renovate 44.19.0 → 44.20.0

package/dist/modules/manager/types.d.ts

@@ -155,6 +155,13 @@ interface PackageDependency<T = Record<string, any>, DepType extends string = st
   datasource?: string;
   deprecationMessage?: string;
   digestOneAndOnly?: boolean;
+  /**
+   * The digest for this dependency is managed externally (for instance in a lockfile) instead of alongside the package file's version,
+   * so Renovate must not pin the digest inline.
+   *
+   * As this is due to the package ecossytem/manager in use, this shouldn't be overridable by `packageRules`
+   */
+  digestManagedExternally?: boolean;
   fixedVersion?: string;
   currentVersion?: string;
   currentVersionTimestamp?: string;

package/dist/util/exec/containerbase.js

@@ -76,6 +76,11 @@ const allToolConfig = {
 		packageName: "fluxcd/flux2",
 		versioning: "semver"
 	},
+	gh: {
+		datasource: "github-releases",
+		packageName: "cli/cli",
+		versioning: "semver"
+	},
 	gleam: {
 		datasource: "github-releases",
 		packageName: "gleam-lang/gleam",

package/dist/util/exec/containerbase.js.map

@@ -1 +1 @@
-{"version":3,"file":"containerbase.js","names":[],"sources":["../../../lib/util/exec/containerbase.ts"],"sourcesContent":["import { isString } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport { GlobalConfig } from '../../config/global.ts';\nimport { logger } from '../../logger/index.ts';\nimport type { ReleaseResult } from '../../modules/datasource/index.ts';\nimport type { VersioningApi } from '../../modules/versioning/types.ts';\nimport { getEnv } from '../env.ts';\nimport type { Opt, ToolConfig, ToolConstraint, ToolName } from './types.ts';\n\nexport const allToolConfig: Record<ToolName, ToolConfig> = {\n  bazelisk: {\n    datasource: 'github-releases',\n    packageName: 'bazelbuild/bazelisk',\n    versioning: 'semver',\n  },\n  bun: {\n    datasource: 'github-releases',\n    packageName: 'oven-sh/bun',\n    extractVersion: '^bun-v(?<version>.*)$',\n    versioning: 'npm',\n  },\n  bundler: {\n    datasource: 'rubygems',\n    packageName: 'bundler',\n    versioning: 'ruby',\n  },\n  cocoapods: {\n    datasource: 'rubygems',\n    packageName: 'cocoapods',\n    versioning: 'ruby',\n  },\n  composer: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/composer-prebuild',\n    versioning: 'composer',\n  },\n  conan: {\n    datasource: 'pypi',\n    packageName: 'conan',\n    versioning: 'pep440',\n  },\n  copier: {\n    datasource: 'pypi',\n    packageName: 'copier',\n    versioning: 'pep440',\n  },\n  corepack: {\n    datasource: 'npm',\n    packageName: 'corepack',\n    versioning: 'npm',\n  },\n  deno: {\n    datasource: 'github-releases',\n    packageName: 'denoland/deno',\n    versioning: 'deno',\n  },\n  devbox: {\n    datasource: 'github-releases',\n    packageName: 'jetify-com/devbox',\n    versioning: 'semver',\n  },\n  dotnet: {\n    datasource: 'dotnet-version',\n    packageName: 'dotnet-sdk',\n    versioning: 'semver',\n  },\n  erlang: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/erlang-prebuild',\n    versioning: 'semver-coerced',\n  },\n  elixir: {\n    datasource: 'github-releases',\n    packageName: 'elixir-lang/elixir',\n    versioning: 'semver',\n  },\n  flux: {\n    datasource: 'github-releases',\n    packageName: 'fluxcd/flux2',\n    versioning: 'semver',\n  },\n  gleam: {\n    datasource: 'github-releases',\n    packageName: 'gleam-lang/gleam',\n    versioning: 'semver',\n  },\n  golang: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/golang-prebuild',\n    versioning: 'npm',\n  },\n  gradle: {\n    datasource: 'gradle-version',\n    packageName: 'gradle',\n    versioning: 'gradle',\n  },\n  hashin: {\n    datasource: 'pypi',\n    packageName: 'hashin',\n    versioning: 'pep440',\n  },\n  helm: {\n    datasource: 'github-releases',\n    packageName: 'helm/helm',\n    versioning: 'semver',\n  },\n  helmfile: {\n    datasource: 'github-releases',\n    packageName: 'helmfile/helmfile',\n    versioning: 'semver',\n  },\n  java: {\n    datasource: 'java-version',\n    packageName: 'java?system=true',\n    versioning: 'npm',\n  },\n  /* not used in Renovate */\n  'java-maven': {\n    datasource: 'java-version',\n    packageName: 'java?system=true',\n    versioning: 'maven',\n  },\n  jb: {\n    datasource: 'github-releases',\n    packageName: 'jsonnet-bundler/jsonnet-bundler',\n    versioning: 'semver',\n  },\n  kustomize: {\n    datasource: 'github-releases',\n    packageName: 'kubernetes-sigs/kustomize',\n    extractVersion: '^kustomize/v(?<version>.*)$',\n    versioning: 'semver',\n  },\n  maven: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/maven-prebuild',\n    versioning: 'maven',\n  },\n  mise: {\n    datasource: 'github-releases',\n    packageName: 'jdx/mise',\n    versioning: 'npm',\n  },\n  nix: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/nix-prebuild',\n    versioning: 'semver',\n  },\n  node: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/node-prebuild',\n    versioning: 'node',\n  },\n  npm: {\n    datasource: 'npm',\n    packageName: 'npm',\n    versioning: 'npm',\n  },\n  pdm: {\n    datasource: 'github-releases',\n    packageName: 'pdm-project/pdm',\n    versioning: 'semver',\n  },\n  php: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/php-prebuild',\n    versioning: 'composer',\n  },\n  'pip-tools': {\n    datasource: 'pypi',\n    packageName: 'pip-tools',\n    versioning: 'pep440',\n  },\n  pipenv: {\n    datasource: 'pypi',\n    packageName: 'pipenv',\n    versioning: 'pep440',\n  },\n  pnpm: {\n    datasource: 'npm',\n    packageName: 'pnpm',\n    versioning: 'npm',\n  },\n  pixi: {\n    datasource: 'github-releases',\n    packageName: 'prefix-dev/pixi',\n    versioning: 'conda',\n    extractVersion: '^v(?<version>.*)$',\n  },\n  poetry: {\n    datasource: 'pypi',\n    packageName: 'poetry',\n    versioning: 'pep440',\n  },\n  python: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/python-prebuild',\n    versioning: 'python',\n  },\n  ruby: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/ruby-prebuild',\n    versioning: 'ruby',\n  },\n  rust: {\n    datasource: 'rust-version',\n    packageName: 'rust',\n    versioning: 'rust-release-channel',\n  },\n  uv: {\n    datasource: 'pypi',\n    packageName: 'uv',\n    versioning: 'pep440',\n  },\n  yarn: {\n    datasource: 'npm',\n    packageName: 'yarn',\n    versioning: 'npm',\n  },\n  'yarn-slim': {\n    datasource: 'npm',\n    packageName: 'yarn',\n    versioning: 'npm',\n  },\n  dart: {\n    datasource: 'dart-version',\n    packageName: 'dart',\n    versioning: 'npm',\n  },\n  flutter: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/flutter-prebuild',\n    versioning: 'npm',\n  },\n  vendir: {\n    datasource: 'github-releases',\n    packageName: 'carvel-dev/vendir',\n    versioning: 'semver',\n  },\n} as const;\n\nlet _getPkgReleases: Promise<\n  typeof import('../../modules/datasource/index.ts')\n> | null = null;\n\nasync function getPkgReleases(\n  toolConfig: ToolConfig,\n): Promise<ReleaseResult | null> {\n  _getPkgReleases ??= import('../../modules/datasource/index.ts');\n  const { getPkgReleases } = await _getPkgReleases;\n  return getPkgReleases(toolConfig);\n}\n\nexport function getToolConfig(toolName: ToolName): ToolConfig {\n  return allToolConfig[toolName];\n}\n\nexport function supportsDynamicInstall(toolName: ToolName): boolean {\n  return !!allToolConfig[toolName];\n}\n\nexport function isContainerbase(): boolean {\n  return !!getEnv().CONTAINERBASE;\n}\n\nexport function isDynamicInstall(\n  toolConstraints?: Opt<ToolConstraint[]>,\n): boolean {\n  if (GlobalConfig.get('binarySource') !== 'install') {\n    return false;\n  }\n  if (!isContainerbase()) {\n    logger.debug('Falling back to binarySource=global');\n    return false;\n  }\n  return (\n    !toolConstraints ||\n    toolConstraints.every((toolConstraint) =>\n      supportsDynamicInstall(toolConstraint.toolName),\n    )\n  );\n}\n\nfunction isStable(\n  version: string,\n  versioningApi: VersioningApi,\n  latest?: string,\n): boolean {\n  if (!versioningApi.isStable(version)) {\n    return false;\n  }\n  if (isString(latest) && versioningApi.isGreaterThan(version, latest)) {\n    return false;\n  }\n  return true;\n}\n\nexport async function resolveConstraint(\n  toolConstraint: ToolConstraint,\n): Promise<string> {\n  const { toolName } = toolConstraint;\n  const toolConfig = allToolConfig[toolName];\n  if (!toolConfig) {\n    throw new Error(`Invalid tool to install: ${toolName}`);\n  }\n\n  const { get: getVersioning } =\n    await import('../../modules/versioning/index.ts');\n  const versioning = getVersioning(toolConfig.versioning);\n  let constraint = toolConstraint.constraint;\n  if (constraint) {\n    if (versioning.isValid(constraint)) {\n      if (versioning.isSingleVersion(constraint)) {\n        return constraint.replace(/^=+/, '').trim();\n      }\n    } else {\n      logger.warn(\n        { toolName, constraint, versioning: toolConfig.versioning },\n        'Invalid tool constraint',\n      );\n      constraint = undefined;\n    }\n  }\n\n  const pkgReleases = await getPkgReleases(toolConfig);\n  const releases = pkgReleases?.releases ?? [];\n\n  if (!releases?.length) {\n    logger.warn({ toolConfig }, 'No tool releases found.');\n    throw new Error('No tool releases found.');\n  }\n\n  const matchingReleases = releases.filter(\n    (r) => !constraint || versioning.matches(r.version, constraint),\n  );\n\n  const stableMatchingVersion = matchingReleases\n    .filter((r) => isStable(r.version, versioning, pkgReleases?.tags?.latest))\n    .pop()?.version;\n  if (stableMatchingVersion) {\n    logger.debug(\n      { toolName, constraint, resolvedVersion: stableMatchingVersion },\n      'Resolved stable matching version',\n    );\n    return stableMatchingVersion;\n  }\n\n  const unstableMatchingVersion = matchingReleases.pop()?.version;\n  if (unstableMatchingVersion) {\n    logger.debug(\n      { toolName, constraint, resolvedVersion: unstableMatchingVersion },\n      'Resolved unstable matching version',\n    );\n    return unstableMatchingVersion;\n  }\n\n  const stableVersion = releases\n    .filter((r) => isStable(r.version, versioning, pkgReleases?.tags?.latest))\n    .pop()?.version;\n  if (stableVersion) {\n    logger.warn(\n      { toolName, constraint, stableVersion },\n      'No matching tool versions found for constraint - using latest stable version',\n    );\n  }\n\n  const highestVersion = releases.pop()!.version;\n  logger.warn(\n    { toolName, constraint, highestVersion },\n    'No matching or stable tool versions found - using an unstable version',\n  );\n  return highestVersion;\n}\n\nexport async function generateInstallCommands(\n  toolConstraints: Opt<ToolConstraint[]>,\n): Promise<string[]> {\n  const installCommands: string[] = [];\n  if (toolConstraints?.length) {\n    for (const toolConstraint of toolConstraints) {\n      const toolVersion = await resolveConstraint(toolConstraint);\n      const { toolName } = toolConstraint;\n      const installCommand = `install-tool ${toolName} ${quote(toolVersion)}`;\n      installCommands.push(installCommand);\n    }\n  }\n  return installCommands;\n}\n"],"mappings":";;;;;;AASA,MAAa,gBAA8C;CACzD,UAAU;EACR,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,KAAK;EACH,YAAY;EACZ,aAAa;EACb,gBAAgB;EAChB,YAAY;CACd;CACA,SAAS;EACP,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,WAAW;EACT,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,UAAU;EACR,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,OAAO;EACL,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,UAAU;EACR,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,OAAO;EACL,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,UAAU;EACR,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CAEA,cAAc;EACZ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,IAAI;EACF,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,WAAW;EACT,YAAY;EACZ,aAAa;EACb,gBAAgB;EAChB,YAAY;CACd;CACA,OAAO;EACL,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,KAAK;EACH,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,KAAK;EACH,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,KAAK;EACH,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,KAAK;EACH,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,aAAa;EACX,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,IAAI;EACF,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,aAAa;EACX,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,SAAS;EACP,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;AACF;AAEA,IAAI,kBAEO;AAEX,eAAe,eACb,YAC+B;CAC/B,oBAAoB,OAAO;CAC3B,MAAM,EAAE,mBAAmB,MAAM;CACjC,OAAO,eAAe,UAAU;AAClC;AAEA,SAAgB,cAAc,UAAgC;CAC5D,OAAO,cAAc;AACvB;AAEA,SAAgB,uBAAuB,UAA6B;CAClE,OAAO,CAAC,CAAC,cAAc;AACzB;AAEA,SAAgB,kBAA2B;CACzC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;AACpB;AAEA,SAAgB,iBACd,iBACS;CACT,IAAI,aAAa,IAAI,cAAc,MAAM,WACvC,OAAO;CAET,IAAI,CAAC,gBAAgB,GAAG;EACtB,OAAO,MAAM,qCAAqC;EAClD,OAAO;CACT;CACA,OACE,CAAC,mBACD,gBAAgB,OAAO,mBACrB,uBAAuB,eAAe,QAAQ,CAChD;AAEJ;AAEA,SAAS,SACP,SACA,eACA,QACS;CACT,IAAI,CAAC,cAAc,SAAS,OAAO,GACjC,OAAO;CAET,IAAI,SAAS,MAAM,KAAK,cAAc,cAAc,SAAS,MAAM,GACjE,OAAO;CAET,OAAO;AACT;AAEA,eAAsB,kBACpB,gBACiB;CACjB,MAAM,EAAE,aAAa;CACrB,MAAM,aAAa,cAAc;CACjC,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,4BAA4B,UAAU;CAGxD,MAAM,EAAE,KAAK,kBACX,MAAM,OAAO;CACf,MAAM,aAAa,cAAc,WAAW,UAAU;CACtD,IAAI,aAAa,eAAe;CAChC,IAAI,YACF,IAAI,WAAW,QAAQ,UAAU,GAC3B;MAAA,WAAW,gBAAgB,UAAU,GACvC,OAAO,WAAW,QAAQ,OAAO,EAAE,CAAC,CAAC,KAAK;CAAA,OAEvC;EACL,OAAO,KACL;GAAE;GAAU;GAAY,YAAY,WAAW;EAAW,GAC1D,yBACF;EACA,aAAa,KAAA;CACf;CAGF,MAAM,cAAc,MAAM,eAAe,UAAU;CACnD,MAAM,WAAW,aAAa,YAAY,CAAC;CAE3C,IAAI,CAAC,UAAU,QAAQ;EACrB,OAAO,KAAK,EAAE,WAAW,GAAG,yBAAyB;EACrD,MAAM,IAAI,MAAM,yBAAyB;CAC3C;CAEA,MAAM,mBAAmB,SAAS,QAC/B,MAAM,CAAC,cAAc,WAAW,QAAQ,EAAE,SAAS,UAAU,CAChE;CAEA,MAAM,wBAAwB,iBAC3B,QAAQ,MAAM,SAAS,EAAE,SAAS,YAAY,aAAa,MAAM,MAAM,CAAC,CAAC,CACzE,IAAI,CAAC,EAAE;CACV,IAAI,uBAAuB;EACzB,OAAO,MACL;GAAE;GAAU;GAAY,iBAAiB;EAAsB,GAC/D,kCACF;EACA,OAAO;CACT;CAEA,MAAM,0BAA0B,iBAAiB,IAAI,CAAC,EAAE;CACxD,IAAI,yBAAyB;EAC3B,OAAO,MACL;GAAE;GAAU;GAAY,iBAAiB;EAAwB,GACjE,oCACF;EACA,OAAO;CACT;CAEA,MAAM,gBAAgB,SACnB,QAAQ,MAAM,SAAS,EAAE,SAAS,YAAY,aAAa,MAAM,MAAM,CAAC,CAAC,CACzE,IAAI,CAAC,EAAE;CACV,IAAI,eACF,OAAO,KACL;EAAE;EAAU;EAAY;CAAc,GACtC,8EACF;CAGF,MAAM,iBAAiB,SAAS,IAAI,CAAC,CAAE;CACvC,OAAO,KACL;EAAE;EAAU;EAAY;CAAe,GACvC,uEACF;CACA,OAAO;AACT;AAEA,eAAsB,wBACpB,iBACmB;CACnB,MAAM,kBAA4B,CAAC;CACnC,IAAI,iBAAiB,QACnB,KAAK,MAAM,kBAAkB,iBAAiB;EAC5C,MAAM,cAAc,MAAM,kBAAkB,cAAc;EAC1D,MAAM,EAAE,aAAa;EACrB,MAAM,iBAAiB,gBAAgB,SAAS,GAAG,MAAM,WAAW;EACpE,gBAAgB,KAAK,cAAc;CACrC;CAEF,OAAO;AACT"}
