npm - renovate - Versions diffs - 44.37.1 → 44.38.0 - Mend

renovate 44.37.1 → 44.38.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/dist/manager-default-configs.generated.js CHANGED Viewed

@@ -92,7 +92,11 @@ const managerDefaultConfigs = {
 		"versioning": "maven"
 	},
 	"devbox": { "managerFilePatterns": ["/(^|/)devbox\\.json$/"] },
-	"devcontainer": { "managerFilePatterns": ["/^.devcontainer/devcontainer.json$/", "/^.devcontainer.json$/"] },
+	"devcontainer": { "managerFilePatterns": [
+		"/^.devcontainer/devcontainer.json$/",
+		"/^.devcontainer.json$/",
+		"/^.devcontainer/[^/]+/devcontainer.json$/"
+	] },
 	"docker-compose": { "managerFilePatterns": ["/(^|/)(?:docker-)?compose[^/]*\\.ya?ml$/"] },
 	"dockerfile": { "managerFilePatterns": ["/(^|/|\\.)([Dd]ocker|[Cc]ontainer)file$/", "/(^|/)([Dd]ocker|[Cc]ontainer)file[^/]*$/"] },
 	"droneci": { "managerFilePatterns": ["/(^|/)\\.drone\\.yml$/"] },

package/dist/manager-default-configs.generated.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"manager-default-configs.generated.js","names":[],"sources":["../lib/manager-default-configs.generated.ts"],"sourcesContent":["\nexport const managerDefaultConfigs: Record<string, Record<string, unknown>> = {\n \"ant\": {\n \"managerFilePatterns\": [\n \"*/build.xml\"\n ]\n },\n \"ansible\": {\n \"managerFilePatterns\": [\n \"/(^\|/)tasks/[^/]+\\\\.ya?ml$/\"\n ]\n },\n \"ansible-galaxy\": {\n \"managerFilePatterns\": [\n \"/(^\|/)(galaxy\|requirements)(\\\\.ansible)?\\\\.ya?ml$/\"\n ]\n },\n \"argocd\": {\n \"managerFilePatterns\": []\n },\n \"asdf\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.tool-versions$/\"\n ]\n },\n \"azure-pipelines\": {\n \"managerFilePatterns\": [\n \"/(^\|/).azuredevops/.+\\\\.ya?ml$/\",\n \"/azure.pipelines?.\\\\.ya?ml$/\"\n ],\n \"enabled\": false\n },\n \"batect\": {\n \"managerFilePatterns\": [\n \"/(^\|/)batect(-bundle)?\\\\.ya?ml$/\"\n ]\n },\n \"batect-wrapper\": {\n \"managerFilePatterns\": [\n \"/(^\|/)batect$/\"\n ],\n \"versioning\": \"semver\"\n },\n \"bazel\": {\n \"managerFilePatterns\": [\n \"/(^\|/)WORKSPACE(\|\\\\.bazel\|\\\\.bzlmod)$/\",\n \"/\\\\.WORKSPACE\\\\.bazel$/\",\n \"/\\\\.bzl$/\"\n ]\n },\n \"bazel-module\": {\n \"managerFilePatterns\": [\n \"/(^\|/\|\\\\.)MODULE\\\\.bazel$/\"\n ]\n },\n \"bazelisk\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.bazelversion$/\"\n ],\n \"pinDigests\": false,\n \"versioning\": \"semver\"\n },\n \"bicep\": {\n \"managerFilePatterns\": [\n \"/\\\\.bicep$/\"\n ]\n },\n \"bitbucket-pipelines\": {\n \"managerFilePatterns\": [\n \"/-pipelines.yml\"\n ]\n },\n \"bitrise\": {\n \"managerFilePatterns\": [\n \"/(^\|/)bitrise\\\\.ya?ml$/\"\n ]\n },\n \"buildkite\": {\n \"managerFilePatterns\": [\n \"/buildkite\\\\.ya?ml/\",\n \"/\\\\.buildkite/.+\\\\.ya?ml$/\"\n ],\n \"commitMessageTopic\": \"buildkite plugin {{depName}}\",\n \"commitMessageExtra\": \"to {{#if isMajor}}{{{prettyNewMajor}}}{{else}}{{{newValue}}}{{/if}}\"\n },\n \"buildpacks\": {\n \"commitMessageTopic\": \"buildpack {{depName}}\",\n \"managerFilePatterns\": [\n \"/(^\|/)project\\\\.toml$/\"\n ],\n \"pinDigests\": false\n },\n \"bun\": {\n \"managerFilePatterns\": [\n \"/(^\|/)bun\\\\.lockb?$/\",\n \"/(^\|/)package\\\\.json$/\"\n ],\n \"digest\": {\n \"prBodyDefinitions\": {\n \"Change\": \"{{#if displayFrom}}`{{{displayFrom}}}` → {{else}}{{#if currentValue}}`{{{currentValue}}}` → {{/if}}{{/if}}{{#if displayTo}}`{{{displayTo}}}`{{else}}`{{{newValue}}}`{{/if}}\"\n }\n },\n \"prBodyDefinitions\": {\n \"Change\": \"[{{#if displayFrom}}`{{{displayFrom}}}` → {{else}}{{#if currentValue}}`{{{currentValue}}}` → {{/if}}{{/if}}{{#if displayTo}}`{{{displayTo}}}`{{else}}`{{{newValue}}}`{{/if}}]({{#if depName}}https://renovatebot.com/diffs/npm/{{replace '/' '%2f' depName}}/{{{currentVersion}}}/{{{newVersion}}}{{/if}})\"\n }\n },\n \"bun-version\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.bun-version$/\"\n ],\n \"versioning\": \"npm\"\n },\n \"bundler\": {\n \"managerFilePatterns\": [\n \"/(^\|/)Gemfile$/\"\n ],\n \"versioning\": \"ruby\"\n },\n \"cake\": {\n \"managerFilePatterns\": [\n \"/\\\\.cake$/\"\n ]\n },\n \"cargo\": {\n \"commitMessageTopic\": \"Rust crate {{depName}}\",\n \"managerFilePatterns\": [\n \"/(^\|/)Cargo\\\\.toml$/\"\n ]\n },\n \"cdnurl\": {\n \"managerFilePatterns\": [],\n \"versioning\": \"semver\"\n },\n \"circleci\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.circleci/.+\\\\.ya?ml$/\"\n ]\n },\n \"cloudbuild\": {\n \"managerFilePatterns\": [\n \"/(^\|/)cloudbuild\\\\.ya?ml/\"\n ]\n },\n \"cocoapods\": {\n \"managerFilePatterns\": [\n \"/(^\|/)Podfile$/\"\n ],\n \"versioning\": \"ruby\"\n },\n \"composer\": {\n \"managerFilePatterns\": [\n \"/(^\|/)([\\\\w-])composer\\\\.json$/\"\n ],\n \"versioning\": \"composer\"\n },\n \"conan\": {\n \"managerFilePatterns\": [\n \"/(^\|/)conanfile\\\\.(txt\|py)$/\"\n ],\n \"datasource\": \"conan\",\n \"versioning\": \"conan\"\n },\n \"copier\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.copier-answers(\\\\..+)?\\\\.ya?ml/\"\n ],\n \"versioning\": \"pep440\"\n },\n \"cpanfile\": {\n \"managerFilePatterns\": [\n \"/(^\|/)cpanfile$/\"\n ]\n },\n \"crossplane\": {\n \"managerFilePatterns\": []\n },\n \"crow\": {\n \"managerFilePatterns\": [\n \"/^\\\\.crow(?:/[^/]+)?\\\\.ya?ml$/\"\n ]\n },\n \"deno\": {\n \"managerFilePatterns\": [\n \"/(^\|/)deno\\\\.lock$/\",\n \"/(^\|/)deno\\\\.(json\|jsonc)$/\"\n ],\n \"digest\": {\n \"prBodyDefinitions\": {\n \"Change\": \"{{#if displayFrom}}`{{{displayFrom}}}` -> {{else}}{{#if currentValue}}`{{{currentValue}}}` -> {{/if}}{{/if}}{{#if displayTo}}`{{{displayTo}}}`{{else}}`{{{newValue}}}`{{/if}}\"\n }\n },\n \"prBodyDefinitions\": {\n \"Change\": \"{{#if (equals datasource \\\"npm\\\")}}[{{#if displayFrom}}`{{{displayFrom}}}` -> {{else}}{{#if currentValue}}`{{{currentValue}}}` -> {{/if}}{{/if}}{{#if displayTo}}`{{{displayTo}}}`{{else}}`{{{newValue}}}`{{/if}}]({{#if depName}}https://renovatebot.com/diffs/npm/{{replace '/' '%2f' depName}}/{{{currentVersion}}}/{{{newVersion}}}{{/if}}){{else}}{{#if displayFrom}}`{{{displayFrom}}}` -> {{else}}{{#if currentValue}}`{{{currentValue}}}` -> {{/if}}{{/if}}{{#if displayTo}}`{{{displayTo}}}`{{else}}`{{{newValue}}}`{{/if}}{{/if}}\"\n }\n },\n \"deps-edn\": {\n \"managerFilePatterns\": [\n \"/(^\|/)(?:deps\|bb)\\\\.edn$/\"\n ],\n \"versioning\": \"maven\"\n },\n \"devbox\": {\n \"managerFilePatterns\": [\n \"/(^\|/)devbox\\\\.json$/\"\n ]\n },\n \"devcontainer\": {\n \"managerFilePatterns\": [\n \"/^.devcontainer/devcontainer.json$/\",\n \"/^.devcontainer.json$/\"\n ]\n },\n \"docker-compose\": {\n \"managerFilePatterns\": [\n \"/(^\|/)(?:docker-)?compose[^/]\\\\.ya?ml$/\"\n ]\n },\n \"dockerfile\": {\n \"managerFilePatterns\": [\n \"/(^\|/\|\\\\.)([Dd]ocker\|[Cc]ontainer)file$/\",\n \"/(^\|/)([Dd]ocker\|[Cc]ontainer)file[^/]$/\"\n ]\n },\n \"droneci\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.drone\\\\.yml$/\"\n ]\n },\n \"fleet\": {\n \"managerFilePatterns\": [\n \"/(^\|/)fleet\\\\.ya?ml/\"\n ]\n },\n \"flux\": {\n \"managerFilePatterns\": [\n \"/(?:^\|/)gotk-components\\\\.ya?ml$/\"\n ]\n },\n \"fvm\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.fvm/fvm_config\\\\.json$/\",\n \"/(^\|/)\\\\.fvmrc$/\"\n ],\n \"versioning\": \"semver\"\n },\n \"git-submodules\": {\n \"enabled\": false,\n \"versioning\": \"git\",\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.gitmodules$/\"\n ]\n },\n \"github-actions\": {\n \"managerFilePatterns\": [\n \"/(^\|/)(workflow-templates\|\\\\.(?:github\|gitea\|forgejo)/(?:workflows\|actions))/.+\\\\.ya?ml$/\",\n \"/(^\|/)action\\\\.ya?ml$/\"\n ]\n },\n \"gitlabci\": {\n \"managerFilePatterns\": [\n \"/\\\\.gitlab-ci\\\\.ya?ml$/\"\n ]\n },\n \"gitlabci-include\": {\n \"managerFilePatterns\": [\n \"/\\\\.gitlab-ci\\\\.ya?ml$/\"\n ]\n },\n \"glasskube\": {\n \"managerFilePatterns\": []\n },\n \"gleam\": {\n \"managerFilePatterns\": [\n \"/(^\|/)gleam.toml$/\"\n ],\n \"versioning\": \"hex\"\n },\n \"gomod\": {\n \"managerFilePatterns\": [\n \"/(^\|/)go\\\\.mod$/\"\n ],\n \"pinDigests\": false\n },\n \"gradle\": {\n \"managerFilePatterns\": [\n \"/\\\\.gradle(\\\\.kts)?$/\",\n \"/(^\|/)gradle\\\\.properties$/\",\n \"/(^\|/)gradle/.+\\\\.toml$/\",\n \"/(^\|/)buildSrc/.+\\\\.kt$/\",\n \"/\\\\.versions\\\\.toml$/\",\n \"/(^\|/)versions.props$/\",\n \"/(^\|/)versions.lock$/\"\n ],\n \"timeout\": 600,\n \"versioning\": \"gradle\"\n },\n \"gradle-wrapper\": {\n \"managerFilePatterns\": [\n \"/(^\|/)gradle/wrapper/gradle-wrapper\\\\.properties$/\"\n ],\n \"versioning\": \"gradle\"\n },\n \"haskell-cabal\": {\n \"managerFilePatterns\": [\n \"/\\\\.cabal$/\"\n ],\n \"pinDigests\": false\n },\n \"helm-requirements\": {\n \"registryAliases\": {\n \"stable\": \"https://charts.helm.sh/stable\"\n },\n \"commitMessageTopic\": \"helm chart {{depName}}\",\n \"managerFilePatterns\": [\n \"/(^\|/)requirements\\\\.ya?ml$/\"\n ]\n },\n \"helm-values\": {\n \"commitMessageTopic\": \"helm values {{depName}}\",\n \"managerFilePatterns\": [\n \"/(^\|/)values\\\\.ya?ml$/\"\n ],\n \"pinDigests\": false\n },\n \"helmfile\": {\n \"registryAliases\": {\n \"stable\": \"https://charts.helm.sh/stable\"\n },\n \"commitMessageTopic\": \"helm chart {{depName}}\",\n \"managerFilePatterns\": [\n \"/(^\|/)helmfile\\\\.ya?ml(?:\\\\.gotmpl)?$/\",\n \"/(^\|/)helmfile\\\\.d/.+\\\\.ya?ml(?:\\\\.gotmpl)?$/\"\n ]\n },\n \"helmsman\": {\n \"managerFilePatterns\": []\n },\n \"helmv3\": {\n \"registryAliases\": {\n \"stable\": \"https://charts.helm.sh/stable\"\n },\n \"commitMessageTopic\": \"helm chart {{depName}}\",\n \"managerFilePatterns\": [\n \"/(^\|/)Chart\\\\.ya?ml$/\"\n ]\n },\n \"hermit\": {\n \"managerFilePatterns\": [\n \"/(^\|/)bin/hermit$/\"\n ],\n \"excludeCommitPaths\": [\n \"/bin/hermit\"\n ],\n \"versioning\": \"hermit\"\n },\n \"homeassistant-manifest\": {\n \"managerFilePatterns\": [\n \"/(^\|/)manifest\\\\.json$/\"\n ]\n },\n \"homebrew\": {\n \"commitMessageTopic\": \"Homebrew Formula {{depName}}\",\n \"managerFilePatterns\": [\n \"/^Formula/\\\\w/?[^/]+[.]rb$/\"\n ]\n },\n \"html\": {\n \"managerFilePatterns\": [\n \"/\\\\.html?$/\"\n ],\n \"versioning\": \"semver\",\n \"digest\": {\n \"enabled\": false\n },\n \"pinDigests\": false\n },\n \"jenkins\": {\n \"managerFilePatterns\": [\n \"/(^\|/)plugins\\\\.(txt\|ya?ml)$/\"\n ]\n },\n \"jsonnet-bundler\": {\n \"managerFilePatterns\": [\n \"/(^\|/)jsonnetfile\\\\.json$/\"\n ],\n \"datasource\": \"git-tags\"\n },\n \"kotlin-script\": {\n \"managerFilePatterns\": [\n \"/^.+\\\\.main\\\\.kts$/\"\n ]\n },\n \"kubernetes\": {\n \"managerFilePatterns\": []\n },\n \"kustomize\": {\n \"managerFilePatterns\": [\n \"/(^\|/)kustomization\\\\.ya?ml$/\"\n ],\n \"pinDigests\": false\n },\n \"leiningen\": {\n \"managerFilePatterns\": [\n \"/(^\|/)project\\\\.clj$/\"\n ],\n \"versioning\": \"maven\"\n },\n \"maven\": {\n \"managerFilePatterns\": [\n \"/(^\|/\|\\\\.)pom\\\\.xml$/\",\n \"/(^\|/)pom\\\\.template\\\\.xml$/\",\n \"/^(((\\\\.mvn)\|(\\\\.m2))/)?settings\\\\.xml$/\",\n \"/(^\|/)\\\\.mvn/extensions\\\\.xml$/\"\n ]\n },\n \"maven-wrapper\": {\n \"managerFilePatterns\": [\n \"/(^\|\\\\/).mvn/wrapper/maven-wrapper.properties$/\",\n \"/(^\|\\\\/)mvnw(.cmd)?$/\"\n ]\n },\n \"meteor\": {\n \"managerFilePatterns\": [\n \"/(^\|/)package\\\\.js$/\"\n ]\n },\n \"mint\": {\n \"managerFilePatterns\": [\n \"/(^\|/)Mintfile$/\"\n ]\n },\n \"mise\": {\n \"managerFilePatterns\": [\n \"*/{,.}mise{,.}.toml\",\n \"*/{,.}mise/config{,.}.toml\",\n \"*/.config/mise{,.}.toml\",\n \"*/.config/mise/{mise,config}{,.}.toml\",\n \"*/.config/mise/conf.d/.toml\",\n \"*/.rtx{,.}.toml\"\n ],\n \"pinDigests\": false\n },\n \"mix\": {\n \"managerFilePatterns\": [\n \"/(^\|/)mix\\\\.exs$/\"\n ]\n },\n \"nix\": {\n \"managerFilePatterns\": [\n \"/(^\|/)flake\\\\.nix$/\"\n ],\n \"commitMessageTopic\": \"nix\",\n \"commitMessageExtra\": \"to {{newValue}}\",\n \"enabled\": false\n },\n \"nodenv\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.node-version$/\"\n ],\n \"versioning\": \"node\"\n },\n \"npm\": {\n \"managerFilePatterns\": [\n \"/(^\|/)package\\\\.json$/\",\n \"/(^\|/)pnpm-workspace\\\\.yaml$/\",\n \"/(^\|/)\\\\.yarnrc\\\\.yml$/\"\n ],\n \"digest\": {\n \"prBodyDefinitions\": {\n \"Change\": \"{{#if displayFrom}}`{{{displayFrom}}}` → {{else}}{{#if currentValue}}`{{{currentValue}}}` → {{/if}}{{/if}}{{#if displayTo}}`{{{displayTo}}}`{{else}}`{{{newValue}}}`{{/if}}\"\n }\n },\n \"prBodyDefinitions\": {\n \"Change\": \"[{{#if displayFrom}}`{{{displayFrom}}}` → {{else}}{{#if currentValue}}`{{{currentValue}}}` → {{/if}}{{/if}}{{#if displayTo}}`{{{displayTo}}}`{{else}}`{{{newValue}}}`{{/if}}]({{#if depName}}https://renovatebot.com/diffs/npm/{{replace '/' '%2f' depName}}/{{{currentVersion}}}/{{{newVersion}}}{{/if}})\"\n }\n },\n \"nuget\": {\n \"managerFilePatterns\": [\n \"/\\\\.(?:cs\|fs\|vb\|sql)proj$/\",\n \"/\\\\.(?:props\|targets)$/\",\n \"/(^\|/)dotnet-tools\\\\.json$/\",\n \"/(^\|/)global\\\\.json$/\"\n ],\n \"rangeStrategy\": \"bump\",\n \"packageRules\": [\n {\n \"matchDepTypes\": [\n \"msbuild-sdk\"\n ],\n \"rangeStrategy\": \"bump\"\n }\n ]\n },\n \"nvm\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.nvmrc$/\"\n ],\n \"versioning\": \"node\",\n \"pinDigests\": false\n },\n \"ocb\": {\n \"managerFilePatterns\": []\n },\n \"osgi\": {\n \"managerFilePatterns\": [\n \"/(^\|/)src/main/features/.+\\\\.json$/\"\n ]\n },\n \"pep621\": {\n \"managerFilePatterns\": [\n \"/(^\|/)pyproject\\\\.toml$/\"\n ]\n },\n \"pep723\": {\n \"managerFilePatterns\": []\n },\n \"pip-compile\": {\n \"managerFilePatterns\": [],\n \"lockFileMaintenance\": {\n \"enabled\": true,\n \"branchTopic\": \"pip-compile-refresh\",\n \"commitMessageAction\": \"Refresh pip-compile outputs\"\n }\n },\n \"pip_requirements\": {\n \"managerFilePatterns\": [\n \"/(^\|/)[\\\\w-]requirements([-._]\\\\w+)?\\\\.