '../../util/http/rate-limits.ts';\nimport { initMergeConfidence } from '../../util/merge-confidence/index.ts';\nimport { setMaxLimit } from './limits.ts';\n\nasync function setDirectories(input: AllConfig): Promise<AllConfig> {\n  const config: AllConfig = { ...input };\n  process.env.TMPDIR = process.env.RENOVATE_TMPDIR ?? os.tmpdir();\n  if (config.baseDir) {\n    logger.debug(`Using configured baseDir: ${config.baseDir}`);\n  } else {\n    config.baseDir = upath.join(process.env.TMPDIR, 'renovate');\n    logger.debug(`Using baseDir: ${config.baseDir}`);\n  }\n  await fs.ensureDir(config.baseDir);\n  if (config.cacheDir) {\n    logger.debug(`Using configured cacheDir: ${config.cacheDir}`);\n  } else {\n    config.cacheDir = upath.join(config.baseDir, 'cache');\n    logger.debug(`Using cacheDir: ${config.cacheDir}`);\n  }\n  await fs.ensureDir(config.cacheDir);\n  if (config.binarySource === 'docker' || config.binarySource === 'install') {\n    if (config.containerbaseDir) {\n      logger.debug(\n        `Using configured containerbaseDir: ${config.containerbaseDir}`,\n      );\n    } else {\n      config.containerbaseDir = upath.join(config.cacheDir, 'containerbase');\n      logger.debug(`Using containerbaseDir: ${config.containerbaseDir}`);\n    }\n    await fs.ensureDir(config.containerbaseDir);\n  }\n  return config;\n}\n\nfunction limitCommitsPerRun(config: RenovateConfig): void {\n  const limit = config.prCommitsPerRunLimit;\n  setMaxLimit('Commits', typeof limit === 'number' && limit > 0 ? limit : null);\n}\n\n/**\n * Checks that the Containerbase image version is compatible with Renovate.\n *\n * Can be skipped using `RENOVATE_X_IGNORE_CONTAINERBASE_VERSION`, which is\n * read from the process environment only.\n */\nasync function checkContainerbaseVersion(): Promise<void> {\n  if (!isContainerbase()) {\n    return;\n  }\n  if (process.env.RENOVATE_X_IGNORE_CONTAINERBASE_VERSION) {\n    logger.info(\n      'Containerbase version check is skipped via RENOVATE_X_IGNORE_CONTAINERBASE_VERSION',\n    );\n    return;\n  }\n  try {\n    const version = await validateContainerbaseVersion();\n    logger.debug({ version }, 'Containerbase image version is compatible');\n  } catch (err) {\n    throw new Error(\n      `Init: containerbase image version check failed: ${err.message}. Upgrade your version of Containerbase, or set \\`RENOVATE_X_IGNORE_CONTAINERBASE_VERSION\\` to skip the check.`,\n    );\n  }\n}\n\n/**\n * Checks the versions of the tools and the image Renovate depends on.\n */\nasync function checkVersions(): Promise<void> {\n  const validGitVersion = await validateGitVersion();\n  if (!validGitVersion) {\n    throw new Error('Init: git version needs upgrading');\n  }\n  await checkContainerbaseVersion();\n}\n\nfunction setGlobalHostRules(config: AllConfig): void {\n  if (config.hostRules) {\n    logger.debug('Setting global hostRules');\n    applySecretsAndVariablesToConfig({\n      config,\n      deleteVariables: false,\n      deleteSecrets: false,\n    });\n    for (const rule of config.hostRules) {\n      // the self-hosted admin's own rules: `trusted`, so that their `headers` are applied over any a repository or preset sets for the same host, and exempt from `allowedHeaders` altogether - `allowedHeaders` constrains what a repository or preset may set, not the administrator, mirroring how `allowedEnv` does not constrain the administrator's own `env`\n      hostRules.add(rule, { trusted: true });\n    }\n  }\n}\n\nfunction configureThirdPartyLibraries(config: AllConfig): void {\n  // Not using early return style to make clear what's the criterion to set the variables,\n  // especially when there is more stuff added here in the future.