+{"version":3,"file":"containerbase.js","names":[],"sources":["../../../lib/util/exec/containerbase.ts"],"sourcesContent":["import { isString } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport { GlobalConfig } from '../../config/global.ts';\nimport { logger } from '../../logger/index.ts';\nimport type { ReleaseResult } from '../../modules/datasource/index.ts';\nimport type { VersioningApi } from '../../modules/versioning/types.ts';\nimport { getEnv } from '../env.ts';\nimport type { Opt, ToolConfig, ToolConstraint, ToolName } from './types.ts';\n\nexport const allToolConfig: Record<ToolName, ToolConfig> = {\n  bazelisk: {\n    datasource: 'github-releases',\n    packageName: 'bazelbuild/bazelisk',\n    versioning: 'semver',\n  },\n  bun: {\n    datasource: 'github-releases',\n    packageName: 'oven-sh/bun',\n    extractVersion: '^bun-v(?<version>.*)$',\n    versioning: 'npm',\n  },\n  bundler: {\n    datasource: 'rubygems',\n    packageName: 'bundler',\n    versioning: 'ruby',\n  },\n  cocoapods: {\n    datasource: 'rubygems',\n    packageName: 'cocoapods',\n    versioning: 'ruby',\n  },\n  composer: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/composer-prebuild',\n    versioning: 'composer',\n  },\n  conan: {\n    datasource: 'pypi',\n    packageName: 'conan',\n    versioning: 'pep440',\n  },\n  copier: {\n    datasource: 'pypi',\n    packageName: 'copier',\n    versioning: 'pep440',\n  },\n  corepack: {\n    datasource: 'npm',\n    packageName: 'corepack',\n    versioning: 'npm',\n  },\n  deno: {\n    datasource: 'github-releases',\n    packageName: 'denoland/deno',\n    versioning: 'deno',\n  },\n  devbox: {\n    datasource: 'github-releases',\n    packageName: 'jetify-com/devbox',\n    versioning: 'semver',\n  },\n  dotnet: {\n    datasource: 'dotnet-version',\n    packageName: 'dotnet-sdk',\n    versioning: 'semver',\n  },\n  erlang: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/erlang-prebuild',\n    versioning: 'semver-coerced',\n  },\n  elixir: {\n    datasource: 'github-releases',\n    packageName: 'elixir-lang/elixir',\n    versioning: 'semver',\n  },\n  flux: {\n    datasource: 'github-releases',\n    packageName: 'fluxcd/flux2',\n    versioning: 'semver',\n  },\n  gh: {\n    datasource: 'github-releases',\n    packageName: 'cli/cli',\n    versioning: 'semver',\n  },\n  gleam: {\n    datasource: 'github-releases',\n    packageName: 'gleam-lang/gleam',\n    versioning: 'semver',\n  },\n  golang: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/golang-prebuild',\n    versioning: 'npm',\n  },\n  gradle: {\n    datasource: 'gradle-version',\n    packageName: 'gradle',\n    versioning: 'gradle',\n  },\n  hashin: {\n    datasource: 'pypi',\n    packageName: 'hashin',\n    versioning: 'pep440',\n  },\n  helm: {\n    datasource: 'github-releases',\n    packageName: 'helm/helm',\n    versioning: 'semver',\n  },\n  helmfile: {\n    datasource: 'github-releases',\n    packageName: 'helmfile/helmfile',\n    versioning: 'semver',\n  },\n  java: {\n    datasource: 'java-version',\n    packageName: 'java?system=true',\n    versioning: 'npm',\n  },\n  /* not used in Renovate */\n  'java-maven': {\n    datasource: 'java-version',\n    packageName: 'java?system=true',\n    versioning: 'maven',\n  },\n  jb: {\n    datasource: 'github-releases',\n    packageName: 'jsonnet-bundler/jsonnet-bundler',\n    versioning: 'semver',\n  },\n  kustomize: {\n    datasource: 'github-releases',\n    packageName: 'kubernetes-sigs/kustomize',\n    extractVersion: '^kustomize/v(?<version>.*)$',\n    versioning: 'semver',\n  },\n  maven: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/maven-prebuild',\n    versioning: 'maven',\n  },\n  mise: {\n    datasource: 'github-releases',\n    packageName: 'jdx/mise',\n    versioning: 'npm',\n  },\n  nix: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/nix-prebuild',\n    versioning: 'semver',\n  },\n  node: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/node-prebuild',\n    versioning: 'node',\n  },\n  npm: {\n    datasource: 'npm',\n    packageName: 'npm',\n    versioning: 'npm',\n  },\n  pdm: {\n    datasource: 'github-releases',\n    packageName: 'pdm-project/pdm',\n    versioning: 'semver',\n  },\n  php: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/php-prebuild',\n    versioning: 'composer',\n  },\n  'pip-tools': {\n    datasource: 'pypi',\n    packageName: 'pip-tools',\n    versioning: 'pep440',\n  },\n  pipenv: {\n    datasource: 'pypi',\n    packageName: 'pipenv',\n    versioning: 'pep440',\n  },\n  pnpm: {\n    datasource: 'npm',\n    packageName: 'pnpm',\n    versioning: 'npm',\n  },\n  pixi: {\n    datasource: 'github-releases',\n    packageName: 'prefix-dev/pixi',\n    versioning: 'conda',\n    extractVersion: '^v(?<version>.*)$',\n  },\n  poetry: {\n    datasource: 'pypi',\n    packageName: 'poetry',\n    versioning: 'pep440',\n  },\n  python: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/python-prebuild',\n    versioning: 'python',\n  },\n  ruby: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/ruby-prebuild',\n    versioning: 'ruby',\n  },\n  rust: {\n    datasource: 'rust-version',\n    packageName: 'rust',\n    versioning: 'rust-release-channel',\n  },\n  uv: {\n    datasource: 'pypi',\n    packageName: 'uv',\n    versioning: 'pep440',\n  },\n  yarn: {\n    datasource: 'npm',\n    packageName: 'yarn',\n    versioning: 'npm',\n  },\n  'yarn-slim': {\n    datasource: 'npm',\n    packageName: 'yarn',\n    versioning: 'npm',\n  },\n  dart: {\n    datasource: 'dart-version',\n    packageName: 'dart',\n    versioning: 'npm',\n  },\n  flutter: {\n    datasource: 'github-releases',\n    packageName: 'containerbase/flutter-prebuild',\n    versioning: 'npm',\n  },\n  vendir: {\n    datasource: 'github-releases',\n    packageName: 'carvel-dev/vendir',\n    versioning: 'semver',\n  },\n} as const;\n\nlet _getPkgReleases: Promise<\n  typeof import('../../modules/datasource/index.ts')\n> | null = null;\n\nasync function getPkgReleases(\n  toolConfig: ToolConfig,\n): Promise<ReleaseResult | null> {\n  _getPkgReleases ??= import('../../modules/datasource/index.ts');\n  const { getPkgReleases } = await _getPkgReleases;\n  return getPkgReleases(toolConfig);\n}\n\nexport function getToolConfig(toolName: ToolName): ToolConfig {\n  return allToolConfig[toolName];\n}\n\nexport function supportsDynamicInstall(toolName: ToolName): boolean {\n  return !!allToolConfig[toolName];\n}\n\nexport function isContainerbase(): boolean {\n  return !!getEnv().CONTAINERBASE;\n}\n\nexport function isDynamicInstall(\n  toolConstraints?: Opt<ToolConstraint[]>,\n): boolean {\n  if (GlobalConfig.get('binarySource') !== 'install') {\n    return false;\n  }\n  if (!isContainerbase()) {\n    logger.debug('Falling back to binarySource=global');\n    return false;\n  }\n  return (\n    !toolConstraints ||\n    toolConstraints.every((toolConstraint) =>\n      supportsDynamicInstall(toolConstraint.toolName),\n    )\n  );\n}\n\nfunction isStable(\n  version: string,\n  versioningApi: VersioningApi,\n  latest?: string,\n): boolean {\n  if (!versioningApi.isStable(version)) {\n    return false;\n  }\n  if (isString(latest) && versioningApi.isGreaterThan(version, latest)) {\n    return false;\n  }\n  return true;\n}\n\nexport async function resolveConstraint(\n  toolConstraint: ToolConstraint,\n): Promise<string> {\n  const { toolName } = toolConstraint;\n  const toolConfig = allToolConfig[toolName];\n  if (!toolConfig) {\n    throw new Error(`Invalid tool to install: ${toolName}`);\n  }\n\n  const { get: getVersioning } =\n    await import('../../modules/versioning/index.ts');\n  const versioning = getVersioning(toolConfig.versioning);\n  let constraint = toolConstraint.constraint;\n  if (constraint) {\n    if (versioning.isValid(constraint)) {\n      if (versioning.isSingleVersion(constraint)) {\n        return constraint.replace(/^=+/, '').trim();\n      }\n    } else {\n      logger.warn(\n        { toolName, constraint, versioning: toolConfig.versioning },\n        'Invalid tool constraint',\n      );\n      constraint = undefined;\n    }\n  }\n\n  const pkgReleases = await getPkgReleases(toolConfig);\n  const releases = pkgReleases?.releases ?? [];\n\n  if (!releases?.length) {\n    logger.warn({ toolConfig }, 'No tool releases found.');\n    throw new Error('No tool releases found.');\n  }\n\n  const matchingReleases = releases.filter(\n    (r) => !constraint || versioning.matches(r.version, constraint),\n  );\n\n  const stableMatchingVersion = matchingReleases\n    .filter((r) => isStable(r.version, versioning, pkgReleases?.tags?.latest))\n    .pop()?.version;\n  if (stableMatchingVersion) {\n    logger.debug(\n      { toolName, constraint, resolvedVersion: stableMatchingVersion },\n      'Resolved stable matching version',\n    );\n    return stableMatchingVersion;\n  }\n\n  const unstableMatchingVersion = matchingReleases.pop()?.version;\n  if (unstableMatchingVersion) {\n    logger.debug(\n      { toolName, constraint, resolvedVersion: unstableMatchingVersion },\n      'Resolved unstable matching version',\n    );\n    return unstableMatchingVersion;\n  }\n\n  const stableVersion = releases\n    .filter((r) => isStable(r.version, versioning, pkgReleases?.tags?.latest))\n    .pop()?.version;\n  if (stableVersion) {\n    logger.warn(\n      { toolName, constraint, stableVersion },\n      'No matching tool versions found for constraint - using latest stable version',\n    );\n  }\n\n  const highestVersion = releases.pop()!.version;\n  logger.warn(\n    { toolName, constraint, highestVersion },\n    'No matching or stable tool versions found - using an unstable version',\n  );\n  return highestVersion;\n}\n\nexport async function generateInstallCommands(\n  toolConstraints: Opt<ToolConstraint[]>,\n): Promise<string[]> {\n  const installCommands: string[] = [];\n  if (toolConstraints?.length) {\n    for (const toolConstraint of toolConstraints) {\n      const toolVersion = await resolveConstraint(toolConstraint);\n      const { toolName } = toolConstraint;\n      const installCommand = `install-tool ${toolName} ${quote(toolVersion)}`;\n      installCommands.push(installCommand);\n    }\n  }\n  return installCommands;\n}\n"],"mappings":";;;;;;AASA,MAAa,gBAA8C;CACzD,UAAU;EACR,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,KAAK;EACH,YAAY;EACZ,aAAa;EACb,gBAAgB;EAChB,YAAY;CACd;CACA,SAAS;EACP,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,WAAW;EACT,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,UAAU;EACR,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,OAAO;EACL,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,UAAU;EACR,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,IAAI;EACF,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,OAAO;EACL,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,UAAU;EACR,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CAEA,cAAc;EACZ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,IAAI;EACF,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,WAAW;EACT,YAAY;EACZ,aAAa;EACb,gBAAgB;EAChB,YAAY;CACd;CACA,OAAO;EACL,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,KAAK;EACH,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,KAAK;EACH,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,KAAK;EACH,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,KAAK;EACH,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,aAAa;EACX,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,IAAI;EACF,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,aAAa;EACX,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,MAAM;EACJ,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,SAAS;EACP,YAAY;EACZ,aAAa;EACb,YAAY;CACd;CACA,QAAQ;EACN,YAAY;EACZ,aAAa;EACb,YAAY;CACd;AACF;AAEA,IAAI,kBAEO;AAEX,eAAe,eACb,YAC+B;CAC/B,oBAAoB,OAAO;CAC3B,MAAM,EAAE,mBAAmB,MAAM;CACjC,OAAO,eAAe,UAAU;AAClC;AAEA,SAAgB,cAAc,UAAgC;CAC5D,OAAO,cAAc;AACvB;AAEA,SAAgB,uBAAuB,UAA6B;CAClE,OAAO,CAAC,CAAC,cAAc;AACzB;AAEA,SAAgB,kBAA2B;CACzC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;AACpB;AAEA,SAAgB,iBACd,iBACS;CACT,IAAI,aAAa,IAAI,cAAc,MAAM,WACvC,OAAO;CAET,IAAI,CAAC,gBAAgB,GAAG;EACtB,OAAO,MAAM,qCAAqC;EAClD,OAAO;CACT;CACA,OACE,CAAC,mBACD,gBAAgB,OAAO,mBACrB,uBAAuB,eAAe,QAAQ,CAChD;AAEJ;AAEA,SAAS,SACP,SACA,eACA,QACS;CACT,IAAI,CAAC,cAAc,SAAS,OAAO,GACjC,OAAO;CAET,IAAI,SAAS,MAAM,KAAK,cAAc,cAAc,SAAS,MAAM,GACjE,OAAO;CAET,OAAO;AACT;AAEA,eAAsB,kBACpB,gBACiB;CACjB,MAAM,EAAE,aAAa;CACrB,MAAM,aAAa,cAAc;CACjC,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,4BAA4B,UAAU;CAGxD,MAAM,EAAE,KAAK,kBACX,MAAM,OAAO;CACf,MAAM,aAAa,cAAc,WAAW,UAAU;CACtD,IAAI,aAAa,eAAe;CAChC,IAAI,YACF,IAAI,WAAW,QAAQ,UAAU,GAC3B;MAAA,WAAW,gBAAgB,UAAU,GACvC,OAAO,WAAW,QAAQ,OAAO,EAAE,CAAC,CAAC,KAAK;CAAA,OAEvC;EACL,OAAO,KACL;GAAE;GAAU;GAAY,YAAY,WAAW;EAAW,GAC1D,yBACF;EACA,aAAa,KAAA;CACf;CAGF,MAAM,cAAc,MAAM,eAAe,UAAU;CACnD,MAAM,WAAW,aAAa,YAAY,CAAC;CAE3C,IAAI,CAAC,UAAU,QAAQ;EACrB,OAAO,KAAK,EAAE,WAAW,GAAG,yBAAyB;EACrD,MAAM,IAAI,MAAM,yBAAyB;CAC3C;CAEA,MAAM,mBAAmB,SAAS,QAC/B,MAAM,CAAC,cAAc,WAAW,QAAQ,EAAE,SAAS,UAAU,CAChE;CAEA,MAAM,wBAAwB,iBAC3B,QAAQ,MAAM,SAAS,EAAE,SAAS,YAAY,aAAa,MAAM,MAAM,CAAC,CAAC,CACzE,IAAI,CAAC,EAAE;CACV,IAAI,uBAAuB;EACzB,OAAO,MACL;GAAE;GAAU;GAAY,iBAAiB;EAAsB,GAC/D,kCACF;EACA,OAAO;CACT;CAEA,MAAM,0BAA0B,iBAAiB,IAAI,CAAC,EAAE;CACxD,IAAI,yBAAyB;EAC3B,OAAO,MACL;GAAE;GAAU;GAAY,iBAAiB;EAAwB,GACjE,oCACF;EACA,OAAO;CACT;CAEA,MAAM,gBAAgB,SACnB,QAAQ,MAAM,SAAS,EAAE,SAAS,YAAY,aAAa,MAAM,MAAM,CAAC,CAAC,CACzE,IAAI,CAAC,EAAE;CACV,IAAI,eACF,OAAO,KACL;EAAE;EAAU;EAAY;CAAc,GACtC,8EACF;CAGF,MAAM,iBAAiB,SAAS,IAAI,CAAC,CAAE;CACvC,OAAO,KACL;EAAE;EAAU;EAAY;CAAe,GACvC,uEACF;CACA,OAAO;AACT;AAEA,eAAsB,wBACpB,iBACmB;CACnB,MAAM,kBAA4B,CAAC;CACnC,IAAI,iBAAiB,QACnB,KAAK,MAAM,kBAAkB,iBAAiB;EAC5C,MAAM,cAAc,MAAM,kBAAkB,cAAc;EAC1D,MAAM,EAAE,aAAa;EACrB,MAAM,iBAAiB,gBAAgB,SAAS,GAAG,MAAM,WAAW;EACpE,gBAAgB,KAAK,cAAc;CACrC;CAEF,OAAO;AACT"}