(txt\|pip)$/\"\n ]\n },\n \"pip_setup\": {\n \"managerFilePatterns\": [\n \"/(^\|/)setup\\\\.py$/\"\n ]\n },\n \"pipenv\": {\n \"managerFilePatterns\": [\n \"/(^\|/)Pipfile$/\"\n ]\n },\n \"pixi\": {\n \"managerFilePatterns\": [\n \"/(^\|/)pyproject\\\\.toml$/\",\n \"/(^\|/)pixi\\\\.toml$/\"\n ]\n },\n \"poetry\": {\n \"managerFilePatterns\": [\n \"/(^\|/)pyproject\\\\.toml$/\"\n ]\n },\n \"pre-commit\": {\n \"commitMessageTopic\": \"pre-commit hook {{depName}}\",\n \"enabled\": false,\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.pre-commit-config\\\\.ya?ml$/\"\n ],\n \"prBodyNotes\": [\n \"Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://github.com/renovatebot/renovate/discussions/new) if you have any questions.\"\n ]\n },\n \"proto\": {\n \"managerFilePatterns\": [\n \"/.prototools\"\n ]\n },\n \"pub\": {\n \"managerFilePatterns\": [\n \"/(^\|/)pubspec\\\\.ya?ml$/\"\n ]\n },\n \"puppet\": {\n \"managerFilePatterns\": [\n \"/(^\|/)Puppetfile$/\"\n ]\n },\n \"pyenv\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.python-version$/\"\n ],\n \"versioning\": \"docker\",\n \"pinDigests\": false\n },\n \"quadlet\": {\n \"managerFilePatterns\": [\n \"/.+\\\\.container$/\",\n \"/.+\\\\.image$/\",\n \"/.+\\\\.volume$/\"\n ]\n },\n \"renovate-config\": {\n \"managerFilePatterns\": [\n \"renovate.json\",\n \"renovate.jsonc\",\n \"renovate.json5\",\n \".github/renovate.json\",\n \".github/renovate.jsonc\",\n \".github/renovate.json5\",\n \".gitlab/renovate.json\",\n \".gitlab/renovate.jsonc\",\n \".gitlab/renovate.json5\",\n \".renovaterc\",\n \".renovaterc.json\",\n \".renovaterc.jsonc\",\n \".renovaterc.json5\"\n ]\n },\n \"ruby-version\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.ruby-version$/\"\n ],\n \"versioning\": \"ruby\"\n },\n \"runtime-version\": {\n \"managerFilePatterns\": [\n \"/(^\|/)runtime.txt$/\"\n ],\n \"pinDigests\": false\n },\n \"rust-toolchain\": {\n \"commitMessageTopic\": \"Rust\",\n \"managerFilePatterns\": [\n \"/(^\|/)rust-toolchain(\\\\.toml)?$/\"\n ]\n },\n \"sbt\": {\n \"managerFilePatterns\": [\n \"/\\\\.sbt$/\",\n \"/project/[^/]\\\\.scala$/\",\n \"/project/build\\\\.properties$/\",\n \"/(^\|/)repositories$/\"\n ],\n \"versioning\": \"ivy\"\n },\n \"scalafmt\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.scalafmt.conf$/\"\n ]\n },\n \"setup-cfg\": {\n \"managerFilePatterns\": [\n \"/(^\|/)setup\\\\.cfg$/\"\n ],\n \"versioning\": \"pep440\"\n },\n \"smithy\": {\n \"managerFilePatterns\": [\n \"/(^\|/)smithy-build\\\\.json$/\"\n ]\n },\n \"sveltos\": {\n \"managerFilePatterns\": []\n },\n \"swift\": {\n \"managerFilePatterns\": [\n \"/(^\|/)Package\\\\.swift/\"\n ],\n \"versioning\": \"swift\",\n \"pinDigests\": false\n },\n \"tekton\": {\n \"managerFilePatterns\": []\n },\n \"terraform\": {\n \"commitMessageTopic\": \"Terraform {{depName}}\",\n \"managerFilePatterns\": [\n \"*/.tf\",\n \"*/.tofu\"\n ],\n \"pinDigests\": false\n },\n \"terraform-version\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.terraform-version$/\"\n ],\n \"versioning\": \"hashicorp\",\n \"extractVersion\": \"^v(?<version>.)$\"\n },\n \"terragrunt\": {\n \"commitMessageTopic\": \"Terragrunt dependency {{depName}}\",\n \"managerFilePatterns\": [\n \"/(^\|/)terragrunt\\\\.hcl$/\"\n ]\n },\n \"terragrunt-version\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.terragrunt-version$/\"\n ],\n \"versioning\": \"hashicorp\",\n \"extractVersion\": \"^v(?<version>.+)$\"\n },\n \"tflint-plugin\": {\n \"commitMessageTopic\": \"TFLint plugin {{depName}}\",\n \"managerFilePatterns\": [\n \"/\\\\.tflint\\\\.hcl$/\"\n ],\n \"extractVersion\": \"^v(?<version>.)$\"\n },\n \"travis\": {\n \"managerFilePatterns\": [\n \"/^\\\\.travis\\\\.ya?ml$/\"\n ],\n \"major\": {\n \"enabled\": false\n },\n \"versioning\": \"node\"\n },\n \"typst\": {\n \"managerFilePatterns\": [\n \"/\\\\.typ$/\"\n ]\n },\n \"unity3d\": {\n \"managerFilePatterns\": [\n \"/ProjectSettings/ProjectVersion.txt\"\n ]\n },\n \"velaci\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.vela\\\\.ya?ml$/\"\n ]\n },\n \"vendir\": {\n \"commitMessageTopic\": \"vendir {{depName}}\",\n \"managerFilePatterns\": [\n \"/(^\|/)vendir\\\\.yml$/\"\n ]\n },\n \"woodpecker\": {\n \"managerFilePatterns\": [\n \"/^\\\\.woodpecker(?:/[^/]+)?\\\\.ya?ml$/\"\n ]\n },\n \"xcodegen\": {\n \"managerFilePatterns\": [\n \"/project.yml\"\n ],\n \"pinDigests\": false\n },\n \"regex\": {\n \"pinDigests\": false\n },\n \"jsonata\": {\n \"pinDigests\": false\n }\n};\n"],"mappings":";AACA,MAAa,wBAAiE;CAC5E,OAAO,EACL,uBAAuB,CACrB,cACF,EACF;CACA,WAAW,EACT,uBAAuB,CACrB,6BACF,EACF;CACA,kBAAkB,EAChB,uBAAuB,CACrB,oDACF,EACF;CACA,UAAU,EACR,uBAAuB,CAAC,EAC1B;CACA,QAAQ,EACN,uBAAuB,CACrB,0BACF,EACF;CACA,mBAAmB;EACjB,uBAAuB,CACrB,mCACA,gCACF;EACA,WAAW;CACb;CACA,UAAU,EACR,uBAAuB,CACrB,kCACF,EACF;CACA,kBAAkB;EAChB,uBAAuB,CACrB,gBACF;EACA,cAAc;CAChB;CACA,SAAS,EACP,uBAAuB;EACrB;EACA;EACA;CACF,EACF;CACA,gBAAgB,EACd,uBAAuB,CACrB,4BACF,EACF;CACA,YAAY;EACV,uBAAuB,CACrB,yBACF;EACA,cAAc;EACd,cAAc;CAChB;CACA,SAAS,EACP,uBAAuB,CACrB,aACF,EACF;CACA,uBAAuB,EACrB,uBAAuB,CACrB,oBACF,EACF;CACA,WAAW,EACT,uBAAuB,CACrB,yBACF,EACF;CACA,aAAa;EACX,uBAAuB,CACrB,uBACA,4BACF;EACA,sBAAsB;EACtB,sBAAsB;CACxB;CACA,cAAc;EACZ,sBAAsB;EACtB,uBAAuB,CACrB,wBACF;EACA,cAAc;CAChB;CACA,OAAO;EACL,uBAAuB,CACrB,wBACA,wBACF;EACA,UAAU,EACR,qBAAqB,EACnB,UAAU,8KACZ,EACF;EACA,qBAAqB,EACnB,UAAU,6SACZ;CACF;CACA,eAAe;EACb,uBAAuB,CACrB,wBACF;EACA,cAAc;CAChB;CACA,WAAW;EACT,uBAAuB,CACrB,iBACF;EACA,cAAc;CAChB;CACA,QAAQ,EACN,uBAAuB,CACrB,YACF,EACF;CACA,SAAS;EACP,sBAAsB;EACtB,uBAAuB,CACrB,sBACF;CACF;CACA,UAAU;EACR,uBAAuB,CAAC;EACxB,cAAc;CAChB;CACA,YAAY,EACV,uBAAuB,CACrB,gCACF,EACF;CACA,cAAc,EACZ,uBAAuB,CACrB,2BACF,EACF;CACA,aAAa;EACX,uBAAuB,CACrB,iBACF;EACA,cAAc;CAChB;CACA,YAAY;EACV,uBAAuB,CACrB,kCACF;EACA,cAAc;CAChB;CACA,SAAS;EACP,uBAAuB,CACrB,8BACF;EACA,cAAc;EACd,cAAc;CAChB;CACA,UAAU;EACR,uBAAuB,CACrB,0CACF;EACA,cAAc;CAChB;CACA,YAAY,EACV,uBAAuB,CACrB,kBACF,EACF;CACA,cAAc,EACZ,uBAAuB,CAAC,EAC1B;CACA,QAAQ,EACN,uBAAuB,CACrB,gCACF,EACF;CACA,QAAQ;EACN,uBAAuB,CACrB,uBACA,6BACF;EACA,UAAU,EACR,qBAAqB,EACnB,UAAU,gLACZ,EACF;EACA,qBAAqB,EACnB,UAAU,8gBACZ;CACF;CACA,YAAY;EACV,uBAAuB,CACrB,2BACF;EACA,cAAc;CAChB;CACA,UAAU,EACR,uBAAuB,CACrB,uBACF,EACF;CACA,gBAAgB,EACd,uBAAuB,CACrB,uCACA,wBACF,EACF;CACA,kBAAkB,EAChB,uBAAuB,CACrB,0CACF,EACF;CACA,cAAc,EACZ,uBAAuB,CACrB,4CACA,2CACF,EACF;CACA,WAAW,EACT,uBAAuB,CACrB,wBACF,EACF;CACA,SAAS,EACP,uBAAuB,CACrB,sBACF,EACF;CACA,QAAQ,EACN,uBAAuB,CACrB,mCACF,EACF;CACA,OAAO;EACL,uBAAuB,CACrB,oCACA,kBACF;EACA,cAAc;CAChB;CACA,kBAAkB;EAChB,WAAW;EACX,cAAc;EACd,uBAAuB,CACrB,uBACF;CACF;CACA,kBAAkB,EAChB,uBAAuB,CACrB,6FACA,wBACF,EACF;CACA,YAAY,EACV,uBAAuB,CACrB,yBACF,EACF;CACA,oBAAoB,EAClB,uBAAuB,CACrB,yBACF,EACF;CACA,aAAa,EACX,uBAAuB,CAAC,EAC1B;CACA,SAAS;EACP,uBAAuB,CACrB,oBACF;EACA,cAAc;CAChB;CACA,SAAS;EACP,uBAAuB,CACrB,kBACF;EACA,cAAc;CAChB;CACA,UAAU;EACR,uBAAuB;GACrB;GACA;GACA;GACA;GACA;GACA;GACA;EACF;EACA,WAAW;EACX,cAAc;CAChB;CACA,kBAAkB;EAChB,uBAAuB,CACrB,oDACF;EACA,cAAc;CAChB;CACA,iBAAiB;EACf,uBAAuB,CACrB,aACF;EACA,cAAc;CAChB;CACA,qBAAqB;EACnB,mBAAmB,EACjB,UAAU,gCACZ;EACA,sBAAsB;EACtB,uBAAuB,CACrB,8BACF;CACF;CACA,eAAe;EACb,sBAAsB;EACtB,uBAAuB,CACrB,wBACF;EACA,cAAc;CAChB;CACA,YAAY;EACV,mBAAmB,EACjB,UAAU,gCACZ;EACA,sBAAsB;EACtB,uBAAuB,CACrB,0CACA,+CACF;CACF;CACA,YAAY,EACV,uBAAuB,CAAC,EAC1B;CACA,UAAU;EACR,mBAAmB,EACjB,UAAU,gCACZ;EACA,sBAAsB;EACtB,uBAAuB,CACrB,uBACF;CACF;CACA,UAAU;EACR,uBAAuB,CACrB,oBACF;EACA,sBAAsB,CACpB,eACF;EACA,cAAc;CAChB;CACA,0BAA0B,EACxB,uBAAuB,CACrB,yBACF,EACF;CACA,YAAY;EACV,sBAAsB;EACtB,uBAAuB,CACrB,8BACF;CACF;CACA,QAAQ;EACN,uBAAuB,CACrB,aACF;EACA,cAAc;EACd,UAAU,EACR,WAAW,MACb;EACA,cAAc;CAChB;CACA,WAAW,EACT,uBAAuB,CACrB,+BACF,EACF;CACA,mBAAmB;EACjB,uBAAuB,CACrB,4BACF;EACA,cAAc;CAChB;CACA,iBAAiB,EACf,uBAAuB,CACrB,qBACF,EACF;CACA,cAAc,EACZ,uBAAuB,CAAC,EAC1B;CACA,aAAa;EACX,uBAAuB,CACrB,+BACF;EACA,cAAc;CAChB;CACA,aAAa;EACX,uBAAuB,CACrB,uBACF;EACA,cAAc;CAChB;CACA,SAAS,EACP,uBAAuB;EACrB;EACA;EACA;EACA;CACF,EACF;CACA,iBAAiB,EACf,uBAAuB,CACrB,mDACA,uBACF,EACF;CACA,UAAU,EACR,uBAAuB,CACrB,sBACF,EACF;CACA,QAAQ,EACN,uBAAuB,CACrB,kBACF,EACF;CACA,QAAQ;EACN,uBAAuB;GACrB;GACA;GACA;GACA;GACA;GACA;EACF;EACA,cAAc;CAChB;CACA,OAAO,EACL,uBAAuB,CACrB,mBACF,EACF;CACA,OAAO;EACL,uBAAuB,CACrB,qBACF;EACA,sBAAsB;EACtB,sBAAsB;EACtB,WAAW;CACb;CACA,UAAU;EACR,uBAAuB,CACrB,yBACF;EACA,cAAc;CAChB;CACA,OAAO;EACL,uBAAuB;GACrB;GACA;GACA;EACF;EACA,UAAU,EACR,qBAAqB,EACnB,UAAU,8KACZ,EACF;EACA,qBAAqB,EACnB,UAAU,6SACZ;CACF;CACA,SAAS;EACP,uBAAuB;GACrB;GACA;GACA;GACA;EACF;EACA,iBAAiB;EACjB,gBAAgB,CACd;GACE,iBAAiB,CACf,aACF;GACA,iBAAiB;EACnB,CACF;CACF;CACA,OAAO;EACL,uBAAuB,CACrB,kBACF;EACA,cAAc;EACd,cAAc;CAChB;CACA,OAAO,EACL,uBAAuB,CAAC,EAC1B;CACA,QAAQ,EACN,uBAAuB,CACrB,qCACF,EACF;CACA,UAAU,EACR,uBAAuB,CACrB,0BACF,EACF;CACA,UAAU,EACR,uBAAuB,CAAC,EAC1B;CACA,eAAe;EACb,uBAAuB,CAAC;EACxB,uBAAuB;GACrB,WAAW;GACX,eAAe;GACf,uBAAuB;EACzB;CACF;CACA,oBAAoB,EAClB,uBAAuB,CACrB,qDACF,EACF;CACA,aAAa,EACX,uBAAuB,CACrB,oBACF,EACF;CACA,UAAU,EACR,uBAAuB,CACrB,iBACF,EACF;CACA,QAAQ,EACN,uBAAuB,CACrB,4BACA,qBACF,EACF;CACA,UAAU,EACR,uBAAuB,CACrB,0BACF,EACF;CACA,cAAc;EACZ,sBAAsB;EACtB,WAAW;EACX,uBAAuB,CACrB,sCACF;EACA,eAAe,CACb,iSACF;CACF;CACA,SAAS,EACP,uBAAuB,CACrB,gBACF,EACF;CACA,OAAO,EACL,uBAAuB,CACrB,yBACF,EACF;CACA,UAAU,EACR,uBAAuB,CACrB,oBACF,EACF;CACA,SAAS;EACP,uBAAuB,CACrB,2BACF;EACA,cAAc;EACd,cAAc;CAChB;CACA,WAAW,EACT,uBAAuB;EACrB;EACA;EACA;CACF,EACF;CACA,mBAAmB,EACjB,uBAAuB;EACrB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,EACF;CACA,gBAAgB;EACd,uBAAuB,CACrB,yBACF;EACA,cAAc;CAChB;CACA,mBAAmB;EACjB,uBAAuB,CACrB,qBACF;EACA,cAAc;CAChB;CACA,kBAAkB;EAChB,sBAAsB;EACtB,uBAAuB,CACrB,kCACF;CACF;CACA,OAAO;EACL,uBAAuB;GACrB;GACA;GACA;GACA;EACF;EACA,cAAc;CAChB;CACA,YAAY,EACV,uBAAuB,CACrB,0BACF,EACF;CACA,aAAa;EACX,uBAAuB,CACrB,qBACF;EACA,cAAc;CAChB;CACA,UAAU,EACR,uBAAuB,CACrB,6BACF,EACF;CACA,WAAW,EACT,uBAAuB,CAAC,EAC1B;CACA,SAAS;EACP,uBAAuB,CACrB,wBACF;EACA,cAAc;EACd,cAAc;CAChB;CACA,UAAU,EACR,uBAAuB,CAAC,EAC1B;CACA,aAAa;EACX,sBAAsB;EACtB,uBAAuB,CACrB,WACA,WACF;EACA,cAAc;CAChB;CACA,qBAAqB;EACnB,uBAAuB,CACrB,8BACF;EACA,cAAc;EACd,kBAAkB;CACpB;CACA,cAAc;EACZ,sBAAsB;EACtB,uBAAuB,CACrB,0BACF;CACF;CACA,sBAAsB;EACpB,uBAAuB,CACrB,+BACF;EACA,cAAc;EACd,kBAAkB;CACpB;CACA,iBAAiB;EACf,sBAAsB;EACtB,uBAAuB,CACrB,oBACF;EACA,kBAAkB;CACpB;CACA,UAAU;EACR,uBAAuB,CACrB,uBACF;EACA,SAAS,EACP,WAAW,MACb;EACA,cAAc;CAChB;CACA,SAAS,EACP,uBAAuB,CACrB,WACF,EACF;CACA,WAAW,EACT,uBAAuB,CACrB,uCACF,EACF;CACA,UAAU,EACR,uBAAuB,CACrB,yBACF,EACF;CACA,UAAU;EACR,sBAAsB;EACtB,uBAAuB,CACrB,sBACF;CACF;CACA,cAAc,EACZ,uBAAuB,CACrB,sCACF,EACF;CACA,YAAY;EACV,uBAAuB,CACrB,gBACF;EACA,cAAc;CAChB;CACA,SAAS,EACP,cAAc,MAChB;CACA,WAAW,EACT,cAAc,MAChB;AACF"}
1	+ {"version":3,"file":"manager-default-configs.generated.js","names":[],"sources":["../lib/manager-default-configs.generated.ts"],"sourcesContent":["\nexport const managerDefaultConfigs: Record<string, Record<string, unknown>> = {\n \"ant\": {\n \"managerFilePatterns\": [\n \"*/build.xml\"\n ]\n },\n \"ansible\": {\n \"managerFilePatterns\": [\n \"/(^\|/)tasks/[^/]+\\\\.ya?ml$/\"\n ]\n },\n \"ansible-galaxy\": {\n \"managerFilePatterns\": [\n \"/(^\|/)(galaxy\|requirements)(\\\\.ansible)?\\\\.ya?ml$/\"\n ]\n },\n \"argocd\": {\n \"managerFilePatterns\": []\n },\n \"asdf\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.tool-versions$/\"\n ]\n },\n \"azure-pipelines\": {\n \"managerFilePatterns\": [\n \"/(^\|/).azuredevops/.+\\\\.ya?ml$/\",\n \"/azure.pipelines?.\\\\.ya?ml$/\"\n ],\n \"enabled\": false\n },\n \"batect\": {\n \"managerFilePatterns\": [\n \"/(^\|/)batect(-bundle)?\\\\.ya?ml$/\"\n ]\n },\n \"batect-wrapper\": {\n \"managerFilePatterns\": [\n \"/(^\|/)batect$/\"\n ],\n \"versioning\": \"semver\"\n },\n \"bazel\": {\n \"managerFilePatterns\": [\n \"/(^\|/)WORKSPACE(\|\\\\.bazel\|\\\\.bzlmod)$/\",\n \"/\\\\.WORKSPACE\\\\.bazel$/\",\n \"/\\\\.bzl$/\"\n ]\n },\n \"bazel-module\": {\n \"managerFilePatterns\": [\n \"/(^\|/\|\\\\.)MODULE\\\\.bazel$/\"\n ]\n },\n \"bazelisk\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.bazelversion$/\"\n ],\n \"pinDigests\": false,\n \"versioning\": \"semver\"\n },\n \"bicep\": {\n \"managerFilePatterns\": [\n \"/\\\\.bicep$/\"\n ]\n },\n \"bitbucket-pipelines\": {\n \"managerFilePatterns\": [\n \"/-pipelines.yml\"\n ]\n },\n \"bitrise\": {\n \"managerFilePatterns\": [\n \"/(^\|/)bitrise\\\\.ya?ml$/\"\n ]\n },\n \"buildkite\": {\n \"managerFilePatterns\": [\n \"/buildkite\\\\.ya?ml/\",\n \"/\\\\.buildkite/.+\\\\.ya?ml$/\"\n ],\n \"commitMessageTopic\": \"buildkite plugin {{depName}}\",\n \"commitMessageExtra\": \"to {{#if isMajor}}{{{prettyNewMajor}}}{{else}}{{{newValue}}}{{/if}}\"\n },\n \"buildpacks\": {\n \"commitMessageTopic\": \"buildpack {{depName}}\",\n \"managerFilePatterns\": [\n \"/(^\|/)project\\\\.toml$/\"\n ],\n \"pinDigests\": false\n },\n \"bun\": {\n \"managerFilePatterns\": [\n \"/(^\|/)bun\\\\.lockb?$/\",\n \"/(^\|/)package\\\\.json$/\"\n ],\n \"digest\": {\n \"prBodyDefinitions\": {\n \"Change\": \"{{#if displayFrom}}`{{{displayFrom}}}` → {{else}}{{#if currentValue}}`{{{currentValue}}}` → {{/if}}{{/if}}{{#if displayTo}}`{{{displayTo}}}`{{else}}`{{{newValue}}}`{{/if}}\"\n }\n },\n \"prBodyDefinitions\": {\n \"Change\": \"[{{#if displayFrom}}`{{{displayFrom}}}` → {{else}}{{#if currentValue}}`{{{currentValue}}}` → {{/if}}{{/if}}{{#if displayTo}}`{{{displayTo}}}`{{else}}`{{{newValue}}}`{{/if}}]({{#if depName}}https://renovatebot.com/diffs/npm/{{replace '/' '%2f' depName}}/{{{currentVersion}}}/{{{newVersion}}}{{/if}})\"\n }\n },\n \"bun-version\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.bun-version$/\"\n ],\n \"versioning\": \"npm\"\n },\n \"bundler\": {\n \"managerFilePatterns\": [\n \"/(^\|/)Gemfile$/\"\n ],\n \"versioning\": \"ruby\"\n },\n \"cake\": {\n \"managerFilePatterns\": [\n \"/\\\\.cake$/\"\n ]\n },\n \"cargo\": {\n \"commitMessageTopic\": \"Rust crate {{depName}}\",\n \"managerFilePatterns\": [\n \"/(^\|/)Cargo\\\\.toml$/\"\n ]\n },\n \"cdnurl\": {\n \"managerFilePatterns\": [],\n \"versioning\": \"semver\"\n },\n \"circleci\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.circleci/.+\\\\.ya?ml$/\"\n ]\n },\n \"cloudbuild\": {\n \"managerFilePatterns\": [\n \"/(^\|/)cloudbuild\\\\.ya?ml/\"\n ]\n },\n \"cocoapods\": {\n \"managerFilePatterns\": [\n \"/(^\|/)Podfile$/\"\n ],\n \"versioning\": \"ruby\"\n },\n \"composer\": {\n \"managerFilePatterns\": [\n \"/(^\|/)([\\\\w-])composer\\\\.json$/\"\n ],\n \"versioning\": \"composer\"\n },\n \"conan\": {\n \"managerFilePatterns\": [\n \"/(^\|/)conanfile\\\\.