renovate 44.237.2 → 44.238.0

package/dist/config/presets/internal/security.preset.js

@@ -42,14 +42,17 @@ const php2shellRule = {
 const minimumReleaseAgeDatasources = {
 	crate: {
 		description: "Wait until the Crate version is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behavior in crates, and b) reduces the risk of upgrading to a newly published crate that its owner deletes during crates.io's initial 72-hour deletion window.",
+		manager: "cargo",
 		minimumReleaseAge: "3 days"
 	},
 	npm: {
 		description: "Wait until the npm package is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behavior in packages, and b) prevents the maintainer and/or NPM from unpublishing a package you already upgraded to, breaking builds.",
+		manager: "npm",
 		minimumReleaseAge: "3 days"
 	},
 	pypi: {
 		description: "Wait until the Python package is three days old before raising the update. This introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behavior in packages.",
+		manager: "poetry",
 		minimumReleaseAge: "3 days"
 	}
 };
@@ -92,17 +95,19 @@ const unsupportedUpdateTypeRules = [
 		prBodyNotes: ["⚠️ Renovate does not enforce Minimum Release Age for `bump`, `lockfileUpdate`, or `rollback` updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s)."]
 	}
 ];
-function buildMinimumReleaseAgePreset(datasource, { description, minimumReleaseAge }) {
+function buildMinimumReleaseAgePreset(datasource, { description, manager, minimumReleaseAge }) {
+	const packageRules = [{
+		internalChecksFilter: "strict",
+		matchDatasources: [datasource],
+		minimumReleaseAge
+	}, ...unsupportedUpdateTypeRules.map((rule) => ({
+		...rule,
+		matchDatasources: [datasource]
+	}))];
 	return {
 		description,
-		packageRules: [{
-			internalChecksFilter: "strict",
-			matchDatasources: [datasource],
-			minimumReleaseAge
-		}, ...unsupportedUpdateTypeRules.map((rule) => ({
-			...rule,
-			matchDatasources: [datasource]
-		}))]
+		[manager]: { minimumReleaseAgePackageManager: minimumReleaseAge },
+		packageRules
 	};
 }
 function loadMinimumReleaseAgePresets() {

package/dist/config/presets/internal/security.preset.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.preset.js","names":[],"sources":["../../../../lib/config/presets/internal/security.preset.ts"],"sourcesContent":["import type { DatasourceName } from '../../../datasource-list.generated.ts';\nimport type { PackageRule } from '../../types.ts';\nimport { UpdateTypesOptions } from '../../types.ts';\nimport type { Preset } from '../types.ts';\n\nconst php2shellPatchedVersions = JSON.stringify({\n  '8.2': 35,\n  '8.3': 36,\n  '8.4': 27,\n  '8.5': 12,\n});\n\nconst php2shellVulnerableVersion = `(\n  $value := (manager = \"mise\" and isLockfileOnly) ? lockedVersion : currentValue;\n  $version := datasource = \"docker\" ? $split($value, \"-\")[0] : $value;\n  $parts := $match($version, /^(8\\\\.[2-5])\\\\.(\\\\d+)$/).groups;\n\n  $not(vulnerabilityAlerts.enabled = false) and $exists($parts)\n    and $number($parts[1]) < $lookup(${php2shellPatchedVersions}, $parts[0])\n)`;\n\nconst php2shellRule = {\n  isVulnerabilityAlert: true,\n  matchJsonata: [\n    `${php2shellVulnerableVersion} and (\n      $version := datasource = \"docker\" ? $split(newVersion, \"-\")[0] : newVersion;\n      $parts := $match($version, /^(8\\\\.[2-5])\\\\.(\\\\d+)$/).groups;\n\n      $exists($parts) and $number($parts[1]) >= $lookup(${php2shellPatchedVersions}, $parts[0])\n    )`,\n  ],\n  matchUpdateTypes: ['patch', 'minor', 'major'],\n  prBodyNotes: [\n    [\n      '> ⚠️ PHP2Shell vulnerabilities can allow remote code execution. This PR updates affected PHP versions to patched releases. Rebuild affected images, deploy the updates, and restart PHP workers.',\n      '>',\n      '> Details: [CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and [CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp).',\n    ].join('\\n'),\n  ],\n  schedule: [],\n} satisfies PackageRule;\n\ninterface MinimumReleaseAgeDatasource {\n  description: string;\n  minimumReleaseAge: string;\n}\n\n/**\n * Datasources for which we expose a `security:minimumReleaseAge*` preset.\n *\n * Only supported for Datasources that have `releaseTimestampSupport`.\n */\nconst minimumReleaseAgeDatasources: Partial<\n  Record<DatasourceName, MinimumReleaseAgeDatasource>\n> = {\n  crate: {\n    description:\n      \"Wait until the Crate version is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behavior in crates, and b) reduces the risk of upgrading to a newly published crate that its owner deletes during crates.io's initial 72-hour deletion window.\",\n    minimumReleaseAge: '3 days',\n  },\n  npm: {\n    description:\n      'Wait until the npm package is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behavior in packages, and b) prevents the maintainer and/or NPM from unpublishing a package you already upgraded to, breaking builds.',\n    minimumReleaseAge: '3 days',\n  },\n  pypi: {\n    description:\n      'Wait until the Python package is three days old before raising the update. This introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behavior in packages.',\n    minimumReleaseAge: '3 days',\n  },\n};\n\n/**\n * Certain update types don't currently support `releaseTimestamp`s, so applying `minimumReleaseAge` to them results in updates that will never come.\n *\n * Instead, we opt them out of `minimumReleaseAge`, and add a warning for the user.\n *\n * This must stay in sync with the update types documented as _not_ supported (❌) in `docs/usage/key-concepts/minimum-release-age.md`, so we opt-out any unsupported `updateType`s.\n *\n * These rules are datasource-agnostic (`matchDatasources` is added per preset), so they are shared across every generated `security:minimumReleaseAge*` preset to keep the warnings consistent.\n */\nconst unsupportedUpdateTypeRules: PackageRule[] = [\n  {\n    description:\n      'Do not require Minimum Release Age for update types that are controlled by the package manager',\n    matchUpdateTypes: ['lockFileMaintenance'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's lock file maintenance functionality does not support validating Minimum Release Age, as the package manager performs the required changes to update package(s). Confirm whether your package manager perform its own validation for the Minimum Release Age of packages.\",\n    ],\n  },\n  // TODO #39400\n  {\n    description: 'Do not require Minimum Release Age for package replacements',\n    matchUpdateTypes: ['replacement'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's replacement functionality [does not currently](https://github.com/renovatebot/renovate/issues/39400) wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).\",\n    ],\n  },\n  // TODO #40288\n  {\n    description: 'Do not require Minimum Release Age for package pinning',\n    matchUpdateTypes: ['pin'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's pin functionality [does not currently](https://github.com/renovatebot/renovate/issues/40288) wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).\",\n    ],\n  },\n  {\n    description:\n      'Do not require Minimum Release Age for update types that do not provide a release timestamp',\n    matchUpdateTypes: ['bump', 'lockfileUpdate', 'rollback'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      '⚠️ Renovate does not enforce Minimum Release Age for `bump`, `lockfileUpdate`, or `rollback` updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).',\n    ],\n  },\n];\n\nfunction buildMinimumReleaseAgePreset(\n  datasource: string,\n  { description, minimumReleaseAge }: MinimumReleaseAgeDatasource,\n): Preset {\n  const packageRules: PackageRule[] = [\n    {\n      internalChecksFilter: 'strict',\n      matchDatasources: [datasource],\n      minimumReleaseAge,\n    },\n    ...unsupportedUpdateTypeRules.map((rule): PackageRule => ({\n      ...rule,\n      matchDatasources: [datasource],\n    })),\n  ];\n\n  return { description, packageRules };\n}\n\nfunction loadMinimumReleaseAgePresets(): Record<string, Preset> {\n  const presets: Record<string, Preset> = {};\n\n  for (const [datasource, config] of Object.entries(\n    minimumReleaseAgeDatasources,\n  )) {\n    const suffix = datasource[0].toUpperCase() + datasource.slice(1);\n    presets[`minimumReleaseAge${suffix}`] = buildMinimumReleaseAgePreset(\n      datasource,\n      config,\n    );\n  }\n\n  return presets;\n}\n\nexport const presets: Record<string, Preset> = {\n  gomodIndirectSecurityUpdates: {\n    description:\n      'Enable go.mod indirect dependency updates only when vulnerabilities have been detected.',\n    extends: [':enableVulnerabilityAlerts'],\n    packageRules: [\n      {\n        description: 'Enable lookups for indirect go.mod dependencies',\n        enabled: true,\n        matchDepTypes: ['indirect'],\n        matchManagers: ['gomod'],\n      },\n      {\n        description:\n          'Disable non-security updates for indirect go.mod dependencies (vulnerability alerts use force to override this)',\n        enabled: false,\n        matchDepTypes: ['indirect'],\n        matchManagers: ['gomod'],\n        matchUpdateTypes: [...UpdateTypesOptions],\n      },\n    ],\n  },\n  ...loadMinimumReleaseAgePresets(),\n  'only-security-updates': {\n    description:\n      'Only update dependencies if vulnerabilities have been detected.',\n    extends: ['config:recommended'],\n    osvVulnerabilityAlerts: true,\n    packageRules: [\n      {\n        enabled: false,\n        matchPackageNames: ['*'],\n      },\n    ],\n    vulnerabilityAlerts: {\n      enabled: true,\n    },\n  },\n  'openssf-scorecard': {\n    description: 'Show OpenSSF badge on pull requests.',\n    packageRules: [\n      {\n        matchSourceUrls: ['https://github.com/**'],\n        prBodyColumns: [\n          'Package',\n          'Type',\n          'Update',\n          'Change',\n          'Pending',\n          'OpenSSF',\n        ],\n        prBodyDefinitions: {\n          OpenSSF:\n            '[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/{{sourceRepo}}/badge)](https://securityscorecards.dev/viewer/?uri=github.com/{{sourceRepo}})',\n        },\n      },\n    ],\n  },\n  php2shell: {\n    customManagers: [\n      {\n        customType: 'regex',\n        datasourceTemplate: 'github-tags',\n        depNameTemplate: 'php',\n        depTypeTemplate: 'php2shell-runtime',\n        extractVersionTemplate: '^php-(?<version>\\\\S+)',\n        managerFilePatterns: ['/(^|/)\\\\.php-version$/'],\n        matchStrings: ['^\\\\s*(?<currentValue>8\\\\.[2-5]\\\\.\\\\d+)\\\\s*$'],\n        packageNameTemplate: 'php/php-src',\n      },\n      {\n        customType: 'jsonata',\n        datasourceTemplate: 'github-tags',\n        depNameTemplate: 'php',\n        depTypeTemplate: 'php2shell-runtime',\n        extractVersionTemplate: '^php-(?<version>\\\\S+)',\n        fileFormat: 'yaml',\n        managerFilePatterns: [\n          '/(^|/)(workflow-templates|\\\\.(?:github|gitea|forgejo)/(?:workflows|actions))/.+\\\\.ya?ml$/',\n          '/(^|/)action\\\\.ya?ml$/',\n        ],\n        matchStrings: [\n          '**[uses and $exists($match(uses, /^shivammathur\\\\/setup-php@/))].with.\"php-version\"[$type($) = \"string\" and $exists($match($, /^8\\\\.[2-5]\\\\.\\\\d+$/))].{\"currentValue\": $}',\n        ],\n        packageNameTemplate: 'php/php-src',\n      },\n    ],\n    description:\n      'Update vulnerable PHP runtime pins for CVE-2026-109618 and CVE-2026-109619.',\n    packageRules: [\n      {\n        enabled: false,\n        matchDepTypes: ['php2shell-runtime'],\n        matchManagers: ['custom.regex', 'custom.jsonata'],\n      },\n      {\n        enabled: true,\n        matchDepTypes: ['php2shell-runtime'],\n        matchJsonata: [php2shellVulnerableVersion],\n        matchManagers: ['custom.regex', 'custom.jsonata'],\n      },\n      {\n        ...php2shellRule,\n        matchDatasources: ['github-tags'],\n        matchPackageNames: ['containerbase/php-prebuild', 'php/php-src'],\n      },\n      {\n        ...php2shellRule,\n        matchDatasources: ['docker'],\n        matchPackageNames: [\n          '/^(?:(?:docker\\\\.io|index\\\\.docker\\\\.io)\\\\/)?(?:library\\\\/)?php$/',\n        ],\n      },\n    ],\n  },\n};\n\nexport const minimumReleaseAgeDatasourceNames = Object.keys(\n  minimumReleaseAgeDatasources,\n);\n"],"mappings":";;AAKA,MAAM,2BAA2B,KAAK,UAAU;CAC9C,OAAO;CACP,OAAO;CACP,OAAO;CACP,OAAO;AACT,CAAC;AAED,MAAM,6BAA6B;;;;;;uCAMI,yBAAyB;;AAGhE,MAAM,gBAAgB;CACpB,sBAAsB;CACtB,cAAc,CACZ,GAAG,2BAA2B;;;;0DAIwB,yBAAyB;MAEjF;CACA,kBAAkB;EAAC;EAAS;EAAS;CAAO;CAC5C,aAAa,CACX;EACE;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI,CACb;CACA,UAAU,CAAC;AACb;;;;;;AAYA,MAAM,+BAEF;CACF,OAAO;EACL,aACE;EACF,mBAAmB;CACrB;CACA,KAAK;EACH,aACE;EACF,mBAAmB;CACrB;CACA,MAAM;EACJ,aACE;EACF,mBAAmB;CACrB;AACF;;;;;;;;;;AAWA,MAAM,6BAA4C;CAChD;EACE,aACE;EACF,kBAAkB,CAAC,qBAAqB;EACxC,mBAAmB;EACnB,aAAa,CACX,wRACF;CACF;CAEA;EACE,aAAa;EACb,kBAAkB,CAAC,aAAa;EAChC,mBAAmB;EACnB,aAAa,CACX,yRACF;CACF;CAEA;EACE,aAAa;EACb,kBAAkB,CAAC,KAAK;EACxB,mBAAmB;EACnB,aAAa,CACX,iRACF;CACF;CACA;EACE,aACE;EACF,kBAAkB;GAAC;GAAQ;GAAkB;EAAU;EACvD,mBAAmB;EACnB,aAAa,CACX,iPACF;CACF;AACF;AAEA,SAAS,6BACP,YACA,EAAE,aAAa,qBACP;CAaR,OAAO;EAAE;EAAa,cAAA,CAXpB;GACE,sBAAsB;GACtB,kBAAkB,CAAC,UAAU;GAC7B;EACF,GACA,GAAG,2BAA2B,KAAK,UAAuB;GACxD,GAAG;GACH,kBAAkB,CAAC,UAAU;EAC/B,EAAE,CAG6B;CAAE;AACrC;AAEA,SAAS,+BAAuD;CAC9D,MAAM,UAAkC,CAAC;CAEzC,KAAK,MAAM,CAAC,YAAY,WAAW,OAAO,QACxC,4BACF,GAAG;EACD,MAAM,SAAS,WAAW,EAAE,CAAC,YAAY,IAAI,WAAW,MAAM,CAAC;EAC/D,QAAQ,oBAAoB,YAAY,6BACtC,YACA,MACF;CACF;CAEA,OAAO;AACT;AAEA,MAAa,UAAkC;CAC7C,8BAA8B;EAC5B,aACE;EACF,SAAS,CAAC,4BAA4B;EACtC,cAAc,CACZ;GACE,aAAa;GACb,SAAS;GACT,eAAe,CAAC,UAAU;GAC1B,eAAe,CAAC,OAAO;EACzB,GACA;GACE,aACE;GACF,SAAS;GACT,eAAe,CAAC,UAAU;GAC1B,eAAe,CAAC,OAAO;GACvB,kBAAkB,CAAC,GAAG,kBAAkB;EAC1C,CACF;CACF;CACA,GAAG,6BAA6B;CAChC,yBAAyB;EACvB,aACE;EACF,SAAS,CAAC,oBAAoB;EAC9B,wBAAwB;EACxB,cAAc,CACZ;GACE,SAAS;GACT,mBAAmB,CAAC,GAAG;EACzB,CACF;EACA,qBAAqB,EACnB,SAAS,KACX;CACF;CACA,qBAAqB;EACnB,aAAa;EACb,cAAc,CACZ;GACE,iBAAiB,CAAC,uBAAuB;GACzC,eAAe;IACb;IACA;IACA;IACA;IACA;IACA;GACF;GACA,mBAAmB,EACjB,SACE,4KACJ;EACF,CACF;CACF;CACA,WAAW;EACT,gBAAgB,CACd;GACE,YAAY;GACZ,oBAAoB;GACpB,iBAAiB;GACjB,iBAAiB;GACjB,wBAAwB;GACxB,qBAAqB,CAAC,wBAAwB;GAC9C,cAAc,CAAC,6CAA6C;GAC5D,qBAAqB;EACvB,GACA;GACE,YAAY;GACZ,oBAAoB;GACpB,iBAAiB;GACjB,iBAAiB;GACjB,wBAAwB;GACxB,YAAY;GACZ,qBAAqB,CACnB,6FACA,wBACF;GACA,cAAc,CACZ,iLACF;GACA,qBAAqB;EACvB,CACF;EACA,aACE;EACF,cAAc;GACZ;IACE,SAAS;IACT,eAAe,CAAC,mBAAmB;IACnC,eAAe,CAAC,gBAAgB,gBAAgB;GAClD;GACA;IACE,SAAS;IACT,eAAe,CAAC,mBAAmB;IACnC,cAAc,CAAC,0BAA0B;IACzC,eAAe,CAAC,gBAAgB,gBAAgB;GAClD;GACA;IACE,GAAG;IACH,kBAAkB,CAAC,aAAa;IAChC,mBAAmB,CAAC,8BAA8B,aAAa;GACjE;GACA;IACE,GAAG;IACH,kBAAkB,CAAC,QAAQ;IAC3B,mBAAmB,CACjB,mEACF;GACF;EACF;CACF;AACF;AAEgD,OAAO,KACrD,4BACF"}