\n  if (!config.useCloudMetadataServices) {\n    logger.debug('Disabling the use of cloud metadata services');\n    process.env.AWS_EC2_METADATA_DISABLED = 'true'; // See https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html#envvars-list\n    process.env.METADATA_SERVER_DETECTION = 'none'; // See https://cloud.google.com/nodejs/docs/reference/gcp-metadata/latest#environment-variables\n  }\n}\n\nexport async function globalInitialize(\n  config_: AllConfig,\n): Promise<RenovateConfig> {\n  let config = config_;\n  setHttpRateLimits();\n  await checkVersions();\n  setGlobalHostRules(config);\n  config = await initPlatform(config);\n  config = await setDirectories(config);\n  await packageCache.init(config);\n  limitCommitsPerRun(config);\n  setEmojiConfig(config);\n  // registered a second time in case initialization changed them\n  setGlobalHostRules(config);\n  configureThirdPartyLibraries(config);\n  await initMergeConfidence(config);\n  return config;\n}\n\nexport async function globalFinalize(config: RenovateConfig): Promise<void> {\n  await packageCache.cleanup(config);\n  resetGlobalLogLevelRemaps();\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,eAAe,eAAe,OAAsC;CAClE,MAAM,SAAoB,EAAE,GAAG,MAAM;CACrC,QAAQ,IAAI,SAAS,QAAQ,IAAI,mBAAmB,GAAG,OAAO;CAC9D,IAAI,OAAO,SACT,OAAO,MAAM,6BAA6B,OAAO,SAAS;MACrD;EACL,OAAO,UAAU,MAAM,KAAK,QAAQ,IAAI,QAAQ,UAAU;EAC1D,OAAO,MAAM,kBAAkB,OAAO,SAAS;CACjD;CACA,MAAM,GAAG,UAAU,OAAO,OAAO;CACjC,IAAI,OAAO,UACT,OAAO,MAAM,8BAA8B,OAAO,UAAU;MACvD;EACL,OAAO,WAAW,MAAM,KAAK,OAAO,SAAS,OAAO;EACpD,OAAO,MAAM,mBAAmB,OAAO,UAAU;CACnD;CACA,MAAM,GAAG,UAAU,OAAO,QAAQ;CAClC,IAAI,OAAO,iBAAiB,YAAY,OAAO,iBAAiB,WAAW;EACzE,IAAI,OAAO,kBACT,OAAO,MACL,sCAAsC,OAAO,kBAC/C;OACK;GACL,OAAO,mBAAmB,MAAM,KAAK,OAAO,UAAU,eAAe;GACrE,OAAO,MAAM,2BAA2B,OAAO,kBAAkB;EACnE;EACA,MAAM,GAAG,UAAU,OAAO,gBAAgB;CAC5C;CACA,OAAO;AACT;AAEA,SAAS,mBAAmB,QAA8B;CACxD,MAAM,QAAQ,OAAO;CACrB,YAAY,WAAW,OAAO,UAAU,YAAY,QAAQ,IAAI,QAAQ,IAAI;AAC9E;;;;;;;AAQA,eAAe,4BAA2C;CACxD,IAAI,CAAC,gBAAgB,GACnB;CAEF,IAAI,QAAQ,IAAI,yCAAyC;EACvD,OAAO,KACL,oFACF;EACA;CACF;CACA,IAAI;EACF,MAAM,UAAU,MAAM,6BAA6B;EACnD,OAAO,MAAM,EAAE,QAAQ,GAAG,2CAA2C;CACvE,SAAS,KAAK;EACZ,MAAM,IAAI,MACR,mDAAmD,IAAI,QAAQ,+GACjE;CACF;AACF;;;;AAKA,eAAe,gBAA+B;CAE5C,IAAI,CAAC,MADyB,mBAAmB,GAE/C,MAAM,IAAI,MAAM,mCAAmC;CAErD,MAAM,0BAA0B;AAClC;AAEA,SAAS,mBAAmB,QAAyB;CACnD,IAAI,OAAO,WAAW;EACpB,OAAO,MAAM,0BAA0B;EACvC,iCAAiC;GAC/B;GACA,iBAAiB;GACjB,eAAe;EACjB,CAAC;EACD,KAAK,MAAM,QAAQ,OAAO,WAExB,IAAc,MAAM,EAAE,SAAS,KAAK,CAAC;CAEzC;AACF;AAEA,SAAS,6BAA6B,QAAyB;CAG7D,IAAI,CAAC,OAAO,0BAA0B;EACpC,OAAO,MAAM,8CAA8C;EAC3D,QAAQ,IAAI,4BAA4B;EACxC,QAAQ,IAAI,4BAA4B;CAC1C;AACF;AAEA,eAAsB,iBACpB,SACyB;CACzB,IAAI,SAAS;CACb,kBAAkB;CAClB,MAAM,cAAc;CACpB,mBAAmB,MAAM;CACzB,SAAS,MAAM,aAAa,MAAM;CAClC,SAAS,MAAM,eAAe,MAAM;CACpC,MAAMA,KAAkB,MAAM;CAC9B,mBAAmB,MAAM;CACzB,eAAe,MAAM;CAErB,mBAAmB,MAAM;CACzB,6BAA6B,MAAM;CACnC,MAAM,oBAAoB,MAAM;CAChC,OAAO;AACT;AAEA,eAAsB,eAAe,QAAuC;CAC1E,MAAMC,QAAqB,MAAM;CACjC,0BAA0B;AAC5B"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "renovate",
   "description": "Automated dependency updates. Flexible so you don't need to be.",
-  "version": "44.177.0",
+  "version": "44.178.0",
   "type": "module",
   "bin": {
     "renovate": "dist/renovate.js",

package/renovate-schema.json

@@ -1,8 +1,8 @@
 {
   "$id": "https://docs.renovatebot.com/renovate-schema.json",
-  "title": "JSON schema for Renovate 44.177.0 config files (https://renovatebot.com/)",
+  "title": "JSON schema for Renovate 44.178.0 config files (https://renovatebot.com/)",
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "x-renovate-version": "44.177.0",
+  "x-renovate-version": "44.178.0",
   "allowComments": true,
   "type": "object",
   "definitions": {