(txt\|py)$/\"\n ],\n \"datasource\": \"conan\",\n \"versioning\": \"conan\"\n },\n \"copier\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.copier-answers(\\\\..+)?\\\\.ya?ml/\"\n ],\n \"versioning\": \"pep440\"\n },\n \"cpanfile\": {\n \"managerFilePatterns\": [\n \"/(^\|/)cpanfile$/\"\n ]\n },\n \"crossplane\": {\n \"managerFilePatterns\": []\n },\n \"crow\": {\n \"managerFilePatterns\": [\n \"/^\\\\.crow(?:/[^/]+)?\\\\.ya?ml$/\"\n ]\n },\n \"deno\": {\n \"managerFilePatterns\": [\n \"/(^\|/)deno\\\\.lock$/\",\n \"/(^\|/)deno\\\\.(json\|jsonc)$/\"\n ],\n \"digest\": {\n \"prBodyDefinitions\": {\n \"Change\": \"{{#if displayFrom}}`{{{displayFrom}}}` -> {{else}}{{#if currentValue}}`{{{currentValue}}}` -> {{/if}}{{/if}}{{#if displayTo}}`{{{displayTo}}}`{{else}}`{{{newValue}}}`{{/if}}\"\n }\n },\n \"prBodyDefinitions\": {\n \"Change\": \"{{#if (equals datasource \\\"npm\\\")}}[{{#if displayFrom}}`{{{displayFrom}}}` -> {{else}}{{#if currentValue}}`{{{currentValue}}}` -> {{/if}}{{/if}}{{#if displayTo}}`{{{displayTo}}}`{{else}}`{{{newValue}}}`{{/if}}]({{#if depName}}https://renovatebot.com/diffs/npm/{{replace '/' '%2f' depName}}/{{{currentVersion}}}/{{{newVersion}}}{{/if}}){{else}}{{#if displayFrom}}`{{{displayFrom}}}` -> {{else}}{{#if currentValue}}`{{{currentValue}}}` -> {{/if}}{{/if}}{{#if displayTo}}`{{{displayTo}}}`{{else}}`{{{newValue}}}`{{/if}}{{/if}}\"\n }\n },\n \"deps-edn\": {\n \"managerFilePatterns\": [\n \"/(^\|/)(?:deps\|bb)\\\\.edn$/\"\n ],\n \"versioning\": \"maven\"\n },\n \"devbox\": {\n \"managerFilePatterns\": [\n \"/(^\|/)devbox\\\\.json$/\"\n ]\n },\n \"devcontainer\": {\n \"managerFilePatterns\": [\n \"/^.devcontainer/devcontainer.json$/\",\n \"/^.devcontainer.json$/\",\n \"/^.devcontainer/[^/]+/devcontainer.json$/\"\n ]\n },\n \"docker-compose\": {\n \"managerFilePatterns\": [\n \"/(^\|/)(?:docker-)?compose[^/]\\\\.ya?ml$/\"\n ]\n },\n \"dockerfile\": {\n \"managerFilePatterns\": [\n \"/(^\|/\|\\\\.)([Dd]ocker\|[Cc]ontainer)file$/\",\n \"/(^\|/)([Dd]ocker\|[Cc]ontainer)file[^/]$/\"\n ]\n },\n \"droneci\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.drone\\\\.yml$/\"\n ]\n },\n \"fleet\": {\n \"managerFilePatterns\": [\n \"/(^\|/)fleet\\\\.ya?ml/\"\n ]\n },\n \"flux\": {\n \"managerFilePatterns\": [\n \"/(?:^\|/)gotk-components\\\\.ya?ml$/\"\n ]\n },\n \"fvm\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.fvm/fvm_config\\\\.json$/\",\n \"/(^\|/)\\\\.fvmrc$/\"\n ],\n \"versioning\": \"semver\"\n },\n \"git-submodules\": {\n \"enabled\": false,\n \"versioning\": \"git\",\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.gitmodules$/\"\n ]\n },\n \"github-actions\": {\n \"managerFilePatterns\": [\n \"/(^\|/)(workflow-templates\|\\\\.(?:github\|gitea\|forgejo)/(?:workflows\|actions))/.+\\\\.ya?ml$/\",\n \"/(^\|/)action\\\\.ya?ml$/\"\n ]\n },\n \"gitlabci\": {\n \"managerFilePatterns\": [\n \"/\\\\.gitlab-ci\\\\.ya?ml$/\"\n ]\n },\n \"gitlabci-include\": {\n \"managerFilePatterns\": [\n \"/\\\\.gitlab-ci\\\\.ya?ml$/\"\n ]\n },\n \"glasskube\": {\n \"managerFilePatterns\": []\n },\n \"gleam\": {\n \"managerFilePatterns\": [\n \"/(^\|/)gleam.toml$/\"\n ],\n \"versioning\": \"hex\"\n },\n \"gomod\": {\n \"managerFilePatterns\": [\n \"/(^\|/)go\\\\.mod$/\"\n ],\n \"pinDigests\": false\n },\n \"gradle\": {\n \"managerFilePatterns\": [\n \"/\\\\.gradle(\\\\.kts)?$/\",\n \"/(^\|/)gradle\\\\.properties$/\",\n \"/(^\|/)gradle/.+\\\\.toml$/\",\n \"/(^\|/)buildSrc/.+\\\\.kt$/\",\n \"/\\\\.versions\\\\.toml$/\",\n \"/(^\|/)versions.props$/\",\n \"/(^\|/)versions.lock$/\"\n ],\n \"timeout\": 600,\n \"versioning\": \"gradle\"\n },\n \"gradle-wrapper\": {\n \"managerFilePatterns\": [\n \"/(^\|/)gradle/wrapper/gradle-wrapper\\\\.properties$/\"\n ],\n \"versioning\": \"gradle\"\n },\n \"haskell-cabal\": {\n \"managerFilePatterns\": [\n \"/\\\\.cabal$/\"\n ],\n \"pinDigests\": false\n },\n \"helm-requirements\": {\n \"registryAliases\": {\n \"stable\": \"https://charts.helm.sh/stable\"\n },\n \"commitMessageTopic\": \"helm chart {{depName}}\",\n \"managerFilePatterns\": [\n \"/(^\|/)requirements\\\\.ya?ml$/\"\n ]\n },\n \"helm-values\": {\n \"commitMessageTopic\": \"helm values {{depName}}\",\n \"managerFilePatterns\": [\n \"/(^\|/)values\\\\.ya?ml$/\"\n ],\n \"pinDigests\": false\n },\n \"helmfile\": {\n \"registryAliases\": {\n \"stable\": \"https://charts.helm.sh/stable\"\n },\n \"commitMessageTopic\": \"helm chart {{depName}}\",\n \"managerFilePatterns\": [\n \"/(^\|/)helmfile\\\\.ya?ml(?:\\\\.gotmpl)?$/\",\n \"/(^\|/)helmfile\\\\.d/.+\\\\.ya?ml(?:\\\\.gotmpl)?$/\"\n ]\n },\n \"helmsman\": {\n \"managerFilePatterns\": []\n },\n \"helmv3\": {\n \"registryAliases\": {\n \"stable\": \"https://charts.helm.sh/stable\"\n },\n \"commitMessageTopic\": \"helm chart {{depName}}\",\n \"managerFilePatterns\": [\n \"/(^\|/)Chart\\\\.ya?ml$/\"\n ]\n },\n \"hermit\": {\n \"managerFilePatterns\": [\n \"/(^\|/)bin/hermit$/\"\n ],\n \"excludeCommitPaths\": [\n \"/bin/hermit\"\n ],\n \"versioning\": \"hermit\"\n },\n \"homeassistant-manifest\": {\n \"managerFilePatterns\": [\n \"/(^\|/)manifest\\\\.json$/\"\n ]\n },\n \"homebrew\": {\n \"commitMessageTopic\": \"Homebrew Formula {{depName}}\",\n \"managerFilePatterns\": [\n \"/^Formula/\\\\w/?[^/]+[.]rb$/\"\n ]\n },\n \"html\": {\n \"managerFilePatterns\": [\n \"/\\\\.html?$/\"\n ],\n \"versioning\": \"semver\",\n \"digest\": {\n \"enabled\": false\n },\n \"pinDigests\": false\n },\n \"jenkins\": {\n \"managerFilePatterns\": [\n \"/(^\|/)plugins\\\\.(txt\|ya?ml)$/\"\n ]\n },\n \"jsonnet-bundler\": {\n \"managerFilePatterns\": [\n \"/(^\|/)jsonnetfile\\\\.json$/\"\n ],\n \"datasource\": \"git-tags\"\n },\n \"kotlin-script\": {\n \"managerFilePatterns\": [\n \"/^.+\\\\.main\\\\.kts$/\"\n ]\n },\n \"kubernetes\": {\n \"managerFilePatterns\": []\n },\n \"kustomize\": {\n \"managerFilePatterns\": [\n \"/(^\|/)kustomization\\\\.ya?ml$/\"\n ],\n \"pinDigests\": false\n },\n \"leiningen\": {\n \"managerFilePatterns\": [\n \"/(^\|/)project\\\\.clj$/\"\n ],\n \"versioning\": \"maven\"\n },\n \"maven\": {\n \"managerFilePatterns\": [\n \"/(^\|/\|\\\\.)pom\\\\.xml$/\",\n \"/(^\|/)pom\\\\.template\\\\.xml$/\",\n \"/^(((\\\\.mvn)\|(\\\\.m2))/)?settings\\\\.xml$/\",\n \"/(^\|/)\\\\.mvn/extensions\\\\.xml$/\"\n ]\n },\n \"maven-wrapper\": {\n \"managerFilePatterns\": [\n \"/(^\|\\\\/).mvn/wrapper/maven-wrapper.properties$/\",\n \"/(^\|\\\\/)mvnw(.cmd)?$/\"\n ]\n },\n \"meteor\": {\n \"managerFilePatterns\": [\n \"/(^\|/)package\\\\.js$/\"\n ]\n },\n \"mint\": {\n \"managerFilePatterns\": [\n \"/(^\|/)Mintfile$/\"\n ]\n },\n \"mise\": {\n \"managerFilePatterns\": [\n \"*/{,.}mise{,.}.toml\",\n \"*/{,.}mise/config{,.}.toml\",\n \"*/.config/mise{,.}.toml\",\n \"*/.config/mise/{mise,config}{,.}.toml\",\n \"*/.config/mise/conf.d/.toml\",\n \"*/.rtx{,.}.toml\"\n ],\n \"pinDigests\": false\n },\n \"mix\": {\n \"managerFilePatterns\": [\n \"/(^\|/)mix\\\\.exs$/\"\n ]\n },\n \"nix\": {\n \"managerFilePatterns\": [\n \"/(^\|/)flake\\\\.nix$/\"\n ],\n \"commitMessageTopic\": \"nix\",\n \"commitMessageExtra\": \"to {{newValue}}\",\n \"enabled\": false\n },\n \"nodenv\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.node-version$/\"\n ],\n \"versioning\": \"node\"\n },\n \"npm\": {\n \"managerFilePatterns\": [\n \"/(^\|/)package\\\\.json$/\",\n \"/(^\|/)pnpm-workspace\\\\.yaml$/\",\n \"/(^\|/)\\\\.yarnrc\\\\.yml$/\"\n ],\n \"digest\": {\n \"prBodyDefinitions\": {\n \"Change\": \"{{#if displayFrom}}`{{{displayFrom}}}` → {{else}}{{#if currentValue}}`{{{currentValue}}}` → {{/if}}{{/if}}{{#if displayTo}}`{{{displayTo}}}`{{else}}`{{{newValue}}}`{{/if}}\"\n }\n },\n \"prBodyDefinitions\": {\n \"Change\": \"[{{#if displayFrom}}`{{{displayFrom}}}` → {{else}}{{#if currentValue}}`{{{currentValue}}}` → {{/if}}{{/if}}{{#if displayTo}}`{{{displayTo}}}`{{else}}`{{{newValue}}}`{{/if}}]({{#if depName}}https://renovatebot.com/diffs/npm/{{replace '/' '%2f' depName}}/{{{currentVersion}}}/{{{newVersion}}}{{/if}})\"\n }\n },\n \"nuget\": {\n \"managerFilePatterns\": [\n \"/\\\\.(?:cs\|fs\|vb\|sql)proj$/\",\n \"/\\\\.(?:props\|targets)$/\",\n \"/(^\|/)dotnet-tools\\\\.json$/\",\n \"/(^\|/)global\\\\.json$/\"\n ],\n \"rangeStrategy\": \"bump\",\n \"packageRules\": [\n {\n \"matchDepTypes\": [\n \"msbuild-sdk\"\n ],\n \"rangeStrategy\": \"bump\"\n }\n ]\n },\n \"nvm\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.nvmrc$/\"\n ],\n \"versioning\": \"node\",\n \"pinDigests\": false\n },\n \"ocb\": {\n \"managerFilePatterns\": []\n },\n \"osgi\": {\n \"managerFilePatterns\": [\n \"/(^\|/)src/main/features/.+\\\\.json$/\"\n ]\n },\n \"pep621\": {\n \"managerFilePatterns\": [\n \"/(^\|/)pyproject\\\\.toml$/\"\n ]\n },\n \"pep723\": {\n \"managerFilePatterns\": []\n },\n \"pip-compile\": {\n \"managerFilePatterns\": [],\n \"lockFileMaintenance\": {\n \"enabled\": true,\n \"branchTopic\": \"pip-compile-refresh\",\n \"commitMessageAction\": \"Refresh pip-compile outputs\"\n }\n },\n \"pip_requirements\": {\n \"managerFilePatterns\": [\n \"/(^\|/)[\\\\w-]requirements([-._]\\\\w+)?\\\\.(txt\|pip)$/\"\n ]\n },\n \"pip_setup\": {\n \"managerFilePatterns\": [\n \"/(^\|/)setup\\\\.py$/\"\n ]\n },\n \"pipenv\": {\n \"managerFilePatterns\": [\n \"/(^\|/)Pipfile$/\"\n ]\n },\n \"pixi\": {\n \"managerFilePatterns\": [\n \"/(^\|/)pyproject\\\\.toml$/\",\n \"/(^\|/)pixi\\\\.toml$/\"\n ]\n },\n \"poetry\": {\n \"managerFilePatterns\": [\n \"/(^\|/)pyproject\\\\.toml$/\"\n ]\n },\n \"pre-commit\": {\n \"commitMessageTopic\": \"pre-commit hook {{depName}}\",\n \"enabled\": false,\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.pre-commit-config\\\\.ya?ml$/\"\n ],\n \"prBodyNotes\": [\n \"Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://github.com/renovatebot/renovate/discussions/new) if you have any questions.\"\n ]\n },\n \"proto\": {\n \"managerFilePatterns\": [\n \"/.prototools\"\n ]\n },\n \"pub\": {\n \"managerFilePatterns\": [\n \"/(^\|/)pubspec\\\\.ya?ml$/\"\n ]\n },\n \"puppet\": {\n \"managerFilePatterns\": [\n \"/(^\|/)Puppetfile$/\"\n ]\n },\n \"pyenv\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.python-version$/\"\n ],\n \"versioning\": \"docker\",\n \"pinDigests\": false\n },\n \"quadlet\": {\n \"managerFilePatterns\": [\n \"/.+\\\\.container$/\",\n \"/.+\\\\.image$/\",\n \"/.+\\\\.volume$/\"\n ]\n },\n \"renovate-config\": {\n \"managerFilePatterns\": [\n \"renovate.json\",\n \"renovate.jsonc\",\n \"renovate.json5\",\n \".github/renovate.json\",\n \".github/renovate.jsonc\",\n \".github/renovate.json5\",\n \".gitlab/renovate.json\",\n \".gitlab/renovate.jsonc\",\n \".gitlab/renovate.json5\",\n \".renovaterc\",\n \".renovaterc.json\",\n \".renovaterc.jsonc\",\n \".renovaterc.json5\"\n ]\n },\n \"ruby-version\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.ruby-version$/\"\n ],\n \"versioning\": \"ruby\"\n },\n \"runtime-version\": {\n \"managerFilePatterns\": [\n \"/(^\|/)runtime.txt$/\"\n ],\n \"pinDigests\": false\n },\n \"rust-toolchain\": {\n \"commitMessageTopic\": \"Rust\",\n \"managerFilePatterns\": [\n \"/(^\|/)rust-toolchain(\\\\.toml)?$/\"\n ]\n },\n \"sbt\": {\n \"managerFilePatterns\": [\n \"/\\\\.sbt$/\",\n \"/project/[^/]\\\\.scala$/\",\n \"/project/build\\\\.properties$/\",\n \"/(^\|/)repositories$/\"\n ],\n \"versioning\": \"ivy\"\n },\n \"scalafmt\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.scalafmt.conf$/\"\n ]\n },\n \"setup-cfg\": {\n \"managerFilePatterns\": [\n \"/(^\|/)setup\\\\.cfg$/\"\n ],\n \"versioning\": \"pep440\"\n },\n \"smithy\": {\n \"managerFilePatterns\": [\n \"/(^\|/)smithy-build\\\\.json$/\"\n ]\n },\n \"sveltos\": {\n \"managerFilePatterns\": []\n },\n \"swift\": {\n \"managerFilePatterns\": [\n \"/(^\|/)Package\\\\.swift/\"\n ],\n \"versioning\": \"swift\",\n \"pinDigests\": false\n },\n \"tekton\": {\n \"managerFilePatterns\": []\n },\n \"terraform\": {\n \"commitMessageTopic\": \"Terraform {{depName}}\",\n \"managerFilePatterns\": [\n \"*/.tf\",\n \"*/.tofu\"\n ],\n \"pinDigests\": false\n },\n \"terraform-version\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.terraform-version$/\"\n ],\n \"versioning\": \"hashicorp\",\n \"extractVersion\": \"^v(?<version>.)$\"\n },\n \"terragrunt\": {\n \"commitMessageTopic\": \"Terragrunt dependency {{depName}}\",\n \"managerFilePatterns\": [\n \"/(^\|/)terragrunt\\\\.hcl$/\"\n ]\n },\n \"terragrunt-version\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.terragrunt-version$/\"\n ],\n \"versioning\": \"hashicorp\",\n \"extractVersion\": \"^v(?<version>.+)$\"\n },\n \"tflint-plugin\": {\n \"commitMessageTopic\": \"TFLint plugin {{depName}}\",\n \"managerFilePatterns\": [\n \"/\\\\.tflint\\\\.hcl$/\"\n ],\n \"extractVersion\": \"^v(?<version>.)$\"\n },\n \"travis\": {\n \"managerFilePatterns\": [\n \"/^\\\\.travis\\\\.ya?ml$/\"\n ],\n \"major\": {\n \"enabled\": false\n },\n \"versioning\": \"node\"\n },\n \"typst\": {\n \"managerFilePatterns\": [\n \"/\\\\.typ$/\"\n ]\n },\n \"unity3d\": {\n \"managerFilePatterns\": [\n \"/ProjectSettings/ProjectVersion.txt\"\n ]\n },\n \"velaci\": {\n \"managerFilePatterns\": [\n \"/(^\|/)\\\\.vela\\\\.ya?ml$/\"\n ]\n },\n \"vendir\": {\n \"commitMessageTopic\": \"vendir {{depName}}\",\n \"managerFilePatterns\": [\n \"/(^\|/)vendir\\\\.yml$/\"\n ]\n },\n \"woodpecker\": {\n \"managerFilePatterns\": [\n \"/^\\\\.woodpecker(?:/[^/]+)?