renovate 44.210.2 → 44.211.0

package/dist/workers/repository/process/extract-update.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract-update.js","names":[],"sources":["../../../../lib/workers/repository/process/extract-update.ts"],"sourcesContent":["import { isArray, isNonEmptyArray, isString, isTruthy } from '@sindresorhus/is';\nimport type { RenovateConfig } from '../../../config/types.ts';\nimport { instrument } from '../../../instrumentation/index.ts';\nimport { logger } from '../../../logger/index.ts';\nimport {\n  getDatasourceFor,\n  getDatasourceHostType,\n} from '../../../modules/datasource/common.ts';\nimport { hashMap } from '../../../modules/manager/index.ts';\nimport {\n  needsNpmrcFromDisk,\n  withNpmrc,\n  withoutNpmrc,\n} from '../../../modules/manager/npmrc.ts';\nimport type { PackageFile } from '../../../modules/manager/types.ts';\nimport { scm } from '../../../modules/platform/scm.ts';\nimport { isNotNullOrUndefined } from '../../../util/array.ts';\nimport * as memCache from '../../../util/cache/memory/index.ts';\nimport { getCache } from '../../../util/cache/repository/index.ts';\nimport type { BaseBranchCache } from '../../../util/cache/repository/types.ts';\nimport { checkGithubToken as ensureGithubToken } from '../../../util/check-token.ts';\nimport { clone } from '../../../util/clone.ts';\nimport { fingerprint } from '../../../util/fingerprint.ts';\nimport { detachUrlCredentials } from '../../../util/host-rules.ts';\nimport { coerceObject } from '../../../util/object.ts';\nimport {\n  containsUrlCredentials,\n  hasUrlCredentials,\n} from '../../../util/url.ts';\nimport type { BranchConfig } from '../../types.ts';\nimport { generateFingerprintConfig } from '../extract/extract-fingerprint-config.ts';\nimport { extractAllDependencies } from '../extract/index.ts';\nimport { branchifyUpgrades } from '../updates/branchify.ts';\nimport { fetchUpdates } from './fetch.ts';\nimport { calculateLibYears } from './libyear.ts';\nimport { sortBranches } from './sort.ts';\nimport { Vulnerabilities } from './vulnerabilities.ts';\nimport type { WriteUpdateResult } from './write.ts';\nimport { writeUpdates } from './write.ts';\n\n// Increment this if needing to cache bust ALL extract caches\nexport const EXTRACT_CACHE_REVISION = 1;\n\nexport interface ExtractResult {\n  branches: BranchConfig[];\n  branchList: string[];\n  packageFiles: Record<string, PackageFile[]>;\n}\n\nexport interface StatsResult {\n  fileCount: number;\n  depCount: number;\n}\n\nexport interface Stats {\n  managers: Record<string, StatsResult>;\n  total: StatsResult;\n}\n\n// istanbul ignore next\nfunction extractStats(\n  packageFiles: Record<string, PackageFile[]>,\n): Stats | null {\n  if (!packageFiles) {\n    return null;\n  }\n  const stats: Stats = {\n    managers: {},\n    total: {\n      fileCount: 0,\n      depCount: 0,\n    },\n  };\n  for (const [manager, managerPackageFiles] of Object.entries(packageFiles)) {\n    const fileCount = managerPackageFiles.length;\n    let depCount = 0;\n    for (const file of managerPackageFiles) {\n      depCount += file.deps.length;\n    }\n    stats.managers[manager] = {\n      fileCount,\n      depCount,\n    };\n    stats.total.fileCount += fileCount;\n    stats.total.depCount += depCount;\n  }\n  return stats;\n}\n\nexport function isCacheExtractValid(\n  baseBranchSha: string,\n  configHash: string,\n  cachedExtract?: BaseBranchCache,\n): boolean {\n  if (!cachedExtract) {\n    return false;\n  }\n\n  if (!cachedExtract.revision) {\n    logger.debug('Cached extract is missing revision, so cannot be used');\n    return false;\n  }\n\n  if (cachedExtract.revision !== EXTRACT_CACHE_REVISION) {\n    logger.debug(\n      `Extract cache revision has changed (old=${cachedExtract.revision}, new=${EXTRACT_CACHE_REVISION})`,\n    );\n    return false;\n  }\n\n  if (!(cachedExtract.sha && cachedExtract.configHash)) {\n    return false;\n  }\n  if (cachedExtract.sha !== baseBranchSha) {\n    logger.debug(\n      `Cached extract result cannot be used due to base branch SHA change (old=${cachedExtract.sha}, new=${baseBranchSha})`,\n    );\n    return false;\n  }\n  if (cachedExtract.configHash !== configHash) {\n    logger.debug('Cached extract result cannot be used due to config change');\n    return false;\n  }\n  if (!cachedExtract.extractionFingerprints) {\n    logger.debug(\n      'Cached extract is missing extractionFingerprints, so cannot be used',\n    );\n    return false;\n  }\n  const changedManagers = new Set();\n  for (const [manager, fingerprint] of Object.entries(\n    cachedExtract.extractionFingerprints,\n  )) {\n    if (fingerprint !== hashMap.get(manager)) {\n      changedManagers.add(manager);\n    }\n  }\n  if (changedManagers.size > 0) {\n    logger.debug(\n      { changedManagers: [...changedManagers] },\n      'Manager fingerprint(s) have changed, extract cache cannot be reused',\n    );\n    return false;\n  }\n  if (containsUrlCredentials(cachedExtract.packageFiles)) {\n    logger.debug('Cached extract has URLs with credentials, so cannot be used');\n    return false;\n  }\n  logger.debug(\n    `Cached extract for sha=${baseBranchSha} is valid and can be used`,\n  );\n  return true;\n}\n\nexport async function extract(\n  config: RenovateConfig,\n  overwriteCache = true,\n): Promise<Record<string, PackageFile[]>> {\n  logger.debug('extract()');\n  const { baseBranch } = config;\n  const baseBranchSha = await scm.getBranchCommit(baseBranch!);\n  let packageFiles: Record<string, PackageFile[]>;\n  const cache = getCache();\n  cache.scan ??= {};\n  const cachedExtract = cache.scan[baseBranch!];\n  const configHash = instrument('fingerprint', () =>\n    fingerprint(generateFingerprintConfig(config)),\n  );\n  if (\n    overwriteCache &&\n    isCacheExtractValid(baseBranchSha!, configHash, cachedExtract)\n  ) {\n    if (needsNpmrcFromDisk(cachedExtract.packageFiles)) {\n      // a repository `.npmrc` with credentials is not cached, so it is read from the base branch again\n      await instrument(\n        'checkoutBranch',\n        async () => await scm.checkoutBranch(baseBranch!),\n      );\n    }\n    // the merged `npmrc` is not cached, so it is rebuilt from the cached repository `.npmrc` and the config\n    packageFiles = await withNpmrc(clone(cachedExtract.packageFiles), config);\n  } else {\n    await instrument(\n      'checkoutBranch',\n      async () => await scm.checkoutBranch(baseBranch!),\n    );\n    const extractResult = await instrument(\n      'extractAllDependencies',\n      async () => (await extractAllDependencies(config)) || {},\n    );\n    packageFiles = extractResult.packageFiles;\n    const { extractionFingerprints } = extractResult;\n    // before caching, as the host rules for the credentials are registered for this run only, and the cache keeps copies of the package files\n    const registryUrlsHadCredentials =\n      detachRegistryUrlCredentials(packageFiles);\n    // the merged `npmrc` carries the configured one, which may hold credentials\n    const cachedPackageFiles = overwriteCache\n      ? withoutNpmrc(packageFiles)\n      : undefined;\n    // the registry URLs held their credentials before they were detached, the other strings are checked on what would be cached\n    const hasUrlCredentials =\n      overwriteCache &&\n      (registryUrlsHadCredentials ||\n        containsUrlCredentials(cachedPackageFiles));\n\n    if (hasUrlCredentials) {\n      logger.once.warn(\n        { baseBranch },\n        'The package files contain URLs with credentials, so the extract result is not cached: configure the credentials through hostRules instead',\n      );\n      delete cache.scan[baseBranch!];\n    } else if (cachedPackageFiles) {\n      // TODO: fix types (#22198)\n      cache.scan[baseBranch!] = {\n        revision: EXTRACT_CACHE_REVISION,\n        sha: baseBranchSha!,\n        configHash,\n        extractionFingerprints,\n        // a deep copy, as `withoutNpmrc()` copies the package files shallowly and the lookup adds its results to the deps\n        packageFiles: clone(cachedPackageFiles),\n      };\n    }\n\n    // Clean up cached branch extracts\n    const baseBranches = isNonEmptyArray(config.baseBranches)\n      ? config.baseBranches\n      : [baseBranch];\n    Object.keys(cache.scan).forEach((branchName) => {\n      if (!baseBranches.includes(branchName)) {\n        delete cache.scan![branchName];\n      }\n    });\n  }\n  const stats = extractStats(packageFiles);\n  logger.info(\n    { baseBranch: config.baseBranch, stats },\n    `Dependency extraction complete`,\n  );\n  logger.trace({ config: packageFiles }, 'packageFiles');\n  ensureGithubToken(packageFiles);\n  return packageFiles;\n}\n\n/**\n * Returns the host types the known datasources among `datasources` request with, such as `custom` for `custom.<name>`.\n */\nfunction datasourceHostTypes(datasources: (string | undefined)[]): string[] {\n  const hostTypes = datasources\n    .filter(isTruthy)\n    .map((datasource) => getDatasourceHostType(datasource))\n    .filter(isTruthy);\n  return [...new Set(hostTypes)];\n}\n\n/**\n * Returns the datasources of `deps` which support custom registry URLs for their package.\n */\nfunction customRegistryDatasources(\n  deps: Pick<\n    PackageFile['deps'][number],\n    'datasource' | 'packageName' | 'depName'\n  >[],\n): string[] {\n  return deps\n    .filter(({ datasource, packageName, depName }) =>\n      getDatasourceFor(datasource ?? '')?.supportsCustomRegistry(\n        packageName ?? depName ?? '',\n      ),\n    )\n    .map(({ datasource }) => datasource!);\n}\n\n/**\n * Moves the credentials of every extracted registry URL into host rules for the current run, for the datasources which support custom registry URLs; the URLs of other datasources lose their credentials.\n *\n * @returns whether a registry URL of a datasource which supports custom registry URLs held credentials according to `hasUrlCredentials()`\n */\nfunction detachRegistryUrlCredentials(\n  packageFiles: Record<string, PackageFile[]>,\n): boolean {\n  let hadCredentials = false;\n\n  function detach(url: string, hostTypes: string[]): string {\n    // managers may yield non-string entries despite the type\n    if (!isString(url)) {\n      return url;\n    }\n    hadCredentials ||= hostTypes.length > 0 && hasUrlCredentials(url);\n    return detachUrlCredentials(url, hostTypes);\n  }\n\n  // `extractAllDependencies` may have yielded nothing\n  for (const files of Object.values(coerceObject(packageFiles))) {\n    for (const file of files) {\n      // the URLs of a package file are requested with the datasources of its dependencies\n      const hostTypes = datasourceHostTypes(\n        customRegistryDatasources([\n          { datasource: file.datasource },\n          ...file.deps,\n        ]),\n      );\n      // absent fields stay absent, so they don't override configured ones\n      if (isArray(file.registryUrls)) {\n        file.registryUrls = file.registryUrls.map((url) =>\n          detach(url, hostTypes),\n        );\n      }\n      if (isArray(file.additionalRegistryUrls)) {\n        file.additionalRegistryUrls = file.additionalRegistryUrls.map((url) =>\n          detach(url, hostTypes),\n        );\n      }\n      for (const dep of file.deps) {\n        if (isArray(dep.registryUrls)) {\n          dep.registryUrls = dep.registryUrls.map((url) =>\n            detach(url, datasourceHostTypes(customRegistryDatasources([dep]))),\n          );\n        }\n      }\n    }\n  }\n  return hadCredentials;\n}\n\nasync function fetchVulnerabilities(\n  config: RenovateConfig,\n  packageFiles: Record<string, PackageFile[]>,\n): Promise<void> {\n  if (config.osvVulnerabilityAlerts) {\n    logger.debug('fetchVulnerabilities() - osvVulnerabilityAlerts=true');\n    try {\n      const vulnerabilities = await Vulnerabilities.create();\n      await vulnerabilities.appendVulnerabilityPackageRules(\n        config,\n        packageFiles,\n      );\n    } catch (err) {\n      logger.warn({ err }, 'Unable to read vulnerability information');\n    }\n  }\n}\n\nexport async function lookup(\n  config: RenovateConfig,\n  packageFiles: Record<string, PackageFile[]>,\n): Promise<ExtractResult> {\n  await fetchVulnerabilities(config, packageFiles);\n  await fetchUpdates(config, packageFiles);\n  // call this twice, as the second time, the updates will be availalbe for malicious package checks\n  // TODO: this will be refactored as part of #42423\n  await fetchVulnerabilities(config, packageFiles);\n  memCache.cleanDatasourceKeys();\n  calculateLibYears(config, packageFiles);\n  const { branches, branchList } = await branchifyUpgrades(\n    config,\n    packageFiles,\n  );\n  reportMaliciousSkippedDependencies(packageFiles);\n  logger.debug(\n    { baseBranch: config.baseBranch, config: packageFiles },\n    'packageFiles with updates',\n  );\n  sortBranches(branches);\n  return { branches, branchList, packageFiles };\n}\n\nexport function reportMaliciousSkippedDependencies(\n  allPackageFiles: Record<string, PackageFile[]>,\n): void {\n  if (allPackageFiles === undefined) {\n    return;\n  }\n\n  for (const [manager, packageFiles] of Object.entries(allPackageFiles)) {\n    for (const packageFile of packageFiles) {\n      for (const dep of packageFile.deps) {\n        if (dep.skipReason === 'malicious-version-in-use') {\n          logger.warn(\n            {\n              packageFile: packageFile.packageFile,\n              depName: dep.depName,\n              packageName: dep.packageName,\n              manager: manager,\n              datasource: dep.datasource,\n            },\n            'Dependency is currently using a malicious version',\n          );\n\n          // and make sure that it then gets updates proposed in the update phase\n          delete dep.skipReason;\n          delete dep.skipStage;\n        } else if (dep.skipReason === 'malicious-update-proposed') {\n          const newVersions = dep.updates\n            ?.map((u) => u.newVersion ?? u.newValue)\n            .filter(isNotNullOrUndefined);\n          logger.warn(\n            {\n              packageFile: packageFile.packageFile,\n              depName: dep.depName,\n              packageName: dep.packageName,\n              manager: manager,\n              datasource: dep.datasource,\n              newVersions,\n            },\n            'Dependency has update(s) proposed which would update you to a malicious version - skipping',\n          );\n        }\n      }\n    }\n  }\n}\n\nexport function update(\n  config: RenovateConfig,\n  branches: BranchConfig[],\n): Promise<WriteUpdateResult> {\n  return writeUpdates(config, branches);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,SAAS,aACP,cACc;CACd,IAAI,CAAC,cACH,OAAO;CAET,MAAM,QAAe;EACnB,UAAU,CAAC;EACX,OAAO;GACL,WAAW;GACX,UAAU;EACZ;CACF;CACA,KAAK,MAAM,CAAC,SAAS,wBAAwB,OAAO,QAAQ,YAAY,GAAG;EACzE,MAAM,YAAY,oBAAoB;EACtC,IAAI,WAAW;EACf,KAAK,MAAM,QAAQ,qBACjB,YAAY,KAAK,KAAK;EAExB,MAAM,SAAS,WAAW;GACxB;GACA;EACF;EACA,MAAM,MAAM,aAAa;EACzB,MAAM,MAAM,YAAY;CAC1B;CACA,OAAO;AACT;AAEA,SAAgB,oBACd,eACA,YACA,eACS;CACT,IAAI,CAAC,eACH,OAAO;CAGT,IAAI,CAAC,cAAc,UAAU;EAC3B,OAAO,MAAM,uDAAuD;EACpE,OAAO;CACT;CAEA,IAAI,cAAc,aAAA,GAAqC;EACrD,OAAO,MACL,2CAA2C,cAAc,SAAS,SACpE;EACA,OAAO;CACT;CAEA,IAAI,EAAE,cAAc,OAAO,cAAc,aACvC,OAAO;CAET,IAAI,cAAc,QAAQ,eAAe;EACvC,OAAO,MACL,2EAA2E,cAAc,IAAI,QAAQ,cAAc,EACrH;EACA,OAAO;CACT;CACA,IAAI,cAAc,eAAe,YAAY;EAC3C,OAAO,MAAM,2DAA2D;EACxE,OAAO;CACT;CACA,IAAI,CAAC,cAAc,wBAAwB;EACzC,OAAO,MACL,qEACF;EACA,OAAO;CACT;CACA,MAAM,kCAAkB,IAAI,IAAI;CAChC,KAAK,MAAM,CAAC,SAAS,gBAAgB,OAAO,QAC1C,cAAc,sBAChB,GACE,IAAI,gBAAgB,QAAQ,IAAI,OAAO,GACrC,gBAAgB,IAAI,OAAO;CAG/B,IAAI,gBAAgB,OAAO,GAAG;EAC5B,OAAO,MACL,EAAE,iBAAiB,CAAC,GAAG,eAAe,EAAE,GACxC,qEACF;EACA,OAAO;CACT;CACA,IAAI,uBAAuB,cAAc,YAAY,GAAG;EACtD,OAAO,MAAM,6DAA6D;EAC1E,OAAO;CACT;CACA,OAAO,MACL,0BAA0B,cAAc,0BAC1C;CACA,OAAO;AACT;AAEA,eAAsB,QACpB,QACA,iBAAiB,MACuB;CACxC,OAAO,MAAM,WAAW;CACxB,MAAM,EAAE,eAAe;CACvB,MAAM,gBAAgB,MAAM,IAAI,gBAAgB,UAAW;CAC3D,IAAI;CACJ,MAAM,QAAQ,SAAS;CACvB,MAAM,SAAS,CAAC;CAChB,MAAM,gBAAgB,MAAM,KAAK;CACjC,MAAM,aAAa,WAAW,qBAC5B,YAAY,0BAA0B,MAAM,CAAC,CAC/C;CACA,IACE,kBACA,oBAAoB,eAAgB,YAAY,aAAa,GAC7D;EACA,IAAI,mBAAmB,cAAc,YAAY,GAE/C,MAAM,WACJ,kBACA,YAAY,MAAM,IAAI,eAAe,UAAW,CAClD;EAGF,eAAe,MAAM,UAAU,MAAM,cAAc,YAAY,GAAG,MAAM;CAC1E,OAAO;EACL,MAAM,WACJ,kBACA,YAAY,MAAM,IAAI,eAAe,UAAW,CAClD;EACA,MAAM,gBAAgB,MAAM,WAC1B,0BACA,YAAa,MAAM,uBAAuB,MAAM,KAAM,CAAC,CACzD;EACA,eAAe,cAAc;EAC7B,MAAM,EAAE,2BAA2B;EAEnC,MAAM,6BACJ,6BAA6B,YAAY;EAE3C,MAAM,qBAAqB,iBACvB,aAAa,YAAY,IACzB,KAAA;EAOJ,IAJE,mBACC,8BACC,uBAAuB,kBAAkB,IAEtB;GACrB,OAAO,KAAK,KACV,EAAE,WAAW,GACb,2IACF;GACA,OAAO,MAAM,KAAK;EACpB,OAAO,IAAI,oBAET,MAAM,KAAK,cAAe;GACxB,UAAA;GACA,KAAK;GACL;GACA;GAEA,cAAc,MAAM,kBAAkB;EACxC;EAIF,MAAM,eAAe,gBAAgB,OAAO,YAAY,IACpD,OAAO,eACP,CAAC,UAAU;EACf,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,eAAe;GAC9C,IAAI,CAAC,aAAa,SAAS,UAAU,GACnC,OAAO,MAAM,KAAM;EAEvB,CAAC;CACH;CACA,MAAM,QAAQ,aAAa,YAAY;CACvC,OAAO,KACL;EAAE,YAAY,OAAO;EAAY;CAAM,GACvC,gCACF;CACA,OAAO,MAAM,EAAE,QAAQ,aAAa,GAAG,cAAc;CACrD,iBAAkB,YAAY;CAC9B,OAAO;AACT;;;;AAKA,SAAS,oBAAoB,aAA+C;CAC1E,MAAM,YAAY,YACf,OAAO,QAAQ,CAAC,CAChB,KAAK,eAAe,sBAAsB,UAAU,CAAC,CAAC,CACtD,OAAO,QAAQ;CAClB,OAAO,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;AAC/B;;;;AAKA,SAAS,0BACP,MAIU;CACV,OAAO,KACJ,QAAQ,EAAE,YAAY,aAAa,cAClC,iBAAiB,cAAc,EAAE,CAAC,EAAE,uBAClC,eAAe,WAAW,EAC5B,CACF,CAAC,CACA,KAAK,EAAE,iBAAiB,UAAW;AACxC;;;;;;AAOA,SAAS,6BACP,cACS;CACT,IAAI,iBAAiB;CAErB,SAAS,OAAO,KAAa,WAA6B;EAExD,IAAI,CAAC,SAAS,GAAG,GACf,OAAO;EAET,mBAAmB,UAAU,SAAS,KAAK,kBAAkB,GAAG;EAChE,OAAO,qBAAqB,KAAK,SAAS;CAC5C;CAGA,KAAK,MAAM,SAAS,OAAO,OAAO,aAAa,YAAY,CAAC,GAC1D,KAAK,MAAM,QAAQ,OAAO;EAExB,MAAM,YAAY,oBAChB,0BAA0B,CACxB,EAAE,YAAY,KAAK,WAAW,GAC9B,GAAG,KAAK,IACV,CAAC,CACH;EAEA,IAAI,QAAQ,KAAK,YAAY,GAC3B,KAAK,eAAe,KAAK,aAAa,KAAK,QACzC,OAAO,KAAK,SAAS,CACvB;EAEF,IAAI,QAAQ,KAAK,sBAAsB,GACrC,KAAK,yBAAyB,KAAK,uBAAuB,KAAK,QAC7D,OAAO,KAAK,SAAS,CACvB;EAEF,KAAK,MAAM,OAAO,KAAK,MACrB,IAAI,QAAQ,IAAI,YAAY,GAC1B,IAAI,eAAe,IAAI,aAAa,KAAK,QACvC,OAAO,KAAK,oBAAoB,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CACnE;CAGN;CAEF,OAAO;AACT;AAEA,eAAe,qBACb,QACA,cACe;CACf,IAAI,OAAO,wBAAwB;EACjC,OAAO,MAAM,sDAAsD;EACnE,IAAI;GAEF,OAAM,MADwB,gBAAgB,OAAO,EAAA,CAC/B,gCACpB,QACA,YACF;EACF,SAAS,KAAK;GACZ,OAAO,KAAK,EAAE,IAAI,GAAG,0CAA0C;EACjE;CACF;AACF;AAEA,eAAsB,OACpB,QACA,cACwB;CACxB,MAAM,qBAAqB,QAAQ,YAAY;CAC/C,MAAM,aAAa,QAAQ,YAAY;CAGvC,MAAM,qBAAqB,QAAQ,YAAY;CAC/C,oBAA6B;CAC7B,kBAAkB,QAAQ,YAAY;CACtC,MAAM,EAAE,UAAU,eAAe,MAAM,kBACrC,QACA,YACF;CACA,mCAAmC,YAAY;CAC/C,OAAO,MACL;EAAE,YAAY,OAAO;EAAY,QAAQ;CAAa,GACtD,2BACF;CACA,aAAa,QAAQ;CACrB,OAAO;EAAE;EAAU;EAAY;CAAa;AAC9C;AAEA,SAAgB,mCACd,iBACM;CACN,IAAI,oBAAoB,KAAA,GACtB;CAGF,KAAK,MAAM,CAAC,SAAS,iBAAiB,OAAO,QAAQ,eAAe,GAClE,KAAK,MAAM,eAAe,cACxB,KAAK,MAAM,OAAO,YAAY,MAC5B,IAAI,IAAI,eAAe,4BAA4B;EACjD,OAAO,KACL;GACE,aAAa,YAAY;GACzB,SAAS,IAAI;GACb,aAAa,IAAI;GACR;GACT,YAAY,IAAI;EAClB,GACA,mDACF;EAGA,OAAO,IAAI;EACX,OAAO,IAAI;CACb,OAAO,IAAI,IAAI,eAAe,6BAA6B;EACzD,MAAM,cAAc,IAAI,SACpB,KAAK,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CACvC,OAAO,oBAAoB;EAC9B,OAAO,KACL;GACE,aAAa,YAAY;GACzB,SAAS,IAAI;GACb,aAAa,IAAI;GACR;GACT,YAAY,IAAI;GAChB;EACF,GACA,4FACF;CACF;AAIR;AAEA,SAAgB,OACd,QACA,UAC4B;CAC5B,OAAO,aAAa,QAAQ,QAAQ;AACtC"}