package/dist/util/exec/types.d.ts

@@ -38,6 +38,8 @@ declare const toolDefinitions: [{
   readonly name: 'elixir';
 }, {
   readonly name: 'flux';
+}, {
+  readonly name: 'gh';
 }, {
   readonly name: 'gleam';
 }, {

package/dist/util/exec/types.js

@@ -20,6 +20,7 @@ const toolDefinitions = [
 	{ name: "erlang" },
 	{ name: "elixir" },
 	{ name: "flux" },
+	{ name: "gh" },
 	{ name: "gleam" },
 	{ name: "golang" },
 	{ name: "gradle" },

package/dist/util/exec/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","names":[],"sources":["../../../lib/util/exec/types.ts"],"sourcesContent":["import { isString } from '@sindresorhus/is';\nimport type { Options as ExecaOptions } from 'execa';\nimport type { VersioningName } from '../../versioning-list.generated.ts';\n\nexport interface ConstraintDefinition {\n  name: string;\n  description?: string;\n}\n\n/**\n * A `tool` that Containerbase supports.\n *\n * TODO #41849 replace with upstream types\n */\nexport const toolDefinitions = [\n  {\n    name: 'bazelisk',\n  },\n  {\n    name: 'bun',\n  },\n  {\n    name: 'bundler',\n  },\n  {\n    name: 'cocoapods',\n  },\n  {\n    name: 'composer',\n  },\n  {\n    name: 'conan',\n  },\n  {\n    name: 'copier',\n  },\n  {\n    name: 'corepack',\n  },\n  {\n    name: 'deno',\n  },\n  {\n    name: 'devbox',\n  },\n  {\n    name: 'dotnet',\n  },\n  {\n    name: 'erlang',\n  },\n  {\n    name: 'elixir',\n  },\n  {\n    name: 'flux',\n  },\n  {\n    name: 'gleam',\n  },\n  {\n    name: 'golang',\n  },\n  {\n    name: 'gradle',\n  },\n  {\n    name: 'hashin',\n  },\n  {\n    name: 'helm',\n  },\n  {\n    name: 'helmfile',\n  },\n  {\n    name: 'java',\n  },\n  {\n    name: 'java-maven',\n  },\n  {\n    name: 'jb',\n  },\n  {\n    name: 'kustomize',\n  },\n  {\n    name: 'maven',\n  },\n  {\n    name: 'mise',\n  },\n  {\n    name: 'nix',\n  },\n  {\n    name: 'node',\n  },\n  {\n    name: 'npm',\n  },\n  {\n    name: 'pdm',\n  },\n  {\n    name: 'php',\n  },\n  {\n    name: 'pip-tools',\n  },\n  {\n    name: 'pipenv',\n  },\n  {\n    name: 'pnpm',\n  },\n  {\n    name: 'pixi',\n  },\n  {\n    name: 'poetry',\n  },\n  {\n    name: 'python',\n  },\n  {\n    name: 'ruby',\n    description: 'Also used in the `rubygems` Datasource',\n  },\n  {\n    name: 'rust',\n  },\n  {\n    name: 'uv',\n  },\n  {\n    name: 'yarn',\n  },\n  {\n    name: 'yarn-slim',\n  },\n  {\n    name: 'dart',\n  },\n  {\n    name: 'flutter',\n  },\n  {\n    name: 'vendir',\n  },\n] as const satisfies ConstraintDefinition[];\n\n/**\n * A `tool` that Containerbase supports.\n */\nexport type ToolName = (typeof toolDefinitions)[number]['name'];\n\n/**\n * A `tool` that Containerbase supports.\n */\nexport const toolNames: ToolName[] = toolDefinitions.map((t) => t.name);\n\nexport function isToolName(value: unknown): value is ToolName {\n  return isString(value) && (toolNames as readonly string[]).includes(value);\n}\n\n/**\n * Additional constraints that can be specified for some Managers, but are **not** tools that Containerbase supports, with optional description.\n */\nexport const additionalConstraintDefinitions = [\n  /**\n   * @deprecated TODO remove in #42600\n   */\n  {\n    name: 'go',\n    description: `Used in the \\`gomod\\` manager to specify the version of the Go toolchain to use.\n\nIn precedence order:\n\n1. config: \\`constraints.go\\`\n1. \\`go.mod\\`: \\`toolchain\\` directive\n1. \\`go.mod\\`: \\`go\\` directive\n\nNOTE that the \\`constraints.golang\\` is not used (https://github.com/renovatebot/renovate/issues/42601)\n  `,\n  },\n  {\n    name: 'gomodMod',\n    description: `Used in the \\`gomod\\` manager to specify a tag for [\\`github.com/marwan-at-work/mod\\`](https://github.com/marwan-at-work/mod).\n\nMust be prefixed with \\`v\\`.`,\n  },\n  {\n    name: 'jenkins',\n    description:\n      'Used in the `jenkins-plugins` datasource to specify a minimum version of Jenkins that a plugin must support.',\n  },\n  {\n    name: 'pipTools',\n    description:\n      'Used in the `pip-compile` manager to specify a version of `pip-tools` to use. @deprecated TODO remove in #42599',\n  },\n  {\n    name: 'platform',\n    description:\n      'Used in the `rubygems` datasource to specify the `platform` that the Gem dependency supports.',\n  },\n  {\n    name: 'rubygems',\n    description:\n      'Used in the `rubygems` datasource to specify the version of the `rubygems` tool that is needed to use this Gem.',\n  },\n  {\n    name: 'vscode',\n    description:\n      'Used in the `npm` manager to track the version of VSCode that the package is compatible with.',\n  },\n  {\n    name: 'dotnet-sdk',\n    description:\n      'Used in the `nuget` manager to track .NET SDK version required.',\n  },\n  {\n    name: 'perl',\n    description:\n      'Used in the `cpanfile` manager to track Perl version required.',\n  },\n  {\n    name: '%goMod',\n    description:\n      'Used in the `gomod` manager to determine the [minimum version of Go required to use this module](https://go.dev/ref/mod#go-mod-file-go).\\n\\nNote that this is prefixed with a `%` to explicitly note that this is not a tool that Containerbase knows.',\n  },\n] as const satisfies ConstraintDefinition[];\n\n/**\n * Additional constraints that can be specified for some Managers, but are **not** tools that Containerbase supports.\n */\nexport type AdditionalConstraintName =\n  (typeof additionalConstraintDefinitions)[number]['name'];\n\n/**\n * Additional constraints that can be specified for some Managers, but are **not** tools that Containerbase supports.\n */\nexport const additionalConstraintNames: AdditionalConstraintName[] =\n  additionalConstraintDefinitions.map((c) => c.name);\n\nexport function isAdditionalConstraintName(\n  value: unknown,\n): value is AdditionalConstraintName {\n  return (\n    isString(value) &&\n    (additionalConstraintNames as readonly string[]).includes(value)\n  );\n}\n\n/**\n * A name usable as a key in a `constraints` record, which may be tools that Containerbase supports.\n */\nexport type ConstraintName = ToolName | AdditionalConstraintName;\n\nexport function isConstraintName(value: unknown): value is ConstraintName {\n  return isToolName(value) || isAdditionalConstraintName(value);\n}\n\nexport interface ToolConstraint {\n  toolName: ToolName;\n  constraint?: string | null;\n}\n\nexport interface ToolConfig {\n  datasource: string;\n  extractVersion?: string;\n  packageName: string;\n  versioning: VersioningName;\n}\n\nexport type Opt<T> = T | null | undefined;\n\nexport type VolumesPair = [string, string];\nexport type VolumeOption = Opt<string | VolumesPair>;\n\nexport interface DockerOptions {\n  volumes?: Opt<VolumeOption[]>;\n  envVars?: Opt<Opt<string>[]>;\n  cwd?: Opt<string>;\n}\n\nexport type DataListener = (chunk: any) => void;\nexport interface OutputListeners {\n  stdout?: DataListener[];\n  stderr?: DataListener[];\n}\n\nexport interface OutputWriter {\n  write(chunk: Buffer): void;\n  toString(): string;\n}\n\nexport interface OutputWriters {\n  stdout?: OutputWriter;\n  stderr?: OutputWriter;\n}\n\nexport interface RawExecOptions extends ExecaOptions {\n  maxBuffer?: number | undefined;\n  cwd?: string;\n  outputListeners?: OutputListeners;\n  outputWriters?: OutputWriters;\n}\n\nexport interface ExecResult {\n  stdout: string;\n  stderr: string;\n  /**\n   * The process' exit code in the case of a failure.\n   *\n   * This is only set if using `ignoreFailure` when executing a command\n   *\n   */\n  exitCode?: number;\n}\n\nexport type ExtraEnv<T = unknown> = Record<string, T>;\n\nexport interface ExecOptions {\n  cwd?: string;\n  cwdFile?: string;\n  env?: Opt<ExtraEnv>;\n  extraEnv?: Opt<ExtraEnv>;\n  docker?: Opt<DockerOptions>;\n  toolConstraints?: Opt<ToolConstraint[]>;\n  preCommands?: Opt<string[]>;\n  ignoreStdout?: boolean;\n  // Following are pass-through to child process\n  maxBuffer?: number | undefined;\n  timeout?: number | undefined;\n  shell?: boolean | string | undefined;\n}\n\n/**\n * configuration that can be configured on a per-command basis, that doesn't make sense to be on the `RawExecOptions`\n */\nexport interface CommandWithOptions {\n  command: string[];\n\n  /** do not throw errors when a command fails, but do log that an error occurred */\n  ignoreFailure?: boolean;\n\n  /**\n   * Execute the `command` within a shell\n   *\n   * WARNING this can result in security issues if this includes user-controlled commands\n   * **/\n  shell?: boolean | string;\n}\n"],"mappings":";;;;;;;AAcA,MAAa,kBAAkB;CAC7B,EACE,MAAM,WACR;CACA,EACE,MAAM,MACR;CACA,EACE,MAAM,UACR;CACA,EACE,MAAM,YACR;CACA,EACE,MAAM,WACR;CACA,EACE,MAAM,QACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,WACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,QACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,WACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,aACR;CACA,EACE,MAAM,KACR;CACA,EACE,MAAM,YACR;CACA,EACE,MAAM,QACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,MACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,MACR;CACA,EACE,MAAM,MACR;CACA,EACE,MAAM,MACR;CACA,EACE,MAAM,YACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,SACR;CACA;EACE,MAAM;EACN,aAAa;CACf;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,KACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,YACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,UACR;CACA,EACE,MAAM,SACR;AACF;;;;AAUA,MAAa,YAAwB,gBAAgB,KAAK,MAAM,EAAE,IAAI;AAEtE,SAAgB,WAAW,OAAmC;CAC5D,OAAO,SAAS,KAAK,KAAM,UAAgC,SAAS,KAAK;AAC3E;;;;AAKA,MAAa,kCAAkC;;;;;CAI7C;EACE,MAAM;EACN,aAAa;;;;;;;;;;CAUf;CACA;EACE,MAAM;EACN,aAAa;;;CAGf;CACA;EACE,MAAM;EACN,aACE;CACJ;CACA;EACE,MAAM;EACN,aACE;CACJ;CACA;EACE,MAAM;EACN,aACE;CACJ;CACA;EACE,MAAM;EACN,aACE;CACJ;CACA;EACE,MAAM;EACN,aACE;CACJ;CACA;EACE,MAAM;EACN,aACE;CACJ;CACA;EACE,MAAM;EACN,aACE;CACJ;CACA;EACE,MAAM;EACN,aACE;CACJ;AACF;;;;AAWA,MAAa,4BACX,gCAAgC,KAAK,MAAM,EAAE,IAAI;AAEnD,SAAgB,2BACd,OACmC;CACnC,OACE,SAAS,KAAK,KACb,0BAAgD,SAAS,KAAK;AAEnE;AAOA,SAAgB,iBAAiB,OAAyC;CACxE,OAAO,WAAW,KAAK,KAAK,2BAA2B,KAAK;AAC9D"}
+{"version":3,"file":"types.js","names":[],"sources":["../../../lib/util/exec/types.ts"],"sourcesContent":["import { isString } from '@sindresorhus/is';\nimport type { Options as ExecaOptions } from 'execa';\nimport type { VersioningName } from '../../versioning-list.generated.ts';\n\nexport interface ConstraintDefinition {\n  name: string;\n  description?: string;\n}\n\n/**\n * A `tool` that Containerbase supports.\n *\n * TODO #41849 replace with upstream types\n */\nexport const toolDefinitions = [\n  {\n    name: 'bazelisk',\n  },\n  {\n    name: 'bun',\n  },\n  {\n    name: 'bundler',\n  },\n  {\n    name: 'cocoapods',\n  },\n  {\n    name: 'composer',\n  },\n  {\n    name: 'conan',\n  },\n  {\n    name: 'copier',\n  },\n  {\n    name: 'corepack',\n  },\n  {\n    name: 'deno',\n  },\n  {\n    name: 'devbox',\n  },\n  {\n    name: 'dotnet',\n  },\n  {\n    name: 'erlang',\n  },\n  {\n    name: 'elixir',\n  },\n  {\n    name: 'flux',\n  },\n  {\n    name: 'gh',\n  },\n  {\n    name: 'gleam',\n  },\n  {\n    name: 'golang',\n  },\n  {\n    name: 'gradle',\n  },\n  {\n    name: 'hashin',\n  },\n  {\n    name: 'helm',\n  },\n  {\n    name: 'helmfile',\n  },\n  {\n    name: 'java',\n  },\n  {\n    name: 'java-maven',\n  },\n  {\n    name: 'jb',\n  },\n  {\n    name: 'kustomize',\n  },\n  {\n    name: 'maven',\n  },\n  {\n    name: 'mise',\n  },\n  {\n    name: 'nix',\n  },\n  {\n    name: 'node',\n  },\n  {\n    name: 'npm',\n  },\n  {\n    name: 'pdm',\n  },\n  {\n    name: 'php',\n  },\n  {\n    name: 'pip-tools',\n  },\n  {\n    name: 'pipenv',\n  },\n  {\n    name: 'pnpm',\n  },\n  {\n    name: 'pixi',\n  },\n  {\n    name: 'poetry',\n  },\n  {\n    name: 'python',\n  },\n  {\n    name: 'ruby',\n    description: 'Also used in the `rubygems` Datasource',\n  },\n  {\n    name: 'rust',\n  },\n  {\n    name: 'uv',\n  },\n  {\n    name: 'yarn',\n  },\n  {\n    name: 'yarn-slim',\n  },\n  {\n    name: 'dart',\n  },\n  {\n    name: 'flutter',\n  },\n  {\n    name: 'vendir',\n  },\n] as const satisfies ConstraintDefinition[];\n\n/**\n * A `tool` that Containerbase supports.\n */\nexport type ToolName = (typeof toolDefinitions)[number]['name'];\n\n/**\n * A `tool` that Containerbase supports.\n */\nexport const toolNames: ToolName[] = toolDefinitions.map((t) => t.name);\n\nexport function isToolName(value: unknown): value is ToolName {\n  return isString(value) && (toolNames as readonly string[]).includes(value);\n}\n\n/**\n * Additional constraints that can be specified for some Managers, but are **not** tools that Containerbase supports, with optional description.\n */\nexport const additionalConstraintDefinitions = [\n  /**\n   * @deprecated TODO remove in #42600\n   */\n  {\n    name: 'go',\n    description: `Used in the \\`gomod\\` manager to specify the version of the Go toolchain to use.\n\nIn precedence order:\n\n1. config: \\`constraints.go\\`\n1. \\`go.mod\\`: \\`toolchain\\` directive\n1. \\`go.mod\\`: \\`go\\` directive\n\nNOTE that the \\`constraints.golang\\` is not used (https://github.com/renovatebot/renovate/issues/42601)\n  `,\n  },\n  {\n    name: 'gomodMod',\n    description: `Used in the \\`gomod\\` manager to specify a tag for [\\`github.com/marwan-at-work/mod\\`](https://github.com/marwan-at-work/mod).\n\nMust be prefixed with \\`v\\`.`,\n  },\n  {\n    name: 'jenkins',\n    description:\n      'Used in the `jenkins-plugins` datasource to specify a minimum version of Jenkins that a plugin must support.',\n  },\n  {\n    name: 'pipTools',\n    description:\n      'Used in the `pip-compile` manager to specify a version of `pip-tools` to use. @deprecated TODO remove in #42599',\n  },\n  {\n    name: 'platform',\n    description:\n      'Used in the `rubygems` datasource to specify the `platform` that the Gem dependency supports.',\n  },\n  {\n    name: 'rubygems',\n    description:\n      'Used in the `rubygems` datasource to specify the version of the `rubygems` tool that is needed to use this Gem.',\n  },\n  {\n    name: 'vscode',\n    description:\n      'Used in the `npm` manager to track the version of VSCode that the package is compatible with.',\n  },\n  {\n    name: 'dotnet-sdk',\n    description:\n      'Used in the `nuget` manager to track .NET SDK version required.',\n  },\n  {\n    name: 'perl',\n    description:\n      'Used in the `cpanfile` manager to track Perl version required.',\n  },\n  {\n    name: '%goMod',\n    description:\n      'Used in the `gomod` manager to determine the [minimum version of Go required to use this module](https://go.dev/ref/mod#go-mod-file-go).\\n\\nNote that this is prefixed with a `%` to explicitly note that this is not a tool that Containerbase knows.',\n  },\n] as const satisfies ConstraintDefinition[];\n\n/**\n * Additional constraints that can be specified for some Managers, but are **not** tools that Containerbase supports.\n */\nexport type AdditionalConstraintName =\n  (typeof additionalConstraintDefinitions)[number]['name'];\n\n/**\n * Additional constraints that can be specified for some Managers, but are **not** tools that Containerbase supports.\n */\nexport const additionalConstraintNames: AdditionalConstraintName[] =\n  additionalConstraintDefinitions.map((c) => c.name);\n\nexport function isAdditionalConstraintName(\n  value: unknown,\n): value is AdditionalConstraintName {\n  return (\n    isString(value) &&\n    (additionalConstraintNames as readonly string[]).includes(value)\n  );\n}\n\n/**\n * A name usable as a key in a `constraints` record, which may be tools that Containerbase supports.\n */\nexport type ConstraintName = ToolName | AdditionalConstraintName;\n\nexport function isConstraintName(value: unknown): value is ConstraintName {\n  return isToolName(value) || isAdditionalConstraintName(value);\n}\n\nexport interface ToolConstraint {\n  toolName: ToolName;\n  constraint?: string | null;\n}\n\nexport interface ToolConfig {\n  datasource: string;\n  extractVersion?: string;\n  packageName: string;\n  versioning: VersioningName;\n}\n\nexport type Opt<T> = T | null | undefined;\n\nexport type VolumesPair = [string, string];\nexport type VolumeOption = Opt<string | VolumesPair>;\n\nexport interface DockerOptions {\n  volumes?: Opt<VolumeOption[]>;\n  envVars?: Opt<Opt<string>[]>;\n  cwd?: Opt<string>;\n}\n\nexport type DataListener = (chunk: any) => void;\nexport interface OutputListeners {\n  stdout?: DataListener[];\n  stderr?: DataListener[];\n}\n\nexport interface OutputWriter {\n  write(chunk: Buffer): void;\n  toString(): string;\n}\n\nexport interface OutputWriters {\n  stdout?: OutputWriter;\n  stderr?: OutputWriter;\n}\n\nexport interface RawExecOptions extends ExecaOptions {\n  maxBuffer?: number | undefined;\n  cwd?: string;\n  outputListeners?: OutputListeners;\n  outputWriters?: OutputWriters;\n}\n\nexport interface ExecResult {\n  stdout: string;\n  stderr: string;\n  /**\n   * The process' exit code in the case of a failure.\n   *\n   * This is only set if using `ignoreFailure` when executing a command\n   *\n   */\n  exitCode?: number;\n}\n\nexport type ExtraEnv<T = unknown> = Record<string, T>;\n\nexport interface ExecOptions {\n  cwd?: string;\n  cwdFile?: string;\n  env?: Opt<ExtraEnv>;\n  extraEnv?: Opt<ExtraEnv>;\n  docker?: Opt<DockerOptions>;\n  toolConstraints?: Opt<ToolConstraint[]>;\n  preCommands?: Opt<string[]>;\n  ignoreStdout?: boolean;\n  // Following are pass-through to child process\n  maxBuffer?: number | undefined;\n  timeout?: number | undefined;\n  shell?: boolean | string | undefined;\n}\n\n/**\n * configuration that can be configured on a per-command basis, that doesn't make sense to be on the `RawExecOptions`\n */\nexport interface CommandWithOptions {\n  command: string[];\n\n  /** do not throw errors when a command fails, but do log that an error occurred */\n  ignoreFailure?: boolean;\n\n  /**\n   * Execute the `command` within a shell\n   *\n   * WARNING this can result in security issues if this includes user-controlled commands\n   * **/\n  shell?: boolean | string;\n}\n"],"mappings":";;;;;;;AAcA,MAAa,kBAAkB;CAC7B,EACE,MAAM,WACR;CACA,EACE,MAAM,MACR;CACA,EACE,MAAM,UACR;CACA,EACE,MAAM,YACR;CACA,EACE,MAAM,WACR;CACA,EACE,MAAM,QACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,WACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,KACR;CACA,EACE,MAAM,QACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,WACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,aACR;CACA,EACE,MAAM,KACR;CACA,EACE,MAAM,YACR;CACA,EACE,MAAM,QACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,MACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,MACR;CACA,EACE,MAAM,MACR;CACA,EACE,MAAM,MACR;CACA,EACE,MAAM,YACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,SACR;CACA,EACE,MAAM,SACR;CACA;EACE,MAAM;EACN,aAAa;CACf;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,KACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,YACR;CACA,EACE,MAAM,OACR;CACA,EACE,MAAM,UACR;CACA,EACE,MAAM,SACR;AACF;;;;AAUA,MAAa,YAAwB,gBAAgB,KAAK,MAAM,EAAE,IAAI;AAEtE,SAAgB,WAAW,OAAmC;CAC5D,OAAO,SAAS,KAAK,KAAM,UAAgC,SAAS,KAAK;AAC3E;;;;AAKA,MAAa,kCAAkC;;;;;CAI7C;EACE,MAAM;EACN,aAAa;;;;;;;;;;CAUf;CACA;EACE,MAAM;EACN,aAAa;;;CAGf;CACA;EACE,MAAM;EACN,aACE;CACJ;CACA;EACE,MAAM;EACN,aACE;CACJ;CACA;EACE,MAAM;EACN,aACE;CACJ;CACA;EACE,MAAM;EACN,aACE;CACJ;CACA;EACE,MAAM;EACN,aACE;CACJ;CACA;EACE,MAAM;EACN,aACE;CACJ;CACA;EACE,MAAM;EACN,aACE;CACJ;CACA;EACE,MAAM;EACN,aACE;CACJ;AACF;;;;AAWA,MAAa,4BACX,gCAAgC,KAAK,MAAM,EAAE,IAAI;AAEnD,SAAgB,2BACd,OACmC;CACnC,OACE,SAAS,KAAK,KACb,0BAAgD,SAAS,KAAK;AAEnE;AAOA,SAAgB,iBAAiB,OAAyC;CACxE,OAAO,WAAW,KAAK,KAAK,2BAA2B,KAAK;AAC9D"}

package/dist/workers/repository/process/lookup/index.js

@@ -360,7 +360,7 @@ async function lookupUpdates(inconfig) {
 					};
 					res.updates.push(digestUpdate);
 				}
-			} else if (config.pinDigests && 
+			} else if (config.pinDigests && !config.digestManagedExternally && 
 			// v8 ignore else -- TODO: add test #40625
 			!res.updates.some((update) => update.updateType === "pin")) {
 				const pinDigestUpdate = {
@@ -377,7 +377,7 @@ async function lookupUpdates(inconfig) {
 			}
 			if (res.registryUrl) config.registryUrls = [res.registryUrl];
 			for (const update of res.updates) {
-				if (config.pinDigests === true || config.currentDigest) {
+				if (config.pinDigests === true && !config.digestManagedExternally || config.currentDigest) {
 					const getDigestConfig = {
 						...config,
 						registryUrl: update.registryUrl ?? res.registryUrl,