\\\\.ya?ml$/\"\n ]\n },\n \"xcodegen\": {\n \"managerFilePatterns\": [\n \"/project.yml\"\n ],\n \"pinDigests\": false\n },\n \"regex\": {\n \"pinDigests\": false\n },\n \"jsonata\": {\n \"pinDigests\": false\n }\n};\n"],"mappings":";AACA,MAAa,wBAAiE;CAC5E,OAAO,EACL,uBAAuB,CACrB,cACF,EACF;CACA,WAAW,EACT,uBAAuB,CACrB,6BACF,EACF;CACA,kBAAkB,EAChB,uBAAuB,CACrB,oDACF,EACF;CACA,UAAU,EACR,uBAAuB,CAAC,EAC1B;CACA,QAAQ,EACN,uBAAuB,CACrB,0BACF,EACF;CACA,mBAAmB;EACjB,uBAAuB,CACrB,mCACA,gCACF;EACA,WAAW;CACb;CACA,UAAU,EACR,uBAAuB,CACrB,kCACF,EACF;CACA,kBAAkB;EAChB,uBAAuB,CACrB,gBACF;EACA,cAAc;CAChB;CACA,SAAS,EACP,uBAAuB;EACrB;EACA;EACA;CACF,EACF;CACA,gBAAgB,EACd,uBAAuB,CACrB,4BACF,EACF;CACA,YAAY;EACV,uBAAuB,CACrB,yBACF;EACA,cAAc;EACd,cAAc;CAChB;CACA,SAAS,EACP,uBAAuB,CACrB,aACF,EACF;CACA,uBAAuB,EACrB,uBAAuB,CACrB,oBACF,EACF;CACA,WAAW,EACT,uBAAuB,CACrB,yBACF,EACF;CACA,aAAa;EACX,uBAAuB,CACrB,uBACA,4BACF;EACA,sBAAsB;EACtB,sBAAsB;CACxB;CACA,cAAc;EACZ,sBAAsB;EACtB,uBAAuB,CACrB,wBACF;EACA,cAAc;CAChB;CACA,OAAO;EACL,uBAAuB,CACrB,wBACA,wBACF;EACA,UAAU,EACR,qBAAqB,EACnB,UAAU,8KACZ,EACF;EACA,qBAAqB,EACnB,UAAU,6SACZ;CACF;CACA,eAAe;EACb,uBAAuB,CACrB,wBACF;EACA,cAAc;CAChB;CACA,WAAW;EACT,uBAAuB,CACrB,iBACF;EACA,cAAc;CAChB;CACA,QAAQ,EACN,uBAAuB,CACrB,YACF,EACF;CACA,SAAS;EACP,sBAAsB;EACtB,uBAAuB,CACrB,sBACF;CACF;CACA,UAAU;EACR,uBAAuB,CAAC;EACxB,cAAc;CAChB;CACA,YAAY,EACV,uBAAuB,CACrB,gCACF,EACF;CACA,cAAc,EACZ,uBAAuB,CACrB,2BACF,EACF;CACA,aAAa;EACX,uBAAuB,CACrB,iBACF;EACA,cAAc;CAChB;CACA,YAAY;EACV,uBAAuB,CACrB,kCACF;EACA,cAAc;CAChB;CACA,SAAS;EACP,uBAAuB,CACrB,8BACF;EACA,cAAc;EACd,cAAc;CAChB;CACA,UAAU;EACR,uBAAuB,CACrB,0CACF;EACA,cAAc;CAChB;CACA,YAAY,EACV,uBAAuB,CACrB,kBACF,EACF;CACA,cAAc,EACZ,uBAAuB,CAAC,EAC1B;CACA,QAAQ,EACN,uBAAuB,CACrB,gCACF,EACF;CACA,QAAQ;EACN,uBAAuB,CACrB,uBACA,6BACF;EACA,UAAU,EACR,qBAAqB,EACnB,UAAU,gLACZ,EACF;EACA,qBAAqB,EACnB,UAAU,8gBACZ;CACF;CACA,YAAY;EACV,uBAAuB,CACrB,2BACF;EACA,cAAc;CAChB;CACA,UAAU,EACR,uBAAuB,CACrB,uBACF,EACF;CACA,gBAAgB,EACd,uBAAuB;EACrB;EACA;EACA;CACF,EACF;CACA,kBAAkB,EAChB,uBAAuB,CACrB,0CACF,EACF;CACA,cAAc,EACZ,uBAAuB,CACrB,4CACA,2CACF,EACF;CACA,WAAW,EACT,uBAAuB,CACrB,wBACF,EACF;CACA,SAAS,EACP,uBAAuB,CACrB,sBACF,EACF;CACA,QAAQ,EACN,uBAAuB,CACrB,mCACF,EACF;CACA,OAAO;EACL,uBAAuB,CACrB,oCACA,kBACF;EACA,cAAc;CAChB;CACA,kBAAkB;EAChB,WAAW;EACX,cAAc;EACd,uBAAuB,CACrB,uBACF;CACF;CACA,kBAAkB,EAChB,uBAAuB,CACrB,6FACA,wBACF,EACF;CACA,YAAY,EACV,uBAAuB,CACrB,yBACF,EACF;CACA,oBAAoB,EAClB,uBAAuB,CACrB,yBACF,EACF;CACA,aAAa,EACX,uBAAuB,CAAC,EAC1B;CACA,SAAS;EACP,uBAAuB,CACrB,oBACF;EACA,cAAc;CAChB;CACA,SAAS;EACP,uBAAuB,CACrB,kBACF;EACA,cAAc;CAChB;CACA,UAAU;EACR,uBAAuB;GACrB;GACA;GACA;GACA;GACA;GACA;GACA;EACF;EACA,WAAW;EACX,cAAc;CAChB;CACA,kBAAkB;EAChB,uBAAuB,CACrB,oDACF;EACA,cAAc;CAChB;CACA,iBAAiB;EACf,uBAAuB,CACrB,aACF;EACA,cAAc;CAChB;CACA,qBAAqB;EACnB,mBAAmB,EACjB,UAAU,gCACZ;EACA,sBAAsB;EACtB,uBAAuB,CACrB,8BACF;CACF;CACA,eAAe;EACb,sBAAsB;EACtB,uBAAuB,CACrB,wBACF;EACA,cAAc;CAChB;CACA,YAAY;EACV,mBAAmB,EACjB,UAAU,gCACZ;EACA,sBAAsB;EACtB,uBAAuB,CACrB,0CACA,+CACF;CACF;CACA,YAAY,EACV,uBAAuB,CAAC,EAC1B;CACA,UAAU;EACR,mBAAmB,EACjB,UAAU,gCACZ;EACA,sBAAsB;EACtB,uBAAuB,CACrB,uBACF;CACF;CACA,UAAU;EACR,uBAAuB,CACrB,oBACF;EACA,sBAAsB,CACpB,eACF;EACA,cAAc;CAChB;CACA,0BAA0B,EACxB,uBAAuB,CACrB,yBACF,EACF;CACA,YAAY;EACV,sBAAsB;EACtB,uBAAuB,CACrB,8BACF;CACF;CACA,QAAQ;EACN,uBAAuB,CACrB,aACF;EACA,cAAc;EACd,UAAU,EACR,WAAW,MACb;EACA,cAAc;CAChB;CACA,WAAW,EACT,uBAAuB,CACrB,+BACF,EACF;CACA,mBAAmB;EACjB,uBAAuB,CACrB,4BACF;EACA,cAAc;CAChB;CACA,iBAAiB,EACf,uBAAuB,CACrB,qBACF,EACF;CACA,cAAc,EACZ,uBAAuB,CAAC,EAC1B;CACA,aAAa;EACX,uBAAuB,CACrB,+BACF;EACA,cAAc;CAChB;CACA,aAAa;EACX,uBAAuB,CACrB,uBACF;EACA,cAAc;CAChB;CACA,SAAS,EACP,uBAAuB;EACrB;EACA;EACA;EACA;CACF,EACF;CACA,iBAAiB,EACf,uBAAuB,CACrB,mDACA,uBACF,EACF;CACA,UAAU,EACR,uBAAuB,CACrB,sBACF,EACF;CACA,QAAQ,EACN,uBAAuB,CACrB,kBACF,EACF;CACA,QAAQ;EACN,uBAAuB;GACrB;GACA;GACA;GACA;GACA;GACA;EACF;EACA,cAAc;CAChB;CACA,OAAO,EACL,uBAAuB,CACrB,mBACF,EACF;CACA,OAAO;EACL,uBAAuB,CACrB,qBACF;EACA,sBAAsB;EACtB,sBAAsB;EACtB,WAAW;CACb;CACA,UAAU;EACR,uBAAuB,CACrB,yBACF;EACA,cAAc;CAChB;CACA,OAAO;EACL,uBAAuB;GACrB;GACA;GACA;EACF;EACA,UAAU,EACR,qBAAqB,EACnB,UAAU,8KACZ,EACF;EACA,qBAAqB,EACnB,UAAU,6SACZ;CACF;CACA,SAAS;EACP,uBAAuB;GACrB;GACA;GACA;GACA;EACF;EACA,iBAAiB;EACjB,gBAAgB,CACd;GACE,iBAAiB,CACf,aACF;GACA,iBAAiB;EACnB,CACF;CACF;CACA,OAAO;EACL,uBAAuB,CACrB,kBACF;EACA,cAAc;EACd,cAAc;CAChB;CACA,OAAO,EACL,uBAAuB,CAAC,EAC1B;CACA,QAAQ,EACN,uBAAuB,CACrB,qCACF,EACF;CACA,UAAU,EACR,uBAAuB,CACrB,0BACF,EACF;CACA,UAAU,EACR,uBAAuB,CAAC,EAC1B;CACA,eAAe;EACb,uBAAuB,CAAC;EACxB,uBAAuB;GACrB,WAAW;GACX,eAAe;GACf,uBAAuB;EACzB;CACF;CACA,oBAAoB,EAClB,uBAAuB,CACrB,qDACF,EACF;CACA,aAAa,EACX,uBAAuB,CACrB,oBACF,EACF;CACA,UAAU,EACR,uBAAuB,CACrB,iBACF,EACF;CACA,QAAQ,EACN,uBAAuB,CACrB,4BACA,qBACF,EACF;CACA,UAAU,EACR,uBAAuB,CACrB,0BACF,EACF;CACA,cAAc;EACZ,sBAAsB;EACtB,WAAW;EACX,uBAAuB,CACrB,sCACF;EACA,eAAe,CACb,iSACF;CACF;CACA,SAAS,EACP,uBAAuB,CACrB,gBACF,EACF;CACA,OAAO,EACL,uBAAuB,CACrB,yBACF,EACF;CACA,UAAU,EACR,uBAAuB,CACrB,oBACF,EACF;CACA,SAAS;EACP,uBAAuB,CACrB,2BACF;EACA,cAAc;EACd,cAAc;CAChB;CACA,WAAW,EACT,uBAAuB;EACrB;EACA;EACA;CACF,EACF;CACA,mBAAmB,EACjB,uBAAuB;EACrB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,EACF;CACA,gBAAgB;EACd,uBAAuB,CACrB,yBACF;EACA,cAAc;CAChB;CACA,mBAAmB;EACjB,uBAAuB,CACrB,qBACF;EACA,cAAc;CAChB;CACA,kBAAkB;EAChB,sBAAsB;EACtB,uBAAuB,CACrB,kCACF;CACF;CACA,OAAO;EACL,uBAAuB;GACrB;GACA;GACA;GACA;EACF;EACA,cAAc;CAChB;CACA,YAAY,EACV,uBAAuB,CACrB,0BACF,EACF;CACA,aAAa;EACX,uBAAuB,CACrB,qBACF;EACA,cAAc;CAChB;CACA,UAAU,EACR,uBAAuB,CACrB,6BACF,EACF;CACA,WAAW,EACT,uBAAuB,CAAC,EAC1B;CACA,SAAS;EACP,uBAAuB,CACrB,wBACF;EACA,cAAc;EACd,cAAc;CAChB;CACA,UAAU,EACR,uBAAuB,CAAC,EAC1B;CACA,aAAa;EACX,sBAAsB;EACtB,uBAAuB,CACrB,WACA,WACF;EACA,cAAc;CAChB;CACA,qBAAqB;EACnB,uBAAuB,CACrB,8BACF;EACA,cAAc;EACd,kBAAkB;CACpB;CACA,cAAc;EACZ,sBAAsB;EACtB,uBAAuB,CACrB,0BACF;CACF;CACA,sBAAsB;EACpB,uBAAuB,CACrB,+BACF;EACA,cAAc;EACd,kBAAkB;CACpB;CACA,iBAAiB;EACf,sBAAsB;EACtB,uBAAuB,CACrB,oBACF;EACA,kBAAkB;CACpB;CACA,UAAU;EACR,uBAAuB,CACrB,uBACF;EACA,SAAS,EACP,WAAW,MACb;EACA,cAAc;CAChB;CACA,SAAS,EACP,uBAAuB,CACrB,WACF,EACF;CACA,WAAW,EACT,uBAAuB,CACrB,uCACF,EACF;CACA,UAAU,EACR,uBAAuB,CACrB,yBACF,EACF;CACA,UAAU;EACR,sBAAsB;EACtB,uBAAuB,CACrB,sBACF;CACF;CACA,cAAc,EACZ,uBAAuB,CACrB,sCACF,EACF;CACA,YAAY;EACV,uBAAuB,CACrB,gBACF;EACA,cAAc;CAChB;CACA,SAAS,EACP,cAAc,MAChB;CACA,WAAW,EACT,cAAc,MAChB;AACF"}

package/dist/modules/manager/devcontainer/index.js CHANGED Viewed

@@ -19,7 +19,11 @@ var devcontainer_exports = /* @__PURE__ */ __exportAll({
 const name = "Dev Container";
 const url = "https://code.visualstudio.com/docs/devcontainers/containers";
 const categories = ["docker"];
-const defaultConfig = { managerFilePatterns: ["/^.devcontainer/devcontainer.json$/", "/^.devcontainer.json$/"] };
+const defaultConfig = { managerFilePatterns: [
+	"/^.devcontainer/devcontainer.json$/",
+	"/^.devcontainer.json$/",
+	"/^.devcontainer/[^/]+/devcontainer.json$/"
+] };
 const supportedDatasources = [
 	DockerDatasource.id,
 	GolangVersionDatasource.id,

package/dist/modules/manager/devcontainer/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","names":[],"sources":["../../../../lib/modules/manager/devcontainer/index.ts"],"sourcesContent":["import type { Category } from '../../../constants/index.ts';\nimport { DockerDatasource } from '../../datasource/docker/index.ts';\nimport { GolangVersionDatasource } from '../../datasource/golang-version/index.ts';\nimport { NodeVersionDatasource } from '../../datasource/node-version/index.ts';\nimport { PythonVersionDatasource } from '../../datasource/python-version/index.ts';\nimport { RubyVersionDatasource } from '../../datasource/ruby-version/index.ts';\n\nexport { knownDepTypes } from './dep-types.ts';\nexport { extractPackageFile } from './extract.ts';\n\nexport const name = 'Dev Container';\nexport const url =\n 'https://code.visualstudio.com/docs/devcontainers/containers';\nexport const categories: Category[] = ['docker'];\n\nexport const defaultConfig = {\n managerFilePatterns: [\n '/^.devcontainer/devcontainer.json$/',\n '/^.devcontainer.json$/',\n ],\n};\n\nexport const supportedDatasources = [\n DockerDatasource.id,\n GolangVersionDatasource.id,\n NodeVersionDatasource.id,\n PythonVersionDatasource.id,\n RubyVersionDatasource.id,\n];\n"],"mappings":";;;;;;;;;;;;;;;;;;AAUA,MAAa,OAAO;AACpB,MAAa,MACX;AACF,MAAa,aAAyB,CAAC,QAAQ;AAE/C,MAAa,gBAAgB,EAC3B,qBAAqB,CACnB,~~uCACA,wBACF,~~EACF;AAEA,MAAa,uBAAuB;CAClC,iBAAiB;CACjB,wBAAwB;CACxB,sBAAsB;CACtB,wBAAwB;CACxB,sBAAsB;AACxB"}
1	+ {"version":3,"file":"index.js","names":[],"sources":["../../../../lib/modules/manager/devcontainer/index.ts"],"sourcesContent":["import type { Category } from '../../../constants/index.ts';\nimport { DockerDatasource } from '../../datasource/docker/index.ts';\nimport { GolangVersionDatasource } from '../../datasource/golang-version/index.ts';\nimport { NodeVersionDatasource } from '../../datasource/node-version/index.ts';\nimport { PythonVersionDatasource } from '../../datasource/python-version/index.ts';\nimport { RubyVersionDatasource } from '../../datasource/ruby-version/index.ts';\n\nexport { knownDepTypes } from './dep-types.ts';\nexport { extractPackageFile } from './extract.ts';\n\nexport const name = 'Dev Container';\nexport const url =\n 'https://code.visualstudio.com/docs/devcontainers/containers';\nexport const categories: Category[] = ['docker'];\n\nexport const defaultConfig = {\n managerFilePatterns: [\n '/^.devcontainer/devcontainer.json$/',\n '/^.devcontainer.json$/',\n '/^.devcontainer/[^/]+/devcontainer.json$/',\n ],\n};\n\nexport const supportedDatasources = [\n DockerDatasource.id,\n GolangVersionDatasource.id,\n NodeVersionDatasource.id,\n PythonVersionDatasource.id,\n RubyVersionDatasource.id,\n];\n"],"mappings":";;;;;;;;;;;;;;;;;;AAUA,MAAa,OAAO;AACpB,MAAa,MACX;AACF,MAAa,aAAyB,CAAC,QAAQ;AAE/C,MAAa,gBAAgB,EAC3B,qBAAqB;CACnB;CACA;CACA;AACF,EACF;AAEA,MAAa,uBAAuB;CAClC,iBAAiB;CACjB,wBAAwB;CACxB,sBAAsB;CACtB,wBAAwB;CACxB,sBAAsB;AACxB"}

package/dist/workers/repository/process/vulnerabilities.js CHANGED Viewed

@@ -85,10 +85,12 @@ var Vulnerabilities = class Vulnerabilities {
 		}
 		const packageName = dep.packageName ?? dep.depName;
 		let osvPackageName = packageName;
+		let depType;
 		if (ecosystem === "PyPI") osvPackageName = osvPackageName.toLowerCase().replace(regEx(/[_.-]+/g), "-");
 		else if (ecosystem === "Go" && packageName === "go") {
 			if (dep.depType !== "toolchain") return null;
 			osvPackageName = "stdlib";
+			depType = dep.depType;
 		}
 		try {
 			const osvVulnerabilities = await instrument("get OSV vulnerabilities", () => this.osvOffline.getVulnerabilities(ecosystem, osvPackageName), { attributes: {
@@ -122,6 +124,7 @@ var Vulnerabilities = class Vulnerabilities {
 						osvPackageName,
 						vulnerability: osvVulnerability,
 						affected,
+						depType,
 						depVersion,
 						fixedVersion,
 						datasource: dep.datasource,
@@ -242,7 +245,7 @@ var Vulnerabilities = class Vulnerabilities {
 		return versioningApi.isVersion(version) && versioningApi.isVersion(other) && (versioningApi.equals(version, other) || versioningApi.isGreaterThan(version, other));
 	}
 	vulnerabilityToPackageRules(vul) {
-		const { vulnerability, affected, packageName, depVersion, fixedVersion, datasource, packageFileConfig } = vul;
+		const { vulnerability, affected, packageName, depType, depVersion, fixedVersion, datasource, packageFileConfig } = vul;
 		if (isNullOrUndefined(fixedVersion)) {
 			logger.debug(`No fixed version available for vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`);
 			return null;
@@ -256,6 +259,7 @@ var Vulnerabilities = class Vulnerabilities {
 		return {
 			matchDatasources: [datasource],
 			matchPackageNames: [packageName],
+			...depType ? { matchDepTypes: [depType] } : {},
 			matchCurrentVersion: depVersion,
 			versioning,
 			allowedVersions: fixedVersion,

package/dist/workers/repository/process/vulnerabilities.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"vulnerabilities.js","names":["p.all","getVersioning"],"sources":["../../../../lib/workers/repository/process/vulnerabilities.ts"],"sourcesContent":["// TODO #22198\nimport type { Ecosystem, Osv } from '@renovatebot/osv-offline';\nimport { OsvOffline } from '@renovatebot/osv-offline';\nimport {\n isEmptyArray,\n isNonEmptyString,\n isNullOrUndefined,\n isTruthy,\n} from '@sindresorhus/is';\nimport type { CvssVector } from 'ae-cvss-calculator';\nimport * as _aeCvss from 'ae-cvss-calculator';\nimport { z } from 'zod/v4';\nimport { getManagerConfig, mergeChildConfig } from '../../../config/index.ts';\nimport type { PackageRule, RenovateConfig } from '../../../config/types.ts';\nimport { instrument } from '../../../instrumentation/index.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { getDefaultVersioning } from '../../../modules/datasource/common.ts';\nimport type {\n PackageDependency,\n PackageFile,\n} from '../../../modules/manager/types.ts';\nimport type { VersioningApi } from '../../../modules/versioning/index.ts';\nimport { get as getVersioning } from '../../../modules/versioning/index.ts';\nimport { sanitizeMarkdown } from '../../../util/markdown.ts';\nimport * as p from '../../../util/promises.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { titleCase } from '../../../util/string.ts';\nimport { datasourceToOsvEcosystem } from '../../../util/vulnerability/ecosystem.ts';\nimport {\n getFixedVersionConstraint,\n getLastAffectedVersionConstraint,\n} from '../../../util/vulnerability/utils.ts';\nimport type {\n DependencyVulnerabilities,\n SeverityDetails,\n Vulnerability,\n} from './types.ts';\n\nconst { fromVector } = (_aeCvss as unknown as { default: typeof _aeCvss })\n .default;\n\nexport class Vulnerabilities {\n private static osvOffline: Promise<OsvOffline> \| undefined;\n\n private osvOffline: OsvOffline;\n\n private static readonly datasourceEcosystemMap = datasourceToOsvEcosystem;\n\n private constructor(osvOffline: OsvOffline) {\n this.osvOffline = osvOffline;\n }\n\n private static initialize(): Promise<OsvOffline> {\n // no async here, so osv promise will only be created once\n Vulnerabilities.osvOffline ??= OsvOffline.create();\n return Vulnerabilities.osvOffline;\n }\n\n static async create(): Promise<Vulnerabilities> {\n // intialize osv only once\n const osvOffline = await Vulnerabilities.initialize();\n\n const instance = new Vulnerabilities(osvOffline);\n return instance;\n }\n\n async appendVulnerabilityPackageRules(\n config: RenovateConfig,\n packageFiles: Record<string, PackageFile[]>,\n ): Promise<void> {\n const dependencyVulnerabilities = await this.fetchDependencyVulnerabilities(\n config,\n packageFiles,\n );\n\n config.packageRules ??