+{"version":3,"file":"extract-update.js","names":[],"sources":["../../../../lib/workers/repository/process/extract-update.ts"],"sourcesContent":["import { isArray, isNonEmptyArray, isString, isTruthy } from '@sindresorhus/is';\nimport type { RenovateConfig } from '../../../config/types.ts';\nimport { instrument } from '../../../instrumentation/index.ts';\nimport { logger } from '../../../logger/index.ts';\nimport {\n  getDatasourceFor,\n  getDatasourceHostType,\n} from '../../../modules/datasource/common.ts';\nimport { hashMap } from '../../../modules/manager/index.ts';\nimport {\n  needsNpmrcFromDisk,\n  withNpmrc,\n  withoutNpmrc,\n} from '../../../modules/manager/npmrc.ts';\nimport type { PackageFile } from '../../../modules/manager/types.ts';\nimport { scm } from '../../../modules/platform/scm.ts';\nimport { isNotNullOrUndefined } from '../../../util/array.ts';\nimport * as memCache from '../../../util/cache/memory/index.ts';\nimport { getCache } from '../../../util/cache/repository/index.ts';\nimport type { BaseBranchCache } from '../../../util/cache/repository/types.ts';\nimport { checkGithubToken as ensureGithubToken } from '../../../util/check-token.ts';\nimport { clone } from '../../../util/clone.ts';\nimport { fingerprint } from '../../../util/fingerprint.ts';\nimport { detachUrlCredentials } from '../../../util/host-rules.ts';\nimport { coerceObject } from '../../../util/object.ts';\nimport {\n  containsUrlCredentials,\n  hasUrlCredentials,\n} from '../../../util/url.ts';\nimport type { BranchConfig } from '../../types.ts';\nimport { generateFingerprintConfig } from '../extract/extract-fingerprint-config.ts';\nimport { extractAllDependencies } from '../extract/index.ts';\nimport { branchifyUpgrades } from '../updates/branchify.ts';\nimport { fetchUpdates } from './fetch.ts';\nimport { calculateLibYears } from './libyear.ts';\nimport { sortBranches } from './sort.ts';\nimport { Vulnerabilities } from './vulnerabilities.ts';\nimport type { WriteUpdateResult } from './write.ts';\nimport { writeUpdates } from './write.ts';\n\n// Increment this if needing to cache bust ALL extract caches\nexport const EXTRACT_CACHE_REVISION = 1;\n\nexport interface ExtractResult {\n  branches: BranchConfig[];\n  branchList: string[];\n  packageFiles: Record<string, PackageFile[]>;\n}\n\nexport interface StatsResult {\n  fileCount: number;\n  depCount: number;\n}\n\nexport interface Stats {\n  managers: Record<string, StatsResult>;\n  total: StatsResult;\n}\n\n// istanbul ignore next\nfunction extractStats(\n  packageFiles: Record<string, PackageFile[]>,\n): Stats | null {\n  if (!packageFiles) {\n    return null;\n  }\n  const stats: Stats = {\n    managers: {},\n    total: {\n      fileCount: 0,\n      depCount: 0,\n    },\n  };\n  for (const [manager, managerPackageFiles] of Object.entries(packageFiles)) {\n    const fileCount = managerPackageFiles.length;\n    let depCount = 0;\n    for (const file of managerPackageFiles) {\n      depCount += file.deps.length;\n    }\n    stats.managers[manager] = {\n      fileCount,\n      depCount,\n    };\n    stats.total.fileCount += fileCount;\n    stats.total.depCount += depCount;\n  }\n  return stats;\n}\n\nexport function isCacheExtractValid(\n  baseBranchSha: string,\n  configHash: string,\n  cachedExtract?: BaseBranchCache,\n): boolean {\n  if (!cachedExtract) {\n    return false;\n  }\n\n  if (!cachedExtract.revision) {\n    logger.debug('Cached extract is missing revision, so cannot be used');\n    return false;\n  }\n\n  if (cachedExtract.revision !== EXTRACT_CACHE_REVISION) {\n    logger.debug(\n      `Extract cache revision has changed (old=${cachedExtract.revision}, new=${EXTRACT_CACHE_REVISION})`,\n    );\n    return false;\n  }\n\n  if (!(cachedExtract.sha && cachedExtract.configHash)) {\n    return false;\n  }\n  if (cachedExtract.sha !== baseBranchSha) {\n    logger.debug(\n      `Cached extract result cannot be used due to base branch SHA change (old=${cachedExtract.sha}, new=${baseBranchSha})`,\n    );\n    return false;\n  }\n  if (cachedExtract.configHash !== configHash) {\n    logger.debug('Cached extract result cannot be used due to config change');\n    return false;\n  }\n  if (!cachedExtract.extractionFingerprints) {\n    logger.debug(\n      'Cached extract is missing extractionFingerprints, so cannot be used',\n    );\n    return false;\n  }\n  const changedManagers = new Set();\n  for (const [manager, fingerprint] of Object.entries(\n    cachedExtract.extractionFingerprints,\n  )) {\n    if (fingerprint !== hashMap.get(manager)) {\n      changedManagers.add(manager);\n    }\n  }\n  if (changedManagers.size > 0) {\n    logger.debug(\n      { changedManagers: [...changedManagers] },\n      'Manager fingerprint(s) have changed, extract cache cannot be reused',\n    );\n    return false;\n  }\n  if (containsUrlCredentials(cachedExtract.packageFiles)) {\n    logger.debug('Cached extract has URLs with credentials, so cannot be used');\n    return false;\n  }\n  logger.debug(\n    `Cached extract for sha=${baseBranchSha} is valid and can be used`,\n  );\n  return true;\n}\n\nexport async function extract(\n  config: RenovateConfig,\n  overwriteCache = true,\n): Promise<Record<string, PackageFile[]>> {\n  logger.debug('extract()');\n  const { baseBranch } = config;\n  const baseBranchSha = await scm.getBranchCommit(baseBranch!);\n  let packageFiles: Record<string, PackageFile[]>;\n  const cache = getCache();\n  cache.scan ??= {};\n  const cachedExtract = cache.scan[baseBranch!];\n  const configHash = instrument('fingerprint', () =>\n    fingerprint(generateFingerprintConfig(config)),\n  );\n  if (\n    overwriteCache &&\n    isCacheExtractValid(baseBranchSha!, configHash, cachedExtract)\n  ) {\n    if (needsNpmrcFromDisk(cachedExtract.packageFiles)) {\n      // a repository `.npmrc` with credentials is not cached, so it is read from the base branch again\n      await instrument(\n        'checkoutBranch',\n        async () => await scm.checkoutBranch(baseBranch!),\n      );\n    }\n    // the merged `npmrc` is not cached, so it is rebuilt from the cached repository `.npmrc` and the config\n    packageFiles = await withNpmrc(clone(cachedExtract.packageFiles), config);\n  } else {\n    await instrument(\n      'checkoutBranch',\n      async () => await scm.checkoutBranch(baseBranch!),\n    );\n    const extractResult = await instrument(\n      'extractAllDependencies',\n      async () => (await extractAllDependencies(config)) || {},\n    );\n    packageFiles = extractResult.packageFiles;\n    const { extractionFingerprints } = extractResult;\n    // before caching, as the host rules for the credentials are registered for this run only, and the cache keeps copies of the package files\n    const registryUrlsHadCredentials =\n      detachRegistryUrlCredentials(packageFiles);\n    // the merged `npmrc` carries the configured one, which may hold credentials\n    const cachedPackageFiles = overwriteCache\n      ? withoutNpmrc(packageFiles)\n      : undefined;\n    // the registry URLs held their credentials before they were detached, the other strings are checked on what would be cached\n    function hasCredentials(): boolean {\n      return (\n        registryUrlsHadCredentials || containsUrlCredentials(cachedPackageFiles)\n      );\n    }\n    const hasUrlCredentials = overwriteCache && hasCredentials();\n\n    if (hasUrlCredentials) {\n      logger.once.warn(\n        { baseBranch },\n        'The package files contain URLs with credentials, so the extract result is not cached: configure the credentials through hostRules instead',\n      );\n      delete cache.scan[baseBranch!];\n    } else if (cachedPackageFiles) {\n      // TODO: fix types (#22198)\n      cache.scan[baseBranch!] = {\n        revision: EXTRACT_CACHE_REVISION,\n        sha: baseBranchSha!,\n        configHash,\n        extractionFingerprints,\n        // a deep copy, as `withoutNpmrc()` copies the package files shallowly and the lookup adds its results to the deps\n        packageFiles: clone(cachedPackageFiles),\n      };\n    }\n\n    // Clean up cached branch extracts\n    const baseBranches = isNonEmptyArray(config.baseBranches)\n      ? config.baseBranches\n      : [baseBranch];\n    Object.keys(cache.scan).forEach((branchName) => {\n      if (!baseBranches.includes(branchName)) {\n        delete cache.scan![branchName];\n      }\n    });\n  }\n  const stats = extractStats(packageFiles);\n  logger.info(\n    { baseBranch: config.baseBranch, stats },\n    `Dependency extraction complete`,\n  );\n  logger.trace({ config: packageFiles }, 'packageFiles');\n  ensureGithubToken(packageFiles);\n  return packageFiles;\n}\n\n/**\n * Returns the host types the known datasources among `datasources` request with, such as `custom` for `custom.<name>`.\n */\nfunction datasourceHostTypes(datasources: (string | undefined)[]): string[] {\n  const hostTypes = datasources\n    .filter(isTruthy)\n    .map((datasource) => getDatasourceHostType(datasource))\n    .filter(isTruthy);\n  return [...new Set(hostTypes)];\n}\n\n/**\n * Returns the datasources of `deps` which support custom registry URLs for their package.\n */\nfunction customRegistryDatasources(\n  deps: Pick<\n    PackageFile['deps'][number],\n    'datasource' | 'packageName' | 'depName'\n  >[],\n): string[] {\n  return deps\n    .filter(({ datasource, packageName, depName }) =>\n      getDatasourceFor(datasource ?? '')?.supportsCustomRegistry(\n        packageName ?? depName ?? '',\n      ),\n    )\n    .map(({ datasource }) => datasource!);\n}\n\n/**\n * Moves the credentials of every extracted registry URL into host rules for the current run, for the datasources which support custom registry URLs; the URLs of other datasources lose their credentials.\n *\n * @returns whether a registry URL of a datasource which supports custom registry URLs held credentials according to `hasUrlCredentials()`\n */\nfunction detachRegistryUrlCredentials(\n  packageFiles: Record<string, PackageFile[]>,\n): boolean {\n  let hadCredentials = false;\n\n  function detach(url: string, hostTypes: string[]): string {\n    // managers may yield non-string entries despite the type\n    if (!isString(url)) {\n      return url;\n    }\n    hadCredentials ||= hostTypes.length > 0 && hasUrlCredentials(url);\n    return detachUrlCredentials(url, hostTypes);\n  }\n\n  // `extractAllDependencies` may have yielded nothing\n  for (const files of Object.values(coerceObject(packageFiles))) {\n    for (const file of files) {\n      // the URLs of a package file are requested with the datasources of its dependencies\n      const hostTypes = datasourceHostTypes(\n        customRegistryDatasources([\n          { datasource: file.datasource },\n          ...file.deps,\n        ]),\n      );\n      // absent fields stay absent, so they don't override configured ones\n      if (isArray(file.registryUrls)) {\n        file.registryUrls = file.registryUrls.map((url) =>\n          detach(url, hostTypes),\n        );\n      }\n      if (isArray(file.additionalRegistryUrls)) {\n        file.additionalRegistryUrls = file.additionalRegistryUrls.map((url) =>\n          detach(url, hostTypes),\n        );\n      }\n      for (const dep of file.deps) {\n        if (isArray(dep.registryUrls)) {\n          dep.registryUrls = dep.registryUrls.map((url) =>\n            detach(url, datasourceHostTypes(customRegistryDatasources([dep]))),\n          );\n        }\n      }\n    }\n  }\n  return hadCredentials;\n}\n\nasync function fetchVulnerabilities(\n  config: RenovateConfig,\n  packageFiles: Record<string, PackageFile[]>,\n): Promise<void> {\n  if (config.osvVulnerabilityAlerts) {\n    logger.debug('fetchVulnerabilities() - osvVulnerabilityAlerts=true');\n    try {\n      const vulnerabilities = await Vulnerabilities.create();\n      await vulnerabilities.appendVulnerabilityPackageRules(\n        config,\n        packageFiles,\n      );\n    } catch (err) {\n      logger.warn({ err }, 'Unable to read vulnerability information');\n    }\n  }\n}\n\nexport async function lookup(\n  config: RenovateConfig,\n  packageFiles: Record<string, PackageFile[]>,\n): Promise<ExtractResult> {\n  await fetchVulnerabilities(config, packageFiles);\n  await fetchUpdates(config, packageFiles);\n  // call this twice, as the second time, the updates will be availalbe for malicious package checks\n  // TODO: this will be refactored as part of #42423\n  await fetchVulnerabilities(config, packageFiles);\n  memCache.cleanDatasourceKeys();\n  calculateLibYears(config, packageFiles);\n  const { branches, branchList } = await branchifyUpgrades(\n    config,\n    packageFiles,\n  );\n  reportMaliciousSkippedDependencies(packageFiles);\n  logger.debug(\n    { baseBranch: config.baseBranch, config: packageFiles },\n    'packageFiles with updates',\n  );\n  sortBranches(branches);\n  return { branches, branchList, packageFiles };\n}\n\nexport function reportMaliciousSkippedDependencies(\n  allPackageFiles: Record<string, PackageFile[]>,\n): void {\n  if (allPackageFiles === undefined) {\n    return;\n  }\n\n  for (const [manager, packageFiles] of Object.entries(allPackageFiles)) {\n    for (const packageFile of packageFiles) {\n      for (const dep of packageFile.deps) {\n        if (dep.skipReason === 'malicious-version-in-use') {\n          logger.warn(\n            {\n              packageFile: packageFile.packageFile,\n              depName: dep.depName,\n              packageName: dep.packageName,\n              manager: manager,\n              datasource: dep.datasource,\n            },\n            'Dependency is currently using a malicious version',\n          );\n\n          // and make sure that it then gets updates proposed in the update phase\n          delete dep.skipReason;\n          delete dep.skipStage;\n        } else if (dep.skipReason === 'malicious-update-proposed') {\n          const newVersions = dep.updates\n            ?.map((u) => u.newVersion ?? u.newValue)\n            .filter(isNotNullOrUndefined);\n          logger.warn(\n            {\n              packageFile: packageFile.packageFile,\n              depName: dep.depName,\n              packageName: dep.packageName,\n              manager: manager,\n              datasource: dep.datasource,\n              newVersions,\n            },\n            'Dependency has update(s) proposed which would update you to a malicious version - skipping',\n          );\n        }\n      }\n    }\n  }\n}\n\nexport function update(\n  config: RenovateConfig,\n  branches: BranchConfig[],\n): Promise<WriteUpdateResult> {\n  return writeUpdates(config, branches);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,SAAS,aACP,cACc;CACd,IAAI,CAAC,cACH,OAAO;CAET,MAAM,QAAe;EACnB,UAAU,CAAC;EACX,OAAO;GACL,WAAW;GACX,UAAU;EACZ;CACF;CACA,KAAK,MAAM,CAAC,SAAS,wBAAwB,OAAO,QAAQ,YAAY,GAAG;EACzE,MAAM,YAAY,oBAAoB;EACtC,IAAI,WAAW;EACf,KAAK,MAAM,QAAQ,qBACjB,YAAY,KAAK,KAAK;EAExB,MAAM,SAAS,WAAW;GACxB;GACA;EACF;EACA,MAAM,MAAM,aAAa;EACzB,MAAM,MAAM,YAAY;CAC1B;CACA,OAAO;AACT;AAEA,SAAgB,oBACd,eACA,YACA,eACS;CACT,IAAI,CAAC,eACH,OAAO;CAGT,IAAI,CAAC,cAAc,UAAU;EAC3B,OAAO,MAAM,uDAAuD;EACpE,OAAO;CACT;CAEA,IAAI,cAAc,aAAA,GAAqC;EACrD,OAAO,MACL,2CAA2C,cAAc,SAAS,SACpE;EACA,OAAO;CACT;CAEA,IAAI,EAAE,cAAc,OAAO,cAAc,aACvC,OAAO;CAET,IAAI,cAAc,QAAQ,eAAe;EACvC,OAAO,MACL,2EAA2E,cAAc,IAAI,QAAQ,cAAc,EACrH;EACA,OAAO;CACT;CACA,IAAI,cAAc,eAAe,YAAY;EAC3C,OAAO,MAAM,2DAA2D;EACxE,OAAO;CACT;CACA,IAAI,CAAC,cAAc,wBAAwB;EACzC,OAAO,MACL,qEACF;EACA,OAAO;CACT;CACA,MAAM,kCAAkB,IAAI,IAAI;CAChC,KAAK,MAAM,CAAC,SAAS,gBAAgB,OAAO,QAC1C,cAAc,sBAChB,GACE,IAAI,gBAAgB,QAAQ,IAAI,OAAO,GACrC,gBAAgB,IAAI,OAAO;CAG/B,IAAI,gBAAgB,OAAO,GAAG;EAC5B,OAAO,MACL,EAAE,iBAAiB,CAAC,GAAG,eAAe,EAAE,GACxC,qEACF;EACA,OAAO;CACT;CACA,IAAI,uBAAuB,cAAc,YAAY,GAAG;EACtD,OAAO,MAAM,6DAA6D;EAC1E,OAAO;CACT;CACA,OAAO,MACL,0BAA0B,cAAc,0BAC1C;CACA,OAAO;AACT;AAEA,eAAsB,QACpB,QACA,iBAAiB,MACuB;CACxC,OAAO,MAAM,WAAW;CACxB,MAAM,EAAE,eAAe;CACvB,MAAM,gBAAgB,MAAM,IAAI,gBAAgB,UAAW;CAC3D,IAAI;CACJ,MAAM,QAAQ,SAAS;CACvB,MAAM,SAAS,CAAC;CAChB,MAAM,gBAAgB,MAAM,KAAK;CACjC,MAAM,aAAa,WAAW,qBAC5B,YAAY,0BAA0B,MAAM,CAAC,CAC/C;CACA,IACE,kBACA,oBAAoB,eAAgB,YAAY,aAAa,GAC7D;EACA,IAAI,mBAAmB,cAAc,YAAY,GAE/C,MAAM,WACJ,kBACA,YAAY,MAAM,IAAI,eAAe,UAAW,CAClD;EAGF,eAAe,MAAM,UAAU,MAAM,cAAc,YAAY,GAAG,MAAM;CAC1E,OAAO;EACL,MAAM,WACJ,kBACA,YAAY,MAAM,IAAI,eAAe,UAAW,CAClD;EACA,MAAM,gBAAgB,MAAM,WAC1B,0BACA,YAAa,MAAM,uBAAuB,MAAM,KAAM,CAAC,CACzD;EACA,eAAe,cAAc;EAC7B,MAAM,EAAE,2BAA2B;EAEnC,MAAM,6BACJ,6BAA6B,YAAY;EAE3C,MAAM,qBAAqB,iBACvB,aAAa,YAAY,IACzB,KAAA;EAEJ,SAAS,iBAA0B;GACjC,OACE,8BAA8B,uBAAuB,kBAAkB;EAE3E;EAGA,IAF0B,kBAAkB,eAAe,GAEpC;GACrB,OAAO,KAAK,KACV,EAAE,WAAW,GACb,2IACF;GACA,OAAO,MAAM,KAAK;EACpB,OAAO,IAAI,oBAET,MAAM,KAAK,cAAe;GACxB,UAAA;GACA,KAAK;GACL;GACA;GAEA,cAAc,MAAM,kBAAkB;EACxC;EAIF,MAAM,eAAe,gBAAgB,OAAO,YAAY,IACpD,OAAO,eACP,CAAC,UAAU;EACf,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,eAAe;GAC9C,IAAI,CAAC,aAAa,SAAS,UAAU,GACnC,OAAO,MAAM,KAAM;EAEvB,CAAC;CACH;CACA,MAAM,QAAQ,aAAa,YAAY;CACvC,OAAO,KACL;EAAE,YAAY,OAAO;EAAY;CAAM,GACvC,gCACF;CACA,OAAO,MAAM,EAAE,QAAQ,aAAa,GAAG,cAAc;CACrD,iBAAkB,YAAY;CAC9B,OAAO;AACT;;;;AAKA,SAAS,oBAAoB,aAA+C;CAC1E,MAAM,YAAY,YACf,OAAO,QAAQ,CAAC,CAChB,KAAK,eAAe,sBAAsB,UAAU,CAAC,CAAC,CACtD,OAAO,QAAQ;CAClB,OAAO,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;AAC/B;;;;AAKA,SAAS,0BACP,MAIU;CACV,OAAO,KACJ,QAAQ,EAAE,YAAY,aAAa,cAClC,iBAAiB,cAAc,EAAE,CAAC,EAAE,uBAClC,eAAe,WAAW,EAC5B,CACF,CAAC,CACA,KAAK,EAAE,iBAAiB,UAAW;AACxC;;;;;;AAOA,SAAS,6BACP,cACS;CACT,IAAI,iBAAiB;CAErB,SAAS,OAAO,KAAa,WAA6B;EAExD,IAAI,CAAC,SAAS,GAAG,GACf,OAAO;EAET,mBAAmB,UAAU,SAAS,KAAK,kBAAkB,GAAG;EAChE,OAAO,qBAAqB,KAAK,SAAS;CAC5C;CAGA,KAAK,MAAM,SAAS,OAAO,OAAO,aAAa,YAAY,CAAC,GAC1D,KAAK,MAAM,QAAQ,OAAO;EAExB,MAAM,YAAY,oBAChB,0BAA0B,CACxB,EAAE,YAAY,KAAK,WAAW,GAC9B,GAAG,KAAK,IACV,CAAC,CACH;EAEA,IAAI,QAAQ,KAAK,YAAY,GAC3B,KAAK,eAAe,KAAK,aAAa,KAAK,QACzC,OAAO,KAAK,SAAS,CACvB;EAEF,IAAI,QAAQ,KAAK,sBAAsB,GACrC,KAAK,yBAAyB,KAAK,uBAAuB,KAAK,QAC7D,OAAO,KAAK,SAAS,CACvB;EAEF,KAAK,MAAM,OAAO,KAAK,MACrB,IAAI,QAAQ,IAAI,YAAY,GAC1B,IAAI,eAAe,IAAI,aAAa,KAAK,QACvC,OAAO,KAAK,oBAAoB,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CACnE;CAGN;CAEF,OAAO;AACT;AAEA,eAAe,qBACb,QACA,cACe;CACf,IAAI,OAAO,wBAAwB;EACjC,OAAO,MAAM,sDAAsD;EACnE,IAAI;GAEF,OAAM,MADwB,gBAAgB,OAAO,EAAA,CAC/B,gCACpB,QACA,YACF;EACF,SAAS,KAAK;GACZ,OAAO,KAAK,EAAE,IAAI,GAAG,0CAA0C;EACjE;CACF;AACF;AAEA,eAAsB,OACpB,QACA,cACwB;CACxB,MAAM,qBAAqB,QAAQ,YAAY;CAC/C,MAAM,aAAa,QAAQ,YAAY;CAGvC,MAAM,qBAAqB,QAAQ,YAAY;CAC/C,oBAA6B;CAC7B,kBAAkB,QAAQ,YAAY;CACtC,MAAM,EAAE,UAAU,eAAe,MAAM,kBACrC,QACA,YACF;CACA,mCAAmC,YAAY;CAC/C,OAAO,MACL;EAAE,YAAY,OAAO;EAAY,QAAQ;CAAa,GACtD,2BACF;CACA,aAAa,QAAQ;CACrB,OAAO;EAAE;EAAU;EAAY;CAAa;AAC9C;AAEA,SAAgB,mCACd,iBACM;CACN,IAAI,oBAAoB,KAAA,GACtB;CAGF,KAAK,MAAM,CAAC,SAAS,iBAAiB,OAAO,QAAQ,eAAe,GAClE,KAAK,MAAM,eAAe,cACxB,KAAK,MAAM,OAAO,YAAY,MAC5B,IAAI,IAAI,eAAe,4BAA4B;EACjD,OAAO,KACL;GACE,aAAa,YAAY;GACzB,SAAS,IAAI;GACb,aAAa,IAAI;GACR;GACT,YAAY,IAAI;EAClB,GACA,mDACF;EAGA,OAAO,IAAI;EACX,OAAO,IAAI;CACb,OAAO,IAAI,IAAI,eAAe,6BAA6B;EACzD,MAAM,cAAc,IAAI,SACpB,KAAK,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CACvC,OAAO,oBAAoB;EAC9B,OAAO,KACL;GACE,aAAa,YAAY;GACzB,SAAS,IAAI;GACb,aAAa,IAAI;GACR;GACT,YAAY,IAAI;GAChB;EACF,GACA,4FACF;CACF;AAIR;AAEA,SAAgB,OACd,QACA,UAC4B;CAC5B,OAAO,aAAa,QAAQ,QAAQ;AACtC"}