+{"version":3,"file":"security.preset.js","names":[],"sources":["../../../../lib/config/presets/internal/security.preset.ts"],"sourcesContent":["import type { DatasourceName } from '../../../datasource-list.generated.ts';\nimport type { ManagerName } from '../../../manager-list.generated.ts';\nimport type { PackageRule } from '../../types.ts';\nimport { UpdateTypesOptions } from '../../types.ts';\nimport type { Preset } from '../types.ts';\n\nconst php2shellPatchedVersions = JSON.stringify({\n  '8.2': 35,\n  '8.3': 36,\n  '8.4': 27,\n  '8.5': 12,\n});\n\nconst php2shellVulnerableVersion = `(\n  $value := (manager = \"mise\" and isLockfileOnly) ? lockedVersion : currentValue;\n  $version := datasource = \"docker\" ? $split($value, \"-\")[0] : $value;\n  $parts := $match($version, /^(8\\\\.[2-5])\\\\.(\\\\d+)$/).groups;\n\n  $not(vulnerabilityAlerts.enabled = false) and $exists($parts)\n    and $number($parts[1]) < $lookup(${php2shellPatchedVersions}, $parts[0])\n)`;\n\nconst php2shellRule = {\n  isVulnerabilityAlert: true,\n  matchJsonata: [\n    `${php2shellVulnerableVersion} and (\n      $version := datasource = \"docker\" ? $split(newVersion, \"-\")[0] : newVersion;\n      $parts := $match($version, /^(8\\\\.[2-5])\\\\.(\\\\d+)$/).groups;\n\n      $exists($parts) and $number($parts[1]) >= $lookup(${php2shellPatchedVersions}, $parts[0])\n    )`,\n  ],\n  matchUpdateTypes: ['patch', 'minor', 'major'],\n  prBodyNotes: [\n    [\n      '> ⚠️ PHP2Shell vulnerabilities can allow remote code execution. This PR updates affected PHP versions to patched releases. Rebuild affected images, deploy the updates, and restart PHP workers.',\n      '>',\n      '> Details: [CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and [CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp).',\n    ].join('\\n'),\n  ],\n  schedule: [],\n} satisfies PackageRule;\n\ninterface MinimumReleaseAgeDatasource {\n  description: string;\n  /** The manager whose package manager receives `minimumReleaseAge` as `minimumReleaseAgePackageManager`. */\n  manager: ManagerName;\n  minimumReleaseAge: string;\n}\n\n/**\n * Datasources for which we expose a `security:minimumReleaseAge*` preset.\n *\n * Only supported for Datasources that have `releaseTimestampSupport`.\n */\nconst minimumReleaseAgeDatasources: Partial<\n  Record<DatasourceName, MinimumReleaseAgeDatasource>\n> = {\n  crate: {\n    description:\n      \"Wait until the Crate version is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behavior in crates, and b) reduces the risk of upgrading to a newly published crate that its owner deletes during crates.io's initial 72-hour deletion window.\",\n    manager: 'cargo',\n    minimumReleaseAge: '3 days',\n  },\n  npm: {\n    description:\n      'Wait until the npm package is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behavior in packages, and b) prevents the maintainer and/or NPM from unpublishing a package you already upgraded to, breaking builds.',\n    manager: 'npm',\n    minimumReleaseAge: '3 days',\n  },\n  pypi: {\n    description:\n      'Wait until the Python package is three days old before raising the update. This introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behavior in packages.',\n    manager: 'poetry',\n    minimumReleaseAge: '3 days',\n  },\n};\n\n/**\n * Certain update types don't currently support `releaseTimestamp`s, so applying `minimumReleaseAge` to them results in updates that will never come.\n *\n * Instead, we opt them out of `minimumReleaseAge`, and add a warning for the user.\n *\n * This must stay in sync with the update types documented as _not_ supported (❌) in `docs/usage/key-concepts/minimum-release-age.md`, so we opt-out any unsupported `updateType`s.\n *\n * These rules are datasource-agnostic (`matchDatasources` is added per preset), so they are shared across every generated `security:minimumReleaseAge*` preset to keep the warnings consistent.\n */\nconst unsupportedUpdateTypeRules: PackageRule[] = [\n  {\n    description:\n      'Do not require Minimum Release Age for update types that are controlled by the package manager',\n    matchUpdateTypes: ['lockFileMaintenance'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's lock file maintenance functionality does not support validating Minimum Release Age, as the package manager performs the required changes to update package(s). Confirm whether your package manager perform its own validation for the Minimum Release Age of packages.\",\n    ],\n  },\n  // TODO #39400\n  {\n    description: 'Do not require Minimum Release Age for package replacements',\n    matchUpdateTypes: ['replacement'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's replacement functionality [does not currently](https://github.com/renovatebot/renovate/issues/39400) wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).\",\n    ],\n  },\n  // TODO #40288\n  {\n    description: 'Do not require Minimum Release Age for package pinning',\n    matchUpdateTypes: ['pin'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's pin functionality [does not currently](https://github.com/renovatebot/renovate/issues/40288) wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).\",\n    ],\n  },\n  {\n    description:\n      'Do not require Minimum Release Age for update types that do not provide a release timestamp',\n    matchUpdateTypes: ['bump', 'lockfileUpdate', 'rollback'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      '⚠️ Renovate does not enforce Minimum Release Age for `bump`, `lockfileUpdate`, or `rollback` updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).',\n    ],\n  },\n];\n\nfunction buildMinimumReleaseAgePreset(\n  datasource: string,\n  { description, manager, minimumReleaseAge }: MinimumReleaseAgeDatasource,\n): Preset {\n  const packageRules: PackageRule[] = [\n    {\n      internalChecksFilter: 'strict',\n      matchDatasources: [datasource],\n      minimumReleaseAge,\n    },\n    ...unsupportedUpdateTypeRules.map((rule): PackageRule => ({\n      ...rule,\n      matchDatasources: [datasource],\n    })),\n  ];\n\n  return {\n    description,\n    [manager]: { minimumReleaseAgePackageManager: minimumReleaseAge },\n    packageRules,\n  };\n}\n\nfunction loadMinimumReleaseAgePresets(): Record<string, Preset> {\n  const presets: Record<string, Preset> = {};\n\n  for (const [datasource, config] of Object.entries(\n    minimumReleaseAgeDatasources,\n  )) {\n    const suffix = datasource[0].toUpperCase() + datasource.slice(1);\n    presets[`minimumReleaseAge${suffix}`] = buildMinimumReleaseAgePreset(\n      datasource,\n      config,\n    );\n  }\n\n  return presets;\n}\n\nexport const presets: Record<string, Preset> = {\n  gomodIndirectSecurityUpdates: {\n    description:\n      'Enable go.mod indirect dependency updates only when vulnerabilities have been detected.',\n    extends: [':enableVulnerabilityAlerts'],\n    packageRules: [\n      {\n        description: 'Enable lookups for indirect go.mod dependencies',\n        enabled: true,\n        matchDepTypes: ['indirect'],\n        matchManagers: ['gomod'],\n      },\n      {\n        description:\n          'Disable non-security updates for indirect go.mod dependencies (vulnerability alerts use force to override this)',\n        enabled: false,\n        matchDepTypes: ['indirect'],\n        matchManagers: ['gomod'],\n        matchUpdateTypes: [...UpdateTypesOptions],\n      },\n    ],\n  },\n  ...loadMinimumReleaseAgePresets(),\n  'only-security-updates': {\n    description:\n      'Only update dependencies if vulnerabilities have been detected.',\n    extends: ['config:recommended'],\n    osvVulnerabilityAlerts: true,\n    packageRules: [\n      {\n        enabled: false,\n        matchPackageNames: ['*'],\n      },\n    ],\n    vulnerabilityAlerts: {\n      enabled: true,\n    },\n  },\n  'openssf-scorecard': {\n    description: 'Show OpenSSF badge on pull requests.',\n    packageRules: [\n      {\n        matchSourceUrls: ['https://github.com/**'],\n        prBodyColumns: [\n          'Package',\n          'Type',\n          'Update',\n          'Change',\n          'Pending',\n          'OpenSSF',\n        ],\n        prBodyDefinitions: {\n          OpenSSF:\n            '[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/{{sourceRepo}}/badge)](https://securityscorecards.dev/viewer/?uri=github.com/{{sourceRepo}})',\n        },\n      },\n    ],\n  },\n  php2shell: {\n    customManagers: [\n      {\n        customType: 'regex',\n        datasourceTemplate: 'github-tags',\n        depNameTemplate: 'php',\n        depTypeTemplate: 'php2shell-runtime',\n        extractVersionTemplate: '^php-(?<version>\\\\S+)',\n        managerFilePatterns: ['/(^|/)\\\\.php-version$/'],\n        matchStrings: ['^\\\\s*(?<currentValue>8\\\\.[2-5]\\\\.\\\\d+)\\\\s*$'],\n        packageNameTemplate: 'php/php-src',\n      },\n      {\n        customType: 'jsonata',\n        datasourceTemplate: 'github-tags',\n        depNameTemplate: 'php',\n        depTypeTemplate: 'php2shell-runtime',\n        extractVersionTemplate: '^php-(?<version>\\\\S+)',\n        fileFormat: 'yaml',\n        managerFilePatterns: [\n          '/(^|/)(workflow-templates|\\\\.(?:github|gitea|forgejo)/(?:workflows|actions))/.+\\\\.ya?ml$/',\n          '/(^|/)action\\\\.ya?ml$/',\n        ],\n        matchStrings: [\n          '**[uses and $exists($match(uses, /^shivammathur\\\\/setup-php@/))].with.\"php-version\"[$type($) = \"string\" and $exists($match($, /^8\\\\.[2-5]\\\\.\\\\d+$/))].{\"currentValue\": $}',\n        ],\n        packageNameTemplate: 'php/php-src',\n      },\n    ],\n    description:\n      'Update vulnerable PHP runtime pins for CVE-2026-109618 and CVE-2026-109619.',\n    packageRules: [\n      {\n        enabled: false,\n        matchDepTypes: ['php2shell-runtime'],\n        matchManagers: ['custom.regex', 'custom.jsonata'],\n      },\n      {\n        enabled: true,\n        matchDepTypes: ['php2shell-runtime'],\n        matchJsonata: [php2shellVulnerableVersion],\n        matchManagers: ['custom.regex', 'custom.jsonata'],\n      },\n      {\n        ...php2shellRule,\n        matchDatasources: ['github-tags'],\n        matchPackageNames: ['containerbase/php-prebuild', 'php/php-src'],\n      },\n      {\n        ...php2shellRule,\n        matchDatasources: ['docker'],\n        matchPackageNames: [\n          '/^(?:(?:docker\\\\.io|index\\\\.docker\\\\.io)\\\\/)?(?:library\\\\/)?php$/',\n        ],\n      },\n    ],\n  },\n};\n\nexport const minimumReleaseAgeDatasourceNames = Object.keys(\n  minimumReleaseAgeDatasources,\n);\n"],"mappings":";;AAMA,MAAM,2BAA2B,KAAK,UAAU;CAC9C,OAAO;CACP,OAAO;CACP,OAAO;CACP,OAAO;AACT,CAAC;AAED,MAAM,6BAA6B;;;;;;uCAMI,yBAAyB;;AAGhE,MAAM,gBAAgB;CACpB,sBAAsB;CACtB,cAAc,CACZ,GAAG,2BAA2B;;;;0DAIwB,yBAAyB;MAEjF;CACA,kBAAkB;EAAC;EAAS;EAAS;CAAO;CAC5C,aAAa,CACX;EACE;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI,CACb;CACA,UAAU,CAAC;AACb;;;;;;AAcA,MAAM,+BAEF;CACF,OAAO;EACL,aACE;EACF,SAAS;EACT,mBAAmB;CACrB;CACA,KAAK;EACH,aACE;EACF,SAAS;EACT,mBAAmB;CACrB;CACA,MAAM;EACJ,aACE;EACF,SAAS;EACT,mBAAmB;CACrB;AACF;;;;;;;;;;AAWA,MAAM,6BAA4C;CAChD;EACE,aACE;EACF,kBAAkB,CAAC,qBAAqB;EACxC,mBAAmB;EACnB,aAAa,CACX,wRACF;CACF;CAEA;EACE,aAAa;EACb,kBAAkB,CAAC,aAAa;EAChC,mBAAmB;EACnB,aAAa,CACX,yRACF;CACF;CAEA;EACE,aAAa;EACb,kBAAkB,CAAC,KAAK;EACxB,mBAAmB;EACnB,aAAa,CACX,iRACF;CACF;CACA;EACE,aACE;EACF,kBAAkB;GAAC;GAAQ;GAAkB;EAAU;EACvD,mBAAmB;EACnB,aAAa,CACX,iPACF;CACF;AACF;AAEA,SAAS,6BACP,YACA,EAAE,aAAa,SAAS,qBAChB;CACR,MAAM,eAA8B,CAClC;EACE,sBAAsB;EACtB,kBAAkB,CAAC,UAAU;EAC7B;CACF,GACA,GAAG,2BAA2B,KAAK,UAAuB;EACxD,GAAG;EACH,kBAAkB,CAAC,UAAU;CAC/B,EAAE,CACJ;CAEA,OAAO;EACL;GACC,UAAU,EAAE,iCAAiC,kBAAkB;EAChE;CACF;AACF;AAEA,SAAS,+BAAuD;CAC9D,MAAM,UAAkC,CAAC;CAEzC,KAAK,MAAM,CAAC,YAAY,WAAW,OAAO,QACxC,4BACF,GAAG;EACD,MAAM,SAAS,WAAW,EAAE,CAAC,YAAY,IAAI,WAAW,MAAM,CAAC;EAC/D,QAAQ,oBAAoB,YAAY,6BACtC,YACA,MACF;CACF;CAEA,OAAO;AACT;AAEA,MAAa,UAAkC;CAC7C,8BAA8B;EAC5B,aACE;EACF,SAAS,CAAC,4BAA4B;EACtC,cAAc,CACZ;GACE,aAAa;GACb,SAAS;GACT,eAAe,CAAC,UAAU;GAC1B,eAAe,CAAC,OAAO;EACzB,GACA;GACE,aACE;GACF,SAAS;GACT,eAAe,CAAC,UAAU;GAC1B,eAAe,CAAC,OAAO;GACvB,kBAAkB,CAAC,GAAG,kBAAkB;EAC1C,CACF;CACF;CACA,GAAG,6BAA6B;CAChC,yBAAyB;EACvB,aACE;EACF,SAAS,CAAC,oBAAoB;EAC9B,wBAAwB;EACxB,cAAc,CACZ;GACE,SAAS;GACT,mBAAmB,CAAC,GAAG;EACzB,CACF;EACA,qBAAqB,EACnB,SAAS,KACX;CACF;CACA,qBAAqB;EACnB,aAAa;EACb,cAAc,CACZ;GACE,iBAAiB,CAAC,uBAAuB;GACzC,eAAe;IACb;IACA;IACA;IACA;IACA;IACA;GACF;GACA,mBAAmB,EACjB,SACE,4KACJ;EACF,CACF;CACF;CACA,WAAW;EACT,gBAAgB,CACd;GACE,YAAY;GACZ,oBAAoB;GACpB,iBAAiB;GACjB,iBAAiB;GACjB,wBAAwB;GACxB,qBAAqB,CAAC,wBAAwB;GAC9C,cAAc,CAAC,6CAA6C;GAC5D,qBAAqB;EACvB,GACA;GACE,YAAY;GACZ,oBAAoB;GACpB,iBAAiB;GACjB,iBAAiB;GACjB,wBAAwB;GACxB,YAAY;GACZ,qBAAqB,CACnB,6FACA,wBACF;GACA,cAAc,CACZ,iLACF;GACA,qBAAqB;EACvB,CACF;EACA,aACE;EACF,cAAc;GACZ;IACE,SAAS;IACT,eAAe,CAAC,mBAAmB;IACnC,eAAe,CAAC,gBAAgB,gBAAgB;GAClD;GACA;IACE,SAAS;IACT,eAAe,CAAC,mBAAmB;IACnC,cAAc,CAAC,0BAA0B;IACzC,eAAe,CAAC,gBAAgB,gBAAgB;GAClD;GACA;IACE,GAAG;IACH,kBAAkB,CAAC,aAAa;IAChC,mBAAmB,CAAC,8BAA8B,aAAa;GACjE;GACA;IACE,GAAG;IACH,kBAAkB,CAAC,QAAQ;IAC3B,mBAAmB,CACjB,mEACF;GACF;EACF;CACF;AACF;AAEgD,OAAO,KACrD,4BACF"}

package/dist/config/types.d.ts

@@ -98,6 +98,7 @@ export interface RenovateSharedConfig {
   milestone?: number;
   minimumReleaseAge?: Nullish<string>;
   minimumReleaseAgeBuffer?: Nullish<string>;
+  minimumReleaseAgePackageManager?: Nullish<string>;
   minimumReleaseAgePackageManagerSync?: boolean;
   npmrc?: string;
   npmrcMerge?: boolean;

package/dist/config/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","names":[],"sources":["../../lib/config/types.ts"],"sourcesContent":["import type { Category, PlatformId } from '../constants/index.ts';\nimport type { LogLevelRemap } from '../logger/types.ts';\nimport type {\n  CustomManagerName,\n  ManagerName,\n} from '../manager-list.generated.ts';\nimport type { CustomManager } from '../modules/manager/custom/types.ts';\nimport type {\n  GitUrlOption,\n  RepoSortMethod,\n  SortMethod,\n} from '../modules/platform/types.ts';\nimport type {\n  AutoMergeType,\n  HostRule,\n  Nullish,\n  RangeStrategy,\n  SkipReason,\n} from '../types/index.ts';\nimport type { StageName } from '../types/skip-reason.ts';\nimport type {\n  AdditionalConstraintName,\n  ConstraintName,\n  ToolName,\n} from '../util/exec/types.ts';\nimport type { GitNoVerifyOption } from '../util/git/types.ts';\nimport type { MergeConfidence } from '../util/merge-confidence/types.ts';\nimport type { Timestamp } from '../util/timestamp.ts';\nimport type { ConfigValidationTopic } from './validation-helpers/types.ts';\n\nexport type RenovateConfigStage =\n  'global' | 'inherit' | 'repository' | 'package' | 'branch' | 'pr';\n\nexport type RenovateSplit =\n  'init' | 'onboarding' | 'extract' | 'lookup' | 'update';\n\nexport type RepositoryCacheConfig = 'disabled' | 'enabled' | 'reset';\nexport type RepositoryCacheType = 'local' | (string & {});\nexport type DryRunConfig = 'extract' | 'lookup' | 'full';\nexport type InternalHostAccess = 'allow' | 'warn' | 'block';\nexport type RequiredConfig = 'required' | 'optional' | 'ignored';\n\nexport interface GroupConfig extends Record<string, unknown> {\n  branchName?: string;\n  branchTopic?: string;\n}\n\nexport type RecreateWhen = 'auto' | 'never' | 'always';\nexport const allowedStatusCheckWhenValues = [\n  'always',\n  'never',\n  'failed',\n] as const;\nexport type StatusCheckWhen = (typeof allowedStatusCheckWhenValues)[number];\nexport type PlatformCommitOptions = 'auto' | 'disabled' | 'enabled';\n\nexport type BinarySource = 'docker' | 'global' | 'install' | 'hermit';\n\n// TODO: Proper typings\n/**\n * Any configuration that could be used either top-level in a repository config (or Global, Inherited or Shareable Preset configuration), or:\n *\n * - in a datasource-specific configuration\n * - in a manager-specific configuration\n * - in a Package Rule\n *\n * @see RenovateConfig for the superset of all configuration allowed in a given repository\n *\n */\nexport interface RenovateSharedConfig {\n  $schema?: string;\n  abandonmentThreshold?: Nullish<string>;\n  addLabels?: string[];\n  assignAutomerge?: boolean;\n  autoApprove?: boolean;\n  autoReplaceGlobalMatch?: boolean;\n  automerge?: boolean;\n  automergeSchedule?: string[];\n  automergeStrategy?: MergeStrategy;\n  automergeType?: AutoMergeType;\n  azureWorkItemId?: number;\n  azureWorkItemType?: string;\n  branchName?: string;\n  branchNameStrict?: boolean;\n  branchPrefix?: string;\n  branchPrefixOld?: string;\n  bumpVersions?: BumpVersionConfig[];\n  commitBody?: string;\n  commitBodyTable?: boolean;\n  commitMessage?: string;\n  commitMessageAction?: string;\n  commitMessageExtra?: string;\n  commitMessageLowerCase?: 'auto' | 'never';\n  commitMessagePrefix?: string;\n  commitMessageTopic?: string;\n  commitTrailers?: string[];\n  confidential?: boolean;\n  configValidationError?: boolean;\n  changelogUrl?: string;\n  dependencyDashboardApproval?: boolean;\n  draftPR?: boolean;\n  enabled?: boolean;\n  enabledManagers?: string[];\n  encrypted?: Record<string, string>;\n  extends?: string[];\n  extractVersion?: string;\n  managerFilePatterns?: string[];\n  followTag?: string;\n  force?: RenovateConfig;\n  gitIgnoredAuthors?: string[];\n  group?: GroupConfig;\n  groupName?: string;\n  groupSingleUpdates?: boolean;\n  groupSlug?: string;\n  hashedBranchLength?: number;\n  ignoreDeps?: string[];\n  ignorePaths?: string[];\n  ignoreTests?: boolean;\n  ignoreUnstable?: boolean;\n  includePaths?: string[];\n  internalChecksAsSuccess?: boolean;\n  internalChecksFilter?: 'strict' | 'flexible' | 'none';\n  keepUpdatedLabel?: string;\n  labels?: string[];\n  manager?: string;\n  milestone?: number;\n  minimumReleaseAge?: Nullish<string>;\n  minimumReleaseAgeBuffer?: Nullish<string>;\n  minimumReleaseAgePackageManagerSync?: boolean;\n  npmrc?: string;\n  npmrcMerge?: boolean;\n  npmToken?: string;\n\n  pinDigests?: boolean;\n  platformAutomerge?: boolean;\n  platformCommit?: PlatformCommitOptions;\n  postUpgradeTasks?: PostUpgradeTasks;\n  prBodyColumns?: string[];\n  prBodyDefinitions?: Record<string, string>;\n  prBodyHeadingDefinitions?: Record<string, string>;\n  prBodyNotes?: string[];\n  prCreation?: 'immediate' | 'not-pending' | 'status-success' | 'approval';\n  prFooter?: string;\n  prHeader?: string;\n  prPriority?: number;\n  prTitle?: string;\n  prTitleStrict?: boolean;\n  pruneBranchAfterAutomerge?: boolean;\n  rangeStrategy?: RangeStrategy;\n  rebaseLabel?: string;\n  rebaseWhen?: string;\n  recreateClosed?: boolean;\n  recreateWhen?: RecreateWhen;\n  repository?: string;\n  repositoryCache?: RepositoryCacheConfig;\n  repositoryCacheType?: RepositoryCacheType;\n  respectLatest?: boolean;\n  rollbackPrs?: boolean;\n  schedule?: string[];\n  semanticCommitScope?: string | null;\n  semanticCommitType?: string;\n  semanticCommits?: 'auto' | 'enabled' | 'disabled';\n  separateMajorMinor?: boolean;\n  separateMinorPatch?: boolean;\n  separateMultipleMajor?: boolean;\n  separateMultipleMinor?: boolean;\n  skipArtifactsUpdate?: boolean;\n  stopUpdatingLabel?: string;\n  suppressNotifications?: string[];\n  timezone?: string;\n  unicodeEmoji?: boolean;\n  updateNotScheduled?: boolean;\n  versioning?: string;\n  versionCompatibility?: string;\n}\n\n/**\n * Contains all options with globalOnly=true && inheritConfigSupport=true\n */\nexport interface GlobalInheritableConfig {\n  bbUseDevelopmentBranch?: boolean;\n  configFileNames?: string[];\n  onboarding?: boolean;\n  onboardingAutoCloseAge?: number;\n  onboardingBranch?: string;\n  onboardingCommitMessage?: string;\n  onboardingConfig?: RenovateConfig;\n  onboardingConfigFileName?: string;\n  onboardingNoDeps?: 'auto' | 'enabled' | 'disabled';\n  onboardingPrTitle?: string;\n  requireConfig?: RequiredConfig;\n}\n\n// Config options used only within the global worker\n// The below should contain config options where stage=global\n/** @deprecated use `RepoGlobalConfig` instead **/\nexport interface GlobalOnlyConfigLegacy {\n  autodiscover?: boolean;\n  autodiscoverFilter?: string[] | string;\n  autodiscoverNamespaces?: string[];\n  autodiscoverProjects?: string[];\n  autodiscoverTopics?: string[];\n  baseDir?: string;\n  cacheDir?: string;\n  containerbaseDir?: string;\n  detectHostRulesFromEnv?: boolean;\n  dockerCliOptions?: string;\n  endpoint?: string;\n  exitCodeForErrors?: boolean;\n  forceCli?: boolean;\n  gitNoVerify?: GitNoVerifyOption[];\n  gitPrivateKey?: string;\n  gitPrivateKeyPassphrase?: string;\n  globalExtends?: string[];\n  mergeConfidenceDatasources?: string[];\n  mergeConfidenceEndpoint?: string;\n  platform?: PlatformId;\n  processEnv?: Record<string, string>;\n  prCommitsPerRunLimit?: number;\n  privateKey?: string;\n  privateKeyOld?: string;\n  privateKeyPath?: string;\n  privateKeyPathOld?: string;\n  redisPrefix?: string;\n  redisUrl?: string;\n  repositories?: RenovateRepository[];\n  useCloudMetadataServices?: boolean;\n  deleteConfigFile?: boolean;\n  deleteAdditionalConfigFile?: boolean;\n}\n\n/**\n * Any global-only configuration set by self-hosted administrators.\n *\n * Used within the repository worker.\n *\n * Should only contain config options where globalOnly=true.\n */\nexport interface RepoGlobalConfig extends GlobalInheritableConfig {\n  allowedCommands?: string[];\n  allowCustomCrateGitRegistries?: boolean;\n  allowPlugins?: boolean;\n  allowScripts?: boolean;\n  allowShellExecutorForPostUpgradeCommands?: boolean;\n  allowedEnv?: string[];\n  allowedHeaders?: string[];\n  binarySource?: BinarySource;\n  cacheDir?: string;\n  cacheHardTtlMinutes?: number;\n  cacheTtlOverride?: Record<string, number>;\n  checkedBranches?: string[];\n  containerbaseDir?: string;\n  customEnvVariables?: Record<string, string>;\n  dockerChildPrefix?: string;\n  dockerCliOptions?: string;\n  dockerSidecarImage?: string;\n  dockerUser?: string;\n  dryRun?: DryRunConfig;\n  encryptedWarning?: string;\n  endpoint?: string;\n  executionTimeout?: number;\n  exposeAllEnv?: boolean;\n  gitTimeout?: number;\n  githubTokenWarn?: boolean;\n  goEnvFromHostRules?: boolean;\n  includeMirrors?: boolean;\n  inheritConfigTrusted?: boolean;\n  internalHostAccess?: InternalHostAccess;\n  migratePresets?: Record<string, string>;\n  platform?: PlatformId;\n  prCacheSyncMaxPages?: number;\n  presetCachePersistence?: boolean;\n  httpCacheTtlDays?: number;\n  autodiscoverRepoSort?: RepoSortMethod;\n  autodiscoverRepoOrder?: SortMethod;\n  userAgent?: string;\n  dockerMaxPages?: number;\n  s3Endpoint?: string;\n  s3PathStyle?: boolean;\n  cachePrivatePackages?: boolean;\n  repositoryCacheForceLocal?: boolean;\n  configFileNames?: string[];\n  ignorePrAuthor?: boolean;\n  allowedUnsafeExecutions?: AllowedUnsafeExecution[];\n  onboardingAutoCloseAge?: number;\n  productLinks?: Record<string, string>;\n  rebaseAllOpenBranches?: boolean;\n  toolSettings?: GlobalToolSettingsOptions;\n}\n\n/**\n * Internal variables which are referenced from `GlobalConfig`, but are *not* user-configurable options.\n */\nexport interface InternalGlobalConfigOptions {\n  localDir?: string;\n}\n\n/**\n * Those options are global only but still passed into the repository worker config.\n *\n * @deprecated https://github.com/renovatebot/renovate/issues/39693\n */\nexport interface LegacyAdminConfig {\n  baseDir?: string;\n  localDir?: string;\n\n  logContext?: string;\n\n  onboarding?: boolean;\n  onboardingBranch?: string;\n  onboardingNoDeps?: 'auto' | 'enabled' | 'disabled';\n  onboardingRebaseCheckbox?: boolean;\n  onboardingConfig?: RenovateConfig;\n  onboardingConfigFileName?: string;\n\n  optimizeForDisabled?: boolean;\n\n  persistRepoData?: boolean;\n\n  prCommitsPerRunLimit?: number;\n\n  requireConfig?: RequiredConfig;\n\n  useCloudMetadataServices?: boolean;\n\n  writeDiscoveredRepos?: string;\n}\n\nexport type ExecutionMode = 'branch' | 'update';\n\nexport interface PostUpgradeTasks {\n  commands?: string[];\n  workingDirTemplate?: string;\n  dataFileTemplate?: string;\n  fileFilters?: string[];\n  executionMode: ExecutionMode;\n  installTools?: Partial<Record<ToolName, Record<never, never>>>;\n}\n\nexport type UpdateConfig<\n  T extends RenovateSharedConfig = RenovateSharedConfig,\n> = Partial<Record<UpdateType, T | null>>;\n\nexport type RenovateRepositoryEntry = AllConfig & {\n  repository: string;\n};\n\nexport type RenovateRepository = string | RenovateRepositoryEntry;\n\nexport type UseBaseBranchConfigType = 'merge' | 'merge-if-present' | 'none';\nexport type ConstraintsFilter = 'strict' | 'none';\nexport type MinimumReleaseAgeBehaviour =\n  'timestamp-required' | 'timestamp-optional';\n\nexport const allowedStatusCheckStrings = [\n  'minimumReleaseAge',\n  'mergeConfidence',\n  'configValidation',\n  'artifactError',\n] as const;\nexport type StatusCheckKey = (typeof allowedStatusCheckStrings)[number];\ntype UserEnv = Record<string, string>;\n\n/**\n * Computed properties, for internal use only\n */\nexport interface RenovateInternalConfig {\n  /** computed base branch from patterns - for internal use only */\n  baseBranches?: string[];\n  currentCompatibility?: string;\n  datasource?: string;\n  hasBaseBranches?: boolean;\n  isFork?: boolean;\n  isVulnerabilityAlert?: boolean;\n\n  /** What is this used for? */\n  remediations?: unknown;\n  /** What is this used for? */\n  vulnerabilityAlertsOnly?: boolean;\n}\n\n// TODO: Proper typings\n/**\n * Configuration that could be used either top-level in a repository config (or Global, Inherited or Shareable Preset configuration).\n *\n * This is a superset of any configuration that a Renovate user (not self-hosted administrator) can set.\n */\nexport interface RenovateConfig\n  extends\n    LegacyAdminConfig,\n    RenovateSharedConfig,\n    UpdateConfig<PackageRule>,\n    AssigneesAndReviewersConfig,\n    ConfigMigration,\n    RenovateInternalConfig {\n  s3Endpoint?: string;\n  s3PathStyle?: boolean;\n  reportFormatting?: boolean;\n  reportPath?: string;\n  reportType?: 'logging' | 'file' | 's3' | null;\n  depName?: string;\n  /** user configurable base branch patterns*/\n  baseBranchPatterns?: string[];\n  useBaseBranchConfig?: UseBaseBranchConfigType;\n  baseBranch?: string;\n  defaultBranch?: string;\n  branchList?: string[];\n  cloneSubmodules?: boolean;\n  cloneSubmodulesFilter?: string[];\n  description?: string | string[];\n  overrideDescription?: string | string[];\n  detectGlobalManagerConfig?: boolean;\n  errors?: ValidationMessage[];\n  forkModeDisallowMaintainerEdits?: boolean;\n  forkProcessing?: 'auto' | 'enabled' | 'disabled';\n  forkToken?: string;\n\n  gitAuthor?: string;\n\n  hostRules?: HostRule[];\n\n  inheritConfig?: boolean;\n  inheritConfigFileName?: string;\n  inheritConfigRepoName?: string;\n  inheritConfigStrict?: boolean;\n\n  ignorePresets?: string[];\n\n  fileList?: string[];\n  configWarningReuseIssue?: boolean;\n  dependencyDashboard?: DependencyDashboardConfig;\n  dependencyDashboardChecks?: Record<string, string>;\n  dependencyDashboardIssue?: number;\n  mode?: 'silent' | 'full';\n  packageFile?: string;\n  packageRules?: PackageRule[];\n  postUpdateOptions?: string[];\n  branchConcurrentLimit?: number | null;\n  parentOrg?: string;\n  prConcurrentLimit?: number;\n  commitHourlyLimit?: number;\n  prHourlyLimit?: number;\n\n  printConfig?: boolean;\n\n  pruneStaleBranches?: boolean;\n\n  defaultRegistryUrls?: string[];\n  registryUrls?: string[] | null;\n  registryAliases?: Record<string, string>;\n\n  /**\n   * What is this used for?\n   * @deprecated\n   */\n  renovateJsonPresent?: boolean;\n\n  repoIsOnboarded?: boolean;\n  repoIsActivated?: boolean;\n\n  topLevelOrg?: string;\n  updateInternalDeps?: boolean;\n  updateType?: UpdateType;\n\n  warnings?: ValidationMessage[];\n  vulnerabilityAlerts?: RenovateSharedConfig;\n  osvVulnerabilityAlerts?: boolean;\n  vulnerabilitySeverity?: string;\n  customManagers?: CustomManager[];\n  customDatasources?: Record<string, CustomDatasourceConfig>;\n\n  fetchChangeLogs?: FetchChangeLogsOptions;\n  secrets?: Record<string, string>;\n  variables?: Record<string, string>;\n\n  constraints?: Partial<Record<ConstraintName, string>>;\n  /**\n   * Any specific overrides for the versioning for the `AdditionalConstraintName`s.\n   */\n  constraintsVersioning?: Partial<Record<AdditionalConstraintName, string>>;\n  skipInstalls?: boolean | null;\n\n  constraintsFiltering?: ConstraintsFilter;\n\n  statusCheckNames?: Record<StatusCheckKey, string | null>;\n  statusCheckWhen?: Partial<Record<StatusCheckKey, StatusCheckWhen>>;\n  /**\n   * User configured environment variables that Renovate uses when executing package manager commands\n   */\n  env?: UserEnv;\n  logLevelRemap?: LogLevelRemap[];\n\n  branchTopic?: string;\n  additionalBranchPrefix?: string;\n  sharedVariableName?: string;\n  minimumGroupSize?: number;\n  configFileNames?: string[];\n  minimumReleaseAgeBehaviour?: MinimumReleaseAgeBehaviour;\n  toolSettings?: RepoToolSettingsOptions;\n}\n\nexport const CustomDatasourceFormats = [\n  'html',\n  'json',\n  'plain',\n  'toml',\n  'yaml',\n] as const;\nexport type CustomDatasourceFormats = (typeof CustomDatasourceFormats)[number];\n\nexport interface CustomDatasourceConfig {\n  defaultRegistryUrlTemplate?: string;\n  format?: CustomDatasourceFormats;\n  transformTemplates?: string[];\n}\n\n/**\n * The superset of all configuration that a self-hosted administrator can set, alongside all repository-level configuration.\n *\n */\nexport interface AllConfig\n  extends RenovateConfig, GlobalOnlyConfigLegacy, RepoGlobalConfig {\n  gitUrl?: GitUrlOption;\n  password?: string;\n  token?: string;\n  username?: string;\n}\n\nexport interface AssigneesAndReviewersConfig {\n  assigneesFromCodeOwners?: boolean;\n  expandCodeOwnersGroups?: boolean;\n  assignees?: string[];\n  assigneesSampleSize?: number;\n  ignoreReviewers?: string[];\n  reviewersFromCodeOwners?: boolean;\n  reviewers?: string[];\n  reviewersSampleSize?: number;\n  additionalReviewers?: string[];\n  filterUnavailableUsers?: boolean;\n}\n\nexport type UpdateType =\n  | 'major'\n  | 'minor'\n  | 'patch'\n  | 'pin'\n  | 'digest'\n  | 'pinDigest'\n  | 'lockFileMaintenance'\n  | 'lockfileUpdate'\n  | 'rollback'\n  | 'bump'\n  | 'replacement';\n\n// These are the update types which can have configuration\nexport const UpdateTypesOptions = [\n  'major',\n  'minor',\n  'patch',\n  'pin',\n  'digest',\n  'pinDigest',\n  'lockFileMaintenance',\n  'rollback',\n  'replacement',\n] as const;\n\nexport type UpdateTypeOptions = (typeof UpdateTypesOptions)[number];\n\nexport type FetchChangeLogsOptions = 'off' | 'branch' | 'pr';\n\nexport type MatchStringsStrategy = 'any' | 'recursive' | 'combination';\n\nexport type MergeStrategy =\n  | 'auto'\n  | 'fast-forward'\n  | 'merge-commit'\n  | 'rebase'\n  | 'rebase-merge'\n  | 'squash';\n\n// This list should be added to as any new unsafe execution commands should be permitted\nexport type AllowedUnsafeExecution =\n  'bazelModDeps' | 'goGenerate' | 'gradleWrapper' | 'mise' | 'pixi';\n\n// TODO: Proper typings\nexport interface PackageRule\n  extends RenovateSharedConfig, RenovateInternalConfig, UpdateConfig {\n  allowedVersions?: string;\n  description?: string | string[];\n  matchBaseBranches?: string[];\n  matchCategories?: string[];\n  matchConfidence?: MergeConfidence[];\n  matchCurrentAge?: string;\n  matchCurrentValue?: string;\n  matchCurrentVersion?: string;\n  matchDatasources?: string[];\n  matchDepNames?: string[];\n  matchDepTypes?: string[];\n  matchFileNames?: string[];\n  matchIsBreaking?: boolean;\n  matchManagers?: string[];\n  matchNewValue?: string;\n  matchPackageNames?: string[];\n  matchRepositories?: string[];\n  matchSourceUrls?: string[];\n  matchRegistryUrls?: string[];\n  matchUpdateTypes?: UpdateType[];\n  matchJsonata?: string[];\n  overrideDatasource?: string;\n  overrideDepName?: string;\n  overridePackageName?: string;\n  registryUrls?: string[] | null;\n  replacementName?: string;\n  replacementVersion?: string;\n  sourceUrl?: string;\n  sourceDirectory?: string;\n  vulnerabilitySeverity?: string;\n  vulnerabilityFixVersion?: string;\n}\n\nexport interface ValidationMessage {\n  // Topic is either the known list of topics, or a dynamically generated one\n  topic: ConfigValidationTopic | (string & {});\n  message: string;\n}\n\n/**\n * The kinds of place a config option can be used, which expand to the {@link AllowedParents} they cover.