renovate 44.195.0 → 44.195.1

package/dist/modules/platform/codecommit/codecommit-client.js

@@ -4,7 +4,7 @@ import { regEx } from "../../../util/regex.js";
 import { logger } from "../../../logger/index.js";
 import { isString } from "@sindresorhus/is";
 import { CodeCommitClient, CreatePullRequestApprovalRuleCommand, CreatePullRequestCommand, DeleteCommentContentCommand, GetCommentsForPullRequestCommand, GetFileCommand, GetPullRequestCommand, GetRepositoryCommand, ListPullRequestsCommand, ListRepositoriesCommand, PostCommentForPullRequestCommand, PullRequestStatusEnum, UpdateCommentCommand, UpdatePullRequestDescriptionCommand, UpdatePullRequestStatusCommand, UpdatePullRequestTitleCommand } from "@aws-sdk/client-codecommit";
-import * as aws4 from "aws4";
+import aws4 from "aws4";
 //#region lib/modules/platform/codecommit/codecommit-client.ts
 let codeCommitClient;
 function buildCodeCommitClient() {

package/dist/modules/platform/codecommit/codecommit-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"codecommit-client.js","names":[],"sources":["../../../../lib/modules/platform/codecommit/codecommit-client.ts"],"sourcesContent":["import type {\n  CreatePullRequestApprovalRuleInput,\n  CreatePullRequestApprovalRuleOutput,\n  CreatePullRequestInput,\n  CreatePullRequestOutput,\n  DeleteCommentContentInput,\n  DeleteCommentContentOutput,\n  GetCommentsForPullRequestInput,\n  GetCommentsForPullRequestOutput,\n  GetFileInput,\n  GetFileOutput,\n  GetPullRequestInput,\n  GetPullRequestOutput,\n  GetRepositoryInput,\n  GetRepositoryOutput,\n  ListPullRequestsInput,\n  ListPullRequestsOutput,\n  ListRepositoriesInput,\n  ListRepositoriesOutput,\n  PostCommentForPullRequestInput,\n  PostCommentForPullRequestOutput,\n  RepositoryMetadata,\n  UpdateCommentInput,\n  UpdateCommentOutput,\n  UpdatePullRequestDescriptionInput,\n  UpdatePullRequestDescriptionOutput,\n  UpdatePullRequestStatusInput,\n  UpdatePullRequestStatusOutput,\n  UpdatePullRequestTitleInput,\n  UpdatePullRequestTitleOutput,\n} from '@aws-sdk/client-codecommit';\nimport {\n  CodeCommitClient,\n  CreatePullRequestApprovalRuleCommand,\n  CreatePullRequestCommand,\n  DeleteCommentContentCommand,\n  GetCommentsForPullRequestCommand,\n  GetFileCommand,\n  GetPullRequestCommand,\n  GetRepositoryCommand,\n  ListPullRequestsCommand,\n  ListRepositoriesCommand,\n  PostCommentForPullRequestCommand,\n  PullRequestStatusEnum,\n  UpdateCommentCommand,\n  UpdatePullRequestDescriptionCommand,\n  UpdatePullRequestStatusCommand,\n  UpdatePullRequestTitleCommand,\n} from '@aws-sdk/client-codecommit';\nimport { isString } from '@sindresorhus/is';\nimport * as aws4 from 'aws4';\nimport { REPOSITORY_UNINITIATED } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { getEnv } from '../../../util/env.ts';\nimport { regEx } from '../../../util/regex.ts';\n\nlet codeCommitClient: CodeCommitClient;\n\nexport function buildCodeCommitClient(): void {\n  if (!codeCommitClient) {\n    codeCommitClient = new CodeCommitClient({});\n  }\n\n  /* v8 ignore next -- unreachable: the client was just constructed above */\n  if (!codeCommitClient) {\n    throw new Error('Failed to initialize codecommit client');\n  }\n}\n\nexport async function deleteComment(\n  commentId: string,\n): Promise<DeleteCommentContentOutput> {\n  const input: DeleteCommentContentInput = {\n    commentId,\n  };\n  const cmd = new DeleteCommentContentCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function getPrComments(\n  pullRequestId: string,\n): Promise<GetCommentsForPullRequestOutput> {\n  const input: GetCommentsForPullRequestInput = {\n    pullRequestId,\n  };\n  const cmd = new GetCommentsForPullRequestCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function updateComment(\n  commentId: string,\n  content: string,\n): Promise<UpdateCommentOutput> {\n  const input: UpdateCommentInput = {\n    commentId,\n    content,\n  };\n  const cmd = new UpdateCommentCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function createPrComment(\n  pullRequestId: string,\n  repositoryName: string | undefined,\n  content: string,\n  beforeCommitId: string,\n  afterCommitId: string,\n): Promise<PostCommentForPullRequestOutput> {\n  const input: PostCommentForPullRequestInput = {\n    pullRequestId,\n    repositoryName,\n    content,\n    afterCommitId,\n    beforeCommitId,\n  };\n  const cmd = new PostCommentForPullRequestCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\n// export async function fastForwardMerge(\n//   repositoryName: string,\n//   sourceCommitSpecifier: string,\n//   destinationReference: string\n// ): Promise<MergeBranchesByFastForwardOutput> {\n//   const input: MergeBranchesByFastForwardInput = {\n//     repositoryName,\n//     sourceCommitSpecifier,\n//     destinationCommitSpecifier: destinationReference,\n//     targetBranch: destinationReference,\n//   };\n//   const cmd = new MergeBranchesByFastForwardCommand(input);\n//   return await codeCommitClient.send(cmd);\n// }\n\n// export async function squashMerge(\n//   repositoryName: string,\n//   sourceCommitSpecifier: string,\n//   destinationReference: string,\n//   commitMessage: string | undefined\n// ): Promise<MergeBranchesBySquashOutput> {\n//   const input: MergeBranchesBySquashInput = {\n//     repositoryName,\n//     sourceCommitSpecifier,\n//     destinationCommitSpecifier: destinationReference,\n//     targetBranch: destinationReference,\n//     commitMessage,\n//   };\n//   const cmd = new MergeBranchesBySquashCommand(input);\n//   return await codeCommitClient.send(cmd);\n// }\n\nexport async function updatePrStatus(\n  pullRequestId: string,\n  pullRequestStatus: PullRequestStatusEnum,\n): Promise<UpdatePullRequestStatusOutput> {\n  const input: UpdatePullRequestStatusInput = {\n    pullRequestId,\n    pullRequestStatus,\n  };\n  const cmd = new UpdatePullRequestStatusCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function updatePrTitle(\n  prNo: string,\n  title: string,\n): Promise<UpdatePullRequestTitleOutput> {\n  const input: UpdatePullRequestTitleInput = {\n    pullRequestId: `${prNo}`,\n    title,\n  };\n  const cmd = new UpdatePullRequestTitleCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function updatePrDescription(\n  pullRequestId: string,\n  description: string,\n): Promise<UpdatePullRequestDescriptionOutput> {\n  const input: UpdatePullRequestDescriptionInput = {\n    pullRequestId,\n    description,\n  };\n  const cmd = new UpdatePullRequestDescriptionCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function createPr(\n  title: string,\n  description: string,\n  sourceReference: string,\n  destinationReference: string,\n  repositoryName: string | undefined,\n): Promise<CreatePullRequestOutput> {\n  const input: CreatePullRequestInput = {\n    title,\n    description,\n    targets: [\n      {\n        sourceReference,\n        destinationReference,\n        repositoryName,\n      },\n    ],\n  };\n  const cmd = new CreatePullRequestCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function getFile(\n  repositoryName: string | undefined,\n  filePath: string,\n  commitSpecifier: string | undefined,\n): Promise<GetFileOutput> {\n  const input: GetFileInput = {\n    repositoryName,\n    filePath,\n    commitSpecifier,\n  };\n  const cmd: GetFileCommand = new GetFileCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function listPullRequests(\n  repositoryName: string,\n): Promise<ListPullRequestsOutput> {\n  const input: ListPullRequestsInput = {\n    repositoryName,\n    pullRequestStatus: PullRequestStatusEnum.OPEN,\n  };\n\n  const cmd = new ListPullRequestsCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function getRepositoryInfo(\n  repository: string,\n): Promise<GetRepositoryOutput> {\n  const input: GetRepositoryInput = {\n    repositoryName: `${repository}`,\n  };\n  const cmd = new GetRepositoryCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function getPr(\n  pullRequestId: string,\n): Promise<GetPullRequestOutput | undefined> {\n  const input: GetPullRequestInput = {\n    pullRequestId,\n  };\n  const cmd = new GetPullRequestCommand(input);\n  let res;\n  try {\n    res = await codeCommitClient.send(cmd);\n  } catch (err) {\n    logger.debug({ err }, 'failed to get PR using prId');\n  }\n  return res;\n}\n\nexport async function listRepositories(): Promise<ListRepositoriesOutput> {\n  const input: ListRepositoriesInput = {};\n  const cmd = new ListRepositoriesCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function createPrApprovalRule(\n  pullRequestId: string,\n  approvalRuleContent: string,\n): Promise<CreatePullRequestApprovalRuleOutput> {\n  const input: CreatePullRequestApprovalRuleInput = {\n    approvalRuleContent,\n    approvalRuleName: 'Reviewers By Renovate',\n    pullRequestId,\n  };\n  const cmd = new CreatePullRequestApprovalRuleCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport function getCodeCommitUrl(\n  repoMetadata: RepositoryMetadata,\n  repoName: string,\n): string {\n  logger.debug('get code commit url');\n  const env = getEnv();\n  if (!env.AWS_ACCESS_KEY_ID || !env.AWS_SECRET_ACCESS_KEY) {\n    if (repoMetadata.cloneUrlHttp) {\n      return repoMetadata.cloneUrlHttp;\n    }\n    // shouldn't reach here, but just in case\n    return `https://git-codecommit.${\n      env.AWS_REGION ?? 'us-east-1'\n    }.amazonaws.com/v1/repos/${repoName}`;\n  }\n\n  const signer = new aws4.RequestSigner({\n    service: 'codecommit',\n    host: `git-codecommit.${env.AWS_REGION ?? 'us-east-1'}.amazonaws.com`,\n    method: 'GIT',\n    path: `v1/repos/${repoName}`,\n  });\n  const dateTime = signer.getDateTime();\n\n  /* v8 ignore next -- defensive: the SigV4 signer always returns a datetime string */\n  if (!isString(dateTime)) {\n    throw new Error(REPOSITORY_UNINITIATED);\n  }\n\n  const token = `${dateTime}Z${signer.signature()}`;\n\n  let username = `${env.AWS_ACCESS_KEY_ID}${\n    env.AWS_SESSION_TOKEN ? `%${env.AWS_SESSION_TOKEN}` : ''\n  }`;\n\n  // massaging username with the session token,\n  /* v8 ignore next -- only hit when an AWS session token contains '/', not present in spec env */\n  if (username.includes('/')) {\n    username = username.replace(regEx(/\\//g), '%2F');\n  }\n  return `https://${username}:${token}@git-codecommit.${\n    env.AWS_REGION ?? 'us-east-1'\n  }.amazonaws.com/v1/repos/${repoName}`;\n}\n"],"mappings":";;;;;;;;AAwDA,IAAI;AAEJ,SAAgB,wBAA8B;CAC5C,IAAI,CAAC,kBACH,mBAAmB,IAAI,iBAAiB,CAAC,CAAC;;CAI5C,IAAI,CAAC,kBACH,MAAM,IAAI,MAAM,wCAAwC;AAE5D;AAEA,eAAsB,cACpB,WACqC;CAIrC,MAAM,MAAM,IAAI,4BAA4B,EAF1C,UAE8C,CAAC;CACjD,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,cACpB,eAC0C;CAI1C,MAAM,MAAM,IAAI,iCAAiC,EAF/C,cAEmD,CAAC;CACtD,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,cACpB,WACA,SAC8B;CAK9B,MAAM,MAAM,IAAI,qBAAqB;EAHnC;EACA;CAEuC,CAAC;CAC1C,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,gBACpB,eACA,gBACA,SACA,gBACA,eAC0C;CAQ1C,MAAM,MAAM,IAAI,iCAAiC;EAN/C;EACA;EACA;EACA;EACA;CAEmD,CAAC;CACtD,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAkCA,eAAsB,eACpB,eACA,mBACwC;CAKxC,MAAM,MAAM,IAAI,+BAA+B;EAH7C;EACA;CAEiD,CAAC;CACpD,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,cACpB,MACA,OACuC;CACvC,MAAM,QAAqC;EACzC,eAAe,GAAG;EAClB;CACF;CACA,MAAM,MAAM,IAAI,8BAA8B,KAAK;CACnD,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,oBACpB,eACA,aAC6C;CAK7C,MAAM,MAAM,IAAI,oCAAoC;EAHlD;EACA;CAEsD,CAAC;CACzD,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,SACpB,OACA,aACA,iBACA,sBACA,gBACkC;CAYlC,MAAM,MAAM,IAAI,yBAAyB;EAVvC;EACA;EACA,SAAS,CACP;GACE;GACA;GACA;EACF,CACF;CAE2C,CAAC;CAC9C,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,QACpB,gBACA,UACA,iBACwB;CAMxB,MAAM,MAAsB,IAAI,eAAe;EAJ7C;EACA;EACA;CAEiD,CAAC;CACpD,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,iBACpB,gBACiC;CACjC,MAAM,QAA+B;EACnC;EACA,mBAAmB,sBAAsB;CAC3C;CAEA,MAAM,MAAM,IAAI,wBAAwB,KAAK;CAC7C,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,kBACpB,YAC8B;CAC9B,MAAM,QAA4B,EAChC,gBAAgB,GAAG,aACrB;CACA,MAAM,MAAM,IAAI,qBAAqB,KAAK;CAC1C,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,MACpB,eAC2C;CAI3C,MAAM,MAAM,IAAI,sBAAsB,EAFpC,cAEwC,CAAC;CAC3C,IAAI;CACJ,IAAI;EACF,MAAM,MAAM,iBAAiB,KAAK,GAAG;CACvC,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,6BAA6B;CACrD;CACA,OAAO;AACT;AAEA,eAAsB,mBAAoD;CAExE,MAAM,MAAM,IAAI,wBAAwB,CAAI,CAAC;CAC7C,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,qBACpB,eACA,qBAC8C;CAM9C,MAAM,MAAM,IAAI,qCAAqC;EAJnD;EACA,kBAAkB;EAClB;CAEuD,CAAC;CAC1D,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,SAAgB,iBACd,cACA,UACQ;CACR,OAAO,MAAM,qBAAqB;CAClC,MAAM,MAAM,OAAO;CACnB,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,uBAAuB;EACxD,IAAI,aAAa,cACf,OAAO,aAAa;EAGtB,OAAO,0BACL,IAAI,cAAc,YACnB,0BAA0B;CAC7B;CAEA,MAAM,SAAS,IAAI,KAAK,cAAc;EACpC,SAAS;EACT,MAAM,kBAAkB,IAAI,cAAc,YAAY;EACtD,QAAQ;EACR,MAAM,YAAY;CACpB,CAAC;CACD,MAAM,WAAW,OAAO,YAAY;;CAGpC,IAAI,CAAC,SAAS,QAAQ,GACpB,MAAM,IAAI,MAAM,sBAAsB;CAGxC,MAAM,QAAQ,GAAG,SAAS,GAAG,OAAO,UAAU;CAE9C,IAAI,WAAW,GAAG,IAAI,oBACpB,IAAI,oBAAoB,IAAI,IAAI,sBAAsB;;CAKxD,IAAI,SAAS,SAAS,GAAG,GACvB,WAAW,SAAS,QAAQ,MAAM,KAAK,GAAG,KAAK;CAEjD,OAAO,WAAW,SAAS,GAAG,MAAM,kBAClC,IAAI,cAAc,YACnB,0BAA0B;AAC7B"}