package/dist/workers/repository/process/lookup/digest.js

@@ -94,8 +94,9 @@ async function resolveUpdateDigest(config, res, dependency, update) {
 * `registryUrl`) for every update.
 */
 async function resolveUpdateDigests(config, res, dependency) {
+	const isPinnedByUs = config.pinDigests === true && !config.digestManagedExternally;
 	for (const update of res.updates) {
-		if (config.pinDigests === true && !config.digestManagedExternally || config.currentDigest) await resolveUpdateDigest(config, res, dependency, update);
+		if (isPinnedByUs || config.currentDigest) await resolveUpdateDigest(config, res, dependency, update);
 		else delete update.newDigest;
 		if (update.newVersion) {
 			const registryUrl = dependency?.releases?.find((release) => release.version === update.newVersion)?.registryUrl;

package/dist/workers/repository/process/lookup/digest.js.map

@@ -1 +1 @@
-{"version":3,"file":"digest.js","names":[],"sources":["../../../../../lib/workers/repository/process/lookup/digest.ts"],"sourcesContent":["import { isNonEmptyString } from '@sindresorhus/is';\nimport { mergeChildConfig } from '../../../../config/index.ts';\nimport { logger } from '../../../../logger/index.ts';\nimport type {\n  GetDigestInputConfig,\n  ReleaseResult,\n} from '../../../../modules/datasource/index.ts';\nimport { getDigest } from '../../../../modules/datasource/index.ts';\nimport type { LookupUpdate } from '../../../../modules/manager/types.ts';\nimport { checkMinimumReleaseAge } from '../../../../util/minimum-release-age.ts';\nimport type { Timestamp } from '../../../../util/timestamp.ts';\nimport { withoutUrlCredentials } from '../../../../util/url.ts';\nimport {\n  missingReleaseTimestampWarning,\n  resolveUpdateTypeConfig,\n} from './filter-checks.ts';\nimport type { LookupUpdateConfig, UpdateResult } from './types.ts';\n\n/** The only two `updateType`s that `applyMinimumReleaseAgeToDigestUpdate()` can be called with */\nexport type DigestLikeUpdate = LookupUpdate & {\n  updateType: 'digest' | 'pinDigest';\n};\n\n/**\n * A helper function to allow a short-circuit for `minimumReleaseAge` functionality if a package may have config that applies it.\n *\n * Allows avoiding unnecessary calls to more expensive checks like merge + `applyPackageRules()` and `getTimestamp()`.\n */\nexport function couldApplyMinimumReleaseAgeToDigest(\n  config: LookupUpdateConfig,\n  updateType: DigestLikeUpdate['updateType'],\n): boolean {\n  // Match filterInternalChecks(): under `none` the user opted out of internal\n  // checks entirely, so do no merging, no package rules, no age check and no\n  // logging claiming an age check ran.\n  if (config.internalChecksFilter === 'none') {\n    return false;\n  }\n\n  return (\n    isNonEmptyString(config.minimumReleaseAge) ||\n    isNonEmptyString(config[updateType]?.minimumReleaseAge) ||\n    !!config.packageRules?.some((rule) =>\n      isNonEmptyString(rule.minimumReleaseAge),\n    )\n  );\n}\n\n/**\n * Ensure `minimumReleaseAge`/`internalChecksFilter` applies to digest/pinDigest updates, as they don't currently get run through `filterInternalChecks()`.\n */\nexport async function applyMinimumReleaseAgeToDigestUpdate(\n  update: DigestLikeUpdate,\n  config: LookupUpdateConfig,\n  res: UpdateResult,\n  currentVersionWasResolved: boolean,\n  newestMatchingVersionTimestamp: Timestamp | null | undefined,\n): Promise<void> {\n  if (!couldApplyMinimumReleaseAgeToDigest(config, update.updateType)) {\n    return;\n  }\n\n  if (update.updateType === 'pinDigest' && !currentVersionWasResolved) {\n    // Not `!res.currentVersion` - that's force-set to lockedVersion further down regardless of timestamp resolution.\n    // `pinDigest` doesn't repoint anywhere, unlike `digest` - it just freezes whatever the ref already resolves to.\n    // An unversioned tag (e.g. `latest`) has no versioned release to age against, and holding the pin would only\n    // prolong the less-pinned (less safe) state, so skip the check entirely rather than treating the missing\n    // timestamp as pending.\n    logger.once.debug(\n      { depName: config.depName, updateType: update.updateType },\n      `Skipping minimumReleaseAge check for ${update.updateType} update of ${config.depName}, as its current value does not resolve to a versioned release`,\n    );\n    return;\n  }\n\n  const releaseConfig = await resolveUpdateTypeConfig(\n    mergeChildConfig(config, res),\n    update.updateType,\n  );\n\n  // Not update.releaseTimestamp - that field means \"age of the new release\" elsewhere (generate.ts, libyear.ts).\n  // Not res.currentVersionTimestamp either - that tracks whatever rangeStrategy resolves currentVersion to (e.g.\n  // the oldest matching release under `bump`), whereas both `digest` and `pinDigest` reflect whatever the current\n  // value's ref actually resolves to *right now*, which is always the newest matching version.\n  const ageCheck = checkMinimumReleaseAge(\n    releaseConfig,\n    newestMatchingVersionTimestamp,\n  );\n\n  // Mirror filterInternalChecks()'s logging so a held/passed digest update is diagnosable.\n  if (ageCheck.minimumReleaseAgeMs && !ageCheck.hasTimestamp) {\n    if (releaseConfig.minimumReleaseAgeBehaviour === 'timestamp-optional') {\n      logger.once.warn(missingReleaseTimestampWarning);\n    }\n\n    logger.once.debug(\n      {\n        depName: config.depName,\n        updateType: update.updateType,\n        minimumReleaseAgeBehaviour: releaseConfig.minimumReleaseAgeBehaviour,\n        check: 'minimumReleaseAge',\n      },\n      `${update.updateType} update of ${config.depName} has no releaseTimestamp to age against`,\n    );\n  }\n  if (ageCheck.isPending) {\n    logger.trace(\n      {\n        depName: config.depName,\n        updateType: update.updateType,\n        releaseTimestamp: newestMatchingVersionTimestamp,\n        check: 'minimumReleaseAge',\n      },\n      `${update.updateType} update is pending minimumReleaseAge status checks`,\n    );\n\n    // internalChecksFilter is read from the unmerged top-level config, like filterInternalChecks().\n    if (config.internalChecksFilter === 'strict') {\n      update.pendingChecks = true;\n    }\n  }\n}\n\nfunction getDigestInputConfig(\n  config: LookupUpdateConfig,\n  res: UpdateResult,\n  update: LookupUpdate,\n): GetDigestInputConfig {\n  const getDigestConfig: GetDigestInputConfig = {\n    ...config,\n    registryUrl: update.registryUrl ?? res.registryUrl,\n    lookupName: res.lookupName,\n  };\n\n  // #20304 only pass it for replacement updates, otherwise we get wrong or invalid digest\n  if (update.updateType !== 'replacement') {\n    delete getDigestConfig.replacementName;\n  }\n\n  // #20304 don't use lookupName and currentDigest when we replace image name\n  if (\n    update.updateType === 'replacement' &&\n    update.newName !== config.packageName\n  ) {\n    delete getDigestConfig.lookupName;\n    delete getDigestConfig.currentDigest;\n    getDigestConfig.replacementName = update.newName;\n  }\n\n  return getDigestConfig;\n}\n\nasync function resolveUpdateDigest(\n  config: LookupUpdateConfig,\n  res: UpdateResult,\n  dependency: ReleaseResult | null,\n  update: LookupUpdate,\n): Promise<void> {\n  // Don't use current releases if replacement changes name, otherwise we use the wrong new digest.\n  // This happens on datasources which return the digest in release info like `github-tags`.\n  // We can still use it when only version is changing.\n  if (\n    update.updateType !== 'replacement' ||\n    update.newName === config.packageName\n  ) {\n    update.newDigest ??= dependency?.releases.find(\n      (r) => r.version === update.newValue,\n    )?.newDigest;\n  }\n\n  update.newDigest ??= await getDigest(\n    getDigestInputConfig(config, res, update),\n    update.newValue,\n  );\n\n  // If the digest could not be determined, report this as otherwise the\n  // update will be omitted later on without notice.\n  if (update.newDigest === null) {\n    logger.debug(\n      {\n        packageName: config.packageName,\n        currentValue: config.currentValue,\n        datasource: config.datasource,\n        newValue: update.newValue,\n        bucket: update.bucket,\n      },\n      'Could not determine new digest for update.',\n    );\n\n    // A tag such as `v1.2.3` is commonly referenced without its `v` prefix, which we treat as a misconfiguration rather than silently retrying with the prefix\n    if (\n      update.newValue &&\n      dependency?.releases.some((r) => r.version === `v${update.newValue}`)\n    ) {\n      logger.warn(\n        {\n          packageName: config.packageName,\n          datasource: config.datasource,\n          newValue: update.newValue,\n          suggestedValue: `v${update.newValue}`,\n        },\n        'Could not determine new digest for update. Check the tag in the `newValue` - did you maybe mean the `suggestedValue`, with a `v` prefix?',\n      );\n    }\n\n    // Only report a warning if there is a current digest.\n    // Context: https://github.com/renovatebot/renovate/pull/20175#discussion_r1102615059.\n    if (config.currentDigest) {\n      const packageName = withoutUrlCredentials(config.packageName);\n      res.warnings.push({\n        message: `Could not determine new digest for update (${config.datasource} package ${packageName})`,\n        topic: packageName,\n      });\n    }\n  }\n}\n\n/**\n * Fill in `newDigest` (and, where a release came from another registry,\n * `registryUrl`) for every update.\n */\nexport async function resolveUpdateDigests(\n  config: LookupUpdateConfig,\n  res: UpdateResult,\n  dependency: ReleaseResult | null,\n): Promise<void> {\n  for (const update of res.updates) {\n    // only update the digest in the package file if it's managed by us\n    if (\n      (config.pinDigests === true && !config.digestManagedExternally) ||\n      config.currentDigest\n    ) {\n      await resolveUpdateDigest(config, res, dependency, update);\n    } else {\n      delete update.newDigest;\n    }\n\n    if (update.newVersion) {\n      const registryUrl = dependency?.releases?.find(\n        (release) => release.version === update.newVersion,\n      )?.registryUrl;\n      if (registryUrl && registryUrl !== res.registryUrl) {\n        update.registryUrl = registryUrl;\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AA4BA,SAAgB,oCACd,QACA,YACS;CAIT,IAAI,OAAO,yBAAyB,QAClC,OAAO;CAGT,OACE,iBAAiB,OAAO,iBAAiB,KACzC,iBAAiB,OAAO,WAAW,EAAE,iBAAiB,KACtD,CAAC,CAAC,OAAO,cAAc,MAAM,SAC3B,iBAAiB,KAAK,iBAAiB,CACzC;AAEJ;;;;AAKA,eAAsB,qCACpB,QACA,QACA,KACA,2BACA,gCACe;CACf,IAAI,CAAC,oCAAoC,QAAQ,OAAO,UAAU,GAChE;CAGF,IAAI,OAAO,eAAe,eAAe,CAAC,2BAA2B;EAMnE,OAAO,KAAK,MACV;GAAE,SAAS,OAAO;GAAS,YAAY,OAAO;EAAW,GACzD,wCAAwC,OAAO,WAAW,aAAa,OAAO,QAAQ,+DACxF;EACA;CACF;CAEA,MAAM,gBAAgB,MAAM,wBAC1B,iBAAiB,QAAQ,GAAG,GAC5B,OAAO,UACT;CAMA,MAAM,WAAW,uBACf,eACA,8BACF;CAGA,IAAI,SAAS,uBAAuB,CAAC,SAAS,cAAc;EAC1D,IAAI,cAAc,+BAA+B,sBAC/C,OAAO,KAAK,KAAK,8BAA8B;EAGjD,OAAO,KAAK,MACV;GACE,SAAS,OAAO;GAChB,YAAY,OAAO;GACnB,4BAA4B,cAAc;GAC1C,OAAO;EACT,GACA,GAAG,OAAO,WAAW,aAAa,OAAO,QAAQ,wCACnD;CACF;CACA,IAAI,SAAS,WAAW;EACtB,OAAO,MACL;GACE,SAAS,OAAO;GAChB,YAAY,OAAO;GACnB,kBAAkB;GAClB,OAAO;EACT,GACA,GAAG,OAAO,WAAW,mDACvB;EAGA,IAAI,OAAO,yBAAyB,UAClC,OAAO,gBAAgB;CAE3B;AACF;AAEA,SAAS,qBACP,QACA,KACA,QACsB;CACtB,MAAM,kBAAwC;EAC5C,GAAG;EACH,aAAa,OAAO,eAAe,IAAI;EACvC,YAAY,IAAI;CAClB;CAGA,IAAI,OAAO,eAAe,eACxB,OAAO,gBAAgB;CAIzB,IACE,OAAO,eAAe,iBACtB,OAAO,YAAY,OAAO,aAC1B;EACA,OAAO,gBAAgB;EACvB,OAAO,gBAAgB;EACvB,gBAAgB,kBAAkB,OAAO;CAC3C;CAEA,OAAO;AACT;AAEA,eAAe,oBACb,QACA,KACA,YACA,QACe;CAIf,IACE,OAAO,eAAe,iBACtB,OAAO,YAAY,OAAO,aAE1B,OAAO,cAAc,YAAY,SAAS,MACvC,MAAM,EAAE,YAAY,OAAO,QAC9B,CAAC,EAAE;CAGL,OAAO,cAAc,MAAM,UACzB,qBAAqB,QAAQ,KAAK,MAAM,GACxC,OAAO,QACT;CAIA,IAAI,OAAO,cAAc,MAAM;EAC7B,OAAO,MACL;GACE,aAAa,OAAO;GACpB,cAAc,OAAO;GACrB,YAAY,OAAO;GACnB,UAAU,OAAO;GACjB,QAAQ,OAAO;EACjB,GACA,4CACF;EAGA,IACE,OAAO,YACP,YAAY,SAAS,MAAM,MAAM,EAAE,YAAY,IAAI,OAAO,UAAU,GAEpE,OAAO,KACL;GACE,aAAa,OAAO;GACpB,YAAY,OAAO;GACnB,UAAU,OAAO;GACjB,gBAAgB,IAAI,OAAO;EAC7B,GACA,0IACF;EAKF,IAAI,OAAO,eAAe;GACxB,MAAM,cAAc,sBAAsB,OAAO,WAAW;GAC5D,IAAI,SAAS,KAAK;IAChB,SAAS,8CAA8C,OAAO,WAAW,WAAW,YAAY;IAChG,OAAO;GACT,CAAC;EACH;CACF;AACF;;;;;AAMA,eAAsB,qBACpB,QACA,KACA,YACe;CACf,KAAK,MAAM,UAAU,IAAI,SAAS;EAEhC,IACG,OAAO,eAAe,QAAQ,CAAC,OAAO,2BACvC,OAAO,eAEP,MAAM,oBAAoB,QAAQ,KAAK,YAAY,MAAM;OAEzD,OAAO,OAAO;EAGhB,IAAI,OAAO,YAAY;GACrB,MAAM,cAAc,YAAY,UAAU,MACvC,YAAY,QAAQ,YAAY,OAAO,UAC1C,CAAC,EAAE;GACH,IAAI,eAAe,gBAAgB,IAAI,aACrC,OAAO,cAAc;EAEzB;CACF;AACF"}
+{"version":3,"file":"digest.js","names":[],"sources":["../../../../../lib/workers/repository/process/lookup/digest.ts"],"sourcesContent":["import { isNonEmptyString } from '@sindresorhus/is';\nimport { mergeChildConfig } from '../../../../config/index.ts';\nimport { logger } from '../../../../logger/index.ts';\nimport type {\n  GetDigestInputConfig,\n  ReleaseResult,\n} from '../../../../modules/datasource/index.ts';\nimport { getDigest } from '../../../../modules/datasource/index.ts';\nimport type { LookupUpdate } from '../../../../modules/manager/types.ts';\nimport { checkMinimumReleaseAge } from '../../../../util/minimum-release-age.ts';\nimport type { Timestamp } from '../../../../util/timestamp.ts';\nimport { withoutUrlCredentials } from '../../../../util/url.ts';\nimport {\n  missingReleaseTimestampWarning,\n  resolveUpdateTypeConfig,\n} from './filter-checks.ts';\nimport type { LookupUpdateConfig, UpdateResult } from './types.ts';\n\n/** The only two `updateType`s that `applyMinimumReleaseAgeToDigestUpdate()` can be called with */\nexport type DigestLikeUpdate = LookupUpdate & {\n  updateType: 'digest' | 'pinDigest';\n};\n\n/**\n * A helper function to allow a short-circuit for `minimumReleaseAge` functionality if a package may have config that applies it.\n *\n * Allows avoiding unnecessary calls to more expensive checks like merge + `applyPackageRules()` and `getTimestamp()`.\n */\nexport function couldApplyMinimumReleaseAgeToDigest(\n  config: LookupUpdateConfig,\n  updateType: DigestLikeUpdate['updateType'],\n): boolean {\n  // Match filterInternalChecks(): under `none` the user opted out of internal\n  // checks entirely, so do no merging, no package rules, no age check and no\n  // logging claiming an age check ran.\n  if (config.internalChecksFilter === 'none') {\n    return false;\n  }\n\n  return (\n    isNonEmptyString(config.minimumReleaseAge) ||\n    isNonEmptyString(config[updateType]?.minimumReleaseAge) ||\n    !!config.packageRules?.some((rule) =>\n      isNonEmptyString(rule.minimumReleaseAge),\n    )\n  );\n}\n\n/**\n * Ensure `minimumReleaseAge`/`internalChecksFilter` applies to digest/pinDigest updates, as they don't currently get run through `filterInternalChecks()`.\n */\nexport async function applyMinimumReleaseAgeToDigestUpdate(\n  update: DigestLikeUpdate,\n  config: LookupUpdateConfig,\n  res: UpdateResult,\n  currentVersionWasResolved: boolean,\n  newestMatchingVersionTimestamp: Timestamp | null | undefined,\n): Promise<void> {\n  if (!couldApplyMinimumReleaseAgeToDigest(config, update.updateType)) {\n    return;\n  }\n\n  if (update.updateType === 'pinDigest' && !currentVersionWasResolved) {\n    // Not `!res.currentVersion` - that's force-set to lockedVersion further down regardless of timestamp resolution.\n    // `pinDigest` doesn't repoint anywhere, unlike `digest` - it just freezes whatever the ref already resolves to.\n    // An unversioned tag (e.g. `latest`) has no versioned release to age against, and holding the pin would only\n    // prolong the less-pinned (less safe) state, so skip the check entirely rather than treating the missing\n    // timestamp as pending.\n    logger.once.debug(\n      { depName: config.depName, updateType: update.updateType },\n      `Skipping minimumReleaseAge check for ${update.updateType} update of ${config.depName}, as its current value does not resolve to a versioned release`,\n    );\n    return;\n  }\n\n  const releaseConfig = await resolveUpdateTypeConfig(\n    mergeChildConfig(config, res),\n    update.updateType,\n  );\n\n  // Not update.releaseTimestamp - that field means \"age of the new release\" elsewhere (generate.ts, libyear.ts).\n  // Not res.currentVersionTimestamp either - that tracks whatever rangeStrategy resolves currentVersion to (e.g.\n  // the oldest matching release under `bump`), whereas both `digest` and `pinDigest` reflect whatever the current\n  // value's ref actually resolves to *right now*, which is always the newest matching version.\n  const ageCheck = checkMinimumReleaseAge(\n    releaseConfig,\n    newestMatchingVersionTimestamp,\n  );\n\n  // Mirror filterInternalChecks()'s logging so a held/passed digest update is diagnosable.\n  if (ageCheck.minimumReleaseAgeMs && !ageCheck.hasTimestamp) {\n    if (releaseConfig.minimumReleaseAgeBehaviour === 'timestamp-optional') {\n      logger.once.warn(missingReleaseTimestampWarning);\n    }\n\n    logger.once.debug(\n      {\n        depName: config.depName,\n        updateType: update.updateType,\n        minimumReleaseAgeBehaviour: releaseConfig.minimumReleaseAgeBehaviour,\n        check: 'minimumReleaseAge',\n      },\n      `${update.updateType} update of ${config.depName} has no releaseTimestamp to age against`,\n    );\n  }\n  if (ageCheck.isPending) {\n    logger.trace(\n      {\n        depName: config.depName,\n        updateType: update.updateType,\n        releaseTimestamp: newestMatchingVersionTimestamp,\n        check: 'minimumReleaseAge',\n      },\n      `${update.updateType} update is pending minimumReleaseAge status checks`,\n    );\n\n    // internalChecksFilter is read from the unmerged top-level config, like filterInternalChecks().\n    if (config.internalChecksFilter === 'strict') {\n      update.pendingChecks = true;\n    }\n  }\n}\n\nfunction getDigestInputConfig(\n  config: LookupUpdateConfig,\n  res: UpdateResult,\n  update: LookupUpdate,\n): GetDigestInputConfig {\n  const getDigestConfig: GetDigestInputConfig = {\n    ...config,\n    registryUrl: update.registryUrl ?? res.registryUrl,\n    lookupName: res.lookupName,\n  };\n\n  // #20304 only pass it for replacement updates, otherwise we get wrong or invalid digest\n  if (update.updateType !== 'replacement') {\n    delete getDigestConfig.replacementName;\n  }\n\n  // #20304 don't use lookupName and currentDigest when we replace image name\n  if (\n    update.updateType === 'replacement' &&\n    update.newName !== config.packageName\n  ) {\n    delete getDigestConfig.lookupName;\n    delete getDigestConfig.currentDigest;\n    getDigestConfig.replacementName = update.newName;\n  }\n\n  return getDigestConfig;\n}\n\nasync function resolveUpdateDigest(\n  config: LookupUpdateConfig,\n  res: UpdateResult,\n  dependency: ReleaseResult | null,\n  update: LookupUpdate,\n): Promise<void> {\n  // Don't use current releases if replacement changes name, otherwise we use the wrong new digest.\n  // This happens on datasources which return the digest in release info like `github-tags`.\n  // We can still use it when only version is changing.\n  if (\n    update.updateType !== 'replacement' ||\n    update.newName === config.packageName\n  ) {\n    update.newDigest ??= dependency?.releases.find(\n      (r) => r.version === update.newValue,\n    )?.newDigest;\n  }\n\n  update.newDigest ??= await getDigest(\n    getDigestInputConfig(config, res, update),\n    update.newValue,\n  );\n\n  // If the digest could not be determined, report this as otherwise the\n  // update will be omitted later on without notice.\n  if (update.newDigest === null) {\n    logger.debug(\n      {\n        packageName: config.packageName,\n        currentValue: config.currentValue,\n        datasource: config.datasource,\n        newValue: update.newValue,\n        bucket: update.bucket,\n      },\n      'Could not determine new digest for update.',\n    );\n\n    // A tag such as `v1.2.3` is commonly referenced without its `v` prefix, which we treat as a misconfiguration rather than silently retrying with the prefix\n    if (\n      update.newValue &&\n      dependency?.releases.some((r) => r.version === `v${update.newValue}`)\n    ) {\n      logger.warn(\n        {\n          packageName: config.packageName,\n          datasource: config.datasource,\n          newValue: update.newValue,\n          suggestedValue: `v${update.newValue}`,\n        },\n        'Could not determine new digest for update. Check the tag in the `newValue` - did you maybe mean the `suggestedValue`, with a `v` prefix?',\n      );\n    }\n\n    // Only report a warning if there is a current digest.\n    // Context: https://github.com/renovatebot/renovate/pull/20175#discussion_r1102615059.\n    if (config.currentDigest) {\n      const packageName = withoutUrlCredentials(config.packageName);\n      res.warnings.push({\n        message: `Could not determine new digest for update (${config.datasource} package ${packageName})`,\n        topic: packageName,\n      });\n    }\n  }\n}\n\n/**\n * Fill in `newDigest` (and, where a release came from another registry,\n * `registryUrl`) for every update.\n */\nexport async function resolveUpdateDigests(\n  config: LookupUpdateConfig,\n  res: UpdateResult,\n  dependency: ReleaseResult | null,\n): Promise<void> {\n  const isPinnedByUs =\n    config.pinDigests === true && !config.digestManagedExternally;\n  for (const update of res.updates) {\n    // only update the digest in the package file if it's managed by us\n    if (isPinnedByUs || config.currentDigest) {\n      await resolveUpdateDigest(config, res, dependency, update);\n    } else {\n      delete update.newDigest;\n    }\n\n    if (update.newVersion) {\n      const registryUrl = dependency?.releases?.find(\n        (release) => release.version === update.newVersion,\n      )?.registryUrl;\n      if (registryUrl && registryUrl !== res.registryUrl) {\n        update.registryUrl = registryUrl;\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AA4BA,SAAgB,oCACd,QACA,YACS;CAIT,IAAI,OAAO,yBAAyB,QAClC,OAAO;CAGT,OACE,iBAAiB,OAAO,iBAAiB,KACzC,iBAAiB,OAAO,WAAW,EAAE,iBAAiB,KACtD,CAAC,CAAC,OAAO,cAAc,MAAM,SAC3B,iBAAiB,KAAK,iBAAiB,CACzC;AAEJ;;;;AAKA,eAAsB,qCACpB,QACA,QACA,KACA,2BACA,gCACe;CACf,IAAI,CAAC,oCAAoC,QAAQ,OAAO,UAAU,GAChE;CAGF,IAAI,OAAO,eAAe,eAAe,CAAC,2BAA2B;EAMnE,OAAO,KAAK,MACV;GAAE,SAAS,OAAO;GAAS,YAAY,OAAO;EAAW,GACzD,wCAAwC,OAAO,WAAW,aAAa,OAAO,QAAQ,+DACxF;EACA;CACF;CAEA,MAAM,gBAAgB,MAAM,wBAC1B,iBAAiB,QAAQ,GAAG,GAC5B,OAAO,UACT;CAMA,MAAM,WAAW,uBACf,eACA,8BACF;CAGA,IAAI,SAAS,uBAAuB,CAAC,SAAS,cAAc;EAC1D,IAAI,cAAc,+BAA+B,sBAC/C,OAAO,KAAK,KAAK,8BAA8B;EAGjD,OAAO,KAAK,MACV;GACE,SAAS,OAAO;GAChB,YAAY,OAAO;GACnB,4BAA4B,cAAc;GAC1C,OAAO;EACT,GACA,GAAG,OAAO,WAAW,aAAa,OAAO,QAAQ,wCACnD;CACF;CACA,IAAI,SAAS,WAAW;EACtB,OAAO,MACL;GACE,SAAS,OAAO;GAChB,YAAY,OAAO;GACnB,kBAAkB;GAClB,OAAO;EACT,GACA,GAAG,OAAO,WAAW,mDACvB;EAGA,IAAI,OAAO,yBAAyB,UAClC,OAAO,gBAAgB;CAE3B;AACF;AAEA,SAAS,qBACP,QACA,KACA,QACsB;CACtB,MAAM,kBAAwC;EAC5C,GAAG;EACH,aAAa,OAAO,eAAe,IAAI;EACvC,YAAY,IAAI;CAClB;CAGA,IAAI,OAAO,eAAe,eACxB,OAAO,gBAAgB;CAIzB,IACE,OAAO,eAAe,iBACtB,OAAO,YAAY,OAAO,aAC1B;EACA,OAAO,gBAAgB;EACvB,OAAO,gBAAgB;EACvB,gBAAgB,kBAAkB,OAAO;CAC3C;CAEA,OAAO;AACT;AAEA,eAAe,oBACb,QACA,KACA,YACA,QACe;CAIf,IACE,OAAO,eAAe,iBACtB,OAAO,YAAY,OAAO,aAE1B,OAAO,cAAc,YAAY,SAAS,MACvC,MAAM,EAAE,YAAY,OAAO,QAC9B,CAAC,EAAE;CAGL,OAAO,cAAc,MAAM,UACzB,qBAAqB,QAAQ,KAAK,MAAM,GACxC,OAAO,QACT;CAIA,IAAI,OAAO,cAAc,MAAM;EAC7B,OAAO,MACL;GACE,aAAa,OAAO;GACpB,cAAc,OAAO;GACrB,YAAY,OAAO;GACnB,UAAU,OAAO;GACjB,QAAQ,OAAO;EACjB,GACA,4CACF;EAGA,IACE,OAAO,YACP,YAAY,SAAS,MAAM,MAAM,EAAE,YAAY,IAAI,OAAO,UAAU,GAEpE,OAAO,KACL;GACE,aAAa,OAAO;GACpB,YAAY,OAAO;GACnB,UAAU,OAAO;GACjB,gBAAgB,IAAI,OAAO;EAC7B,GACA,0IACF;EAKF,IAAI,OAAO,eAAe;GACxB,MAAM,cAAc,sBAAsB,OAAO,WAAW;GAC5D,IAAI,SAAS,KAAK;IAChB,SAAS,8CAA8C,OAAO,WAAW,WAAW,YAAY;IAChG,OAAO;GACT,CAAC;EACH;CACF;AACF;;;;;AAMA,eAAsB,qBACpB,QACA,KACA,YACe;CACf,MAAM,eACJ,OAAO,eAAe,QAAQ,CAAC,OAAO;CACxC,KAAK,MAAM,UAAU,IAAI,SAAS;EAEhC,IAAI,gBAAgB,OAAO,eACzB,MAAM,oBAAoB,QAAQ,KAAK,YAAY,MAAM;OAEzD,OAAO,OAAO;EAGhB,IAAI,OAAO,YAAY;GACrB,MAAM,cAAc,YAAY,UAAU,MACvC,YAAY,QAAQ,YAAY,OAAO,UAC1C,CAAC,EAAE;GACH,IAAI,eAAe,gBAAgB,IAAI,aACrC,OAAO,cAAc;EAEzB;CACF;AACF"}