\n *\n * These are for the places which can't reasonably be listed, like every manager or every update type, so an option which is only valid in a specific object - like `hostRules` - should use `parents` instead.\n */\nexport const configScopes = [\n  /** the top level of a repository, global, inherited or preset config */\n  'repo',\n  /** a `packageRules` entry */\n  'packageRule',\n  /** a manager's configuration object, like `npm` */\n  'manager',\n  /** an update type's configuration object, like `major` */\n  'updateType',\n  /** the `vulnerabilityAlerts` configuration object */\n  'vulnerabilityAlert',\n  /** the `group` configuration object, which is merged into an update when it's grouped */\n  'group',\n  /** every object a config can be nested in, for the options which are read wherever they're found */\n  'any',\n] as const;\n\nexport type ConfigScope = (typeof configScopes)[number];\n\n/**\n * The objects which a config can be nested in, other than the top level and the ones which are covered by a {@link ConfigScope}.\n */\nexport const namedParents = [\n  'bumpVersions',\n  'customDatasources',\n  'customManagers',\n  'dependencyDashboard',\n  'group',\n  'hostRules',\n  'logLevelRemap',\n  'packageRules',\n  'postUpgradeTasks',\n  'toolSettings',\n  'vulnerabilityAlerts',\n] as const;\n\nexport type AllowedParents =\n  | '.'\n  | (typeof namedParents)[number]\n  | ManagerName\n  | CustomManagerName\n  | UpdateTypeOptions;\nexport interface RenovateOptionBase {\n  /**\n   * If true, this option **MUST** be checked at the trust boundary: after resolving the full config that sets it, but **before** the value is applied.\n   *\n   * This is in addition to any existing config validation, and ensures that these options are re-validated due to their sensitive nature.\n   *\n   * A failure of that check **must** lead to a {@link ConfigValidationTopic.Security} error (which is then a full config validation error), stopping the Renovate run.\n   *\n   * After this check has been performed, additional filtering (for defense in depth) could be performed, but may not have an indication of what is repo- or preset-config vs global self-hosted config.\n   */\n  requiresCheckAtTrustBoundary?: boolean;\n\n  inheritConfigSupport?: boolean;\n\n  allowedValues?: string[];\n\n  /**\n   * A subset of suggested values for the user, which are some (but not all) of the possible `allowedValues`.\n   *\n   * This provides editor autocomplete (i.e. via our JSON Schema) but makes it possible to not be an exhaustive list, which is required by `allowedValues`, and may be further complicated by `patternMatch`.\n   */\n  suggestedValues?: string[];\n\n  allowString?: boolean;\n\n  cli?: boolean;\n\n  description: string;\n\n  env?: false | string;\n\n  /**\n   * Do not validate object children\n   */\n  freeChoice?: boolean;\n\n  mergeable?: boolean;\n\n  /**\n   * Whether the configuration option has been autogenerated from Renovate's internals, and describes what type of module it's generated from.\n   *\n   * `manager` indicates that this was generated from a Manager's config object, from its `defaultConfig`.\n   */\n  autogenerated?: 'manager';\n\n  name: string;\n\n  parents?: AllowedParents[];\n\n  /**\n   * The kinds of place this option can be used, which are expanded alongside any `parents`.\n   *\n   * An option which declares neither is treated as valid anywhere, which is what we're working towards removing in #43020.\n   */\n  scopes?: ConfigScope[];\n\n  stage?: RenovateConfigStage;\n\n  experimental?: boolean;\n\n  experimentalDescription?: string;\n\n  experimentalIssues?: number[];\n\n  advancedUse?: boolean;\n\n  /**\n   * This is used to add a deprecation message in the docs\n   */\n  deprecationMsg?: string;\n\n  /**\n   * For internal use only: add it to any config option that supports regex or glob matching\n   */\n  patternMatch?: boolean;\n\n  /**\n   * For internal use only: add it to any config option of type integer that supports negative integers\n   */\n  allowNegative?: boolean;\n\n  /**\n   * Whether the option can be set to `null`.\n   *\n   * This is only needed if the default is not `null` (which makes this implied).\n   */\n  nullable?: boolean;\n\n  /**\n   * Managers which support this option, leave undefined if all managers support it.\n   */\n  supportedManagers?: string[];\n\n  /**\n   * Platforms which support this option, leave undefined if all platforms support it.\n   */\n  supportedPlatforms?: PlatformId[];\n\n  /**\n   * Conditions that must be met for this option to be required.\n   */\n  requiredIf?: RenovateRequiredOption[];\n\n  /**\n   * If true, the option's value supports Renovate templating.\n   * @see https://docs.renovatebot.com/templates/\n   */\n  supportsTemplating?: boolean;\n}\n\nexport interface RenovateRequiredOption {\n  siblingProperties: { property: string; value: string }[];\n}\n\nexport interface RenovateArrayOption<\n  T extends string | number | Record<string, unknown> = Record<string, unknown>,\n> extends RenovateOptionBase {\n  default?: T[] | null;\n  mergeable?: boolean;\n  type: 'array';\n  subType?: 'string' | 'object' | 'number';\n}\n\nexport interface RenovateStringArrayOption extends RenovateArrayOption<string> {\n  format?: 'regex';\n  subType: 'string';\n}\n\nexport interface RenovateNumberArrayOption extends RenovateArrayOption<number> {\n  subType: 'number';\n}\n\nexport interface RenovateBooleanOption extends RenovateOptionBase {\n  default?: boolean | null;\n  type: 'boolean';\n}\n\nexport interface RenovateIntegerOption extends RenovateOptionBase {\n  default?: number | null;\n  type: 'integer';\n}\n\nexport interface RenovateStringOption extends RenovateOptionBase {\n  default?: string | null;\n  format?: 'regex';\n\n  // Not used\n  replaceLineReturns?: boolean;\n  type: 'string';\n}\n\nexport interface RenovateObjectOption extends RenovateOptionBase {\n  default?: any;\n  additionalProperties?: Record<string, unknown> | boolean;\n\n  /**\n   * The keys the object accepts, for an option whose keys are a known set rather than the user's choice.\n   */\n  properties?: Record<string, unknown>;\n  mergeable?: boolean;\n  type: 'object';\n}\n\ntype RenovateOptionType =\n  | RenovateStringOption\n  | RenovateNumberArrayOption\n  | RenovateStringArrayOption\n  | RenovateIntegerOption\n  | RenovateBooleanOption\n  | RenovateArrayOption\n  | RenovateObjectOption;\n\n/**\n * An option which can only be configured by people with access to the Renovate instance.\n *\n * It should be documented in docs/usage/self-hosted-configuration.md, and doesn't have to say where it can be used yet - see #43020.\n */\ninterface SelfHostedOption {\n  globalOnly: true;\n  scopes?: ConfigScope[];\n  parents?: AllowedParents[];\n}\n\n/**\n * An option which a repository can configure, which has to say where it can be used, through either its `scopes` or its `parents`.\n */\ntype ConfigurableOption = { globalOnly?: false } & (\n  | { scopes: ConfigScope[]; parents?: AllowedParents[] }\n  | { parents: AllowedParents[]; scopes?: ConfigScope[] }\n);\n\nexport type RenovateOptions = RenovateOptionType &\n  (SelfHostedOption | ConfigurableOption);\n\nexport interface PackageRuleInputConfig extends RenovateConfig {\n  versioning?: string;\n  packageFile?: string;\n  lockFiles?: string[];\n  depType?: string;\n  depTypes?: string[];\n  depName?: string;\n  packageName?: string | null;\n  newValue?: string | null;\n  currentValue?: string | null;\n  currentVersion?: string;\n  lockedVersion?: string;\n  updateType?: UpdateType;\n  mergeConfidenceLevel?: MergeConfidence | undefined;\n  isBump?: boolean;\n  isBreaking?: boolean;\n  sourceUrl?: string | null;\n  categories?: string[];\n  baseBranch?: string;\n  manager?: string;\n  datasource?: string;\n  effectiveDatasource?: string;\n  packageRules?: (PackageRule & PackageRuleInputConfig)[];\n  releaseTimestamp?: Timestamp | null;\n  repository?: string;\n  currentVersionAgeInDays?: number;\n  currentVersionTimestamp?: string;\n  enabled?: boolean;\n  skipReason?: SkipReason;\n  skipStage?: StageName;\n}\n\nexport interface ConfigMigration {\n  configMigration?: boolean;\n}\n\nexport interface MigratedConfig {\n  /**\n   * Indicates whether there was a migration applied to the configuration.\n   *\n   * @returns\n   * `false` if the configuration does not need migrating, and `migratedConfig` can be ignored\n   * `true` if the configuration was migrated, and if so, `migratedConfig` should be used instead of the provided config\n   */\n  isMigrated: boolean;\n  migratedConfig: RenovateConfig;\n}\n\nexport interface MigratedRenovateConfig extends RenovateConfig {\n  endpoints?: HostRule[];\n  pathRules: PackageRule[];\n  packages: PackageRule[];\n\n  node?: RenovateConfig;\n  travis?: RenovateConfig;\n  gradle?: RenovateConfig;\n}\n\nexport interface ManagerConfig extends RenovateConfig {\n  manager: string;\n  categories?: Category[];\n}\n\nexport interface ValidationResult {\n  errors: ValidationMessage[];\n  warnings: ValidationMessage[];\n}\n\nexport interface DependencyDashboardConfig {\n  enabled?: boolean;\n  autoclose?: boolean;\n  title?: string;\n  header?: string;\n  footer?: string;\n  labels?: string[];\n  osvVulnerabilitySummary?: 'none' | 'all' | 'unresolved';\n  reportAbandonment?: boolean;\n  pinned?: boolean;\n  customize?: Record<string, string>;\n}\n\nexport interface BumpVersionConfig {\n  bumpType?: string;\n  filePatterns: string[];\n  matchStrings: string[];\n  name?: string;\n}\n\n/**\n * Global Config for specified `toolSettings` options.\n *\n */\nexport interface GlobalToolSettingsOptions {\n  /** An upper limit on what the Java Virtual Machine's maximum memory can be set to. Repositories can specify <= this value */\n  jvmMaxMemory?: number;\n  /** An upper limit on what the Java Virtual Machine's starting memory can be set to. Repositories can specify <= this value */\n  jvmMemory?: number;\n  /** An upper limit on what the Node.JS process' maximum memory can be set to. Repositories can specify <= this value */\n  nodeMaxMemory?: number;\n}\n\n/**\n * Repository config options for `toolSettings` options.\n */\nexport interface RepoToolSettingsOptions {\n  /** The maximum memory the Java Virtual Machine can use. If greater than the Global Self-Hosted configuration setting, it will be set to that limit **/\n  jvmMaxMemory?: number;\n  /** The starting memory the Java Virtual Machine can use. If greater than the Global Self-Hosted configuration setting, it will be set to that limit **/\n  jvmMemory?: number;\n  /** The maximum memory child Node.JS processes can use. If greater than the Global Self-Hosted configuration setting, it will be set to that limit **/\n  nodeMaxMemory?: number;\n}\n\n/** All known `VulnerabilityAlertSource`s */\nexport const VulnerabilityAlertSources = [\n  /**\n   * The Platform being used provides vulnerability alerts.\n   *\n   * i.e. GitHub Advanced Security's Dependabot Alerts\n   **/\n  '$platform',\n  /**\n   * The Open Source Vulnerability database (OSV) provides vulnerability alerts.\n   *\n   * @link https://github.com/renovatebot/osv-offline\n   **/\n  'OSV',\n  /**\n   * A self-hosted administrator is providing any `packageRules` that will apply Vulnerability Alerts.\n   *\n   * @see PackageRule\n   **/\n  'packageRules',\n] as const;\n\n/**\n * Where the Vulnerability Alerts are sourced from.\n */\nexport type VulnerabilityAlertSource =\n  (typeof VulnerabilityAlertSources)[number];\n"],"mappings":";AAgDA,MAAa,+BAA+B;CAC1C;CACA;CACA;AACF;AA8SA,MAAa,4BAA4B;CACvC;CACA;CACA;CACA;AACF;AA8IA,MAAa,0BAA0B;CACrC;CACA;CACA;CACA;CACA;AACF;AAgDA,MAAa,qBAAqB;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;AAmEA,MAAa,eAAe;CAE1B;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;AACF;;;;AAOA,MAAa,eAAe;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AA4TA,MAAa,4BAA4B;CAMvC;CAMA;CAMA;AACF"}
+{"version":3,"file":"types.js","names":[],"sources":["../../lib/config/types.ts"],"sourcesContent":["import type { Category, PlatformId } from '../constants/index.ts';\nimport type { LogLevelRemap } from '../logger/types.ts';\nimport type {\n  CustomManagerName,\n  ManagerName,\n} from '../manager-list.generated.ts';\nimport type { CustomManager } from '../modules/manager/custom/types.ts';\nimport type {\n  GitUrlOption,\n  RepoSortMethod,\n  SortMethod,\n} from '../modules/platform/types.ts';\nimport type {\n  AutoMergeType,\n  HostRule,\n  Nullish,\n  RangeStrategy,\n  SkipReason,\n} from '../types/index.ts';\nimport type { StageName } from '../types/skip-reason.ts';\nimport type {\n  AdditionalConstraintName,\n  ConstraintName,\n  ToolName,\n} from '../util/exec/types.ts';\nimport type { GitNoVerifyOption } from '../util/git/types.ts';\nimport type { MergeConfidence } from '../util/merge-confidence/types.ts';\nimport type { Timestamp } from '../util/timestamp.ts';\nimport type { ConfigValidationTopic } from './validation-helpers/types.ts';\n\nexport type RenovateConfigStage =\n  'global' | 'inherit' | 'repository' | 'package' | 'branch' | 'pr';\n\nexport type RenovateSplit =\n  'init' | 'onboarding' | 'extract' | 'lookup' | 'update';\n\nexport type RepositoryCacheConfig = 'disabled' | 'enabled' | 'reset';\nexport type RepositoryCacheType = 'local' | (string & {});\nexport type DryRunConfig = 'extract' | 'lookup' | 'full';\nexport type InternalHostAccess = 'allow' | 'warn' | 'block';\nexport type RequiredConfig = 'required' | 'optional' | 'ignored';\n\nexport interface GroupConfig extends Record<string, unknown> {\n  branchName?: string;\n  branchTopic?: string;\n}\n\nexport type RecreateWhen = 'auto' | 'never' | 'always';\nexport const allowedStatusCheckWhenValues = [\n  'always',\n  'never',\n  'failed',\n] as const;\nexport type StatusCheckWhen = (typeof allowedStatusCheckWhenValues)[number];\nexport type PlatformCommitOptions = 'auto' | 'disabled' | 'enabled';\n\nexport type BinarySource = 'docker' | 'global' | 'install' | 'hermit';\n\n// TODO: Proper typings\n/**\n * Any configuration that could be used either top-level in a repository config (or Global, Inherited or Shareable Preset configuration), or:\n *\n * - in a datasource-specific configuration\n * - in a manager-specific configuration\n * - in a Package Rule\n *\n * @see RenovateConfig for the superset of all configuration allowed in a given repository\n *\n */\nexport interface RenovateSharedConfig {\n  $schema?: string;\n  abandonmentThreshold?: Nullish<string>;\n  addLabels?: string[];\n  assignAutomerge?: boolean;\n  autoApprove?: boolean;\n  autoReplaceGlobalMatch?: boolean;\n  automerge?: boolean;\n  automergeSchedule?: string[];\n  automergeStrategy?: MergeStrategy;\n  automergeType?: AutoMergeType;\n  azureWorkItemId?: number;\n  azureWorkItemType?: string;\n  branchName?: string;\n  branchNameStrict?: boolean;\n  branchPrefix?: string;\n  branchPrefixOld?: string;\n  bumpVersions?: BumpVersionConfig[];\n  commitBody?: string;\n  commitBodyTable?: boolean;\n  commitMessage?: string;\n  commitMessageAction?: string;\n  commitMessageExtra?: string;\n  commitMessageLowerCase?: 'auto' | 'never';\n  commitMessagePrefix?: string;\n  commitMessageTopic?: string;\n  commitTrailers?: string[];\n  confidential?: boolean;\n  configValidationError?: boolean;\n  changelogUrl?: string;\n  dependencyDashboardApproval?: boolean;\n  draftPR?: boolean;\n  enabled?: boolean;\n  enabledManagers?: string[];\n  encrypted?: Record<string, string>;\n  extends?: string[];\n  extractVersion?: string;\n  managerFilePatterns?: string[];\n  followTag?: string;\n  force?: RenovateConfig;\n  gitIgnoredAuthors?: string[];\n  group?: GroupConfig;\n  groupName?: string;\n  groupSingleUpdates?: boolean;\n  groupSlug?: string;\n  hashedBranchLength?: number;\n  ignoreDeps?: string[];\n  ignorePaths?: string[];\n  ignoreTests?: boolean;\n  ignoreUnstable?: boolean;\n  includePaths?: string[];\n  internalChecksAsSuccess?: boolean;\n  internalChecksFilter?: 'strict' | 'flexible' | 'none';\n  keepUpdatedLabel?: string;\n  labels?: string[];\n  manager?: string;\n  milestone?: number;\n  minimumReleaseAge?: Nullish<string>;\n  minimumReleaseAgeBuffer?: Nullish<string>;\n  minimumReleaseAgePackageManager?: Nullish<string>;\n  minimumReleaseAgePackageManagerSync?: boolean;\n  npmrc?: string;\n  npmrcMerge?: boolean;\n  npmToken?: string;\n\n  pinDigests?: boolean;\n  platformAutomerge?: boolean;\n  platformCommit?: PlatformCommitOptions;\n  postUpgradeTasks?: PostUpgradeTasks;\n  prBodyColumns?: string[];\n  prBodyDefinitions?: Record<string, string>;\n  prBodyHeadingDefinitions?: Record<string, string>;\n  prBodyNotes?: string[];\n  prCreation?: 'immediate' | 'not-pending' | 'status-success' | 'approval';\n  prFooter?: string;\n  prHeader?: string;\n  prPriority?: number;\n  prTitle?: string;\n  prTitleStrict?: boolean;\n  pruneBranchAfterAutomerge?: boolean;\n  rangeStrategy?: RangeStrategy;\n  rebaseLabel?: string;\n  rebaseWhen?: string;\n  recreateClosed?: boolean;\n  recreateWhen?: RecreateWhen;\n  repository?: string;\n  repositoryCache?: RepositoryCacheConfig;\n  repositoryCacheType?: RepositoryCacheType;\n  respectLatest?: boolean;\n  rollbackPrs?: boolean;\n  schedule?: string[];\n  semanticCommitScope?: string | null;\n  semanticCommitType?: string;\n  semanticCommits?: 'auto' | 'enabled' | 'disabled';\n  separateMajorMinor?: boolean;\n  separateMinorPatch?: boolean;\n  separateMultipleMajor?: boolean;\n  separateMultipleMinor?: boolean;\n  skipArtifactsUpdate?: boolean;\n  stopUpdatingLabel?: string;\n  suppressNotifications?: string[];\n  timezone?: string;\n  unicodeEmoji?: boolean;\n  updateNotScheduled?: boolean;\n  versioning?: string;\n  versionCompatibility?: string;\n}\n\n/**\n * Contains all options with globalOnly=true && inheritConfigSupport=true\n */\nexport interface GlobalInheritableConfig {\n  bbUseDevelopmentBranch?: boolean;\n  configFileNames?: string[];\n  onboarding?: boolean;\n  onboardingAutoCloseAge?: number;\n  onboardingBranch?: string;\n  onboardingCommitMessage?: string;\n  onboardingConfig?: RenovateConfig;\n  onboardingConfigFileName?: string;\n  onboardingNoDeps?: 'auto' | 'enabled' | 'disabled';\n  onboardingPrTitle?: string;\n  requireConfig?: RequiredConfig;\n}\n\n// Config options used only within the global worker\n// The below should contain config options where stage=global\n/** @deprecated use `RepoGlobalConfig` instead **/\nexport interface GlobalOnlyConfigLegacy {\n  autodiscover?: boolean;\n  autodiscoverFilter?: string[] | string;\n  autodiscoverNamespaces?: string[];\n  autodiscoverProjects?: string[];\n  autodiscoverTopics?: string[];\n  baseDir?: string;\n  cacheDir?: string;\n  containerbaseDir?: string;\n  detectHostRulesFromEnv?: boolean;\n  dockerCliOptions?: string;\n  endpoint?: string;\n  exitCodeForErrors?: boolean;\n  forceCli?: boolean;\n  gitNoVerify?: GitNoVerifyOption[];\n  gitPrivateKey?: string;\n  gitPrivateKeyPassphrase?: string;\n  globalExtends?: string[];\n  mergeConfidenceDatasources?: string[];\n  mergeConfidenceEndpoint?: string;\n  platform?: PlatformId;\n  processEnv?: Record<string, string>;\n  prCommitsPerRunLimit?: number;\n  privateKey?: string;\n  privateKeyOld?: string;\n  privateKeyPath?: string;\n  privateKeyPathOld?: string;\n  redisPrefix?: string;\n  redisUrl?: string;\n  repositories?: RenovateRepository[];\n  useCloudMetadataServices?: boolean;\n  deleteConfigFile?: boolean;\n  deleteAdditionalConfigFile?: boolean;\n}\n\n/**\n * Any global-only configuration set by self-hosted administrators.\n *\n * Used within the repository worker.\n *\n * Should only contain config options where globalOnly=true.\n */\nexport interface RepoGlobalConfig extends GlobalInheritableConfig {\n  allowedCommands?: string[];\n  allowCustomCrateGitRegistries?: boolean;\n  allowPlugins?: boolean;\n  allowScripts?: boolean;\n  allowShellExecutorForPostUpgradeCommands?: boolean;\n  allowedEnv?: string[];\n  allowedHeaders?: string[];\n  binarySource?: BinarySource;\n  cacheDir?: string;\n  cacheHardTtlMinutes?: number;\n  cacheTtlOverride?: Record<string, number>;\n  checkedBranches?: string[];\n  containerbaseDir?: string;\n  customEnvVariables?: Record<string, string>;\n  dockerChildPrefix?: string;\n  dockerCliOptions?: string;\n  dockerSidecarImage?: string;\n  dockerUser?: string;\n  dryRun?: DryRunConfig;\n  encryptedWarning?: string;\n  endpoint?: string;\n  executionTimeout?: number;\n  exposeAllEnv?: boolean;\n  gitTimeout?: number;\n  githubTokenWarn?: boolean;\n  goEnvFromHostRules?: boolean;\n  includeMirrors?: boolean;\n  inheritConfigTrusted?: boolean;\n  internalHostAccess?: InternalHostAccess;\n  migratePresets?: Record<string, string>;\n  platform?: PlatformId;\n  prCacheSyncMaxPages?: number;\n  presetCachePersistence?: boolean;\n  httpCacheTtlDays?: number;\n  autodiscoverRepoSort?: RepoSortMethod;\n  autodiscoverRepoOrder?: SortMethod;\n  userAgent?: string;\n  dockerMaxPages?: number;\n  s3Endpoint?: string;\n  s3PathStyle?: boolean;\n  cachePrivatePackages?: boolean;\n  repositoryCacheForceLocal?: boolean;\n  configFileNames?: string[];\n  ignorePrAuthor?: boolean;\n  allowedUnsafeExecutions?: AllowedUnsafeExecution[];\n  onboardingAutoCloseAge?: number;\n  productLinks?: Record<string, string>;\n  rebaseAllOpenBranches?: boolean;\n  toolSettings?: GlobalToolSettingsOptions;\n}\n\n/**\n * Internal variables which are referenced from `GlobalConfig`, but are *not* user-configurable options.\n */\nexport interface InternalGlobalConfigOptions {\n  localDir?: string;\n}\n\n/**\n * Those options are global only but still passed into the repository worker config.\n *\n * @deprecated https://github.com/renovatebot/renovate/issues/39693\n */\nexport interface LegacyAdminConfig {\n  baseDir?: string;\n  localDir?: string;\n\n  logContext?: string;\n\n  onboarding?: boolean;\n  onboardingBranch?: string;\n  onboardingNoDeps?: 'auto' | 'enabled' | 'disabled';\n  onboardingRebaseCheckbox?: boolean;\n  onboardingConfig?: RenovateConfig;\n  onboardingConfigFileName?: string;\n\n  optimizeForDisabled?: boolean;\n\n  persistRepoData?: boolean;\n\n  prCommitsPerRunLimit?: number;\n\n  requireConfig?: RequiredConfig;\n\n  useCloudMetadataServices?: boolean;\n\n  writeDiscoveredRepos?: string;\n}\n\nexport type ExecutionMode = 'branch' | 'update';\n\nexport interface PostUpgradeTasks {\n  commands?: string[];\n  workingDirTemplate?: string;\n  dataFileTemplate?: string;\n  fileFilters?: string[];\n  executionMode: ExecutionMode;\n  installTools?: Partial<Record<ToolName, Record<never, never>>>;\n}\n\nexport type UpdateConfig<\n  T extends RenovateSharedConfig = RenovateSharedConfig,\n> = Partial<Record<UpdateType, T | null>>;\n\nexport type RenovateRepositoryEntry = AllConfig & {\n  repository: string;\n};\n\nexport type RenovateRepository = string | RenovateRepositoryEntry;\n\nexport type UseBaseBranchConfigType = 'merge' | 'merge-if-present' | 'none';\nexport type ConstraintsFilter = 'strict' | 'none';\nexport type MinimumReleaseAgeBehaviour =\n  'timestamp-required' | 'timestamp-optional';\n\nexport const allowedStatusCheckStrings = [\n  'minimumReleaseAge',\n  'mergeConfidence',\n  'configValidation',\n  'artifactError',\n] as const;\nexport type StatusCheckKey = (typeof allowedStatusCheckStrings)[number];\ntype UserEnv = Record<string, string>;\n\n/**\n * Computed properties, for internal use only\n */\nexport interface RenovateInternalConfig {\n  /** computed base branch from patterns - for internal use only */\n  baseBranches?: string[];\n  currentCompatibility?: string;\n  datasource?: string;\n  hasBaseBranches?: boolean;\n  isFork?: boolean;\n  isVulnerabilityAlert?: boolean;\n\n  /** What is this used for? */\n  remediations?: unknown;\n  /** What is this used for? */\n  vulnerabilityAlertsOnly?: boolean;\n}\n\n// TODO: Proper typings\n/**\n * Configuration that could be used either top-level in a repository config (or Global, Inherited or Shareable Preset configuration).\n *\n * This is a superset of any configuration that a Renovate user (not self-hosted administrator) can set.\n */\nexport interface RenovateConfig\n  extends\n    LegacyAdminConfig,\n    RenovateSharedConfig,\n    UpdateConfig<PackageRule>,\n    AssigneesAndReviewersConfig,\n    ConfigMigration,\n    RenovateInternalConfig {\n  s3Endpoint?: string;\n  s3PathStyle?: boolean;\n  reportFormatting?: boolean;\n  reportPath?: string;\n  reportType?: 'logging' | 'file' | 's3' | null;\n  depName?: string;\n  /** user configurable base branch patterns*/\n  baseBranchPatterns?: string[];\n  useBaseBranchConfig?: UseBaseBranchConfigType;\n  baseBranch?: string;\n  defaultBranch?: string;\n  branchList?: string[];\n  cloneSubmodules?: boolean;\n  cloneSubmodulesFilter?: string[];\n  description?: string | string[];\n  overrideDescription?: string | string[];\n  detectGlobalManagerConfig?: boolean;\n  errors?: ValidationMessage[];\n  forkModeDisallowMaintainerEdits?: boolean;\n  forkProcessing?: 'auto' | 'enabled' | 'disabled';\n  forkToken?: string;\n\n  gitAuthor?: string;\n\n  hostRules?: HostRule[];\n\n  inheritConfig?: boolean;\n  inheritConfigFileName?: string;\n  inheritConfigRepoName?: string;\n  inheritConfigStrict?: boolean;\n\n  ignorePresets?: string[];\n\n  fileList?: string[];\n  configWarningReuseIssue?: boolean;\n  dependencyDashboard?: DependencyDashboardConfig;\n  dependencyDashboardChecks?: Record<string, string>;\n  dependencyDashboardIssue?: number;\n  mode?: 'silent' | 'full';\n  packageFile?: string;\n  packageRules?: PackageRule[];\n  postUpdateOptions?: string[];\n  branchConcurrentLimit?: number | null;\n  parentOrg?: string;\n  prConcurrentLimit?: number;\n  commitHourlyLimit?: number;\n  prHourlyLimit?: number;\n\n  printConfig?: boolean;\n\n  pruneStaleBranches?: boolean;\n\n  defaultRegistryUrls?: string[];\n  registryUrls?: string[] | null;\n  registryAliases?: Record<string, string>;\n\n  /**\n   * What is this used for?\n   * @deprecated\n   */\n  renovateJsonPresent?: boolean;\n\n  repoIsOnboarded?: boolean;\n  repoIsActivated?: boolean;\n\n  topLevelOrg?: string;\n  updateInternalDeps?: boolean;\n  updateType?: UpdateType;\n\n  warnings?: ValidationMessage[];\n  vulnerabilityAlerts?: RenovateSharedConfig;\n  osvVulnerabilityAlerts?: boolean;\n  vulnerabilitySeverity?: string;\n  customManagers?: CustomManager[];\n  customDatasources?: Record<string, CustomDatasourceConfig>;\n\n  fetchChangeLogs?: FetchChangeLogsOptions;\n  secrets?: Record<string, string>;\n  variables?: Record<string, string>;\n\n  constraints?: Partial<Record<ConstraintName, string>>;\n  /**\n   * Any specific overrides for the versioning for the `AdditionalConstraintName`s.\n   */\n  constraintsVersioning?: Partial<Record<AdditionalConstraintName, string>>;\n  skipInstalls?: boolean | null;\n\n  constraintsFiltering?: ConstraintsFilter;\n\n  statusCheckNames?: Record<StatusCheckKey, string | null>;\n  statusCheckWhen?: Partial<Record<StatusCheckKey, StatusCheckWhen>>;\n  /**\n   * User configured environment variables that Renovate uses when executing package manager commands\n   */\n  env?: UserEnv;\n  logLevelRemap?: LogLevelRemap[];\n\n  branchTopic?: string;\n  additionalBranchPrefix?: string;\n  sharedVariableName?: string;\n  minimumGroupSize?: number;\n  configFileNames?: string[];\n  minimumReleaseAgeBehaviour?: MinimumReleaseAgeBehaviour;\n  toolSettings?: RepoToolSettingsOptions;\n}\n\nexport const CustomDatasourceFormats = [\n  'html',\n  'json',\n  'plain',\n  'toml',\n  'yaml',\n] as const;\nexport type CustomDatasourceFormats = (typeof CustomDatasourceFormats)[number];\n\nexport interface CustomDatasourceConfig {\n  defaultRegistryUrlTemplate?: string;\n  format?: CustomDatasourceFormats;\n  transformTemplates?: string[];\n}\n\n/**\n * The superset of all configuration that a self-hosted administrator can set, alongside all repository-level configuration.\n *\n */\nexport interface AllConfig\n  extends RenovateConfig, GlobalOnlyConfigLegacy, RepoGlobalConfig {\n  gitUrl?: GitUrlOption;\n  password?: string;\n  token?: string;\n  username?: string;\n}\n\nexport interface AssigneesAndReviewersConfig {\n  assigneesFromCodeOwners?: boolean;\n  expandCodeOwnersGroups?: boolean;\n  assignees?: string[];\n  assigneesSampleSize?: number;\n  ignoreReviewers?: string[];\n  reviewersFromCodeOwners?: boolean;\n  reviewers?: string[];\n  reviewersSampleSize?: number;\n  additionalReviewers?: string[];\n  filterUnavailableUsers?: boolean;\n}\n\nexport type UpdateType =\n  | 'major'\n  | 'minor'\n  | 'patch'\n  | 'pin'\n  | 'digest'\n  | 'pinDigest'\n  | 'lockFileMaintenance'\n  | 'lockfileUpdate'\n  | 'rollback'\n  | 'bump'\n  | 'replacement';\n\n// These are the update types which can have configuration\nexport const UpdateTypesOptions = [\n  'major',\n  'minor',\n  'patch',\n  'pin',\n  'digest',\n  'pinDigest',\n  'lockFileMaintenance',\n  'rollback',\n  'replacement',\n] as const;\n\nexport type UpdateTypeOptions = (typeof UpdateTypesOptions)[number];\n\nexport type FetchChangeLogsOptions = 'off' | 'branch' | 'pr';\n\nexport type MatchStringsStrategy = 'any' | 'recursive' | 'combination';\n\nexport type MergeStrategy =\n  | 'auto'\n  | 'fast-forward'\n  | 'merge-commit'\n  | 'rebase'\n  | 'rebase-merge'\n  | 'squash';\n\n// This list should be added to as any new unsafe execution commands should be permitted\nexport type AllowedUnsafeExecution =\n  'bazelModDeps' | 'goGenerate' | 'gradleWrapper' | 'mise' | 'pixi';\n\n// TODO: Proper typings\nexport interface PackageRule\n  extends RenovateSharedConfig, RenovateInternalConfig, UpdateConfig {\n  allowedVersions?: string;\n  description?: string | string[];\n  matchBaseBranches?: string[];\n  matchCategories?: string[];\n  matchConfidence?: MergeConfidence[];\n  matchCurrentAge?: string;\n  matchCurrentValue?: string;\n  matchCurrentVersion?: string;\n  matchDatasources?: string[];\n  matchDepNames?: string[];\n  matchDepTypes?: string[];\n  matchFileNames?: string[];\n  matchIsBreaking?: boolean;\n  matchManagers?: string[];\n  matchNewValue?: string;\n  matchPackageNames?: string[];\n  matchRepositories?: string[];\n  matchSourceUrls?: string[];\n  matchRegistryUrls?: string[];\n  matchUpdateTypes?: UpdateType[];\n  matchJsonata?: string[];\n  overrideDatasource?: string;\n  overrideDepName?: string;\n  overridePackageName?: string;\n  registryUrls?: string[] | null;\n  replacementName?: string;\n  replacementVersion?: string;\n  sourceUrl?: string;\n  sourceDirectory?: string;\n  vulnerabilitySeverity?: string;\n  vulnerabilityFixVersion?: string;\n}\n\nexport interface ValidationMessage {\n  // Topic is either the known list of topics, or a dynamically generated one\n  topic: ConfigValidationTopic | (string & {});\n  message: string;\n}\n\n/**\n * The kinds of place a config option can be used, which expand to the {@link AllowedParents} they cover.