package/dist/workers/repository/process/lookup/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["allVersioning.get"],"sources":["../../../../../lib/workers/repository/process/lookup/index.ts"],"sourcesContent":["import { isNonEmptyString, isString, isUndefined } from '@sindresorhus/is';\nimport { mergeChildConfig } from '../../../../config/index.ts';\nimport type { ValidationMessage } from '../../../../config/types.ts';\nimport { CONFIG_VALIDATION } from '../../../../constants/error-messages.ts';\nimport { logger } from '../../../../logger/index.ts';\nimport {\n  getDatasourceFor,\n  getDefaultVersioning,\n} from '../../../../modules/datasource/common.ts';\nimport type {\n  GetDigestInputConfig,\n  Release,\n  ReleaseResult,\n} from '../../../../modules/datasource/index.ts';\nimport {\n  applyDatasourceFilters,\n  getDigest,\n  getRawPkgReleases,\n  isGetPkgReleasesConfig,\n  supportsDigests,\n} from '../../../../modules/datasource/index.ts';\nimport { postprocessRelease } from '../../../../modules/datasource/postprocess-release.ts';\nimport { getRangeStrategy } from '../../../../modules/manager/index.ts';\nimport type { LookupUpdate } from '../../../../modules/manager/types.ts';\nimport { id as dockerVersioningId } from '../../../../modules/versioning/docker/index.ts';\nimport * as allVersioning from '../../../../modules/versioning/index.ts';\nimport { ExternalHostError } from '../../../../types/errors/external-host-error.ts';\nimport { assignKeys } from '../../../../util/assign-keys.ts';\nimport { getElapsedDays } from '../../../../util/date.ts';\nimport { checkMinimumReleaseAge } from '../../../../util/minimum-release-age.ts';\nimport { applyPackageRules } from '../../../../util/package-rules/index.ts';\nimport { regEx } from '../../../../util/regex.ts';\nimport { Result } from '../../../../util/result.ts';\nimport type { Timestamp } from '../../../../util/timestamp.ts';\nimport { calculateAbandonment } from './abandonment.ts';\nimport { getBucket } from './bucket.ts';\nimport { getCurrentVersion } from './current.ts';\nimport { filterVersions } from './filter.ts';\nimport { filterInternalChecks } from './filter-checks.ts';\nimport { generateUpdate } from './generate.ts';\nimport { getRollbackUpdate } from './rollback.ts';\nimport { calculateMostRecentTimestamp } from './timestamps.ts';\nimport type { LookupUpdateConfig, UpdateResult } from './types.ts';\nimport {\n  addReplacementUpdateIfValid,\n  isReplacementRulesConfigured,\n} from './utils.ts';\n\nasync function getTimestamp(\n  config: LookupUpdateConfig,\n  versions: Release[],\n  version: string,\n  versioningApi: allVersioning.VersioningApi,\n): Promise<Timestamp | null | undefined> {\n  const currentRelease = versions.find(\n    (v) =>\n      versioningApi.isValid(v.version) &&\n      versioningApi.equals(v.version, version),\n  );\n\n  if (!currentRelease) {\n    return null;\n  }\n\n  if (currentRelease.releaseTimestamp) {\n    return currentRelease.releaseTimestamp;\n  }\n\n  const remoteRelease = await postprocessRelease(config, currentRelease);\n  return remoteRelease?.releaseTimestamp;\n}\n\n/** The only two `updateType`s that `applyMinimumReleaseAgeToDigestUpdate()` can be called with */\ntype DigestLikeUpdate = LookupUpdate & { updateType: 'digest' | 'pinDigest' };\n\n/**\n * A helper function to allow a short-circuit for `minimumReleaseAge` functionality if a package may have config that applies it.\n *\n * Allows avoiding unnecessary calls to more expensive checks like merge + `applyPackageRules()` and `getTimestamp()`.\n */\nfunction couldApplyMinimumReleaseAgeToDigest(\n  config: LookupUpdateConfig,\n  updateType: DigestLikeUpdate['updateType'],\n): boolean {\n  // Match filterInternalChecks(): under `none` the user opted out of internal\n  // checks entirely, so do no merging, no package rules, no age check and no\n  // logging claiming an age check ran.\n  if (config.internalChecksFilter === 'none') {\n    return false;\n  }\n\n  return (\n    isNonEmptyString(config.minimumReleaseAge) ||\n    isNonEmptyString(config[updateType]?.minimumReleaseAge) ||\n    !!config.packageRules?.some((rule) =>\n      isNonEmptyString(rule.minimumReleaseAge),\n    )\n  );\n}\n\n/**\n * Ensure `minimumReleaseAge`/`internalChecksFilter` applies to digest/pinDigest updates, as they don't currently get run through `filterInternalChecks()`.\n *\n * NOTE that this should be kept in sync with `filterInternalChecks`()\n */\nasync function applyMinimumReleaseAgeToDigestUpdate(\n  update: DigestLikeUpdate,\n  config: LookupUpdateConfig,\n  res: UpdateResult,\n  currentVersionWasResolved: boolean,\n  newestMatchingVersionTimestamp: Timestamp | null | undefined,\n): Promise<void> {\n  if (!couldApplyMinimumReleaseAgeToDigest(config, update.updateType)) {\n    return;\n  }\n\n  if (update.updateType === 'pinDigest' && !currentVersionWasResolved) {\n    // Not `!res.currentVersion` - that's force-set to lockedVersion further down regardless of timestamp resolution.\n    // `pinDigest` doesn't repoint anywhere, unlike `digest` - it just freezes whatever the ref already resolves to.\n    // An unversioned tag (e.g. `latest`) has no versioned release to age against, and holding the pin would only\n    // prolong the less-pinned (less safe) state, so skip the check entirely rather than treating the missing\n    // timestamp as pending.\n    logger.once.debug(\n      { depName: config.depName, updateType: update.updateType },\n      `Skipping minimumReleaseAge check for ${update.updateType} update of ${config.depName}, as its current value does not resolve to a versioned release`,\n    );\n    return;\n  }\n\n  let releaseConfig: LookupUpdateConfig = {\n    ...mergeChildConfig(config, res),\n    updateType: update.updateType,\n  };\n  releaseConfig = mergeChildConfig(\n    releaseConfig,\n    releaseConfig[update.updateType]!,\n  );\n  releaseConfig = await applyPackageRules(releaseConfig, 'update-type');\n\n  // Not update.releaseTimestamp - that field means \"age of the new release\" elsewhere (generate.ts, libyear.ts).\n  // Not res.currentVersionTimestamp either - that tracks whatever rangeStrategy resolves currentVersion to (e.g.\n  // the oldest matching release under `bump`), whereas both `digest` and `pinDigest` reflect whatever the current\n  // value's ref actually resolves to *right now*, which is always the newest matching version.\n  const ageCheck = checkMinimumReleaseAge(\n    releaseConfig,\n    newestMatchingVersionTimestamp,\n  );\n\n  // Mirror filterInternalChecks()'s logging so a held/passed digest update is diagnosable.\n  if (ageCheck.minimumReleaseAgeMs && !ageCheck.hasTimestamp) {\n    if (releaseConfig.minimumReleaseAgeBehaviour === 'timestamp-optional') {\n      logger.once.warn(\n        \"Some release(s) did not have a releaseTimestamp, but as we're running with minimumReleaseAgeBehaviour=timestamp-optional, proceeding. See debug logs for more information\",\n      );\n    }\n\n    logger.once.debug(\n      {\n        depName: config.depName,\n        updateType: update.updateType,\n        minimumReleaseAgeBehaviour: releaseConfig.minimumReleaseAgeBehaviour,\n        check: 'minimumReleaseAge',\n      },\n      `${update.updateType} update of ${config.depName} has no releaseTimestamp to age against`,\n    );\n  }\n  if (ageCheck.isPending) {\n    logger.trace(\n      {\n        depName: config.depName,\n        updateType: update.updateType,\n        releaseTimestamp: newestMatchingVersionTimestamp,\n        check: 'minimumReleaseAge',\n      },\n      `${update.updateType} update is pending minimumReleaseAge status checks`,\n    );\n\n    // internalChecksFilter is read from the unmerged top-level config, like filterInternalChecks().\n    if (config.internalChecksFilter === 'strict') {\n      update.pendingChecks = true;\n    }\n  }\n}\n\nexport async function lookupUpdates(\n  inconfig: LookupUpdateConfig,\n): Promise<Result<UpdateResult>> {\n  let config: LookupUpdateConfig = { ...inconfig };\n  config.versioning ??= getDefaultVersioning(config.datasource);\n\n  const versioningApi = allVersioning.get(config.versioning);\n\n  let dependency: ReleaseResult | null = null;\n  const res: UpdateResult = {\n    versioning: config.versioning,\n    updates: [],\n    warnings: [],\n  };\n  // Timestamp of the release a `digest`/`pinDigest` update's current value currently resolves to (the newest version matching it, regardless of `rangeStrategy`), as opposed to `res.currentVersionTimestamp` which tracks whatever the configured rangeStrategy resolves `currentVersion` to (e.g. the oldest for `bump`)\n  let newestMatchingVersionTimestamp: Timestamp | null | undefined;\n  // The `digest` update for `config.currentDigest` (if one is added), so its age check can run after `newDigest` is fetched and no-op updates are stripped.\n  let digestUpdate: DigestLikeUpdate | undefined;\n\n  try {\n    logger.trace(\n      {\n        dependency: config.packageName,\n        currentValue: config.currentValue,\n      },\n      'lookupUpdates',\n    );\n    if (config.currentValue && !isString(config.currentValue)) {\n      // If currentValue is not a string, then it's invalid\n      // v8 ignore else -- TODO: add test #40625\n      if (config.currentValue) {\n        logger.debug(\n          `Invalid currentValue for ${config.packageName}: ${JSON.stringify(config.currentValue)} (${typeof config.currentValue})`,\n        );\n      }\n      res.skipReason = 'invalid-value';\n      return Result.ok(res);\n    }\n    if (\n      !isGetPkgReleasesConfig(config) ||\n      !getDatasourceFor(config.datasource)\n    ) {\n      res.skipReason = 'invalid-config';\n      return Result.ok(res);\n    }\n    let compareValue = config.currentValue;\n    if (\n      isString(config.currentValue) &&\n      isString(config.versionCompatibility)\n    ) {\n      const versionCompatbilityRegEx = regEx(config.versionCompatibility);\n      const regexMatch = versionCompatbilityRegEx.exec(config.currentValue);\n      if (regexMatch?.groups) {\n        logger.debug(\n          {\n            versionCompatibility: config.versionCompatibility,\n            currentValue: config.currentValue,\n            packageName: config.packageName,\n            groups: regexMatch.groups,\n          },\n          'version compatibility regex match',\n        );\n        config.currentCompatibility = regexMatch.groups.compatibility;\n        compareValue = regexMatch.groups.version;\n      } else {\n        logger.debug(\n          {\n            versionCompatibility: config.versionCompatibility,\n            currentValue: config.currentValue,\n            packageName: config.packageName,\n          },\n          'version compatibility regex mismatch',\n        );\n      }\n    }\n\n    const isValid =\n      isString(compareValue) && versioningApi.isValid(compareValue);\n\n    const unconstrainedValue =\n      !!config.lockedVersion && isUndefined(config.currentValue);\n\n    if (isValid || unconstrainedValue) {\n      if (\n        !config.updatePinnedDependencies &&\n        // TODO #22198\n        versioningApi.isSingleVersion(compareValue!)\n      ) {\n        res.skipReason = 'is-pinned';\n        return Result.ok(res);\n      }\n\n      const { val: releaseResult, err: lookupError } = await getRawPkgReleases(\n        config,\n      )\n        .transform((res) => calculateMostRecentTimestamp(versioningApi, res))\n        .transform((res) => calculateAbandonment(res, config))\n        .transform((res) => applyDatasourceFilters(res, config))\n        .unwrap();\n\n      if (lookupError instanceof Error) {\n        throw lookupError;\n      }\n\n      if (lookupError) {\n        // If dependency lookup fails then warn and return\n        const warning: ValidationMessage = {\n          topic: config.packageName,\n          message: `Failed to look up ${config.datasource} package ${config.packageName}: ${lookupError}`,\n        };\n        logger.debug(\n          {\n            dependency: config.packageName,\n            packageFile: config.packageFile,\n          },\n          warning.message,\n        );\n        // TODO: return warnings in own field\n        res.warnings.push(warning);\n        return Result.ok(res);\n      }\n\n      dependency = releaseResult;\n\n      if (dependency.deprecationMessage) {\n        logger.debug(\n          `Found deprecationMessage for ${config.datasource} package ${config.packageName}`,\n        );\n      }\n\n      assignKeys(res, dependency, [\n        'deprecationMessage',\n        'sourceUrl',\n        'registryUrl',\n        'sourceDirectory',\n        'homepage',\n        'changelogUrl',\n        'dependencyUrl',\n        'lookupName',\n        'packageScope',\n        'mostRecentTimestamp',\n        'isAbandoned',\n        'respectLatest',\n      ]);\n\n      const latestVersion = dependency.tags?.latest;\n      // Filter out any results from datasource that don't comply with our versioning\n      let allVersions = dependency.releases.filter((release) =>\n        versioningApi.isVersion(release.version),\n      );\n      const allReleaseVersions = new Set(allVersions.map((r) => r.version));\n      // istanbul ignore if\n      if (allVersions.length === 0) {\n        const message = `Found no results from datasource that look like a version`;\n        logger.info(\n          {\n            dependency: config.packageName,\n            result: dependency,\n          },\n          message,\n        );\n        if (!config.currentDigest) {\n          return Result.ok(res);\n        }\n      }\n      // Reapply package rules in case we missed something from sourceUrl\n      config = await applyPackageRules(\n        { ...config, sourceUrl: res.sourceUrl },\n        'source-url',\n      );\n      if (config.followTag) {\n        const taggedVersion = dependency.tags?.[config.followTag];\n        if (!taggedVersion) {\n          res.warnings.push({\n            topic: config.packageName,\n            message: `Can't find version with tag ${config.followTag} for ${config.datasource} package ${config.packageName}`,\n          });\n          return Result.ok(res);\n        }\n        allVersions = allVersions.filter(\n          (v) =>\n            v.version === taggedVersion ||\n            (v.version === compareValue &&\n              versioningApi.isGreaterThan(taggedVersion, compareValue)),\n        );\n      }\n\n      const inRangeOnlyStrategy = config.rangeStrategy === 'in-range-only';\n      // Check that existing constraint can be satisfied\n      const allSatisfyingVersions =\n        (inRangeOnlyStrategy || config.rollbackPrs) && !unconstrainedValue\n          ? allVersions.filter((v) =>\n              // TODO #22198\n              versioningApi.matches(v.version, compareValue!),\n            )\n          : allVersions;\n      if (!allSatisfyingVersions.length) {\n        logger.debug(\n          `Found no satisfying versions with '${config.versioning}' versioning`,\n        );\n      }\n\n      if (config.rollbackPrs && !allSatisfyingVersions.length) {\n        const rollback = getRollbackUpdate(config, allVersions, versioningApi);\n        // istanbul ignore if\n        if (!rollback) {\n          res.warnings.push({\n            topic: config.packageName,\n            // TODO: types (#22198)\n            message: `Can't find version matching ${compareValue!} for ${\n              config.datasource\n            } package ${config.packageName}`,\n          });\n          return Result.ok(res);\n        }\n        res.updates.push(rollback);\n      }\n      let rangeStrategy = getRangeStrategy(config);\n\n      // istanbul ignore next\n      if (\n        config.isVulnerabilityAlert &&\n        rangeStrategy === 'update-lockfile' &&\n        !config.lockedVersion\n      ) {\n        rangeStrategy = 'bump';\n      }\n      // unconstrained deps with lockedVersion\n      if (\n        config.isVulnerabilityAlert &&\n        !config.currentValue &&\n        config.lockedVersion\n      ) {\n        rangeStrategy = 'update-lockfile';\n      }\n      const nonDeprecatedVersions = dependency.releases\n        .filter((release) => !release.isDeprecated)\n        .map((release) => release.version);\n      let currentVersion: string;\n      if (rangeStrategy === 'update-lockfile') {\n        currentVersion = config.lockedVersion!;\n      } else if (\n        compareValue &&\n        versioningApi.isSingleVersion(compareValue) &&\n        allVersions.find((v) => v.version === compareValue)\n      ) {\n        currentVersion = compareValue;\n      }\n      // TODO #22198\n      currentVersion ??=\n        getCurrentVersion(\n          compareValue!,\n          config.lockedVersion!,\n          versioningApi,\n          rangeStrategy!,\n          latestVersion!,\n          nonDeprecatedVersions,\n        ) ??\n        getCurrentVersion(\n          compareValue!,\n          config.lockedVersion!,\n          versioningApi,\n          rangeStrategy!,\n          latestVersion!,\n          allVersions.map((v) => v.version),\n        )!;\n\n      if (!currentVersion) {\n        // v8 ignore else -- TODO: add test #40625\n        if (!config.lockedVersion) {\n          logger.debug(\n            `No currentVersion or lockedVersion found for ${config.packageName}`,\n          );\n          res.skipReason = 'invalid-value';\n        }\n        return Result.ok(res);\n      }\n\n      res.currentVersion = currentVersion;\n\n      // Use lockedVersion for the timestamp lookup when available, because\n      // res.currentVersion is later overwritten to lockedVersion (see below).\n      // Without this, strategies like \"replace\" would compute the timestamp\n      // for the highest satisfying version (e.g. 1.4.1) while the reported\n      // currentVersion ends up being the locked one (e.g. 1.0.0).\n      const versionForTimestamp = config.lockedVersion ?? currentVersion;\n      const currentVersionTimestamp = await getTimestamp(\n        config,\n        allVersions,\n        versionForTimestamp,\n        versioningApi,\n      );\n\n      if (isNonEmptyString(currentVersionTimestamp)) {\n        res.currentVersionTimestamp = currentVersionTimestamp;\n        res.currentVersionAgeInDays = getElapsedDays(currentVersionTimestamp);\n\n        if (\n          config.packageRules?.some((rule) =>\n            isNonEmptyString(rule.matchCurrentAge),\n          )\n        ) {\n          // Reapply package rules to check matches for matchCurrentAge\n          config = await applyPackageRules(\n            { ...config, currentVersionTimestamp },\n            'current-timestamp',\n          );\n        }\n      }\n\n      if (\n        config.currentDigest\n          ? couldApplyMinimumReleaseAgeToDigest(config, 'digest')\n          : config.pinDigests &&\n            couldApplyMinimumReleaseAgeToDigest(config, 'pinDigest')\n      ) {\n        // Resolve from `allVersions` (not `dependency.releases`) so that filters like followTag apply, preferring non-deprecated versions with a fallback - both like the `currentVersion` resolution above.\n        const newestMatchingVersion =\n          getCurrentVersion(\n            compareValue!,\n            '',\n            versioningApi,\n            'replace',\n            latestVersion!,\n            allVersions.filter((v) => !v.isDeprecated).map((v) => v.version),\n          ) ??\n          getCurrentVersion(\n            compareValue!,\n            '',\n            versioningApi,\n            'replace',\n            latestVersion!,\n            allVersions.map((v) => v.version),\n          );\n        if (newestMatchingVersion) {\n          newestMatchingVersionTimestamp = await getTimestamp(\n            config,\n            allVersions,\n            newestMatchingVersion,\n            versioningApi,\n          );\n        }\n      }\n\n      if (\n        compareValue &&\n        currentVersion &&\n        rangeStrategy === 'pin' &&\n        !versioningApi.isSingleVersion(compareValue)\n      ) {\n        const newValue =\n          versioningApi.getPinnedValue?.