package/dist/workers/repository/process/lookup/generate.js

@@ -60,7 +60,7 @@ async function generateUpdate(config, currentValue, versioningApi, rangeStrategy
 	const { datasource, packageName, packageRules } = config;
 	if (packageRules?.some((pr) => isNonEmptyArray(pr.matchConfidence))) update.mergeConfidenceLevel = await getMergeConfidenceLevel(datasource, packageName, currentVersion, newVersion, update.updateType);
 	if (!versioningApi.isVersion(update.newValue)) update.isRange = true;
-	if ((config.isLockfileOnly || rangeStrategy === "update-lockfile") && currentValue === update.newValue) update.isLockfileUpdate = true;
+	if ((config.isLockfileOnly === true || rangeStrategy === "update-lockfile") && currentValue === update.newValue) update.isLockfileUpdate = true;
 	if (rangeStrategy === "bump" && versioningApi.matches(newVersion, currentValue)) update.isBump = true;
 	return update;
 }

package/dist/workers/repository/process/lookup/generate.js.map

@@ -1 +1 @@
-{"version":3,"file":"generate.js","names":[],"sources":["../../../../../lib/workers/repository/process/lookup/generate.ts"],"sourcesContent":["import { isNonEmptyArray } from '@sindresorhus/is';\nimport { logger } from '../../../../logger/index.ts';\nimport type { Release } from '../../../../modules/datasource/index.ts';\nimport type { LookupUpdate } from '../../../../modules/manager/types.ts';\nimport type { VersioningApi } from '../../../../modules/versioning/index.ts';\nimport type { RangeStrategy } from '../../../../types/index.ts';\nimport { getElapsedDays } from '../../../../util/date.ts';\nimport { getMergeConfidenceLevel } from '../../../../util/merge-confidence/index.ts';\nimport type { LookupUpdateConfig } from './types.ts';\nimport { classifyRelease } from './update-type.ts';\n\nexport async function generateUpdate(\n  config: LookupUpdateConfig,\n  currentValue: string | undefined,\n  versioningApi: VersioningApi,\n  rangeStrategy: RangeStrategy,\n  currentVersion: string,\n  bucket: string,\n  release: Release,\n  allVersions: Set<string>,\n): Promise<LookupUpdate> {\n  const newVersion = release.version;\n  const update: LookupUpdate = {\n    bucket,\n    newVersion,\n    newValue: null!,\n    hasAttestation: release.attestation,\n  };\n\n  if (release.checksumUrl !== undefined) {\n    update.checksumUrl = release.checksumUrl;\n  }\n  if (release.downloadUrl !== undefined) {\n    update.downloadUrl = release.downloadUrl;\n  }\n  if (release.newDigest !== undefined) {\n    update.newDigest = release.newDigest;\n  }\n  if (release.releaseTimestamp) {\n    update.releaseTimestamp = release.releaseTimestamp;\n    update.newVersionAgeInDays = getElapsedDays(release.releaseTimestamp);\n  }\n  if (release.registryUrl !== undefined) {\n    /**\n     * This means:\n     *  - registry strategy is set to merge\n     *  - releases were fetched from multiple registry urls\n     */\n    update.registryUrl = release.registryUrl;\n  }\n\n  if (currentValue) {\n    try {\n      if (config.isLockfileOnly) {\n        update.newValue = currentValue;\n      } else {\n        update.newValue = versioningApi.getNewValue({\n          currentValue,\n          rangeStrategy,\n          currentVersion,\n          newVersion,\n          allVersions,\n        })!;\n      }\n    } catch (err) {\n      logger.warn(\n        { err, currentValue, rangeStrategy, currentVersion, newVersion },\n        'getNewValue error',\n      );\n      update.newValue = currentValue;\n    }\n  } else {\n    update.newValue = currentValue;\n  }\n  update.newMajor = versioningApi.getMajor(newVersion)!;\n  update.newMinor = versioningApi.getMinor(newVersion)!;\n  update.newPatch = versioningApi.getPatch(newVersion)!;\n  if (!update.updateType && !currentVersion) {\n    logger.debug({ update }, 'Update has no currentVersion');\n    update.newValue = currentValue!;\n    return update;\n  }\n  update.updateType =\n    update.updateType ??\n    classifyRelease(versioningApi, currentVersion, newVersion);\n  if (versioningApi.isBreaking) {\n    // This versioning scheme has breaking awareness\n    update.isBreaking = versioningApi.isBreaking(currentVersion, newVersion);\n  } else {\n    // This versioning scheme does not have breaking awareness - assume only major updates are breaking\n    // Updates from, or to, unstable releases should be treated as breaking too.\n    // But we should not add that as default behavior until we stop treating non-LTS versions as unstable first\n    update.isBreaking = update.updateType === 'major';\n  }\n  const { datasource, packageName, packageRules } = config;\n  if (packageRules?.some((pr) => isNonEmptyArray(pr.matchConfidence))) {\n    update.mergeConfidenceLevel = await getMergeConfidenceLevel(\n      datasource,\n      packageName,\n      currentVersion,\n      newVersion,\n      update.updateType,\n    );\n  }\n  if (!versioningApi.isVersion(update.newValue)) {\n    update.isRange = true;\n  }\n  if (\n    (config.isLockfileOnly || rangeStrategy === 'update-lockfile') &&\n    currentValue === update.newValue\n  ) {\n    update.isLockfileUpdate = true;\n  }\n  if (\n    rangeStrategy === 'bump' &&\n    // TODO #22198\n    versioningApi.matches(newVersion, currentValue!)\n  ) {\n    update.isBump = true;\n  }\n  return update;\n}\n"],"mappings":";;;;;;AAWA,eAAsB,eACpB,QACA,cACA,eACA,eACA,gBACA,QACA,SACA,aACuB;CACvB,MAAM,aAAa,QAAQ;CAC3B,MAAM,SAAuB;EAC3B;EACA;EACA,UAAU;EACV,gBAAgB,QAAQ;CAC1B;CAEA,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,OAAO,cAAc,QAAQ;CAE/B,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,OAAO,cAAc,QAAQ;CAE/B,IAAI,QAAQ,cAAc,KAAA,GACxB,OAAO,YAAY,QAAQ;CAE7B,IAAI,QAAQ,kBAAkB;EAC5B,OAAO,mBAAmB,QAAQ;EAClC,OAAO,sBAAsB,eAAe,QAAQ,gBAAgB;CACtE;CACA,IAAI,QAAQ,gBAAgB,KAAA;;;;;;CAM1B,OAAO,cAAc,QAAQ;CAG/B,IAAI,cACF,IAAI;EACF,IAAI,OAAO,gBACT,OAAO,WAAW;OAElB,OAAO,WAAW,cAAc,YAAY;GAC1C;GACA;GACA;GACA;GACA;EACF,CAAC;CAEL,SAAS,KAAK;EACZ,OAAO,KACL;GAAE;GAAK;GAAc;GAAe;GAAgB;EAAW,GAC/D,mBACF;EACA,OAAO,WAAW;CACpB;MAEA,OAAO,WAAW;CAEpB,OAAO,WAAW,cAAc,SAAS,UAAU;CACnD,OAAO,WAAW,cAAc,SAAS,UAAU;CACnD,OAAO,WAAW,cAAc,SAAS,UAAU;CACnD,IAAI,CAAC,OAAO,cAAc,CAAC,gBAAgB;EACzC,OAAO,MAAM,EAAE,OAAO,GAAG,8BAA8B;EACvD,OAAO,WAAW;EAClB,OAAO;CACT;CACA,OAAO,aACL,OAAO,cACP,gBAAgB,eAAe,gBAAgB,UAAU;CAC3D,IAAI,cAAc,YAEhB,OAAO,aAAa,cAAc,WAAW,gBAAgB,UAAU;MAKvE,OAAO,aAAa,OAAO,eAAe;CAE5C,MAAM,EAAE,YAAY,aAAa,iBAAiB;CAClD,IAAI,cAAc,MAAM,OAAO,gBAAgB,GAAG,eAAe,CAAC,GAChE,OAAO,uBAAuB,MAAM,wBAClC,YACA,aACA,gBACA,YACA,OAAO,UACT;CAEF,IAAI,CAAC,cAAc,UAAU,OAAO,QAAQ,GAC1C,OAAO,UAAU;CAEnB,KACG,OAAO,kBAAkB,kBAAkB,sBAC5C,iBAAiB,OAAO,UAExB,OAAO,mBAAmB;CAE5B,IACE,kBAAkB,UAElB,cAAc,QAAQ,YAAY,YAAa,GAE/C,OAAO,SAAS;CAElB,OAAO;AACT"}
+{"version":3,"file":"generate.js","names":[],"sources":["../../../../../lib/workers/repository/process/lookup/generate.ts"],"sourcesContent":["import { isNonEmptyArray } from '@sindresorhus/is';\nimport { logger } from '../../../../logger/index.ts';\nimport type { Release } from '../../../../modules/datasource/index.ts';\nimport type { LookupUpdate } from '../../../../modules/manager/types.ts';\nimport type { VersioningApi } from '../../../../modules/versioning/index.ts';\nimport type { RangeStrategy } from '../../../../types/index.ts';\nimport { getElapsedDays } from '../../../../util/date.ts';\nimport { getMergeConfidenceLevel } from '../../../../util/merge-confidence/index.ts';\nimport type { LookupUpdateConfig } from './types.ts';\nimport { classifyRelease } from './update-type.ts';\n\nexport async function generateUpdate(\n  config: LookupUpdateConfig,\n  currentValue: string | undefined,\n  versioningApi: VersioningApi,\n  rangeStrategy: RangeStrategy,\n  currentVersion: string,\n  bucket: string,\n  release: Release,\n  allVersions: Set<string>,\n): Promise<LookupUpdate> {\n  const newVersion = release.version;\n  const update: LookupUpdate = {\n    bucket,\n    newVersion,\n    newValue: null!,\n    hasAttestation: release.attestation,\n  };\n\n  if (release.checksumUrl !== undefined) {\n    update.checksumUrl = release.checksumUrl;\n  }\n  if (release.downloadUrl !== undefined) {\n    update.downloadUrl = release.downloadUrl;\n  }\n  if (release.newDigest !== undefined) {\n    update.newDigest = release.newDigest;\n  }\n  if (release.releaseTimestamp) {\n    update.releaseTimestamp = release.releaseTimestamp;\n    update.newVersionAgeInDays = getElapsedDays(release.releaseTimestamp);\n  }\n  if (release.registryUrl !== undefined) {\n    /**\n     * This means:\n     *  - registry strategy is set to merge\n     *  - releases were fetched from multiple registry urls\n     */\n    update.registryUrl = release.registryUrl;\n  }\n\n  if (currentValue) {\n    try {\n      if (config.isLockfileOnly) {\n        update.newValue = currentValue;\n      } else {\n        update.newValue = versioningApi.getNewValue({\n          currentValue,\n          rangeStrategy,\n          currentVersion,\n          newVersion,\n          allVersions,\n        })!;\n      }\n    } catch (err) {\n      logger.warn(\n        { err, currentValue, rangeStrategy, currentVersion, newVersion },\n        'getNewValue error',\n      );\n      update.newValue = currentValue;\n    }\n  } else {\n    update.newValue = currentValue;\n  }\n  update.newMajor = versioningApi.getMajor(newVersion)!;\n  update.newMinor = versioningApi.getMinor(newVersion)!;\n  update.newPatch = versioningApi.getPatch(newVersion)!;\n  if (!update.updateType && !currentVersion) {\n    logger.debug({ update }, 'Update has no currentVersion');\n    update.newValue = currentValue!;\n    return update;\n  }\n  update.updateType =\n    update.updateType ??\n    classifyRelease(versioningApi, currentVersion, newVersion);\n  if (versioningApi.isBreaking) {\n    // This versioning scheme has breaking awareness\n    update.isBreaking = versioningApi.isBreaking(currentVersion, newVersion);\n  } else {\n    // This versioning scheme does not have breaking awareness - assume only major updates are breaking\n    // Updates from, or to, unstable releases should be treated as breaking too.\n    // But we should not add that as default behavior until we stop treating non-LTS versions as unstable first\n    update.isBreaking = update.updateType === 'major';\n  }\n  const { datasource, packageName, packageRules } = config;\n  if (packageRules?.some((pr) => isNonEmptyArray(pr.matchConfidence))) {\n    update.mergeConfidenceLevel = await getMergeConfidenceLevel(\n      datasource,\n      packageName,\n      currentVersion,\n      newVersion,\n      update.updateType,\n    );\n  }\n  if (!versioningApi.isVersion(update.newValue)) {\n    update.isRange = true;\n  }\n  const isLockfileStrategy =\n    config.isLockfileOnly === true || rangeStrategy === 'update-lockfile';\n  if (isLockfileStrategy && currentValue === update.newValue) {\n    update.isLockfileUpdate = true;\n  }\n  if (\n    rangeStrategy === 'bump' &&\n    // TODO #22198\n    versioningApi.matches(newVersion, currentValue!)\n  ) {\n    update.isBump = true;\n  }\n  return update;\n}\n"],"mappings":";;;;;;AAWA,eAAsB,eACpB,QACA,cACA,eACA,eACA,gBACA,QACA,SACA,aACuB;CACvB,MAAM,aAAa,QAAQ;CAC3B,MAAM,SAAuB;EAC3B;EACA;EACA,UAAU;EACV,gBAAgB,QAAQ;CAC1B;CAEA,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,OAAO,cAAc,QAAQ;CAE/B,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,OAAO,cAAc,QAAQ;CAE/B,IAAI,QAAQ,cAAc,KAAA,GACxB,OAAO,YAAY,QAAQ;CAE7B,IAAI,QAAQ,kBAAkB;EAC5B,OAAO,mBAAmB,QAAQ;EAClC,OAAO,sBAAsB,eAAe,QAAQ,gBAAgB;CACtE;CACA,IAAI,QAAQ,gBAAgB,KAAA;;;;;;CAM1B,OAAO,cAAc,QAAQ;CAG/B,IAAI,cACF,IAAI;EACF,IAAI,OAAO,gBACT,OAAO,WAAW;OAElB,OAAO,WAAW,cAAc,YAAY;GAC1C;GACA;GACA;GACA;GACA;EACF,CAAC;CAEL,SAAS,KAAK;EACZ,OAAO,KACL;GAAE;GAAK;GAAc;GAAe;GAAgB;EAAW,GAC/D,mBACF;EACA,OAAO,WAAW;CACpB;MAEA,OAAO,WAAW;CAEpB,OAAO,WAAW,cAAc,SAAS,UAAU;CACnD,OAAO,WAAW,cAAc,SAAS,UAAU;CACnD,OAAO,WAAW,cAAc,SAAS,UAAU;CACnD,IAAI,CAAC,OAAO,cAAc,CAAC,gBAAgB;EACzC,OAAO,MAAM,EAAE,OAAO,GAAG,8BAA8B;EACvD,OAAO,WAAW;EAClB,OAAO;CACT;CACA,OAAO,aACL,OAAO,cACP,gBAAgB,eAAe,gBAAgB,UAAU;CAC3D,IAAI,cAAc,YAEhB,OAAO,aAAa,cAAc,WAAW,gBAAgB,UAAU;MAKvE,OAAO,aAAa,OAAO,eAAe;CAE5C,MAAM,EAAE,YAAY,aAAa,iBAAiB;CAClD,IAAI,cAAc,MAAM,OAAO,gBAAgB,GAAG,eAAe,CAAC,GAChE,OAAO,uBAAuB,MAAM,wBAClC,YACA,aACA,gBACA,YACA,OAAO,UACT;CAEF,IAAI,CAAC,cAAc,UAAU,OAAO,QAAQ,GAC1C,OAAO,UAAU;CAInB,KADE,OAAO,mBAAmB,QAAQ,kBAAkB,sBAC5B,iBAAiB,OAAO,UAChD,OAAO,mBAAmB;CAE5B,IACE,kBAAkB,UAElB,cAAc,QAAQ,YAAY,YAAa,GAE/C,OAAO,SAAS;CAElB,OAAO;AACT"}

package/dist/workers/repository/process/lookup/index.js

@@ -143,7 +143,10 @@ async function lookupUpdates(inconfig) {
 					});
 					return Result.ok(res);
 				}
-				allVersions = allVersions.filter((v) => v.version === taggedVersion || v.version === compareValue && versioningApi.isGreaterThan(taggedVersion, compareValue));
+				allVersions = allVersions.filter((v) => {
+					if (v.version === taggedVersion) return true;
+					return v.version === compareValue && versioningApi.isGreaterThan(taggedVersion, compareValue);
+				});
 			}
 			const inRangeOnlyStrategy = config.rangeStrategy === "in-range-only";
 			const allSatisfyingVersions = (inRangeOnlyStrategy || config.rollbackPrs) && !unconstrainedValue ? allVersions.filter((v) => versioningApi.matches(v.version, compareValue)) : allVersions;