\n *\n * These are for the places which can't reasonably be listed, like every manager or every update type, so an option which is only valid in a specific object - like `hostRules` - should use `parents` instead.\n */\nexport const configScopes = [\n  /** the top level of a repository, global, inherited or preset config */\n  'repo',\n  /** a `packageRules` entry */\n  'packageRule',\n  /** a manager's configuration object, like `npm` */\n  'manager',\n  /** an update type's configuration object, like `major` */\n  'updateType',\n  /** the `vulnerabilityAlerts` configuration object */\n  'vulnerabilityAlert',\n  /** the `group` configuration object, which is merged into an update when it's grouped */\n  'group',\n  /** every object a config can be nested in, for the options which are read wherever they're found */\n  'any',\n] as const;\n\nexport type ConfigScope = (typeof configScopes)[number];\n\n/**\n * The objects which a config can be nested in, other than the top level and the ones which are covered by a {@link ConfigScope}.\n */\nexport const namedParents = [\n  'bumpVersions',\n  'customDatasources',\n  'customManagers',\n  'dependencyDashboard',\n  'group',\n  'hostRules',\n  'logLevelRemap',\n  'packageRules',\n  'postUpgradeTasks',\n  'toolSettings',\n  'vulnerabilityAlerts',\n] as const;\n\nexport type AllowedParents =\n  | '.'\n  | (typeof namedParents)[number]\n  | ManagerName\n  | CustomManagerName\n  | UpdateTypeOptions;\nexport interface RenovateOptionBase {\n  /**\n   * If true, this option **MUST** be checked at the trust boundary: after resolving the full config that sets it, but **before** the value is applied.\n   *\n   * This is in addition to any existing config validation, and ensures that these options are re-validated due to their sensitive nature.\n   *\n   * A failure of that check **must** lead to a {@link ConfigValidationTopic.Security} error (which is then a full config validation error), stopping the Renovate run.\n   *\n   * After this check has been performed, additional filtering (for defense in depth) could be performed, but may not have an indication of what is repo- or preset-config vs global self-hosted config.\n   */\n  requiresCheckAtTrustBoundary?: boolean;\n\n  inheritConfigSupport?: boolean;\n\n  allowedValues?: string[];\n\n  /**\n   * A subset of suggested values for the user, which are some (but not all) of the possible `allowedValues`.\n   *\n   * This provides editor autocomplete (i.e. via our JSON Schema) but makes it possible to not be an exhaustive list, which is required by `allowedValues`, and may be further complicated by `patternMatch`.\n   */\n  suggestedValues?: string[];\n\n  allowString?: boolean;\n\n  cli?: boolean;\n\n  description: string;\n\n  env?: false | string;\n\n  /**\n   * Do not validate object children\n   */\n  freeChoice?: boolean;\n\n  mergeable?: boolean;\n\n  /**\n   * Whether the configuration option has been autogenerated from Renovate's internals, and describes what type of module it's generated from.\n   *\n   * `manager` indicates that this was generated from a Manager's config object, from its `defaultConfig`.\n   */\n  autogenerated?: 'manager';\n\n  name: string;\n\n  parents?: AllowedParents[];\n\n  /**\n   * The kinds of place this option can be used, which are expanded alongside any `parents`.\n   *\n   * An option which declares neither is treated as valid anywhere, which is what we're working towards removing in #43020.\n   */\n  scopes?: ConfigScope[];\n\n  stage?: RenovateConfigStage;\n\n  experimental?: boolean;\n\n  experimentalDescription?: string;\n\n  experimentalIssues?: number[];\n\n  advancedUse?: boolean;\n\n  /**\n   * This is used to add a deprecation message in the docs\n   */\n  deprecationMsg?: string;\n\n  /**\n   * For internal use only: add it to any config option that supports regex or glob matching\n   */\n  patternMatch?: boolean;\n\n  /**\n   * For internal use only: add it to any config option of type integer that supports negative integers\n   */\n  allowNegative?: boolean;\n\n  /**\n   * Whether the option can be set to `null`.\n   *\n   * This is only needed if the default is not `null` (which makes this implied).\n   */\n  nullable?: boolean;\n\n  /**\n   * Managers which support this option, leave undefined if all managers support it.\n   */\n  supportedManagers?: string[];\n\n  /**\n   * Platforms which support this option, leave undefined if all platforms support it.\n   */\n  supportedPlatforms?: PlatformId[];\n\n  /**\n   * Conditions that must be met for this option to be required.\n   */\n  requiredIf?: RenovateRequiredOption[];\n\n  /**\n   * If true, the option's value supports Renovate templating.\n   * @see https://docs.renovatebot.com/templates/\n   */\n  supportsTemplating?: boolean;\n}\n\nexport interface RenovateRequiredOption {\n  siblingProperties: { property: string; value: string }[];\n}\n\nexport interface RenovateArrayOption<\n  T extends string | number | Record<string, unknown> = Record<string, unknown>,\n> extends RenovateOptionBase {\n  default?: T[] | null;\n  mergeable?: boolean;\n  type: 'array';\n  subType?: 'string' | 'object' | 'number';\n}\n\nexport interface RenovateStringArrayOption extends RenovateArrayOption<string> {\n  format?: 'regex';\n  subType: 'string';\n}\n\nexport interface RenovateNumberArrayOption extends RenovateArrayOption<number> {\n  subType: 'number';\n}\n\nexport interface RenovateBooleanOption extends RenovateOptionBase {\n  default?: boolean | null;\n  type: 'boolean';\n}\n\nexport interface RenovateIntegerOption extends RenovateOptionBase {\n  default?: number | null;\n  type: 'integer';\n}\n\nexport interface RenovateStringOption extends RenovateOptionBase {\n  default?: string | null;\n  format?: 'regex';\n\n  // Not used\n  replaceLineReturns?: boolean;\n  type: 'string';\n}\n\nexport interface RenovateObjectOption extends RenovateOptionBase {\n  default?: any;\n  additionalProperties?: Record<string, unknown> | boolean;\n\n  /**\n   * The keys the object accepts, for an option whose keys are a known set rather than the user's choice.\n   */\n  properties?: Record<string, unknown>;\n  mergeable?: boolean;\n  type: 'object';\n}\n\ntype RenovateOptionType =\n  | RenovateStringOption\n  | RenovateNumberArrayOption\n  | RenovateStringArrayOption\n  | RenovateIntegerOption\n  | RenovateBooleanOption\n  | RenovateArrayOption\n  | RenovateObjectOption;\n\n/**\n * An option which can only be configured by people with access to the Renovate instance.\n *\n * It should be documented in docs/usage/self-hosted-configuration.md, and doesn't have to say where it can be used yet - see #43020.\n */\ninterface SelfHostedOption {\n  globalOnly: true;\n  scopes?: ConfigScope[];\n  parents?: AllowedParents[];\n}\n\n/**\n * An option which a repository can configure, which has to say where it can be used, through either its `scopes` or its `parents`.\n */\ntype ConfigurableOption = { globalOnly?: false } & (\n  | { scopes: ConfigScope[]; parents?: AllowedParents[] }\n  | { parents: AllowedParents[]; scopes?: ConfigScope[] }\n);\n\nexport type RenovateOptions = RenovateOptionType &\n  (SelfHostedOption | ConfigurableOption);\n\nexport interface PackageRuleInputConfig extends RenovateConfig {\n  versioning?: string;\n  packageFile?: string;\n  lockFiles?: string[];\n  depType?: string;\n  depTypes?: string[];\n  depName?: string;\n  packageName?: string | null;\n  newValue?: string | null;\n  currentValue?: string | null;\n  currentVersion?: string;\n  lockedVersion?: string;\n  updateType?: UpdateType;\n  mergeConfidenceLevel?: MergeConfidence | undefined;\n  isBump?: boolean;\n  isBreaking?: boolean;\n  sourceUrl?: string | null;\n  categories?: string[];\n  baseBranch?: string;\n  manager?: string;\n  datasource?: string;\n  effectiveDatasource?: string;\n  packageRules?: (PackageRule & PackageRuleInputConfig)[];\n  releaseTimestamp?: Timestamp | null;\n  repository?: string;\n  currentVersionAgeInDays?: number;\n  currentVersionTimestamp?: string;\n  enabled?: boolean;\n  skipReason?: SkipReason;\n  skipStage?: StageName;\n}\n\nexport interface ConfigMigration {\n  configMigration?: boolean;\n}\n\nexport interface MigratedConfig {\n  /**\n   * Indicates whether there was a migration applied to the configuration.\n   *\n   * @returns\n   * `false` if the configuration does not need migrating, and `migratedConfig` can be ignored\n   * `true` if the configuration was migrated, and if so, `migratedConfig` should be used instead of the provided config\n   */\n  isMigrated: boolean;\n  migratedConfig: RenovateConfig;\n}\n\nexport interface MigratedRenovateConfig extends RenovateConfig {\n  endpoints?: HostRule[];\n  pathRules: PackageRule[];\n  packages: PackageRule[];\n\n  node?: RenovateConfig;\n  travis?: RenovateConfig;\n  gradle?: RenovateConfig;\n}\n\nexport interface ManagerConfig extends RenovateConfig {\n  manager: string;\n  categories?: Category[];\n}\n\nexport interface ValidationResult {\n  errors: ValidationMessage[];\n  warnings: ValidationMessage[];\n}\n\nexport interface DependencyDashboardConfig {\n  enabled?: boolean;\n  autoclose?: boolean;\n  title?: string;\n  header?: string;\n  footer?: string;\n  labels?: string[];\n  osvVulnerabilitySummary?: 'none' | 'all' | 'unresolved';\n  reportAbandonment?: boolean;\n  pinned?: boolean;\n  customize?: Record<string, string>;\n}\n\nexport interface BumpVersionConfig {\n  bumpType?: string;\n  filePatterns: string[];\n  matchStrings: string[];\n  name?: string;\n}\n\n/**\n * Global Config for specified `toolSettings` options.\n *\n */\nexport interface GlobalToolSettingsOptions {\n  /** An upper limit on what the Java Virtual Machine's maximum memory can be set to. Repositories can specify <= this value */\n  jvmMaxMemory?: number;\n  /** An upper limit on what the Java Virtual Machine's starting memory can be set to. Repositories can specify <= this value */\n  jvmMemory?: number;\n  /** An upper limit on what the Node.JS process' maximum memory can be set to. Repositories can specify <= this value */\n  nodeMaxMemory?: number;\n}\n\n/**\n * Repository config options for `toolSettings` options.\n */\nexport interface RepoToolSettingsOptions {\n  /** The maximum memory the Java Virtual Machine can use. If greater than the Global Self-Hosted configuration setting, it will be set to that limit **/\n  jvmMaxMemory?: number;\n  /** The starting memory the Java Virtual Machine can use. If greater than the Global Self-Hosted configuration setting, it will be set to that limit **/\n  jvmMemory?: number;\n  /** The maximum memory child Node.JS processes can use. If greater than the Global Self-Hosted configuration setting, it will be set to that limit **/\n  nodeMaxMemory?: number;\n}\n\n/** All known `VulnerabilityAlertSource`s */\nexport const VulnerabilityAlertSources = [\n  /**\n   * The Platform being used provides vulnerability alerts.\n   *\n   * i.e. GitHub Advanced Security's Dependabot Alerts\n   **/\n  '$platform',\n  /**\n   * The Open Source Vulnerability database (OSV) provides vulnerability alerts.\n   *\n   * @link https://github.com/renovatebot/osv-offline\n   **/\n  'OSV',\n  /**\n   * A self-hosted administrator is providing any `packageRules` that will apply Vulnerability Alerts.\n   *\n   * @see PackageRule\n   **/\n  'packageRules',\n] as const;\n\n/**\n * Where the Vulnerability Alerts are sourced from.\n */\nexport type VulnerabilityAlertSource =\n  (typeof VulnerabilityAlertSources)[number];\n"],"mappings":";AAgDA,MAAa,+BAA+B;CAC1C;CACA;CACA;AACF;AA+SA,MAAa,4BAA4B;CACvC;CACA;CACA;CACA;AACF;AA8IA,MAAa,0BAA0B;CACrC;CACA;CACA;CACA;CACA;AACF;AAgDA,MAAa,qBAAqB;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;AAmEA,MAAa,eAAe;CAE1B;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;AACF;;;;AAOA,MAAa,eAAe;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AA4TA,MAAa,4BAA4B;CAMvC;CAMA;CAMA;AACF"}

package/dist/global-config-option-defaults.generated.js

@@ -23,7 +23,7 @@ const globalConfigOptionDefaults = {
 	"detectHostRulesFromEnv": false,
 	"dockerChildPrefix": "renovate_",
 	"dockerMaxPages": 20,
-	"dockerSidecarImage": "ghcr.io/renovatebot/base-image:13.166.2",
+	"dockerSidecarImage": "ghcr.io/renovatebot/base-image:13.166.3",
 	"dockerUser": "12021",
 	"executionTimeout": 15,
 	"exitCodeForErrors": false,

package/dist/global-config-option-defaults.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"global-config-option-defaults.generated.js","names":[],"sources":["../lib/global-config-option-defaults.generated.ts"],"sourcesContent":["\nexport const globalConfigOptionDefaults: Record<string, unknown> = {\n  \"allowCustomCrateGitRegistries\": false,\n  \"allowedCommands\": [],\n  \"allowedEnv\": [],\n  \"allowedHeaders\": [\n    \"X-*\"\n  ],\n  \"allowedUnsafeExecutions\": [],\n  \"allowPlugins\": false,\n  \"allowScripts\": false,\n  \"allowShellExecutorForPostUpgradeCommands\": false,\n  \"autodiscover\": false,\n  \"bbUseDevelopmentBranch\": false,\n  \"binarySource\": \"install\",\n  \"cacheHardTtlMinutes\": 10080,\n  \"cachePrivatePackages\": false,\n  \"cacheTtlOverride\": {},\n  \"checkedBranches\": [],\n  \"configValidationError\": false,\n  \"customEnvVariables\": {},\n  \"deleteAdditionalConfigFile\": false,\n  \"deleteConfigFile\": false,\n  \"detectGlobalManagerConfig\": false,\n  \"detectHostRulesFromEnv\": false,\n  \"dockerChildPrefix\": \"renovate_\",\n  \"dockerMaxPages\": 20,\n  \"dockerSidecarImage\": \"ghcr.io/renovatebot/base-image:13.166.2\",\n  \"dockerUser\": \"12021\",\n  \"executionTimeout\": 15,\n  \"exitCodeForErrors\": false,\n  \"exposeAllEnv\": false,\n  \"forceCli\": true,\n  \"forkCreation\": true,\n  \"githubTokenWarn\": true,\n  \"gitNoVerify\": [\n    \"commit\",\n    \"push\"\n  ],\n  \"gitTimeout\": 0,\n  \"gitUrl\": \"default\",\n  \"goEnvFromHostRules\": false,\n  \"httpCacheTtlDays\": 90,\n  \"ignorePrAuthor\": false,\n  \"includeMirrors\": false,\n  \"inheritConfig\": false,\n  \"inheritConfigFileName\": \"org-inherited-config.json\",\n  \"inheritConfigRepoName\": \"{{parentOrg}}/renovate-config\",\n  \"inheritConfigStrict\": false,\n  \"inheritConfigTrusted\": false,\n  \"internalHostAccess\": \"warn\",\n  \"mergeConfidenceDatasources\": [\n    \"go\",\n    \"maven\",\n    \"npm\",\n    \"nuget\",\n    \"packagist\",\n    \"pypi\",\n    \"rubygems\"\n  ],\n  \"mergeConfidenceEndpoint\": \"https://developer.mend.io/\",\n  \"migratePresets\": {},\n  \"onboardingBranch\": \"renovate/configure\",\n  \"onboardingConfig\": {\n    \"$schema\": \"https://docs.renovatebot.com/renovate-schema.json\"\n  },\n  \"onboardingConfigFileName\": \"renovate.json\",\n  \"onboardingNoDeps\": \"auto\",\n  \"onboardingPrTitle\": \"Configure Renovate\",\n  \"onboardingRebaseCheckbox\": false,\n  \"optimizeForDisabled\": false,\n  \"persistRepoData\": false,\n  \"platform\": \"github\",\n  \"prCacheSyncMaxPages\": 100,\n  \"prCommitsPerRunLimit\": 0,\n  \"presetCachePersistence\": false,\n  \"processEnv\": {},\n  \"productLinks\": {\n    \"documentation\": \"https://docs.renovatebot.com/\",\n    \"help\": \"https://github.com/renovatebot/renovate/discussions\",\n    \"homepage\": \"https://github.com/renovatebot/renovate\"\n  },\n  \"rebaseAllOpenBranches\": false,\n  \"reportFormatting\": false,\n  \"repositoryCache\": \"disabled\",\n  \"repositoryCacheForceLocal\": false,\n  \"repositoryCacheType\": \"local\",\n  \"requireConfig\": \"required\",\n  \"s3PathStyle\": false,\n  \"secrets\": {},\n  \"unicodeEmoji\": true,\n  \"useCloudMetadataServices\": true,\n  \"userAgent\": \"Renovate/{{renovateVersion}} (https://github.com/renovatebot/renovate)\",\n  \"variables\": {}\n};\n"],"mappings":";AACA,MAAa,6BAAsD;CACjE,iCAAiC;CACjC,mBAAmB,CAAC;CACpB,cAAc,CAAC;CACf,kBAAkB,CAChB,KACF;CACA,2BAA2B,CAAC;CAC5B,gBAAgB;CAChB,gBAAgB;CAChB,4CAA4C;CAC5C,gBAAgB;CAChB,0BAA0B;CAC1B,gBAAgB;CAChB,uBAAuB;CACvB,wBAAwB;CACxB,oBAAoB,CAAC;CACrB,mBAAmB,CAAC;CACpB,yBAAyB;CACzB,sBAAsB,CAAC;CACvB,8BAA8B;CAC9B,oBAAoB;CACpB,6BAA6B;CAC7B,0BAA0B;CAC1B,qBAAqB;CACrB,kBAAkB;CAClB,sBAAsB;CACtB,cAAc;CACd,oBAAoB;CACpB,qBAAqB;CACrB,gBAAgB;CAChB,YAAY;CACZ,gBAAgB;CAChB,mBAAmB;CACnB,eAAe,CACb,UACA,MACF;CACA,cAAc;CACd,UAAU;CACV,sBAAsB;CACtB,oBAAoB;CACpB,kBAAkB;CAClB,kBAAkB;CAClB,iBAAiB;CACjB,yBAAyB;CACzB,yBAAyB;CACzB,uBAAuB;CACvB,wBAAwB;CACxB,sBAAsB;CACtB,8BAA8B;EAC5B;EACA;EACA;EACA;EACA;EACA;EACA;CACF;CACA,2BAA2B;CAC3B,kBAAkB,CAAC;CACnB,oBAAoB;CACpB,oBAAoB,EAClB,WAAW,oDACb;CACA,4BAA4B;CAC5B,oBAAoB;CACpB,qBAAqB;CACrB,4BAA4B;CAC5B,uBAAuB;CACvB,mBAAmB;CACnB,YAAY;CACZ,uBAAuB;CACvB,wBAAwB;CACxB,0BAA0B;CAC1B,cAAc,CAAC;CACf,gBAAgB;EACd,iBAAiB;EACjB,QAAQ;EACR,YAAY;CACd;CACA,yBAAyB;CACzB,oBAAoB;CACpB,mBAAmB;CACnB,6BAA6B;CAC7B,uBAAuB;CACvB,iBAAiB;CACjB,eAAe;CACf,WAAW,CAAC;CACZ,gBAAgB;CAChB,4BAA4B;CAC5B,aAAa;CACb,aAAa,CAAC;AAChB"}