= [];\n for (const {\n vulnerabilities,\n versioningApi,\n } of dependencyVulnerabilities) {\n const groupPackageRules: PackageRule[] = [];\n for (const vulnerability of vulnerabilities) {\n const rule = this.vulnerabilityToPackageRules(vulnerability);\n if (isNullOrUndefined(rule)) {\n continue;\n }\n groupPackageRules.push(rule);\n }\n this.sortByFixedVersion(groupPackageRules, versioningApi);\n\n config.packageRules.push(...groupPackageRules);\n }\n }\n\n async fetchVulnerabilities(\n config: RenovateConfig,\n packageFiles: Record<string, PackageFile[]>,\n ): Promise<Vulnerability[]> {\n const groups = await this.fetchDependencyVulnerabilities(\n config,\n packageFiles,\n );\n return groups.flatMap((group) => group.vulnerabilities);\n }\n\n private async fetchDependencyVulnerabilities(\n config: RenovateConfig,\n packageFiles: Record<string, PackageFile[]>,\n ): Promise<DependencyVulnerabilities[]> {\n const managers = Object.keys(packageFiles);\n const allManagerJobs = managers.map((manager) =>\n this.fetchManagerVulnerabilities(config, packageFiles, manager),\n );\n return (await Promise.all(allManagerJobs)).flat();\n }\n\n private async fetchManagerVulnerabilities(\n config: RenovateConfig,\n packageFiles: Record<string, PackageFile[]>,\n manager: string,\n ): Promise<DependencyVulnerabilities[]> {\n const managerConfig = getManagerConfig(config, manager);\n const queue = packageFiles[manager].map(\n (pFile) => (): Promise<DependencyVulnerabilities[]> =>\n this.fetchManagerPackageFileVulnerabilities(managerConfig, pFile),\n );\n logger.trace(\n { manager, queueLength: queue.length },\n 'fetchManagerVulnerabilities starting',\n );\n const result = (await p.all(queue)).flat();\n logger.trace({ manager }, 'fetchManagerVulnerabilities finished');\n return result;\n }\n\n private async fetchManagerPackageFileVulnerabilities(\n managerConfig: RenovateConfig,\n pFile: PackageFile,\n ): Promise<DependencyVulnerabilities[]> {\n const { packageFile } = pFile;\n const packageFileConfig = mergeChildConfig(managerConfig, pFile);\n const { manager } = packageFileConfig;\n const queue = pFile.deps.map(\n (dep) => (): Promise<DependencyVulnerabilities \| null> =>\n this.fetchDependencyVulnerability(packageFileConfig, dep),\n );\n logger.trace(\n { manager, packageFile, queueLength: queue.length },\n 'fetchManagerPackageFileVulnerabilities starting with concurrency',\n );\n\n const result = await p.all(queue);\n logger.trace(\n { packageFile },\n 'fetchManagerPackageFileVulnerabilities finished',\n );\n\n return result.filter(isTruthy);\n }\n\n private async fetchDependencyVulnerability(\n packageFileConfig: RenovateConfig & PackageFile,\n dep: PackageDependency,\n ): Promise<DependencyVulnerabilities \| null> {\n const ecosystem = Vulnerabilities.datasourceEcosystemMap[dep.datasource!];\n if (!ecosystem) {\n logger.trace(`Cannot map datasource ${dep.datasource!} to OSV ecosystem`);\n return null;\n }\n\n const packageName = dep.packageName ?? dep.depName!;\n let osvPackageName = packageName;\n if (ecosystem === 'PyPI') {\n // https://peps.python.org/pep-0503/#normalized-names\n osvPackageName = osvPackageName\n .toLowerCase()\n .replace(regEx(/[_.-]+/g), '-');\n } else if (ecosystem === 'Go' && packageName === 'go') {\n if (dep.depType !== 'toolchain') {\n // The `go` directive is source compatibility, not the build toolchain, so we skip it\n return null;\n }\n osvPackageName = 'stdlib';\n }\n\n try {\n const osvVulnerabilities = await instrument(\n 'get OSV vulnerabilities',\n () => this.osvOffline.getVulnerabilities(ecosystem, osvPackageName),\n {\n attributes: {\n osvPackageName,\n ecosystem,\n },\n },\n );\n if (\n isNullOrUndefined(osvVulnerabilities) \|\|\n isEmptyArray(osvVulnerabilities)\n ) {\n logger.trace(\n `No vulnerabilities found in OSV database for ${packageName}`,\n );\n return null;\n }\n\n const depVersion =\n dep.lockedVersion ?? dep.currentVersion ?? dep.currentValue!;\n\n const versioning = dep.versioning ?? getDefaultVersioning(dep.datasource);\n const versioningApi = getVersioning(versioning);\n\n if (!versioningApi.isVersion(depVersion)) {\n logger.debug(\n `Skipping vulnerability lookup for package ${packageName} due to unsupported version ${depVersion}`,\n );\n return null;\n }\n\n const vulnerabilities: Vulnerability[] = [];\n for (const osvVulnerability of osvVulnerabilities) {\n if (osvVulnerability.withdrawn) {\n logger.trace(\n `Skipping withdrawn vulnerability ${osvVulnerability.id}`,\n );\n continue;\n }\n\n this.skipMaliciousPackages(\n ecosystem,\n osvPackageName,\n depVersion,\n versioningApi,\n dep,\n packageFileConfig.manager,\n packageFileConfig.packageFile,\n osvVulnerability,\n );\n\n for (const affected of osvVulnerability.affected ?? []) {\n const isVulnerable = this.isPackageVulnerable(\n ecosystem,\n osvPackageName,\n depVersion,\n affected,\n versioningApi,\n );\n if (!isVulnerable) {\n continue;\n }\n\n logger.debug(\n `Vulnerability ${osvVulnerability.id} affects ${packageName} ${depVersion}`,\n );\n const fixedVersion = this.getFixedVersion(\n ecosystem,\n depVersion,\n affected,\n versioningApi,\n );\n\n vulnerabilities.push({\n packageName,\n osvPackageName,\n vulnerability: osvVulnerability,\n affected,\n depVersion,\n fixedVersion,\n datasource: dep.datasource!,\n packageFileConfig,\n });\n }\n }\n\n return { vulnerabilities, versioningApi };\n } catch (err) {\n logger.warn(\n { err, packageName },\n 'Error fetching vulnerability information for package',\n );\n return null;\n }\n }\n\n private skipMaliciousPackages(\n ecosystem: Ecosystem,\n osvPackageName: string,\n depVersion: string,\n versioningApi: VersioningApi,\n dep: PackageDependency,\n manager: string \| undefined,\n packageFile: string,\n osvVulnerability: Osv.Vulnerability,\n ): void {\n // the OpenSSF's Malicious Packages (https://github.com/ossf/malicious-packages) is a source of advisories through osv.dev, which takes various sources of advisories, and will re-publish them with more specific information about their malicious usage\n if (osvVulnerability.id.startsWith('MAL-')) {\n // is the current dependency vulnerable?\n for (const affected of osvVulnerability.affected ?? []) {\n // is the current dependency vulnerable?\n const isVulnerable = this.isPackageVulnerable(\n ecosystem,\n osvPackageName,\n depVersion,\n affected,\n versioningApi,\n );\n\n if (isVulnerable) {\n logger.debug(\n {\n packageFile: packageFile,\n depName: dep.depName,\n packageName: dep.packageName,\n manager: manager,\n datasource: dep.datasource,\n currentVersion: depVersion,\n },\n `Marking ${dep.depName} as skipReason=malicious-version-in-use, as it is affected by ${osvVulnerability.id}`,\n );\n dep.skipReason = 'malicious-version-in-use';\n dep.skipStage = 'lookup';\n }\n\n // or are any of the updates vulnerable?\n for (const update of dep.updates ?? []) {\n const newVersion = update.newVersion ?? update.newValue!;\n\n const isUpdateVulnerable = this.isPackageVulnerable(\n ecosystem,\n osvPackageName,\n newVersion,\n affected,\n versioningApi,\n );\n\n if (isUpdateVulnerable) {\n logger.debug(\n {\n packageFile: packageFile,\n depName: dep.depName,\n packageName: dep.packageName,\n manager: manager,\n datasource: dep.datasource,\n currentVersion: depVersion,\n newVersion,\n },\n `Marking ${dep.depName}'s update to ${newVersion} as skipReason=malicious-update-proposed, as it is affected by ${osvVulnerability.id}`,\n );\n dep.skipReason = 'malicious-update-proposed';\n dep.skipStage = 'lookup';\n }\n }\n }\n }\n }\n\n private sortByFixedVersion(\n packageRules: PackageRule[],\n versioningApi: VersioningApi,\n ): void {\n const versionsCleaned: Record<string, string> = {};\n for (const rule of packageRules) {\n const version = rule.allowedVersions!;\n versionsCleaned[version] = version.replace(regEx(/[(),=> ]+/g), '');\n }\n packageRules.sort((a, b) =>\n versioningApi.sortVersions(\n versionsCleaned[a.allowedVersions!],\n versionsCleaned[b.allowedVersions!],\n ),\n );\n }\n\n // https://ossf.github.io/osv-schema/#affectedrangesevents-fields\n private sortEvents(\n events: Osv.Event[],\n versioningApi: VersioningApi,\n ): Osv.Event[] {\n const sortedCopy: Osv.Event[] = [];\n let zeroEvent: Osv.Event \| null = null;\n\n for (const event of events) {\n if (event.introduced === '0') {\n zeroEvent = event;\n } else if (versioningApi.isVersion(Object.values(event)[0])) {\n sortedCopy.push(event);\n } else {\n logger.debug({ event }, 'Skipping OSV event with invalid version');\n }\n }\n\n sortedCopy.sort((a, b) =>\n // no pre-processing, as there are only very few values to sort\n versioningApi.sortVersions(Object.values(a)[0], Object.values(b)[0]),\n );\n\n if (zeroEvent) {\n sortedCopy.unshift(zeroEvent);\n }\n\n return sortedCopy;\n }\n\n private isPackageAffected(\n ecosystem: Ecosystem,\n osvPackageName: string,\n affected: Osv.Affected,\n ): boolean {\n const pkg = affected.package;\n if (pkg?.name !== osvPackageName) {\n return false;\n }\n\n // Match exact ecosystems and OSV sub-ecosystems (e.g. Packagist:https://packages.drupal.org/8).\n return (\n pkg.ecosystem === ecosystem \|\| pkg.ecosystem.startsWith(`${ecosystem}:`)\n );\n }\n\n private includedInVersions(\n depVersion: string,\n affected: Osv.Affected,\n ): boolean {\n return !!affected.versions?.includes(depVersion);\n }\n\n private includedInRanges(\n depVersion: string,\n affected: Osv.Affected,\n versioningApi: VersioningApi,\n ): boolean {\n for (const range of affected.ranges ?? []) {\n if (range.type === 'GIT') {\n continue;\n }\n\n let vulnerable = false;\n for (const event of this.sortEvents(range.events, versioningApi)) {\n if (\n isNonEmptyString(event.introduced) &&\n (event.introduced === '0' \|\|\n this.isVersionGtOrEq(depVersion, event.introduced, versioningApi))\n ) {\n vulnerable = true;\n } else if (\n isNonEmptyString(event.fixed) &&\n this.isVersionGtOrEq(depVersion, event.fixed, versioningApi)\n ) {\n vulnerable = false;\n } else if (\n isNonEmptyString(event.last_affected) &&\n this.isVersionGt(depVersion, event.last_affected, versioningApi)\n ) {\n vulnerable = false;\n }\n }\n\n if (vulnerable) {\n return true;\n }\n }\n\n return false;\n }\n\n // https://ossf.github.io/osv-schema/#evaluation\n private isPackageVulnerable(\n ecosystem: Ecosystem,\n osvPackageName: string,\n depVersion: string,\n affected: Osv.Affected,\n versioningApi: VersioningApi,\n ): boolean {\n return (\n this.isPackageAffected(ecosystem, osvPackageName, affected) &&\n (this.includedInVersions(depVersion, affected) \|\|\n this.includedInRanges(depVersion, affected, versioningApi))\n );\n }\n\n private getFixedVersion(\n ecosystem: Ecosystem,\n depVersion: string,\n affected: Osv.Affected,\n versioningApi: VersioningApi,\n ): string \| null {\n const fixedVersions: string[] = [];\n const lastAffectedVersions: string[] = [];\n\n for (const range of affected.ranges ?? []) {\n if (range.type === 'GIT') {\n continue;\n }\n\n for (const event of range.events) {\n if (\n isNonEmptyString(event.fixed) &&\n versioningApi.isVersion(event.fixed)\n ) {\n fixedVersions.push(event.fixed);\n } else if (\n isNonEmptyString(event.last_affected) &&\n versioningApi.isVersion(event.last_affected)\n ) {\n lastAffectedVersions.push(event.last_affected);\n }\n }\n }\n\n fixedVersions.sort((a, b) => versioningApi.sortVersions(a, b));\n const fixedVersion = fixedVersions.find((version) =>\n this.isVersionGt(version, depVersion, versioningApi),\n );\n if (fixedVersion) {\n return this.getFixedVersionByEcosystem(fixedVersion, ecosystem);\n }\n\n lastAffectedVersions.sort((a, b) => versioningApi.sortVersions(a, b));\n const lastAffected = lastAffectedVersions.find((version) =>\n this.isVersionGtOrEq(version, depVersion, versioningApi),\n );\n if (lastAffected) {\n return this.getLastAffectedByEcosystem(lastAffected, ecosystem);\n }\n\n return null;\n }\n\n private getFixedVersionByEcosystem(\n fixedVersion: string,\n ecosystem: Ecosystem,\n ): string {\n return getFixedVersionConstraint(fixedVersion, ecosystem);\n }\n\n private getLastAffectedByEcosystem(\n lastAffected: string,\n ecosystem: Ecosystem,\n ): string {\n return getLastAffectedVersionConstraint(lastAffected, ecosystem);\n }\n\n private isVersionGt(\n version: string,\n other: string,\n versioningApi: VersioningApi,\n ): boolean {\n return (\n versioningApi.isVersion(version) &&\n versioningApi.isVersion(other) &&\n versioningApi.isGreaterThan(version, other)\n );\n }\n\n private isVersionGtOrEq(\n version: string,\n other: string,\n versioningApi: VersioningApi,\n ): boolean {\n return (\n versioningApi.isVersion(version) &&\n versioningApi.isVersion(other) &&\n (versioningApi.equals(version, other) \|\|\n versioningApi.isGreaterThan(version, other))\n );\n }\n\n private vulnerabilityToPackageRules(vul: Vulnerability): PackageRule \| null {\n const {\n vulnerability,\n affected,\n packageName,\n depVersion,\n fixedVersion,\n datasource,\n packageFileConfig,\n } = vul;\n if (isNullOrUndefined(fixedVersion)) {\n logger.debug(\n `No fixed version available for vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`,\n );\n return null;\n }\n\n // we don't know if the dependency has a `versioning` applied to it already, so we have to use the default for the datasource\n const versioning = getDefaultVersioning(datasource);\n\n logger.debug(\n {\n datasource,\n versioning,\n },\n\n `Setting allowed version ${fixedVersion} to fix vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`,\n );\n\n const severityDetails = this.extractSeverityDetails(\n vulnerability,\n affected,\n );\n\n return {\n matchDatasources: [datasource],\n matchPackageNames: [packageName],\n matchCurrentVersion: depVersion,\n versioning,\n allowedVersions: fixedVersion,\n isVulnerabilityAlert: true,\n vulnerabilitySeverity: severityDetails.severityLevel,\n prBodyNotes: this.generatePrBodyNotes(vulnerability, affected),\n force: {\n ...packageFileConfig.vulnerabilityAlerts,\n },\n };\n }\n\n static evaluateCvssVector(vector: string): [string, string] {\n const CvssJson = z.object({\n baseScore: z.number().default(0.0),\n baseSeverity: z.string().toUpperCase().default('UNKNOWN'),\n });\n\n try {\n const parsedCvssScore: CvssVector<any> \| null = fromVector(vector);\n const res = CvssJson.parse(parsedCvssScore?.createJsonSchema());\n\n return [res.baseScore.toFixed(1), res.baseSeverity];\n } catch {\n logger.debug(`Error processing CVSS vector ${vector}`);\n }\n\n return ['', ''];\n }\n\n private generatePrBodyNotes(\n vulnerability: Osv.Vulnerability,\n affected: Osv.Affected,\n ): string[] {\n let aliases = [vulnerability.id].concat(vulnerability.aliases ?? []).sort();\n aliases = aliases.map((id) => {\n if (id.startsWith('CVE-')) {\n return `[${id}](https://nvd.nist.gov/vuln/detail/${id})`;\n }\n if (id.startsWith('GHSA-')) {\n return `[${id}](https://github.com/advisories/${id})`;\n }\n if (id.startsWith('GO-')) {\n return `[${id}](https://pkg.go.dev/vuln/${id})`;\n }\n if (id.startsWith('RUSTSEC-')) {\n return `[${id}](https://rustsec.org/advisories/${id}.html)`;\n }\n\n return id;\n });\n\n let content = '\\n\\n---\\n\\n### ';\n content += vulnerability.summary ? `${vulnerability.summary}\\n` : '';\n content += `${aliases.join(' / ')}\\n`;\n content += `\\n<details>\\n<summary>More information</summary>\\n`;\n\n const details = vulnerability.details?.replace(\n regEx(/^#{1,4} /gm),\n '##### ',\n );\n content += `#### Details\\n${details ?? 