package/dist/workers/repository/process/lookup/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["allVersioning.get"],"sources":["../../../../../lib/workers/repository/process/lookup/index.ts"],"sourcesContent":["import { isNonEmptyString, isString, isUndefined } from '@sindresorhus/is';\nimport { mergeChildConfig } from '../../../../config/index.ts';\nimport type { ValidationMessage } from '../../../../config/types.ts';\nimport { CONFIG_VALIDATION } from '../../../../constants/error-messages.ts';\nimport { logger } from '../../../../logger/index.ts';\nimport {\n  getDatasourceFor,\n  getDefaultVersioning,\n} from '../../../../modules/datasource/common.ts';\nimport type {\n  Release,\n  ReleaseResult,\n} from '../../../../modules/datasource/index.ts';\nimport {\n  applyDatasourceFilters,\n  getRawPkgReleases,\n  isGetPkgReleasesConfig,\n  supportsDigests,\n} from '../../../../modules/datasource/index.ts';\nimport { postprocessRelease } from '../../../../modules/datasource/postprocess-release.ts';\nimport { isPseudoVersion } from '../../../../modules/versioning/gomod/index.ts';\nimport * as allVersioning from '../../../../modules/versioning/index.ts';\nimport { ExternalHostError } from '../../../../types/errors/external-host-error.ts';\nimport { assignKeys } from '../../../../util/assign-keys.ts';\nimport { getElapsedDays } from '../../../../util/date.ts';\nimport { applyPackageRules } from '../../../../util/package-rules/index.ts';\nimport { regEx } from '../../../../util/regex.ts';\nimport { Result } from '../../../../util/result.ts';\nimport { safeStringify } from '../../../../util/stringify.ts';\nimport type { Timestamp } from '../../../../util/timestamp.ts';\nimport { withoutUrlCredentials } from '../../../../util/url.ts';\nimport { calculateAbandonment } from './abandonment.ts';\nimport { groupReleasesIntoBuckets } from './bucket.ts';\nimport { getNewestMatchingVersion, resolveCurrentVersion } from './current.ts';\nimport type { DigestLikeUpdate } from './digest.ts';\nimport {\n  applyMinimumReleaseAgeToDigestUpdate,\n  couldApplyMinimumReleaseAgeToDigest,\n  resolveUpdateDigests,\n} from './digest.ts';\nimport { filterVersions } from './filter.ts';\nimport { filterInternalChecks } from './filter-checks.ts';\nimport { generateUpdate } from './generate.ts';\nimport { resolveRangeStrategy } from './range-strategy.ts';\nimport { getRollbackUpdate } from './rollback.ts';\nimport { calculateMostRecentTimestamp } from './timestamps.ts';\nimport type { LookupUpdateConfig, UpdateResult } from './types.ts';\nimport {\n  addReplacementUpdateIfValid,\n  isReplacementRulesConfigured,\n  stripNoopUpdates,\n} from './utils.ts';\nimport {\n  matchVersionCompatibility,\n  restoreVersionCompatibility,\n} from './version-compatibility.ts';\nimport { applyVulnerabilityFixFilter } from './vulnerability.ts';\n\nasync function getTimestamp(\n  config: LookupUpdateConfig,\n  versions: Release[],\n  version: string,\n  versioningApi: allVersioning.VersioningApi,\n): Promise<Timestamp | null | undefined> {\n  const currentRelease = versions.find(\n    (v) =>\n      versioningApi.isValid(v.version) &&\n      versioningApi.equals(v.version, version),\n  );\n\n  if (!currentRelease) {\n    return null;\n  }\n\n  if (currentRelease.releaseTimestamp) {\n    return currentRelease.releaseTimestamp;\n  }\n\n  const remoteRelease = await postprocessRelease(config, currentRelease);\n  return remoteRelease?.releaseTimestamp;\n}\n\nexport async function lookupUpdates(\n  inconfig: LookupUpdateConfig,\n): Promise<Result<UpdateResult>> {\n  let config: LookupUpdateConfig = { ...inconfig };\n  config.versioning ??= getDefaultVersioning(config.datasource);\n\n  const versioningApi = allVersioning.get(config.versioning);\n\n  let dependency: ReleaseResult | null = null;\n  const res: UpdateResult = {\n    versioning: config.versioning,\n    updates: [],\n    warnings: [],\n  };\n  // Timestamp of the release a `digest`/`pinDigest` update's current value currently resolves to (the newest version matching it, regardless of `rangeStrategy`), as opposed to `res.currentVersionTimestamp` which tracks whatever the configured rangeStrategy resolves `currentVersion` to (e.g. the oldest for `bump`)\n  let newestMatchingVersionTimestamp: Timestamp | null | undefined;\n  // The `digest` update for `config.currentDigest` (if one is added), so its age check can run after `newDigest` is fetched and no-op updates are stripped.\n  let digestUpdate: DigestLikeUpdate | undefined;\n\n  try {\n    logger.trace(\n      {\n        dependency: config.packageName,\n        currentValue: config.currentValue,\n      },\n      'lookupUpdates',\n    );\n    if (config.currentValue && !isString(config.currentValue)) {\n      // If currentValue is not a string, then it's invalid\n      logger.debug(\n        `Invalid currentValue for ${config.packageName}: ${safeStringify(config.currentValue)} (${typeof config.currentValue})`,\n      );\n      res.skipReason = 'invalid-value';\n      return Result.ok(res);\n    }\n    if (!isGetPkgReleasesConfig(config)) {\n      res.skipReason = 'invalid-config';\n      return Result.ok(res);\n    }\n    if (!getDatasourceFor(config.datasource)) {\n      res.skipReason = 'invalid-config';\n      const packageName = withoutUrlCredentials(config.packageName);\n      res.warnings.push({\n        topic: packageName,\n        message: `Unknown datasource \"${config.datasource}\" for package ${packageName}`,\n      });\n      return Result.ok(res);\n    }\n    let compareValue =\n      config.isLockfileOnly && config.lockedVersion\n        ? config.lockedVersion\n        : config.currentValue;\n    const versionCompatibilityMatch = matchVersionCompatibility(config);\n    if (versionCompatibilityMatch) {\n      compareValue = versionCompatibilityMatch.compareValue;\n      config.currentCompatibility =\n        versionCompatibilityMatch.currentCompatibility;\n      res.currentCompatibility = versionCompatibilityMatch.currentCompatibility;\n    }\n\n    const isValid =\n      isString(compareValue) && versioningApi.isValid(compareValue);\n\n    const unconstrainedValue =\n      !!config.lockedVersion && isUndefined(config.currentValue);\n\n    if (isValid || unconstrainedValue) {\n      if (\n        !config.updatePinnedDependencies &&\n        !config.isLockfileOnly &&\n        // TODO #22198\n        versioningApi.isSingleVersion(compareValue!)\n      ) {\n        res.skipReason = 'is-pinned';\n        return Result.ok(res);\n      }\n\n      const { val: releaseResult, err: lookupError } = await getRawPkgReleases(\n        config,\n      )\n        .transform((res) => calculateMostRecentTimestamp(versioningApi, res))\n        .transform((res) => calculateAbandonment(res, config))\n        .transform((res) => applyDatasourceFilters(res, config))\n        .unwrap();\n\n      if (lookupError instanceof Error) {\n        throw lookupError;\n      }\n\n      if (lookupError) {\n        // If dependency lookup fails then warn and return\n        const packageName = withoutUrlCredentials(config.packageName);\n        const warning: ValidationMessage = {\n          topic: packageName,\n          message: `Failed to look up ${config.datasource} package ${packageName}: ${lookupError}`,\n        };\n        logger.debug(\n          {\n            dependency: config.packageName,\n            packageFile: config.packageFile,\n          },\n          warning.message,\n        );\n        // TODO: return warnings in own field\n        res.warnings.push(warning);\n        return Result.ok(res);\n      }\n\n      dependency = releaseResult;\n\n      if (dependency.deprecationMessage) {\n        logger.debug(\n          `Found deprecationMessage for ${config.datasource} package ${config.packageName}`,\n        );\n      }\n\n      assignKeys(res, dependency, [\n        'deprecationMessage',\n        'sourceUrl',\n        'registryUrl',\n        'effectiveDatasource',\n        'sourceDirectory',\n        'homepage',\n        'changelogUrl',\n        'dependencyUrl',\n        'lookupName',\n        'packageScope',\n        'mostRecentTimestamp',\n        'isAbandoned',\n        'respectLatest',\n      ]);\n\n      const latestVersion = dependency.tags?.latest;\n      // Filter out any results from datasource that don't comply with our versioning\n      let allVersions = dependency.releases.filter((release) =>\n        versioningApi.isVersion(release.version),\n      );\n      const allReleaseVersions = new Set(allVersions.map((r) => r.version));\n      // The datasources used in these tests always return at least one\n      // version-like release, so neither this block nor the currentDigest\n      // check inside it is reached. A lookup whose releases are all\n      // unversioned tags does not get here either - with a digest configured\n      // it takes the digest-only path above instead - see #40625\n      // istanbul ignore if\n      if (allVersions.length === 0) {\n        const message = `Found no results from datasource that look like a version`;\n        logger.info(\n          {\n            dependency: config.packageName,\n            result: dependency,\n          },\n          message,\n        );\n        if (!config.currentDigest) {\n          return Result.ok(res);\n        }\n      }\n      // Reapply package rules in case we missed something from sourceUrl\n      config = await applyPackageRules(\n        {\n          ...config,\n          sourceUrl: res.sourceUrl,\n          effectiveDatasource: res.effectiveDatasource,\n        },\n        'source-url',\n      );\n      if (config.followTag) {\n        const taggedVersion = dependency.tags?.[config.followTag];\n        if (!taggedVersion) {\n          const packageName = withoutUrlCredentials(config.packageName);\n          res.warnings.push({\n            topic: packageName,\n            message: `Can't find version with tag ${config.followTag} for ${config.datasource} package ${packageName}`,\n          });\n          return Result.ok(res);\n        }\n        allVersions = allVersions.filter(\n          (v) =>\n            v.version === taggedVersion ||\n            (v.version === compareValue &&\n              versioningApi.isGreaterThan(taggedVersion, compareValue)),\n        );\n      }\n\n      const inRangeOnlyStrategy = config.rangeStrategy === 'in-range-only';\n      // Check that existing constraint can be satisfied\n      const allSatisfyingVersions =\n        (inRangeOnlyStrategy || config.rollbackPrs) && !unconstrainedValue\n          ? allVersions.filter((v) =>\n              // TODO #22198\n              versioningApi.matches(v.version, compareValue!),\n            )\n          : allVersions;\n      if (!allSatisfyingVersions.length) {\n        logger.debug(\n          `Found no satisfying versions with '${config.versioning}' versioning`,\n        );\n      }\n\n      if (config.rollbackPrs && !allSatisfyingVersions.length) {\n        const rollback = getRollbackUpdate(config, allVersions, versioningApi);\n        // istanbul ignore if\n        if (!rollback) {\n          const packageName = withoutUrlCredentials(config.packageName);\n          res.warnings.push({\n            topic: packageName,\n            // TODO: types (#22198)\n            message: `Can't find version matching ${compareValue!} for ${\n              config.datasource\n            } package ${packageName}`,\n          });\n          return Result.ok(res);\n        }\n        res.updates.push(rollback);\n      }\n      let rangeStrategy = resolveRangeStrategy(config);\n\n      const currentVersion = resolveCurrentVersion(\n        compareValue,\n        config.lockedVersion,\n        versioningApi,\n        rangeStrategy,\n        latestVersion,\n        allVersions,\n      );\n\n      if (!currentVersion) {\n        // v8 ignore else -- TODO: add test #40625\n        if (!config.lockedVersion) {\n          logger.debug(\n            `No currentVersion or lockedVersion found for ${config.packageName}`,\n          );\n          res.skipReason = 'invalid-value';\n        }\n        return Result.ok(res);\n      }\n\n      res.currentVersion = currentVersion;\n\n      // Use lockedVersion for the timestamp lookup when available, because\n      // res.currentVersion is later overwritten to lockedVersion (see below).\n      // Without this, strategies like \"replace\" would compute the timestamp\n      // for the highest satisfying version (e.g. 1.4.1) while the reported\n      // currentVersion ends up being the locked one (e.g. 1.0.0).\n      const versionForTimestamp = config.lockedVersion ?? currentVersion;\n      const currentVersionTimestamp = await getTimestamp(\n        config,\n        allVersions,\n        versionForTimestamp,\n        versioningApi,\n      );\n\n      if (isNonEmptyString(currentVersionTimestamp)) {\n        res.currentVersionTimestamp = currentVersionTimestamp;\n        res.currentVersionAgeInDays = getElapsedDays(currentVersionTimestamp);\n\n        if (\n          config.packageRules?.some((rule) =>\n            isNonEmptyString(rule.matchCurrentAge),\n          )\n        ) {\n          // Reapply package rules to check matches for matchCurrentAge\n          config = await applyPackageRules(\n            { ...config, currentVersionTimestamp },\n            'current-timestamp',\n          );\n        }\n      }\n\n      if (\n        config.currentDigest\n          ? couldApplyMinimumReleaseAgeToDigest(config, 'digest')\n          : config.pinDigests &&\n            couldApplyMinimumReleaseAgeToDigest(config, 'pinDigest')\n      ) {\n        const newestMatchingVersion = getNewestMatchingVersion(\n          compareValue,\n          versioningApi,\n          latestVersion,\n          allVersions,\n        );\n        if (newestMatchingVersion) {\n          newestMatchingVersionTimestamp = await getTimestamp(\n            config,\n            allVersions,\n            newestMatchingVersion,\n            versioningApi,\n          );\n        }\n      }\n\n      if (\n        compareValue &&\n        currentVersion &&\n        rangeStrategy === 'pin' &&\n        !versioningApi.isSingleVersion(compareValue)\n      ) {\n        const newValue =\n          versioningApi.getPinnedValue?.(currentVersion) ?? currentVersion;\n        res.updates.push({\n          updateType: 'pin',\n          isPin: true,\n          newValue,\n          newVersion: currentVersion,\n          newMajor: versioningApi.getMajor(currentVersion)!,\n        });\n      }\n      if (rangeStrategy === 'pin') {\n        // Fall back to replace once pinning logic is done\n        rangeStrategy = 'replace';\n      }\n      // A non-version can only get this far via a locked version under\n      // rangeStrategy=pin, but the timestamp lookup above calls `equals()` on\n      // it first and throws - see #40625\n      // istanbul ignore if\n      if (!versioningApi.isVersion(currentVersion)) {\n        res.skipReason = 'invalid-version';\n        return Result.ok(res);\n      }\n      // Filter latest, unstable, etc\n      // TODO #22198\n      let filteredReleases = filterVersions(\n        config,\n        currentVersion,\n        latestVersion!,\n        inRangeOnlyStrategy ? allSatisfyingVersions : allVersions,\n        versioningApi,\n      ).filter((v) => {\n        if (config.isLockfileOnly) {\n          return true;\n        }\n\n        // Leave only compatible versions\n        return (\n          unconstrainedValue ||\n          versioningApi.isCompatible(v.version, compareValue)\n        );\n      });\n      const vulnerabilityFix = applyVulnerabilityFixFilter(\n        config,\n        res,\n        versioningApi,\n        filteredReleases,\n      );\n      filteredReleases = vulnerabilityFix.releases;\n      const { shrinkedViaVulnerability } = vulnerabilityFix;\n\n      const buckets = groupReleasesIntoBuckets(\n        config,\n        currentVersion,\n        filteredReleases,\n        versioningApi,\n      );\n      const depResultConfig = mergeChildConfig(config, res);\n      for (const [bucket, releases] of Object.entries(buckets)) {\n        const sortedReleases = releases.sort((r1, r2) =>\n          versioningApi.sortVersions(r1.version, r2.version),\n        );\n        const { release, pendingChecks, pendingReleases } =\n          await filterInternalChecks(\n            depResultConfig,\n            versioningApi,\n            bucket,\n            sortedReleases,\n          );\n        // `filterInternalChecks()` normally yields a release, falling back to\n        // the newest pending one; only a datasource rejecting every candidate\n        // during postprocessing leaves none - see #40625\n        // istanbul ignore next\n        if (!release) {\n          return Result.ok(res);\n        }\n        const newVersion = release.version;\n        const update = await generateUpdate(\n          config,\n          config.isLockfileOnly ? config.currentValue : compareValue,\n          versioningApi,\n          // TODO #22198\n\n          rangeStrategy!,\n          config.lockedVersion ?? currentVersion,\n          bucket,\n          release,\n          allReleaseVersions,\n        );\n\n        // An update between two pseudo-versions of the same module changes the\n        // commit and nothing else, so it is a digest update - see #29034\n        if (\n          config.manager === 'gomod' &&\n          isPseudoVersion(compareValue) &&\n          isPseudoVersion(update.newValue) &&\n          config.currentDigest !== update.newDigest\n        ) {\n          update.updateType = 'digest';\n\n          // As this has already been processed by `filterInternalChecks()`, but we're changing the `updateType`, we need to apply the digest-scoped minimumReleaseAge rules.\n          // `currentVersionWasResolved` only matters for `pinDigest`, which `update.updateType` never is here - true is a safe constant.\n          await applyMinimumReleaseAgeToDigestUpdate(\n            update as DigestLikeUpdate,\n            config,\n            res,\n            true,\n            release.releaseTimestamp,\n          );\n        }\n\n        if (pendingChecks) {\n          update.pendingChecks = pendingChecks;\n        }\n\n        if (pendingReleases.length) {\n          update.pendingVersions = pendingReleases.map((r) => r.version);\n        }\n        if (!update.newValue || update.newValue === compareValue) {\n          if (!config.lockedVersion) {\n            continue;\n          }\n          // istanbul ignore if\n          if (rangeStrategy === 'bump') {\n            logger.trace(\n              {\n                packageName: config.packageName,\n                currentValue: config.currentValue,\n                lockedVersion: config.lockedVersion,\n                newVersion,\n              },\n              'Skipping bump because newValue is the same',\n            );\n            continue;\n          }\n          res.isSingleVersion = true;\n        }\n        res.isSingleVersion ??=\n          isString(update.newValue) &&\n          versioningApi.isSingleVersion(update.newValue);\n        // Nothing but a rollback should ever propose a lower version, so a\n        // downgrade means the lookup went wrong and the update is dropped - see\n        // #29921. A versioning which reports each value as greater than the\n        // other has no order between them (e.g. aws-machine-image relies on the\n        // datasource order), so no downgrade can be claimed.\n        if (\n          update.updateType !== 'rollback' &&\n          update.newValue &&\n          versioningApi.isVersion(update.newValue) &&\n          compareValue &&\n          versioningApi.isVersion(compareValue) &&\n          versioningApi.isGreaterThan(compareValue, update.newValue) &&\n          !versioningApi.isGreaterThan(update.newValue, compareValue)\n        ) {\n          logger.warn(\n            {\n              packageName: config.packageName,\n              currentValue: config.currentValue,\n              compareValue,\n              currentVersion: config.currentVersion,\n              update,\n              allVersionsLength: allVersions.length,\n              filteredReleaseVersions: filteredReleases.map((r) => r.version),\n              shrinkedViaVulnerability,\n            },\n            'Unexpected downgrade detected: skipping',\n          );\n        } else {\n          res.updates.push(update);\n        }\n      }\n    } else if (compareValue) {\n      logger.debug(\n        `Dependency ${config.packageName} has unsupported/unversioned value ${compareValue} (versioning=${config.versioning})`,\n      );\n\n      if (!config.pinDigests && !config.currentDigest) {\n        logger.debug(\n          `Skipping ${config.packageName} because no currentDigest or pinDigests`,\n        );\n        res.skipReason = 'invalid-value';\n      } else {\n        delete res.skipReason;\n      }\n    } else {\n      res.skipReason = 'invalid-value';\n    }\n\n    if (isReplacementRulesConfigured(config)) {\n      addReplacementUpdateIfValid(res.updates, config);\n    } else if (dependency?.replacementName && dependency.replacementVersion) {\n      res.updates.push({\n        updateType: 'replacement',\n        newName: dependency.replacementName,\n        newValue: dependency.replacementVersion,\n      });\n    }\n\n    // Record if the dep is fixed to a version\n    if (config.lockedVersion) {\n      res.currentVersion = config.lockedVersion;\n      res.fixedVersion = config.lockedVersion;\n    } else if (compareValue && versioningApi.isSingleVersion(compareValue)) {\n      res.fixedVersion = compareValue.replace(regEx(/^=+/), '');\n    }\n\n    // massage versionCompatibility\n    restoreVersionCompatibility(config, compareValue, res.updates);\n\n    // Add digests if necessary\n    if (supportsDigests(config.datasource)) {\n      if (config.currentDigest) {\n        if (!config.digestOneAndOnly || !res.updates.length) {\n          // digest update - age-checked after the strip below, once newDigest is known\n          digestUpdate = {\n            updateType: 'digest',\n            newValue: config.currentValue,\n          };\n          res.updates.push(digestUpdate);\n        }\n      } else if (\n        config.pinDigests &&\n        // only update the digest in the package file if it's managed by us\n        !config.digestManagedExternally &&\n        // Create a pin only if one doesn't already exists\n        // v8 ignore else -- TODO: add test #40625\n        !res.updates.some((update) => update.updateType === 'pin')\n      ) {\n        // pin digest\n        const pinDigestUpdate: DigestLikeUpdate = {\n          isPinDigest: true,\n          updateType: 'pinDigest',\n          newValue: config.currentValue,\n        };\n        await applyMinimumReleaseAgeToDigestUpdate(\n          pinDigestUpdate,\n          config,\n          res,\n          isValid || unconstrainedValue,\n          newestMatchingVersionTimestamp,\n        );\n        res.updates.push(pinDigestUpdate);\n      }\n      if (versioningApi.valueToVersion) {\n        // TODO #22198\n        res.currentVersion = versioningApi.valueToVersion(res.currentVersion!);\n        for (const update of res.updates) {\n          // TODO #22198\n          update.newVersion = versioningApi.valueToVersion(update.newVersion!);\n        }\n      }\n      if (res.registryUrl) {\n        config.registryUrls = [res.registryUrl];\n      }\n\n      // update digest for all\n      await resolveUpdateDigests(config, res, dependency);\n    }\n\n    if (res.updates.length) {\n      delete res.skipReason;\n    }\n    // Strip out any non-changed ones\n    res.updates = stripNoopUpdates(config, res.updates);\n\n    // If there is a digest update proposed which is in the pending updates for this dependency, ensure that `minimumReleaseAge` is applied.