(currentVersion) ?? currentVersion;\n        res.updates.push({\n          updateType: 'pin',\n          isPin: true,\n          newValue,\n          newVersion: currentVersion,\n          newMajor: versioningApi.getMajor(currentVersion)!,\n        });\n      }\n      if (rangeStrategy === 'pin') {\n        // Fall back to replace once pinning logic is done\n        rangeStrategy = 'replace';\n      }\n      // istanbul ignore if\n      if (!versioningApi.isVersion(currentVersion!)) {\n        res.skipReason = 'invalid-version';\n        return Result.ok(res);\n      }\n      // Filter latest, unstable, etc\n      // TODO #22198\n      let filteredReleases = filterVersions(\n        config,\n        currentVersion!,\n        latestVersion!,\n        inRangeOnlyStrategy ? allSatisfyingVersions : allVersions,\n        versioningApi,\n      ).filter(\n        (v) =>\n          // Leave only compatible versions\n          unconstrainedValue ||\n          versioningApi.isCompatible(v.version, compareValue),\n      );\n      let shrinkedViaVulnerability = false;\n      if (config.isVulnerabilityAlert) {\n        if (config.vulnerabilityFixVersion) {\n          res.vulnerabilityFixVersion = config.vulnerabilityFixVersion;\n          res.vulnerabilityFixStrategy = config.vulnerabilityFixStrategy;\n          if (versioningApi.isValid(config.vulnerabilityFixVersion)) {\n            let fixedFilteredReleases;\n            if (versioningApi.isVersion(config.vulnerabilityFixVersion)) {\n              // Retain only releases greater than or equal to the fix version\n              fixedFilteredReleases = filteredReleases.filter(\n                (release) =>\n                  !versioningApi.isGreaterThan(\n                    config.vulnerabilityFixVersion!,\n                    release.version,\n                  ),\n              );\n            } else {\n              // Retain only releases which max the fix constraint\n              fixedFilteredReleases = filteredReleases.filter((release) =>\n                versioningApi.matches(\n                  release.version,\n                  config.vulnerabilityFixVersion!,\n                ),\n              );\n            }\n            // Warn if this filtering results caused zero releases\n            if (fixedFilteredReleases.length === 0 && filteredReleases.length) {\n              logger.warn(\n                {\n                  releases: filteredReleases,\n                  vulnerabilityFixVersion: config.vulnerabilityFixVersion,\n                  packageName: config.packageName,\n                },\n                'No releases satisfy vulnerabilityFixVersion',\n              );\n            }\n            // Use the additionally filtered releases\n            filteredReleases = fixedFilteredReleases;\n          } else {\n            logger.warn(\n              {\n                vulnerabilityFixVersion: config.vulnerabilityFixVersion,\n                packageName: config.packageName,\n              },\n              'vulnerabilityFixVersion is not valid',\n            );\n          }\n        }\n        if (config.vulnerabilityFixStrategy === 'highest') {\n          // Don't shrink the list of releases - let Renovate use its normal logic\n          logger.once.debug(\n            `Using vulnerabilityFixStrategy=highest for ${config.packageName}`,\n          );\n        } else {\n          // Shrink the list of releases to the lowest fixed version\n          logger.once.debug(\n            `Using vulnerabilityFixStrategy=lowest for ${config.packageName}`,\n          );\n          filteredReleases = filteredReleases.slice(0, 1);\n          shrinkedViaVulnerability = true;\n        }\n      }\n      const buckets: Record<string, [Release]> = {};\n      for (const release of filteredReleases) {\n        const bucket = getBucket(\n          config,\n          // TODO #22198\n          currentVersion!,\n          release.version,\n          versioningApi,\n        );\n        // v8 ignore else -- TODO: add test #40625\n        if (isString(bucket)) {\n          if (buckets[bucket]) {\n            buckets[bucket].push(release);\n          } else {\n            buckets[bucket] = [release];\n          }\n        }\n      }\n      const depResultConfig = mergeChildConfig(config, res);\n      for (const [bucket, releases] of Object.entries(buckets)) {\n        const sortedReleases = releases.sort((r1, r2) =>\n          versioningApi.sortVersions(r1.version, r2.version),\n        );\n        const { release, pendingChecks, pendingReleases } =\n          await filterInternalChecks(\n            depResultConfig,\n            versioningApi,\n            bucket,\n            sortedReleases,\n          );\n        // istanbul ignore next\n        if (!release) {\n          return Result.ok(res);\n        }\n        const newVersion = release.version;\n        const update = await generateUpdate(\n          config,\n          compareValue,\n          versioningApi,\n          // TODO #22198\n\n          rangeStrategy!,\n          config.lockedVersion ?? currentVersion!,\n          bucket,\n          release,\n          allReleaseVersions,\n        );\n\n        // #29034\n        if (\n          config.manager === 'gomod' &&\n          compareValue?.startsWith('v0.0.0-') &&\n          update.newValue?.startsWith('v0.0.0-') &&\n          config.currentDigest !== update.newDigest\n        ) {\n          update.updateType = 'digest';\n\n          // As this has already been processed by `filterInternalChecks()`, but we're changing the `updateType`, we need to apply the digest-scoped minimumReleaseAge rules.\n          // `currentVersionWasResolved` only matters for `pinDigest`, which `update.updateType` never is here - true is a safe constant.\n          await applyMinimumReleaseAgeToDigestUpdate(\n            update as DigestLikeUpdate,\n            config,\n            res,\n            true,\n            release.releaseTimestamp,\n          );\n        }\n\n        if (pendingChecks) {\n          update.pendingChecks = pendingChecks;\n        }\n\n        if (pendingReleases.length) {\n          update.pendingVersions = pendingReleases.map((r) => r.version);\n        }\n        if (!update.newValue || update.newValue === compareValue) {\n          if (!config.lockedVersion) {\n            continue;\n          }\n          // istanbul ignore if\n          if (rangeStrategy === 'bump') {\n            logger.trace(\n              {\n                packageName: config.packageName,\n                currentValue: config.currentValue,\n                lockedVersion: config.lockedVersion,\n                newVersion,\n              },\n              'Skipping bump because newValue is the same',\n            );\n            continue;\n          }\n          res.isSingleVersion = true;\n        }\n        res.isSingleVersion ??=\n          isString(update.newValue) &&\n          versioningApi.isSingleVersion(update.newValue);\n        // istanbul ignore if\n        if (\n          config.versioning === dockerVersioningId &&\n          update.updateType !== 'rollback' &&\n          update.newValue &&\n          versioningApi.isVersion(update.newValue) &&\n          compareValue &&\n          versioningApi.isVersion(compareValue) &&\n          versioningApi.isGreaterThan(compareValue, update.newValue)\n        ) {\n          logger.warn(\n            {\n              packageName: config.packageName,\n              currentValue: config.currentValue,\n              compareValue,\n              currentVersion: config.currentVersion,\n              update,\n              allVersionsLength: allVersions.length,\n              filteredReleaseVersions: filteredReleases.map((r) => r.version),\n              shrinkedViaVulnerability,\n            },\n            'Unexpected downgrade detected: skipping',\n          );\n        } else {\n          res.updates.push(update);\n        }\n      }\n    } else if (compareValue) {\n      logger.debug(\n        `Dependency ${config.packageName} has unsupported/unversioned value ${compareValue} (versioning=${config.versioning})`,\n      );\n\n      if (!config.pinDigests && !config.currentDigest) {\n        logger.debug(\n          `Skipping ${config.packageName} because no currentDigest or pinDigests`,\n        );\n        res.skipReason = 'invalid-value';\n      } else {\n        delete res.skipReason;\n      }\n    } else {\n      res.skipReason = 'invalid-value';\n    }\n\n    if (isReplacementRulesConfigured(config)) {\n      addReplacementUpdateIfValid(res.updates, config);\n    } else if (dependency?.replacementName && dependency.replacementVersion) {\n      res.updates.push({\n        updateType: 'replacement',\n        newName: dependency.replacementName,\n        newValue: dependency.replacementVersion,\n      });\n    }\n\n    // Record if the dep is fixed to a version\n    if (config.lockedVersion) {\n      res.currentVersion = config.lockedVersion;\n      res.fixedVersion = config.lockedVersion;\n    } else if (compareValue && versioningApi.isSingleVersion(compareValue)) {\n      res.fixedVersion = compareValue.replace(regEx(/^=+/), '');\n    }\n\n    // massage versionCompatibility\n    if (\n      isString(config.currentValue) &&\n      isString(compareValue) &&\n      isString(config.versionCompatibility)\n    ) {\n      for (const update of res.updates) {\n        logger.debug({ update });\n        // v8 ignore else -- TODO: add test #40625\n        if (isString(config.currentValue) && isString(update.newValue)) {\n          update.newValue = config.currentValue.replace(\n            compareValue,\n            update.newValue,\n          );\n        }\n      }\n    }\n\n    // Add digests if necessary\n    if (supportsDigests(config.datasource)) {\n      if (config.currentDigest) {\n        if (!config.digestOneAndOnly || !res.updates.length) {\n          // digest update - age-checked after the strip below, once newDigest is known\n          digestUpdate = {\n            updateType: 'digest',\n            newValue: config.currentValue,\n          };\n          res.updates.push(digestUpdate);\n        }\n      } else if (\n        config.pinDigests &&\n        // Create a pin only if one doesn't already exists\n        // v8 ignore else -- TODO: add test #40625\n        !res.updates.some((update) => update.updateType === 'pin')\n      ) {\n        // pin digest\n        const pinDigestUpdate: DigestLikeUpdate = {\n          isPinDigest: true,\n          updateType: 'pinDigest',\n          newValue: config.currentValue,\n        };\n        await applyMinimumReleaseAgeToDigestUpdate(\n          pinDigestUpdate,\n          config,\n          res,\n          isValid || unconstrainedValue,\n          newestMatchingVersionTimestamp,\n        );\n        res.updates.push(pinDigestUpdate);\n      }\n      if (versioningApi.valueToVersion) {\n        // TODO #22198\n        res.currentVersion = versioningApi.valueToVersion(res.currentVersion!);\n        for (const update of res.updates) {\n          // TODO #22198\n          update.newVersion = versioningApi.valueToVersion(update.newVersion!);\n        }\n      }\n      if (res.registryUrl) {\n        config.registryUrls = [res.registryUrl];\n      }\n\n      // update digest for all\n      for (const update of res.updates) {\n        if (config.pinDigests === true || config.currentDigest) {\n          const getDigestConfig: GetDigestInputConfig = {\n            ...config,\n            registryUrl: update.registryUrl ?? res.registryUrl,\n            lookupName: res.lookupName,\n          };\n\n          // #20304 only pass it for replacement updates, otherwise we get wrong or invalid digest\n          if (update.updateType !== 'replacement') {\n            delete getDigestConfig.replacementName;\n          }\n\n          // #20304 don't use lookupName and currentDigest when we replace image name\n          if (\n            update.updateType === 'replacement' &&\n            update.newName !== config.packageName\n          ) {\n            delete getDigestConfig.lookupName;\n            delete getDigestConfig.currentDigest;\n            getDigestConfig.replacementName = update.newName;\n          }\n\n          // Don't use current releases if replacement changes name, otherwise we use the wrong new digest.\n          // This happens on datasources which return the digest in release info like `github-tags`.\n          // We can still use it when only version is changing.\n          if (\n            update.updateType !== 'replacement' ||\n            update.newName === config.packageName\n          ) {\n            update.newDigest ??= dependency?.releases.find(\n              (r) => r.version === update.newValue,\n            )?.newDigest;\n          }\n\n          update.newDigest ??= await getDigest(\n            getDigestConfig,\n            update.newValue,\n          );\n\n          // If the digest could not be determined, report this as otherwise the\n          // update will be omitted later on without notice.\n          if (update.newDigest === null) {\n            logger.debug(\n              {\n                packageName: config.packageName,\n                currentValue: config.currentValue,\n                datasource: config.datasource,\n                newValue: update.newValue,\n                bucket: update.bucket,\n              },\n              'Could not determine new digest for update.',\n            );\n\n            // Only report a warning if there is a current digest.\n            // Context: https://github.com/renovatebot/renovate/pull/20175#discussion_r1102615059.\n            if (config.currentDigest) {\n              res.warnings.push({\n                message: `Could not determine new digest for update (${config.datasource} package ${config.packageName})`,\n                topic: config.packageName,\n              });\n            }\n          }\n        } else {\n          delete update.newDigest;\n        }\n        if (update.newVersion) {\n          const registryUrl = dependency?.releases?.find(\n            (release) => release.version === update.newVersion,\n          )?.registryUrl;\n          if (registryUrl && registryUrl !== res.registryUrl) {\n            update.registryUrl = registryUrl;\n          }\n        }\n      }\n    }\n\n    if (res.updates.length) {\n      delete res.skipReason;\n    }\n    // Strip out any non-changed ones\n    res.updates = res.updates\n      .filter(\n        (update) => update.newValue !== null || config.currentValue === null,\n      )\n      .filter((update) => update.newDigest !== null)\n      .filter(\n        (update) =>\n          (isString(update.newName) && update.newName !== config.packageName) ||\n          update.isReplacement === true ||\n          update.newValue !== config.currentValue ||\n          update.isLockfileUpdate === true ||\n          // TODO #22198\n          (update.newDigest &&\n            !update.newDigest.startsWith(config.currentDigest!)),\n      );\n    // If range strategy specified in config is 'in-range-only', also strip out updates where currentValue !== newValue\n    if (config.rangeStrategy === 'in-range-only') {\n      res.updates = res.updates.filter(\n        (update) => update.newValue === config.currentValue,\n      );\n    }\n    // Handle a weird edge case involving followTag and fallbacks\n    if (config.rollbackPrs && config.followTag) {\n      res.updates = res.updates.filter(\n        (update) =>\n          update.updateType !== 'rollback' || res.updates.length === 1,\n      );\n    }\n\n    // If there is a digest update proposed which is in the pending updates for this dependency, ensure that `minimumReleaseAge` is applied.\n    // `currentVersionWasResolved` only matters for `pinDigest`, which `digestUpdate` never is - true is a safe constant.\n    if (digestUpdate && res.updates.includes(digestUpdate)) {\n      await applyMinimumReleaseAgeToDigestUpdate(\n        digestUpdate,\n        config,\n        res,\n        true,\n        newestMatchingVersionTimestamp,\n      );\n    }\n\n    const release =\n      res.updates.length > 0\n        ? (dependency?.releases.find(\n            (r) => r.version === res.updates[0].newValue,\n          ) ??\n          dependency?.releases.find(\n            (r) => r.version === res.updates[0].newVersion,\n          ))\n        : null;\n\n    if (release?.changelogContent) {\n      res.changelogContent = release.changelogContent;\n      res.changelogUrl = release.changelogUrl;\n    }\n  } catch (err) /* istanbul ignore next */ {\n    if (err instanceof ExternalHostError) {\n      return Result.err(err);\n    }\n\n    if (err instanceof Error && err.message === CONFIG_VALIDATION) {\n      return Result.err(err);\n    }\n\n    logger.error(\n      {\n        currentDigest: config.currentDigest,\n        currentValue: config.currentValue,\n        datasource: config.datasource,\n        packageName: config.packageName,\n        digestOneAndOnly: config.digestOneAndOnly,\n        followTag: config.followTag,\n        lockedVersion: config.lockedVersion,\n        packageFile: config.packageFile,\n        pinDigests: config.pinDigests,\n        rollbackPrs: config.rollbackPrs,\n        isVulnerabilityAlert: config.isVulnerabilityAlert,\n        updatePinnedDependencies: config.updatePinnedDependencies,\n        err,\n      },\n      'lookupUpdates error',\n    );\n    res.skipReason = 'internal-error';\n  }\n  return