+{"version":3,"file":"global-config-option-defaults.generated.js","names":[],"sources":["../lib/global-config-option-defaults.generated.ts"],"sourcesContent":["\nexport const globalConfigOptionDefaults: Record<string, unknown> = {\n  \"allowCustomCrateGitRegistries\": false,\n  \"allowedCommands\": [],\n  \"allowedEnv\": [],\n  \"allowedHeaders\": [\n    \"X-*\"\n  ],\n  \"allowedUnsafeExecutions\": [],\n  \"allowPlugins\": false,\n  \"allowScripts\": false,\n  \"allowShellExecutorForPostUpgradeCommands\": false,\n  \"autodiscover\": false,\n  \"bbUseDevelopmentBranch\": false,\n  \"binarySource\": \"install\",\n  \"cacheHardTtlMinutes\": 10080,\n  \"cachePrivatePackages\": false,\n  \"cacheTtlOverride\": {},\n  \"checkedBranches\": [],\n  \"configValidationError\": false,\n  \"customEnvVariables\": {},\n  \"deleteAdditionalConfigFile\": false,\n  \"deleteConfigFile\": false,\n  \"detectGlobalManagerConfig\": false,\n  \"detectHostRulesFromEnv\": false,\n  \"dockerChildPrefix\": \"renovate_\",\n  \"dockerMaxPages\": 20,\n  \"dockerSidecarImage\": \"ghcr.io/renovatebot/base-image:13.166.3\",\n  \"dockerUser\": \"12021\",\n  \"executionTimeout\": 15,\n  \"exitCodeForErrors\": false,\n  \"exposeAllEnv\": false,\n  \"forceCli\": true,\n  \"forkCreation\": true,\n  \"githubTokenWarn\": true,\n  \"gitNoVerify\": [\n    \"commit\",\n    \"push\"\n  ],\n  \"gitTimeout\": 0,\n  \"gitUrl\": \"default\",\n  \"goEnvFromHostRules\": false,\n  \"httpCacheTtlDays\": 90,\n  \"ignorePrAuthor\": false,\n  \"includeMirrors\": false,\n  \"inheritConfig\": false,\n  \"inheritConfigFileName\": \"org-inherited-config.json\",\n  \"inheritConfigRepoName\": \"{{parentOrg}}/renovate-config\",\n  \"inheritConfigStrict\": false,\n  \"inheritConfigTrusted\": false,\n  \"internalHostAccess\": \"warn\",\n  \"mergeConfidenceDatasources\": [\n    \"go\",\n    \"maven\",\n    \"npm\",\n    \"nuget\",\n    \"packagist\",\n    \"pypi\",\n    \"rubygems\"\n  ],\n  \"mergeConfidenceEndpoint\": \"https://developer.mend.io/\",\n  \"migratePresets\": {},\n  \"onboardingBranch\": \"renovate/configure\",\n  \"onboardingConfig\": {\n    \"$schema\": \"https://docs.renovatebot.com/renovate-schema.json\"\n  },\n  \"onboardingConfigFileName\": \"renovate.json\",\n  \"onboardingNoDeps\": \"auto\",\n  \"onboardingPrTitle\": \"Configure Renovate\",\n  \"onboardingRebaseCheckbox\": false,\n  \"optimizeForDisabled\": false,\n  \"persistRepoData\": false,\n  \"platform\": \"github\",\n  \"prCacheSyncMaxPages\": 100,\n  \"prCommitsPerRunLimit\": 0,\n  \"presetCachePersistence\": false,\n  \"processEnv\": {},\n  \"productLinks\": {\n    \"documentation\": \"https://docs.renovatebot.com/\",\n    \"help\": \"https://github.com/renovatebot/renovate/discussions\",\n    \"homepage\": \"https://github.com/renovatebot/renovate\"\n  },\n  \"rebaseAllOpenBranches\": false,\n  \"reportFormatting\": false,\n  \"repositoryCache\": \"disabled\",\n  \"repositoryCacheForceLocal\": false,\n  \"repositoryCacheType\": \"local\",\n  \"requireConfig\": \"required\",\n  \"s3PathStyle\": false,\n  \"secrets\": {},\n  \"unicodeEmoji\": true,\n  \"useCloudMetadataServices\": true,\n  \"userAgent\": \"Renovate/{{renovateVersion}} (https://github.com/renovatebot/renovate)\",\n  \"variables\": {}\n};\n"],"mappings":";AACA,MAAa,6BAAsD;CACjE,iCAAiC;CACjC,mBAAmB,CAAC;CACpB,cAAc,CAAC;CACf,kBAAkB,CAChB,KACF;CACA,2BAA2B,CAAC;CAC5B,gBAAgB;CAChB,gBAAgB;CAChB,4CAA4C;CAC5C,gBAAgB;CAChB,0BAA0B;CAC1B,gBAAgB;CAChB,uBAAuB;CACvB,wBAAwB;CACxB,oBAAoB,CAAC;CACrB,mBAAmB,CAAC;CACpB,yBAAyB;CACzB,sBAAsB,CAAC;CACvB,8BAA8B;CAC9B,oBAAoB;CACpB,6BAA6B;CAC7B,0BAA0B;CAC1B,qBAAqB;CACrB,kBAAkB;CAClB,sBAAsB;CACtB,cAAc;CACd,oBAAoB;CACpB,qBAAqB;CACrB,gBAAgB;CAChB,YAAY;CACZ,gBAAgB;CAChB,mBAAmB;CACnB,eAAe,CACb,UACA,MACF;CACA,cAAc;CACd,UAAU;CACV,sBAAsB;CACtB,oBAAoB;CACpB,kBAAkB;CAClB,kBAAkB;CAClB,iBAAiB;CACjB,yBAAyB;CACzB,yBAAyB;CACzB,uBAAuB;CACvB,wBAAwB;CACxB,sBAAsB;CACtB,8BAA8B;EAC5B;EACA;EACA;EACA;EACA;EACA;EACA;CACF;CACA,2BAA2B;CAC3B,kBAAkB,CAAC;CACnB,oBAAoB;CACpB,oBAAoB,EAClB,WAAW,oDACb;CACA,4BAA4B;CAC5B,oBAAoB;CACpB,qBAAqB;CACrB,4BAA4B;CAC5B,uBAAuB;CACvB,mBAAmB;CACnB,YAAY;CACZ,uBAAuB;CACvB,wBAAwB;CACxB,0BAA0B;CAC1B,cAAc,CAAC;CACf,gBAAgB;EACd,iBAAiB;EACjB,QAAQ;EACR,YAAY;CACd;CACA,yBAAyB;CACzB,oBAAoB;CACpB,mBAAmB;CACnB,6BAA6B;CAC7B,uBAAuB;CACvB,iBAAiB;CACjB,eAAe;CACf,WAAW,CAAC;CACZ,gBAAgB;CAChB,4BAA4B;CAC5B,aAAa;CACb,aAAa,CAAC;AAChB"}

package/dist/modules/manager/cargo/artifacts.js

@@ -7,21 +7,24 @@ import { regEx } from "../../../util/regex.js";
 import { CrateDatasource } from "../../datasource/crate/index.js";
 import { artifactErrorResult, fileAddition, resolveToolConstraint, updateLockFile } from "../util.js";
 import { extractLockFileContentVersions } from "./locked-version.js";
+import { getMinPublishAgeEnv } from "./minimum-release-age.js";
+import { isNullOrUndefined } from "@sindresorhus/is";
 import { quote } from "shlex";
 // lib/modules/manager/cargo/artifacts.ts
 const gitExec = withGitEnvironment(["cargo", CrateDatasource.id]);
-async function cargoUpdate(manifestPath, isLockFileMaintenance, constraint) {
+async function cargoUpdate(manifestPath, isLockFileMaintenance, constraint, extraEnv) {
 	let cmd = `cargo update --config net.git-fetch-with-cli=true --manifest-path ${quote(manifestPath)}`;
 	if (!isLockFileMaintenance) cmd += ` --workspace`;
 	await gitExec(cmd, {
 		docker: {},
+		extraEnv,
 		toolConstraints: [{
 			toolName: "rust",
 			constraint
 		}]
 	});
 }
-async function cargoUpdatePrecise(manifestPath, updatedDeps, constraint) {
+async function cargoUpdatePrecise(manifestPath, updatedDeps, constraint, extraEnv) {
 	const cmds = [];
 	for (const dep of updatedDeps) {
 		if (dep.currentValue && dep.newValue && dep.currentValue !== dep.newValue) continue;
@@ -30,6 +33,7 @@ async function cargoUpdatePrecise(manifestPath, updatedDeps, constraint) {
 	cmds.push(`cargo update --config net.git-fetch-with-cli=true --manifest-path ${quote(manifestPath)} --workspace`);
 	await gitExec(cmds, {
 		docker: {},
+		extraEnv,
 		toolConstraints: [{
 			toolName: "rust",
 			constraint
@@ -39,7 +43,23 @@ async function cargoUpdatePrecise(manifestPath, updatedDeps, constraint) {
 async function updateArtifacts(updateArtifact) {
 	return await updateArtifactsImpl(updateArtifact);
 }
-async function updateArtifactsImpl({ packageFileName, updatedDeps, newPackageFileContent, config }, recursionLimit = 10) {
+/**
+* Adds `notice` to the results, which hold the lock file.
+*/
+function withNotice(results, lockFileName, notice) {
+	if (!notice || !results) return results;
+	return results.map(({ file }) => ({
+		file,
+		notice: {
+			file: lockFileName,
+			message: notice
+		}
+	}));
+}
+/**
+* @param inheritedMinPublishAge The minimum publish age of a failed attempt, which has already updated crates of the lock file with it.
+*/
+async function updateArtifactsImpl({ packageFileName, updatedDeps, newPackageFileContent, config }, recursionLimit = 10, inheritedMinPublishAge) {
 	logger.debug(`cargo.updateArtifacts(${packageFileName})`);
 	const lockFileName = await findLocalSiblingOrParent(packageFileName, "Cargo.lock");
 	let existingLockFileContent = null;
@@ -51,11 +71,20 @@ async function updateArtifactsImpl({ packageFileName, updatedDeps, newPackageFil
 	const { isLockFileMaintenance } = config;
 	if (!isLockFileMaintenance && !updatedDeps?.length) {
 		logger.debug("No more dependencies to update");
-		return [fileAddition(lockFileName, existingLockFileContent)];
+		return withNotice([fileAddition(lockFileName, existingLockFileContent)], lockFileName, inheritedMinPublishAge?.notice);
 	}
 	const rustConstraint = await resolveToolConstraint(config, "rust");
+	let minPublishAge = inheritedMinPublishAge;
+	if (isNullOrUndefined(minPublishAge)) minPublishAge = await getMinPublishAgeEnv({
+		config,
+		manager: "cargo",
+		packageFile: packageFileName,
+		upgrades: updatedDeps,
+		rustConstraint
+	});
+	const { env: extraEnv, notice } = minPublishAge;
 	try {
-		return await updateLockFile({
+		return withNotice(await updateLockFile({
 			lockFileName,
 			existingLockFileContent,
 			packageFile: {
@@ -65,7 +94,7 @@ async function updateArtifactsImpl({ packageFileName, updatedDeps, newPackageFil
 			run: async () => {
 				logger.debug(`Updating ${lockFileName}`);
 				if (isLockFileMaintenance) {
-					await cargoUpdate(packageFileName, true, rustConstraint);
+					await cargoUpdate(packageFileName, true, rustConstraint, extraEnv);
 					return;
 				}
 				const hasNonCrateDep = updatedDeps.some((dep) => dep.datasource !== CrateDatasource.id);
@@ -73,10 +102,10 @@ async function updateArtifactsImpl({ packageFileName, updatedDeps, newPackageFil
 				if (hasNonCrateDep || crateDepWithoutLockedVersion) {
 					// v8 ignore else -- needs a workspace update driven only by a non-crate dep
 					if (crateDepWithoutLockedVersion) logger.warn({ dependency: crateDepWithoutLockedVersion.depName }, "Missing locked version for dependency");
-					await cargoUpdate(packageFileName, false, rustConstraint);
-				} else await cargoUpdatePrecise(packageFileName, updatedDeps, rustConstraint);
+					await cargoUpdate(packageFileName, false, rustConstraint, extraEnv);
+				} else await cargoUpdatePrecise(packageFileName, updatedDeps, rustConstraint, extraEnv);
 			}
-		});
+		}), lockFileName, notice);
 	} catch (err) {
 		// istanbul ignore if
 		if (err.message === "temporary-error") throw err;
@@ -92,7 +121,7 @@ async function updateArtifactsImpl({ packageFileName, updatedDeps, newPackageFil
 					updatedDeps: newUpdatedDeps,
 					newPackageFileContent,
 					config
-				}, recursionLimit - 1);
+				}, recursionLimit - 1, minPublishAge);
 			}
 		}
 		logger.debug({ err }, "Failed to update Cargo lock file");

package/dist/modules/manager/cargo/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/cargo/artifacts.ts"],"sourcesContent":["import { quote } from 'shlex';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  findLocalSiblingOrParent,\n  readLocalFile,\n} from '../../../util/fs/index.ts';\nimport { withGitEnvironment } from '../../../util/git/exec.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { CrateDatasource } from '../../datasource/crate/index.ts';\nimport type {\n  UpdateArtifact,\n  UpdateArtifactsResult,\n  Upgrade,\n} from '../types.ts';\nimport {\n  artifactErrorResult,\n  fileAddition,\n  resolveToolConstraint,\n  updateLockFile,\n} from '../util.ts';\nimport { extractLockFileContentVersions } from './locked-version.ts';\n\nconst gitExec = withGitEnvironment(['cargo', CrateDatasource.id]);\n\nasync function cargoUpdate(\n  manifestPath: string,\n  isLockFileMaintenance: boolean,\n  constraint: string | undefined,\n): Promise<void> {\n  let cmd = `cargo update --config net.git-fetch-with-cli=true --manifest-path ${quote(\n    manifestPath,\n  )}`;\n  // If we're updating a specific crate, `cargo-update` requires `--workspace`\n  // for more information, see: https://github.com/renovatebot/renovate/issues/12332\n  if (!isLockFileMaintenance) {\n    cmd += ` --workspace`;\n  }\n\n  const execOptions: ExecOptions = {\n    docker: {},\n    toolConstraints: [{ toolName: 'rust', constraint }],\n  };\n  await gitExec(cmd, execOptions);\n}\n\nasync function cargoUpdatePrecise(\n  manifestPath: string,\n  updatedDeps: Upgrade[],\n  constraint: string | undefined,\n): Promise<void> {\n  const cmds = [];\n\n  // First update individual dependencies to their `newVersion`. Necessary when\n  // using the `update-lockfile` rangeStrategy which doesn't touch Cargo.toml.\n  for (const dep of updatedDeps) {\n    // If the range is bumped in Cargo.toml, the old lockedVersion may no longer\n    // exist in Cargo's dependency graph, so let the --workspace update at the\n    // end re-resolve it instead.\n    if (dep.currentValue && dep.newValue && dep.currentValue !== dep.newValue) {\n      continue;\n    }\n\n    cmds.push(\n      `cargo update --config net.git-fetch-with-cli=true` +\n        ` --manifest-path ${quote(manifestPath)}` +\n        ` --package ${quote(`${dep.packageName}@${dep.lockedVersion}`)}` +\n        ` --precise ${quote(dep.newVersion!)}`,\n    );\n  }\n\n  // Then update all dependencies that have been bumped in `Cargo.toml`.\n  cmds.push(\n    `cargo update --config net.git-fetch-with-cli=true --manifest-path ${quote(manifestPath)} --workspace`,\n  );\n\n  const execOptions: ExecOptions = {\n    docker: {},\n    toolConstraints: [{ toolName: 'rust', constraint }],\n  };\n\n  await gitExec(cmds, execOptions);\n}\n\nexport async function updateArtifacts(\n  updateArtifact: UpdateArtifact,\n): Promise<UpdateArtifactsResult[] | null> {\n  return await updateArtifactsImpl(updateArtifact);\n}\n\nasync function updateArtifactsImpl(\n  {\n    packageFileName,\n    updatedDeps,\n    newPackageFileContent,\n    config,\n  }: UpdateArtifact,\n  recursionLimit = 10,\n): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`cargo.updateArtifacts(${packageFileName})`);\n\n  // For standalone package crates, the `Cargo.lock` will be in the same\n  // directory as `Cargo.toml` (ie. a sibling). For cargo workspaces, it\n  // will be further up.\n  const lockFileName = await findLocalSiblingOrParent(\n    packageFileName,\n    'Cargo.lock',\n  );\n  let existingLockFileContent: string | null = null;\n  if (lockFileName) {\n    existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  }\n  if (!existingLockFileContent || !lockFileName) {\n    logger.debug('No Cargo.lock found');\n    return null;\n  }\n\n  const { isLockFileMaintenance } = config;\n  if (!isLockFileMaintenance && !updatedDeps?.length) {\n    logger.debug('No more dependencies to update');\n    return [fileAddition(lockFileName, existingLockFileContent)];\n  }\n\n  const rustConstraint = await resolveToolConstraint(config, 'rust');\n\n  try {\n    return await updateLockFile({\n      lockFileName,\n      existingLockFileContent,\n      packageFile: { path: packageFileName, contents: newPackageFileContent },\n      run: async () => {\n        logger.debug(`Updating ${lockFileName}`);\n\n        if (isLockFileMaintenance) {\n          await cargoUpdate(packageFileName, true, rustConstraint);\n          return;\n        }\n\n        const hasNonCrateDep = updatedDeps.some(\n          (dep) => dep.datasource !== CrateDatasource.id,\n        );\n        const crateDepWithoutLockedVersion = updatedDeps.find(\n          (dep) => !dep.lockedVersion && dep.datasource === CrateDatasource.id,\n        );\n        // Non-crate dependencies (like git ones) do not have locked versions.