\n    // `currentVersionWasResolved` only matters for `pinDigest`, which `digestUpdate` never is - true is a safe constant.\n    if (digestUpdate && res.updates.includes(digestUpdate)) {\n      await applyMinimumReleaseAgeToDigestUpdate(\n        digestUpdate,\n        config,\n        res,\n        true,\n        newestMatchingVersionTimestamp,\n      );\n    }\n\n    const release =\n      res.updates.length > 0\n        ? (dependency?.releases.find(\n            (r) => r.version === res.updates[0].newValue,\n          ) ??\n          dependency?.releases.find(\n            (r) => r.version === res.updates[0].newVersion,\n          ))\n        : null;\n\n    if (release?.changelogContent) {\n      res.changelogContent = release.changelogContent;\n      res.changelogUrl = release.changelogUrl;\n    }\n  } catch (err) /* istanbul ignore next */ {\n    if (err instanceof ExternalHostError) {\n      return Result.err(err);\n    }\n\n    if (err instanceof Error && err.message === CONFIG_VALIDATION) {\n      return Result.err(err);\n    }\n\n    logger.error(\n      {\n        currentDigest: config.currentDigest,\n        currentValue: config.currentValue,\n        datasource: config.datasource,\n        packageName: config.packageName,\n        digestOneAndOnly: config.digestOneAndOnly,\n        followTag: config.followTag,\n        lockedVersion: config.lockedVersion,\n        packageFile: config.packageFile,\n        pinDigests: config.pinDigests,\n        rollbackPrs: config.rollbackPrs,\n        isVulnerabilityAlert: config.isVulnerabilityAlert,\n        updatePinnedDependencies: config.updatePinnedDependencies,\n        err,\n      },\n      'lookupUpdates error',\n    );\n    res.skipReason = 'internal-error';\n  }\n  return Result.ok(res);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DA,eAAe,aACb,QACA,UACA,SACA,eACuC;CACvC,MAAM,iBAAiB,SAAS,MAC7B,MACC,cAAc,QAAQ,EAAE,OAAO,KAC/B,cAAc,OAAO,EAAE,SAAS,OAAO,CAC3C;CAEA,IAAI,CAAC,gBACH,OAAO;CAGT,IAAI,eAAe,kBACjB,OAAO,eAAe;CAIxB,QAAO,MADqB,mBAAmB,QAAQ,cAAc,EAAA,EAC/C;AACxB;AAEA,eAAsB,cACpB,UAC+B;CAC/B,IAAI,SAA6B,EAAE,GAAG,SAAS;CAC/C,OAAO,eAAe,qBAAqB,OAAO,UAAU;CAE5D,MAAM,gBAAgBA,IAAkB,OAAO,UAAU;CAEzD,IAAI,aAAmC;CACvC,MAAM,MAAoB;EACxB,YAAY,OAAO;EACnB,SAAS,CAAC;EACV,UAAU,CAAC;CACb;CAEA,IAAI;CAEJ,IAAI;CAEJ,IAAI;EACF,OAAO,MACL;GACE,YAAY,OAAO;GACnB,cAAc,OAAO;EACvB,GACA,eACF;EACA,IAAI,OAAO,gBAAgB,CAAC,SAAS,OAAO,YAAY,GAAG;GAEzD,OAAO,MACL,4BAA4B,OAAO,YAAY,IAAI,cAAc,OAAO,YAAY,EAAE,IAAI,OAAO,OAAO,aAAa,EACvH;GACA,IAAI,aAAa;GACjB,OAAO,OAAO,GAAG,GAAG;EACtB;EACA,IAAI,CAAC,uBAAuB,MAAM,GAAG;GACnC,IAAI,aAAa;GACjB,OAAO,OAAO,GAAG,GAAG;EACtB;EACA,IAAI,CAAC,iBAAiB,OAAO,UAAU,GAAG;GACxC,IAAI,aAAa;GACjB,MAAM,cAAc,sBAAsB,OAAO,WAAW;GAC5D,IAAI,SAAS,KAAK;IAChB,OAAO;IACP,SAAS,uBAAuB,OAAO,WAAW,gBAAgB;GACpE,CAAC;GACD,OAAO,OAAO,GAAG,GAAG;EACtB;EACA,IAAI,eACF,OAAO,kBAAkB,OAAO,gBAC5B,OAAO,gBACP,OAAO;EACb,MAAM,4BAA4B,0BAA0B,MAAM;EAClE,IAAI,2BAA2B;GAC7B,eAAe,0BAA0B;GACzC,OAAO,uBACL,0BAA0B;GAC5B,IAAI,uBAAuB,0BAA0B;EACvD;EAEA,MAAM,UACJ,SAAS,YAAY,KAAK,cAAc,QAAQ,YAAY;EAE9D,MAAM,qBACJ,CAAC,CAAC,OAAO,iBAAiB,YAAY,OAAO,YAAY;EAE3D,IAAI,WAAW,oBAAoB;GACjC,IACE,CAAC,OAAO,4BACR,CAAC,OAAO,kBAER,cAAc,gBAAgB,YAAa,GAC3C;IACA,IAAI,aAAa;IACjB,OAAO,OAAO,GAAG,GAAG;GACtB;GAEA,MAAM,EAAE,KAAK,eAAe,KAAK,gBAAgB,MAAM,kBACrD,MACF,CAAC,CACE,WAAW,QAAQ,6BAA6B,eAAe,GAAG,CAAC,CAAC,CACpE,WAAW,QAAQ,qBAAqB,KAAK,MAAM,CAAC,CAAC,CACrD,WAAW,QAAQ,uBAAuB,KAAK,MAAM,CAAC,CAAC,CACvD,OAAO;GAEV,IAAI,uBAAuB,OACzB,MAAM;GAGR,IAAI,aAAa;IAEf,MAAM,cAAc,sBAAsB,OAAO,WAAW;IAC5D,MAAM,UAA6B;KACjC,OAAO;KACP,SAAS,qBAAqB,OAAO,WAAW,WAAW,YAAY,IAAI;IAC7E;IACA,OAAO,MACL;KACE,YAAY,OAAO;KACnB,aAAa,OAAO;IACtB,GACA,QAAQ,OACV;IAEA,IAAI,SAAS,KAAK,OAAO;IACzB,OAAO,OAAO,GAAG,GAAG;GACtB;GAEA,aAAa;GAEb,IAAI,WAAW,oBACb,OAAO,MACL,gCAAgC,OAAO,WAAW,WAAW,OAAO,aACtE;GAGF,WAAW,KAAK,YAAY;IAC1B;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;GACF,CAAC;GAED,MAAM,gBAAgB,WAAW,MAAM;GAEvC,IAAI,cAAc,WAAW,SAAS,QAAQ,YAC5C,cAAc,UAAU,QAAQ,OAAO,CACzC;GACA,MAAM,qBAAqB,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE,OAAO,CAAC;;GAOpE,IAAI,YAAY,WAAW,GAAG;IAE5B,OAAO,KACL;KACE,YAAY,OAAO;KACnB,QAAQ;IACV,GACA,2DACF;IACA,IAAI,CAAC,OAAO,eACV,OAAO,OAAO,GAAG,GAAG;GAExB;GAEA,SAAS,MAAM,kBACb;IACE,GAAG;IACH,WAAW,IAAI;IACf,qBAAqB,IAAI;GAC3B,GACA,YACF;GACA,IAAI,OAAO,WAAW;IACpB,MAAM,gBAAgB,WAAW,OAAO,OAAO;IAC/C,IAAI,CAAC,eAAe;KAClB,MAAM,cAAc,sBAAsB,OAAO,WAAW;KAC5D,IAAI,SAAS,KAAK;MAChB,OAAO;MACP,SAAS,+BAA+B,OAAO,UAAU,OAAO,OAAO,WAAW,WAAW;KAC/F,CAAC;KACD,OAAO,OAAO,GAAG,GAAG;IACtB;IACA,cAAc,YAAY,QACvB,MACC,EAAE,YAAY,iBACb,EAAE,YAAY,gBACb,cAAc,cAAc,eAAe,YAAY,CAC7D;GACF;GAEA,MAAM,sBAAsB,OAAO,kBAAkB;GAErD,MAAM,yBACH,uBAAuB,OAAO,gBAAgB,CAAC,qBAC5C,YAAY,QAAQ,MAElB,cAAc,QAAQ,EAAE,SAAS,YAAa,CAChD,IACA;GACN,IAAI,CAAC,sBAAsB,QACzB,OAAO,MACL,sCAAsC,OAAO,WAAW,aAC1D;GAGF,IAAI,OAAO,eAAe,CAAC,sBAAsB,QAAQ;IACvD,MAAM,WAAW,kBAAkB,QAAQ,aAAa,aAAa;;IAErE,IAAI,CAAC,UAAU;KACb,MAAM,cAAc,sBAAsB,OAAO,WAAW;KAC5D,IAAI,SAAS,KAAK;MAChB,OAAO;MAEP,SAAS,+BAA+B,aAAc,OACpD,OAAO,WACR,WAAW;KACd,CAAC;KACD,OAAO,OAAO,GAAG,GAAG;IACtB;IACA,IAAI,QAAQ,KAAK,QAAQ;GAC3B;GACA,IAAI,gBAAgB,qBAAqB,MAAM;GAE/C,MAAM,iBAAiB,sBACrB,cACA,OAAO,eACP,eACA,eACA,eACA,WACF;GAEA,IAAI,CAAC,gBAAgB;;IAEnB,IAAI,CAAC,OAAO,eAAe;KACzB,OAAO,MACL,gDAAgD,OAAO,aACzD;KACA,IAAI,aAAa;IACnB;IACA,OAAO,OAAO,GAAG,GAAG;GACtB;GAEA,IAAI,iBAAiB;GAOrB,MAAM,sBAAsB,OAAO,iBAAiB;GACpD,MAAM,0BAA0B,MAAM,aACpC,QACA,aACA,qBACA,aACF;GAEA,IAAI,iBAAiB,uBAAuB,GAAG;IAC7C,IAAI,0BAA0B;IAC9B,IAAI,0BAA0B,eAAe,uBAAuB;IAEpE,IACE,OAAO,cAAc,MAAM,SACzB,iBAAiB,KAAK,eAAe,CACvC,GAGA,SAAS,MAAM,kBACb;KAAE,GAAG;KAAQ;IAAwB,GACrC,mBACF;GAEJ;GAEA,IACE,OAAO,gBACH,oCAAoC,QAAQ,QAAQ,IACpD,OAAO,cACP,oCAAoC,QAAQ,WAAW,GAC3D;IACA,MAAM,wBAAwB,yBAC5B,cACA,eACA,eACA,WACF;IACA,IAAI,uBACF,iCAAiC,MAAM,aACrC,QACA,aACA,uBACA,aACF;GAEJ;GAEA,IACE,gBACA,kBACA,kBAAkB,SAClB,CAAC,cAAc,gBAAgB,YAAY,GAC3C;IACA,MAAM,WACJ,cAAc,iBAAiB,cAAc,KAAK;IACpD,IAAI,QAAQ,KAAK;KACf,YAAY;KACZ,OAAO;KACP;KACA,YAAY;KACZ,UAAU,cAAc,SAAS,cAAc;IACjD,CAAC;GACH;GACA,IAAI,kBAAkB,OAEpB,gBAAgB;;GAMlB,IAAI,CAAC,cAAc,UAAU,cAAc,GAAG;IAC5C,IAAI,aAAa;IACjB,OAAO,OAAO,GAAG,GAAG;GACtB;GAGA,IAAI,mBAAmB,eACrB,QACA,gBACA,eACA,sBAAsB,wBAAwB,aAC9C,aACF,CAAC,CAAC,QAAQ,MAAM;IACd,IAAI,OAAO,gBACT,OAAO;IAIT,OACE,sBACA,cAAc,aAAa,EAAE,SAAS,YAAY;GAEtD,CAAC;GACD,MAAM,mBAAmB,4BACvB,QACA,KACA,eACA,gBACF;GACA,mBAAmB,iBAAiB;GACpC,MAAM,EAAE,6BAA6B;GAErC,MAAM,UAAU,yBACd,QACA,gBACA,kBACA,aACF;GACA,MAAM,kBAAkB,iBAAiB,QAAQ,GAAG;GACpD,KAAK,MAAM,CAAC,QAAQ,aAAa,OAAO,QAAQ,OAAO,GAAG;IACxD,MAAM,iBAAiB,SAAS,MAAM,IAAI,OACxC,cAAc,aAAa,GAAG,SAAS,GAAG,OAAO,CACnD;IACA,MAAM,EAAE,SAAS,eAAe,oBAC9B,MAAM,qBACJ,iBACA,eACA,QACA,cACF;;IAKF,IAAI,CAAC,SACH,OAAO,OAAO,GAAG,GAAG;IAEtB,MAAM,aAAa,QAAQ;IAC3B,MAAM,SAAS,MAAM,eACnB,QACA,OAAO,iBAAiB,OAAO,eAAe,cAC9C,eAGA,eACA,OAAO,iBAAiB,gBACxB,QACA,SACA,kBACF;IAIA,IACE,OAAO,YAAY,WACnB,gBAAgB,YAAY,KAC5B,gBAAgB,OAAO,QAAQ,KAC/B,OAAO,kBAAkB,OAAO,WAChC;KACA,OAAO,aAAa;KAIpB,MAAM,qCACJ,QACA,QACA,KACA,MACA,QAAQ,gBACV;IACF;IAEA,IAAI,eACF,OAAO,gBAAgB;IAGzB,IAAI,gBAAgB,QAClB,OAAO,kBAAkB,gBAAgB,KAAK,MAAM,EAAE,OAAO;IAE/D,IAAI,CAAC,OAAO,YAAY,OAAO,aAAa,cAAc;KACxD,IAAI,CAAC,OAAO,eACV;;KAGF,IAAI,kBAAkB,QAAQ;MAC5B,OAAO,MACL;OACE,aAAa,OAAO;OACpB,cAAc,OAAO;OACrB,eAAe,OAAO;OACtB;MACF,GACA,4CACF;MACA;KACF;KACA,IAAI,kBAAkB;IACxB;IACA,IAAI,oBACF,SAAS,OAAO,QAAQ,KACxB,cAAc,gBAAgB,OAAO,QAAQ;IAM/C,IACE,OAAO,eAAe,cACtB,OAAO,YACP,cAAc,UAAU,OAAO,QAAQ,KACvC,gBACA,cAAc,UAAU,YAAY,KACpC,cAAc,cAAc,cAAc,OAAO,QAAQ,KACzD,CAAC,cAAc,cAAc,OAAO,UAAU,YAAY,GAE1D,OAAO,KACL;KACE,aAAa,OAAO;KACpB,cAAc,OAAO;KACrB;KACA,gBAAgB,OAAO;KACvB;KACA,mBAAmB,YAAY;KAC/B,yBAAyB,iBAAiB,KAAK,MAAM,EAAE,OAAO;KAC9D;IACF,GACA,yCACF;SAEA,IAAI,QAAQ,KAAK,MAAM;GAE3B;EACF,OAAO,IAAI,cAAc;GACvB,OAAO,MACL,cAAc,OAAO,YAAY,qCAAqC,aAAa,eAAe,OAAO,WAAW,EACtH;GAEA,IAAI,CAAC,OAAO,cAAc,CAAC,OAAO,eAAe;IAC/C,OAAO,MACL,YAAY,OAAO,YAAY,wCACjC;IACA,IAAI,aAAa;GACnB,OACE,OAAO,IAAI;EAEf,OACE,IAAI,aAAa;EAGnB,IAAI,6BAA6B,MAAM,GACrC,4BAA4B,IAAI,SAAS,MAAM;OAC1C,IAAI,YAAY,mBAAmB,WAAW,oBACnD,IAAI,QAAQ,KAAK;GACf,YAAY;GACZ,SAAS,WAAW;GACpB,UAAU,WAAW;EACvB,CAAC;EAIH,IAAI,OAAO,eAAe;GACxB,IAAI,iBAAiB,OAAO;GAC5B,IAAI,eAAe,OAAO;EAC5B,OAAO,IAAI,gBAAgB,cAAc,gBAAgB,YAAY,GACnE,IAAI,eAAe,aAAa,QAAQ,MAAM,KAAK,GAAG,EAAE;EAI1D,4BAA4B,QAAQ,cAAc,IAAI,OAAO;EAG7D,IAAI,gBAAgB,OAAO,UAAU,GAAG;GACtC,IAAI,OAAO,eACL;QAAA,CAAC,OAAO,oBAAoB,CAAC,IAAI,QAAQ,QAAQ;KAEnD,eAAe;MACb,YAAY;MACZ,UAAU,OAAO;KACnB;KACA,IAAI,QAAQ,KAAK,YAAY;IAC/B;UACK,IACL,OAAO,cAEP,CAAC,OAAO;;GAGR,CAAC,IAAI,QAAQ,MAAM,WAAW,OAAO,eAAe,KAAK,GACzD;IAEA,MAAM,kBAAoC;KACxC,aAAa;KACb,YAAY;KACZ,UAAU,OAAO;IACnB;IACA,MAAM,qCACJ,iBACA,QACA,KACA,WAAW,oBACX,8BACF;IACA,IAAI,QAAQ,KAAK,eAAe;GAClC;GACA,IAAI,cAAc,gBAAgB;IAEhC,IAAI,iBAAiB,cAAc,eAAe,IAAI,cAAe;IACrE,KAAK,MAAM,UAAU,IAAI,SAEvB,OAAO,aAAa,cAAc,eAAe,OAAO,UAAW;GAEvE;GACA,IAAI,IAAI,aACN,OAAO,eAAe,CAAC,IAAI,WAAW;GAIxC,MAAM,qBAAqB,QAAQ,KAAK,UAAU;EACpD;EAEA,IAAI,IAAI,QAAQ,QACd,OAAO,IAAI;EAGb,IAAI,UAAU,iBAAiB,QAAQ,IAAI,OAAO;EAIlD,IAAI,gBAAgB,IAAI,QAAQ,SAAS,YAAY,GACnD,MAAM,qCACJ,cACA,QACA,KACA,MACA,8BACF;EAGF,MAAM,UACJ,IAAI,QAAQ,SAAS,IAChB,YAAY,SAAS,MACnB,MAAM,EAAE,YAAY,IAAI,QAAQ,EAAE,CAAC,QACtC,KACA,YAAY,SAAS,MAClB,MAAM,EAAE,YAAY,IAAI,QAAQ,EAAE,CAAC,UACtC,IACA;EAEN,IAAI,SAAS,kBAAkB;GAC7B,IAAI,mBAAmB,QAAQ;GAC/B,IAAI,eAAe,QAAQ;EAC7B;CACF,SAAS,gCAAgC;EACvC,IAAI,eAAe,mBACjB,OAAO,OAAO,IAAI,GAAG;EAGvB,IAAI,eAAe,SAAS,IAAI,YAAA,qBAC9B,OAAO,OAAO,IAAI,GAAG;EAGvB,OAAO,MACL;GACE,eAAe,OAAO;GACtB,cAAc,OAAO;GACrB,YAAY,OAAO;GACnB,aAAa,OAAO;GACpB,kBAAkB,OAAO;GACzB,WAAW,OAAO;GAClB,eAAe,OAAO;GACtB,aAAa,OAAO;GACpB,YAAY,OAAO;GACnB,aAAa,OAAO;GACpB,sBAAsB,OAAO;GAC7B,0BAA0B,OAAO;GACjC;EACF,GACA,qBACF;EACA,IAAI,aAAa;CACnB;CACA,OAAO,OAAO,GAAG,GAAG;AACtB"}
+{"version":3,"file":"index.js","names":["allVersioning.get"],"sources":["../../../../../lib/workers/repository/process/lookup/index.ts"],"sourcesContent":["import { isNonEmptyString, isString, isUndefined } from '@sindresorhus/is';\nimport { mergeChildConfig } from '../../../../config/index.ts';\nimport type { ValidationMessage } from '../../../../config/types.ts';\nimport { CONFIG_VALIDATION } from '../../../../constants/error-messages.ts';\nimport { logger } from '../../../../logger/index.ts';\nimport {\n  getDatasourceFor,\n  getDefaultVersioning,\n} from '../../../../modules/datasource/common.ts';\nimport type {\n  Release,\n  ReleaseResult,\n} from '../../../../modules/datasource/index.ts';\nimport {\n  applyDatasourceFilters,\n  getRawPkgReleases,\n  isGetPkgReleasesConfig,\n  supportsDigests,\n} from '../../../../modules/datasource/index.ts';\nimport { postprocessRelease } from '../../../../modules/datasource/postprocess-release.ts';\nimport { isPseudoVersion } from '../../../../modules/versioning/gomod/index.ts';\nimport * as allVersioning from '../../../../modules/versioning/index.ts';\nimport { ExternalHostError } from '../../../../types/errors/external-host-error.ts';\nimport { assignKeys } from '../../../../util/assign-keys.ts';\nimport { getElapsedDays } from '../../../../util/date.ts';\nimport { applyPackageRules } from '../../../../util/package-rules/index.ts';\nimport { regEx } from '../../../../util/regex.ts';\nimport { Result } from '../../../../util/result.ts';\nimport { safeStringify } from '../../../../util/stringify.ts';\nimport type { Timestamp } from '../../../../util/timestamp.ts';\nimport { withoutUrlCredentials } from '../../../../util/url.ts';\nimport { calculateAbandonment } from './abandonment.ts';\nimport { groupReleasesIntoBuckets } from './bucket.ts';\nimport { getNewestMatchingVersion, resolveCurrentVersion } from './current.ts';\nimport type { DigestLikeUpdate } from './digest.ts';\nimport {\n  applyMinimumReleaseAgeToDigestUpdate,\n  couldApplyMinimumReleaseAgeToDigest,\n  resolveUpdateDigests,\n} from './digest.ts';\nimport { filterVersions } from './filter.ts';\nimport { filterInternalChecks } from './filter-checks.ts';\nimport { generateUpdate } from './generate.ts';\nimport { resolveRangeStrategy } from './range-strategy.ts';\nimport { getRollbackUpdate } from './rollback.ts';\nimport { calculateMostRecentTimestamp } from './timestamps.ts';\nimport type { LookupUpdateConfig, UpdateResult } from './types.ts';\nimport {\n  addReplacementUpdateIfValid,\n  isReplacementRulesConfigured,\n  stripNoopUpdates,\n} from './utils.ts';\nimport {\n  matchVersionCompatibility,\n  restoreVersionCompatibility,\n} from './version-compatibility.ts';\nimport { applyVulnerabilityFixFilter } from './vulnerability.ts';\n\nasync function getTimestamp(\n  config: LookupUpdateConfig,\n  versions: Release[],\n  version: string,\n  versioningApi: allVersioning.VersioningApi,\n): Promise<Timestamp | null | undefined> {\n  const currentRelease = versions.find(\n    (v) =>\n      versioningApi.isValid(v.version) &&\n      versioningApi.equals(v.version, version),\n  );\n\n  if (!currentRelease) {\n    return null;\n  }\n\n  if (currentRelease.releaseTimestamp) {\n    return currentRelease.releaseTimestamp;\n  }\n\n  const remoteRelease = await postprocessRelease(config, currentRelease);\n  return remoteRelease?.releaseTimestamp;\n}\n\nexport async function lookupUpdates(\n  inconfig: LookupUpdateConfig,\n): Promise<Result<UpdateResult>> {\n  let config: LookupUpdateConfig = { ...inconfig };\n  config.versioning ??= getDefaultVersioning(config.datasource);\n\n  const versioningApi = allVersioning.get(config.versioning);\n\n  let dependency: ReleaseResult | null = null;\n  const res: UpdateResult = {\n    versioning: config.versioning,\n    updates: [],\n    warnings: [],\n  };\n  // Timestamp of the release a `digest`/`pinDigest` update's current value currently resolves to (the newest version matching it, regardless of `rangeStrategy`), as opposed to `res.currentVersionTimestamp` which tracks whatever the configured rangeStrategy resolves `currentVersion` to (e.g. the oldest for `bump`)\n  let newestMatchingVersionTimestamp: Timestamp | null | undefined;\n  // The `digest` update for `config.currentDigest` (if one is added), so its age check can run after `newDigest` is fetched and no-op updates are stripped.\n  let digestUpdate: DigestLikeUpdate | undefined;\n\n  try {\n    logger.trace(\n      {\n        dependency: config.packageName,\n        currentValue: config.currentValue,\n      },\n      'lookupUpdates',\n    );\n    if (config.currentValue && !isString(config.currentValue)) {\n      // If currentValue is not a string, then it's invalid\n      logger.debug(\n        `Invalid currentValue for ${config.packageName}: ${safeStringify(config.currentValue)} (${typeof config.currentValue})`,\n      );\n      res.skipReason = 'invalid-value';\n      return Result.ok(res);\n    }\n    if (!isGetPkgReleasesConfig(config)) {\n      res.skipReason = 'invalid-config';\n      return Result.ok(res);\n    }\n    if (!getDatasourceFor(config.datasource)) {\n      res.skipReason = 'invalid-config';\n      const packageName = withoutUrlCredentials(config.packageName);\n      res.warnings.push({\n        topic: packageName,\n        message: `Unknown datasource \"${config.datasource}\" for package ${packageName}`,\n      });\n      return Result.ok(res);\n    }\n    let compareValue =\n      config.isLockfileOnly && config.lockedVersion\n        ? config.lockedVersion\n        : config.currentValue;\n    const versionCompatibilityMatch = matchVersionCompatibility(config);\n    if (versionCompatibilityMatch) {\n      compareValue = versionCompatibilityMatch.compareValue;\n      config.currentCompatibility =\n        versionCompatibilityMatch.currentCompatibility;\n      res.currentCompatibility = versionCompatibilityMatch.currentCompatibility;\n    }\n\n    const isValid =\n      isString(compareValue) && versioningApi.isValid(compareValue);\n\n    const unconstrainedValue =\n      !!config.lockedVersion && isUndefined(config.currentValue);\n\n    if (isValid || unconstrainedValue) {\n      if (\n        !config.updatePinnedDependencies &&\n        !config.isLockfileOnly &&\n        // TODO #22198\n        versioningApi.isSingleVersion(compareValue!)\n      ) {\n        res.skipReason = 'is-pinned';\n        return Result.ok(res);\n      }\n\n      const { val: releaseResult, err: lookupError } = await getRawPkgReleases(\n        config,\n      )\n        .transform((res) => calculateMostRecentTimestamp(versioningApi, res))\n        .transform((res) => calculateAbandonment(res, config))\n        .transform((res) => applyDatasourceFilters(res, config))\n        .unwrap();\n\n      if (lookupError instanceof Error) {\n        throw lookupError;\n      }\n\n      if (lookupError) {\n        // If dependency lookup fails then warn and return\n        const packageName = withoutUrlCredentials(config.packageName);\n        const warning: ValidationMessage = {\n          topic: packageName,\n          message: `Failed to look up ${config.datasource} package ${packageName}: ${lookupError}`,\n        };\n        logger.debug(\n          {\n            dependency: config.packageName,\n            packageFile: config.packageFile,\n          },\n          warning.message,\n        );\n        // TODO: return warnings in own field\n        res.warnings.push(warning);\n        return Result.ok(res);\n      }\n\n      dependency = releaseResult;\n\n      if (dependency.deprecationMessage) {\n        logger.debug(\n          `Found deprecationMessage for ${config.datasource} package ${config.packageName}`,\n        );\n      }\n\n      assignKeys(res, dependency, [\n        'deprecationMessage',\n        'sourceUrl',\n        'registryUrl',\n        'effectiveDatasource',\n        'sourceDirectory',\n        'homepage',\n        'changelogUrl',\n        'dependencyUrl',\n        'lookupName',\n        'packageScope',\n        'mostRecentTimestamp',\n        'isAbandoned',\n        'respectLatest',\n      ]);\n\n      const latestVersion = dependency.tags?.latest;\n      // Filter out any results from datasource that don't comply with our versioning\n      let allVersions = dependency.releases.filter((release) =>\n        versioningApi.isVersion(release.version),\n      );\n      const allReleaseVersions = new Set(allVersions.map((r) => r.version));\n      // The datasources used in these tests always return at least one\n      // version-like release, so neither this block nor the currentDigest\n      // check inside it is reached. A lookup whose releases are all\n      // unversioned tags does not get here either - with a digest configured\n      // it takes the digest-only path above instead - see #40625\n      // istanbul ignore if\n      if (allVersions.length === 0) {\n        const message = `Found no results from datasource that look like a version`;\n        logger.info(\n          {\n            dependency: config.packageName,\n            result: dependency,\n          },\n          message,\n        );\n        if (!config.currentDigest) {\n          return Result.ok(res);\n        }\n      }\n      // Reapply package rules in case we missed something from sourceUrl\n      config = await applyPackageRules(\n        {\n          ...config,\n          sourceUrl: res.sourceUrl,\n          effectiveDatasource: res.effectiveDatasource,\n        },\n        'source-url',\n      );\n      if (config.followTag) {\n        const taggedVersion = dependency.tags?.[config.followTag];\n        if (!taggedVersion) {\n          const packageName = withoutUrlCredentials(config.packageName);\n          res.warnings.push({\n            topic: packageName,\n            message: `Can't find version with tag ${config.followTag} for ${config.datasource} package ${packageName}`,\n          });\n          return Result.ok(res);\n        }\n        allVersions = allVersions.filter((v) => {\n          if (v.version === taggedVersion) {\n            return true;\n          }\n          return (\n            v.version === compareValue &&\n            versioningApi.isGreaterThan(taggedVersion, compareValue)\n          );\n        });\n      }\n\n      const inRangeOnlyStrategy = config.rangeStrategy === 'in-range-only';\n      // Check that existing constraint can be satisfied\n      const restrictsToRange = inRangeOnlyStrategy || config.rollbackPrs;\n      const allSatisfyingVersions =\n        restrictsToRange && !unconstrainedValue\n          ? allVersions.filter((v) =>\n              // TODO #22198\n              versioningApi.matches(v.version, compareValue!),\n            )\n          : allVersions;\n      if (!allSatisfyingVersions.length) {\n        logger.debug(\n          `Found no satisfying versions with '${config.versioning}' versioning`,\n        );\n      }\n\n      if (config.rollbackPrs && !allSatisfyingVersions.length) {\n        const rollback = getRollbackUpdate(config, allVersions, versioningApi);\n        // istanbul ignore if\n        if (!rollback) {\n          const packageName = withoutUrlCredentials(config.packageName);\n          res.warnings.push({\n            topic: packageName,\n            // TODO: types (#22198)\n            message: `Can't find version matching ${compareValue!