Result.ok(res);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,eAAe,aACb,QACA,UACA,SACA,eACuC;CACvC,MAAM,iBAAiB,SAAS,MAC7B,MACC,cAAc,QAAQ,EAAE,OAAO,KAC/B,cAAc,OAAO,EAAE,SAAS,OAAO,CAC3C;CAEA,IAAI,CAAC,gBACH,OAAO;CAGT,IAAI,eAAe,kBACjB,OAAO,eAAe;CAIxB,QAAO,MADqB,mBAAmB,QAAQ,cAAc,EAAA,EAC/C;AACxB;;;;;;AAUA,SAAS,oCACP,QACA,YACS;CAIT,IAAI,OAAO,yBAAyB,QAClC,OAAO;CAGT,OACE,iBAAiB,OAAO,iBAAiB,KACzC,iBAAiB,OAAO,WAAW,EAAE,iBAAiB,KACtD,CAAC,CAAC,OAAO,cAAc,MAAM,SAC3B,iBAAiB,KAAK,iBAAiB,CACzC;AAEJ;;;;;;AAOA,eAAe,qCACb,QACA,QACA,KACA,2BACA,gCACe;CACf,IAAI,CAAC,oCAAoC,QAAQ,OAAO,UAAU,GAChE;CAGF,IAAI,OAAO,eAAe,eAAe,CAAC,2BAA2B;EAMnE,OAAO,KAAK,MACV;GAAE,SAAS,OAAO;GAAS,YAAY,OAAO;EAAW,GACzD,wCAAwC,OAAO,WAAW,aAAa,OAAO,QAAQ,+DACxF;EACA;CACF;CAEA,IAAI,gBAAoC;EACtC,GAAG,iBAAiB,QAAQ,GAAG;EAC/B,YAAY,OAAO;CACrB;CACA,gBAAgB,iBACd,eACA,cAAc,OAAO,WACvB;CACA,gBAAgB,MAAM,kBAAkB,eAAe,aAAa;CAMpE,MAAM,WAAW,uBACf,eACA,8BACF;CAGA,IAAI,SAAS,uBAAuB,CAAC,SAAS,cAAc;EAC1D,IAAI,cAAc,+BAA+B,sBAC/C,OAAO,KAAK,KACV,2KACF;EAGF,OAAO,KAAK,MACV;GACE,SAAS,OAAO;GAChB,YAAY,OAAO;GACnB,4BAA4B,cAAc;GAC1C,OAAO;EACT,GACA,GAAG,OAAO,WAAW,aAAa,OAAO,QAAQ,wCACnD;CACF;CACA,IAAI,SAAS,WAAW;EACtB,OAAO,MACL;GACE,SAAS,OAAO;GAChB,YAAY,OAAO;GACnB,kBAAkB;GAClB,OAAO;EACT,GACA,GAAG,OAAO,WAAW,mDACvB;EAGA,IAAI,OAAO,yBAAyB,UAClC,OAAO,gBAAgB;CAE3B;AACF;AAEA,eAAsB,cACpB,UAC+B;CAC/B,IAAI,SAA6B,EAAE,GAAG,SAAS;CAC/C,OAAO,eAAe,qBAAqB,OAAO,UAAU;CAE5D,MAAM,gBAAgBA,IAAkB,OAAO,UAAU;CAEzD,IAAI,aAAmC;CACvC,MAAM,MAAoB;EACxB,YAAY,OAAO;EACnB,SAAS,CAAC;EACV,UAAU,CAAC;CACb;CAEA,IAAI;CAEJ,IAAI;CAEJ,IAAI;EACF,OAAO,MACL;GACE,YAAY,OAAO;GACnB,cAAc,OAAO;EACvB,GACA,eACF;EACA,IAAI,OAAO,gBAAgB,CAAC,SAAS,OAAO,YAAY,GAAG;;GAGzD,IAAI,OAAO,cACT,OAAO,MACL,4BAA4B,OAAO,YAAY,IAAI,KAAK,UAAU,OAAO,YAAY,EAAE,IAAI,OAAO,OAAO,aAAa,EACxH;GAEF,IAAI,aAAa;GACjB,OAAO,OAAO,GAAG,GAAG;EACtB;EACA,IACE,CAAC,uBAAuB,MAAM,KAC9B,CAAC,iBAAiB,OAAO,UAAU,GACnC;GACA,IAAI,aAAa;GACjB,OAAO,OAAO,GAAG,GAAG;EACtB;EACA,IAAI,eAAe,OAAO;EAC1B,IACE,SAAS,OAAO,YAAY,KAC5B,SAAS,OAAO,oBAAoB,GACpC;GAEA,MAAM,aAD2B,MAAM,OAAO,oBACJ,CAAC,CAAC,KAAK,OAAO,YAAY;GACpE,IAAI,YAAY,QAAQ;IACtB,OAAO,MACL;KACE,sBAAsB,OAAO;KAC7B,cAAc,OAAO;KACrB,aAAa,OAAO;KACpB,QAAQ,WAAW;IACrB,GACA,mCACF;IACA,OAAO,uBAAuB,WAAW,OAAO;IAChD,eAAe,WAAW,OAAO;GACnC,OACE,OAAO,MACL;IACE,sBAAsB,OAAO;IAC7B,cAAc,OAAO;IACrB,aAAa,OAAO;GACtB,GACA,sCACF;EAEJ;EAEA,MAAM,UACJ,SAAS,YAAY,KAAK,cAAc,QAAQ,YAAY;EAE9D,MAAM,qBACJ,CAAC,CAAC,OAAO,iBAAiB,YAAY,OAAO,YAAY;EAE3D,IAAI,WAAW,oBAAoB;GACjC,IACE,CAAC,OAAO,4BAER,cAAc,gBAAgB,YAAa,GAC3C;IACA,IAAI,aAAa;IACjB,OAAO,OAAO,GAAG,GAAG;GACtB;GAEA,MAAM,EAAE,KAAK,eAAe,KAAK,gBAAgB,MAAM,kBACrD,MACF,CAAC,CACE,WAAW,QAAQ,6BAA6B,eAAe,GAAG,CAAC,CAAC,CACpE,WAAW,QAAQ,qBAAqB,KAAK,MAAM,CAAC,CAAC,CACrD,WAAW,QAAQ,uBAAuB,KAAK,MAAM,CAAC,CAAC,CACvD,OAAO;GAEV,IAAI,uBAAuB,OACzB,MAAM;GAGR,IAAI,aAAa;IAEf,MAAM,UAA6B;KACjC,OAAO,OAAO;KACd,SAAS,qBAAqB,OAAO,WAAW,WAAW,OAAO,YAAY,IAAI;IACpF;IACA,OAAO,MACL;KACE,YAAY,OAAO;KACnB,aAAa,OAAO;IACtB,GACA,QAAQ,OACV;IAEA,IAAI,SAAS,KAAK,OAAO;IACzB,OAAO,OAAO,GAAG,GAAG;GACtB;GAEA,aAAa;GAEb,IAAI,WAAW,oBACb,OAAO,MACL,gCAAgC,OAAO,WAAW,WAAW,OAAO,aACtE;GAGF,WAAW,KAAK,YAAY;IAC1B;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;GACF,CAAC;GAED,MAAM,gBAAgB,WAAW,MAAM;GAEvC,IAAI,cAAc,WAAW,SAAS,QAAQ,YAC5C,cAAc,UAAU,QAAQ,OAAO,CACzC;GACA,MAAM,qBAAqB,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE,OAAO,CAAC;;GAEpE,IAAI,YAAY,WAAW,GAAG;IAE5B,OAAO,KACL;KACE,YAAY,OAAO;KACnB,QAAQ;IACV,GACA,2DACF;IACA,IAAI,CAAC,OAAO,eACV,OAAO,OAAO,GAAG,GAAG;GAExB;GAEA,SAAS,MAAM,kBACb;IAAE,GAAG;IAAQ,WAAW,IAAI;GAAU,GACtC,YACF;GACA,IAAI,OAAO,WAAW;IACpB,MAAM,gBAAgB,WAAW,OAAO,OAAO;IAC/C,IAAI,CAAC,eAAe;KAClB,IAAI,SAAS,KAAK;MAChB,OAAO,OAAO;MACd,SAAS,+BAA+B,OAAO,UAAU,OAAO,OAAO,WAAW,WAAW,OAAO;KACtG,CAAC;KACD,OAAO,OAAO,GAAG,GAAG;IACtB;IACA,cAAc,YAAY,QACvB,MACC,EAAE,YAAY,iBACb,EAAE,YAAY,gBACb,cAAc,cAAc,eAAe,YAAY,CAC7D;GACF;GAEA,MAAM,sBAAsB,OAAO,kBAAkB;GAErD,MAAM,yBACH,uBAAuB,OAAO,gBAAgB,CAAC,qBAC5C,YAAY,QAAQ,MAElB,cAAc,QAAQ,EAAE,SAAS,YAAa,CAChD,IACA;GACN,IAAI,CAAC,sBAAsB,QACzB,OAAO,MACL,sCAAsC,OAAO,WAAW,aAC1D;GAGF,IAAI,OAAO,eAAe,CAAC,sBAAsB,QAAQ;IACvD,MAAM,WAAW,kBAAkB,QAAQ,aAAa,aAAa;;IAErE,IAAI,CAAC,UAAU;KACb,IAAI,SAAS,KAAK;MAChB,OAAO,OAAO;MAEd,SAAS,+BAA+B,aAAc,OACpD,OAAO,WACR,WAAW,OAAO;KACrB,CAAC;KACD,OAAO,OAAO,GAAG,GAAG;IACtB;IACA,IAAI,QAAQ,KAAK,QAAQ;GAC3B;GACA,IAAI,gBAAgB,iBAAiB,MAAM;;GAG3C,IACE,OAAO,wBACP,kBAAkB,qBAClB,CAAC,OAAO,eAER,gBAAgB;GAGlB,IACE,OAAO,wBACP,CAAC,OAAO,gBACR,OAAO,eAEP,gBAAgB;GAElB,MAAM,wBAAwB,WAAW,SACtC,QAAQ,YAAY,CAAC,QAAQ,YAAY,CAAC,CAC1C,KAAK,YAAY,QAAQ,OAAO;GACnC,IAAI;GACJ,IAAI,kBAAkB,mBACpB,iBAAiB,OAAO;QACnB,IACL,gBACA,cAAc,gBAAgB,YAAY,KAC1C,YAAY,MAAM,MAAM,EAAE,YAAY,YAAY,GAElD,iBAAiB;GAGnB,mBACE,kBACE,cACA,OAAO,eACP,eACA,eACA,eACA,qBACF,KACA,kBACE,cACA,OAAO,eACP,eACA,eACA,eACA,YAAY,KAAK,MAAM,EAAE,OAAO,CAClC;GAEF,IAAI,CAAC,gBAAgB;;IAEnB,IAAI,CAAC,OAAO,eAAe;KACzB,OAAO,MACL,gDAAgD,OAAO,aACzD;KACA,IAAI,aAAa;IACnB;IACA,OAAO,OAAO,GAAG,GAAG;GACtB;GAEA,IAAI,iBAAiB;GAOrB,MAAM,sBAAsB,OAAO,iBAAiB;GACpD,MAAM,0BAA0B,MAAM,aACpC,QACA,aACA,qBACA,aACF;GAEA,IAAI,iBAAiB,uBAAuB,GAAG;IAC7C,IAAI,0BAA0B;IAC9B,IAAI,0BAA0B,eAAe,uBAAuB;IAEpE,IACE,OAAO,cAAc,MAAM,SACzB,iBAAiB,KAAK,eAAe,CACvC,GAGA,SAAS,MAAM,kBACb;KAAE,GAAG;KAAQ;IAAwB,GACrC,mBACF;GAEJ;GAEA,IACE,OAAO,gBACH,oCAAoC,QAAQ,QAAQ,IACpD,OAAO,cACP,oCAAoC,QAAQ,WAAW,GAC3D;IAEA,MAAM,wBACJ,kBACE,cACA,IACA,eACA,WACA,eACA,YAAY,QAAQ,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC,KAAK,MAAM,EAAE,OAAO,CACjE,KACA,kBACE,cACA,IACA,eACA,WACA,eACA,YAAY,KAAK,MAAM,EAAE,OAAO,CAClC;IACF,IAAI,uBACF,iCAAiC,MAAM,aACrC,QACA,aACA,uBACA,aACF;GAEJ;GAEA,IACE,gBACA,kBACA,kBAAkB,SAClB,CAAC,cAAc,gBAAgB,YAAY,GAC3C;IACA,MAAM,WACJ,cAAc,iBAAiB,cAAc,KAAK;IACpD,IAAI,QAAQ,KAAK;KACf,YAAY;KACZ,OAAO;KACP;KACA,YAAY;KACZ,UAAU,cAAc,SAAS,cAAc;IACjD,CAAC;GACH;GACA,IAAI,kBAAkB,OAEpB,gBAAgB;;GAGlB,IAAI,CAAC,cAAc,UAAU,cAAe,GAAG;IAC7C,IAAI,aAAa;IACjB,OAAO,OAAO,GAAG,GAAG;GACtB;GAGA,IAAI,mBAAmB,eACrB,QACA,gBACA,eACA,sBAAsB,wBAAwB,aAC9C,aACF,CAAC,CAAC,QACC,MAEC,sBACA,cAAc,aAAa,EAAE,SAAS,YAAY,CACtD;GACA,IAAI,2BAA2B;GAC/B,IAAI,OAAO,sBAAsB;IAC/B,IAAI,OAAO,yBAAyB;KAClC,IAAI,0BAA0B,OAAO;KACrC,IAAI,2BAA2B,OAAO;KACtC,IAAI,cAAc,QAAQ,OAAO,uBAAuB,GAAG;MACzD,IAAI;MACJ,IAAI,cAAc,UAAU,OAAO,uBAAuB,GAExD,wBAAwB,iBAAiB,QACtC,YACC,CAAC,cAAc,cACb,OAAO,yBACP,QAAQ,OACV,CACJ;WAGA,wBAAwB,iBAAiB,QAAQ,YAC/C,cAAc,QACZ,QAAQ,SACR,OAAO,uBACT,CACF;MAGF,IAAI,sBAAsB,WAAW,KAAK,iBAAiB,QACzD,OAAO,KACL;OACE,UAAU;OACV,yBAAyB,OAAO;OAChC,aAAa,OAAO;MACtB,GACA,6CACF;MAGF,mBAAmB;KACrB,OACE,OAAO,KACL;MACE,yBAAyB,OAAO;MAChC,aAAa,OAAO;KACtB,GACA,sCACF;IAEJ;IACA,IAAI,OAAO,6BAA6B,WAEtC,OAAO,KAAK,MACV,8CAA8C,OAAO,aACvD;SACK;KAEL,OAAO,KAAK,MACV,6CAA6C,OAAO,aACtD;KACA,mBAAmB,iBAAiB,MAAM,GAAG,CAAC;KAC9C,2BAA2B;IAC7B;GACF;GACA,MAAM,UAAqC,CAAC;GAC5C,KAAK,MAAM,WAAW,kBAAkB;IACtC,MAAM,SAAS,UACb,QAEA,gBACA,QAAQ,SACR,aACF;;IAEA,IAAI,SAAS,MAAM,GACjB,IAAI,QAAQ,SACV,QAAQ,OAAO,CAAC,KAAK,OAAO;SAE5B,QAAQ,UAAU,CAAC,OAAO;GAGhC;GACA,MAAM,kBAAkB,iBAAiB,QAAQ,GAAG;GACpD,KAAK,MAAM,CAAC,QAAQ,aAAa,OAAO,QAAQ,OAAO,GAAG;IACxD,MAAM,iBAAiB,SAAS,MAAM,IAAI,OACxC,cAAc,aAAa,GAAG,SAAS,GAAG,OAAO,CACnD;IACA,MAAM,EAAE,SAAS,eAAe,oBAC9B,MAAM,qBACJ,iBACA,eACA,QACA,cACF;;IAEF,IAAI,CAAC,SACH,OAAO,OAAO,GAAG,GAAG;IAEtB,MAAM,aAAa,QAAQ;IAC3B,MAAM,SAAS,MAAM,eACnB,QACA,cACA,eAGA,eACA,OAAO,iBAAiB,gBACxB,QACA,SACA,kBACF;IAGA,IACE,OAAO,YAAY,WACnB,cAAc,WAAW,SAAS,KAClC,OAAO,UAAU,WAAW,SAAS,KACrC,OAAO,kBAAkB,OAAO,WAChC;KACA,OAAO,aAAa;KAIpB,MAAM,qCACJ,QACA,QACA,KACA,MACA,QAAQ,gBACV;IACF;IAEA,IAAI,eACF,OAAO,gBAAgB;IAGzB,IAAI,gBAAgB,QAClB,OAAO,kBAAkB,gBAAgB,KAAK,MAAM,EAAE,OAAO;IAE/D,IAAI,CAAC,OAAO,YAAY,OAAO,aAAa,cAAc;KACxD,IAAI,CAAC,OAAO,eACV;;KAGF,IAAI,kBAAkB,QAAQ;MAC5B,OAAO,MACL;OACE,aAAa,OAAO;OACpB,cAAc,OAAO;OACrB,eAAe,OAAO;OACtB;MACF,GACA,4CACF;MACA;KACF;KACA,IAAI,kBAAkB;IACxB;IACA,IAAI,oBACF,SAAS,OAAO,QAAQ,KACxB,cAAc,gBAAgB,OAAO,QAAQ;;IAE/C,IACE,OAAO,eAAA,YACP,OAAO,eAAe,cACtB,OAAO,YACP,cAAc,UAAU,OAAO,QAAQ,KACvC,gBACA,cAAc,UAAU,YAAY,KACpC,cAAc,cAAc,cAAc,OAAO,QAAQ,GAEzD,OAAO,KACL;KACE,aAAa,OAAO;KACpB,cAAc,OAAO;KACrB;KACA,gBAAgB,OAAO;KACvB;KACA,mBAAmB,YAAY;KAC/B,yBAAyB,iBAAiB,KAAK,MAAM,EAAE,OAAO;KAC9D;IACF,GACA,yCACF;SAEA,IAAI,QAAQ,KAAK,MAAM;GAE3B;EACF,OAAO,IAAI,cAAc;GACvB,OAAO,MACL,cAAc,OAAO,YAAY,qCAAqC,aAAa,eAAe,OAAO,WAAW,EACtH;GAEA,IAAI,CAAC,OAAO,cAAc,CAAC,OAAO,eAAe;IAC/C,OAAO,MACL,YAAY,OAAO,YAAY,wCACjC;IACA,IAAI,aAAa;GACnB,OACE,OAAO,IAAI;EAEf,OACE,IAAI,aAAa;EAGnB,IAAI,6BAA6B,MAAM,GACrC,4BAA4B,IAAI,SAAS,MAAM;OAC1C,IAAI,YAAY,mBAAmB,WAAW,oBACnD,IAAI,QAAQ,KAAK;GACf,YAAY;GACZ,SAAS,WAAW;GACpB,UAAU,WAAW;EACvB,CAAC;EAIH,IAAI,OAAO,eAAe;GACxB,IAAI,iBAAiB,OAAO;GAC5B,IAAI,eAAe,OAAO;EAC5B,OAAO,IAAI,gBAAgB,cAAc,gBAAgB,YAAY,GACnE,IAAI,eAAe,aAAa,QAAQ,MAAM,KAAK,GAAG,EAAE;EAI1D,IACE,SAAS,OAAO,YAAY,KAC5B,SAAS,YAAY,KACrB,SAAS,OAAO,oBAAoB,GAEpC,KAAK,MAAM,UAAU,IAAI,SAAS;GAChC,OAAO,MAAM,EAAE,OAAO,CAAC;;GAEvB,IAAI,SAAS,OAAO,YAAY,KAAK,SAAS,OAAO,QAAQ,GAC3D,OAAO,WAAW,OAAO,aAAa,QACpC,cACA,OAAO,QACT;EAEJ;EAIF,IAAI,gBAAgB,OAAO,UAAU,GAAG;GACtC,IAAI,OAAO,eACL;QAAA,CAAC,OAAO,oBAAoB,CAAC,IAAI,QAAQ,QAAQ;KAEnD,eAAe;MACb,YAAY;MACZ,UAAU,OAAO;KACnB;KACA,IAAI,QAAQ,KAAK,YAAY;IAC/B;UACK,IACL,OAAO;;GAGP,CAAC,IAAI,QAAQ,MAAM,WAAW,OAAO,eAAe,KAAK,GACzD;IAEA,MAAM,kBAAoC;KACxC,aAAa;KACb,YAAY;KACZ,UAAU,OAAO;IACnB;IACA,MAAM,qCACJ,iBACA,QACA,KACA,WAAW,oBACX,8BACF;IACA,IAAI,QAAQ,KAAK,eAAe;GAClC;GACA,IAAI,cAAc,gBAAgB;IAEhC,IAAI,iBAAiB,cAAc,eAAe,IAAI,cAAe;IACrE,KAAK,MAAM,UAAU,IAAI,SAEvB,OAAO,aAAa,cAAc,eAAe,OAAO,UAAW;GAEvE;GACA,IAAI,IAAI,aACN,OAAO,eAAe,CAAC,IAAI,WAAW;GAIxC,KAAK,MAAM,UAAU,IAAI,SAAS;IAChC,IAAI,OAAO,eAAe,QAAQ,OAAO,eAAe;KACtD,MAAM,kBAAwC;MAC5C,GAAG;MACH,aAAa,OAAO,eAAe,IAAI;MACvC,YAAY,IAAI;KAClB;KAGA,IAAI,OAAO,eAAe,eACxB,OAAO,gBAAgB;KAIzB,IACE,OAAO,eAAe,iBACtB,OAAO,YAAY,OAAO,aAC1B;MACA,OAAO,gBAAgB;MACvB,OAAO,gBAAgB;MACvB,gBAAgB,kBAAkB,OAAO;KAC3C;KAKA,IACE,OAAO,eAAe,iBACtB,OAAO,YAAY,OAAO,aAE1B,OAAO,cAAc,YAAY,SAAS,MACvC,MAAM,EAAE,YAAY,OAAO,QAC9B,CAAC,EAAE;KAGL,OAAO,cAAc,MAAM,UACzB,iBACA,OAAO,QACT;KAIA,IAAI,OAAO,cAAc,MAAM;MAC7B,OAAO,MACL;OACE,aAAa,OAAO;OACpB,cAAc,OAAO;OACrB,YAAY,OAAO;OACnB,UAAU,OAAO;OACjB,QAAQ,OAAO;MACjB,GACA,4CACF;MAIA,IAAI,OAAO,eACT,IAAI,SAAS,KAAK;OAChB,SAAS,8CAA8C,OAAO,WAAW,WAAW,OAAO,YAAY;OACvG,OAAO,OAAO;MAChB,CAAC;KAEL;IACF,OACE,OAAO,OAAO;IAEhB,IAAI,OAAO,YAAY;KACrB,MAAM,cAAc,YAAY,UAAU,MACvC,YAAY,QAAQ,YAAY,OAAO,UAC1C,CAAC,EAAE;KACH,IAAI,eAAe,gBAAgB,IAAI,aACrC,OAAO,cAAc;IAEzB;GACF;EACF;EAEA,IAAI,IAAI,QAAQ,QACd,OAAO,IAAI;EAGb,IAAI,UAAU,IAAI,QACf,QACE,WAAW,OAAO,aAAa,QAAQ,OAAO,iBAAiB,IAClE,CAAC,CACA,QAAQ,WAAW,OAAO,cAAc,IAAI,CAAC,CAC7C,QACE,WACE,SAAS,OAAO,OAAO,KAAK,OAAO,YAAY,OAAO,eACvD,OAAO,kBAAkB,QACzB,OAAO,aAAa,OAAO,gBAC3B,OAAO,qBAAqB,QAE3B,OAAO,aACN,CAAC,OAAO,UAAU,WAAW,OAAO,aAAc,CACxD;EAEF,IAAI,OAAO,kBAAkB,iBAC3B,IAAI,UAAU,IAAI,QAAQ,QACvB,WAAW,OAAO,aAAa,OAAO,YACzC;EAGF,IAAI,OAAO,eAAe,OAAO,WAC/B,IAAI,UAAU,IAAI,QAAQ,QACvB,WACC,OAAO,eAAe,cAAc,IAAI,QAAQ,WAAW,CAC/D;EAKF,IAAI,gBAAgB,IAAI,QAAQ,SAAS,YAAY,GACnD,MAAM,qCACJ,cACA,QACA,KACA,MACA,8BACF;EAGF,MAAM,UACJ,IAAI,QAAQ,SAAS,IAChB,YAAY,SAAS,MACnB,MAAM,EAAE,YAAY,IAAI,QAAQ,EAAE,CAAC,QACtC,KACA,YAAY,SAAS,MAClB,MAAM,EAAE,YAAY,IAAI,QAAQ,EAAE,CAAC,UACtC,IACA;EAEN,IAAI,SAAS,kBAAkB;GAC7B,IAAI,mBAAmB,QAAQ;GAC/B,IAAI,eAAe,QAAQ;EAC7B;CACF,SAAS,gCAAgC;EACvC,IAAI,eAAe,mBACjB,OAAO,OAAO,IAAI,GAAG;EAGvB,IAAI,eAAe,SAAS,IAAI,YAAA,qBAC9B,OAAO,OAAO,IAAI,GAAG;EAGvB,OAAO,MACL;GACE,eAAe,OAAO;GACtB,cAAc,OAAO;GACrB,YAAY,OAAO;GACnB,aAAa,OAAO;GACpB,kBAAkB,OAAO;GACzB,WAAW,OAAO;GAClB,eAAe,OAAO;GACtB,aAAa,OAAO;GACpB,YAAY,OAAO;GACnB,aAAa,OAAO;GACpB,sBAAsB,OAAO;GAC7B,0BAA0B,OAAO;GACjC;EACF,GACA,qBACF;EACA,IAAI,aAAa;CACnB;CACA,OAAO,OAAO,GAAG,GAAG;AACtB"}
+{"version":3,"file":"index.js","names":["allVersioning.get"],"sources":["../../../../../lib/workers/repository/process/lookup/index.ts"],"sourcesContent":["import { isNonEmptyString, isString, isUndefined } from '@sindresorhus/is';\nimport { mergeChildConfig } from '../../../../config/index.ts';\nimport type { ValidationMessage } from '../../../../config/types.ts';\nimport { CONFIG_VALIDATION } from '../../../../constants/error-messages.ts';\nimport { logger } from '../../../../logger/index.ts';\nimport {\n  getDatasourceFor,\n  getDefaultVersioning,\n} from '../../../../modules/datasource/common.ts';\nimport type {\n  GetDigestInputConfig,\n  Release,\n  ReleaseResult,\n} from '../../../../modules/datasource/index.ts';\nimport {\n  applyDatasourceFilters,\n  getDigest,\n  getRawPkgReleases,\n  isGetPkgReleasesConfig,\n  supportsDigests,\n} from '../../../../modules/datasource/index.ts';\nimport { postprocessRelease } from '../../../../modules/datasource/postprocess-release.ts';\nimport { getRangeStrategy } from '../../../../modules/manager/index.ts';\nimport type { LookupUpdate } from '../../../../modules/manager/types.ts';\nimport { id as dockerVersioningId } from '../../../../modules/versioning/docker/index.ts';\nimport * as allVersioning from '../../../../modules/versioning/index.ts';\nimport { ExternalHostError } from '../../../../types/errors/external-host-error.ts';\nimport { assignKeys } from '../../../../util/assign-keys.ts';\nimport { getElapsedDays } from '../../../../util/date.ts';\nimport { checkMinimumReleaseAge } from '../../../../util/minimum-release-age.ts';\nimport { applyPackageRules } from '../../../../util/package-rules/index.ts';\nimport { regEx } from '../../../../util/regex.ts';\nimport { Result } from '../../../../util/result.ts';\nimport type { Timestamp } from '../../../../util/timestamp.ts';\nimport { calculateAbandonment } from './abandonment.ts';\nimport { getBucket } from './bucket.ts';\nimport { getCurrentVersion } from './current.ts';\nimport { filterVersions } from './filter.ts';\nimport { filterInternalChecks } from './filter-checks.ts';\nimport { generateUpdate } from './generate.ts';\nimport { getRollbackUpdate } from './rollback.ts';\nimport { calculateMostRecentTimestamp } from './timestamps.ts';\nimport type { LookupUpdateConfig, UpdateResult } from './types.ts';\nimport {\n  addReplacementUpdateIfValid,\n  isReplacementRulesConfigured,\n} from './utils.ts';\n\nasync function getTimestamp(\n  config: LookupUpdateConfig,\n  versions: Release[],\n  version: string,\n  versioningApi: allVersioning.VersioningApi,\n): Promise<Timestamp | null | undefined> {\n  const currentRelease = versions.find(\n    (v) =>\n      versioningApi.isValid(v.version) &&\n      versioningApi.equals(v.version, version),\n  );\n\n  if (!currentRelease) {\n    return null;\n  }\n\n  if (currentRelease.releaseTimestamp) {\n    return currentRelease.releaseTimestamp;\n  }\n\n  const remoteRelease = await postprocessRelease(config, currentRelease);\n  return remoteRelease?.releaseTimestamp;\n}\n\n/** The only two `updateType`s that `applyMinimumReleaseAgeToDigestUpdate()` can be called with */\ntype DigestLikeUpdate = LookupUpdate & { updateType: 'digest' | 'pinDigest' };\n\n/**\n * A helper function to allow a short-circuit for `minimumReleaseAge` functionality if a package may have config that applies it.\n *\n * Allows avoiding unnecessary calls to more expensive checks like merge + `applyPackageRules()` and `getTimestamp()`.\n */\nfunction couldApplyMinimumReleaseAgeToDigest(\n  config: LookupUpdateConfig,\n  updateType: DigestLikeUpdate['updateType'],\n): boolean {\n  // Match filterInternalChecks(): under `none` the user opted out of internal\n  // checks entirely, so do no merging, no package rules, no age check and no\n  // logging claiming an age check ran.\n  if (config.internalChecksFilter === 'none') {\n    return false;\n  }\n\n  return (\n    isNonEmptyString(config.minimumReleaseAge) ||\n    isNonEmptyString(config[updateType]?.minimumReleaseAge) ||\n    !!config.packageRules?.some((rule) =>\n      isNonEmptyString(rule.minimumReleaseAge),\n    )\n  );\n}\n\n/**\n * Ensure `minimumReleaseAge`/`internalChecksFilter` applies to digest/pinDigest updates, as they don't currently get run through `filterInternalChecks()`.\n *\n * NOTE that this should be kept in sync with `filterInternalChecks`()\n */\nasync function applyMinimumReleaseAgeToDigestUpdate(\n  update: DigestLikeUpdate,\n  config: LookupUpdateConfig,\n  res: UpdateResult,\n  currentVersionWasResolved: boolean,\n  newestMatchingVersionTimestamp: Timestamp | null | undefined,\n): Promise<void> {\n  if (!couldApplyMinimumReleaseAgeToDigest(config, update.updateType)) {\n    return;\n  }\n\n  if (update.updateType === 'pinDigest' && !currentVersionWasResolved) {\n    // Not `!res.currentVersion` - that's force-set to lockedVersion further down regardless of timestamp resolution.\n    // `pinDigest` doesn't repoint anywhere, unlike `digest` - it just freezes whatever the ref already resolves to.\n    // An unversioned tag (e.g. `latest`) has no versioned release to age against, and holding the pin would only\n    // prolong the less-pinned (less safe) state, so skip the check entirely rather than treating the missing\n    // timestamp as pending.\n    logger.once.debug(\n      { depName: config.depName, updateType: update.updateType },\n      `Skipping minimumReleaseAge check for ${update.updateType} update of ${config.depName}, as its current value does not resolve to a versioned release`,\n    );\n    return;\n  }\n\n  let releaseConfig: LookupUpdateConfig = {\n    ...mergeChildConfig(config, res),\n    updateType: update.updateType,\n  };\n  releaseConfig = mergeChildConfig(\n    releaseConfig,\n    releaseConfig[update.updateType]!,\n  );\n  releaseConfig = await applyPackageRules(releaseConfig, 'update-type');\n\n  // Not update.releaseTimestamp - that field means \"age of the new release\" elsewhere (generate.ts, libyear.ts).\n  // Not res.currentVersionTimestamp either - that tracks whatever rangeStrategy resolves currentVersion to (e.g.\n  // the oldest matching release under `bump`), whereas both `digest` and `pinDigest` reflect whatever the current\n  // value's ref actually resolves to *right now*, which is always the newest matching version.\n  const ageCheck = checkMinimumReleaseAge(\n    releaseConfig,\n    newestMatchingVersionTimestamp,\n  );\n\n  // Mirror filterInternalChecks()'s logging so a held/passed digest update is diagnosable.\n  if (ageCheck.minimumReleaseAgeMs && !ageCheck.hasTimestamp) {\n    if (releaseConfig.minimumReleaseAgeBehaviour === 'timestamp-optional') {\n      logger.once.warn(\n        \"Some release(s) did not have a releaseTimestamp, but as we're running with minimumReleaseAgeBehaviour=timestamp-optional, proceeding. See debug logs for more information\",\n      );\n    }\n\n    logger.once.debug(\n      {\n        depName: config.depName,\n        updateType: update.updateType,\n        minimumReleaseAgeBehaviour: releaseConfig.minimumReleaseAgeBehaviour,\n        check: 'minimumReleaseAge',\n      },\n      `${update.updateType} update of ${config.depName} has no releaseTimestamp to age against`,\n    );\n  }\n  if (ageCheck.isPending) {\n    logger.trace(\n      {\n        depName: config.depName,\n        updateType: update.updateType,\n        releaseTimestamp: newestMatchingVersionTimestamp,\n        check: 'minimumReleaseAge',\n      },\n      `${update.updateType} update is pending minimumReleaseAge status checks`,\n    );\n\n    // internalChecksFilter is read from the unmerged top-level config, like filterInternalChecks().\n    if (config.internalChecksFilter === 'strict') {\n      update.pendingChecks = true;\n    }\n  }\n}\n\nexport async function lookupUpdates(\n  inconfig: LookupUpdateConfig,\n): Promise<Result<UpdateResult>> {\n  let config: LookupUpdateConfig = { ...inconfig };\n  config.versioning ??= getDefaultVersioning(config.datasource);\n\n  const versioningApi = allVersioning.get(config.versioning);\n\n  let dependency: ReleaseResult | null = null;\n  const res: UpdateResult = {\n    versioning: config.versioning,\n    updates: [],\n    warnings: [],\n  };\n  // Timestamp of the release a `digest`/`pinDigest` update's current value currently resolves to (the newest version matching it, regardless of `rangeStrategy`), as opposed to `res.currentVersionTimestamp` which tracks whatever the configured rangeStrategy resolves `currentVersion` to (e.g. the oldest for `bump`)\n  let newestMatchingVersionTimestamp: Timestamp | null | undefined;\n  // The `digest` update for `config.currentDigest` (if one is added), so its age check can run after `newDigest` is fetched and no-op updates are stripped.\n  let digestUpdate: DigestLikeUpdate | undefined;\n\n  try {\n    logger.trace(\n      {\n        dependency: config.packageName,\n        currentValue: config.currentValue,\n      },\n      'lookupUpdates',\n    );\n    if (config.currentValue && !isString(config.currentValue)) {\n      // If currentValue is not a string, then it's invalid\n      // v8 ignore else -- TODO: add test #40625\n      if (config.currentValue) {\n        logger.debug(\n          `Invalid currentValue for ${config.packageName}: ${JSON.stringify(config.currentValue)} (${typeof config.currentValue})`,\n        );\n      }\n      res.skipReason = 'invalid-value';\n      return Result.ok(res);\n    }\n    if (\n      !isGetPkgReleasesConfig(config) ||\n      !getDatasourceFor(config.datasource)\n    ) {\n      res.skipReason = 'invalid-config';\n      return Result.ok(res);\n    }\n    let compareValue = config.currentValue;\n    if (\n      isString(config.currentValue) &&\n      isString(config.versionCompatibility)\n    ) {\n      const versionCompatbilityRegEx = regEx(config.versionCompatibility);\n      const regexMatch = versionCompatbilityRegEx.exec(config.currentValue);\n      if (regexMatch?.groups) {\n        logger.debug(\n          {\n            versionCompatibility: config.versionCompatibility,\n            currentValue: config.currentValue,\n            packageName: config.packageName,\n            groups: regexMatch.groups,\n          },\n          'version compatibility regex match',\n        );\n        config.currentCompatibility = regexMatch.groups.compatibility;\n        compareValue = regexMatch.groups.version;\n      } else {\n        logger.debug(\n          {\n            versionCompatibility: config.versionCompatibility,\n            currentValue: config.currentValue,\n            packageName: config.packageName,\n          },\n          'version compatibility regex mismatch',\n        );\n      }\n    }\n\n    const isValid =\n      isString(compareValue) && versioningApi.isValid(compareValue);\n\n    const unconstrainedValue =\n      !!config.lockedVersion && isUndefined(config.currentValue);\n\n    if (isValid || unconstrainedValue) {\n      if (\n        !config.updatePinnedDependencies &&\n        // TODO #22198\n        versioningApi.isSingleVersion(compareValue!)