+{"version":3,"file":"codecommit-client.js","names":[],"sources":["../../../../lib/modules/platform/codecommit/codecommit-client.ts"],"sourcesContent":["import type {\n  CreatePullRequestApprovalRuleInput,\n  CreatePullRequestApprovalRuleOutput,\n  CreatePullRequestInput,\n  CreatePullRequestOutput,\n  DeleteCommentContentInput,\n  DeleteCommentContentOutput,\n  GetCommentsForPullRequestInput,\n  GetCommentsForPullRequestOutput,\n  GetFileInput,\n  GetFileOutput,\n  GetPullRequestInput,\n  GetPullRequestOutput,\n  GetRepositoryInput,\n  GetRepositoryOutput,\n  ListPullRequestsInput,\n  ListPullRequestsOutput,\n  ListRepositoriesInput,\n  ListRepositoriesOutput,\n  PostCommentForPullRequestInput,\n  PostCommentForPullRequestOutput,\n  RepositoryMetadata,\n  UpdateCommentInput,\n  UpdateCommentOutput,\n  UpdatePullRequestDescriptionInput,\n  UpdatePullRequestDescriptionOutput,\n  UpdatePullRequestStatusInput,\n  UpdatePullRequestStatusOutput,\n  UpdatePullRequestTitleInput,\n  UpdatePullRequestTitleOutput,\n} from '@aws-sdk/client-codecommit';\nimport {\n  CodeCommitClient,\n  CreatePullRequestApprovalRuleCommand,\n  CreatePullRequestCommand,\n  DeleteCommentContentCommand,\n  GetCommentsForPullRequestCommand,\n  GetFileCommand,\n  GetPullRequestCommand,\n  GetRepositoryCommand,\n  ListPullRequestsCommand,\n  ListRepositoriesCommand,\n  PostCommentForPullRequestCommand,\n  PullRequestStatusEnum,\n  UpdateCommentCommand,\n  UpdatePullRequestDescriptionCommand,\n  UpdatePullRequestStatusCommand,\n  UpdatePullRequestTitleCommand,\n} from '@aws-sdk/client-codecommit';\nimport { isString } from '@sindresorhus/is';\nimport aws4 from 'aws4';\nimport { REPOSITORY_UNINITIATED } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { getEnv } from '../../../util/env.ts';\nimport { regEx } from '../../../util/regex.ts';\n\nlet codeCommitClient: CodeCommitClient;\n\nexport function buildCodeCommitClient(): void {\n  if (!codeCommitClient) {\n    codeCommitClient = new CodeCommitClient({});\n  }\n\n  /* v8 ignore next -- unreachable: the client was just constructed above */\n  if (!codeCommitClient) {\n    throw new Error('Failed to initialize codecommit client');\n  }\n}\n\nexport async function deleteComment(\n  commentId: string,\n): Promise<DeleteCommentContentOutput> {\n  const input: DeleteCommentContentInput = {\n    commentId,\n  };\n  const cmd = new DeleteCommentContentCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function getPrComments(\n  pullRequestId: string,\n): Promise<GetCommentsForPullRequestOutput> {\n  const input: GetCommentsForPullRequestInput = {\n    pullRequestId,\n  };\n  const cmd = new GetCommentsForPullRequestCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function updateComment(\n  commentId: string,\n  content: string,\n): Promise<UpdateCommentOutput> {\n  const input: UpdateCommentInput = {\n    commentId,\n    content,\n  };\n  const cmd = new UpdateCommentCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function createPrComment(\n  pullRequestId: string,\n  repositoryName: string | undefined,\n  content: string,\n  beforeCommitId: string,\n  afterCommitId: string,\n): Promise<PostCommentForPullRequestOutput> {\n  const input: PostCommentForPullRequestInput = {\n    pullRequestId,\n    repositoryName,\n    content,\n    afterCommitId,\n    beforeCommitId,\n  };\n  const cmd = new PostCommentForPullRequestCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\n// export async function fastForwardMerge(\n//   repositoryName: string,\n//   sourceCommitSpecifier: string,\n//   destinationReference: string\n// ): Promise<MergeBranchesByFastForwardOutput> {\n//   const input: MergeBranchesByFastForwardInput = {\n//     repositoryName,\n//     sourceCommitSpecifier,\n//     destinationCommitSpecifier: destinationReference,\n//     targetBranch: destinationReference,\n//   };\n//   const cmd = new MergeBranchesByFastForwardCommand(input);\n//   return await codeCommitClient.send(cmd);\n// }\n\n// export async function squashMerge(\n//   repositoryName: string,\n//   sourceCommitSpecifier: string,\n//   destinationReference: string,\n//   commitMessage: string | undefined\n// ): Promise<MergeBranchesBySquashOutput> {\n//   const input: MergeBranchesBySquashInput = {\n//     repositoryName,\n//     sourceCommitSpecifier,\n//     destinationCommitSpecifier: destinationReference,\n//     targetBranch: destinationReference,\n//     commitMessage,\n//   };\n//   const cmd = new MergeBranchesBySquashCommand(input);\n//   return await codeCommitClient.send(cmd);\n// }\n\nexport async function updatePrStatus(\n  pullRequestId: string,\n  pullRequestStatus: PullRequestStatusEnum,\n): Promise<UpdatePullRequestStatusOutput> {\n  const input: UpdatePullRequestStatusInput = {\n    pullRequestId,\n    pullRequestStatus,\n  };\n  const cmd = new UpdatePullRequestStatusCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function updatePrTitle(\n  prNo: string,\n  title: string,\n): Promise<UpdatePullRequestTitleOutput> {\n  const input: UpdatePullRequestTitleInput = {\n    pullRequestId: `${prNo}`,\n    title,\n  };\n  const cmd = new UpdatePullRequestTitleCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function updatePrDescription(\n  pullRequestId: string,\n  description: string,\n): Promise<UpdatePullRequestDescriptionOutput> {\n  const input: UpdatePullRequestDescriptionInput = {\n    pullRequestId,\n    description,\n  };\n  const cmd = new UpdatePullRequestDescriptionCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function createPr(\n  title: string,\n  description: string,\n  sourceReference: string,\n  destinationReference: string,\n  repositoryName: string | undefined,\n): Promise<CreatePullRequestOutput> {\n  const input: CreatePullRequestInput = {\n    title,\n    description,\n    targets: [\n      {\n        sourceReference,\n        destinationReference,\n        repositoryName,\n      },\n    ],\n  };\n  const cmd = new CreatePullRequestCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function getFile(\n  repositoryName: string | undefined,\n  filePath: string,\n  commitSpecifier: string | undefined,\n): Promise<GetFileOutput> {\n  const input: GetFileInput = {\n    repositoryName,\n    filePath,\n    commitSpecifier,\n  };\n  const cmd: GetFileCommand = new GetFileCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function listPullRequests(\n  repositoryName: string,\n): Promise<ListPullRequestsOutput> {\n  const input: ListPullRequestsInput = {\n    repositoryName,\n    pullRequestStatus: PullRequestStatusEnum.OPEN,\n  };\n\n  const cmd = new ListPullRequestsCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function getRepositoryInfo(\n  repository: string,\n): Promise<GetRepositoryOutput> {\n  const input: GetRepositoryInput = {\n    repositoryName: `${repository}`,\n  };\n  const cmd = new GetRepositoryCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function getPr(\n  pullRequestId: string,\n): Promise<GetPullRequestOutput | undefined> {\n  const input: GetPullRequestInput = {\n    pullRequestId,\n  };\n  const cmd = new GetPullRequestCommand(input);\n  let res;\n  try {\n    res = await codeCommitClient.send(cmd);\n  } catch (err) {\n    logger.debug({ err }, 'failed to get PR using prId');\n  }\n  return res;\n}\n\nexport async function listRepositories(): Promise<ListRepositoriesOutput> {\n  const input: ListRepositoriesInput = {};\n  const cmd = new ListRepositoriesCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport async function createPrApprovalRule(\n  pullRequestId: string,\n  approvalRuleContent: string,\n): Promise<CreatePullRequestApprovalRuleOutput> {\n  const input: CreatePullRequestApprovalRuleInput = {\n    approvalRuleContent,\n    approvalRuleName: 'Reviewers By Renovate',\n    pullRequestId,\n  };\n  const cmd = new CreatePullRequestApprovalRuleCommand(input);\n  return await codeCommitClient.send(cmd);\n}\n\nexport function getCodeCommitUrl(\n  repoMetadata: RepositoryMetadata,\n  repoName: string,\n): string {\n  logger.debug('get code commit url');\n  const env = getEnv();\n  if (!env.AWS_ACCESS_KEY_ID || !env.AWS_SECRET_ACCESS_KEY) {\n    if (repoMetadata.cloneUrlHttp) {\n      return repoMetadata.cloneUrlHttp;\n    }\n    // shouldn't reach here, but just in case\n    return `https://git-codecommit.${\n      env.AWS_REGION ?? 'us-east-1'\n    }.amazonaws.com/v1/repos/${repoName}`;\n  }\n\n  const signer = new aws4.RequestSigner({\n    service: 'codecommit',\n    host: `git-codecommit.${env.AWS_REGION ?? 'us-east-1'}.amazonaws.com`,\n    method: 'GIT',\n    path: `v1/repos/${repoName}`,\n  });\n  const dateTime = signer.getDateTime();\n\n  /* v8 ignore next -- defensive: the SigV4 signer always returns a datetime string */\n  if (!isString(dateTime)) {\n    throw new Error(REPOSITORY_UNINITIATED);\n  }\n\n  const token = `${dateTime}Z${signer.signature()}`;\n\n  let username = `${env.AWS_ACCESS_KEY_ID}${\n    env.AWS_SESSION_TOKEN ? `%${env.AWS_SESSION_TOKEN}` : ''\n  }`;\n\n  // massaging username with the session token,\n  /* v8 ignore next -- only hit when an AWS session token contains '/', not present in spec env */\n  if (username.includes('/')) {\n    username = username.replace(regEx(/\\//g), '%2F');\n  }\n  return `https://${username}:${token}@git-codecommit.${\n    env.AWS_REGION ?? 'us-east-1'\n  }.amazonaws.com/v1/repos/${repoName}`;\n}\n"],"mappings":";;;;;;;;AAwDA,IAAI;AAEJ,SAAgB,wBAA8B;CAC5C,IAAI,CAAC,kBACH,mBAAmB,IAAI,iBAAiB,CAAC,CAAC;;CAI5C,IAAI,CAAC,kBACH,MAAM,IAAI,MAAM,wCAAwC;AAE5D;AAEA,eAAsB,cACpB,WACqC;CAIrC,MAAM,MAAM,IAAI,4BAA4B,EAF1C,UAE8C,CAAC;CACjD,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,cACpB,eAC0C;CAI1C,MAAM,MAAM,IAAI,iCAAiC,EAF/C,cAEmD,CAAC;CACtD,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,cACpB,WACA,SAC8B;CAK9B,MAAM,MAAM,IAAI,qBAAqB;EAHnC;EACA;CAEuC,CAAC;CAC1C,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,gBACpB,eACA,gBACA,SACA,gBACA,eAC0C;CAQ1C,MAAM,MAAM,IAAI,iCAAiC;EAN/C;EACA;EACA;EACA;EACA;CAEmD,CAAC;CACtD,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAkCA,eAAsB,eACpB,eACA,mBACwC;CAKxC,MAAM,MAAM,IAAI,+BAA+B;EAH7C;EACA;CAEiD,CAAC;CACpD,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,cACpB,MACA,OACuC;CACvC,MAAM,QAAqC;EACzC,eAAe,GAAG;EAClB;CACF;CACA,MAAM,MAAM,IAAI,8BAA8B,KAAK;CACnD,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,oBACpB,eACA,aAC6C;CAK7C,MAAM,MAAM,IAAI,oCAAoC;EAHlD;EACA;CAEsD,CAAC;CACzD,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,SACpB,OACA,aACA,iBACA,sBACA,gBACkC;CAYlC,MAAM,MAAM,IAAI,yBAAyB;EAVvC;EACA;EACA,SAAS,CACP;GACE;GACA;GACA;EACF,CACF;CAE2C,CAAC;CAC9C,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,QACpB,gBACA,UACA,iBACwB;CAMxB,MAAM,MAAsB,IAAI,eAAe;EAJ7C;EACA;EACA;CAEiD,CAAC;CACpD,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,iBACpB,gBACiC;CACjC,MAAM,QAA+B;EACnC;EACA,mBAAmB,sBAAsB;CAC3C;CAEA,MAAM,MAAM,IAAI,wBAAwB,KAAK;CAC7C,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,kBACpB,YAC8B;CAC9B,MAAM,QAA4B,EAChC,gBAAgB,GAAG,aACrB;CACA,MAAM,MAAM,IAAI,qBAAqB,KAAK;CAC1C,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,MACpB,eAC2C;CAI3C,MAAM,MAAM,IAAI,sBAAsB,EAFpC,cAEwC,CAAC;CAC3C,IAAI;CACJ,IAAI;EACF,MAAM,MAAM,iBAAiB,KAAK,GAAG;CACvC,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,6BAA6B;CACrD;CACA,OAAO;AACT;AAEA,eAAsB,mBAAoD;CAExE,MAAM,MAAM,IAAI,wBAAwB,CAAI,CAAC;CAC7C,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,eAAsB,qBACpB,eACA,qBAC8C;CAM9C,MAAM,MAAM,IAAI,qCAAqC;EAJnD;EACA,kBAAkB;EAClB;CAEuD,CAAC;CAC1D,OAAO,MAAM,iBAAiB,KAAK,GAAG;AACxC;AAEA,SAAgB,iBACd,cACA,UACQ;CACR,OAAO,MAAM,qBAAqB;CAClC,MAAM,MAAM,OAAO;CACnB,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,uBAAuB;EACxD,IAAI,aAAa,cACf,OAAO,aAAa;EAGtB,OAAO,0BACL,IAAI,cAAc,YACnB,0BAA0B;CAC7B;CAEA,MAAM,SAAS,IAAI,KAAK,cAAc;EACpC,SAAS;EACT,MAAM,kBAAkB,IAAI,cAAc,YAAY;EACtD,QAAQ;EACR,MAAM,YAAY;CACpB,CAAC;CACD,MAAM,WAAW,OAAO,YAAY;;CAGpC,IAAI,CAAC,SAAS,QAAQ,GACpB,MAAM,IAAI,MAAM,sBAAsB;CAGxC,MAAM,QAAQ,GAAG,SAAS,GAAG,OAAO,UAAU;CAE9C,IAAI,WAAW,GAAG,IAAI,oBACpB,IAAI,oBAAoB,IAAI,IAAI,sBAAsB;;CAKxD,IAAI,SAAS,SAAS,GAAG,GACvB,WAAW,SAAS,QAAQ,MAAM,KAAK,GAAG,KAAK;CAEjD,OAAO,WAAW,SAAS,GAAG,MAAM,kBAClC,IAAI,cAAc,YACnB,0BAA0B;AAC7B"}