'No details.'}\\n`;\n\n content += '#### Severity\\n';\n const severityDetails = this.extractSeverityDetails(\n vulnerability,\n affected,\n );\n\n if (severityDetails.cvssVector) {\n content += `- CVSS Score: ${severityDetails.score}\\n`;\n content += `- Vector String: \\`${severityDetails.cvssVector}\\`\\n`;\n } else {\n content += `${titleCase(severityDetails.severityLevel)}\\n`;\n }\n\n content += `\\n#### References\\n${\n vulnerability.references\n ?.map((ref) => {\n return `- [${ref.url}](${ref.url})`;\n })\n .join('\\n') ?? 'No references.'\n }`;\n\n let attribution = '';\n if (vulnerability.id.startsWith('GHSA-')) {\n attribution = ` and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md))`;\n } else if (vulnerability.id.startsWith('GO-')) {\n attribution = ` and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license))`;\n } else if (vulnerability.id.startsWith('PYSEC-')) {\n attribution = ` and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE))`;\n } else if (vulnerability.id.startsWith('RUSTSEC-')) {\n attribution = ` and the [Rust Advisory Database](https://github.com/RustSec/advisory-db) ([CC0 1.0](https://github.com/rustsec/advisory-db/blob/main/LICENSE.txt))`;\n }\n content += `\\n\\nThis data is provided by [OSV](https://osv.dev/vulnerability/${vulnerability.id})${attribution}.\\n`;\n content += `</details>`;\n\n return [sanitizeMarkdown(content)];\n }\n\n private extractSeverityDetails(\n vulnerability: Osv.Vulnerability,\n affected: Osv.Affected,\n ): SeverityDetails {\n let severityLevel = 'UNKNOWN';\n let score = 'Unknown';\n\n const cvssVector =\n vulnerability.severity?.find((e) => e.type === 'CVSS_V4')?.score ??\n vulnerability.severity?.find((e) => e.type === 'CVSS_V3')?.score ??\n (affected.database_specific?.cvss as string); // RUSTSEC\n\n if (cvssVector) {\n const [baseScore, severity] =\n Vulnerabilities.evaluateCvssVector(cvssVector);\n severityLevel = severity ? severity.toUpperCase() : 'UNKNOWN';\n score = baseScore\n ? `${baseScore} / 10 (${titleCase(severityLevel)})`\n : 'Unknown';\n } else if (\n vulnerability.id.startsWith('GHSA-') &&\n vulnerability.database_specific?.severity\n ) {\n const severity = vulnerability.database_specific.severity as string;\n severityLevel = severity.toUpperCase();\n }\n\n return {\n cvssVector,\n score,\n severityLevel,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,MAAM,EAAE,eAAgB,QACrB;AAEH,IAAa,kBAAb,MAAa,gBAAgB;CAC3B,OAAe;CAEf;CAEA,OAAwB,yBAAyB;CAEjD,YAAoB,YAAwB;EAC1C,KAAK,aAAa;CACpB;CAEA,OAAe,aAAkC;EAE/C,gBAAgB,eAAe,WAAW,OAAO;EACjD,OAAO,gBAAgB;CACzB;CAEA,aAAa,SAAmC;EAE9C,MAAM,aAAa,MAAM,gBAAgB,WAAW;EAGpD,OAAO,IADc,gBAAgB,UACvB;CAChB;CAEA,MAAM,gCACJ,QACA,cACe;EACf,MAAM,4BAA4B,MAAM,KAAK,+BAC3C,QACA,YACF;EAEA,OAAO,iBAAiB,CAAC;EACzB,KAAK,MAAM,EACT,iBACA,mBACG,2BAA2B;GAC9B,MAAM,oBAAmC,CAAC;GAC1C,KAAK,MAAM,iBAAiB,iBAAiB;IAC3C,MAAM,OAAO,KAAK,4BAA4B,aAAa;IAC3D,IAAI,kBAAkB,IAAI,GACxB;IAEF,kBAAkB,KAAK,IAAI;GAC7B;GACA,KAAK,mBAAmB,mBAAmB,aAAa;GAExD,OAAO,aAAa,KAAK,GAAG,iBAAiB;EAC/C;CACF;CAEA,MAAM,qBACJ,QACA,cAC0B;EAK1B,QAAO,MAJc,KAAK,+BACxB,QACA,YACF,EAAA,CACc,SAAS,UAAU,MAAM,eAAe;CACxD;CAEA,MAAc,+BACZ,QACA,cACsC;EAEtC,MAAM,iBADW,OAAO,KAAK,YACC,CAAC,CAAC,KAAK,YACnC,KAAK,4BAA4B,QAAQ,cAAc,OAAO,CAChE;EACA,QAAQ,MAAM,QAAQ,IAAI,cAAc,EAAA,CAAG,KAAK;CAClD;CAEA,MAAc,4BACZ,QACA,cACA,SACsC;EACtC,MAAM,gBAAgB,iBAAiB,QAAQ,OAAO;EACtD,MAAM,QAAQ,aAAa,QAAQ,CAAC,KACjC,gBACC,KAAK,uCAAuC,eAAe,KAAK,CACpE;EACA,OAAO,MACL;GAAE;GAAS,aAAa,MAAM;EAAO,GACrC,sCACF;EACA,MAAM,UAAU,MAAMA,IAAM,KAAK,EAAA,CAAG,KAAK;EACzC,OAAO,MAAM,EAAE,QAAQ,GAAG,sCAAsC;EAChE,OAAO;CACT;CAEA,MAAc,uCACZ,eACA,OACsC;EACtC,MAAM,EAAE,gBAAgB;EACxB,MAAM,oBAAoB,iBAAiB,eAAe,KAAK;EAC/D,MAAM,EAAE,YAAY;EACpB,MAAM,QAAQ,MAAM,KAAK,KACtB,cACC,KAAK,6BAA6B,mBAAmB,GAAG,CAC5D;EACA,OAAO,MACL;GAAE;GAAS;GAAa,aAAa,MAAM;EAAO,GAClD,kEACF;EAEA,MAAM,SAAS,MAAMA,IAAM,KAAK;EAChC,OAAO,MACL,EAAE,YAAY,GACd,iDACF;EAEA,OAAO,OAAO,OAAO,QAAQ;CAC/B;CAEA,MAAc,6BACZ,mBACA,KAC2C;EAC3C,MAAM,YAAY,gBAAgB,uBAAuB,IAAI;EAC7D,IAAI,CAAC,WAAW;GACd,OAAO,MAAM,yBAAyB,IAAI,WAAY,kBAAkB;GACxE,OAAO;EACT;EAEA,MAAM,cAAc,IAAI,eAAe,IAAI;EAC3C,IAAI,iBAAiB;EACrB,IAAI,cAAc,QAEhB,iBAAiB,eACd,YAAY,CAAC,CACb,QAAQ,MAAM,SAAS,GAAG,GAAG;OAC3B,IAAI,cAAc,QAAQ,gBAAgB,MAAM;GACrD,IAAI,IAAI,YAAY,aAElB,OAAO;GAET,iBAAiB;EACnB;EAEA,IAAI;GACF,MAAM,qBAAqB,MAAM,WAC/B,iCACM,KAAK,WAAW,mBAAmB,WAAW,cAAc,GAClE,EACE,YAAY;IACV;IACA;GACF,EACF,CACF;GACA,IACE,kBAAkB,kBAAkB,KACpC,aAAa,kBAAkB,GAC/B;IACA,OAAO,MACL,gDAAgD,aAClD;IACA,OAAO;GACT;GAEA,MAAM,aACJ,IAAI,iBAAiB,IAAI,kBAAkB,IAAI;GAEjD,MAAM,aAAa,IAAI,cAAc,qBAAqB,IAAI,UAAU;GACxE,MAAM,gBAAgBC,IAAc,UAAU;GAE9C,IAAI,CAAC,cAAc,UAAU,UAAU,GAAG;IACxC,OAAO,MACL,6CAA6C,YAAY,8BAA8B,YACzF;IACA,OAAO;GACT;GAEA,MAAM,kBAAmC,CAAC;GAC1C,KAAK,MAAM,oBAAoB,oBAAoB;IACjD,IAAI,iBAAiB,WAAW;KAC9B,OAAO,MACL,oCAAoC,iBAAiB,IACvD;KACA;IACF;IAEA,KAAK,sBACH,WACA,gBACA,YACA,eACA,KACA,kBAAkB,SAClB,kBAAkB,aAClB,gBACF;IAEA,KAAK,MAAM,YAAY,iBAAiB,YAAY,CAAC,GAAG;KAQtD,IAAI,CAPiB,KAAK,oBACxB,WACA,gBACA,YACA,UACA,aAEc,GACd;KAGF,OAAO,MACL,iBAAiB,iBAAiB,GAAG,WAAW,YAAY,GAAG,YACjE;KACA,MAAM,eAAe,KAAK,gBACxB,WACA,YACA,UACA,aACF;KAEA,gBAAgB,KAAK;MACnB;MACA;MACA,eAAe;MACf;MACA;MACA;MACA,YAAY,IAAI;MAChB;KACF,CAAC;IACH;GACF;GAEA,OAAO;IAAE;IAAiB;GAAc;EAC1C,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK;GAAY,GACnB,sDACF;GACA,OAAO;EACT;CACF;CAEA,sBACE,WACA,gBACA,YACA,eACA,KACA,SACA,aACA,kBACM;EAEN,IAAI,iBAAiB,GAAG,WAAW,MAAM,GAEvC,KAAK,MAAM,YAAY,iBAAiB,YAAY,CAAC,GAAG;GAUtD,IARqB,KAAK,oBACxB,WACA,gBACA,YACA,UACA,aAGa,GAAG;IAChB,OAAO,MACL;KACe;KACb,SAAS,IAAI;KACb,aAAa,IAAI;KACR;KACT,YAAY,IAAI;KAChB,gBAAgB;IAClB,GACA,WAAW,IAAI,QAAQ,gEAAgE,iBAAiB,IAC1G;IACA,IAAI,aAAa;IACjB,IAAI,YAAY;GAClB;GAGA,KAAK,MAAM,UAAU,IAAI,WAAW,CAAC,GAAG;IACtC,MAAM,aAAa,OAAO,cAAc,OAAO;IAU/C,IAR2B,KAAK,oBAC9B,WACA,gBACA,YACA,UACA,aAGmB,GAAG;KACtB,OAAO,MACL;MACe;MACb,SAAS,IAAI;MACb,aAAa,IAAI;MACR;MACT,YAAY,IAAI;MAChB,gBAAgB;MAChB;KACF,GACA,WAAW,IAAI,QAAQ,eAAe,WAAW,iEAAiE,iBAAiB,IACrI;KACA,IAAI,aAAa;KACjB,IAAI,YAAY;IAClB;GACF;EACF;CAEJ;CAEA,mBACE,cACA,eACM;EACN,MAAM,kBAA0C,CAAC;EACjD,KAAK,MAAM,QAAQ,cAAc;GAC/B,MAAM,UAAU,KAAK;GACrB,gBAAgB,WAAW,QAAQ,QAAQ,MAAM,YAAY,GAAG,EAAE;EACpE;EACA,aAAa,MAAM,GAAG,MACpB,cAAc,aACZ,gBAAgB,EAAE,kBAClB,gBAAgB,EAAE,gBACpB,CACF;CACF;CAGA,WACE,QACA,eACa;EACb,MAAM,aAA0B,CAAC;EACjC,IAAI,YAA8B;EAElC,KAAK,MAAM,SAAS,QAClB,IAAI,MAAM,eAAe,KACvB,YAAY;OACP,IAAI,cAAc,UAAU,OAAO,OAAO,KAAK,CAAC,CAAC,EAAE,GACxD,WAAW,KAAK,KAAK;OAErB,OAAO,MAAM,EAAE,MAAM,GAAG,yCAAyC;EAIrE,WAAW,MAAM,GAAG,MAElB,cAAc,aAAa,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CACrE;EAEA,IAAI,WACF,WAAW,QAAQ,SAAS;EAG9B,OAAO;CACT;CAEA,kBACE,WACA,gBACA,UACS;EACT,MAAM,MAAM,SAAS;EACrB,IAAI,KAAK,SAAS,gBAChB,OAAO;EAIT,OACE,IAAI,cAAc,aAAa,IAAI,UAAU,WAAW,GAAG,UAAU,EAAE;CAE3E;CAEA,mBACE,YACA,UACS;EACT,OAAO,CAAC,CAAC,SAAS,UAAU,SAAS,UAAU;CACjD;CAEA,iBACE,YACA,UACA,eACS;EACT,KAAK,MAAM,SAAS,SAAS,UAAU,CAAC,GAAG;GACzC,IAAI,MAAM,SAAS,OACjB;GAGF,IAAI,aAAa;GACjB,KAAK,MAAM,SAAS,KAAK,WAAW,MAAM,QAAQ,aAAa,GAC7D,IACE,iBAAiB,MAAM,UAAU,MAChC,MAAM,eAAe,OACpB,KAAK,gBAAgB,YAAY,MAAM,YAAY,aAAa,IAElE,aAAa;QACR,IACL,iBAAiB,MAAM,KAAK,KAC5B,KAAK,gBAAgB,YAAY,MAAM,OAAO,aAAa,GAE3D,aAAa;QACR,IACL,iBAAiB,MAAM,aAAa,KACpC,KAAK,YAAY,YAAY,MAAM,eAAe,aAAa,GAE/D,aAAa;GAIjB,IAAI,YACF,OAAO;EAEX;EAEA,OAAO;CACT;CAGA,oBACE,WACA,gBACA,YACA,UACA,eACS;EACT,OACE,KAAK,kBAAkB,WAAW,gBAAgB,QAAQ,MACzD,KAAK,mBAAmB,YAAY,QAAQ,KAC3C,KAAK,iBAAiB,YAAY,UAAU,aAAa;CAE/D;CAEA,gBACE,WACA,YACA,UACA,eACe;EACf,MAAM,gBAA0B,CAAC;EACjC,MAAM,uBAAiC,CAAC;EAExC,KAAK,MAAM,SAAS,SAAS,UAAU,CAAC,GAAG;GACzC,IAAI,MAAM,SAAS,OACjB;GAGF,KAAK,MAAM,SAAS,MAAM,QACxB,IACE,iBAAiB,MAAM,KAAK,KAC5B,cAAc,UAAU,MAAM,KAAK,GAEnC,cAAc,KAAK,MAAM,KAAK;QACzB,IACL,iBAAiB,MAAM,aAAa,KACpC,cAAc,UAAU,MAAM,aAAa,GAE3C,qBAAqB,KAAK,MAAM,aAAa;EAGnD;EAEA,cAAc,MAAM,GAAG,MAAM,cAAc,aAAa,GAAG,CAAC,CAAC;EAC7D,MAAM,eAAe,cAAc,MAAM,YACvC,KAAK,YAAY,SAAS,YAAY,aAAa,CACrD;EACA,IAAI,cACF,OAAO,KAAK,2BAA2B,cAAc,SAAS;EAGhE,qBAAqB,MAAM,GAAG,MAAM,cAAc,aAAa,GAAG,CAAC,CAAC;EACpE,MAAM,eAAe,qBAAqB,MAAM,YAC9C,KAAK,gBAAgB,SAAS,YAAY,aAAa,CACzD;EACA,IAAI,cACF,OAAO,KAAK,2BAA2B,cAAc,SAAS;EAGhE,OAAO;CACT;CAEA,2BACE,cACA,WACQ;EACR,OAAO,0BAA0B,cAAc,SAAS;CAC1D;CAEA,2BACE,cACA,WACQ;EACR,OAAO,iCAAiC,cAAc,SAAS;CACjE;CAEA,YACE,SACA,OACA,eACS;EACT,OACE,cAAc,UAAU,OAAO,KAC/B,cAAc,UAAU,KAAK,KAC7B,cAAc,cAAc,SAAS,KAAK;CAE9C;CAEA,gBACE,SACA,OACA,eACS;EACT,OACE,cAAc,UAAU,OAAO,KAC/B,cAAc,UAAU,KAAK,MAC5B,cAAc,OAAO,SAAS,KAAK,KAClC,cAAc,cAAc,SAAS,KAAK;CAEhD;CAEA,4BAAoC,KAAwC;EAC1E,MAAM,EACJ,eACA,UACA,aACA,YACA,cACA,YACA,sBACE;EACJ,IAAI,kBAAkB,YAAY,GAAG;GACnC,OAAO,MACL,gDAAgD,cAAc,GAAG,MAAM,YAAY,GAAG,YACxF;GACA,OAAO;EACT;EAGA,MAAM,aAAa,qBAAqB,UAAU;EAElD,OAAO,MACL;GACE;GACA;EACF,GAEA,2BAA2B,aAAa,wBAAwB,cAAc,GAAG,MAAM,YAAY,GAAG,YACxG;EAEA,MAAM,kBAAkB,KAAK,uBAC3B,eACA,QACF;EAEA,OAAO;GACL,kBAAkB,CAAC,UAAU;GAC7B,mBAAmB,CAAC,WAAW;GAC/B,qBAAqB;GACrB;GACA,iBAAiB;GACjB,sBAAsB;GACtB,uBAAuB,gBAAgB;GACvC,aAAa,KAAK,oBAAoB,eAAe,QAAQ;GAC7D,OAAO,EACL,GAAG,kBAAkB,oBACvB;EACF;CACF;CAEA,OAAO,mBAAmB,QAAkC;EAC1D,MAAM,WAAW,EAAE,OAAO;GACxB,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAG;GACjC,cAAc,EAAE,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,SAAS;EAC1D,CAAC;EAED,IAAI;GACF,MAAM,kBAA0C,WAAW,MAAM;GACjE,MAAM,MAAM,SAAS,MAAM,iBAAiB,iBAAiB,CAAC;GAE9D,OAAO,CAAC,IAAI,UAAU,QAAQ,CAAC,GAAG,IAAI,YAAY;EACpD,QAAQ;GACN,OAAO,MAAM,gCAAgC,QAAQ;EACvD;EAEA,OAAO,CAAC,IAAI,EAAE;CAChB;CAEA,oBACE,eACA,UACU;EACV,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,cAAc,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;EAC1E,UAAU,QAAQ,KAAK,OAAO;GAC5B,IAAI,GAAG,WAAW,MAAM,GACtB,OAAO,IAAI,GAAG,qCAAqC,GAAG;GAExD,IAAI,GAAG,WAAW,OAAO,GACvB,OAAO,IAAI,GAAG,kCAAkC,GAAG;GAErD,IAAI,GAAG,WAAW,KAAK,GACrB,OAAO,IAAI,GAAG,4BAA4B,GAAG;GAE/C,IAAI,GAAG,WAAW,UAAU,GAC1B,OAAO,IAAI,GAAG,mCAAmC,GAAG;GAGtD,OAAO;EACT,CAAC;EAED,IAAI,UAAU;EACd,WAAW,cAAc,UAAU,GAAG,cAAc,QAAQ,MAAM;EAClE,WAAW,GAAG,QAAQ,KAAK,KAAK,EAAE;EAClC,WAAW;EAEX,MAAM,UAAU,cAAc,SAAS,QACrC,MAAM,YAAY,GAClB,QACF;EACA,WAAW,iBAAiB,WAAW,cAAc;EAErD,WAAW;EACX,MAAM,kBAAkB,KAAK,uBAC3B,eACA,QACF;EAEA,IAAI,gBAAgB,YAAY;GAC9B,WAAW,iBAAiB,gBAAgB,MAAM;GAClD,WAAW,sBAAsB,gBAAgB,WAAW;EAC9D,OACE,WAAW,GAAG,UAAU,gBAAgB,aAAa,EAAE;EAGzD,WAAW,sBACT,cAAc,YACV,KAAK,QAAQ;GACb,OAAO,MAAM,IAAI,IAAI,IAAI,IAAI,IAAI;EACnC,CAAC,CAAC,CACD,KAAK,IAAI,KAAK;EAGnB,IAAI,cAAc;EAClB,IAAI,cAAc,GAAG,WAAW,OAAO,GACrC,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,KAAK,GAC1C,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,QAAQ,GAC7C,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,UAAU,GAC/C,cAAc;EAEhB,WAAW,oEAAoE,cAAc,GAAG,GAAG,YAAY;EAC/G,WAAW;EAEX,OAAO,CAAC,iBAAiB,OAAO,CAAC;CACnC;CAEA,uBACE,eACA,UACiB;EACjB,IAAI,gBAAgB;EACpB,IAAI,QAAQ;EAEZ,MAAM,aACJ,cAAc,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,SAC3D,cAAc,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,SAC1D,SAAS,mBAAmB;EAE/B,IAAI,YAAY;GACd,MAAM,CAAC,WAAW,YAChB,gBAAgB,mBAAmB,UAAU;GAC/C,gBAAgB,WAAW,SAAS,YAAY,IAAI;GACpD,QAAQ,YACJ,GAAG,UAAU,SAAS,UAAU,aAAa,EAAE,KAC/C;EACN,OAAO,IACL,cAAc,GAAG,WAAW,OAAO,KACnC,cAAc,mBAAmB,UAGjC,gBADiB,cAAc,kBAAkB,SACxB,YAAY;EAGvC,OAAO;GACL;GACA;GACA;EACF;CACF;AACF"}
1	+ {"version":3,"file":"vulnerabilities.js","names":["p.all","getVersioning"],"sources":["../../../../lib/workers/repository/process/vulnerabilities.ts"],"sourcesContent":["// TODO #22198\nimport type { Ecosystem, Osv } from '@renovatebot/osv-offline';\nimport { OsvOffline } from '@renovatebot/osv-offline';\nimport {\n isEmptyArray,\n isNonEmptyString,\n isNullOrUndefined,\n isTruthy,\n} from '@sindresorhus/is';\nimport type { CvssVector } from 'ae-cvss-calculator';\nimport * as _aeCvss from 'ae-cvss-calculator';\nimport { z } from 'zod/v4';\nimport { getManagerConfig, mergeChildConfig } from '../../../config/index.ts';\nimport type { PackageRule, RenovateConfig } from '../../../config/types.ts';\nimport { instrument } from '../../../instrumentation/index.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { getDefaultVersioning } from '../../../modules/datasource/common.ts';\nimport type {\n PackageDependency,\n PackageFile,\n} from '../../../modules/manager/types.ts';\nimport type { VersioningApi } from '../../../modules/versioning/index.ts';\nimport { get as getVersioning } from '../../../modules/versioning/index.ts';\nimport { sanitizeMarkdown } from '../../../util/markdown.ts';\nimport * as p from '../../../util/promises.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { titleCase } from '../../../util/string.ts';\nimport { datasourceToOsvEcosystem } from '../../../util/vulnerability/ecosystem.ts';\nimport {\n getFixedVersionConstraint,\n getLastAffectedVersionConstraint,\n} from '../../../util/vulnerability/utils.ts';\nimport type {\n DependencyVulnerabilities,\n SeverityDetails,\n Vulnerability,\n} from './types.ts';\n\nconst { fromVector } = (_aeCvss as unknown as { default: typeof _aeCvss })\n .default;\n\nexport class Vulnerabilities {\n private static osvOffline: Promise<OsvOffline> \| undefined;\n\n private osvOffline: OsvOffline;\n\n private static readonly datasourceEcosystemMap = datasourceToOsvEcosystem;\n\n private constructor(osvOffline: OsvOffline) {\n this.osvOffline = osvOffline;\n }\n\n private static initialize(): Promise<OsvOffline> {\n // no async here, so osv promise will only be created once\n Vulnerabilities.osvOffline ??