\n      ) {\n        res.skipReason = 'is-pinned';\n        return Result.ok(res);\n      }\n\n      const { val: releaseResult, err: lookupError } = await getRawPkgReleases(\n        config,\n      )\n        .transform((res) => calculateMostRecentTimestamp(versioningApi, res))\n        .transform((res) => calculateAbandonment(res, config))\n        .transform((res) => applyDatasourceFilters(res, config))\n        .unwrap();\n\n      if (lookupError instanceof Error) {\n        throw lookupError;\n      }\n\n      if (lookupError) {\n        // If dependency lookup fails then warn and return\n        const warning: ValidationMessage = {\n          topic: config.packageName,\n          message: `Failed to look up ${config.datasource} package ${config.packageName}: ${lookupError}`,\n        };\n        logger.debug(\n          {\n            dependency: config.packageName,\n            packageFile: config.packageFile,\n          },\n          warning.message,\n        );\n        // TODO: return warnings in own field\n        res.warnings.push(warning);\n        return Result.ok(res);\n      }\n\n      dependency = releaseResult;\n\n      if (dependency.deprecationMessage) {\n        logger.debug(\n          `Found deprecationMessage for ${config.datasource} package ${config.packageName}`,\n        );\n      }\n\n      assignKeys(res, dependency, [\n        'deprecationMessage',\n        'sourceUrl',\n        'registryUrl',\n        'sourceDirectory',\n        'homepage',\n        'changelogUrl',\n        'dependencyUrl',\n        'lookupName',\n        'packageScope',\n        'mostRecentTimestamp',\n        'isAbandoned',\n        'respectLatest',\n      ]);\n\n      const latestVersion = dependency.tags?.latest;\n      // Filter out any results from datasource that don't comply with our versioning\n      let allVersions = dependency.releases.filter((release) =>\n        versioningApi.isVersion(release.version),\n      );\n      const allReleaseVersions = new Set(allVersions.map((r) => r.version));\n      // istanbul ignore if\n      if (allVersions.length === 0) {\n        const message = `Found no results from datasource that look like a version`;\n        logger.info(\n          {\n            dependency: config.packageName,\n            result: dependency,\n          },\n          message,\n        );\n        if (!config.currentDigest) {\n          return Result.ok(res);\n        }\n      }\n      // Reapply package rules in case we missed something from sourceUrl\n      config = await applyPackageRules(\n        { ...config, sourceUrl: res.sourceUrl },\n        'source-url',\n      );\n      if (config.followTag) {\n        const taggedVersion = dependency.tags?.[config.followTag];\n        if (!taggedVersion) {\n          res.warnings.push({\n            topic: config.packageName,\n            message: `Can't find version with tag ${config.followTag} for ${config.datasource} package ${config.packageName}`,\n          });\n          return Result.ok(res);\n        }\n        allVersions = allVersions.filter(\n          (v) =>\n            v.version === taggedVersion ||\n            (v.version === compareValue &&\n              versioningApi.isGreaterThan(taggedVersion, compareValue)),\n        );\n      }\n\n      const inRangeOnlyStrategy = config.rangeStrategy === 'in-range-only';\n      // Check that existing constraint can be satisfied\n      const allSatisfyingVersions =\n        (inRangeOnlyStrategy || config.rollbackPrs) && !unconstrainedValue\n          ? allVersions.filter((v) =>\n              // TODO #22198\n              versioningApi.matches(v.version, compareValue!),\n            )\n          : allVersions;\n      if (!allSatisfyingVersions.length) {\n        logger.debug(\n          `Found no satisfying versions with '${config.versioning}' versioning`,\n        );\n      }\n\n      if (config.rollbackPrs && !allSatisfyingVersions.length) {\n        const rollback = getRollbackUpdate(config, allVersions, versioningApi);\n        // istanbul ignore if\n        if (!rollback) {\n          res.warnings.push({\n            topic: config.packageName,\n            // TODO: types (#22198)\n            message: `Can't find version matching ${compareValue!} for ${\n              config.datasource\n            } package ${config.packageName}`,\n          });\n          return Result.ok(res);\n        }\n        res.updates.push(rollback);\n      }\n      let rangeStrategy = getRangeStrategy(config);\n\n      // istanbul ignore next\n      if (\n        config.isVulnerabilityAlert &&\n        rangeStrategy === 'update-lockfile' &&\n        !config.lockedVersion\n      ) {\n        rangeStrategy = 'bump';\n      }\n      // unconstrained deps with lockedVersion\n      if (\n        config.isVulnerabilityAlert &&\n        !config.currentValue &&\n        config.lockedVersion\n      ) {\n        rangeStrategy = 'update-lockfile';\n      }\n      const nonDeprecatedVersions = dependency.releases\n        .filter((release) => !release.isDeprecated)\n        .map((release) => release.version);\n      let currentVersion: string;\n      if (rangeStrategy === 'update-lockfile') {\n        currentVersion = config.lockedVersion!;\n      } else if (\n        compareValue &&\n        versioningApi.isSingleVersion(compareValue) &&\n        allVersions.find((v) => v.version === compareValue)\n      ) {\n        currentVersion = compareValue;\n      }\n      // TODO #22198\n      currentVersion ??=\n        getCurrentVersion(\n          compareValue!,\n          config.lockedVersion!,\n          versioningApi,\n          rangeStrategy!,\n          latestVersion!,\n          nonDeprecatedVersions,\n        ) ??\n        getCurrentVersion(\n          compareValue!,\n          config.lockedVersion!,\n          versioningApi,\n          rangeStrategy!,\n          latestVersion!,\n          allVersions.map((v) => v.version),\n        )!;\n\n      if (!currentVersion) {\n        // v8 ignore else -- TODO: add test #40625\n        if (!config.lockedVersion) {\n          logger.debug(\n            `No currentVersion or lockedVersion found for ${config.packageName}`,\n          );\n          res.skipReason = 'invalid-value';\n        }\n        return Result.ok(res);\n      }\n\n      res.currentVersion = currentVersion;\n\n      // Use lockedVersion for the timestamp lookup when available, because\n      // res.currentVersion is later overwritten to lockedVersion (see below).\n      // Without this, strategies like \"replace\" would compute the timestamp\n      // for the highest satisfying version (e.g. 1.4.1) while the reported\n      // currentVersion ends up being the locked one (e.g. 1.0.0).\n      const versionForTimestamp = config.lockedVersion ?? currentVersion;\n      const currentVersionTimestamp = await getTimestamp(\n        config,\n        allVersions,\n        versionForTimestamp,\n        versioningApi,\n      );\n\n      if (isNonEmptyString(currentVersionTimestamp)) {\n        res.currentVersionTimestamp = currentVersionTimestamp;\n        res.currentVersionAgeInDays = getElapsedDays(currentVersionTimestamp);\n\n        if (\n          config.packageRules?.some((rule) =>\n            isNonEmptyString(rule.matchCurrentAge),\n          )\n        ) {\n          // Reapply package rules to check matches for matchCurrentAge\n          config = await applyPackageRules(\n            { ...config, currentVersionTimestamp },\n            'current-timestamp',\n          );\n        }\n      }\n\n      if (\n        config.currentDigest\n          ? couldApplyMinimumReleaseAgeToDigest(config, 'digest')\n          : config.pinDigests &&\n            couldApplyMinimumReleaseAgeToDigest(config, 'pinDigest')\n      ) {\n        // Resolve from `allVersions` (not `dependency.releases`) so that filters like followTag apply, preferring non-deprecated versions with a fallback - both like the `currentVersion` resolution above.\n        const newestMatchingVersion =\n          getCurrentVersion(\n            compareValue!,\n            '',\n            versioningApi,\n            'replace',\n            latestVersion!,\n            allVersions.filter((v) => !v.isDeprecated).map((v) => v.version),\n          ) ??\n          getCurrentVersion(\n            compareValue!,\n            '',\n            versioningApi,\n            'replace',\n            latestVersion!,\n            allVersions.map((v) => v.version),\n          );\n        if (newestMatchingVersion) {\n          newestMatchingVersionTimestamp = await getTimestamp(\n            config,\n            allVersions,\n            newestMatchingVersion,\n            versioningApi,\n          );\n        }\n      }\n\n      if (\n        compareValue &&\n        currentVersion &&\n        rangeStrategy === 'pin' &&\n        !versioningApi.isSingleVersion(compareValue)\n      ) {\n        const newValue =\n          versioningApi.getPinnedValue?.(currentVersion) ?? currentVersion;\n        res.updates.push({\n          updateType: 'pin',\n          isPin: true,\n          newValue,\n          newVersion: currentVersion,\n          newMajor: versioningApi.getMajor(currentVersion)!,\n        });\n      }\n      if (rangeStrategy === 'pin') {\n        // Fall back to replace once pinning logic is done\n        rangeStrategy = 'replace';\n      }\n      // istanbul ignore if\n      if (!versioningApi.isVersion(currentVersion!)) {\n        res.skipReason = 'invalid-version';\n        return Result.ok(res);\n      }\n      // Filter latest, unstable, etc\n      // TODO #22198\n      let filteredReleases = filterVersions(\n        config,\n        currentVersion!,\n        latestVersion!,\n        inRangeOnlyStrategy ? allSatisfyingVersions : allVersions,\n        versioningApi,\n      ).filter(\n        (v) =>\n          // Leave only compatible versions\n          unconstrainedValue ||\n          versioningApi.isCompatible(v.version, compareValue),\n      );\n      let shrinkedViaVulnerability = false;\n      if (config.isVulnerabilityAlert) {\n        if (config.vulnerabilityFixVersion) {\n          res.vulnerabilityFixVersion = config.vulnerabilityFixVersion;\n          res.vulnerabilityFixStrategy = config.vulnerabilityFixStrategy;\n          if (versioningApi.isValid(config.vulnerabilityFixVersion)) {\n            let fixedFilteredReleases;\n            if (versioningApi.isVersion(config.vulnerabilityFixVersion)) {\n              // Retain only releases greater than or equal to the fix version\n              fixedFilteredReleases = filteredReleases.filter(\n                (release) =>\n                  !versioningApi.isGreaterThan(\n                    config.vulnerabilityFixVersion!,\n                    release.version,\n                  ),\n              );\n            } else {\n              // Retain only releases which max the fix constraint\n              fixedFilteredReleases = filteredReleases.filter((release) =>\n                versioningApi.matches(\n                  release.version,\n                  config.vulnerabilityFixVersion!,\n                ),\n              );\n            }\n            // Warn if this filtering results caused zero releases\n            if (fixedFilteredReleases.length === 0 && filteredReleases.length) {\n              logger.warn(\n                {\n                  releases: filteredReleases,\n                  vulnerabilityFixVersion: config.vulnerabilityFixVersion,\n                  packageName: config.packageName,\n                },\n                'No releases satisfy vulnerabilityFixVersion',\n              );\n            }\n            // Use the additionally filtered releases\n            filteredReleases = fixedFilteredReleases;\n          } else {\n            logger.warn(\n              {\n                vulnerabilityFixVersion: config.vulnerabilityFixVersion,\n                packageName: config.packageName,\n              },\n              'vulnerabilityFixVersion is not valid',\n            );\n          }\n        }\n        if (config.vulnerabilityFixStrategy === 'highest') {\n          // Don't shrink the list of releases - let Renovate use its normal logic\n          logger.once.debug(\n            `Using vulnerabilityFixStrategy=highest for ${config.packageName}`,\n          );\n        } else {\n          // Shrink the list of releases to the lowest fixed version\n          logger.once.debug(\n            `Using vulnerabilityFixStrategy=lowest for ${config.packageName}`,\n          );\n          filteredReleases = filteredReleases.slice(0, 1);\n          shrinkedViaVulnerability = true;\n        }\n      }\n      const buckets: Record<string, [Release]> = {};\n      for (const release of filteredReleases) {\n        const bucket = getBucket(\n          config,\n          // TODO #22198\n          currentVersion!,\n          release.version,\n          versioningApi,\n        );\n        // v8 ignore else -- TODO: add test #40625\n        if (isString(bucket)) {\n          if (buckets[bucket]) {\n            buckets[bucket].push(release);\n          } else {\n            buckets[bucket] = [release];\n          }\n        }\n      }\n      const depResultConfig = mergeChildConfig(config, res);\n      for (const [bucket, releases] of Object.entries(buckets)) {\n        const sortedReleases = releases.sort((r1, r2) =>\n          versioningApi.sortVersions(r1.version, r2.version),\n        );\n        const { release, pendingChecks, pendingReleases } =\n          await filterInternalChecks(\n            depResultConfig,\n            versioningApi,\n            bucket,\n            sortedReleases,\n          );\n        // istanbul ignore next\n        if (!release) {\n          return Result.ok(res);\n        }\n        const newVersion = release.version;\n        const update = await generateUpdate(\n          config,\n          compareValue,\n          versioningApi,\n          // TODO #22198\n\n          rangeStrategy!,\n          config.lockedVersion ?? currentVersion!,\n          bucket,\n          release,\n          allReleaseVersions,\n        );\n\n        // #29034\n        if (\n          config.manager === 'gomod' &&\n          compareValue?.startsWith('v0.0.0-') &&\n          update.newValue?.startsWith('v0.0.0-') &&\n          config.currentDigest !== update.newDigest\n        ) {\n          update.updateType = 'digest';\n\n          // As this has already been processed by `filterInternalChecks()`, but we're changing the `updateType`, we need to apply the digest-scoped minimumReleaseAge rules.\n          // `currentVersionWasResolved` only matters for `pinDigest`, which `update.updateType` never is here - true is a safe constant.\n          await applyMinimumReleaseAgeToDigestUpdate(\n            update as DigestLikeUpdate,\n            config,\n            res,\n            true,\n            release.releaseTimestamp,\n          );\n        }\n\n        if (pendingChecks) {\n          update.pendingChecks = pendingChecks;\n        }\n\n        if (pendingReleases.length) {\n          update.pendingVersions = pendingReleases.map((r) => r.version);\n        }\n        if (!update.newValue || update.newValue === compareValue) {\n          if (!config.lockedVersion) {\n            continue;\n          }\n          // istanbul ignore if\n          if (rangeStrategy === 'bump') {\n            logger.trace(\n              {\n                packageName: config.packageName,\n                currentValue: config.currentValue,\n                lockedVersion: config.lockedVersion,\n                newVersion,\n              },\n              'Skipping bump because newValue is the same',\n            );\n            continue;\n          }\n          res.isSingleVersion = true;\n        }\n        res.isSingleVersion ??=\n          isString(update.newValue) &&\n          versioningApi.isSingleVersion(update.newValue);\n        // istanbul ignore if\n        if (\n          config.versioning === dockerVersioningId &&\n          update.updateType !== 'rollback' &&\n          update.newValue &&\n          versioningApi.isVersion(update.newValue) &&\n          compareValue &&\n          versioningApi.isVersion(compareValue) &&\n          versioningApi.isGreaterThan(compareValue, update.newValue)\n        ) {\n          logger.warn(\n            {\n              packageName: config.packageName,\n              currentValue: config.currentValue,\n              compareValue,\n              currentVersion: config.currentVersion,\n              update,\n              allVersionsLength: allVersions.length,\n              filteredReleaseVersions: filteredReleases.map((r) => r.version),\n              shrinkedViaVulnerability,\n            },\n            'Unexpected downgrade detected: skipping',\n          );\n        } else {\n          res.updates.push(update);\n        }\n      }\n    } else if (compareValue) {\n      logger.debug(\n        `Dependency ${config.packageName} has unsupported/unversioned value ${compareValue} (versioning=${config.versioning})`,\n      );\n\n      if (!config.pinDigests && !config.currentDigest) {\n        logger.debug(\n          `Skipping ${config.packageName} because no currentDigest or pinDigests`,\n        );\n        res.skipReason = 'invalid-value';\n      } else {\n        delete res.skipReason;\n      }\n    } else {\n      res.skipReason = 'invalid-value';\n    }\n\n    if (isReplacementRulesConfigured(config)) {\n      addReplacementUpdateIfValid(res.updates, config);\n    } else if (dependency?.replacementName && dependency.replacementVersion) {\n      res.updates.push({\n        updateType: 'replacement',\n        newName: dependency.replacementName,\n        newValue: dependency.replacementVersion,\n      });\n    }\n\n    // Record if the dep is fixed to a version\n    if (config.lockedVersion) {\n      res.currentVersion = config.lockedVersion;\n      res.fixedVersion = config.lockedVersion;\n    } else if (compareValue && versioningApi.isSingleVersion(compareValue)) {\n      res.fixedVersion = compareValue.replace(regEx(/^=+/), '');\n    }\n\n    // massage versionCompatibility\n    if (\n      isString(config.currentValue) &&\n      isString(compareValue) &&\n      isString(config.versionCompatibility)\n    ) {\n      for (const update of res.updates) {\n        logger.debug({ update });\n        // v8 ignore else -- TODO: add test #40625\n        if (isString(config.currentValue) && isString(update.newValue)) {\n          update.newValue = config.currentValue.replace(\n            compareValue,\n            update.newValue,\n          );\n        }\n      }\n    }\n\n    // Add digests if necessary\n    if (supportsDigests(config.datasource)) {\n      if (config.currentDigest) {\n        if (!config.digestOneAndOnly || !res.updates.length) {\n          // digest update - age-checked after the strip below, once newDigest is known\n          digestUpdate = {\n            updateType: 'digest',\n            newValue: config.currentValue,\n          };\n          res.updates.push(digestUpdate);\n        }\n      } else if (\n        config.pinDigests &&\n        // only update the digest in the package file if it's managed by us\n        !config.digestManagedExternally &&\n        // Create a pin only if one doesn't already exists\n        // v8 ignore else -- TODO: add test #40625\n        !res.updates.some((update) => update.updateType === 'pin')\n      ) {\n        // pin digest\n        const pinDigestUpdate: DigestLikeUpdate = {\n          isPinDigest: true,\n          updateType: 'pinDigest',\n          newValue: config.currentValue,\n        };\n        await applyMinimumReleaseAgeToDigestUpdate(\n          pinDigestUpdate,\n          config,\n          res,\n          isValid || unconstrainedValue,\n          newestMatchingVersionTimestamp,\n        );\n        res.updates.push(pinDigestUpdate);\n      }\n      if (versioningApi.valueToVersion) {\n        // TODO #22198\n        res.currentVersion = versioningApi.valueToVersion(res.currentVersion!);\n        for (const update of res.updates) {\n          // TODO #22198\n          update.newVersion = versioningApi.valueToVersion(update.newVersion!);\n        }\n      }\n      if (res.registryUrl) {\n        config.registryUrls = [res.registryUrl];\n      }\n\n      // update digest for all\n      for (const update of res.updates) {\n        // only update the digest in the package file if it's managed by us\n        if (\n          (config.pinDigests === true && !config.digestManagedExternally) ||\n          config.currentDigest\n        ) {\n          const getDigestConfig: GetDigestInputConfig = {\n            ...config,\n            registryUrl: update.registryUrl ?? res.registryUrl,\n            lookupName: res.lookupName,\n          };\n\n          // #20304 only pass it for replacement updates, otherwise we get wrong or invalid digest\n          if (update.updateType !