package/dist/util/markdown.js

@@ -6,7 +6,7 @@ import github from "remark-github";
 function sanitizeMarkdown(markdown) {
 	let res = markdown;
 	res = res.replace(regEx(/(?<pre>\W)#(?<digit>\d)/gi), "$<pre>#&#8203;$<digit>");
-	res = res.split(regEx(/(?<skip>```[\s\S]*?```|`[^`\n]*?`|https?:\/\/[^\s<]+)/gi)).map((part) => part.startsWith("`") || regEx(/^https?:\/\//i).test(part) ? part : part.replace(regEx(/@/g), "@&#8203;")).join("");
+	res = res.split(regEx(/(?<skip>````[\s\S]*?````|```[\s\S]*?```|`[^`\n]*?`|https?:\/\/[^\s<]+)/gi)).map((part) => part.startsWith("`") || regEx(/^https?:\/\//i).test(part) ? part : part.replace(regEx(/@/g), "@&#8203;")).join("");
 	res = res.replace(regEx(/(?<pre>[a-z]@)&#8203;/gi), "$<pre>");
 	res = res.replace(regEx(/\/compare\/@&#8203;/g), "/compare/@");
 	res = res.replace(regEx(/(?<pre>\(https:\/\/[^)]*?)\.\.\.@&#8203;/g), "$<pre>...@");

package/dist/util/markdown.js.map

@@ -1 +1 @@
-{"version":3,"file":"markdown.js","names":[],"sources":["../../lib/util/markdown.ts"],"sourcesContent":["import { remark } from 'remark';\nimport gfm from 'remark-gfm';\nimport type { Options as RemarkGithubOptions } from 'remark-github';\nimport github from 'remark-github';\nimport { regEx } from './regex.ts';\n\n// Generic replacements/link-breakers\nexport function sanitizeMarkdown(markdown: string): string {\n  let res = markdown;\n  // Put a zero width space after every # followed by a digit\n  res = res.replace(\n    regEx(/(?<pre>\\W)#(?<digit>\\d)/gi),\n    '$<pre>#&#8203;$<digit>',\n  );\n  // Put a zero width space after every @ symbol to prevent unintended hyperlinking,\n  // but leave URLs, code blocks (triple backticks), and inline code spans untouched\n  res = res\n    .split(regEx(/(?<skip>```[\\s\\S]*?```|`[^`\\n]*?`|https?:\\/\\/[^\\s<]+)/gi))\n    .map((part) =>\n      part.startsWith('`') || regEx(/^https?:\\/\\//i).test(part)\n        ? part\n        : part.replace(regEx(/@/g), '@&#8203;'),\n    )\n    .join('');\n  res = res.replace(regEx(/(?<pre>[a-z]@)&#8203;/gi), '$<pre>');\n  res = res.replace(regEx(/\\/compare\\/@&#8203;/g), '/compare/@');\n  res = res.replace(\n    regEx(/(?<pre>\\(https:\\/\\/[^)]*?)\\.\\.\\.@&#8203;/g),\n    '$<pre>...@',\n  );\n  res = res.replace(\n    regEx(/(?<pre>[\\s(])#(?<digits>\\d+)(?<post>[)\\s]?)/g),\n    '$<pre>#&#8203;$<digits>$<post>',\n  );\n  // convert escaped backticks back to `\n  const backTickRe = regEx(/&#x60;(?<content>[^/]*?)&#x60;/g);\n  res = res.replace(backTickRe, '`$<content>`');\n  res = res.replace(regEx(/`#&#8203;(?<digits>\\d+)`/g), '`#$<digits>`');\n  res = res.replace(\n    regEx(/(?<before>[^\\n]\\n)(?<title>#.*)/g),\n    '$<before>\\n$<title>',\n  );\n  return res;\n}\n\n/**\n *\n * @param content content to process\n * @param options github options\n * @returns linkified content\n */\nexport async function linkify(\n  content: string,\n  options: RemarkGithubOptions,\n): Promise<string> {\n  // https://github.com/syntax-tree/mdast-util-to-markdown#optionsbullet\n  const output = await remark()\n    .use({ settings: { bullet: '-' } })\n    .use(gfm)\n    .use(github, { mentionStrong: false, ...options })\n    .process(content);\n  return output.toString();\n}\n"],"mappings":";;;;;AAOA,SAAgB,iBAAiB,UAA0B;CACzD,IAAI,MAAM;CAEV,MAAM,IAAI,QACR,MAAM,2BAA2B,GACjC,wBACF;CAGA,MAAM,IACH,MAAM,MAAM,yDAAyD,CAAC,CAAC,CACvE,KAAK,SACJ,KAAK,WAAW,GAAG,KAAK,MAAM,eAAe,CAAC,CAAC,KAAK,IAAI,IACpD,OACA,KAAK,QAAQ,MAAM,IAAI,GAAG,UAAU,CAC1C,CAAC,CACA,KAAK,EAAE;CACV,MAAM,IAAI,QAAQ,MAAM,yBAAyB,GAAG,QAAQ;CAC5D,MAAM,IAAI,QAAQ,MAAM,sBAAsB,GAAG,YAAY;CAC7D,MAAM,IAAI,QACR,MAAM,2CAA2C,GACjD,YACF;CACA,MAAM,IAAI,QACR,MAAM,8CAA8C,GACpD,gCACF;CAEA,MAAM,aAAa,MAAM,iCAAiC;CAC1D,MAAM,IAAI,QAAQ,YAAY,cAAc;CAC5C,MAAM,IAAI,QAAQ,MAAM,2BAA2B,GAAG,cAAc;CACpE,MAAM,IAAI,QACR,MAAM,kCAAkC,GACxC,qBACF;CACA,OAAO;AACT;;;;;;;AAQA,eAAsB,QACpB,SACA,SACiB;CAOjB,QAAO,MALc,OAAO,CAAC,CAC1B,IAAI,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAClC,IAAI,GAAG,CAAC,CACR,IAAI,QAAQ;EAAE,eAAe;EAAO,GAAG;CAAQ,CAAC,CAAC,CACjD,QAAQ,OAAO,EAAA,CACJ,SAAS;AACzB"}
+{"version":3,"file":"markdown.js","names":[],"sources":["../../lib/util/markdown.ts"],"sourcesContent":["import { remark } from 'remark';\nimport gfm from 'remark-gfm';\nimport type { Options as RemarkGithubOptions } from 'remark-github';\nimport github from 'remark-github';\nimport { regEx } from './regex.ts';\n\n// Generic replacements/link-breakers\nexport function sanitizeMarkdown(markdown: string): string {\n  let res = markdown;\n  // Put a zero width space after every # followed by a digit\n  res = res.replace(\n    regEx(/(?<pre>\\W)#(?<digit>\\d)/gi),\n    '$<pre>#&#8203;$<digit>',\n  );\n  // Put a zero width space after every @ symbol to prevent unintended hyperlinking,\n  // but leave URLs, code blocks (triple or quadruple backticks), and inline code spans untouched\n  res = res\n    .split(\n      regEx(\n        /(?<skip>````[\\s\\S]*?````|```[\\s\\S]*?```|`[^`\\n]*?`|https?:\\/\\/[^\\s<]+)/gi,\n      ),\n    )\n    .map((part) =>\n      part.startsWith('`') || regEx(/^https?:\\/\\//i).test(part)\n        ? part\n        : part.replace(regEx(/@/g), '@&#8203;'),\n    )\n    .join('');\n  res = res.replace(regEx(/(?<pre>[a-z]@)&#8203;/gi), '$<pre>');\n  res = res.replace(regEx(/\\/compare\\/@&#8203;/g), '/compare/@');\n  res = res.replace(\n    regEx(/(?<pre>\\(https:\\/\\/[^)]*?)\\.\\.\\.@&#8203;/g),\n    '$<pre>...@',\n  );\n  res = res.replace(\n    regEx(/(?<pre>[\\s(])#(?<digits>\\d+)(?<post>[)\\s]?)/g),\n    '$<pre>#&#8203;$<digits>$<post>',\n  );\n  // convert escaped backticks back to `\n  const backTickRe = regEx(/&#x60;(?<content>[^/]*?)&#x60;/g);\n  res = res.replace(backTickRe, '`$<content>`');\n  res = res.replace(regEx(/`#&#8203;(?<digits>\\d+)`/g), '`#$<digits>`');\n  res = res.replace(\n    regEx(/(?<before>[^\\n]\\n)(?<title>#.*)/g),\n    '$<before>\\n$<title>',\n  );\n  return res;\n}\n\n/**\n *\n * @param content content to process\n * @param options github options\n * @returns linkified content\n */\nexport async function linkify(\n  content: string,\n  options: RemarkGithubOptions,\n): Promise<string> {\n  // https://github.com/syntax-tree/mdast-util-to-markdown#optionsbullet\n  const output = await remark()\n    .use({ settings: { bullet: '-' } })\n    .use(gfm)\n    .use(github, { mentionStrong: false, ...options })\n    .process(content);\n  return output.toString();\n}\n"],"mappings":";;;;;AAOA,SAAgB,iBAAiB,UAA0B;CACzD,IAAI,MAAM;CAEV,MAAM,IAAI,QACR,MAAM,2BAA2B,GACjC,wBACF;CAGA,MAAM,IACH,MACC,MACE,0EACF,CACF,CAAC,CACA,KAAK,SACJ,KAAK,WAAW,GAAG,KAAK,MAAM,eAAe,CAAC,CAAC,KAAK,IAAI,IACpD,OACA,KAAK,QAAQ,MAAM,IAAI,GAAG,UAAU,CAC1C,CAAC,CACA,KAAK,EAAE;CACV,MAAM,IAAI,QAAQ,MAAM,yBAAyB,GAAG,QAAQ;CAC5D,MAAM,IAAI,QAAQ,MAAM,sBAAsB,GAAG,YAAY;CAC7D,MAAM,IAAI,QACR,MAAM,2CAA2C,GACjD,YACF;CACA,MAAM,IAAI,QACR,MAAM,8CAA8C,GACpD,gCACF;CAEA,MAAM,aAAa,MAAM,iCAAiC;CAC1D,MAAM,IAAI,QAAQ,YAAY,cAAc;CAC5C,MAAM,IAAI,QAAQ,MAAM,2BAA2B,GAAG,cAAc;CACpE,MAAM,IAAI,QACR,MAAM,kCAAkC,GACxC,qBACF;CACA,OAAO;AACT;;;;;;;AAQA,eAAsB,QACpB,SACA,SACiB;CAOjB,QAAO,MALc,OAAO,CAAC,CAC1B,IAAI,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAClC,IAAI,GAAG,CAAC,CACR,IAAI,QAAQ;EAAE,eAAe;EAAO,GAAG;CAAQ,CAAC,CAAC,CACjD,QAAQ,OAAO,EAAA,CACJ,SAAS;AACzB"}

package/dist/workers/repository/process/vulnerabilities.js

@@ -14,9 +14,9 @@ import { datasourceToOsvEcosystem } from "../../../util/vulnerability/ecosystem.
 import { isEmptyArray, isNonEmptyString, isNullOrUndefined, isTruthy } from "@sindresorhus/is";
 import { z } from "zod/v4";
 import { OsvOffline } from "@renovatebot/osv-offline";
-import * as _aeCvss from "ae-cvss-calculator";
+import aeCvss from "ae-cvss-calculator";
 //#region lib/workers/repository/process/vulnerabilities.ts
-const { fromVector } = _aeCvss.default;
+const { fromVector } = aeCvss;
 var Vulnerabilities = class Vulnerabilities {
 	static osvOffline;
 	osvOffline;

package/dist/workers/repository/process/vulnerabilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"vulnerabilities.js","names":["p.all","getVersioning"],"sources":["../../../../lib/workers/repository/process/vulnerabilities.ts"],"sourcesContent":["// TODO #22198\nimport type { Ecosystem, Osv } from '@renovatebot/osv-offline';\nimport { OsvOffline } from '@renovatebot/osv-offline';\nimport {\n  isEmptyArray,\n  isNonEmptyString,\n  isNullOrUndefined,\n  isTruthy,\n} from '@sindresorhus/is';\nimport type { CvssVector } from 'ae-cvss-calculator';\nimport * as _aeCvss from 'ae-cvss-calculator';\nimport { z } from 'zod/v4';\nimport { getManagerConfig, mergeChildConfig } from '../../../config/index.ts';\nimport type { PackageRule, RenovateConfig } from '../../../config/types.ts';\nimport { instrument } from '../../../instrumentation/index.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { getDefaultVersioning } from '../../../modules/datasource/common.ts';\nimport type {\n  PackageDependency,\n  PackageFile,\n} from '../../../modules/manager/types.ts';\nimport type { VersioningApi } from '../../../modules/versioning/index.ts';\nimport { get as getVersioning } from '../../../modules/versioning/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { sanitizeMarkdown } from '../../../util/markdown.ts';\nimport * as p from '../../../util/promises.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { titleCase } from '../../../util/string.ts';\nimport { datasourceToOsvEcosystem } from '../../../util/vulnerability/ecosystem.ts';\nimport {\n  getFixedVersionConstraint,\n  getLastAffectedVersionConstraint,\n} from '../../../util/vulnerability/utils.ts';\nimport type {\n  DependencyVulnerabilities,\n  SeverityDetails,\n  Vulnerability,\n} from './types.ts';\n\nconst { fromVector } = (_aeCvss as unknown as { default: typeof _aeCvss })\n  .default;\n\nexport class Vulnerabilities {\n  private static osvOffline: Promise<OsvOffline> | undefined;\n\n  private osvOffline: OsvOffline;\n\n  private static readonly datasourceEcosystemMap = datasourceToOsvEcosystem;\n\n  private constructor(osvOffline: OsvOffline) {\n    this.osvOffline = osvOffline;\n  }\n\n  private static initialize(): Promise<OsvOffline> {\n    // no async here, so osv promise will only be created once\n    Vulnerabilities.osvOffline ??= OsvOffline.create();\n    return Vulnerabilities.osvOffline;\n  }\n\n  static async create(): Promise<Vulnerabilities> {\n    // intialize osv only once\n    const osvOffline = await Vulnerabilities.initialize();\n\n    const instance = new Vulnerabilities(osvOffline);\n    return instance;\n  }\n\n  async appendVulnerabilityPackageRules(\n    config: RenovateConfig,\n    packageFiles: Record<string, PackageFile[]>,\n  ): Promise<void> {\n    const dependencyVulnerabilities = await this.fetchDependencyVulnerabilities(\n      config,\n      packageFiles,\n    );\n\n    config.packageRules ??