= OsvOffline.create();\n return Vulnerabilities.osvOffline;\n }\n\n static async create(): Promise<Vulnerabilities> {\n // intialize osv only once\n const osvOffline = await Vulnerabilities.initialize();\n\n const instance = new Vulnerabilities(osvOffline);\n return instance;\n }\n\n async appendVulnerabilityPackageRules(\n config: RenovateConfig,\n packageFiles: Record<string, PackageFile[]>,\n ): Promise<void> {\n const dependencyVulnerabilities = await this.fetchDependencyVulnerabilities(\n config,\n packageFiles,\n );\n\n config.packageRules ??= [];\n for (const {\n vulnerabilities,\n versioningApi,\n } of dependencyVulnerabilities) {\n const groupPackageRules: PackageRule[] = [];\n for (const vulnerability of vulnerabilities) {\n const rule = this.vulnerabilityToPackageRules(vulnerability);\n if (isNullOrUndefined(rule)) {\n continue;\n }\n groupPackageRules.push(rule);\n }\n this.sortByFixedVersion(groupPackageRules, versioningApi);\n\n config.packageRules.push(...groupPackageRules);\n }\n }\n\n async fetchVulnerabilities(\n config: RenovateConfig,\n packageFiles: Record<string, PackageFile[]>,\n ): Promise<Vulnerability[]> {\n const groups = await this.fetchDependencyVulnerabilities(\n config,\n packageFiles,\n );\n return groups.flatMap((group) => group.vulnerabilities);\n }\n\n private async fetchDependencyVulnerabilities(\n config: RenovateConfig,\n packageFiles: Record<string, PackageFile[]>,\n ): Promise<DependencyVulnerabilities[]> {\n const managers = Object.keys(packageFiles);\n const allManagerJobs = managers.map((manager) =>\n this.fetchManagerVulnerabilities(config, packageFiles, manager),\n );\n return (await Promise.all(allManagerJobs)).flat();\n }\n\n private async fetchManagerVulnerabilities(\n config: RenovateConfig,\n packageFiles: Record<string, PackageFile[]>,\n manager: string,\n ): Promise<DependencyVulnerabilities[]> {\n const managerConfig = getManagerConfig(config, manager);\n const queue = packageFiles[manager].map(\n (pFile) => (): Promise<DependencyVulnerabilities[]> =>\n this.fetchManagerPackageFileVulnerabilities(managerConfig, pFile),\n );\n logger.trace(\n { manager, queueLength: queue.length },\n 'fetchManagerVulnerabilities starting',\n );\n const result = (await p.all(queue)).flat();\n logger.trace({ manager }, 'fetchManagerVulnerabilities finished');\n return result;\n }\n\n private async fetchManagerPackageFileVulnerabilities(\n managerConfig: RenovateConfig,\n pFile: PackageFile,\n ): Promise<DependencyVulnerabilities[]> {\n const { packageFile } = pFile;\n const packageFileConfig = mergeChildConfig(managerConfig, pFile);\n const { manager } = packageFileConfig;\n const queue = pFile.deps.map(\n (dep) => (): Promise<DependencyVulnerabilities \| null> =>\n this.fetchDependencyVulnerability(packageFileConfig, dep),\n );\n logger.trace(\n { manager, packageFile, queueLength: queue.length },\n 'fetchManagerPackageFileVulnerabilities starting with concurrency',\n );\n\n const result = await p.all(queue);\n logger.trace(\n { packageFile },\n 'fetchManagerPackageFileVulnerabilities finished',\n );\n\n return result.filter(isTruthy);\n }\n\n private async fetchDependencyVulnerability(\n packageFileConfig: RenovateConfig & PackageFile,\n dep: PackageDependency,\n ): Promise<DependencyVulnerabilities \| null> {\n const ecosystem = Vulnerabilities.datasourceEcosystemMap[dep.datasource!];\n if (!ecosystem) {\n logger.trace(`Cannot map datasource ${dep.datasource!} to OSV ecosystem`);\n return null;\n }\n\n const packageName = dep.packageName ?? dep.depName!;\n let osvPackageName = packageName;\n let depType: string \| undefined;\n if (ecosystem === 'PyPI') {\n // https://peps.python.org/pep-0503/#normalized-names\n osvPackageName = osvPackageName\n .toLowerCase()\n .replace(regEx(/[_.-]+/g), '-');\n } else if (ecosystem === 'Go' && packageName === 'go') {\n if (dep.depType !== 'toolchain') {\n // The `go` directive is source compatibility, not the build toolchain, so we skip it\n return null;\n }\n osvPackageName = 'stdlib';\n depType = dep.depType;\n }\n\n try {\n const osvVulnerabilities = await instrument(\n 'get OSV vulnerabilities',\n () => this.osvOffline.getVulnerabilities(ecosystem, osvPackageName),\n {\n attributes: {\n osvPackageName,\n ecosystem,\n },\n },\n );\n if (\n isNullOrUndefined(osvVulnerabilities) \|\|\n isEmptyArray(osvVulnerabilities)\n ) {\n logger.trace(\n `No vulnerabilities found in OSV database for ${packageName}`,\n );\n return null;\n }\n\n const depVersion =\n dep.lockedVersion ?? dep.currentVersion ?? dep.currentValue!;\n\n const versioning = dep.versioning ?? getDefaultVersioning(dep.datasource);\n const versioningApi = getVersioning(versioning);\n\n if (!versioningApi.isVersion(depVersion)) {\n logger.debug(\n `Skipping vulnerability lookup for package ${packageName} due to unsupported version ${depVersion}`,\n );\n return null;\n }\n\n const vulnerabilities: Vulnerability[] = [];\n for (const osvVulnerability of osvVulnerabilities) {\n if (osvVulnerability.withdrawn) {\n logger.trace(\n `Skipping withdrawn vulnerability ${osvVulnerability.id}`,\n );\n continue;\n }\n\n this.skipMaliciousPackages(\n ecosystem,\n osvPackageName,\n depVersion,\n versioningApi,\n dep,\n packageFileConfig.manager,\n packageFileConfig.packageFile,\n osvVulnerability,\n );\n\n for (const affected of osvVulnerability.affected ?? []) {\n const isVulnerable = this.isPackageVulnerable(\n ecosystem,\n osvPackageName,\n depVersion,\n affected,\n versioningApi,\n );\n if (!isVulnerable) {\n continue;\n }\n\n logger.debug(\n `Vulnerability ${osvVulnerability.id} affects ${packageName} ${depVersion}`,\n );\n const fixedVersion = this.getFixedVersion(\n ecosystem,\n depVersion,\n affected,\n versioningApi,\n );\n\n vulnerabilities.push({\n packageName,\n osvPackageName,\n vulnerability: osvVulnerability,\n affected,\n depType,\n depVersion,\n fixedVersion,\n datasource: dep.datasource!,\n packageFileConfig,\n });\n }\n }\n\n return { vulnerabilities, versioningApi };\n } catch (err) {\n logger.warn(\n { err, packageName },\n 'Error fetching vulnerability information for package',\n );\n return null;\n }\n }\n\n private skipMaliciousPackages(\n ecosystem: Ecosystem,\n osvPackageName: string,\n depVersion: string,\n versioningApi: VersioningApi,\n dep: PackageDependency,\n manager: string \| undefined,\n packageFile: string,\n osvVulnerability: Osv.Vulnerability,\n ): void {\n // the OpenSSF's Malicious Packages (https://github.com/ossf/malicious-packages) is a source of advisories through osv.dev, which takes various sources of advisories, and will re-publish them with more specific information about their malicious usage\n if (osvVulnerability.id.startsWith('MAL-')) {\n // is the current dependency vulnerable?\n for (const affected of osvVulnerability.affected ?? []) {\n // is the current dependency vulnerable?\n const isVulnerable = this.isPackageVulnerable(\n ecosystem,\n osvPackageName,\n depVersion,\n affected,\n versioningApi,\n );\n\n if (isVulnerable) {\n logger.debug(\n {\n packageFile: packageFile,\n depName: dep.depName,\n packageName: dep.packageName,\n manager: manager,\n datasource: dep.datasource,\n currentVersion: depVersion,\n },\n `Marking ${dep.depName} as skipReason=malicious-version-in-use, as it is affected by ${osvVulnerability.id}`,\n );\n dep.skipReason = 'malicious-version-in-use';\n dep.skipStage = 'lookup';\n }\n\n // or are any of the updates vulnerable?\n for (const update of dep.updates ?? []) {\n const newVersion = update.newVersion ?? update.newValue!;\n\n const isUpdateVulnerable = this.isPackageVulnerable(\n ecosystem,\n osvPackageName,\n newVersion,\n affected,\n versioningApi,\n );\n\n if (isUpdateVulnerable) {\n logger.debug(\n {\n packageFile: packageFile,\n depName: dep.depName,\n packageName: dep.packageName,\n manager: manager,\n datasource: dep.datasource,\n currentVersion: depVersion,\n newVersion,\n },\n `Marking ${dep.depName}'s update to ${newVersion} as skipReason=malicious-update-proposed, as it is affected by ${osvVulnerability.id}`,\n );\n dep.skipReason = 'malicious-update-proposed';\n dep.skipStage = 'lookup';\n }\n }\n }\n }\n }\n\n private sortByFixedVersion(\n packageRules: PackageRule[],\n versioningApi: VersioningApi,\n ): void {\n const versionsCleaned: Record<string, string> = {};\n for (const rule of packageRules) {\n const version = rule.allowedVersions!;\n versionsCleaned[version] = version.replace(regEx(/[(),=> ]+/g), '');\n }\n packageRules.sort((a, b) =>\n versioningApi.sortVersions(\n versionsCleaned[a.allowedVersions!],\n versionsCleaned[b.allowedVersions!],\n ),\n );\n }\n\n // https://ossf.github.io/osv-schema/#affectedrangesevents-fields\n private sortEvents(\n events: Osv.Event[],\n versioningApi: VersioningApi,\n ): Osv.Event[] {\n const sortedCopy: Osv.Event[] = [];\n let zeroEvent: Osv.Event \| null = null;\n\n for (const event of events) {\n if (event.introduced === '0') {\n zeroEvent = event;\n } else if (versioningApi.isVersion(Object.values(event)[0])) {\n sortedCopy.push(event);\n } else {\n logger.debug({ event }, 'Skipping OSV event with invalid version');\n }\n }\n\n sortedCopy.sort((a, b) =>\n // no pre-processing, as there are only very few values to sort\n versioningApi.sortVersions(Object.values(a)[0], Object.values(b)[0]),\n );\n\n if (zeroEvent) {\n sortedCopy.unshift(zeroEvent);\n }\n\n return sortedCopy;\n }\n\n private isPackageAffected(\n ecosystem: Ecosystem,\n osvPackageName: string,\n affected: Osv.Affected,\n ): boolean {\n const pkg = affected.package;\n if (pkg?.name !== osvPackageName) {\n return false;\n }\n\n // Match exact ecosystems and OSV sub-ecosystems (e.g. Packagist:https://packages.drupal.org/8).\n return (\n pkg.ecosystem === ecosystem \|\| pkg.ecosystem.startsWith(`${ecosystem}:`)\n );\n }\n\n private includedInVersions(\n depVersion: string,\n affected: Osv.Affected,\n ): boolean {\n return !!affected.versions?.includes(depVersion);\n }\n\n private includedInRanges(\n depVersion: string,\n affected: Osv.Affected,\n versioningApi: VersioningApi,\n ): boolean {\n for (const range of affected.ranges ?? []) {\n if (range.type === 'GIT') {\n continue;\n }\n\n let vulnerable = false;\n for (const event of this.sortEvents(range.events, versioningApi)) {\n if (\n isNonEmptyString(event.introduced) &&\n (event.introduced === '0' \|\|\n this.isVersionGtOrEq(depVersion, event.introduced, versioningApi))\n ) {\n vulnerable = true;\n } else if (\n isNonEmptyString(event.fixed) &&\n this.isVersionGtOrEq(depVersion, event.fixed, versioningApi)\n ) {\n vulnerable = false;\n } else if (\n isNonEmptyString(event.last_affected) &&\n this.isVersionGt(depVersion, event.last_affected, versioningApi)\n ) {\n vulnerable = false;\n }\n }\n\n if (vulnerable) {\n return true;\n }\n }\n\n return false;\n }\n\n // https://ossf.github.io/osv-schema/#evaluation\n private isPackageVulnerable(\n ecosystem: Ecosystem,\n osvPackageName: string,\n depVersion: string,\n affected: Osv.Affected,\n versioningApi: VersioningApi,\n ): boolean {\n return (\n this.isPackageAffected(ecosystem, osvPackageName, affected) &&\n (this.includedInVersions(depVersion, affected) \|\|\n this.includedInRanges(depVersion, affected, versioningApi))\n );\n }\n\n private getFixedVersion(\n ecosystem: Ecosystem,\n depVersion: string,\n affected: Osv.Affected,\n versioningApi: VersioningApi,\n ): string \| null {\n const fixedVersions: string[] = [];\n const lastAffectedVersions: string[] = [];\n\n for (const range of affected.ranges ?? []) {\n if (range.type === 'GIT') {\n continue;\n }\n\n for (const event of range.events) {\n if (\n isNonEmptyString(event.fixed) &&\n versioningApi.isVersion(event.fixed)\n ) {\n fixedVersions.push(event.fixed);\n } else if (\n isNonEmptyString(event.last_affected) &&\n versioningApi.isVersion(event.last_affected)\n ) {\n lastAffectedVersions.push(event.last_affected);\n }\n }\n }\n\n fixedVersions.sort((a, b) => versioningApi.sortVersions(a, b));\n const fixedVersion = fixedVersions.find((version) =>\n this.isVersionGt(version, depVersion, versioningApi),\n );\n if (fixedVersion) {\n return this.getFixedVersionByEcosystem(fixedVersion, ecosystem);\n }\n\n lastAffectedVersions.sort((a, b) => versioningApi.sortVersions(a, b));\n const lastAffected = lastAffectedVersions.find((version) =>\n this.isVersionGtOrEq(version, depVersion, versioningApi),\n );\n if (lastAffected) {\n return this.getLastAffectedByEcosystem(lastAffected, ecosystem);\n }\n\n return null;\n }\n\n private getFixedVersionByEcosystem(\n fixedVersion: string,\n ecosystem: Ecosystem,\n ): string {\n return getFixedVersionConstraint(fixedVersion, ecosystem);\n }\n\n private getLastAffectedByEcosystem(\n lastAffected: string,\n ecosystem: Ecosystem,\n ): string {\n return getLastAffectedVersionConstraint(lastAffected, ecosystem);\n }\n\n private isVersionGt(\n version: string,\n other: string,\n versioningApi: VersioningApi,\n ): boolean {\n return (\n versioningApi.isVersion(version) &&\n versioningApi.isVersion(other) &&\n versioningApi.isGreaterThan(version, other)\n );\n }\n\n private isVersionGtOrEq(\n version: string,\n other: string,\n versioningApi: VersioningApi,\n ): boolean {\n return (\n versioningApi.isVersion(version) &&\n versioningApi.isVersion(other) &&\n (versioningApi.equals(version, other) \|\|\n versioningApi.isGreaterThan(version, other))\n );\n }\n\n private vulnerabilityToPackageRules(vul: Vulnerability): PackageRule \| null {\n const {\n vulnerability,\n affected,\n packageName,\n depType,\n depVersion,\n fixedVersion,\n datasource,\n packageFileConfig,\n } = vul;\n if (isNullOrUndefined(fixedVersion)) {\n logger.debug(\n `No fixed version available for vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`,\n );\n return null;\n }\n\n // we don't know if the dependency has a `versioning` applied to it already, so we have to use the default for the datasource\n const versioning = getDefaultVersioning(datasource);\n\n logger.debug(\n {\n datasource,\n versioning,\n },\n\n `Setting allowed version ${fixedVersion} to fix vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`,\n );\n\n const severityDetails = this.extractSeverityDetails(\n vulnerability,\n affected,\n );\n\n return {\n matchDatasources: [datasource],\n matchPackageNames: [packageName],\n ...