} for ${\n              config.datasource\n            } package ${packageName}`,\n          });\n          return Result.ok(res);\n        }\n        res.updates.push(rollback);\n      }\n      let rangeStrategy = resolveRangeStrategy(config);\n\n      const currentVersion = resolveCurrentVersion(\n        compareValue,\n        config.lockedVersion,\n        versioningApi,\n        rangeStrategy,\n        latestVersion,\n        allVersions,\n      );\n\n      if (!currentVersion) {\n        // v8 ignore else -- TODO: add test #40625\n        if (!config.lockedVersion) {\n          logger.debug(\n            `No currentVersion or lockedVersion found for ${config.packageName}`,\n          );\n          res.skipReason = 'invalid-value';\n        }\n        return Result.ok(res);\n      }\n\n      res.currentVersion = currentVersion;\n\n      // Use lockedVersion for the timestamp lookup when available, because\n      // res.currentVersion is later overwritten to lockedVersion (see below).\n      // Without this, strategies like \"replace\" would compute the timestamp\n      // for the highest satisfying version (e.g. 1.4.1) while the reported\n      // currentVersion ends up being the locked one (e.g. 1.0.0).\n      const versionForTimestamp = config.lockedVersion ?? currentVersion;\n      const currentVersionTimestamp = await getTimestamp(\n        config,\n        allVersions,\n        versionForTimestamp,\n        versioningApi,\n      );\n\n      if (isNonEmptyString(currentVersionTimestamp)) {\n        res.currentVersionTimestamp = currentVersionTimestamp;\n        res.currentVersionAgeInDays = getElapsedDays(currentVersionTimestamp);\n\n        if (\n          config.packageRules?.some((rule) =>\n            isNonEmptyString(rule.matchCurrentAge),\n          )\n        ) {\n          // Reapply package rules to check matches for matchCurrentAge\n          config = await applyPackageRules(\n            { ...config, currentVersionTimestamp },\n            'current-timestamp',\n          );\n        }\n      }\n\n      if (\n        config.currentDigest\n          ? couldApplyMinimumReleaseAgeToDigest(config, 'digest')\n          : config.pinDigests &&\n            couldApplyMinimumReleaseAgeToDigest(config, 'pinDigest')\n      ) {\n        const newestMatchingVersion = getNewestMatchingVersion(\n          compareValue,\n          versioningApi,\n          latestVersion,\n          allVersions,\n        );\n        if (newestMatchingVersion) {\n          newestMatchingVersionTimestamp = await getTimestamp(\n            config,\n            allVersions,\n            newestMatchingVersion,\n            versioningApi,\n          );\n        }\n      }\n\n      if (\n        compareValue &&\n        currentVersion &&\n        rangeStrategy === 'pin' &&\n        !versioningApi.isSingleVersion(compareValue)\n      ) {\n        const newValue =\n          versioningApi.getPinnedValue?.(currentVersion) ?? currentVersion;\n        res.updates.push({\n          updateType: 'pin',\n          isPin: true,\n          newValue,\n          newVersion: currentVersion,\n          newMajor: versioningApi.getMajor(currentVersion)!,\n        });\n      }\n      if (rangeStrategy === 'pin') {\n        // Fall back to replace once pinning logic is done\n        rangeStrategy = 'replace';\n      }\n      // A non-version can only get this far via a locked version under\n      // rangeStrategy=pin, but the timestamp lookup above calls `equals()` on\n      // it first and throws - see #40625\n      // istanbul ignore if\n      if (!versioningApi.isVersion(currentVersion)) {\n        res.skipReason = 'invalid-version';\n        return Result.ok(res);\n      }\n      // Filter latest, unstable, etc\n      // TODO #22198\n      let filteredReleases = filterVersions(\n        config,\n        currentVersion,\n        latestVersion!,\n        inRangeOnlyStrategy ? allSatisfyingVersions : allVersions,\n        versioningApi,\n      ).filter((v) => {\n        if (config.isLockfileOnly) {\n          return true;\n        }\n\n        // Leave only compatible versions\n        return (\n          unconstrainedValue ||\n          versioningApi.isCompatible(v.version, compareValue)\n        );\n      });\n      const vulnerabilityFix = applyVulnerabilityFixFilter(\n        config,\n        res,\n        versioningApi,\n        filteredReleases,\n      );\n      filteredReleases = vulnerabilityFix.releases;\n      const { shrinkedViaVulnerability } = vulnerabilityFix;\n\n      const buckets = groupReleasesIntoBuckets(\n        config,\n        currentVersion,\n        filteredReleases,\n        versioningApi,\n      );\n      const depResultConfig = mergeChildConfig(config, res);\n      for (const [bucket, releases] of Object.entries(buckets)) {\n        const sortedReleases = releases.sort((r1, r2) =>\n          versioningApi.sortVersions(r1.version, r2.version),\n        );\n        const { release, pendingChecks, pendingReleases } =\n          await filterInternalChecks(\n            depResultConfig,\n            versioningApi,\n            bucket,\n            sortedReleases,\n          );\n        // `filterInternalChecks()` normally yields a release, falling back to\n        // the newest pending one; only a datasource rejecting every candidate\n        // during postprocessing leaves none - see #40625\n        // istanbul ignore next\n        if (!release) {\n          return Result.ok(res);\n        }\n        const newVersion = release.version;\n        const update = await generateUpdate(\n          config,\n          config.isLockfileOnly ? config.currentValue : compareValue,\n          versioningApi,\n          // TODO #22198\n\n          rangeStrategy!,\n          config.lockedVersion ?? currentVersion,\n          bucket,\n          release,\n          allReleaseVersions,\n        );\n\n        // An update between two pseudo-versions of the same module changes the\n        // commit and nothing else, so it is a digest update - see #29034\n        if (\n          config.manager === 'gomod' &&\n          isPseudoVersion(compareValue) &&\n          isPseudoVersion(update.newValue) &&\n          config.currentDigest !== update.newDigest\n        ) {\n          update.updateType = 'digest';\n\n          // As this has already been processed by `filterInternalChecks()`, but we're changing the `updateType`, we need to apply the digest-scoped minimumReleaseAge rules.\n          // `currentVersionWasResolved` only matters for `pinDigest`, which `update.updateType` never is here - true is a safe constant.\n          await applyMinimumReleaseAgeToDigestUpdate(\n            update as DigestLikeUpdate,\n            config,\n            res,\n            true,\n            release.releaseTimestamp,\n          );\n        }\n\n        if (pendingChecks) {\n          update.pendingChecks = pendingChecks;\n        }\n\n        if (pendingReleases.length) {\n          update.pendingVersions = pendingReleases.map((r) => r.version);\n        }\n        if (!update.newValue || update.newValue === compareValue) {\n          if (!config.lockedVersion) {\n            continue;\n          }\n          // istanbul ignore if\n          if (rangeStrategy === 'bump') {\n            logger.trace(\n              {\n                packageName: config.packageName,\n                currentValue: config.currentValue,\n                lockedVersion: config.lockedVersion,\n                newVersion,\n              },\n              'Skipping bump because newValue is the same',\n            );\n            continue;\n          }\n          res.isSingleVersion = true;\n        }\n        res.isSingleVersion ??=\n          isString(update.newValue) &&\n          versioningApi.isSingleVersion(update.newValue);\n        // Nothing but a rollback should ever propose a lower version, so a\n        // downgrade means the lookup went wrong and the update is dropped - see\n        // #29921. A versioning which reports each value as greater than the\n        // other has no order between them (e.g. aws-machine-image relies on the\n        // datasource order), so no downgrade can be claimed.\n        if (\n          update.updateType !== 'rollback' &&\n          update.newValue &&\n          versioningApi.isVersion(update.newValue) &&\n          compareValue &&\n          versioningApi.isVersion(compareValue) &&\n          versioningApi.isGreaterThan(compareValue, update.newValue) &&\n          !versioningApi.isGreaterThan(update.newValue, compareValue)\n        ) {\n          logger.warn(\n            {\n              packageName: config.packageName,\n              currentValue: config.currentValue,\n              compareValue,\n              currentVersion: config.currentVersion,\n              update,\n              allVersionsLength: allVersions.length,\n              filteredReleaseVersions: filteredReleases.map((r) => r.version),\n              shrinkedViaVulnerability,\n            },\n            'Unexpected downgrade detected: skipping',\n          );\n        } else {\n          res.updates.push(update);\n        }\n      }\n    } else if (compareValue) {\n      logger.debug(\n        `Dependency ${config.packageName} has unsupported/unversioned value ${compareValue} (versioning=${config.versioning})`,\n      );\n\n      if (!config.pinDigests && !config.currentDigest) {\n        logger.debug(\n          `Skipping ${config.packageName} because no currentDigest or pinDigests`,\n        );\n        res.skipReason = 'invalid-value';\n      } else {\n        delete res.skipReason;\n      }\n    } else {\n      res.skipReason = 'invalid-value';\n    }\n\n    if (isReplacementRulesConfigured(config)) {\n      addReplacementUpdateIfValid(res.updates, config);\n    } else if (dependency?.replacementName && dependency.replacementVersion) {\n      res.updates.push({\n        updateType: 'replacement',\n        newName: dependency.replacementName,\n        newValue: dependency.replacementVersion,\n      });\n    }\n\n    // Record if the dep is fixed to a version\n    if (config.lockedVersion) {\n      res.currentVersion = config.lockedVersion;\n      res.fixedVersion = config.lockedVersion;\n    } else if (compareValue && versioningApi.isSingleVersion(compareValue)) {\n      res.fixedVersion = compareValue.replace(regEx(/^=+/), '');\n    }\n\n    // massage versionCompatibility\n    restoreVersionCompatibility(config, compareValue, res.updates);\n\n    // Add digests if necessary\n    if (supportsDigests(config.datasource)) {\n      if (config.currentDigest) {\n        if (!config.digestOneAndOnly || !res.updates.length) {\n          // digest update - age-checked after the strip below, once newDigest is known\n          digestUpdate = {\n            updateType: 'digest',\n            newValue: config.currentValue,\n          };\n          res.updates.push(digestUpdate);\n        }\n      } else if (\n        config.pinDigests &&\n        // only update the digest in the package file if it's managed by us\n        !config.digestManagedExternally &&\n        // Create a pin only if one doesn't already exists\n        // v8 ignore else -- TODO: add test #40625\n        !res.updates.some((update) => update.updateType === 'pin')\n      ) {\n        // pin digest\n        const pinDigestUpdate: DigestLikeUpdate = {\n          isPinDigest: true,\n          updateType: 'pinDigest',\n          newValue: config.currentValue,\n        };\n        await applyMinimumReleaseAgeToDigestUpdate(\n          pinDigestUpdate,\n          config,\n          res,\n          isValid || unconstrainedValue,\n          newestMatchingVersionTimestamp,\n        );\n        res.updates.push(pinDigestUpdate);\n      }\n      if (versioningApi.valueToVersion) {\n        // TODO #22198\n        res.currentVersion = versioningApi.valueToVersion(res.currentVersion!);\n        for (const update of res.updates) {\n          // TODO #22198\n          update.newVersion = versioningApi.valueToVersion(update.newVersion!);\n        }\n      }\n      if (res.registryUrl) {\n        config.registryUrls = [res.registryUrl];\n      }\n\n      // update digest for all\n      await resolveUpdateDigests(config, res, dependency);\n    }\n\n    if (res.updates.length) {\n      delete res.skipReason;\n    }\n    // Strip out any non-changed ones\n    res.updates = stripNoopUpdates(config, res.updates);\n\n    // If there is a digest update proposed which is in the pending updates for this dependency, ensure that `minimumReleaseAge` is applied.\n    // `currentVersionWasResolved` only matters for `pinDigest`, which `digestUpdate` never is - true is a safe constant.\n    if (digestUpdate && res.updates.includes(digestUpdate)) {\n      await applyMinimumReleaseAgeToDigestUpdate(\n        digestUpdate,\n        config,\n        res,\n        true,\n        newestMatchingVersionTimestamp,\n      );\n    }\n\n    const release =\n      res.updates.length > 0\n        ? (dependency?.releases.find(\n            (r) => r.version === res.updates[0].newValue,\n          ) ??\n          dependency?.releases.find(\n            (r) => r.version === res.updates[0].newVersion,\n          ))\n        : null;\n\n    if (release?.changelogContent) {\n      res.changelogContent = release.changelogContent;\n      res.changelogUrl = release.changelogUrl;\n    }\n  } catch (err) /* istanbul ignore next */ {\n    if (err instanceof ExternalHostError) {\n      return Result.err(err);\n    }\n\n    if (err instanceof Error && err.message === CONFIG_VALIDATION) {\n      return Result.err(err);\n    }\n\n    logger.error(\n      {\n        currentDigest: config.currentDigest,\n        currentValue: config.currentValue,\n        datasource: config.datasource,\n        packageName: config.packageName,\n        digestOneAndOnly: config.digestOneAndOnly,\n        followTag: config.followTag,\n        lockedVersion: config.lockedVersion,\n        packageFile: config.packageFile,\n        pinDigests: config.pinDigests,\n        rollbackPrs: config.rollbackPrs,\n        isVulnerabilityAlert: config.isVulnerabilityAlert,\n        updatePinnedDependencies: config.updatePinnedDependencies,\n        err,\n      },\n      'lookupUpdates error',\n    );\n    res.skipReason = 'internal-error';\n  }\n  return Result.ok(res);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DA,eAAe,aACb,QACA,UACA,SACA,eACuC;CACvC,MAAM,iBAAiB,SAAS,MAC7B,MACC,cAAc,QAAQ,EAAE,OAAO,KAC/B,cAAc,OAAO,EAAE,SAAS,OAAO,CAC3C;CAEA,IAAI,CAAC,gBACH,OAAO;CAGT,IAAI,eAAe,kBACjB,OAAO,eAAe;CAIxB,QAAO,MADqB,mBAAmB,QAAQ,cAAc,EAAA,EAC/C;AACxB;AAEA,eAAsB,cACpB,UAC+B;CAC/B,IAAI,SAA6B,EAAE,GAAG,SAAS;CAC/C,OAAO,eAAe,qBAAqB,OAAO,UAAU;CAE5D,MAAM,gBAAgBA,IAAkB,OAAO,UAAU;CAEzD,IAAI,aAAmC;CACvC,MAAM,MAAoB;EACxB,YAAY,OAAO;EACnB,SAAS,CAAC;EACV,UAAU,CAAC;CACb;CAEA,IAAI;CAEJ,IAAI;CAEJ,IAAI;EACF,OAAO,MACL;GACE,YAAY,OAAO;GACnB,cAAc,OAAO;EACvB,GACA,eACF;EACA,IAAI,OAAO,gBAAgB,CAAC,SAAS,OAAO,YAAY,GAAG;GAEzD,OAAO,MACL,4BAA4B,OAAO,YAAY,IAAI,cAAc,OAAO,YAAY,EAAE,IAAI,OAAO,OAAO,aAAa,EACvH;GACA,IAAI,aAAa;GACjB,OAAO,OAAO,GAAG,GAAG;EACtB;EACA,IAAI,CAAC,uBAAuB,MAAM,GAAG;GACnC,IAAI,aAAa;GACjB,OAAO,OAAO,GAAG,GAAG;EACtB;EACA,IAAI,CAAC,iBAAiB,OAAO,UAAU,GAAG;GACxC,IAAI,aAAa;GACjB,MAAM,cAAc,sBAAsB,OAAO,WAAW;GAC5D,IAAI,SAAS,KAAK;IAChB,OAAO;IACP,SAAS,uBAAuB,OAAO,WAAW,gBAAgB;GACpE,CAAC;GACD,OAAO,OAAO,GAAG,GAAG;EACtB;EACA,IAAI,eACF,OAAO,kBAAkB,OAAO,gBAC5B,OAAO,gBACP,OAAO;EACb,MAAM,4BAA4B,0BAA0B,MAAM;EAClE,IAAI,2BAA2B;GAC7B,eAAe,0BAA0B;GACzC,OAAO,uBACL,0BAA0B;GAC5B,IAAI,uBAAuB,0BAA0B;EACvD;EAEA,MAAM,UACJ,SAAS,YAAY,KAAK,cAAc,QAAQ,YAAY;EAE9D,MAAM,qBACJ,CAAC,CAAC,OAAO,iBAAiB,YAAY,OAAO,YAAY;EAE3D,IAAI,WAAW,oBAAoB;GACjC,IACE,CAAC,OAAO,4BACR,CAAC,OAAO,kBAER,cAAc,gBAAgB,YAAa,GAC3C;IACA,IAAI,aAAa;IACjB,OAAO,OAAO,GAAG,GAAG;GACtB;GAEA,MAAM,EAAE,KAAK,eAAe,KAAK,gBAAgB,MAAM,kBACrD,MACF,CAAC,CACE,WAAW,QAAQ,6BAA6B,eAAe,GAAG,CAAC,CAAC,CACpE,WAAW,QAAQ,qBAAqB,KAAK,MAAM,CAAC,CAAC,CACrD,WAAW,QAAQ,uBAAuB,KAAK,MAAM,CAAC,CAAC,CACvD,OAAO;GAEV,IAAI,uBAAuB,OACzB,MAAM;GAGR,IAAI,aAAa;IAEf,MAAM,cAAc,sBAAsB,OAAO,WAAW;IAC5D,MAAM,UAA6B;KACjC,OAAO;KACP,SAAS,qBAAqB,OAAO,WAAW,WAAW,YAAY,IAAI;IAC7E;IACA,OAAO,MACL;KACE,YAAY,OAAO;KACnB,aAAa,OAAO;IACtB,GACA,QAAQ,OACV;IAEA,IAAI,SAAS,KAAK,OAAO;IACzB,OAAO,OAAO,GAAG,GAAG;GACtB;GAEA,aAAa;GAEb,IAAI,WAAW,oBACb,OAAO,MACL,gCAAgC,OAAO,WAAW,WAAW,OAAO,aACtE;GAGF,WAAW,KAAK,YAAY;IAC1B;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;GACF,CAAC;GAED,MAAM,gBAAgB,WAAW,MAAM;GAEvC,IAAI,cAAc,WAAW,SAAS,QAAQ,YAC5C,cAAc,UAAU,QAAQ,OAAO,CACzC;GACA,MAAM,qBAAqB,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE,OAAO,CAAC;;GAOpE,IAAI,YAAY,WAAW,GAAG;IAE5B,OAAO,KACL;KACE,YAAY,OAAO;KACnB,QAAQ;IACV,GACA,2DACF;IACA,IAAI,CAAC,OAAO,eACV,OAAO,OAAO,GAAG,GAAG;GAExB;GAEA,SAAS,MAAM,kBACb;IACE,GAAG;IACH,WAAW,IAAI;IACf,qBAAqB,IAAI;GAC3B,GACA,YACF;GACA,IAAI,OAAO,WAAW;IACpB,MAAM,gBAAgB,WAAW,OAAO,OAAO;IAC/C,IAAI,CAAC,eAAe;KAClB,MAAM,cAAc,sBAAsB,OAAO,WAAW;KAC5D,IAAI,SAAS,KAAK;MAChB,OAAO;MACP,SAAS,+BAA+B,OAAO,UAAU,OAAO,OAAO,WAAW,WAAW;KAC/F,CAAC;KACD,OAAO,OAAO,GAAG,GAAG;IACtB;IACA,cAAc,YAAY,QAAQ,MAAM;KACtC,IAAI,EAAE,YAAY,eAChB,OAAO;KAET,OACE,EAAE,YAAY,gBACd,cAAc,cAAc,eAAe,YAAY;IAE3D,CAAC;GACH;GAEA,MAAM,sBAAsB,OAAO,kBAAkB;GAGrD,MAAM,yBADmB,uBAAuB,OAAO,gBAEjC,CAAC,qBACjB,YAAY,QAAQ,MAElB,cAAc,QAAQ,EAAE,SAAS,YAAa,CAChD,IACA;GACN,IAAI,CAAC,sBAAsB,QACzB,OAAO,MACL,sCAAsC,OAAO,WAAW,aAC1D;GAGF,IAAI,OAAO,eAAe,CAAC,sBAAsB,QAAQ;IACvD,MAAM,WAAW,kBAAkB,QAAQ,aAAa,aAAa;;IAErE,IAAI,CAAC,UAAU;KACb,MAAM,cAAc,sBAAsB,OAAO,WAAW;KAC5D,IAAI,SAAS,KAAK;MAChB,OAAO;MAEP,SAAS,+BAA+B,aAAc,OACpD,OAAO,WACR,WAAW;KACd,CAAC;KACD,OAAO,OAAO,GAAG,GAAG;IACtB;IACA,IAAI,QAAQ,KAAK,QAAQ;GAC3B;GACA,IAAI,gBAAgB,qBAAqB,MAAM;GAE/C,MAAM,iBAAiB,sBACrB,cACA,OAAO,eACP,eACA,eACA,eACA,WACF;GAEA,IAAI,CAAC,gBAAgB;;IAEnB,IAAI,CAAC,OAAO,eAAe;KACzB,OAAO,MACL,gDAAgD,OAAO,aACzD;KACA,IAAI,aAAa;IACnB;IACA,OAAO,OAAO,GAAG,GAAG;GACtB;GAEA,IAAI,iBAAiB;GAOrB,MAAM,sBAAsB,OAAO,iBAAiB;GACpD,MAAM,0BAA0B,MAAM,aACpC,QACA,aACA,qBACA,aACF;GAEA,IAAI,iBAAiB,uBAAuB,GAAG;IAC7C,IAAI,0BAA0B;IAC9B,IAAI,0BAA0B,eAAe,uBAAuB;IAEpE,IACE,OAAO,cAAc,MAAM,SACzB,iBAAiB,KAAK,eAAe,CACvC,GAGA,SAAS,MAAM,kBACb;KAAE,GAAG;KAAQ;IAAwB,GACrC,mBACF;GAEJ;GAEA,IACE,OAAO,gBACH,oCAAoC,QAAQ,QAAQ,IACpD,OAAO,cACP,oCAAoC,QAAQ,WAAW,GAC3D;IACA,MAAM,wBAAwB,yBAC5B,cACA,eACA,eACA,WACF;IACA,IAAI,uBACF,iCAAiC,MAAM,aACrC,QACA,aACA,uBACA,aACF;GAEJ;GAEA,IACE,gBACA,kBACA,kBAAkB,SAClB,CAAC,cAAc,gBAAgB,YAAY,GAC3C;IACA,MAAM,WACJ,cAAc,iBAAiB,cAAc,KAAK;IACpD,IAAI,QAAQ,KAAK;KACf,YAAY;KACZ,OAAO;KACP;KACA,YAAY;KACZ,UAAU,cAAc,SAAS,cAAc;IACjD,CAAC;GACH;GACA,IAAI,kBAAkB,OAEpB,gBAAgB;;GAMlB,IAAI,CAAC,cAAc,UAAU,cAAc,GAAG;IAC5C,IAAI,aAAa;IACjB,OAAO,OAAO,GAAG,GAAG;GACtB;GAGA,IAAI,mBAAmB,eACrB,QACA,gBACA,eACA,sBAAsB,wBAAwB,aAC9C,aACF,CAAC,CAAC,QAAQ,MAAM;IACd,IAAI,OAAO,gBACT,OAAO;IAIT,OACE,sBACA,cAAc,aAAa,EAAE,SAAS,YAAY;GAEtD,CAAC;GACD,MAAM,mBAAmB,4BACvB,QACA,KACA,eACA,gBACF;GACA,mBAAmB,iBAAiB;GACpC,MAAM,EAAE,6BAA6B;GAErC,MAAM,UAAU,yBACd,QACA,gBACA,kBACA,aACF;GACA,MAAM,kBAAkB,iBAAiB,QAAQ,GAAG;GACpD,KAAK,MAAM,CAAC,QAAQ,aAAa,OAAO,QAAQ,OAAO,GAAG;IACxD,MAAM,iBAAiB,SAAS,MAAM,IAAI,OACxC,cAAc,aAAa,GAAG,SAAS,GAAG,OAAO,CACnD;IACA,MAAM,EAAE,SAAS,eAAe,oBAC9B,MAAM,qBACJ,iBACA,eACA,QACA,cACF;;IAKF,IAAI,CAAC,SACH,OAAO,OAAO,GAAG,GAAG;IAEtB,MAAM,aAAa,QAAQ;IAC3B,MAAM,SAAS,MAAM,eACnB,QACA,OAAO,iBAAiB,OAAO,eAAe,cAC9C,eAGA,eACA,OAAO,iBAAiB,gBACxB,QACA,SACA,kBACF;IAIA,IACE,OAAO,YAAY,WACnB,gBAAgB,YAAY,KAC5B,gBAAgB,OAAO,QAAQ,KAC/B,OAAO,kBAAkB,OAAO,WAChC;KACA,OAAO,aAAa;KAIpB,MAAM,qCACJ,QACA,QACA,KACA,MACA,QAAQ,gBACV;IACF;IAEA,IAAI,eACF,OAAO,gBAAgB;IAGzB,IAAI,gBAAgB,QAClB,OAAO,kBAAkB,gBAAgB,KAAK,MAAM,EAAE,OAAO;IAE/D,IAAI,CAAC,OAAO,YAAY,OAAO,aAAa,cAAc;KACxD,IAAI,CAAC,OAAO,eACV;;KAGF,IAAI,kBAAkB,QAAQ;MAC5B,OAAO,MACL;OACE,aAAa,OAAO;OACpB,cAAc,OAAO;OACrB,eAAe,OAAO;OACtB;MACF,GACA,4CACF;MACA;KACF;KACA,IAAI,kBAAkB;IACxB;IACA,IAAI,oBACF,SAAS,OAAO,QAAQ,KACxB,cAAc,gBAAgB,OAAO,QAAQ;IAM/C,IACE,OAAO,eAAe,cACtB,OAAO,YACP,cAAc,UAAU,OAAO,QAAQ,KACvC,gBACA,cAAc,UAAU,YAAY,KACpC,cAAc,cAAc,cAAc,OAAO,QAAQ,KACzD,CAAC,cAAc,cAAc,OAAO,UAAU,YAAY,GAE1D,OAAO,KACL;KACE,aAAa,OAAO;KACpB,cAAc,OAAO;KACrB;KACA,gBAAgB,OAAO;KACvB;KACA,mBAAmB,YAAY;KAC/B,yBAAyB,iBAAiB,KAAK,MAAM,EAAE,OAAO;KAC9D;IACF,GACA,yCACF;SAEA,IAAI,QAAQ,KAAK,MAAM;GAE3B;EACF,OAAO,IAAI,cAAc;GACvB,OAAO,MACL,cAAc,OAAO,YAAY,qCAAqC,aAAa,eAAe,OAAO,WAAW,EACtH;GAEA,IAAI,CAAC,OAAO,cAAc,CAAC,OAAO,eAAe;IAC/C,OAAO,MACL,YAAY,OAAO,YAAY,wCACjC;IACA,IAAI,aAAa;GACnB,OACE,OAAO,IAAI;EAEf,OACE,IAAI,aAAa;EAGnB,IAAI,6BAA6B,MAAM,GACrC,4BAA4B,IAAI,SAAS,MAAM;OAC1C,IAAI,YAAY,mBAAmB,WAAW,oBACnD,IAAI,QAAQ,KAAK;GACf,YAAY;GACZ,SAAS,WAAW;GACpB,UAAU,WAAW;EACvB,CAAC;EAIH,IAAI,OAAO,eAAe;GACxB,IAAI,iBAAiB,OAAO;GAC5B,IAAI,eAAe,OAAO;EAC5B,OAAO,IAAI,gBAAgB,cAAc,gBAAgB,YAAY,GACnE,IAAI,eAAe,aAAa,QAAQ,MAAM,KAAK,GAAG,EAAE;EAI1D,4BAA4B,QAAQ,cAAc,IAAI,OAAO;EAG7D,IAAI,gBAAgB,OAAO,UAAU,GAAG;GACtC,IAAI,OAAO,eACL;QAAA,CAAC,OAAO,oBAAoB,CAAC,IAAI,QAAQ,QAAQ;KAEnD,eAAe;MACb,YAAY;MACZ,UAAU,OAAO;KACnB;KACA,IAAI,QAAQ,KAAK,YAAY;IAC/B;UACK,IACL,OAAO,cAEP,CAAC,OAAO;;GAGR,CAAC,IAAI,QAAQ,MAAM,WAAW,OAAO,eAAe,KAAK,GACzD;IAEA,MAAM,kBAAoC;KACxC,aAAa;KACb,YAAY;KACZ,UAAU,OAAO;IACnB;IACA,MAAM,qCACJ,iBACA,QACA,KACA,WAAW,oBACX,8BACF;IACA,IAAI,QAAQ,KAAK,eAAe;GAClC;GACA,IAAI,cAAc,gBAAgB;IAEhC,IAAI,iBAAiB,cAAc,eAAe,IAAI,cAAe;IACrE,KAAK,MAAM,UAAU,IAAI,SAEvB,OAAO,aAAa,cAAc,eAAe,OAAO,UAAW;GAEvE;GACA,IAAI,IAAI,aACN,OAAO,eAAe,CAAC,IAAI,WAAW;GAIxC,MAAM,qBAAqB,QAAQ,KAAK,UAAU;EACpD;EAEA,IAAI,IAAI,QAAQ,QACd,OAAO,IAAI;EAGb,IAAI,UAAU,iBAAiB,QAAQ,IAAI,OAAO;EAIlD,IAAI,gBAAgB,IAAI,QAAQ,SAAS,YAAY,GACnD,MAAM,qCACJ,cACA,QACA,KACA,MACA,8BACF;EAGF,MAAM,UACJ,IAAI,QAAQ,SAAS,IAChB,YAAY,SAAS,MACnB,MAAM,EAAE,YAAY,IAAI,QAAQ,EAAE,CAAC,QACtC,KACA,YAAY,SAAS,MAClB,MAAM,EAAE,YAAY,IAAI,QAAQ,EAAE,CAAC,UACtC,IACA;EAEN,IAAI,SAAS,kBAAkB;GAC7B,IAAI,mBAAmB,QAAQ;GAC/B,IAAI,eAAe,QAAQ;EAC7B;CACF,SAAS,gCAAgC;EACvC,IAAI,eAAe,mBACjB,OAAO,OAAO,IAAI,GAAG;EAGvB,IAAI,eAAe,SAAS,IAAI,YAAA,qBAC9B,OAAO,OAAO,IAAI,GAAG;EAGvB,OAAO,MACL;GACE,eAAe,OAAO;GACtB,cAAc,OAAO;GACrB,YAAY,OAAO;GACnB,aAAa,OAAO;GACpB,kBAAkB,OAAO;GACzB,WAAW,OAAO;GAClB,eAAe,OAAO;GACtB,aAAa,OAAO;GACpB,YAAY,OAAO;GACnB,aAAa,OAAO;GACpB,sBAAsB,OAAO;GAC7B,0BAA0B,OAAO;GACjC;EACF,GACA,qBACF;EACA,IAAI,aAAa;CACnB;CACA,OAAO,OAAO,GAAG,GAAG;AACtB"}