= [];\n    for (const {\n      vulnerabilities,\n      versioningApi,\n    } of dependencyVulnerabilities) {\n      const groupPackageRules: PackageRule[] = [];\n      for (const vulnerability of vulnerabilities) {\n        const rule = this.vulnerabilityToPackageRules(vulnerability);\n        if (isNullOrUndefined(rule)) {\n          continue;\n        }\n        groupPackageRules.push(rule);\n      }\n      this.sortByFixedVersion(groupPackageRules, versioningApi);\n\n      config.packageRules.push(...groupPackageRules);\n    }\n  }\n\n  async fetchVulnerabilities(\n    config: RenovateConfig,\n    packageFiles: Record<string, PackageFile[]>,\n  ): Promise<Vulnerability[]> {\n    const groups = await this.fetchDependencyVulnerabilities(\n      config,\n      packageFiles,\n    );\n    return groups.flatMap((group) => group.vulnerabilities);\n  }\n\n  private async fetchDependencyVulnerabilities(\n    config: RenovateConfig,\n    packageFiles: Record<string, PackageFile[]>,\n  ): Promise<DependencyVulnerabilities[]> {\n    const managers = Object.keys(packageFiles);\n    const allManagerJobs = managers.map((manager) =>\n      this.fetchManagerVulnerabilities(config, packageFiles, manager),\n    );\n    return (await Promise.all(allManagerJobs)).flat();\n  }\n\n  private async fetchManagerVulnerabilities(\n    config: RenovateConfig,\n    packageFiles: Record<string, PackageFile[]>,\n    manager: string,\n  ): Promise<DependencyVulnerabilities[]> {\n    const managerConfig = getManagerConfig(config, manager);\n    const queue = packageFiles[manager].map(\n      (pFile) => (): Promise<DependencyVulnerabilities[]> =>\n        this.fetchManagerPackageFileVulnerabilities(managerConfig, pFile),\n    );\n    logger.trace(\n      { manager, queueLength: queue.length },\n      'fetchManagerVulnerabilities starting',\n    );\n    const result = (await p.all(queue)).flat();\n    logger.trace({ manager }, 'fetchManagerVulnerabilities finished');\n    return result;\n  }\n\n  private async fetchManagerPackageFileVulnerabilities(\n    managerConfig: RenovateConfig,\n    pFile: PackageFile,\n  ): Promise<DependencyVulnerabilities[]> {\n    const { packageFile } = pFile;\n    const packageFileConfig = mergeChildConfig(managerConfig, pFile);\n    const { manager } = packageFileConfig;\n    const queue = pFile.deps.map(\n      (dep) => (): Promise<DependencyVulnerabilities | null> =>\n        this.fetchDependencyVulnerability(packageFileConfig, dep),\n    );\n    logger.trace(\n      { manager, packageFile, queueLength: queue.length },\n      'fetchManagerPackageFileVulnerabilities starting with concurrency',\n    );\n\n    const result = await p.all(queue);\n    logger.trace(\n      { packageFile },\n      'fetchManagerPackageFileVulnerabilities finished',\n    );\n\n    return result.filter(isTruthy);\n  }\n\n  private async fetchDependencyVulnerability(\n    packageFileConfig: RenovateConfig & PackageFile,\n    dep: PackageDependency,\n  ): Promise<DependencyVulnerabilities | null> {\n    const ecosystem = Vulnerabilities.datasourceEcosystemMap[dep.datasource!];\n    if (!ecosystem) {\n      logger.trace(`Cannot map datasource ${dep.datasource!} to OSV ecosystem`);\n      return null;\n    }\n\n    const packageName = dep.packageName!;\n    let osvPackageName = packageName;\n    let depType: string | undefined;\n    if (ecosystem === 'PyPI') {\n      // https://peps.python.org/pep-0503/#normalized-names\n      osvPackageName = osvPackageName\n        .toLowerCase()\n        .replace(regEx(/[_.-]+/g), '-');\n    } else if (ecosystem === 'Go' && packageName === 'go') {\n      if (dep.depType !== 'toolchain') {\n        // The `go` directive is source compatibility, not the build toolchain, so we skip it\n        return null;\n      }\n      osvPackageName = 'stdlib';\n      depType = dep.depType;\n    }\n\n    try {\n      const osvVulnerabilities = await instrument(\n        'get OSV vulnerabilities',\n        () => this.osvOffline.getVulnerabilities(ecosystem, osvPackageName),\n        {\n          attributes: {\n            osvPackageName,\n            ecosystem,\n          },\n        },\n      );\n      if (\n        isNullOrUndefined(osvVulnerabilities) ||\n        isEmptyArray(osvVulnerabilities)\n      ) {\n        logger.trace(\n          `No vulnerabilities found in OSV database for ${packageName}`,\n        );\n        return null;\n      }\n\n      const depVersion =\n        dep.lockedVersion ?? dep.currentVersion ?? dep.currentValue!;\n\n      const versioning = dep.versioning ?? getDefaultVersioning(dep.datasource);\n      const versioningApi = getVersioning(versioning);\n\n      if (!versioningApi.isVersion(depVersion)) {\n        logger.debug(\n          `Skipping vulnerability lookup for package ${packageName} due to unsupported version ${depVersion}`,\n        );\n        return null;\n      }\n\n      const vulnerabilities: Vulnerability[] = [];\n      for (const osvVulnerability of osvVulnerabilities) {\n        if (osvVulnerability.withdrawn) {\n          logger.trace(\n            `Skipping withdrawn vulnerability ${osvVulnerability.id}`,\n          );\n          continue;\n        }\n\n        this.skipMaliciousPackages(\n          ecosystem,\n          osvPackageName,\n          depVersion,\n          versioningApi,\n          dep,\n          packageFileConfig.manager,\n          packageFileConfig.packageFile,\n          osvVulnerability,\n        );\n\n        for (const affected of coerceArray(osvVulnerability.affected)) {\n          const isVulnerable = this.isPackageVulnerable(\n            ecosystem,\n            osvPackageName,\n            depVersion,\n            affected,\n            versioningApi,\n          );\n          if (!isVulnerable) {\n            continue;\n          }\n\n          logger.debug(\n            `Vulnerability ${osvVulnerability.id} affects ${packageName} ${depVersion}`,\n          );\n          const fixedVersion = this.getFixedVersion(\n            ecosystem,\n            depVersion,\n            affected,\n            versioningApi,\n          );\n\n          vulnerabilities.push({\n            packageName,\n            osvPackageName,\n            vulnerability: osvVulnerability,\n            affected,\n            depType,\n            depVersion,\n            fixedVersion,\n            datasource: dep.datasource!,\n            packageFileConfig,\n          });\n        }\n      }\n\n      return { vulnerabilities, versioningApi };\n    } catch (err) {\n      logger.warn(\n        { err, packageName },\n        'Error fetching vulnerability information for package',\n      );\n      return null;\n    }\n  }\n\n  private skipMaliciousPackages(\n    ecosystem: Ecosystem,\n    osvPackageName: string,\n    depVersion: string,\n    versioningApi: VersioningApi,\n    dep: PackageDependency,\n    manager: string | undefined,\n    packageFile: string,\n    osvVulnerability: Osv.Vulnerability,\n  ): void {\n    // the OpenSSF's Malicious Packages (https://github.com/ossf/malicious-packages) is a source of advisories through osv.dev, which takes various sources of advisories, and will re-publish them with more specific information about their malicious usage\n    if (osvVulnerability.id.startsWith('MAL-')) {\n      // is the current dependency vulnerable?\n      for (const affected of coerceArray(osvVulnerability.affected)) {\n        // is the current dependency vulnerable?\n        const isVulnerable = this.isPackageVulnerable(\n          ecosystem,\n          osvPackageName,\n          depVersion,\n          affected,\n          versioningApi,\n        );\n\n        if (isVulnerable) {\n          logger.debug(\n            {\n              packageFile: packageFile,\n              depName: dep.depName,\n              packageName: dep.packageName,\n              manager: manager,\n              datasource: dep.datasource,\n              currentVersion: depVersion,\n            },\n            `Marking ${dep.depName} as skipReason=malicious-version-in-use, as it is affected by ${osvVulnerability.id}`,\n          );\n          dep.skipReason = 'malicious-version-in-use';\n          dep.skipStage = 'lookup';\n        }\n\n        // or are any of the updates vulnerable?\n        for (const update of coerceArray(dep.updates)) {\n          const newVersion = update.newVersion ?? update.newValue!;\n\n          const isUpdateVulnerable = this.isPackageVulnerable(\n            ecosystem,\n            osvPackageName,\n            newVersion,\n            affected,\n            versioningApi,\n          );\n\n          if (isUpdateVulnerable) {\n            logger.debug(\n              {\n                packageFile: packageFile,\n                depName: dep.depName,\n                packageName: dep.packageName,\n                manager: manager,\n                datasource: dep.datasource,\n                currentVersion: depVersion,\n                newVersion,\n              },\n              `Marking ${dep.depName}'s update to ${newVersion} as skipReason=malicious-update-proposed, as it is affected by ${osvVulnerability.id}`,\n            );\n            dep.skipReason = 'malicious-update-proposed';\n            dep.skipStage = 'lookup';\n          }\n        }\n      }\n    }\n  }\n\n  private sortByFixedVersion(\n    packageRules: PackageRule[],\n    versioningApi: VersioningApi,\n  ): void {\n    const versionsCleaned: Record<string, string> = {};\n    for (const rule of packageRules) {\n      const version = rule.allowedVersions!;\n      versionsCleaned[version] = version.replace(regEx(/[(),=> ]+/g), '');\n    }\n    packageRules.sort((a, b) =>\n      versioningApi.sortVersions(\n        versionsCleaned[a.allowedVersions!],\n        versionsCleaned[b.allowedVersions!],\n      ),\n    );\n  }\n\n  // https://ossf.github.io/osv-schema/#affectedrangesevents-fields\n  private sortEvents(\n    events: Osv.Event[],\n    versioningApi: VersioningApi,\n  ): Osv.Event[] {\n    const sortedCopy: Osv.Event[] = [];\n    let zeroEvent: Osv.Event | null = null;\n\n    for (const event of events) {\n      if (event.introduced === '0') {\n        zeroEvent = event;\n      } else if (versioningApi.isVersion(Object.values(event)[0])) {\n        sortedCopy.push(event);\n      } else {\n        logger.debug({ event }, 'Skipping OSV event with invalid version');\n      }\n    }\n\n    sortedCopy.sort((a, b) =>\n      // no pre-processing, as there are only very few values to sort\n      versioningApi.sortVersions(Object.values(a)[0], Object.values(b)[0]),\n    );\n\n    if (zeroEvent) {\n      sortedCopy.unshift(zeroEvent);\n    }\n\n    return sortedCopy;\n  }\n\n  private isPackageAffected(\n    ecosystem: Ecosystem,\n    osvPackageName: string,\n    affected: Osv.Affected,\n  ): boolean {\n    const pkg = affected.package;\n    if (pkg?.name !== osvPackageName) {\n      return false;\n    }\n\n    // Match exact ecosystems and OSV sub-ecosystems (e.g. Packagist:https://packages.drupal.org/8).\n    return (\n      pkg.ecosystem === ecosystem || pkg.ecosystem.startsWith(`${ecosystem}:`)\n    );\n  }\n\n  private includedInVersions(\n    depVersion: string,\n    affected: Osv.Affected,\n  ): boolean {\n    return !!affected.versions?.includes(depVersion);\n  }\n\n  private includedInRanges(\n    depVersion: string,\n    affected: Osv.Affected,\n    versioningApi: VersioningApi,\n  ): boolean {\n    for (const range of coerceArray(affected.ranges)) {\n      if (range.type === 'GIT') {\n        continue;\n      }\n\n      let vulnerable = false;\n      for (const event of this.sortEvents(range.events, versioningApi)) {\n        if (\n          isNonEmptyString(event.introduced) &&\n          (event.introduced === '0' ||\n            this.isVersionGtOrEq(depVersion, event.introduced, versioningApi))\n        ) {\n          vulnerable = true;\n        } else if (\n          isNonEmptyString(event.fixed) &&\n          this.isVersionGtOrEq(depVersion, event.fixed, versioningApi)\n        ) {\n          vulnerable = false;\n        } else if (\n          isNonEmptyString(event.last_affected) &&\n          this.isVersionGt(depVersion, event.last_affected, versioningApi)\n        ) {\n          vulnerable = false;\n        }\n      }\n\n      if (vulnerable) {\n        return true;\n      }\n    }\n\n    return false;\n  }\n\n  // https://ossf.github.io/osv-schema/#evaluation\n  private isPackageVulnerable(\n    ecosystem: Ecosystem,\n    osvPackageName: string,\n    depVersion: string,\n    affected: Osv.Affected,\n    versioningApi: VersioningApi,\n  ): boolean {\n    return (\n      this.isPackageAffected(ecosystem, osvPackageName, affected) &&\n      (this.includedInVersions(depVersion, affected) ||\n        this.includedInRanges(depVersion, affected, versioningApi))\n    );\n  }\n\n  private getFixedVersion(\n    ecosystem: Ecosystem,\n    depVersion: string,\n    affected: Osv.Affected,\n    versioningApi: VersioningApi,\n  ): string | null {\n    const fixedVersions: string[] = [];\n    const lastAffectedVersions: string[] = [];\n\n    for (const range of coerceArray(affected.ranges)) {\n      if (range.type === 'GIT') {\n        continue;\n      }\n\n      for (const event of range.events) {\n        if (\n          isNonEmptyString(event.fixed) &&\n          versioningApi.isVersion(event.fixed)\n        ) {\n          fixedVersions.push(event.fixed);\n        } else if (\n          isNonEmptyString(event.last_affected) &&\n          versioningApi.isVersion(event.last_affected)\n        ) {\n          lastAffectedVersions.push(event.last_affected);\n        }\n      }\n    }\n\n    fixedVersions.sort((a, b) => versioningApi.sortVersions(a, b));\n    const fixedVersion = fixedVersions.find((version) =>\n      this.isVersionGt(version, depVersion, versioningApi),\n    );\n    if (fixedVersion) {\n      return this.getFixedVersionByEcosystem(fixedVersion, ecosystem);\n    }\n\n    lastAffectedVersions.sort((a, b) => versioningApi.sortVersions(a, b));\n    const lastAffected = lastAffectedVersions.find((version) =>\n      this.isVersionGtOrEq(version, depVersion, versioningApi),\n    );\n    if (lastAffected) {\n      return this.getLastAffectedByEcosystem(lastAffected, ecosystem);\n    }\n\n    return null;\n  }\n\n  private getFixedVersionByEcosystem(\n    fixedVersion: string,\n    ecosystem: Ecosystem,\n  ): string {\n    return getFixedVersionConstraint(fixedVersion, ecosystem);\n  }\n\n  private getLastAffectedByEcosystem(\n    lastAffected: string,\n    ecosystem: Ecosystem,\n  ): string {\n    return getLastAffectedVersionConstraint(lastAffected, ecosystem);\n  }\n\n  private isVersionGt(\n    version: string,\n    other: string,\n    versioningApi: VersioningApi,\n  ): boolean {\n    return (\n      versioningApi.isVersion(version) &&\n      versioningApi.isVersion(other) &&\n      versioningApi.isGreaterThan(version, other)\n    );\n  }\n\n  private isVersionGtOrEq(\n    version: string,\n    other: string,\n    versioningApi: VersioningApi,\n  ): boolean {\n    return (\n      versioningApi.isVersion(version) &&\n      versioningApi.isVersion(other) &&\n      (versioningApi.equals(version, other) ||\n        versioningApi.isGreaterThan(version, other))\n    );\n  }\n\n  private vulnerabilityToPackageRules(vul: Vulnerability): PackageRule | null {\n    const {\n      vulnerability,\n      affected,\n      packageName,\n      depType,\n      depVersion,\n      fixedVersion,\n      datasource,\n      packageFileConfig,\n    } = vul;\n    if (isNullOrUndefined(fixedVersion)) {\n      logger.debug(\n        `No fixed version available for vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`,\n      );\n      return null;\n    }\n\n    // we don't know if the dependency has a `versioning` applied to it already, so we have to use the default for the datasource\n    const versioning = getDefaultVersioning(datasource);\n\n    logger.debug(\n      {\n        datasource,\n        versioning,\n      },\n\n      `Setting allowed version ${fixedVersion} to fix vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`,\n    );\n\n    const severityDetails = this.extractSeverityDetails(\n      vulnerability,\n      affected,\n    );\n\n    return {\n      matchDatasources: [datasource],\n      matchPackageNames: [packageName],\n      ...(depType ? { matchDepTypes: [depType] } : {}),\n      matchCurrentVersion: depVersion,\n      versioning,\n      allowedVersions: fixedVersion,\n      isVulnerabilityAlert: true,\n      vulnerabilitySeverity: severityDetails.severityLevel,\n      prBodyNotes: this.generatePrBodyNotes(vulnerability, affected),\n      force: {\n        ...packageFileConfig.vulnerabilityAlerts,\n      },\n    };\n  }\n\n  static evaluateCvssVector(vector: string): [string, string] {\n    const CvssJson = z.object({\n      baseScore: z.number().default(0.0),\n      baseSeverity: z.string().toUpperCase().default('UNKNOWN'),\n    });\n\n    try {\n      const parsedCvssScore: CvssVector<any> | null = fromVector(vector);\n      const res = CvssJson.parse(parsedCvssScore?.createJsonSchema());\n\n      return [res.baseScore.toFixed(1), res.baseSeverity];\n    } catch {\n      logger.debug(`Error processing CVSS vector ${vector}`);\n    }\n\n    return ['', ''];\n  }\n\n  private generatePrBodyNotes(\n    vulnerability: Osv.Vulnerability,\n    affected: Osv.Affected,\n  ): string[] {\n    let aliases = [vulnerability.id]\n      .concat(coerceArray(vulnerability.aliases))\n      .sort();\n    aliases = aliases.map((id) => {\n      if (id.startsWith('CVE-')) {\n        return `[${id}](https://nvd.nist.gov/vuln/detail/${id})`;\n      }\n      if (id.startsWith('GHSA-')) {\n        return `[${id}](https://github.com/advisories/${id})`;\n      }\n      if (id.startsWith('GO-')) {\n        return `[${id}](https://pkg.go.dev/vuln/${id})`;\n      }\n      if (id.startsWith('RUSTSEC-')) {\n        return `[${id}](https://rustsec.org/advisories/${id}.html)`;\n      }\n\n      return id;\n    });\n\n    let content = '\\n\\n---\\n\\n### ';\n    content += vulnerability.summary ? `${vulnerability.summary}\\n` : '';\n    content += `${aliases.join(' / ')}\\n`;\n    content += `\\n<details>\\n<summary>More information</summary>\\n`;\n\n    const details = vulnerability.details?.replace(\n      regEx(/^#{1,4} /gm),\n      '##### ',\n    );\n    content += `#### Details\\n${details ?? 'No details.'}\\n`;\n\n    content += '#### Severity\\n';\n    const severityDetails = this.extractSeverityDetails(\n      vulnerability,\n      affected,\n    );\n\n    if (severityDetails.cvssVector) {\n      content += `- CVSS Score: ${severityDetails.score}\\n`;\n      content += `- Vector String: \\`${severityDetails.cvssVector}\\`\\n`;\n    } else {\n      content += `${titleCase(severityDetails.severityLevel)}\\n`;\n    }\n\n    content += `\\n#### References\\n${\n      vulnerability.references\n        ?.map((ref) => {\n          return `- [${ref.url}](${ref.url})`;\n        })\n        .join('\\n') ?? 'No references.'\n    }`;\n\n    let attribution = '';\n    if (vulnerability.id.startsWith('GHSA-')) {\n      attribution = ` and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md))`;\n    } else if (vulnerability.id.startsWith('GO-')) {\n      attribution = ` and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license))`;\n    } else if (vulnerability.id.startsWith('PYSEC-')) {\n      attribution = ` and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE))`;\n    } else if (vulnerability.id.startsWith('RUSTSEC-')) {\n      attribution = ` and the [Rust Advisory Database](https://github.com/RustSec/advisory-db) ([CC0 1.0](https://github.com/rustsec/advisory-db/blob/main/LICENSE.txt))`;\n    }\n    content += `\\n\\nThis data is provided by [OSV](https://osv.dev/vulnerability/${vulnerability.id})${attribution}.\\n`;\n    content += `</details>`;\n\n    return [sanitizeMarkdown(content)];\n  }\n\n  private extractSeverityDetails(\n    vulnerability: Osv.Vulnerability,\n    affected: Osv.Affected,\n  ): SeverityDetails {\n    let severityLevel = 'UNKNOWN';\n    let score = 'Unknown';\n\n    const cvssVector =\n      vulnerability.severity?.find((e) => e.type === 'CVSS_V4')?.score ??\n      vulnerability.severity?.find((e) => e.type === 'CVSS_V3')?.score ??\n      (affected.database_specific?.cvss as string); // RUSTSEC\n\n    if (cvssVector) {\n      const [baseScore, severity] =\n        Vulnerabilities.evaluateCvssVector(cvssVector);\n      severityLevel = severity ? severity.toUpperCase() : 'UNKNOWN';\n      score = baseScore\n        ? `${baseScore} / 10 (${titleCase(severityLevel)})`\n        : 'Unknown';\n    } else if (\n      vulnerability.id.startsWith('GHSA-') &&\n      vulnerability.database_specific?.severity\n    ) {\n      const severity = vulnerability.database_specific.severity as string;\n      severityLevel = severity.toUpperCase();\n    }\n\n    return {\n      cvssVector,\n      score,\n      severityLevel,\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAuCA,MAAM,EAAE,eAAgB,QACrB;AAEH,IAAa,kBAAb,MAAa,gBAAgB;CAC3B,OAAe;CAEf;CAEA,OAAwB,yBAAyB;CAEjD,YAAoB,YAAwB;EAC1C,KAAK,aAAa;CACpB;CAEA,OAAe,aAAkC;EAE/C,gBAAgB,eAAe,WAAW,OAAO;EACjD,OAAO,gBAAgB;CACzB;CAEA,aAAa,SAAmC;EAE9C,MAAM,aAAa,MAAM,gBAAgB,WAAW;EAGpD,OAAO,IADc,gBAAgB,UACvB;CAChB;CAEA,MAAM,gCACJ,QACA,cACe;EACf,MAAM,4BAA4B,MAAM,KAAK,+BAC3C,QACA,YACF;EAEA,OAAO,iBAAiB,CAAC;EACzB,KAAK,MAAM,EACT,iBACA,mBACG,2BAA2B;GAC9B,MAAM,oBAAmC,CAAC;GAC1C,KAAK,MAAM,iBAAiB,iBAAiB;IAC3C,MAAM,OAAO,KAAK,4BAA4B,aAAa;IAC3D,IAAI,kBAAkB,IAAI,GACxB;IAEF,kBAAkB,KAAK,IAAI;GAC7B;GACA,KAAK,mBAAmB,mBAAmB,aAAa;GAExD,OAAO,aAAa,KAAK,GAAG,iBAAiB;EAC/C;CACF;CAEA,MAAM,qBACJ,QACA,cAC0B;EAK1B,QAAO,MAJc,KAAK,+BACxB,QACA,YACF,EAAA,CACc,SAAS,UAAU,MAAM,eAAe;CACxD;CAEA,MAAc,+BACZ,QACA,cACsC;EAEtC,MAAM,iBADW,OAAO,KAAK,YACC,CAAC,CAAC,KAAK,YACnC,KAAK,4BAA4B,QAAQ,cAAc,OAAO,CAChE;EACA,QAAQ,MAAM,QAAQ,IAAI,cAAc,EAAA,CAAG,KAAK;CAClD;CAEA,MAAc,4BACZ,QACA,cACA,SACsC;EACtC,MAAM,gBAAgB,iBAAiB,QAAQ,OAAO;EACtD,MAAM,QAAQ,aAAa,QAAQ,CAAC,KACjC,gBACC,KAAK,uCAAuC,eAAe,KAAK,CACpE;EACA,OAAO,MACL;GAAE;GAAS,aAAa,MAAM;EAAO,GACrC,sCACF;EACA,MAAM,UAAU,MAAMA,IAAM,KAAK,EAAA,CAAG,KAAK;EACzC,OAAO,MAAM,EAAE,QAAQ,GAAG,sCAAsC;EAChE,OAAO;CACT;CAEA,MAAc,uCACZ,eACA,OACsC;EACtC,MAAM,EAAE,gBAAgB;EACxB,MAAM,oBAAoB,iBAAiB,eAAe,KAAK;EAC/D,MAAM,EAAE,YAAY;EACpB,MAAM,QAAQ,MAAM,KAAK,KACtB,cACC,KAAK,6BAA6B,mBAAmB,GAAG,CAC5D;EACA,OAAO,MACL;GAAE;GAAS;GAAa,aAAa,MAAM;EAAO,GAClD,kEACF;EAEA,MAAM,SAAS,MAAMA,IAAM,KAAK;EAChC,OAAO,MACL,EAAE,YAAY,GACd,iDACF;EAEA,OAAO,OAAO,OAAO,QAAQ;CAC/B;CAEA,MAAc,6BACZ,mBACA,KAC2C;EAC3C,MAAM,YAAY,gBAAgB,uBAAuB,IAAI;EAC7D,IAAI,CAAC,WAAW;GACd,OAAO,MAAM,yBAAyB,IAAI,WAAY,kBAAkB;GACxE,OAAO;EACT;EAEA,MAAM,cAAc,IAAI;EACxB,IAAI,iBAAiB;EACrB,IAAI;EACJ,IAAI,cAAc,QAEhB,iBAAiB,eACd,YAAY,CAAC,CACb,QAAQ,MAAM,SAAS,GAAG,GAAG;OAC3B,IAAI,cAAc,QAAQ,gBAAgB,MAAM;GACrD,IAAI,IAAI,YAAY,aAElB,OAAO;GAET,iBAAiB;GACjB,UAAU,IAAI;EAChB;EAEA,IAAI;GACF,MAAM,qBAAqB,MAAM,WAC/B,iCACM,KAAK,WAAW,mBAAmB,WAAW,cAAc,GAClE,EACE,YAAY;IACV;IACA;GACF,EACF,CACF;GACA,IACE,kBAAkB,kBAAkB,KACpC,aAAa,kBAAkB,GAC/B;IACA,OAAO,MACL,gDAAgD,aAClD;IACA,OAAO;GACT;GAEA,MAAM,aACJ,IAAI,iBAAiB,IAAI,kBAAkB,IAAI;GAEjD,MAAM,aAAa,IAAI,cAAc,qBAAqB,IAAI,UAAU;GACxE,MAAM,gBAAgBC,IAAc,UAAU;GAE9C,IAAI,CAAC,cAAc,UAAU,UAAU,GAAG;IACxC,OAAO,MACL,6CAA6C,YAAY,8BAA8B,YACzF;IACA,OAAO;GACT;GAEA,MAAM,kBAAmC,CAAC;GAC1C,KAAK,MAAM,oBAAoB,oBAAoB;IACjD,IAAI,iBAAiB,WAAW;KAC9B,OAAO,MACL,oCAAoC,iBAAiB,IACvD;KACA;IACF;IAEA,KAAK,sBACH,WACA,gBACA,YACA,eACA,KACA,kBAAkB,SAClB,kBAAkB,aAClB,gBACF;IAEA,KAAK,MAAM,YAAY,YAAY,iBAAiB,QAAQ,GAAG;KAQ7D,IAAI,CAPiB,KAAK,oBACxB,WACA,gBACA,YACA,UACA,aAEc,GACd;KAGF,OAAO,MACL,iBAAiB,iBAAiB,GAAG,WAAW,YAAY,GAAG,YACjE;KACA,MAAM,eAAe,KAAK,gBACxB,WACA,YACA,UACA,aACF;KAEA,gBAAgB,KAAK;MACnB;MACA;MACA,eAAe;MACf;MACA;MACA;MACA;MACA,YAAY,IAAI;MAChB;KACF,CAAC;IACH;GACF;GAEA,OAAO;IAAE;IAAiB;GAAc;EAC1C,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK;GAAY,GACnB,sDACF;GACA,OAAO;EACT;CACF;CAEA,sBACE,WACA,gBACA,YACA,eACA,KACA,SACA,aACA,kBACM;EAEN,IAAI,iBAAiB,GAAG,WAAW,MAAM,GAEvC,KAAK,MAAM,YAAY,YAAY,iBAAiB,QAAQ,GAAG;GAU7D,IARqB,KAAK,oBACxB,WACA,gBACA,YACA,UACA,aAGa,GAAG;IAChB,OAAO,MACL;KACe;KACb,SAAS,IAAI;KACb,aAAa,IAAI;KACR;KACT,YAAY,IAAI;KAChB,gBAAgB;IAClB,GACA,WAAW,IAAI,QAAQ,gEAAgE,iBAAiB,IAC1G;IACA,IAAI,aAAa;IACjB,IAAI,YAAY;GAClB;GAGA,KAAK,MAAM,UAAU,YAAY,IAAI,OAAO,GAAG;IAC7C,MAAM,aAAa,OAAO,cAAc,OAAO;IAU/C,IAR2B,KAAK,oBAC9B,WACA,gBACA,YACA,UACA,aAGmB,GAAG;KACtB,OAAO,MACL;MACe;MACb,SAAS,IAAI;MACb,aAAa,IAAI;MACR;MACT,YAAY,IAAI;MAChB,gBAAgB;MAChB;KACF,GACA,WAAW,IAAI,QAAQ,eAAe,WAAW,iEAAiE,iBAAiB,IACrI;KACA,IAAI,aAAa;KACjB,IAAI,YAAY;IAClB;GACF;EACF;CAEJ;CAEA,mBACE,cACA,eACM;EACN,MAAM,kBAA0C,CAAC;EACjD,KAAK,MAAM,QAAQ,cAAc;GAC/B,MAAM,UAAU,KAAK;GACrB,gBAAgB,WAAW,QAAQ,QAAQ,MAAM,YAAY,GAAG,EAAE;EACpE;EACA,aAAa,MAAM,GAAG,MACpB,cAAc,aACZ,gBAAgB,EAAE,kBAClB,gBAAgB,EAAE,gBACpB,CACF;CACF;CAGA,WACE,QACA,eACa;EACb,MAAM,aAA0B,CAAC;EACjC,IAAI,YAA8B;EAElC,KAAK,MAAM,SAAS,QAClB,IAAI,MAAM,eAAe,KACvB,YAAY;OACP,IAAI,cAAc,UAAU,OAAO,OAAO,KAAK,CAAC,CAAC,EAAE,GACxD,WAAW,KAAK,KAAK;OAErB,OAAO,MAAM,EAAE,MAAM,GAAG,yCAAyC;EAIrE,WAAW,MAAM,GAAG,MAElB,cAAc,aAAa,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CACrE;EAEA,IAAI,WACF,WAAW,QAAQ,SAAS;EAG9B,OAAO;CACT;CAEA,kBACE,WACA,gBACA,UACS;EACT,MAAM,MAAM,SAAS;EACrB,IAAI,KAAK,SAAS,gBAChB,OAAO;EAIT,OACE,IAAI,cAAc,aAAa,IAAI,UAAU,WAAW,GAAG,UAAU,EAAE;CAE3E;CAEA,mBACE,YACA,UACS;EACT,OAAO,CAAC,CAAC,SAAS,UAAU,SAAS,UAAU;CACjD;CAEA,iBACE,YACA,UACA,eACS;EACT,KAAK,MAAM,SAAS,YAAY,SAAS,MAAM,GAAG;GAChD,IAAI,MAAM,SAAS,OACjB;GAGF,IAAI,aAAa;GACjB,KAAK,MAAM,SAAS,KAAK,WAAW,MAAM,QAAQ,aAAa,GAC7D,IACE,iBAAiB,MAAM,UAAU,MAChC,MAAM,eAAe,OACpB,KAAK,gBAAgB,YAAY,MAAM,YAAY,aAAa,IAElE,aAAa;QACR,IACL,iBAAiB,MAAM,KAAK,KAC5B,KAAK,gBAAgB,YAAY,MAAM,OAAO,aAAa,GAE3D,aAAa;QACR,IACL,iBAAiB,MAAM,aAAa,KACpC,KAAK,YAAY,YAAY,MAAM,eAAe,aAAa,GAE/D,aAAa;GAIjB,IAAI,YACF,OAAO;EAEX;EAEA,OAAO;CACT;CAGA,oBACE,WACA,gBACA,YACA,UACA,eACS;EACT,OACE,KAAK,kBAAkB,WAAW,gBAAgB,QAAQ,MACzD,KAAK,mBAAmB,YAAY,QAAQ,KAC3C,KAAK,iBAAiB,YAAY,UAAU,aAAa;CAE/D;CAEA,gBACE,WACA,YACA,UACA,eACe;EACf,MAAM,gBAA0B,CAAC;EACjC,MAAM,uBAAiC,CAAC;EAExC,KAAK,MAAM,SAAS,YAAY,SAAS,MAAM,GAAG;GAChD,IAAI,MAAM,SAAS,OACjB;GAGF,KAAK,MAAM,SAAS,MAAM,QACxB,IACE,iBAAiB,MAAM,KAAK,KAC5B,cAAc,UAAU,MAAM,KAAK,GAEnC,cAAc,KAAK,MAAM,KAAK;QACzB,IACL,iBAAiB,MAAM,aAAa,KACpC,cAAc,UAAU,MAAM,aAAa,GAE3C,qBAAqB,KAAK,MAAM,aAAa;EAGnD;EAEA,cAAc,MAAM,GAAG,MAAM,cAAc,aAAa,GAAG,CAAC,CAAC;EAC7D,MAAM,eAAe,cAAc,MAAM,YACvC,KAAK,YAAY,SAAS,YAAY,aAAa,CACrD;EACA,IAAI,cACF,OAAO,KAAK,2BAA2B,cAAc,SAAS;EAGhE,qBAAqB,MAAM,GAAG,MAAM,cAAc,aAAa,GAAG,CAAC,CAAC;EACpE,MAAM,eAAe,qBAAqB,MAAM,YAC9C,KAAK,gBAAgB,SAAS,YAAY,aAAa,CACzD;EACA,IAAI,cACF,OAAO,KAAK,2BAA2B,cAAc,SAAS;EAGhE,OAAO;CACT;CAEA,2BACE,cACA,WACQ;EACR,OAAO,0BAA0B,cAAc,SAAS;CAC1D;CAEA,2BACE,cACA,WACQ;EACR,OAAO,iCAAiC,cAAc,SAAS;CACjE;CAEA,YACE,SACA,OACA,eACS;EACT,OACE,cAAc,UAAU,OAAO,KAC/B,cAAc,UAAU,KAAK,KAC7B,cAAc,cAAc,SAAS,KAAK;CAE9C;CAEA,gBACE,SACA,OACA,eACS;EACT,OACE,cAAc,UAAU,OAAO,KAC/B,cAAc,UAAU,KAAK,MAC5B,cAAc,OAAO,SAAS,KAAK,KAClC,cAAc,cAAc,SAAS,KAAK;CAEhD;CAEA,4BAAoC,KAAwC;EAC1E,MAAM,EACJ,eACA,UACA,aACA,SACA,YACA,cACA,YACA,sBACE;EACJ,IAAI,kBAAkB,YAAY,GAAG;GACnC,OAAO,MACL,gDAAgD,cAAc,GAAG,MAAM,YAAY,GAAG,YACxF;GACA,OAAO;EACT;EAGA,MAAM,aAAa,qBAAqB,UAAU;EAElD,OAAO,MACL;GACE;GACA;EACF,GAEA,2BAA2B,aAAa,wBAAwB,cAAc,GAAG,MAAM,YAAY,GAAG,YACxG;EAEA,MAAM,kBAAkB,KAAK,uBAC3B,eACA,QACF;EAEA,OAAO;GACL,kBAAkB,CAAC,UAAU;GAC7B,mBAAmB,CAAC,WAAW;GAC/B,GAAI,UAAU,EAAE,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC;GAC9C,qBAAqB;GACrB;GACA,iBAAiB;GACjB,sBAAsB;GACtB,uBAAuB,gBAAgB;GACvC,aAAa,KAAK,oBAAoB,eAAe,QAAQ;GAC7D,OAAO,EACL,GAAG,kBAAkB,oBACvB;EACF;CACF;CAEA,OAAO,mBAAmB,QAAkC;EAC1D,MAAM,WAAW,EAAE,OAAO;GACxB,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAG;GACjC,cAAc,EAAE,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,SAAS;EAC1D,CAAC;EAED,IAAI;GACF,MAAM,kBAA0C,WAAW,MAAM;GACjE,MAAM,MAAM,SAAS,MAAM,iBAAiB,iBAAiB,CAAC;GAE9D,OAAO,CAAC,IAAI,UAAU,QAAQ,CAAC,GAAG,IAAI,YAAY;EACpD,QAAQ;GACN,OAAO,MAAM,gCAAgC,QAAQ;EACvD;EAEA,OAAO,CAAC,IAAI,EAAE;CAChB;CAEA,oBACE,eACA,UACU;EACV,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC,CAC7B,OAAO,YAAY,cAAc,OAAO,CAAC,CAAC,CAC1C,KAAK;EACR,UAAU,QAAQ,KAAK,OAAO;GAC5B,IAAI,GAAG,WAAW,MAAM,GACtB,OAAO,IAAI,GAAG,qCAAqC,GAAG;GAExD,IAAI,GAAG,WAAW,OAAO,GACvB,OAAO,IAAI,GAAG,kCAAkC,GAAG;GAErD,IAAI,GAAG,WAAW,KAAK,GACrB,OAAO,IAAI,GAAG,4BAA4B,GAAG;GAE/C,IAAI,GAAG,WAAW,UAAU,GAC1B,OAAO,IAAI,GAAG,mCAAmC,GAAG;GAGtD,OAAO;EACT,CAAC;EAED,IAAI,UAAU;EACd,WAAW,cAAc,UAAU,GAAG,cAAc,QAAQ,MAAM;EAClE,WAAW,GAAG,QAAQ,KAAK,KAAK,EAAE;EAClC,WAAW;EAEX,MAAM,UAAU,cAAc,SAAS,QACrC,MAAM,YAAY,GAClB,QACF;EACA,WAAW,iBAAiB,WAAW,cAAc;EAErD,WAAW;EACX,MAAM,kBAAkB,KAAK,uBAC3B,eACA,QACF;EAEA,IAAI,gBAAgB,YAAY;GAC9B,WAAW,iBAAiB,gBAAgB,MAAM;GAClD,WAAW,sBAAsB,gBAAgB,WAAW;EAC9D,OACE,WAAW,GAAG,UAAU,gBAAgB,aAAa,EAAE;EAGzD,WAAW,sBACT,cAAc,YACV,KAAK,QAAQ;GACb,OAAO,MAAM,IAAI,IAAI,IAAI,IAAI,IAAI;EACnC,CAAC,CAAC,CACD,KAAK,IAAI,KAAK;EAGnB,IAAI,cAAc;EAClB,IAAI,cAAc,GAAG,WAAW,OAAO,GACrC,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,KAAK,GAC1C,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,QAAQ,GAC7C,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,UAAU,GAC/C,cAAc;EAEhB,WAAW,oEAAoE,cAAc,GAAG,GAAG,YAAY;EAC/G,WAAW;EAEX,OAAO,CAAC,iBAAiB,OAAO,CAAC;CACnC;CAEA,uBACE,eACA,UACiB;EACjB,IAAI,gBAAgB;EACpB,IAAI,QAAQ;EAEZ,MAAM,aACJ,cAAc,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,SAC3D,cAAc,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,SAC1D,SAAS,mBAAmB;EAE/B,IAAI,YAAY;GACd,MAAM,CAAC,WAAW,YAChB,gBAAgB,mBAAmB,UAAU;GAC/C,gBAAgB,WAAW,SAAS,YAAY,IAAI;GACpD,QAAQ,YACJ,GAAG,UAAU,SAAS,UAAU,aAAa,EAAE,KAC/C;EACN,OAAO,IACL,cAAc,GAAG,WAAW,OAAO,KACnC,cAAc,mBAAmB,UAGjC,gBADiB,cAAc,kBAAkB,SACxB,YAAY;EAGvC,OAAO;GACL;GACA;GACA;EACF;CACF;AACF"}
+{"version":3,"file":"vulnerabilities.js","names":["p.all","getVersioning"],"sources":["../../../../lib/workers/repository/process/vulnerabilities.ts"],"sourcesContent":["// TODO #22198\nimport type { Ecosystem, Osv } from '@renovatebot/osv-offline';\nimport { OsvOffline } from '@renovatebot/osv-offline';\nimport {\n  isEmptyArray,\n  isNonEmptyString,\n  isNullOrUndefined,\n  isTruthy,\n} from '@sindresorhus/is';\nimport type { CvssVector } from 'ae-cvss-calculator';\nimport aeCvss from 'ae-cvss-calculator';\nimport { z } from 'zod/v4';\nimport { getManagerConfig, mergeChildConfig } from '../../../config/index.ts';\nimport type { PackageRule, RenovateConfig } from '../../../config/types.ts';\nimport { instrument } from '../../../instrumentation/index.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { getDefaultVersioning } from '../../../modules/datasource/common.ts';\nimport type {\n  PackageDependency,\n  PackageFile,\n} from '../../../modules/manager/types.ts';\nimport type { VersioningApi } from '../../../modules/versioning/index.ts';\nimport { get as getVersioning } from '../../../modules/versioning/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { sanitizeMarkdown } from '../../../util/markdown.ts';\nimport * as p from '../../../util/promises.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { titleCase } from '../../../util/string.ts';\nimport { datasourceToOsvEcosystem } from '../../../util/vulnerability/ecosystem.ts';\nimport {\n  getFixedVersionConstraint,\n  getLastAffectedVersionConstraint,\n} from '../../../util/vulnerability/utils.ts';\nimport type {\n  DependencyVulnerabilities,\n  SeverityDetails,\n  Vulnerability,\n} from './types.ts';\n\nconst { fromVector } = aeCvss;\n\nexport class Vulnerabilities {\n  private static osvOffline: Promise<OsvOffline> | undefined;\n\n  private osvOffline: OsvOffline;\n\n  private static readonly datasourceEcosystemMap = datasourceToOsvEcosystem;\n\n  private constructor(osvOffline: OsvOffline) {\n    this.osvOffline = osvOffline;\n  }\n\n  private static initialize(): Promise<OsvOffline> {\n    // no async here, so osv promise will only be created once\n    Vulnerabilities.osvOffline ??= OsvOffline.create();\n    return Vulnerabilities.osvOffline;\n  }\n\n  static async create(): Promise<Vulnerabilities> {\n    // intialize osv only once\n    const osvOffline = await Vulnerabilities.initialize();\n\n    const instance = new Vulnerabilities(osvOffline);\n    return instance;\n  }\n\n  async appendVulnerabilityPackageRules(\n    config: RenovateConfig,\n    packageFiles: Record<string, PackageFile[]>,\n  ): Promise<void> {\n    const dependencyVulnerabilities = await this.fetchDependencyVulnerabilities(\n      config,\n      packageFiles,\n    );\n\n    config.packageRules ??= [];\n    for (const {\n      vulnerabilities,\n      versioningApi,\n    } of dependencyVulnerabilities) {\n      const groupPackageRules: PackageRule[] = [];\n      for (const vulnerability of vulnerabilities) {\n        const rule = this.vulnerabilityToPackageRules(vulnerability);\n        if (isNullOrUndefined(rule)) {\n          continue;\n        }\n        groupPackageRules.push(rule);\n      }\n      this.sortByFixedVersion(groupPackageRules, versioningApi);\n\n      config.packageRules.push(...groupPackageRules);\n    }\n  }\n\n  async fetchVulnerabilities(\n    config: RenovateConfig,\n    packageFiles: Record<string, PackageFile[]>,\n  ): Promise<Vulnerability[]> {\n    const groups = await this.fetchDependencyVulnerabilities(\n      config,\n      packageFiles,\n    );\n    return groups.flatMap((group) => group.vulnerabilities);\n  }\n\n  private async fetchDependencyVulnerabilities(\n    config: RenovateConfig,\n    packageFiles: Record<string, PackageFile[]>,\n  ): Promise<DependencyVulnerabilities[]> {\n    const managers = Object.keys(packageFiles);\n    const allManagerJobs = managers.map((manager) =>\n      this.fetchManagerVulnerabilities(config, packageFiles, manager),\n    );\n    return (await Promise.all(allManagerJobs)).flat();\n  }\n\n  private async fetchManagerVulnerabilities(\n    config: RenovateConfig,\n    packageFiles: Record<string, PackageFile[]>,\n    manager: string,\n  ): Promise<DependencyVulnerabilities[]> {\n    const managerConfig = getManagerConfig(config, manager);\n    const queue = packageFiles[manager].map(\n      (pFile) => (): Promise<DependencyVulnerabilities[]> =>\n        this.fetchManagerPackageFileVulnerabilities(managerConfig, pFile),\n    );\n    logger.trace(\n      { manager, queueLength: queue.length },\n      'fetchManagerVulnerabilities starting',\n    );\n    const result = (await p.all(queue)).flat();\n    logger.trace({ manager }, 'fetchManagerVulnerabilities finished');\n    return result;\n  }\n\n  private async fetchManagerPackageFileVulnerabilities(\n    managerConfig: RenovateConfig,\n    pFile: PackageFile,\n  ): Promise<DependencyVulnerabilities[]> {\n    const { packageFile } = pFile;\n    const packageFileConfig = mergeChildConfig(managerConfig, pFile);\n    const { manager } = packageFileConfig;\n    const queue = pFile.deps.map(\n      (dep) => (): Promise<DependencyVulnerabilities | null> =>\n        this.fetchDependencyVulnerability(packageFileConfig, dep),\n    );\n    logger.trace(\n      { manager, packageFile, queueLength: queue.length },\n      'fetchManagerPackageFileVulnerabilities starting with concurrency',\n    );\n\n    const result = await p.all(queue);\n    logger.trace(\n      { packageFile },\n      'fetchManagerPackageFileVulnerabilities finished',\n    );\n\n    return result.filter(isTruthy);\n  }\n\n  private async fetchDependencyVulnerability(\n    packageFileConfig: RenovateConfig & PackageFile,\n    dep: PackageDependency,\n  ): Promise<DependencyVulnerabilities | null> {\n    const ecosystem = Vulnerabilities.datasourceEcosystemMap[dep.datasource!];\n    if (!ecosystem) {\n      logger.trace(`Cannot map datasource ${dep.datasource!} to OSV ecosystem`);\n      return null;\n    }\n\n    const packageName = dep.packageName!;\n    let osvPackageName = packageName;\n    let depType: string | undefined;\n    if (ecosystem === 'PyPI') {\n      // https://peps.python.org/pep-0503/#normalized-names\n      osvPackageName = osvPackageName\n        .toLowerCase()\n        .replace(regEx(/[_.-]+/g), '-');\n    } else if (ecosystem === 'Go' && packageName === 'go') {\n      if (dep.depType !== 'toolchain') {\n        // The `go` directive is source compatibility, not the build toolchain, so we skip it\n        return null;\n      }\n      osvPackageName = 'stdlib';\n      depType = dep.depType;\n    }\n\n    try {\n      const osvVulnerabilities = await instrument(\n        'get OSV vulnerabilities',\n        () => this.osvOffline.getVulnerabilities(ecosystem, osvPackageName),\n        {\n          attributes: {\n            osvPackageName,\n            ecosystem,\n          },\n        },\n      );\n      if (\n        isNullOrUndefined(osvVulnerabilities) ||\n        isEmptyArray(osvVulnerabilities)\n      ) {\n        logger.trace(\n          `No vulnerabilities found in OSV database for ${packageName}`,\n        );\n        return null;\n      }\n\n      const depVersion =\n        dep.lockedVersion ?? dep.currentVersion ?? dep.currentValue!;\n\n      const versioning = dep.versioning ?? getDefaultVersioning(dep.datasource);\n      const versioningApi = getVersioning(versioning);\n\n      if (!versioningApi.isVersion(depVersion)) {\n        logger.debug(\n          `Skipping vulnerability lookup for package ${packageName} due to unsupported version ${depVersion}`,\n        );\n        return null;\n      }\n\n      const vulnerabilities: Vulnerability[] = [];\n      for (const osvVulnerability of osvVulnerabilities) {\n        if (osvVulnerability.withdrawn) {\n          logger.trace(\n            `Skipping withdrawn vulnerability ${osvVulnerability.id}`,\n          );\n          continue;\n        }\n\n        this.skipMaliciousPackages(\n          ecosystem,\n          osvPackageName,\n          depVersion,\n          versioningApi,\n          dep,\n          packageFileConfig.manager,\n          packageFileConfig.packageFile,\n          osvVulnerability,\n        );\n\n        for (const affected of coerceArray(osvVulnerability.affected)) {\n          const isVulnerable = this.isPackageVulnerable(\n            ecosystem,\n            osvPackageName,\n            depVersion,\n            affected,\n            versioningApi,\n          );\n          if (!isVulnerable) {\n            continue;\n          }\n\n          logger.debug(\n            `Vulnerability ${osvVulnerability.id} affects ${packageName} ${depVersion}`,\n          );\n          const fixedVersion = this.getFixedVersion(\n            ecosystem,\n            depVersion,\n            affected,\n            versioningApi,\n          );\n\n          vulnerabilities.push({\n            packageName,\n            osvPackageName,\n            vulnerability: osvVulnerability,\n            affected,\n            depType,\n            depVersion,\n            fixedVersion,\n            datasource: dep.datasource!,\n            packageFileConfig,\n          });\n        }\n      }\n\n      return { vulnerabilities, versioningApi };\n    } catch (err) {\n      logger.warn(\n        { err, packageName },\n        'Error fetching vulnerability information for package',\n      );\n      return null;\n    }\n  }\n\n  private skipMaliciousPackages(\n    ecosystem: Ecosystem,\n    osvPackageName: string,\n    depVersion: string,\n    versioningApi: VersioningApi,\n    dep: PackageDependency,\n    manager: string | undefined,\n    packageFile: string,\n    osvVulnerability: Osv.Vulnerability,\n  ): void {\n    // the OpenSSF's Malicious Packages (https://github.com/ossf/malicious-packages) is a source of advisories through osv.dev, which takes various sources of advisories, and will re-publish them with more specific information about their malicious usage\n    if (osvVulnerability.id.startsWith('MAL-')) {\n      // is the current dependency vulnerable?