(depType ? { matchDepTypes: [depType] } : {}),\n matchCurrentVersion: depVersion,\n versioning,\n allowedVersions: fixedVersion,\n isVulnerabilityAlert: true,\n vulnerabilitySeverity: severityDetails.severityLevel,\n prBodyNotes: this.generatePrBodyNotes(vulnerability, affected),\n force: {\n ...packageFileConfig.vulnerabilityAlerts,\n },\n };\n }\n\n static evaluateCvssVector(vector: string): [string, string] {\n const CvssJson = z.object({\n baseScore: z.number().default(0.0),\n baseSeverity: z.string().toUpperCase().default('UNKNOWN'),\n });\n\n try {\n const parsedCvssScore: CvssVector<any> \| null = fromVector(vector);\n const res = CvssJson.parse(parsedCvssScore?.createJsonSchema());\n\n return [res.baseScore.toFixed(1), res.baseSeverity];\n } catch {\n logger.debug(`Error processing CVSS vector ${vector}`);\n }\n\n return ['', ''];\n }\n\n private generatePrBodyNotes(\n vulnerability: Osv.Vulnerability,\n affected: Osv.Affected,\n ): string[] {\n let aliases = [vulnerability.id].concat(vulnerability.aliases ?? []).sort();\n aliases = aliases.map((id) => {\n if (id.startsWith('CVE-')) {\n return `[${id}](https://nvd.nist.gov/vuln/detail/${id})`;\n }\n if (id.startsWith('GHSA-')) {\n return `[${id}](https://github.com/advisories/${id})`;\n }\n if (id.startsWith('GO-')) {\n return `[${id}](https://pkg.go.dev/vuln/${id})`;\n }\n if (id.startsWith('RUSTSEC-')) {\n return `[${id}](https://rustsec.org/advisories/${id}.html)`;\n }\n\n return id;\n });\n\n let content = '\\n\\n---\\n\\n### ';\n content += vulnerability.summary ? `${vulnerability.summary}\\n` : '';\n content += `${aliases.join(' / ')}\\n`;\n content += `\\n<details>\\n<summary>More information</summary>\\n`;\n\n const details = vulnerability.details?.replace(\n regEx(/^#{1,4} /gm),\n '##### ',\n );\n content += `#### Details\\n${details ?? 'No details.'}\\n`;\n\n content += '#### Severity\\n';\n const severityDetails = this.extractSeverityDetails(\n vulnerability,\n affected,\n );\n\n if (severityDetails.cvssVector) {\n content += `- CVSS Score: ${severityDetails.score}\\n`;\n content += `- Vector String: \\`${severityDetails.cvssVector}\\`\\n`;\n } else {\n content += `${titleCase(severityDetails.severityLevel)}\\n`;\n }\n\n content += `\\n#### References\\n${\n vulnerability.references\n ?.map((ref) => {\n return `- [${ref.url}](${ref.url})`;\n })\n .join('\\n') ?? 'No references.'\n }`;\n\n let attribution = '';\n if (vulnerability.id.startsWith('GHSA-')) {\n attribution = ` and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md))`;\n } else if (vulnerability.id.startsWith('GO-')) {\n attribution = ` and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license))`;\n } else if (vulnerability.id.startsWith('PYSEC-')) {\n attribution = ` and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE))`;\n } else if (vulnerability.id.startsWith('RUSTSEC-')) {\n attribution = ` and the [Rust Advisory Database](https://github.com/RustSec/advisory-db) ([CC0 1.0](https://github.com/rustsec/advisory-db/blob/main/LICENSE.txt))`;\n }\n content += `\\n\\nThis data is provided by [OSV](https://osv.dev/vulnerability/${vulnerability.id})${attribution}.\\n`;\n content += `</details>`;\n\n return [sanitizeMarkdown(content)];\n }\n\n private extractSeverityDetails(\n vulnerability: Osv.Vulnerability,\n affected: Osv.Affected,\n ): SeverityDetails {\n let severityLevel = 'UNKNOWN';\n let score = 'Unknown';\n\n const cvssVector =\n vulnerability.severity?.find((e) => e.type === 'CVSS_V4')?.score ??\n vulnerability.severity?.find((e) => e.type === 'CVSS_V3')?.score ??\n (affected.database_specific?.cvss as string); // RUSTSEC\n\n if (cvssVector) {\n const [baseScore, severity] =\n Vulnerabilities.evaluateCvssVector(cvssVector);\n severityLevel = severity ? severity.toUpperCase() : 'UNKNOWN';\n score = baseScore\n ? `${baseScore} / 10 (${titleCase(severityLevel)})`\n : 'Unknown';\n } else if (\n vulnerability.id.startsWith('GHSA-') &&\n vulnerability.database_specific?.severity\n ) {\n const severity = vulnerability.database_specific.severity as string;\n severityLevel = severity.toUpperCase();\n }\n\n return {\n cvssVector,\n score,\n severityLevel,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,MAAM,EAAE,eAAgB,QACrB;AAEH,IAAa,kBAAb,MAAa,gBAAgB;CAC3B,OAAe;CAEf;CAEA,OAAwB,yBAAyB;CAEjD,YAAoB,YAAwB;EAC1C,KAAK,aAAa;CACpB;CAEA,OAAe,aAAkC;EAE/C,gBAAgB,eAAe,WAAW,OAAO;EACjD,OAAO,gBAAgB;CACzB;CAEA,aAAa,SAAmC;EAE9C,MAAM,aAAa,MAAM,gBAAgB,WAAW;EAGpD,OAAO,IADc,gBAAgB,UACvB;CAChB;CAEA,MAAM,gCACJ,QACA,cACe;EACf,MAAM,4BAA4B,MAAM,KAAK,+BAC3C,QACA,YACF;EAEA,OAAO,iBAAiB,CAAC;EACzB,KAAK,MAAM,EACT,iBACA,mBACG,2BAA2B;GAC9B,MAAM,oBAAmC,CAAC;GAC1C,KAAK,MAAM,iBAAiB,iBAAiB;IAC3C,MAAM,OAAO,KAAK,4BAA4B,aAAa;IAC3D,IAAI,kBAAkB,IAAI,GACxB;IAEF,kBAAkB,KAAK,IAAI;GAC7B;GACA,KAAK,mBAAmB,mBAAmB,aAAa;GAExD,OAAO,aAAa,KAAK,GAAG,iBAAiB;EAC/C;CACF;CAEA,MAAM,qBACJ,QACA,cAC0B;EAK1B,QAAO,MAJc,KAAK,+BACxB,QACA,YACF,EAAA,CACc,SAAS,UAAU,MAAM,eAAe;CACxD;CAEA,MAAc,+BACZ,QACA,cACsC;EAEtC,MAAM,iBADW,OAAO,KAAK,YACC,CAAC,CAAC,KAAK,YACnC,KAAK,4BAA4B,QAAQ,cAAc,OAAO,CAChE;EACA,QAAQ,MAAM,QAAQ,IAAI,cAAc,EAAA,CAAG,KAAK;CAClD;CAEA,MAAc,4BACZ,QACA,cACA,SACsC;EACtC,MAAM,gBAAgB,iBAAiB,QAAQ,OAAO;EACtD,MAAM,QAAQ,aAAa,QAAQ,CAAC,KACjC,gBACC,KAAK,uCAAuC,eAAe,KAAK,CACpE;EACA,OAAO,MACL;GAAE;GAAS,aAAa,MAAM;EAAO,GACrC,sCACF;EACA,MAAM,UAAU,MAAMA,IAAM,KAAK,EAAA,CAAG,KAAK;EACzC,OAAO,MAAM,EAAE,QAAQ,GAAG,sCAAsC;EAChE,OAAO;CACT;CAEA,MAAc,uCACZ,eACA,OACsC;EACtC,MAAM,EAAE,gBAAgB;EACxB,MAAM,oBAAoB,iBAAiB,eAAe,KAAK;EAC/D,MAAM,EAAE,YAAY;EACpB,MAAM,QAAQ,MAAM,KAAK,KACtB,cACC,KAAK,6BAA6B,mBAAmB,GAAG,CAC5D;EACA,OAAO,MACL;GAAE;GAAS;GAAa,aAAa,MAAM;EAAO,GAClD,kEACF;EAEA,MAAM,SAAS,MAAMA,IAAM,KAAK;EAChC,OAAO,MACL,EAAE,YAAY,GACd,iDACF;EAEA,OAAO,OAAO,OAAO,QAAQ;CAC/B;CAEA,MAAc,6BACZ,mBACA,KAC2C;EAC3C,MAAM,YAAY,gBAAgB,uBAAuB,IAAI;EAC7D,IAAI,CAAC,WAAW;GACd,OAAO,MAAM,yBAAyB,IAAI,WAAY,kBAAkB;GACxE,OAAO;EACT;EAEA,MAAM,cAAc,IAAI,eAAe,IAAI;EAC3C,IAAI,iBAAiB;EACrB,IAAI;EACJ,IAAI,cAAc,QAEhB,iBAAiB,eACd,YAAY,CAAC,CACb,QAAQ,MAAM,SAAS,GAAG,GAAG;OAC3B,IAAI,cAAc,QAAQ,gBAAgB,MAAM;GACrD,IAAI,IAAI,YAAY,aAElB,OAAO;GAET,iBAAiB;GACjB,UAAU,IAAI;EAChB;EAEA,IAAI;GACF,MAAM,qBAAqB,MAAM,WAC/B,iCACM,KAAK,WAAW,mBAAmB,WAAW,cAAc,GAClE,EACE,YAAY;IACV;IACA;GACF,EACF,CACF;GACA,IACE,kBAAkB,kBAAkB,KACpC,aAAa,kBAAkB,GAC/B;IACA,OAAO,MACL,gDAAgD,aAClD;IACA,OAAO;GACT;GAEA,MAAM,aACJ,IAAI,iBAAiB,IAAI,kBAAkB,IAAI;GAEjD,MAAM,aAAa,IAAI,cAAc,qBAAqB,IAAI,UAAU;GACxE,MAAM,gBAAgBC,IAAc,UAAU;GAE9C,IAAI,CAAC,cAAc,UAAU,UAAU,GAAG;IACxC,OAAO,MACL,6CAA6C,YAAY,8BAA8B,YACzF;IACA,OAAO;GACT;GAEA,MAAM,kBAAmC,CAAC;GAC1C,KAAK,MAAM,oBAAoB,oBAAoB;IACjD,IAAI,iBAAiB,WAAW;KAC9B,OAAO,MACL,oCAAoC,iBAAiB,IACvD;KACA;IACF;IAEA,KAAK,sBACH,WACA,gBACA,YACA,eACA,KACA,kBAAkB,SAClB,kBAAkB,aAClB,gBACF;IAEA,KAAK,MAAM,YAAY,iBAAiB,YAAY,CAAC,GAAG;KAQtD,IAAI,CAPiB,KAAK,oBACxB,WACA,gBACA,YACA,UACA,aAEc,GACd;KAGF,OAAO,MACL,iBAAiB,iBAAiB,GAAG,WAAW,YAAY,GAAG,YACjE;KACA,MAAM,eAAe,KAAK,gBACxB,WACA,YACA,UACA,aACF;KAEA,gBAAgB,KAAK;MACnB;MACA;MACA,eAAe;MACf;MACA;MACA;MACA;MACA,YAAY,IAAI;MAChB;KACF,CAAC;IACH;GACF;GAEA,OAAO;IAAE;IAAiB;GAAc;EAC1C,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK;GAAY,GACnB,sDACF;GACA,OAAO;EACT;CACF;CAEA,sBACE,WACA,gBACA,YACA,eACA,KACA,SACA,aACA,kBACM;EAEN,IAAI,iBAAiB,GAAG,WAAW,MAAM,GAEvC,KAAK,MAAM,YAAY,iBAAiB,YAAY,CAAC,GAAG;GAUtD,IARqB,KAAK,oBACxB,WACA,gBACA,YACA,UACA,aAGa,GAAG;IAChB,OAAO,MACL;KACe;KACb,SAAS,IAAI;KACb,aAAa,IAAI;KACR;KACT,YAAY,IAAI;KAChB,gBAAgB;IAClB,GACA,WAAW,IAAI,QAAQ,gEAAgE,iBAAiB,IAC1G;IACA,IAAI,aAAa;IACjB,IAAI,YAAY;GAClB;GAGA,KAAK,MAAM,UAAU,IAAI,WAAW,CAAC,GAAG;IACtC,MAAM,aAAa,OAAO,cAAc,OAAO;IAU/C,IAR2B,KAAK,oBAC9B,WACA,gBACA,YACA,UACA,aAGmB,GAAG;KACtB,OAAO,MACL;MACe;MACb,SAAS,IAAI;MACb,aAAa,IAAI;MACR;MACT,YAAY,IAAI;MAChB,gBAAgB;MAChB;KACF,GACA,WAAW,IAAI,QAAQ,eAAe,WAAW,iEAAiE,iBAAiB,IACrI;KACA,IAAI,aAAa;KACjB,IAAI,YAAY;IAClB;GACF;EACF;CAEJ;CAEA,mBACE,cACA,eACM;EACN,MAAM,kBAA0C,CAAC;EACjD,KAAK,MAAM,QAAQ,cAAc;GAC/B,MAAM,UAAU,KAAK;GACrB,gBAAgB,WAAW,QAAQ,QAAQ,MAAM,YAAY,GAAG,EAAE;EACpE;EACA,aAAa,MAAM,GAAG,MACpB,cAAc,aACZ,gBAAgB,EAAE,kBAClB,gBAAgB,EAAE,gBACpB,CACF;CACF;CAGA,WACE,QACA,eACa;EACb,MAAM,aAA0B,CAAC;EACjC,IAAI,YAA8B;EAElC,KAAK,MAAM,SAAS,QAClB,IAAI,MAAM,eAAe,KACvB,YAAY;OACP,IAAI,cAAc,UAAU,OAAO,OAAO,KAAK,CAAC,CAAC,EAAE,GACxD,WAAW,KAAK,KAAK;OAErB,OAAO,MAAM,EAAE,MAAM,GAAG,yCAAyC;EAIrE,WAAW,MAAM,GAAG,MAElB,cAAc,aAAa,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CACrE;EAEA,IAAI,WACF,WAAW,QAAQ,SAAS;EAG9B,OAAO;CACT;CAEA,kBACE,WACA,gBACA,UACS;EACT,MAAM,MAAM,SAAS;EACrB,IAAI,KAAK,SAAS,gBAChB,OAAO;EAIT,OACE,IAAI,cAAc,aAAa,IAAI,UAAU,WAAW,GAAG,UAAU,EAAE;CAE3E;CAEA,mBACE,YACA,UACS;EACT,OAAO,CAAC,CAAC,SAAS,UAAU,SAAS,UAAU;CACjD;CAEA,iBACE,YACA,UACA,eACS;EACT,KAAK,MAAM,SAAS,SAAS,UAAU,CAAC,GAAG;GACzC,IAAI,MAAM,SAAS,OACjB;GAGF,IAAI,aAAa;GACjB,KAAK,MAAM,SAAS,KAAK,WAAW,MAAM,QAAQ,aAAa,GAC7D,IACE,iBAAiB,MAAM,UAAU,MAChC,MAAM,eAAe,OACpB,KAAK,gBAAgB,YAAY,MAAM,YAAY,aAAa,IAElE,aAAa;QACR,IACL,iBAAiB,MAAM,KAAK,KAC5B,KAAK,gBAAgB,YAAY,MAAM,OAAO,aAAa,GAE3D,aAAa;QACR,IACL,iBAAiB,MAAM,aAAa,KACpC,KAAK,YAAY,YAAY,MAAM,eAAe,aAAa,GAE/D,aAAa;GAIjB,IAAI,YACF,OAAO;EAEX;EAEA,OAAO;CACT;CAGA,oBACE,WACA,gBACA,YACA,UACA,eACS;EACT,OACE,KAAK,kBAAkB,WAAW,gBAAgB,QAAQ,MACzD,KAAK,mBAAmB,YAAY,QAAQ,KAC3C,KAAK,iBAAiB,YAAY,UAAU,aAAa;CAE/D;CAEA,gBACE,WACA,YACA,UACA,eACe;EACf,MAAM,gBAA0B,CAAC;EACjC,MAAM,uBAAiC,CAAC;EAExC,KAAK,MAAM,SAAS,SAAS,UAAU,CAAC,GAAG;GACzC,IAAI,MAAM,SAAS,OACjB;GAGF,KAAK,MAAM,SAAS,MAAM,QACxB,IACE,iBAAiB,MAAM,KAAK,KAC5B,cAAc,UAAU,MAAM,KAAK,GAEnC,cAAc,KAAK,MAAM,KAAK;QACzB,IACL,iBAAiB,MAAM,aAAa,KACpC,cAAc,UAAU,MAAM,aAAa,GAE3C,qBAAqB,KAAK,MAAM,aAAa;EAGnD;EAEA,cAAc,MAAM,GAAG,MAAM,cAAc,aAAa,GAAG,CAAC,CAAC;EAC7D,MAAM,eAAe,cAAc,MAAM,YACvC,KAAK,YAAY,SAAS,YAAY,aAAa,CACrD;EACA,IAAI,cACF,OAAO,KAAK,2BAA2B,cAAc,SAAS;EAGhE,qBAAqB,MAAM,GAAG,MAAM,cAAc,aAAa,GAAG,CAAC,CAAC;EACpE,MAAM,eAAe,qBAAqB,MAAM,YAC9C,KAAK,gBAAgB,SAAS,YAAY,aAAa,CACzD;EACA,IAAI,cACF,OAAO,KAAK,2BAA2B,cAAc,SAAS;EAGhE,OAAO;CACT;CAEA,2BACE,cACA,WACQ;EACR,OAAO,0BAA0B,cAAc,SAAS;CAC1D;CAEA,2BACE,cACA,WACQ;EACR,OAAO,iCAAiC,cAAc,SAAS;CACjE;CAEA,YACE,SACA,OACA,eACS;EACT,OACE,cAAc,UAAU,OAAO,KAC/B,cAAc,UAAU,KAAK,KAC7B,cAAc,cAAc,SAAS,KAAK;CAE9C;CAEA,gBACE,SACA,OACA,eACS;EACT,OACE,cAAc,UAAU,OAAO,KAC/B,cAAc,UAAU,KAAK,MAC5B,cAAc,OAAO,SAAS,KAAK,KAClC,cAAc,cAAc,SAAS,KAAK;CAEhD;CAEA,4BAAoC,KAAwC;EAC1E,MAAM,EACJ,eACA,UACA,aACA,SACA,YACA,cACA,YACA,sBACE;EACJ,IAAI,kBAAkB,YAAY,GAAG;GACnC,OAAO,MACL,gDAAgD,cAAc,GAAG,MAAM,YAAY,GAAG,YACxF;GACA,OAAO;EACT;EAGA,MAAM,aAAa,qBAAqB,UAAU;EAElD,OAAO,MACL;GACE;GACA;EACF,GAEA,2BAA2B,aAAa,wBAAwB,cAAc,GAAG,MAAM,YAAY,GAAG,YACxG;EAEA,MAAM,kBAAkB,KAAK,uBAC3B,eACA,QACF;EAEA,OAAO;GACL,kBAAkB,CAAC,UAAU;GAC7B,mBAAmB,CAAC,WAAW;GAC/B,GAAI,UAAU,EAAE,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC;GAC9C,qBAAqB;GACrB;GACA,iBAAiB;GACjB,sBAAsB;GACtB,uBAAuB,gBAAgB;GACvC,aAAa,KAAK,oBAAoB,eAAe,QAAQ;GAC7D,OAAO,EACL,GAAG,kBAAkB,oBACvB;EACF;CACF;CAEA,OAAO,mBAAmB,QAAkC;EAC1D,MAAM,WAAW,EAAE,OAAO;GACxB,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAG;GACjC,cAAc,EAAE,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,SAAS;EAC1D,CAAC;EAED,IAAI;GACF,MAAM,kBAA0C,WAAW,MAAM;GACjE,MAAM,MAAM,SAAS,MAAM,iBAAiB,iBAAiB,CAAC;GAE9D,OAAO,CAAC,IAAI,UAAU,QAAQ,CAAC,GAAG,IAAI,YAAY;EACpD,QAAQ;GACN,OAAO,MAAM,gCAAgC,QAAQ;EACvD;EAEA,OAAO,CAAC,IAAI,EAAE;CAChB;CAEA,oBACE,eACA,UACU;EACV,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,cAAc,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;EAC1E,UAAU,QAAQ,KAAK,OAAO;GAC5B,IAAI,GAAG,WAAW,MAAM,GACtB,OAAO,IAAI,GAAG,qCAAqC,GAAG;GAExD,IAAI,GAAG,WAAW,OAAO,GACvB,OAAO,IAAI,GAAG,kCAAkC,GAAG;GAErD,IAAI,GAAG,WAAW,KAAK,GACrB,OAAO,IAAI,GAAG,4BAA4B,GAAG;GAE/C,IAAI,GAAG,WAAW,UAAU,GAC1B,OAAO,IAAI,GAAG,mCAAmC,GAAG;GAGtD,OAAO;EACT,CAAC;EAED,IAAI,UAAU;EACd,WAAW,cAAc,UAAU,GAAG,cAAc,QAAQ,MAAM;EAClE,WAAW,GAAG,QAAQ,KAAK,KAAK,EAAE;EAClC,WAAW;EAEX,MAAM,UAAU,cAAc,SAAS,QACrC,MAAM,YAAY,GAClB,QACF;EACA,WAAW,iBAAiB,WAAW,cAAc;EAErD,WAAW;EACX,MAAM,kBAAkB,KAAK,uBAC3B,eACA,QACF;EAEA,IAAI,gBAAgB,YAAY;GAC9B,WAAW,iBAAiB,gBAAgB,MAAM;GAClD,WAAW,sBAAsB,gBAAgB,WAAW;EAC9D,OACE,WAAW,GAAG,UAAU,gBAAgB,aAAa,EAAE;EAGzD,WAAW,sBACT,cAAc,YACV,KAAK,QAAQ;GACb,OAAO,MAAM,IAAI,IAAI,IAAI,IAAI,IAAI;EACnC,CAAC,CAAC,CACD,KAAK,IAAI,KAAK;EAGnB,IAAI,cAAc;EAClB,IAAI,cAAc,GAAG,WAAW,OAAO,GACrC,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,KAAK,GAC1C,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,QAAQ,GAC7C,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,UAAU,GAC/C,cAAc;EAEhB,WAAW,oEAAoE,cAAc,GAAG,GAAG,YAAY;EAC/G,WAAW;EAEX,OAAO,CAAC,iBAAiB,OAAO,CAAC;CACnC;CAEA,uBACE,eACA,UACiB;EACjB,IAAI,gBAAgB;EACpB,IAAI,QAAQ;EAEZ,MAAM,aACJ,cAAc,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,SAC3D,cAAc,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,SAC1D,SAAS,mBAAmB;EAE/B,IAAI,YAAY;GACd,MAAM,CAAC,WAAW,YAChB,gBAAgB,mBAAmB,UAAU;GAC/C,gBAAgB,WAAW,SAAS,YAAY,IAAI;GACpD,QAAQ,YACJ,GAAG,UAAU,SAAS,UAAU,aAAa,EAAE,KAC/C;EACN,OAAO,IACL,cAAc,GAAG,WAAW,OAAO,KACnC,cAAc,mBAAmB,UAGjC,gBADiB,cAAc,kBAAkB,SACxB,YAAY;EAGvC,OAAO;GACL;GACA;GACA;EACF;CACF;AACF"}

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "name": "renovate",
   "description": "Automated dependency updates. Flexible so you don't need to be.",
-  "version": "44.37.1",
+  "version": "44.38.0",
   "type": "module",
   "bin": {
     "renovate": "dist/renovate.js",

package/renovate-schema.json CHANGED Viewed

@@ -1,8 +1,8 @@
 {
   "$id": "https://docs.renovatebot.com/renovate-schema.json",
-  "title": "JSON schema for Renovate 44.37.1 config files (https://renovatebot.com/)",
+  "title": "JSON schema for Renovate 44.38.0 config files (https://renovatebot.com/)",
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "x-renovate-version": "44.37.1",
+  "x-renovate-version": "44.38.0",
   "allowComments": true,
   "type": "object",
   "definitions": {
@@ -2475,7 +2475,8 @@
       "default": {
         "managerFilePatterns": [
           "/^.devcontainer/devcontainer.json$/",
-          "/^.devcontainer.json$/"
+          "/^.devcontainer.json$/",
+          "/^.devcontainer/[^/]+/devcontainer.json$/"
         ]
       },
       "$ref": "#",