\n        // For crate dependencies, a locked version is expected.\n        // In both situations, perform a regular workspace lockfile update.\n        if (hasNonCrateDep || crateDepWithoutLockedVersion) {\n          // v8 ignore else -- needs a workspace update driven only by a non-crate dep\n          if (crateDepWithoutLockedVersion) {\n            // Only warn when a crate dependency has no locked version\n            logger.warn(\n              { dependency: crateDepWithoutLockedVersion.depName },\n              'Missing locked version for dependency',\n            );\n          }\n          await cargoUpdate(packageFileName, false, rustConstraint);\n        } else {\n          // If all dependencies have locked versions then update them precisely.\n          await cargoUpdatePrecise(\n            packageFileName,\n            updatedDeps,\n            rustConstraint,\n          );\n        }\n      },\n    });\n  } catch (err) {\n    // istanbul ignore if\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n\n    // Sometimes `cargo update` will fail when a preceding dependency update\n    // causes another dependency to update. In this case we can no longer\n    // reference the dependency by its old version, so we filter it out\n    // and retry recursively.\n    const newCargoLockContent = await readLocalFile(lockFileName, 'utf8');\n    if (\n      recursionLimit > 0 &&\n      newCargoLockContent &&\n      regEx(/error: package ID specification/).test(err.stderr)\n    ) {\n      const versions = extractLockFileContentVersions(newCargoLockContent);\n      const newUpdatedDeps = updatedDeps.filter(\n        (dep) =>\n          !coerceArray(versions?.get(dep.packageName!)).includes(\n            dep.newVersion!,\n          ),\n      );\n\n      // v8 ignore else -- this retry only runs when a dep was already current\n      if (newUpdatedDeps.length < updatedDeps.length) {\n        logger.debug(\n          'Dependency already up to date - reattempting recursively',\n        );\n        return updateArtifactsImpl(\n          {\n            packageFileName,\n            updatedDeps: newUpdatedDeps,\n            newPackageFileContent,\n            config,\n          },\n          recursionLimit - 1,\n        );\n      }\n    }\n\n    logger.debug({ err }, 'Failed to update Cargo lock file');\n\n    return artifactErrorResult(lockFileName, err);\n  }\n}\n"],"mappings":";;;;;;;;;;;AAyBA,MAAM,UAAU,mBAAmB,CAAC,SAAS,gBAAgB,EAAE,CAAC;AAEhE,eAAe,YACb,cACA,uBACA,YACe;CACf,IAAI,MAAM,qEAAqE,MAC7E,YACF;CAGA,IAAI,CAAC,uBACH,OAAO;CAOT,MAAM,QAAQ,KAAK;EAHjB,QAAQ,CAAC;EACT,iBAAiB,CAAC;GAAE,UAAU;GAAQ;EAAW,CAAC;CAEvB,CAAC;AAChC;AAEA,eAAe,mBACb,cACA,aACA,YACe;CACf,MAAM,OAAO,CAAC;CAId,KAAK,MAAM,OAAO,aAAa;EAI7B,IAAI,IAAI,gBAAgB,IAAI,YAAY,IAAI,iBAAiB,IAAI,UAC/D;EAGF,KAAK,KACH,qEACsB,MAAM,YAAY,EAAA,aACxB,MAAM,GAAG,IAAI,YAAY,GAAG,IAAI,eAAe,EAAA,aAC/C,MAAM,IAAI,UAAW,GACvC;CACF;CAGA,KAAK,KACH,qEAAqE,MAAM,YAAY,EAAE,aAC3F;CAOA,MAAM,QAAQ,MAAM;EAJlB,QAAQ,CAAC;EACT,iBAAiB,CAAC;GAAE,UAAU;GAAQ;EAAW,CAAC;CAGtB,CAAC;AACjC;AAEA,eAAsB,gBACpB,gBACyC;CACzC,OAAO,MAAM,oBAAoB,cAAc;AACjD;AAEA,eAAe,oBACb,EACE,iBACA,aACA,uBACA,UAEF,iBAAiB,IACwB;CACzC,OAAO,MAAM,yBAAyB,gBAAgB,EAAE;CAKxD,MAAM,eAAe,MAAM,yBACzB,iBACA,YACF;CACA,IAAI,0BAAyC;CAC7C,IAAI,cACF,0BAA0B,MAAM,cAAc,cAAc,MAAM;CAEpE,IAAI,CAAC,2BAA2B,CAAC,cAAc;EAC7C,OAAO,MAAM,qBAAqB;EAClC,OAAO;CACT;CAEA,MAAM,EAAE,0BAA0B;CAClC,IAAI,CAAC,yBAAyB,CAAC,aAAa,QAAQ;EAClD,OAAO,MAAM,gCAAgC;EAC7C,OAAO,CAAC,aAAa,cAAc,uBAAuB,CAAC;CAC7D;CAEA,MAAM,iBAAiB,MAAM,sBAAsB,QAAQ,MAAM;CAEjE,IAAI;EACF,OAAO,MAAM,eAAe;GAC1B;GACA;GACA,aAAa;IAAE,MAAM;IAAiB,UAAU;GAAsB;GACtE,KAAK,YAAY;IACf,OAAO,MAAM,YAAY,cAAc;IAEvC,IAAI,uBAAuB;KACzB,MAAM,YAAY,iBAAiB,MAAM,cAAc;KACvD;IACF;IAEA,MAAM,iBAAiB,YAAY,MAChC,QAAQ,IAAI,eAAe,gBAAgB,EAC9C;IACA,MAAM,+BAA+B,YAAY,MAC9C,QAAQ,CAAC,IAAI,iBAAiB,IAAI,eAAe,gBAAgB,EACpE;IAIA,IAAI,kBAAkB,8BAA8B;;KAElD,IAAI,8BAEF,OAAO,KACL,EAAE,YAAY,6BAA6B,QAAQ,GACnD,uCACF;KAEF,MAAM,YAAY,iBAAiB,OAAO,cAAc;IAC1D,OAEE,MAAM,mBACJ,iBACA,aACA,cACF;GAEJ;EACF,CAAC;CACH,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAOR,MAAM,sBAAsB,MAAM,cAAc,cAAc,MAAM;EACpE,IACE,iBAAiB,KACjB,uBACA,MAAM,iCAAiC,CAAC,CAAC,KAAK,IAAI,MAAM,GACxD;GACA,MAAM,WAAW,+BAA+B,mBAAmB;GACnE,MAAM,iBAAiB,YAAY,QAChC,QACC,CAAC,YAAY,UAAU,IAAI,IAAI,WAAY,CAAC,CAAC,CAAC,SAC5C,IAAI,UACN,CACJ;;GAGA,IAAI,eAAe,SAAS,YAAY,QAAQ;IAC9C,OAAO,MACL,0DACF;IACA,OAAO,oBACL;KACE;KACA,aAAa;KACb;KACA;IACF,GACA,iBAAiB,CACnB;GACF;EACF;EAEA,OAAO,MAAM,EAAE,IAAI,GAAG,kCAAkC;EAExD,OAAO,oBAAoB,cAAc,GAAG;CAC9C;AACF"}
+{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/cargo/artifacts.ts"],"sourcesContent":["import { isNullOrUndefined } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  findLocalSiblingOrParent,\n  readLocalFile,\n} from '../../../util/fs/index.ts';\nimport { withGitEnvironment } from '../../../util/git/exec.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { CrateDatasource } from '../../datasource/crate/index.ts';\nimport type {\n  UpdateArtifact,\n  UpdateArtifactsResult,\n  Upgrade,\n} from '../types.ts';\nimport {\n  artifactErrorResult,\n  fileAddition,\n  resolveToolConstraint,\n  updateLockFile,\n} from '../util.ts';\nimport { extractLockFileContentVersions } from './locked-version.ts';\nimport { getMinPublishAgeEnv } from './minimum-release-age.ts';\nimport type { CargoManagerData, MinPublishAgeEnv } from './types.ts';\n\nconst gitExec = withGitEnvironment(['cargo', CrateDatasource.id]);\n\nasync function cargoUpdate(\n  manifestPath: string,\n  isLockFileMaintenance: boolean,\n  constraint: string | undefined,\n  extraEnv: Record<string, string>,\n): Promise<void> {\n  let cmd = `cargo update --config net.git-fetch-with-cli=true --manifest-path ${quote(\n    manifestPath,\n  )}`;\n  // If we're updating a specific crate, `cargo-update` requires `--workspace`\n  // for more information, see: https://github.com/renovatebot/renovate/issues/12332\n  if (!isLockFileMaintenance) {\n    cmd += ` --workspace`;\n  }\n\n  const execOptions: ExecOptions = {\n    docker: {},\n    extraEnv,\n    toolConstraints: [{ toolName: 'rust', constraint }],\n  };\n  await gitExec(cmd, execOptions);\n}\n\nasync function cargoUpdatePrecise(\n  manifestPath: string,\n  updatedDeps: Upgrade[],\n  constraint: string | undefined,\n  extraEnv: Record<string, string>,\n): Promise<void> {\n  const cmds = [];\n\n  // First update individual dependencies to their `newVersion`. Necessary when\n  // using the `update-lockfile` rangeStrategy which doesn't touch Cargo.toml.\n  for (const dep of updatedDeps) {\n    // If the range is bumped in Cargo.toml, the old lockedVersion may no longer\n    // exist in Cargo's dependency graph, so let the --workspace update at the\n    // end re-resolve it instead.\n    if (dep.currentValue && dep.newValue && dep.currentValue !== dep.newValue) {\n      continue;\n    }\n\n    cmds.push(\n      `cargo update --config net.git-fetch-with-cli=true` +\n        ` --manifest-path ${quote(manifestPath)}` +\n        ` --package ${quote(`${dep.packageName}@${dep.lockedVersion}`)}` +\n        ` --precise ${quote(dep.newVersion!)}`,\n    );\n  }\n\n  // Then update all dependencies that have been bumped in `Cargo.toml`.\n  cmds.push(\n    `cargo update --config net.git-fetch-with-cli=true --manifest-path ${quote(manifestPath)} --workspace`,\n  );\n\n  const execOptions: ExecOptions = {\n    docker: {},\n    extraEnv,\n    toolConstraints: [{ toolName: 'rust', constraint }],\n  };\n\n  await gitExec(cmds, execOptions);\n}\n\nexport async function updateArtifacts(\n  updateArtifact: UpdateArtifact<CargoManagerData>,\n): Promise<UpdateArtifactsResult[] | null> {\n  return await updateArtifactsImpl(updateArtifact);\n}\n\n/**\n * Adds `notice` to the results, which hold the lock file.\n */\nfunction withNotice(\n  results: UpdateArtifactsResult[] | null,\n  lockFileName: string,\n  notice: string | undefined,\n): UpdateArtifactsResult[] | null {\n  if (!notice || !results) {\n    return results;\n  }\n  return results.map(({ file }) => ({\n    file,\n    notice: { file: lockFileName, message: notice },\n  }));\n}\n\n/**\n * @param inheritedMinPublishAge The minimum publish age of a failed attempt, which has already updated crates of the lock file with it.\n */\nasync function updateArtifactsImpl(\n  {\n    packageFileName,\n    updatedDeps,\n    newPackageFileContent,\n    config,\n  }: UpdateArtifact<CargoManagerData>,\n  recursionLimit = 10,\n  inheritedMinPublishAge?: MinPublishAgeEnv,\n): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`cargo.updateArtifacts(${packageFileName})`);\n\n  // For standalone package crates, the `Cargo.lock` will be in the same\n  // directory as `Cargo.toml` (ie. a sibling). For cargo workspaces, it\n  // will be further up.\n  const lockFileName = await findLocalSiblingOrParent(\n    packageFileName,\n    'Cargo.lock',\n  );\n  let existingLockFileContent: string | null = null;\n  if (lockFileName) {\n    existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  }\n  if (!existingLockFileContent || !lockFileName) {\n    logger.debug('No Cargo.lock found');\n    return null;\n  }\n\n  const { isLockFileMaintenance } = config;\n  if (!isLockFileMaintenance && !updatedDeps?.length) {\n    logger.debug('No more dependencies to update');\n    return withNotice(\n      [fileAddition(lockFileName, existingLockFileContent)],\n      lockFileName,\n      inheritedMinPublishAge?.notice,\n    );\n  }\n\n  const rustConstraint = await resolveToolConstraint(config, 'rust');\n  let minPublishAge = inheritedMinPublishAge;\n  if (isNullOrUndefined(minPublishAge)) {\n    minPublishAge = await getMinPublishAgeEnv({\n      config,\n      manager: 'cargo',\n      packageFile: packageFileName,\n      upgrades: updatedDeps,\n      rustConstraint,\n    });\n  }\n  const { env: extraEnv, notice } = minPublishAge;\n\n  try {\n    const results = await updateLockFile({\n      lockFileName,\n      existingLockFileContent,\n      packageFile: { path: packageFileName, contents: newPackageFileContent },\n      run: async () => {\n        logger.debug(`Updating ${lockFileName}`);\n\n        if (isLockFileMaintenance) {\n          await cargoUpdate(packageFileName, true, rustConstraint, extraEnv);\n          return;\n        }\n\n        const hasNonCrateDep = updatedDeps.some(\n          (dep) => dep.datasource !== CrateDatasource.id,\n        );\n        const crateDepWithoutLockedVersion = updatedDeps.find(\n          (dep) => !dep.lockedVersion && dep.datasource === CrateDatasource.id,\n        );\n        // Non-crate dependencies (like git ones) do not have locked versions.\n        // For crate dependencies, a locked version is expected.\n        // In both situations, perform a regular workspace lockfile update.\n        if (hasNonCrateDep || crateDepWithoutLockedVersion) {\n          // v8 ignore else -- needs a workspace update driven only by a non-crate dep\n          if (crateDepWithoutLockedVersion) {\n            // Only warn when a crate dependency has no locked version\n            logger.warn(\n              { dependency: crateDepWithoutLockedVersion.depName },\n              'Missing locked version for dependency',\n            );\n          }\n          await cargoUpdate(packageFileName, false, rustConstraint, extraEnv);\n        } else {\n          // If all dependencies have locked versions then update them precisely.\n          await cargoUpdatePrecise(\n            packageFileName,\n            updatedDeps,\n            rustConstraint,\n            extraEnv,\n          );\n        }\n      },\n    });\n    return withNotice(results, lockFileName, notice);\n  } catch (err) {\n    // istanbul ignore if\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n\n    // Sometimes `cargo update` will fail when a preceding dependency update\n    // causes another dependency to update. In this case we can no longer\n    // reference the dependency by its old version, so we filter it out\n    // and retry recursively.\n    const newCargoLockContent = await readLocalFile(lockFileName, 'utf8');\n    if (\n      recursionLimit > 0 &&\n      newCargoLockContent &&\n      regEx(/error: package ID specification/).test(err.stderr)\n    ) {\n      const versions = extractLockFileContentVersions(newCargoLockContent);\n      const newUpdatedDeps = updatedDeps.filter(\n        (dep) =>\n          !coerceArray(versions?.get(dep.packageName!)).includes(\n            dep.newVersion!,\n          ),\n      );\n\n      // v8 ignore else -- this retry only runs when a dep was already current\n      if (newUpdatedDeps.length < updatedDeps.length) {\n        logger.debug(\n          'Dependency already up to date - reattempting recursively',\n        );\n        return updateArtifactsImpl(\n          {\n            packageFileName,\n            updatedDeps: newUpdatedDeps,\n            newPackageFileContent,\n            config,\n          },\n          recursionLimit - 1,\n          minPublishAge,\n        );\n      }\n    }\n\n    logger.debug({ err }, 'Failed to update Cargo lock file');\n\n    return artifactErrorResult(lockFileName, err);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AA4BA,MAAM,UAAU,mBAAmB,CAAC,SAAS,gBAAgB,EAAE,CAAC;AAEhE,eAAe,YACb,cACA,uBACA,YACA,UACe;CACf,IAAI,MAAM,qEAAqE,MAC7E,YACF;CAGA,IAAI,CAAC,uBACH,OAAO;CAQT,MAAM,QAAQ,KAAK;EAJjB,QAAQ,CAAC;EACT;EACA,iBAAiB,CAAC;GAAE,UAAU;GAAQ;EAAW,CAAC;CAEvB,CAAC;AAChC;AAEA,eAAe,mBACb,cACA,aACA,YACA,UACe;CACf,MAAM,OAAO,CAAC;CAId,KAAK,MAAM,OAAO,aAAa;EAI7B,IAAI,IAAI,gBAAgB,IAAI,YAAY,IAAI,iBAAiB,IAAI,UAC/D;EAGF,KAAK,KACH,qEACsB,MAAM,YAAY,EAAA,aACxB,MAAM,GAAG,IAAI,YAAY,GAAG,IAAI,eAAe,EAAA,aAC/C,MAAM,IAAI,UAAW,GACvC;CACF;CAGA,KAAK,KACH,qEAAqE,MAAM,YAAY,EAAE,aAC3F;CAQA,MAAM,QAAQ,MAAM;EALlB,QAAQ,CAAC;EACT;EACA,iBAAiB,CAAC;GAAE,UAAU;GAAQ;EAAW,CAAC;CAGtB,CAAC;AACjC;AAEA,eAAsB,gBACpB,gBACyC;CACzC,OAAO,MAAM,oBAAoB,cAAc;AACjD;;;;AAKA,SAAS,WACP,SACA,cACA,QACgC;CAChC,IAAI,CAAC,UAAU,CAAC,SACd,OAAO;CAET,OAAO,QAAQ,KAAK,EAAE,YAAY;EAChC;EACA,QAAQ;GAAE,MAAM;GAAc,SAAS;EAAO;CAChD,EAAE;AACJ;;;;AAKA,eAAe,oBACb,EACE,iBACA,aACA,uBACA,UAEF,iBAAiB,IACjB,wBACyC;CACzC,OAAO,MAAM,yBAAyB,gBAAgB,EAAE;CAKxD,MAAM,eAAe,MAAM,yBACzB,iBACA,YACF;CACA,IAAI,0BAAyC;CAC7C,IAAI,cACF,0BAA0B,MAAM,cAAc,cAAc,MAAM;CAEpE,IAAI,CAAC,2BAA2B,CAAC,cAAc;EAC7C,OAAO,MAAM,qBAAqB;EAClC,OAAO;CACT;CAEA,MAAM,EAAE,0BAA0B;CAClC,IAAI,CAAC,yBAAyB,CAAC,aAAa,QAAQ;EAClD,OAAO,MAAM,gCAAgC;EAC7C,OAAO,WACL,CAAC,aAAa,cAAc,uBAAuB,CAAC,GACpD,cACA,wBAAwB,MAC1B;CACF;CAEA,MAAM,iBAAiB,MAAM,sBAAsB,QAAQ,MAAM;CACjE,IAAI,gBAAgB;CACpB,IAAI,kBAAkB,aAAa,GACjC,gBAAgB,MAAM,oBAAoB;EACxC;EACA,SAAS;EACT,aAAa;EACb,UAAU;EACV;CACF,CAAC;CAEH,MAAM,EAAE,KAAK,UAAU,WAAW;CAElC,IAAI;EA2CF,OAAO,WAAW,MA1CI,eAAe;GACnC;GACA;GACA,aAAa;IAAE,MAAM;IAAiB,UAAU;GAAsB;GACtE,KAAK,YAAY;IACf,OAAO,MAAM,YAAY,cAAc;IAEvC,IAAI,uBAAuB;KACzB,MAAM,YAAY,iBAAiB,MAAM,gBAAgB,QAAQ;KACjE;IACF;IAEA,MAAM,iBAAiB,YAAY,MAChC,QAAQ,IAAI,eAAe,gBAAgB,EAC9C;IACA,MAAM,+BAA+B,YAAY,MAC9C,QAAQ,CAAC,IAAI,iBAAiB,IAAI,eAAe,gBAAgB,EACpE;IAIA,IAAI,kBAAkB,8BAA8B;;KAElD,IAAI,8BAEF,OAAO,KACL,EAAE,YAAY,6BAA6B,QAAQ,GACnD,uCACF;KAEF,MAAM,YAAY,iBAAiB,OAAO,gBAAgB,QAAQ;IACpE,OAEE,MAAM,mBACJ,iBACA,aACA,gBACA,QACF;GAEJ;EACF,CAAC,GAC0B,cAAc,MAAM;CACjD,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAOR,MAAM,sBAAsB,MAAM,cAAc,cAAc,MAAM;EACpE,IACE,iBAAiB,KACjB,uBACA,MAAM,iCAAiC,CAAC,CAAC,KAAK,IAAI,MAAM,GACxD;GACA,MAAM,WAAW,+BAA+B,mBAAmB;GACnE,MAAM,iBAAiB,YAAY,QAChC,QACC,CAAC,YAAY,UAAU,IAAI,IAAI,WAAY,CAAC,CAAC,CAAC,SAC5C,IAAI,UACN,CACJ;;GAGA,IAAI,eAAe,SAAS,YAAY,QAAQ;IAC9C,OAAO,MACL,0DACF;IACA,OAAO,oBACL;KACE;KACA,aAAa;KACb;KACA;IACF,GACA,iBAAiB,GACjB,aACF;GACF;EACF;EAEA,OAAO,MAAM,EAAE,IAAI,GAAG,kCAAkC;EAExD,OAAO,oBAAoB,cAAc,GAAG;CAC9C;AACF"}