package/dist/workers/repository/process/lookup/utils.js

@@ -37,13 +37,19 @@ function getNewVersion(config) {
 	if (!isNullOrUndefined(config.replacementVersionTemplate)) return compile(config.replacementVersionTemplate, config, true);
 	return null;
 }
+function isRenamed(update, config) {
+	return isString(update.newName) && update.newName !== config.packageName;
+}
+function hasChangedDigest(update, config) {
+	return !!update.newDigest && !update.newDigest.startsWith(config.currentDigest);
+}
 /**
 * Drop every update which would not actually change the package file, plus the
 * updates excluded by `rangeStrategy=in-range-only` and by the `rollbackPrs` +
 * `followTag` edge case.
 */
 function stripNoopUpdates(config, updates) {
-	let result = updates.filter((update) => update.newValue !== null || config.currentValue === null).filter((update) => update.newDigest !== null).filter((update) => isString(update.newName) && update.newName !== config.packageName || update.isReplacement === true || update.newValue !== config.currentValue || update.isLockfileUpdate === true || update.newDigest && !update.newDigest.startsWith(config.currentDigest));
+	let result = updates.filter((update) => update.newValue !== null || config.currentValue === null).filter((update) => update.newDigest !== null).filter((update) => isRenamed(update, config) || update.isReplacement === true || update.newValue !== config.currentValue || update.isLockfileUpdate === true || hasChangedDigest(update, config));
 	if (config.rangeStrategy === "in-range-only") result = result.filter((update) => update.newValue === config.currentValue);
 	if (config.rollbackPrs && config.followTag) result = result.filter((update) => update.updateType !== "rollback" || result.length === 1);
 	return result;

package/dist/workers/repository/process/lookup/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":["template.compile","allVersioning.get"],"sources":["../../../../../lib/workers/repository/process/lookup/utils.ts"],"sourcesContent":["import {\n  isNonEmptyString,\n  isNullOrUndefined,\n  isString,\n} from '@sindresorhus/is';\n\nimport { getRangeStrategy } from '../../../../modules/manager/index.ts';\nimport type { LookupUpdate } from '../../../../modules/manager/types.ts';\nimport * as allVersioning from '../../../../modules/versioning/index.ts';\nimport * as template from '../../../../util/template/index.ts';\nimport type { LookupUpdateConfig } from './types.ts';\n\nexport function addReplacementUpdateIfValid(\n  updates: LookupUpdate[],\n  config: LookupUpdateConfig,\n): void {\n  const replacementNewName = determineNewReplacementName(config);\n  const replacementNewValue = determineNewReplacementValue(config);\n\n  if (\n    config.packageName !== replacementNewName ||\n    config.currentValue !== replacementNewValue\n  ) {\n    updates.push({\n      updateType: 'replacement',\n      newName: replacementNewName,\n      newValue: replacementNewValue!,\n    });\n  }\n}\n\nexport function isReplacementRulesConfigured(\n  config: LookupUpdateConfig,\n): boolean {\n  return (\n    isNonEmptyString(config.replacementName) ||\n    isNonEmptyString(config.replacementNameTemplate) ||\n    isNonEmptyString(config.replacementVersion) ||\n    isNonEmptyString(config.replacementVersionTemplate)\n  );\n}\n\nexport function determineNewReplacementName(\n  config: LookupUpdateConfig,\n): string {\n  if (config.replacementName) {\n    return config.replacementName;\n  }\n  if (config.replacementNameTemplate) {\n    return template.compile(config.replacementNameTemplate, config, true);\n  }\n  return config.packageName;\n}\n\nexport function determineNewReplacementValue(\n  config: LookupUpdateConfig,\n): string | undefined | null {\n  const newVersion = getNewVersion(config);\n  if (!newVersion) {\n    return config.currentValue;\n  }\n\n  const versioningApi = allVersioning.get(config.versioning);\n  const rangeStrategy = getRangeStrategy(config);\n\n  return versioningApi.getNewValue({\n    // TODO #22198\n    currentValue: config.currentValue!,\n    newVersion,\n    rangeStrategy: rangeStrategy!,\n    isReplacement: true,\n  });\n}\n\nfunction getNewVersion(config: LookupUpdateConfig): string | null {\n  if (!isNullOrUndefined(config.replacementVersion)) {\n    return config.replacementVersion;\n  }\n  if (!isNullOrUndefined(config.replacementVersionTemplate)) {\n    return template.compile(config.replacementVersionTemplate, config, true);\n  }\n  return null;\n}\n\n/**\n * Drop every update which would not actually change the package file, plus the\n * updates excluded by `rangeStrategy=in-range-only` and by the `rollbackPrs` +\n * `followTag` edge case.\n */\nexport function stripNoopUpdates(\n  config: LookupUpdateConfig,\n  updates: LookupUpdate[],\n): LookupUpdate[] {\n  let result = updates\n    .filter(\n      (update) => update.newValue !== null || config.currentValue === null,\n    )\n    .filter((update) => update.newDigest !== null)\n    .filter(\n      (update) =>\n        (isString(update.newName) && update.newName !== config.packageName) ||\n        update.isReplacement === true ||\n        update.newValue !== config.currentValue ||\n        update.isLockfileUpdate === true ||\n        // TODO #22198\n        (update.newDigest &&\n          !update.newDigest.startsWith(config.currentDigest!)),\n    );\n\n  // If range strategy specified in config is 'in-range-only', also strip out updates where currentValue !== newValue\n  if (config.rangeStrategy === 'in-range-only') {\n    result = result.filter((update) => update.newValue === config.currentValue);\n  }\n\n  // Handle a weird edge case involving followTag and fallbacks\n  if (config.rollbackPrs && config.followTag) {\n    result = result.filter(\n      (update) => update.updateType !== 'rollback' || result.length === 1,\n    );\n  }\n\n  return result;\n}\n"],"mappings":";;;;;AAYA,SAAgB,4BACd,SACA,QACM;CACN,MAAM,qBAAqB,4BAA4B,MAAM;CAC7D,MAAM,sBAAsB,6BAA6B,MAAM;CAE/D,IACE,OAAO,gBAAgB,sBACvB,OAAO,iBAAiB,qBAExB,QAAQ,KAAK;EACX,YAAY;EACZ,SAAS;EACT,UAAU;CACZ,CAAC;AAEL;AAEA,SAAgB,6BACd,QACS;CACT,OACE,iBAAiB,OAAO,eAAe,KACvC,iBAAiB,OAAO,uBAAuB,KAC/C,iBAAiB,OAAO,kBAAkB,KAC1C,iBAAiB,OAAO,0BAA0B;AAEtD;AAEA,SAAgB,4BACd,QACQ;CACR,IAAI,OAAO,iBACT,OAAO,OAAO;CAEhB,IAAI,OAAO,yBACT,OAAOA,QAAiB,OAAO,yBAAyB,QAAQ,IAAI;CAEtE,OAAO,OAAO;AAChB;AAEA,SAAgB,6BACd,QAC2B;CAC3B,MAAM,aAAa,cAAc,MAAM;CACvC,IAAI,CAAC,YACH,OAAO,OAAO;CAGhB,MAAM,gBAAgBC,IAAkB,OAAO,UAAU;CACzD,MAAM,gBAAgB,iBAAiB,MAAM;CAE7C,OAAO,cAAc,YAAY;EAE/B,cAAc,OAAO;EACrB;EACe;EACf,eAAe;CACjB,CAAC;AACH;AAEA,SAAS,cAAc,QAA2C;CAChE,IAAI,CAAC,kBAAkB,OAAO,kBAAkB,GAC9C,OAAO,OAAO;CAEhB,IAAI,CAAC,kBAAkB,OAAO,0BAA0B,GACtD,OAAOD,QAAiB,OAAO,4BAA4B,QAAQ,IAAI;CAEzE,OAAO;AACT;;;;;;AAOA,SAAgB,iBACd,QACA,SACgB;CAChB,IAAI,SAAS,QACV,QACE,WAAW,OAAO,aAAa,QAAQ,OAAO,iBAAiB,IAClE,CAAC,CACA,QAAQ,WAAW,OAAO,cAAc,IAAI,CAAC,CAC7C,QACE,WACE,SAAS,OAAO,OAAO,KAAK,OAAO,YAAY,OAAO,eACvD,OAAO,kBAAkB,QACzB,OAAO,aAAa,OAAO,gBAC3B,OAAO,qBAAqB,QAE3B,OAAO,aACN,CAAC,OAAO,UAAU,WAAW,OAAO,aAAc,CACxD;CAGF,IAAI,OAAO,kBAAkB,iBAC3B,SAAS,OAAO,QAAQ,WAAW,OAAO,aAAa,OAAO,YAAY;CAI5E,IAAI,OAAO,eAAe,OAAO,WAC/B,SAAS,OAAO,QACb,WAAW,OAAO,eAAe,cAAc,OAAO,WAAW,CACpE;CAGF,OAAO;AACT"}
+{"version":3,"file":"utils.js","names":["template.compile","allVersioning.get"],"sources":["../../../../../lib/workers/repository/process/lookup/utils.ts"],"sourcesContent":["import {\n  isNonEmptyString,\n  isNullOrUndefined,\n  isString,\n} from '@sindresorhus/is';\n\nimport { getRangeStrategy } from '../../../../modules/manager/index.ts';\nimport type { LookupUpdate } from '../../../../modules/manager/types.ts';\nimport * as allVersioning from '../../../../modules/versioning/index.ts';\nimport * as template from '../../../../util/template/index.ts';\nimport type { LookupUpdateConfig } from './types.ts';\n\nexport function addReplacementUpdateIfValid(\n  updates: LookupUpdate[],\n  config: LookupUpdateConfig,\n): void {\n  const replacementNewName = determineNewReplacementName(config);\n  const replacementNewValue = determineNewReplacementValue(config);\n\n  if (\n    config.packageName !== replacementNewName ||\n    config.currentValue !== replacementNewValue\n  ) {\n    updates.push({\n      updateType: 'replacement',\n      newName: replacementNewName,\n      newValue: replacementNewValue!,\n    });\n  }\n}\n\nexport function isReplacementRulesConfigured(\n  config: LookupUpdateConfig,\n): boolean {\n  return (\n    isNonEmptyString(config.replacementName) ||\n    isNonEmptyString(config.replacementNameTemplate) ||\n    isNonEmptyString(config.replacementVersion) ||\n    isNonEmptyString(config.replacementVersionTemplate)\n  );\n}\n\nexport function determineNewReplacementName(\n  config: LookupUpdateConfig,\n): string {\n  if (config.replacementName) {\n    return config.replacementName;\n  }\n  if (config.replacementNameTemplate) {\n    return template.compile(config.replacementNameTemplate, config, true);\n  }\n  return config.packageName;\n}\n\nexport function determineNewReplacementValue(\n  config: LookupUpdateConfig,\n): string | undefined | null {\n  const newVersion = getNewVersion(config);\n  if (!newVersion) {\n    return config.currentValue;\n  }\n\n  const versioningApi = allVersioning.get(config.versioning);\n  const rangeStrategy = getRangeStrategy(config);\n\n  return versioningApi.getNewValue({\n    // TODO #22198\n    currentValue: config.currentValue!,\n    newVersion,\n    rangeStrategy: rangeStrategy!,\n    isReplacement: true,\n  });\n}\n\nfunction getNewVersion(config: LookupUpdateConfig): string | null {\n  if (!isNullOrUndefined(config.replacementVersion)) {\n    return config.replacementVersion;\n  }\n  if (!isNullOrUndefined(config.replacementVersionTemplate)) {\n    return template.compile(config.replacementVersionTemplate, config, true);\n  }\n  return null;\n}\n\nfunction isRenamed(update: LookupUpdate, config: LookupUpdateConfig): boolean {\n  return isString(update.newName) && update.newName !== config.packageName;\n}\n\nfunction hasChangedDigest(\n  update: LookupUpdate,\n  config: LookupUpdateConfig,\n): boolean {\n  // TODO #22198\n  return (\n    !!update.newDigest && !update.newDigest.startsWith(config.currentDigest!)\n  );\n}\n\n/**\n * Drop every update which would not actually change the package file, plus the\n * updates excluded by `rangeStrategy=in-range-only` and by the `rollbackPrs` +\n * `followTag` edge case.\n */\nexport function stripNoopUpdates(\n  config: LookupUpdateConfig,\n  updates: LookupUpdate[],\n): LookupUpdate[] {\n  let result = updates\n    .filter(\n      (update) => update.newValue !== null || config.currentValue === null,\n    )\n    .filter((update) => update.newDigest !== null)\n    .filter(\n      (update) =>\n        isRenamed(update, config) ||\n        update.isReplacement === true ||\n        update.newValue !== config.currentValue ||\n        update.isLockfileUpdate === true ||\n        hasChangedDigest(update, config),\n    );\n\n  // If range strategy specified in config is 'in-range-only', also strip out updates where currentValue !== newValue\n  if (config.rangeStrategy === 'in-range-only') {\n    result = result.filter((update) => update.newValue === config.currentValue);\n  }\n\n  // Handle a weird edge case involving followTag and fallbacks\n  if (config.rollbackPrs && config.followTag) {\n    result = result.filter(\n      (update) => update.updateType !== 'rollback' || result.length === 1,\n    );\n  }\n\n  return result;\n}\n"],"mappings":";;;;;AAYA,SAAgB,4BACd,SACA,QACM;CACN,MAAM,qBAAqB,4BAA4B,MAAM;CAC7D,MAAM,sBAAsB,6BAA6B,MAAM;CAE/D,IACE,OAAO,gBAAgB,sBACvB,OAAO,iBAAiB,qBAExB,QAAQ,KAAK;EACX,YAAY;EACZ,SAAS;EACT,UAAU;CACZ,CAAC;AAEL;AAEA,SAAgB,6BACd,QACS;CACT,OACE,iBAAiB,OAAO,eAAe,KACvC,iBAAiB,OAAO,uBAAuB,KAC/C,iBAAiB,OAAO,kBAAkB,KAC1C,iBAAiB,OAAO,0BAA0B;AAEtD;AAEA,SAAgB,4BACd,QACQ;CACR,IAAI,OAAO,iBACT,OAAO,OAAO;CAEhB,IAAI,OAAO,yBACT,OAAOA,QAAiB,OAAO,yBAAyB,QAAQ,IAAI;CAEtE,OAAO,OAAO;AAChB;AAEA,SAAgB,6BACd,QAC2B;CAC3B,MAAM,aAAa,cAAc,MAAM;CACvC,IAAI,CAAC,YACH,OAAO,OAAO;CAGhB,MAAM,gBAAgBC,IAAkB,OAAO,UAAU;CACzD,MAAM,gBAAgB,iBAAiB,MAAM;CAE7C,OAAO,cAAc,YAAY;EAE/B,cAAc,OAAO;EACrB;EACe;EACf,eAAe;CACjB,CAAC;AACH;AAEA,SAAS,cAAc,QAA2C;CAChE,IAAI,CAAC,kBAAkB,OAAO,kBAAkB,GAC9C,OAAO,OAAO;CAEhB,IAAI,CAAC,kBAAkB,OAAO,0BAA0B,GACtD,OAAOD,QAAiB,OAAO,4BAA4B,QAAQ,IAAI;CAEzE,OAAO;AACT;AAEA,SAAS,UAAU,QAAsB,QAAqC;CAC5E,OAAO,SAAS,OAAO,OAAO,KAAK,OAAO,YAAY,OAAO;AAC/D;AAEA,SAAS,iBACP,QACA,QACS;CAET,OACE,CAAC,CAAC,OAAO,aAAa,CAAC,OAAO,UAAU,WAAW,OAAO,aAAc;AAE5E;;;;;;AAOA,SAAgB,iBACd,QACA,SACgB;CAChB,IAAI,SAAS,QACV,QACE,WAAW,OAAO,aAAa,QAAQ,OAAO,iBAAiB,IAClE,CAAC,CACA,QAAQ,WAAW,OAAO,cAAc,IAAI,CAAC,CAC7C,QACE,WACC,UAAU,QAAQ,MAAM,KACxB,OAAO,kBAAkB,QACzB,OAAO,aAAa,OAAO,gBAC3B,OAAO,qBAAqB,QAC5B,iBAAiB,QAAQ,MAAM,CACnC;CAGF,IAAI,OAAO,kBAAkB,iBAC3B,SAAS,OAAO,QAAQ,WAAW,OAAO,aAAa,OAAO,YAAY;CAI5E,IAAI,OAAO,eAAe,OAAO,WAC/B,SAAS,OAAO,QACb,WAAW,OAAO,eAAe,cAAc,OAAO,WAAW,CACpE;CAGF,OAAO;AACT"}

package/dist/workers/repository/process/vulnerabilities.js

@@ -229,15 +229,19 @@ var Vulnerabilities = class Vulnerabilities {
 		for (const range of coerceArray(affected.ranges)) {
 			if (range.type === "GIT") continue;
 			let vulnerable = false;
-			for (const event of this.sortEvents(range.events, versioningApi)) if (isNonEmptyString(event.introduced) && (event.introduced === "0" || this.isVersionGtOrEq(depVersion, event.introduced, versioningApi))) vulnerable = true;
+			for (const event of this.sortEvents(range.events, versioningApi)) if (isNonEmptyString(event.introduced) && this.isIntroducedIn(depVersion, event.introduced, versioningApi)) vulnerable = true;
 			else if (isNonEmptyString(event.fixed) && this.isVersionGtOrEq(depVersion, event.fixed, versioningApi)) vulnerable = false;
 			else if (isNonEmptyString(event.last_affected) && this.isVersionGt(depVersion, event.last_affected, versioningApi)) vulnerable = false;
 			if (vulnerable) return true;
 		}
 		return false;
 	}
+	isIntroducedIn(depVersion, introduced, versioningApi) {
+		return introduced === "0" || this.isVersionGtOrEq(depVersion, introduced, versioningApi);
+	}
 	isPackageVulnerable(ecosystem, osvPackageName, depVersion, affected, versioningApi) {
-		return this.isPackageAffected(ecosystem, osvPackageName, affected) && (this.includedInVersions(depVersion, affected) || this.includedInRanges(depVersion, affected, versioningApi));
+		if (!this.isPackageAffected(ecosystem, osvPackageName, affected)) return false;
+		return this.includedInVersions(depVersion, affected) || this.includedInRanges(depVersion, affected, versioningApi);
 	}
 	getFixedVersion(ecosystem, depVersion, affected, versioningApi) {
 		const fixedVersions = [];
@@ -265,7 +269,10 @@ var Vulnerabilities = class Vulnerabilities {
 		return versioningApi.isVersion(version) && versioningApi.isVersion(other) && versioningApi.isGreaterThan(version, other);
 	}
 	isVersionGtOrEq(version, other, versioningApi) {
-		return versioningApi.isVersion(version) && versioningApi.isVersion(other) && (versioningApi.equals(version, other) || versioningApi.isGreaterThan(version, other));
+		return versioningApi.isVersion(version) && versioningApi.isVersion(other) && this.isEqualOrGreater(version, other, versioningApi);
+	}
+	isEqualOrGreater(version, other, versioningApi) {
+		return versioningApi.equals(version, other) || versioningApi.isGreaterThan(version, other);
 	}
 	vulnerabilityToPackageRules(vul) {
 		const { vulnerability, affected, packageName, depType, depVersion, fixedVersion, datasource, versioning: depVersioning, packageFileConfig } = vul;