\n      for (const affected of coerceArray(osvVulnerability.affected)) {\n        // is the current dependency vulnerable?\n        const isVulnerable = this.isPackageVulnerable(\n          ecosystem,\n          osvPackageName,\n          depVersion,\n          affected,\n          versioningApi,\n        );\n\n        if (isVulnerable) {\n          logger.debug(\n            {\n              packageFile: packageFile,\n              depName: dep.depName,\n              packageName: dep.packageName,\n              manager: manager,\n              datasource: dep.datasource,\n              currentVersion: depVersion,\n            },\n            `Marking ${dep.depName} as skipReason=malicious-version-in-use, as it is affected by ${osvVulnerability.id}`,\n          );\n          dep.skipReason = 'malicious-version-in-use';\n          dep.skipStage = 'lookup';\n        }\n\n        // or are any of the updates vulnerable?\n        for (const update of coerceArray(dep.updates)) {\n          const newVersion = update.newVersion ?? update.newValue!;\n\n          const isUpdateVulnerable = this.isPackageVulnerable(\n            ecosystem,\n            osvPackageName,\n            newVersion,\n            affected,\n            versioningApi,\n          );\n\n          if (isUpdateVulnerable) {\n            logger.debug(\n              {\n                packageFile: packageFile,\n                depName: dep.depName,\n                packageName: dep.packageName,\n                manager: manager,\n                datasource: dep.datasource,\n                currentVersion: depVersion,\n                newVersion,\n              },\n              `Marking ${dep.depName}'s update to ${newVersion} as skipReason=malicious-update-proposed, as it is affected by ${osvVulnerability.id}`,\n            );\n            dep.skipReason = 'malicious-update-proposed';\n            dep.skipStage = 'lookup';\n          }\n        }\n      }\n    }\n  }\n\n  private sortByFixedVersion(\n    packageRules: PackageRule[],\n    versioningApi: VersioningApi,\n  ): void {\n    const versionsCleaned: Record<string, string> = {};\n    for (const rule of packageRules) {\n      const version = rule.allowedVersions!;\n      versionsCleaned[version] = version.replace(regEx(/[(),=> ]+/g), '');\n    }\n    packageRules.sort((a, b) =>\n      versioningApi.sortVersions(\n        versionsCleaned[a.allowedVersions!],\n        versionsCleaned[b.allowedVersions!],\n      ),\n    );\n  }\n\n  // https://ossf.github.io/osv-schema/#affectedrangesevents-fields\n  private sortEvents(\n    events: Osv.Event[],\n    versioningApi: VersioningApi,\n  ): Osv.Event[] {\n    const sortedCopy: Osv.Event[] = [];\n    let zeroEvent: Osv.Event | null = null;\n\n    for (const event of events) {\n      if (event.introduced === '0') {\n        zeroEvent = event;\n      } else if (versioningApi.isVersion(Object.values(event)[0])) {\n        sortedCopy.push(event);\n      } else {\n        logger.debug({ event }, 'Skipping OSV event with invalid version');\n      }\n    }\n\n    sortedCopy.sort((a, b) =>\n      // no pre-processing, as there are only very few values to sort\n      versioningApi.sortVersions(Object.values(a)[0], Object.values(b)[0]),\n    );\n\n    if (zeroEvent) {\n      sortedCopy.unshift(zeroEvent);\n    }\n\n    return sortedCopy;\n  }\n\n  private isPackageAffected(\n    ecosystem: Ecosystem,\n    osvPackageName: string,\n    affected: Osv.Affected,\n  ): boolean {\n    const pkg = affected.package;\n    if (pkg?.name !== osvPackageName) {\n      return false;\n    }\n\n    // Match exact ecosystems and OSV sub-ecosystems (e.g. Packagist:https://packages.drupal.org/8).\n    return (\n      pkg.ecosystem === ecosystem || pkg.ecosystem.startsWith(`${ecosystem}:`)\n    );\n  }\n\n  private includedInVersions(\n    depVersion: string,\n    affected: Osv.Affected,\n  ): boolean {\n    return !!affected.versions?.includes(depVersion);\n  }\n\n  private includedInRanges(\n    depVersion: string,\n    affected: Osv.Affected,\n    versioningApi: VersioningApi,\n  ): boolean {\n    for (const range of coerceArray(affected.ranges)) {\n      if (range.type === 'GIT') {\n        continue;\n      }\n\n      let vulnerable = false;\n      for (const event of this.sortEvents(range.events, versioningApi)) {\n        if (\n          isNonEmptyString(event.introduced) &&\n          (event.introduced === '0' ||\n            this.isVersionGtOrEq(depVersion, event.introduced, versioningApi))\n        ) {\n          vulnerable = true;\n        } else if (\n          isNonEmptyString(event.fixed) &&\n          this.isVersionGtOrEq(depVersion, event.fixed, versioningApi)\n        ) {\n          vulnerable = false;\n        } else if (\n          isNonEmptyString(event.last_affected) &&\n          this.isVersionGt(depVersion, event.last_affected, versioningApi)\n        ) {\n          vulnerable = false;\n        }\n      }\n\n      if (vulnerable) {\n        return true;\n      }\n    }\n\n    return false;\n  }\n\n  // https://ossf.github.io/osv-schema/#evaluation\n  private isPackageVulnerable(\n    ecosystem: Ecosystem,\n    osvPackageName: string,\n    depVersion: string,\n    affected: Osv.Affected,\n    versioningApi: VersioningApi,\n  ): boolean {\n    return (\n      this.isPackageAffected(ecosystem, osvPackageName, affected) &&\n      (this.includedInVersions(depVersion, affected) ||\n        this.includedInRanges(depVersion, affected, versioningApi))\n    );\n  }\n\n  private getFixedVersion(\n    ecosystem: Ecosystem,\n    depVersion: string,\n    affected: Osv.Affected,\n    versioningApi: VersioningApi,\n  ): string | null {\n    const fixedVersions: string[] = [];\n    const lastAffectedVersions: string[] = [];\n\n    for (const range of coerceArray(affected.ranges)) {\n      if (range.type === 'GIT') {\n        continue;\n      }\n\n      for (const event of range.events) {\n        if (\n          isNonEmptyString(event.fixed) &&\n          versioningApi.isVersion(event.fixed)\n        ) {\n          fixedVersions.push(event.fixed);\n        } else if (\n          isNonEmptyString(event.last_affected) &&\n          versioningApi.isVersion(event.last_affected)\n        ) {\n          lastAffectedVersions.push(event.last_affected);\n        }\n      }\n    }\n\n    fixedVersions.sort((a, b) => versioningApi.sortVersions(a, b));\n    const fixedVersion = fixedVersions.find((version) =>\n      this.isVersionGt(version, depVersion, versioningApi),\n    );\n    if (fixedVersion) {\n      return this.getFixedVersionByEcosystem(fixedVersion, ecosystem);\n    }\n\n    lastAffectedVersions.sort((a, b) => versioningApi.sortVersions(a, b));\n    const lastAffected = lastAffectedVersions.find((version) =>\n      this.isVersionGtOrEq(version, depVersion, versioningApi),\n    );\n    if (lastAffected) {\n      return this.getLastAffectedByEcosystem(lastAffected, ecosystem);\n    }\n\n    return null;\n  }\n\n  private getFixedVersionByEcosystem(\n    fixedVersion: string,\n    ecosystem: Ecosystem,\n  ): string {\n    return getFixedVersionConstraint(fixedVersion, ecosystem);\n  }\n\n  private getLastAffectedByEcosystem(\n    lastAffected: string,\n    ecosystem: Ecosystem,\n  ): string {\n    return getLastAffectedVersionConstraint(lastAffected, ecosystem);\n  }\n\n  private isVersionGt(\n    version: string,\n    other: string,\n    versioningApi: VersioningApi,\n  ): boolean {\n    return (\n      versioningApi.isVersion(version) &&\n      versioningApi.isVersion(other) &&\n      versioningApi.isGreaterThan(version, other)\n    );\n  }\n\n  private isVersionGtOrEq(\n    version: string,\n    other: string,\n    versioningApi: VersioningApi,\n  ): boolean {\n    return (\n      versioningApi.isVersion(version) &&\n      versioningApi.isVersion(other) &&\n      (versioningApi.equals(version, other) ||\n        versioningApi.isGreaterThan(version, other))\n    );\n  }\n\n  private vulnerabilityToPackageRules(vul: Vulnerability): PackageRule | null {\n    const {\n      vulnerability,\n      affected,\n      packageName,\n      depType,\n      depVersion,\n      fixedVersion,\n      datasource,\n      packageFileConfig,\n    } = vul;\n    if (isNullOrUndefined(fixedVersion)) {\n      logger.debug(\n        `No fixed version available for vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`,\n      );\n      return null;\n    }\n\n    // we don't know if the dependency has a `versioning` applied to it already, so we have to use the default for the datasource\n    const versioning = getDefaultVersioning(datasource);\n\n    logger.debug(\n      {\n        datasource,\n        versioning,\n      },\n\n      `Setting allowed version ${fixedVersion} to fix vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`,\n    );\n\n    const severityDetails = this.extractSeverityDetails(\n      vulnerability,\n      affected,\n    );\n\n    return {\n      matchDatasources: [datasource],\n      matchPackageNames: [packageName],\n      ...(depType ? { matchDepTypes: [depType] } : {}),\n      matchCurrentVersion: depVersion,\n      versioning,\n      allowedVersions: fixedVersion,\n      isVulnerabilityAlert: true,\n      vulnerabilitySeverity: severityDetails.severityLevel,\n      prBodyNotes: this.generatePrBodyNotes(vulnerability, affected),\n      force: {\n        ...packageFileConfig.vulnerabilityAlerts,\n      },\n    };\n  }\n\n  static evaluateCvssVector(vector: string): [string, string] {\n    const CvssJson = z.object({\n      baseScore: z.number().default(0.0),\n      baseSeverity: z.string().toUpperCase().default('UNKNOWN'),\n    });\n\n    try {\n      const parsedCvssScore: CvssVector<any> | null = fromVector(vector);\n      const res = CvssJson.parse(parsedCvssScore?.createJsonSchema());\n\n      return [res.baseScore.toFixed(1), res.baseSeverity];\n    } catch {\n      logger.debug(`Error processing CVSS vector ${vector}`);\n    }\n\n    return ['', ''];\n  }\n\n  private generatePrBodyNotes(\n    vulnerability: Osv.Vulnerability,\n    affected: Osv.Affected,\n  ): string[] {\n    let aliases = [vulnerability.id]\n      .concat(coerceArray(vulnerability.aliases))\n      .sort();\n    aliases = aliases.map((id) => {\n      if (id.startsWith('CVE-')) {\n        return `[${id}](https://nvd.nist.gov/vuln/detail/${id})`;\n      }\n      if (id.startsWith('GHSA-')) {\n        return `[${id}](https://github.com/advisories/${id})`;\n      }\n      if (id.startsWith('GO-')) {\n        return `[${id}](https://pkg.go.dev/vuln/${id})`;\n      }\n      if (id.startsWith('RUSTSEC-')) {\n        return `[${id}](https://rustsec.org/advisories/${id}.html)`;\n      }\n\n      return id;\n    });\n\n    let content = '\\n\\n---\\n\\n### ';\n    content += vulnerability.summary ? `${vulnerability.summary}\\n` : '';\n    content += `${aliases.join(' / ')}\\n`;\n    content += `\\n<details>\\n<summary>More information</summary>\\n`;\n\n    const details = vulnerability.details?.replace(\n      regEx(/^#{1,4} /gm),\n      '##### ',\n    );\n    content += `#### Details\\n${details ?? 