== 'replacement') {\n            delete getDigestConfig.replacementName;\n          }\n\n          // #20304 don't use lookupName and currentDigest when we replace image name\n          if (\n            update.updateType === 'replacement' &&\n            update.newName !== config.packageName\n          ) {\n            delete getDigestConfig.lookupName;\n            delete getDigestConfig.currentDigest;\n            getDigestConfig.replacementName = update.newName;\n          }\n\n          // Don't use current releases if replacement changes name, otherwise we use the wrong new digest.\n          // This happens on datasources which return the digest in release info like `github-tags`.\n          // We can still use it when only version is changing.\n          if (\n            update.updateType !== 'replacement' ||\n            update.newName === config.packageName\n          ) {\n            update.newDigest ??= dependency?.releases.find(\n              (r) => r.version === update.newValue,\n            )?.newDigest;\n          }\n\n          update.newDigest ??= await getDigest(\n            getDigestConfig,\n            update.newValue,\n          );\n\n          // If the digest could not be determined, report this as otherwise the\n          // update will be omitted later on without notice.\n          if (update.newDigest === null) {\n            logger.debug(\n              {\n                packageName: config.packageName,\n                currentValue: config.currentValue,\n                datasource: config.datasource,\n                newValue: update.newValue,\n                bucket: update.bucket,\n              },\n              'Could not determine new digest for update.',\n            );\n\n            // Only report a warning if there is a current digest.\n            // Context: https://github.com/renovatebot/renovate/pull/20175#discussion_r1102615059.\n            if (config.currentDigest) {\n              res.warnings.push({\n                message: `Could not determine new digest for update (${config.datasource} package ${config.packageName})`,\n                topic: config.packageName,\n              });\n            }\n          }\n        } else {\n          delete update.newDigest;\n        }\n        if (update.newVersion) {\n          const registryUrl = dependency?.releases?.find(\n            (release) => release.version === update.newVersion,\n          )?.registryUrl;\n          if (registryUrl && registryUrl !== res.registryUrl) {\n            update.registryUrl = registryUrl;\n          }\n        }\n      }\n    }\n\n    if (res.updates.length) {\n      delete res.skipReason;\n    }\n    // Strip out any non-changed ones\n    res.updates = res.updates\n      .filter(\n        (update) => update.newValue !== null || config.currentValue === null,\n      )\n      .filter((update) => update.newDigest !== null)\n      .filter(\n        (update) =>\n          (isString(update.newName) && update.newName !== config.packageName) ||\n          update.isReplacement === true ||\n          update.newValue !== config.currentValue ||\n          update.isLockfileUpdate === true ||\n          // TODO #22198\n          (update.newDigest &&\n            !update.newDigest.startsWith(config.currentDigest!)),\n      );\n    // If range strategy specified in config is 'in-range-only', also strip out updates where currentValue !== newValue\n    if (config.rangeStrategy === 'in-range-only') {\n      res.updates = res.updates.filter(\n        (update) => update.newValue === config.currentValue,\n      );\n    }\n    // Handle a weird edge case involving followTag and fallbacks\n    if (config.rollbackPrs && config.followTag) {\n      res.updates = res.updates.filter(\n        (update) =>\n          update.updateType !== 'rollback' || res.updates.length === 1,\n      );\n    }\n\n    // If there is a digest update proposed which is in the pending updates for this dependency, ensure that `minimumReleaseAge` is applied.\n    // `currentVersionWasResolved` only matters for `pinDigest`, which `digestUpdate` never is - true is a safe constant.\n    if (digestUpdate && res.updates.includes(digestUpdate)) {\n      await applyMinimumReleaseAgeToDigestUpdate(\n        digestUpdate,\n        config,\n        res,\n        true,\n        newestMatchingVersionTimestamp,\n      );\n    }\n\n    const release =\n      res.updates.length > 0\n        ? (dependency?.releases.find(\n            (r) => r.version === res.updates[0].newValue,\n          ) ??\n          dependency?.releases.find(\n            (r) => r.version === res.updates[0].newVersion,\n          ))\n        : null;\n\n    if (release?.changelogContent) {\n      res.changelogContent = release.changelogContent;\n      res.changelogUrl = release.changelogUrl;\n    }\n  } catch (err) /* istanbul ignore next */ {\n    if (err instanceof ExternalHostError) {\n      return Result.err(err);\n    }\n\n    if (err instanceof Error && err.message === CONFIG_VALIDATION) {\n      return Result.err(err);\n    }\n\n    logger.error(\n      {\n        currentDigest: config.currentDigest,\n        currentValue: config.currentValue,\n        datasource: config.datasource,\n        packageName: config.packageName,\n        digestOneAndOnly: config.digestOneAndOnly,\n        followTag: config.followTag,\n        lockedVersion: config.lockedVersion,\n        packageFile: config.packageFile,\n        pinDigests: config.pinDigests,\n        rollbackPrs: config.rollbackPrs,\n        isVulnerabilityAlert: config.isVulnerabilityAlert,\n        updatePinnedDependencies: config.updatePinnedDependencies,\n        err,\n      },\n      'lookupUpdates error',\n    );\n    res.skipReason = 'internal-error';\n  }\n  return Result.ok(res);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,eAAe,aACb,QACA,UACA,SACA,eACuC;CACvC,MAAM,iBAAiB,SAAS,MAC7B,MACC,cAAc,QAAQ,EAAE,OAAO,KAC/B,cAAc,OAAO,EAAE,SAAS,OAAO,CAC3C;CAEA,IAAI,CAAC,gBACH,OAAO;CAGT,IAAI,eAAe,kBACjB,OAAO,eAAe;CAIxB,QAAO,MADqB,mBAAmB,QAAQ,cAAc,EAAA,EAC/C;AACxB;;;;;;AAUA,SAAS,oCACP,QACA,YACS;CAIT,IAAI,OAAO,yBAAyB,QAClC,OAAO;CAGT,OACE,iBAAiB,OAAO,iBAAiB,KACzC,iBAAiB,OAAO,WAAW,EAAE,iBAAiB,KACtD,CAAC,CAAC,OAAO,cAAc,MAAM,SAC3B,iBAAiB,KAAK,iBAAiB,CACzC;AAEJ;;;;;;AAOA,eAAe,qCACb,QACA,QACA,KACA,2BACA,gCACe;CACf,IAAI,CAAC,oCAAoC,QAAQ,OAAO,UAAU,GAChE;CAGF,IAAI,OAAO,eAAe,eAAe,CAAC,2BAA2B;EAMnE,OAAO,KAAK,MACV;GAAE,SAAS,OAAO;GAAS,YAAY,OAAO;EAAW,GACzD,wCAAwC,OAAO,WAAW,aAAa,OAAO,QAAQ,+DACxF;EACA;CACF;CAEA,IAAI,gBAAoC;EACtC,GAAG,iBAAiB,QAAQ,GAAG;EAC/B,YAAY,OAAO;CACrB;CACA,gBAAgB,iBACd,eACA,cAAc,OAAO,WACvB;CACA,gBAAgB,MAAM,kBAAkB,eAAe,aAAa;CAMpE,MAAM,WAAW,uBACf,eACA,8BACF;CAGA,IAAI,SAAS,uBAAuB,CAAC,SAAS,cAAc;EAC1D,IAAI,cAAc,+BAA+B,sBAC/C,OAAO,KAAK,KACV,2KACF;EAGF,OAAO,KAAK,MACV;GACE,SAAS,OAAO;GAChB,YAAY,OAAO;GACnB,4BAA4B,cAAc;GAC1C,OAAO;EACT,GACA,GAAG,OAAO,WAAW,aAAa,OAAO,QAAQ,wCACnD;CACF;CACA,IAAI,SAAS,WAAW;EACtB,OAAO,MACL;GACE,SAAS,OAAO;GAChB,YAAY,OAAO;GACnB,kBAAkB;GAClB,OAAO;EACT,GACA,GAAG,OAAO,WAAW,mDACvB;EAGA,IAAI,OAAO,yBAAyB,UAClC,OAAO,gBAAgB;CAE3B;AACF;AAEA,eAAsB,cACpB,UAC+B;CAC/B,IAAI,SAA6B,EAAE,GAAG,SAAS;CAC/C,OAAO,eAAe,qBAAqB,OAAO,UAAU;CAE5D,MAAM,gBAAgBA,IAAkB,OAAO,UAAU;CAEzD,IAAI,aAAmC;CACvC,MAAM,MAAoB;EACxB,YAAY,OAAO;EACnB,SAAS,CAAC;EACV,UAAU,CAAC;CACb;CAEA,IAAI;CAEJ,IAAI;CAEJ,IAAI;EACF,OAAO,MACL;GACE,YAAY,OAAO;GACnB,cAAc,OAAO;EACvB,GACA,eACF;EACA,IAAI,OAAO,gBAAgB,CAAC,SAAS,OAAO,YAAY,GAAG;;GAGzD,IAAI,OAAO,cACT,OAAO,MACL,4BAA4B,OAAO,YAAY,IAAI,KAAK,UAAU,OAAO,YAAY,EAAE,IAAI,OAAO,OAAO,aAAa,EACxH;GAEF,IAAI,aAAa;GACjB,OAAO,OAAO,GAAG,GAAG;EACtB;EACA,IACE,CAAC,uBAAuB,MAAM,KAC9B,CAAC,iBAAiB,OAAO,UAAU,GACnC;GACA,IAAI,aAAa;GACjB,OAAO,OAAO,GAAG,GAAG;EACtB;EACA,IAAI,eAAe,OAAO;EAC1B,IACE,SAAS,OAAO,YAAY,KAC5B,SAAS,OAAO,oBAAoB,GACpC;GAEA,MAAM,aAD2B,MAAM,OAAO,oBACJ,CAAC,CAAC,KAAK,OAAO,YAAY;GACpE,IAAI,YAAY,QAAQ;IACtB,OAAO,MACL;KACE,sBAAsB,OAAO;KAC7B,cAAc,OAAO;KACrB,aAAa,OAAO;KACpB,QAAQ,WAAW;IACrB,GACA,mCACF;IACA,OAAO,uBAAuB,WAAW,OAAO;IAChD,eAAe,WAAW,OAAO;GACnC,OACE,OAAO,MACL;IACE,sBAAsB,OAAO;IAC7B,cAAc,OAAO;IACrB,aAAa,OAAO;GACtB,GACA,sCACF;EAEJ;EAEA,MAAM,UACJ,SAAS,YAAY,KAAK,cAAc,QAAQ,YAAY;EAE9D,MAAM,qBACJ,CAAC,CAAC,OAAO,iBAAiB,YAAY,OAAO,YAAY;EAE3D,IAAI,WAAW,oBAAoB;GACjC,IACE,CAAC,OAAO,4BAER,cAAc,gBAAgB,YAAa,GAC3C;IACA,IAAI,aAAa;IACjB,OAAO,OAAO,GAAG,GAAG;GACtB;GAEA,MAAM,EAAE,KAAK,eAAe,KAAK,gBAAgB,MAAM,kBACrD,MACF,CAAC,CACE,WAAW,QAAQ,6BAA6B,eAAe,GAAG,CAAC,CAAC,CACpE,WAAW,QAAQ,qBAAqB,KAAK,MAAM,CAAC,CAAC,CACrD,WAAW,QAAQ,uBAAuB,KAAK,MAAM,CAAC,CAAC,CACvD,OAAO;GAEV,IAAI,uBAAuB,OACzB,MAAM;GAGR,IAAI,aAAa;IAEf,MAAM,UAA6B;KACjC,OAAO,OAAO;KACd,SAAS,qBAAqB,OAAO,WAAW,WAAW,OAAO,YAAY,IAAI;IACpF;IACA,OAAO,MACL;KACE,YAAY,OAAO;KACnB,aAAa,OAAO;IACtB,GACA,QAAQ,OACV;IAEA,IAAI,SAAS,KAAK,OAAO;IACzB,OAAO,OAAO,GAAG,GAAG;GACtB;GAEA,aAAa;GAEb,IAAI,WAAW,oBACb,OAAO,MACL,gCAAgC,OAAO,WAAW,WAAW,OAAO,aACtE;GAGF,WAAW,KAAK,YAAY;IAC1B;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;GACF,CAAC;GAED,MAAM,gBAAgB,WAAW,MAAM;GAEvC,IAAI,cAAc,WAAW,SAAS,QAAQ,YAC5C,cAAc,UAAU,QAAQ,OAAO,CACzC;GACA,MAAM,qBAAqB,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE,OAAO,CAAC;;GAEpE,IAAI,YAAY,WAAW,GAAG;IAE5B,OAAO,KACL;KACE,YAAY,OAAO;KACnB,QAAQ;IACV,GACA,2DACF;IACA,IAAI,CAAC,OAAO,eACV,OAAO,OAAO,GAAG,GAAG;GAExB;GAEA,SAAS,MAAM,kBACb;IAAE,GAAG;IAAQ,WAAW,IAAI;GAAU,GACtC,YACF;GACA,IAAI,OAAO,WAAW;IACpB,MAAM,gBAAgB,WAAW,OAAO,OAAO;IAC/C,IAAI,CAAC,eAAe;KAClB,IAAI,SAAS,KAAK;MAChB,OAAO,OAAO;MACd,SAAS,+BAA+B,OAAO,UAAU,OAAO,OAAO,WAAW,WAAW,OAAO;KACtG,CAAC;KACD,OAAO,OAAO,GAAG,GAAG;IACtB;IACA,cAAc,YAAY,QACvB,MACC,EAAE,YAAY,iBACb,EAAE,YAAY,gBACb,cAAc,cAAc,eAAe,YAAY,CAC7D;GACF;GAEA,MAAM,sBAAsB,OAAO,kBAAkB;GAErD,MAAM,yBACH,uBAAuB,OAAO,gBAAgB,CAAC,qBAC5C,YAAY,QAAQ,MAElB,cAAc,QAAQ,EAAE,SAAS,YAAa,CAChD,IACA;GACN,IAAI,CAAC,sBAAsB,QACzB,OAAO,MACL,sCAAsC,OAAO,WAAW,aAC1D;GAGF,IAAI,OAAO,eAAe,CAAC,sBAAsB,QAAQ;IACvD,MAAM,WAAW,kBAAkB,QAAQ,aAAa,aAAa;;IAErE,IAAI,CAAC,UAAU;KACb,IAAI,SAAS,KAAK;MAChB,OAAO,OAAO;MAEd,SAAS,+BAA+B,aAAc,OACpD,OAAO,WACR,WAAW,OAAO;KACrB,CAAC;KACD,OAAO,OAAO,GAAG,GAAG;IACtB;IACA,IAAI,QAAQ,KAAK,QAAQ;GAC3B;GACA,IAAI,gBAAgB,iBAAiB,MAAM;;GAG3C,IACE,OAAO,wBACP,kBAAkB,qBAClB,CAAC,OAAO,eAER,gBAAgB;GAGlB,IACE,OAAO,wBACP,CAAC,OAAO,gBACR,OAAO,eAEP,gBAAgB;GAElB,MAAM,wBAAwB,WAAW,SACtC,QAAQ,YAAY,CAAC,QAAQ,YAAY,CAAC,CAC1C,KAAK,YAAY,QAAQ,OAAO;GACnC,IAAI;GACJ,IAAI,kBAAkB,mBACpB,iBAAiB,OAAO;QACnB,IACL,gBACA,cAAc,gBAAgB,YAAY,KAC1C,YAAY,MAAM,MAAM,EAAE,YAAY,YAAY,GAElD,iBAAiB;GAGnB,mBACE,kBACE,cACA,OAAO,eACP,eACA,eACA,eACA,qBACF,KACA,kBACE,cACA,OAAO,eACP,eACA,eACA,eACA,YAAY,KAAK,MAAM,EAAE,OAAO,CAClC;GAEF,IAAI,CAAC,gBAAgB;;IAEnB,IAAI,CAAC,OAAO,eAAe;KACzB,OAAO,MACL,gDAAgD,OAAO,aACzD;KACA,IAAI,aAAa;IACnB;IACA,OAAO,OAAO,GAAG,GAAG;GACtB;GAEA,IAAI,iBAAiB;GAOrB,MAAM,sBAAsB,OAAO,iBAAiB;GACpD,MAAM,0BAA0B,MAAM,aACpC,QACA,aACA,qBACA,aACF;GAEA,IAAI,iBAAiB,uBAAuB,GAAG;IAC7C,IAAI,0BAA0B;IAC9B,IAAI,0BAA0B,eAAe,uBAAuB;IAEpE,IACE,OAAO,cAAc,MAAM,SACzB,iBAAiB,KAAK,eAAe,CACvC,GAGA,SAAS,MAAM,kBACb;KAAE,GAAG;KAAQ;IAAwB,GACrC,mBACF;GAEJ;GAEA,IACE,OAAO,gBACH,oCAAoC,QAAQ,QAAQ,IACpD,OAAO,cACP,oCAAoC,QAAQ,WAAW,GAC3D;IAEA,MAAM,wBACJ,kBACE,cACA,IACA,eACA,WACA,eACA,YAAY,QAAQ,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC,KAAK,MAAM,EAAE,OAAO,CACjE,KACA,kBACE,cACA,IACA,eACA,WACA,eACA,YAAY,KAAK,MAAM,EAAE,OAAO,CAClC;IACF,IAAI,uBACF,iCAAiC,MAAM,aACrC,QACA,aACA,uBACA,aACF;GAEJ;GAEA,IACE,gBACA,kBACA,kBAAkB,SAClB,CAAC,cAAc,gBAAgB,YAAY,GAC3C;IACA,MAAM,WACJ,cAAc,iBAAiB,cAAc,KAAK;IACpD,IAAI,QAAQ,KAAK;KACf,YAAY;KACZ,OAAO;KACP;KACA,YAAY;KACZ,UAAU,cAAc,SAAS,cAAc;IACjD,CAAC;GACH;GACA,IAAI,kBAAkB,OAEpB,gBAAgB;;GAGlB,IAAI,CAAC,cAAc,UAAU,cAAe,GAAG;IAC7C,IAAI,aAAa;IACjB,OAAO,OAAO,GAAG,GAAG;GACtB;GAGA,IAAI,mBAAmB,eACrB,QACA,gBACA,eACA,sBAAsB,wBAAwB,aAC9C,aACF,CAAC,CAAC,QACC,MAEC,sBACA,cAAc,aAAa,EAAE,SAAS,YAAY,CACtD;GACA,IAAI,2BAA2B;GAC/B,IAAI,OAAO,sBAAsB;IAC/B,IAAI,OAAO,yBAAyB;KAClC,IAAI,0BAA0B,OAAO;KACrC,IAAI,2BAA2B,OAAO;KACtC,IAAI,cAAc,QAAQ,OAAO,uBAAuB,GAAG;MACzD,IAAI;MACJ,IAAI,cAAc,UAAU,OAAO,uBAAuB,GAExD,wBAAwB,iBAAiB,QACtC,YACC,CAAC,cAAc,cACb,OAAO,yBACP,QAAQ,OACV,CACJ;WAGA,wBAAwB,iBAAiB,QAAQ,YAC/C,cAAc,QACZ,QAAQ,SACR,OAAO,uBACT,CACF;MAGF,IAAI,sBAAsB,WAAW,KAAK,iBAAiB,QACzD,OAAO,KACL;OACE,UAAU;OACV,yBAAyB,OAAO;OAChC,aAAa,OAAO;MACtB,GACA,6CACF;MAGF,mBAAmB;KACrB,OACE,OAAO,KACL;MACE,yBAAyB,OAAO;MAChC,aAAa,OAAO;KACtB,GACA,sCACF;IAEJ;IACA,IAAI,OAAO,6BAA6B,WAEtC,OAAO,KAAK,MACV,8CAA8C,OAAO,aACvD;SACK;KAEL,OAAO,KAAK,MACV,6CAA6C,OAAO,aACtD;KACA,mBAAmB,iBAAiB,MAAM,GAAG,CAAC;KAC9C,2BAA2B;IAC7B;GACF;GACA,MAAM,UAAqC,CAAC;GAC5C,KAAK,MAAM,WAAW,kBAAkB;IACtC,MAAM,SAAS,UACb,QAEA,gBACA,QAAQ,SACR,aACF;;IAEA,IAAI,SAAS,MAAM,GACjB,IAAI,QAAQ,SACV,QAAQ,OAAO,CAAC,KAAK,OAAO;SAE5B,QAAQ,UAAU,CAAC,OAAO;GAGhC;GACA,MAAM,kBAAkB,iBAAiB,QAAQ,GAAG;GACpD,KAAK,MAAM,CAAC,QAAQ,aAAa,OAAO,QAAQ,OAAO,GAAG;IACxD,MAAM,iBAAiB,SAAS,MAAM,IAAI,OACxC,cAAc,aAAa,GAAG,SAAS,GAAG,OAAO,CACnD;IACA,MAAM,EAAE,SAAS,eAAe,oBAC9B,MAAM,qBACJ,iBACA,eACA,QACA,cACF;;IAEF,IAAI,CAAC,SACH,OAAO,OAAO,GAAG,GAAG;IAEtB,MAAM,aAAa,QAAQ;IAC3B,MAAM,SAAS,MAAM,eACnB,QACA,cACA,eAGA,eACA,OAAO,iBAAiB,gBACxB,QACA,SACA,kBACF;IAGA,IACE,OAAO,YAAY,WACnB,cAAc,WAAW,SAAS,KAClC,OAAO,UAAU,WAAW,SAAS,KACrC,OAAO,kBAAkB,OAAO,WAChC;KACA,OAAO,aAAa;KAIpB,MAAM,qCACJ,QACA,QACA,KACA,MACA,QAAQ,gBACV;IACF;IAEA,IAAI,eACF,OAAO,gBAAgB;IAGzB,IAAI,gBAAgB,QAClB,OAAO,kBAAkB,gBAAgB,KAAK,MAAM,EAAE,OAAO;IAE/D,IAAI,CAAC,OAAO,YAAY,OAAO,aAAa,cAAc;KACxD,IAAI,CAAC,OAAO,eACV;;KAGF,IAAI,kBAAkB,QAAQ;MAC5B,OAAO,MACL;OACE,aAAa,OAAO;OACpB,cAAc,OAAO;OACrB,eAAe,OAAO;OACtB;MACF,GACA,4CACF;MACA;KACF;KACA,IAAI,kBAAkB;IACxB;IACA,IAAI,oBACF,SAAS,OAAO,QAAQ,KACxB,cAAc,gBAAgB,OAAO,QAAQ;;IAE/C,IACE,OAAO,eAAA,YACP,OAAO,eAAe,cACtB,OAAO,YACP,cAAc,UAAU,OAAO,QAAQ,KACvC,gBACA,cAAc,UAAU,YAAY,KACpC,cAAc,cAAc,cAAc,OAAO,QAAQ,GAEzD,OAAO,KACL;KACE,aAAa,OAAO;KACpB,cAAc,OAAO;KACrB;KACA,gBAAgB,OAAO;KACvB;KACA,mBAAmB,YAAY;KAC/B,yBAAyB,iBAAiB,KAAK,MAAM,EAAE,OAAO;KAC9D;IACF,GACA,yCACF;SAEA,IAAI,QAAQ,KAAK,MAAM;GAE3B;EACF,OAAO,IAAI,cAAc;GACvB,OAAO,MACL,cAAc,OAAO,YAAY,qCAAqC,aAAa,eAAe,OAAO,WAAW,EACtH;GAEA,IAAI,CAAC,OAAO,cAAc,CAAC,OAAO,eAAe;IAC/C,OAAO,MACL,YAAY,OAAO,YAAY,wCACjC;IACA,IAAI,aAAa;GACnB,OACE,OAAO,IAAI;EAEf,OACE,IAAI,aAAa;EAGnB,IAAI,6BAA6B,MAAM,GACrC,4BAA4B,IAAI,SAAS,MAAM;OAC1C,IAAI,YAAY,mBAAmB,WAAW,oBACnD,IAAI,QAAQ,KAAK;GACf,YAAY;GACZ,SAAS,WAAW;GACpB,UAAU,WAAW;EACvB,CAAC;EAIH,IAAI,OAAO,eAAe;GACxB,IAAI,iBAAiB,OAAO;GAC5B,IAAI,eAAe,OAAO;EAC5B,OAAO,IAAI,gBAAgB,cAAc,gBAAgB,YAAY,GACnE,IAAI,eAAe,aAAa,QAAQ,MAAM,KAAK,GAAG,EAAE;EAI1D,IACE,SAAS,OAAO,YAAY,KAC5B,SAAS,YAAY,KACrB,SAAS,OAAO,oBAAoB,GAEpC,KAAK,MAAM,UAAU,IAAI,SAAS;GAChC,OAAO,MAAM,EAAE,OAAO,CAAC;;GAEvB,IAAI,SAAS,OAAO,YAAY,KAAK,SAAS,OAAO,QAAQ,GAC3D,OAAO,WAAW,OAAO,aAAa,QACpC,cACA,OAAO,QACT;EAEJ;EAIF,IAAI,gBAAgB,OAAO,UAAU,GAAG;GACtC,IAAI,OAAO,eACL;QAAA,CAAC,OAAO,oBAAoB,CAAC,IAAI,QAAQ,QAAQ;KAEnD,eAAe;MACb,YAAY;MACZ,UAAU,OAAO;KACnB;KACA,IAAI,QAAQ,KAAK,YAAY;IAC/B;UACK,IACL,OAAO,cAEP,CAAC,OAAO;;GAGR,CAAC,IAAI,QAAQ,MAAM,WAAW,OAAO,eAAe,KAAK,GACzD;IAEA,MAAM,kBAAoC;KACxC,aAAa;KACb,YAAY;KACZ,UAAU,OAAO;IACnB;IACA,MAAM,qCACJ,iBACA,QACA,KACA,WAAW,oBACX,8BACF;IACA,IAAI,QAAQ,KAAK,eAAe;GAClC;GACA,IAAI,cAAc,gBAAgB;IAEhC,IAAI,iBAAiB,cAAc,eAAe,IAAI,cAAe;IACrE,KAAK,MAAM,UAAU,IAAI,SAEvB,OAAO,aAAa,cAAc,eAAe,OAAO,UAAW;GAEvE;GACA,IAAI,IAAI,aACN,OAAO,eAAe,CAAC,IAAI,WAAW;GAIxC,KAAK,MAAM,UAAU,IAAI,SAAS;IAEhC,IACG,OAAO,eAAe,QAAQ,CAAC,OAAO,2BACvC,OAAO,eACP;KACA,MAAM,kBAAwC;MAC5C,GAAG;MACH,aAAa,OAAO,eAAe,IAAI;MACvC,YAAY,IAAI;KAClB;KAGA,IAAI,OAAO,eAAe,eACxB,OAAO,gBAAgB;KAIzB,IACE,OAAO,eAAe,iBACtB,OAAO,YAAY,OAAO,aAC1B;MACA,OAAO,gBAAgB;MACvB,OAAO,gBAAgB;MACvB,gBAAgB,kBAAkB,OAAO;KAC3C;KAKA,IACE,OAAO,eAAe,iBACtB,OAAO,YAAY,OAAO,aAE1B,OAAO,cAAc,YAAY,SAAS,MACvC,MAAM,EAAE,YAAY,OAAO,QAC9B,CAAC,EAAE;KAGL,OAAO,cAAc,MAAM,UACzB,iBACA,OAAO,QACT;KAIA,IAAI,OAAO,cAAc,MAAM;MAC7B,OAAO,MACL;OACE,aAAa,OAAO;OACpB,cAAc,OAAO;OACrB,YAAY,OAAO;OACnB,UAAU,OAAO;OACjB,QAAQ,OAAO;MACjB,GACA,4CACF;MAIA,IAAI,OAAO,eACT,IAAI,SAAS,KAAK;OAChB,SAAS,8CAA8C,OAAO,WAAW,WAAW,OAAO,YAAY;OACvG,OAAO,OAAO;MAChB,CAAC;KAEL;IACF,OACE,OAAO,OAAO;IAEhB,IAAI,OAAO,YAAY;KACrB,MAAM,cAAc,YAAY,UAAU,MACvC,YAAY,QAAQ,YAAY,OAAO,UAC1C,CAAC,EAAE;KACH,IAAI,eAAe,gBAAgB,IAAI,aACrC,OAAO,cAAc;IAEzB;GACF;EACF;EAEA,IAAI,IAAI,QAAQ,QACd,OAAO,IAAI;EAGb,IAAI,UAAU,IAAI,QACf,QACE,WAAW,OAAO,aAAa,QAAQ,OAAO,iBAAiB,IAClE,CAAC,CACA,QAAQ,WAAW,OAAO,cAAc,IAAI,CAAC,CAC7C,QACE,WACE,SAAS,OAAO,OAAO,KAAK,OAAO,YAAY,OAAO,eACvD,OAAO,kBAAkB,QACzB,OAAO,aAAa,OAAO,gBAC3B,OAAO,qBAAqB,QAE3B,OAAO,aACN,CAAC,OAAO,UAAU,WAAW,OAAO,aAAc,CACxD;EAEF,IAAI,OAAO,kBAAkB,iBAC3B,IAAI,UAAU,IAAI,QAAQ,QACvB,WAAW,OAAO,aAAa,OAAO,YACzC;EAGF,IAAI,OAAO,eAAe,OAAO,WAC/B,IAAI,UAAU,IAAI,QAAQ,QACvB,WACC,OAAO,eAAe,cAAc,IAAI,QAAQ,WAAW,CAC/D;EAKF,IAAI,gBAAgB,IAAI,QAAQ,SAAS,YAAY,GACnD,MAAM,qCACJ,cACA,QACA,KACA,MACA,8BACF;EAGF,MAAM,UACJ,IAAI,QAAQ,SAAS,IAChB,YAAY,SAAS,MACnB,MAAM,EAAE,YAAY,IAAI,QAAQ,EAAE,CAAC,QACtC,KACA,YAAY,SAAS,MAClB,MAAM,EAAE,YAAY,IAAI,QAAQ,EAAE,CAAC,UACtC,IACA;EAEN,IAAI,SAAS,kBAAkB;GAC7B,IAAI,mBAAmB,QAAQ;GAC/B,IAAI,eAAe,QAAQ;EAC7B;CACF,SAAS,gCAAgC;EACvC,IAAI,eAAe,mBACjB,OAAO,OAAO,IAAI,GAAG;EAGvB,IAAI,eAAe,SAAS,IAAI,YAAA,qBAC9B,OAAO,OAAO,IAAI,GAAG;EAGvB,OAAO,MACL;GACE,eAAe,OAAO;GACtB,cAAc,OAAO;GACrB,YAAY,OAAO;GACnB,aAAa,OAAO;GACpB,kBAAkB,OAAO;GACzB,WAAW,OAAO;GAClB,eAAe,OAAO;GACtB,aAAa,OAAO;GACpB,YAAY,OAAO;GACnB,aAAa,OAAO;GACpB,sBAAsB,OAAO;GAC7B,0BAA0B,OAAO;GACjC;EACF,GACA,qBACF;EACA,IAAI,aAAa;CACnB;CACA,OAAO,OAAO,GAAG,GAAG;AACtB"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "renovate",
   "description": "Automated dependency updates. Flexible so you don't need to be.",
-  "version": "44.19.0",
+  "version": "44.20.0",
   "type": "module",
   "bin": {
     "renovate": "dist/renovate.js",

package/renovate-schema.json

@@ -1,8 +1,8 @@
 {
   "$id": "https://docs.renovatebot.com/renovate-schema.json",
-  "title": "JSON schema for Renovate 44.19.0 config files (https://renovatebot.com/)",
+  "title": "JSON schema for Renovate 44.20.0 config files (https://renovatebot.com/)",
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "x-renovate-version": "44.19.0",
+  "x-renovate-version": "44.20.0",
   "allowComments": true,
   "type": "object",
   "definitions": {
@@ -1655,6 +1655,10 @@
           "type": "string",
           "description": "A constraint for the `flux` Containerbase tool"
         },
+        "gh": {
+          "type": "string",
+          "description": "A constraint for the `gh` Containerbase tool"
+        },
         "gleam": {
           "type": "string",
           "description": "A constraint for the `gleam` Containerbase tool"
@@ -4157,6 +4161,11 @@
           "description": "Install the `flux` Containerbase tool",
           "additionalProperties": false
         },
+        "gh": {
+          "type": "object",
+          "description": "Install the `gh` Containerbase tool",
+          "additionalProperties": false
+        },
         "gleam": {
           "type": "object",
           "description": "Install the `gleam` Containerbase tool",