'No details.'}\\n`;\n\n    content += '#### Severity\\n';\n    const severityDetails = this.extractSeverityDetails(\n      vulnerability,\n      affected,\n    );\n\n    if (severityDetails.cvssVector) {\n      content += `- CVSS Score: ${severityDetails.score}\\n`;\n      content += `- Vector String: \\`${severityDetails.cvssVector}\\`\\n`;\n    } else {\n      content += `${titleCase(severityDetails.severityLevel)}\\n`;\n    }\n\n    content += `\\n#### References\\n${\n      vulnerability.references\n        ?.map((ref) => {\n          return `- [${ref.url}](${ref.url})`;\n        })\n        .join('\\n') ?? 'No references.'\n    }`;\n\n    let attribution = '';\n    if (vulnerability.id.startsWith('GHSA-')) {\n      attribution = ` and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md))`;\n    } else if (vulnerability.id.startsWith('GO-')) {\n      attribution = ` and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license))`;\n    } else if (vulnerability.id.startsWith('PYSEC-')) {\n      attribution = ` and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE))`;\n    } else if (vulnerability.id.startsWith('RUSTSEC-')) {\n      attribution = ` and the [Rust Advisory Database](https://github.com/RustSec/advisory-db) ([CC0 1.0](https://github.com/rustsec/advisory-db/blob/main/LICENSE.txt))`;\n    }\n    content += `\\n\\nThis data is provided by [OSV](https://osv.dev/vulnerability/${vulnerability.id})${attribution}.\\n`;\n    content += `</details>`;\n\n    return [sanitizeMarkdown(content)];\n  }\n\n  private extractSeverityDetails(\n    vulnerability: Osv.Vulnerability,\n    affected: Osv.Affected,\n  ): SeverityDetails {\n    let severityLevel = 'UNKNOWN';\n    let score = 'Unknown';\n\n    const cvssVector =\n      vulnerability.severity?.find((e) => e.type === 'CVSS_V4')?.score ??\n      vulnerability.severity?.find((e) => e.type === 'CVSS_V3')?.score ??\n      (affected.database_specific?.cvss as string); // RUSTSEC\n\n    if (cvssVector) {\n      const [baseScore, severity] =\n        Vulnerabilities.evaluateCvssVector(cvssVector);\n      severityLevel = severity ? severity.toUpperCase() : 'UNKNOWN';\n      score = baseScore\n        ? `${baseScore} / 10 (${titleCase(severityLevel)})`\n        : 'Unknown';\n    } else if (\n      vulnerability.id.startsWith('GHSA-') &&\n      vulnerability.database_specific?.severity\n    ) {\n      const severity = vulnerability.database_specific.severity as string;\n      severityLevel = severity.toUpperCase();\n    }\n\n    return {\n      cvssVector,\n      score,\n      severityLevel,\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAuCA,MAAM,EAAE,eAAe;AAEvB,IAAa,kBAAb,MAAa,gBAAgB;CAC3B,OAAe;CAEf;CAEA,OAAwB,yBAAyB;CAEjD,YAAoB,YAAwB;EAC1C,KAAK,aAAa;CACpB;CAEA,OAAe,aAAkC;EAE/C,gBAAgB,eAAe,WAAW,OAAO;EACjD,OAAO,gBAAgB;CACzB;CAEA,aAAa,SAAmC;EAE9C,MAAM,aAAa,MAAM,gBAAgB,WAAW;EAGpD,OAAO,IADc,gBAAgB,UACvB;CAChB;CAEA,MAAM,gCACJ,QACA,cACe;EACf,MAAM,4BAA4B,MAAM,KAAK,+BAC3C,QACA,YACF;EAEA,OAAO,iBAAiB,CAAC;EACzB,KAAK,MAAM,EACT,iBACA,mBACG,2BAA2B;GAC9B,MAAM,oBAAmC,CAAC;GAC1C,KAAK,MAAM,iBAAiB,iBAAiB;IAC3C,MAAM,OAAO,KAAK,4BAA4B,aAAa;IAC3D,IAAI,kBAAkB,IAAI,GACxB;IAEF,kBAAkB,KAAK,IAAI;GAC7B;GACA,KAAK,mBAAmB,mBAAmB,aAAa;GAExD,OAAO,aAAa,KAAK,GAAG,iBAAiB;EAC/C;CACF;CAEA,MAAM,qBACJ,QACA,cAC0B;EAK1B,QAAO,MAJc,KAAK,+BACxB,QACA,YACF,EAAA,CACc,SAAS,UAAU,MAAM,eAAe;CACxD;CAEA,MAAc,+BACZ,QACA,cACsC;EAEtC,MAAM,iBADW,OAAO,KAAK,YACC,CAAC,CAAC,KAAK,YACnC,KAAK,4BAA4B,QAAQ,cAAc,OAAO,CAChE;EACA,QAAQ,MAAM,QAAQ,IAAI,cAAc,EAAA,CAAG,KAAK;CAClD;CAEA,MAAc,4BACZ,QACA,cACA,SACsC;EACtC,MAAM,gBAAgB,iBAAiB,QAAQ,OAAO;EACtD,MAAM,QAAQ,aAAa,QAAQ,CAAC,KACjC,gBACC,KAAK,uCAAuC,eAAe,KAAK,CACpE;EACA,OAAO,MACL;GAAE;GAAS,aAAa,MAAM;EAAO,GACrC,sCACF;EACA,MAAM,UAAU,MAAMA,IAAM,KAAK,EAAA,CAAG,KAAK;EACzC,OAAO,MAAM,EAAE,QAAQ,GAAG,sCAAsC;EAChE,OAAO;CACT;CAEA,MAAc,uCACZ,eACA,OACsC;EACtC,MAAM,EAAE,gBAAgB;EACxB,MAAM,oBAAoB,iBAAiB,eAAe,KAAK;EAC/D,MAAM,EAAE,YAAY;EACpB,MAAM,QAAQ,MAAM,KAAK,KACtB,cACC,KAAK,6BAA6B,mBAAmB,GAAG,CAC5D;EACA,OAAO,MACL;GAAE;GAAS;GAAa,aAAa,MAAM;EAAO,GAClD,kEACF;EAEA,MAAM,SAAS,MAAMA,IAAM,KAAK;EAChC,OAAO,MACL,EAAE,YAAY,GACd,iDACF;EAEA,OAAO,OAAO,OAAO,QAAQ;CAC/B;CAEA,MAAc,6BACZ,mBACA,KAC2C;EAC3C,MAAM,YAAY,gBAAgB,uBAAuB,IAAI;EAC7D,IAAI,CAAC,WAAW;GACd,OAAO,MAAM,yBAAyB,IAAI,WAAY,kBAAkB;GACxE,OAAO;EACT;EAEA,MAAM,cAAc,IAAI;EACxB,IAAI,iBAAiB;EACrB,IAAI;EACJ,IAAI,cAAc,QAEhB,iBAAiB,eACd,YAAY,CAAC,CACb,QAAQ,MAAM,SAAS,GAAG,GAAG;OAC3B,IAAI,cAAc,QAAQ,gBAAgB,MAAM;GACrD,IAAI,IAAI,YAAY,aAElB,OAAO;GAET,iBAAiB;GACjB,UAAU,IAAI;EAChB;EAEA,IAAI;GACF,MAAM,qBAAqB,MAAM,WAC/B,iCACM,KAAK,WAAW,mBAAmB,WAAW,cAAc,GAClE,EACE,YAAY;IACV;IACA;GACF,EACF,CACF;GACA,IACE,kBAAkB,kBAAkB,KACpC,aAAa,kBAAkB,GAC/B;IACA,OAAO,MACL,gDAAgD,aAClD;IACA,OAAO;GACT;GAEA,MAAM,aACJ,IAAI,iBAAiB,IAAI,kBAAkB,IAAI;GAEjD,MAAM,aAAa,IAAI,cAAc,qBAAqB,IAAI,UAAU;GACxE,MAAM,gBAAgBC,IAAc,UAAU;GAE9C,IAAI,CAAC,cAAc,UAAU,UAAU,GAAG;IACxC,OAAO,MACL,6CAA6C,YAAY,8BAA8B,YACzF;IACA,OAAO;GACT;GAEA,MAAM,kBAAmC,CAAC;GAC1C,KAAK,MAAM,oBAAoB,oBAAoB;IACjD,IAAI,iBAAiB,WAAW;KAC9B,OAAO,MACL,oCAAoC,iBAAiB,IACvD;KACA;IACF;IAEA,KAAK,sBACH,WACA,gBACA,YACA,eACA,KACA,kBAAkB,SAClB,kBAAkB,aAClB,gBACF;IAEA,KAAK,MAAM,YAAY,YAAY,iBAAiB,QAAQ,GAAG;KAQ7D,IAAI,CAPiB,KAAK,oBACxB,WACA,gBACA,YACA,UACA,aAEc,GACd;KAGF,OAAO,MACL,iBAAiB,iBAAiB,GAAG,WAAW,YAAY,GAAG,YACjE;KACA,MAAM,eAAe,KAAK,gBACxB,WACA,YACA,UACA,aACF;KAEA,gBAAgB,KAAK;MACnB;MACA;MACA,eAAe;MACf;MACA;MACA;MACA;MACA,YAAY,IAAI;MAChB;KACF,CAAC;IACH;GACF;GAEA,OAAO;IAAE;IAAiB;GAAc;EAC1C,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK;GAAY,GACnB,sDACF;GACA,OAAO;EACT;CACF;CAEA,sBACE,WACA,gBACA,YACA,eACA,KACA,SACA,aACA,kBACM;EAEN,IAAI,iBAAiB,GAAG,WAAW,MAAM,GAEvC,KAAK,MAAM,YAAY,YAAY,iBAAiB,QAAQ,GAAG;GAU7D,IARqB,KAAK,oBACxB,WACA,gBACA,YACA,UACA,aAGa,GAAG;IAChB,OAAO,MACL;KACe;KACb,SAAS,IAAI;KACb,aAAa,IAAI;KACR;KACT,YAAY,IAAI;KAChB,gBAAgB;IAClB,GACA,WAAW,IAAI,QAAQ,gEAAgE,iBAAiB,IAC1G;IACA,IAAI,aAAa;IACjB,IAAI,YAAY;GAClB;GAGA,KAAK,MAAM,UAAU,YAAY,IAAI,OAAO,GAAG;IAC7C,MAAM,aAAa,OAAO,cAAc,OAAO;IAU/C,IAR2B,KAAK,oBAC9B,WACA,gBACA,YACA,UACA,aAGmB,GAAG;KACtB,OAAO,MACL;MACe;MACb,SAAS,IAAI;MACb,aAAa,IAAI;MACR;MACT,YAAY,IAAI;MAChB,gBAAgB;MAChB;KACF,GACA,WAAW,IAAI,QAAQ,eAAe,WAAW,iEAAiE,iBAAiB,IACrI;KACA,IAAI,aAAa;KACjB,IAAI,YAAY;IAClB;GACF;EACF;CAEJ;CAEA,mBACE,cACA,eACM;EACN,MAAM,kBAA0C,CAAC;EACjD,KAAK,MAAM,QAAQ,cAAc;GAC/B,MAAM,UAAU,KAAK;GACrB,gBAAgB,WAAW,QAAQ,QAAQ,MAAM,YAAY,GAAG,EAAE;EACpE;EACA,aAAa,MAAM,GAAG,MACpB,cAAc,aACZ,gBAAgB,EAAE,kBAClB,gBAAgB,EAAE,gBACpB,CACF;CACF;CAGA,WACE,QACA,eACa;EACb,MAAM,aAA0B,CAAC;EACjC,IAAI,YAA8B;EAElC,KAAK,MAAM,SAAS,QAClB,IAAI,MAAM,eAAe,KACvB,YAAY;OACP,IAAI,cAAc,UAAU,OAAO,OAAO,KAAK,CAAC,CAAC,EAAE,GACxD,WAAW,KAAK,KAAK;OAErB,OAAO,MAAM,EAAE,MAAM,GAAG,yCAAyC;EAIrE,WAAW,MAAM,GAAG,MAElB,cAAc,aAAa,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CACrE;EAEA,IAAI,WACF,WAAW,QAAQ,SAAS;EAG9B,OAAO;CACT;CAEA,kBACE,WACA,gBACA,UACS;EACT,MAAM,MAAM,SAAS;EACrB,IAAI,KAAK,SAAS,gBAChB,OAAO;EAIT,OACE,IAAI,cAAc,aAAa,IAAI,UAAU,WAAW,GAAG,UAAU,EAAE;CAE3E;CAEA,mBACE,YACA,UACS;EACT,OAAO,CAAC,CAAC,SAAS,UAAU,SAAS,UAAU;CACjD;CAEA,iBACE,YACA,UACA,eACS;EACT,KAAK,MAAM,SAAS,YAAY,SAAS,MAAM,GAAG;GAChD,IAAI,MAAM,SAAS,OACjB;GAGF,IAAI,aAAa;GACjB,KAAK,MAAM,SAAS,KAAK,WAAW,MAAM,QAAQ,aAAa,GAC7D,IACE,iBAAiB,MAAM,UAAU,MAChC,MAAM,eAAe,OACpB,KAAK,gBAAgB,YAAY,MAAM,YAAY,aAAa,IAElE,aAAa;QACR,IACL,iBAAiB,MAAM,KAAK,KAC5B,KAAK,gBAAgB,YAAY,MAAM,OAAO,aAAa,GAE3D,aAAa;QACR,IACL,iBAAiB,MAAM,aAAa,KACpC,KAAK,YAAY,YAAY,MAAM,eAAe,aAAa,GAE/D,aAAa;GAIjB,IAAI,YACF,OAAO;EAEX;EAEA,OAAO;CACT;CAGA,oBACE,WACA,gBACA,YACA,UACA,eACS;EACT,OACE,KAAK,kBAAkB,WAAW,gBAAgB,QAAQ,MACzD,KAAK,mBAAmB,YAAY,QAAQ,KAC3C,KAAK,iBAAiB,YAAY,UAAU,aAAa;CAE/D;CAEA,gBACE,WACA,YACA,UACA,eACe;EACf,MAAM,gBAA0B,CAAC;EACjC,MAAM,uBAAiC,CAAC;EAExC,KAAK,MAAM,SAAS,YAAY,SAAS,MAAM,GAAG;GAChD,IAAI,MAAM,SAAS,OACjB;GAGF,KAAK,MAAM,SAAS,MAAM,QACxB,IACE,iBAAiB,MAAM,KAAK,KAC5B,cAAc,UAAU,MAAM,KAAK,GAEnC,cAAc,KAAK,MAAM,KAAK;QACzB,IACL,iBAAiB,MAAM,aAAa,KACpC,cAAc,UAAU,MAAM,aAAa,GAE3C,qBAAqB,KAAK,MAAM,aAAa;EAGnD;EAEA,cAAc,MAAM,GAAG,MAAM,cAAc,aAAa,GAAG,CAAC,CAAC;EAC7D,MAAM,eAAe,cAAc,MAAM,YACvC,KAAK,YAAY,SAAS,YAAY,aAAa,CACrD;EACA,IAAI,cACF,OAAO,KAAK,2BAA2B,cAAc,SAAS;EAGhE,qBAAqB,MAAM,GAAG,MAAM,cAAc,aAAa,GAAG,CAAC,CAAC;EACpE,MAAM,eAAe,qBAAqB,MAAM,YAC9C,KAAK,gBAAgB,SAAS,YAAY,aAAa,CACzD;EACA,IAAI,cACF,OAAO,KAAK,2BAA2B,cAAc,SAAS;EAGhE,OAAO;CACT;CAEA,2BACE,cACA,WACQ;EACR,OAAO,0BAA0B,cAAc,SAAS;CAC1D;CAEA,2BACE,cACA,WACQ;EACR,OAAO,iCAAiC,cAAc,SAAS;CACjE;CAEA,YACE,SACA,OACA,eACS;EACT,OACE,cAAc,UAAU,OAAO,KAC/B,cAAc,UAAU,KAAK,KAC7B,cAAc,cAAc,SAAS,KAAK;CAE9C;CAEA,gBACE,SACA,OACA,eACS;EACT,OACE,cAAc,UAAU,OAAO,KAC/B,cAAc,UAAU,KAAK,MAC5B,cAAc,OAAO,SAAS,KAAK,KAClC,cAAc,cAAc,SAAS,KAAK;CAEhD;CAEA,4BAAoC,KAAwC;EAC1E,MAAM,EACJ,eACA,UACA,aACA,SACA,YACA,cACA,YACA,sBACE;EACJ,IAAI,kBAAkB,YAAY,GAAG;GACnC,OAAO,MACL,gDAAgD,cAAc,GAAG,MAAM,YAAY,GAAG,YACxF;GACA,OAAO;EACT;EAGA,MAAM,aAAa,qBAAqB,UAAU;EAElD,OAAO,MACL;GACE;GACA;EACF,GAEA,2BAA2B,aAAa,wBAAwB,cAAc,GAAG,MAAM,YAAY,GAAG,YACxG;EAEA,MAAM,kBAAkB,KAAK,uBAC3B,eACA,QACF;EAEA,OAAO;GACL,kBAAkB,CAAC,UAAU;GAC7B,mBAAmB,CAAC,WAAW;GAC/B,GAAI,UAAU,EAAE,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC;GAC9C,qBAAqB;GACrB;GACA,iBAAiB;GACjB,sBAAsB;GACtB,uBAAuB,gBAAgB;GACvC,aAAa,KAAK,oBAAoB,eAAe,QAAQ;GAC7D,OAAO,EACL,GAAG,kBAAkB,oBACvB;EACF;CACF;CAEA,OAAO,mBAAmB,QAAkC;EAC1D,MAAM,WAAW,EAAE,OAAO;GACxB,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAG;GACjC,cAAc,EAAE,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,SAAS;EAC1D,CAAC;EAED,IAAI;GACF,MAAM,kBAA0C,WAAW,MAAM;GACjE,MAAM,MAAM,SAAS,MAAM,iBAAiB,iBAAiB,CAAC;GAE9D,OAAO,CAAC,IAAI,UAAU,QAAQ,CAAC,GAAG,IAAI,YAAY;EACpD,QAAQ;GACN,OAAO,MAAM,gCAAgC,QAAQ;EACvD;EAEA,OAAO,CAAC,IAAI,EAAE;CAChB;CAEA,oBACE,eACA,UACU;EACV,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC,CAC7B,OAAO,YAAY,cAAc,OAAO,CAAC,CAAC,CAC1C,KAAK;EACR,UAAU,QAAQ,KAAK,OAAO;GAC5B,IAAI,GAAG,WAAW,MAAM,GACtB,OAAO,IAAI,GAAG,qCAAqC,GAAG;GAExD,IAAI,GAAG,WAAW,OAAO,GACvB,OAAO,IAAI,GAAG,kCAAkC,GAAG;GAErD,IAAI,GAAG,WAAW,KAAK,GACrB,OAAO,IAAI,GAAG,4BAA4B,GAAG;GAE/C,IAAI,GAAG,WAAW,UAAU,GAC1B,OAAO,IAAI,GAAG,mCAAmC,GAAG;GAGtD,OAAO;EACT,CAAC;EAED,IAAI,UAAU;EACd,WAAW,cAAc,UAAU,GAAG,cAAc,QAAQ,MAAM;EAClE,WAAW,GAAG,QAAQ,KAAK,KAAK,EAAE;EAClC,WAAW;EAEX,MAAM,UAAU,cAAc,SAAS,QACrC,MAAM,YAAY,GAClB,QACF;EACA,WAAW,iBAAiB,WAAW,cAAc;EAErD,WAAW;EACX,MAAM,kBAAkB,KAAK,uBAC3B,eACA,QACF;EAEA,IAAI,gBAAgB,YAAY;GAC9B,WAAW,iBAAiB,gBAAgB,MAAM;GAClD,WAAW,sBAAsB,gBAAgB,WAAW;EAC9D,OACE,WAAW,GAAG,UAAU,gBAAgB,aAAa,EAAE;EAGzD,WAAW,sBACT,cAAc,YACV,KAAK,QAAQ;GACb,OAAO,MAAM,IAAI,IAAI,IAAI,IAAI,IAAI;EACnC,CAAC,CAAC,CACD,KAAK,IAAI,KAAK;EAGnB,IAAI,cAAc;EAClB,IAAI,cAAc,GAAG,WAAW,OAAO,GACrC,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,KAAK,GAC1C,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,QAAQ,GAC7C,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,UAAU,GAC/C,cAAc;EAEhB,WAAW,oEAAoE,cAAc,GAAG,GAAG,YAAY;EAC/G,WAAW;EAEX,OAAO,CAAC,iBAAiB,OAAO,CAAC;CACnC;CAEA,uBACE,eACA,UACiB;EACjB,IAAI,gBAAgB;EACpB,IAAI,QAAQ;EAEZ,MAAM,aACJ,cAAc,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,SAC3D,cAAc,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,SAC1D,SAAS,mBAAmB;EAE/B,IAAI,YAAY;GACd,MAAM,CAAC,WAAW,YAChB,gBAAgB,mBAAmB,UAAU;GAC/C,gBAAgB,WAAW,SAAS,YAAY,IAAI;GACpD,QAAQ,YACJ,GAAG,UAAU,SAAS,UAAU,aAAa,EAAE,KAC/C;EACN,OAAO,IACL,cAAc,GAAG,WAAW,OAAO,KACnC,cAAc,mBAAmB,UAGjC,gBADiB,cAAc,kBAAkB,SACxB,YAAY;EAGvC,OAAO;GACL;GACA;GACA;EACF;CACF;AACF"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "renovate",
   "description": "Automated dependency updates. Flexible so you don't need to be.",
-  "version": "44.195.0",
+  "version": "44.195.1",
   "type": "module",
   "bin": {
     "renovate": "dist/renovate.js",

package/renovate-schema.json

@@ -1,8 +1,8 @@
 {
   "$id": "https://docs.renovatebot.com/renovate-schema.json",
-  "title": "JSON schema for Renovate 44.195.0 config files (https://renovatebot.com/)",
+  "title": "JSON schema for Renovate 44.195.1 config files (https://renovatebot.com/)",
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "x-renovate-version": "44.195.0",
+  "x-renovate-version": "44.195.1",
   "allowComments": true,
   "type": "object",
   "definitions": {