renovate 44.7.4 → 44.8.0

package/dist/config/presets/internal/security.preset.js

@@ -13,6 +13,10 @@ const minimumReleaseAgeDatasources = {
 	npm: {
 		description: "Wait until the npm package is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behaviour in packages, and b) prevents the maintainer and/or NPM from unpublishing a package you already upgraded to, breaking builds.",
 		minimumReleaseAge: "3 days"
+	},
+	pypi: {
+		description: "Wait until the Python package is three days old before raising the update. This introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behaviour in packages.",
+		minimumReleaseAge: "3 days"
 	}
 };
 /**

package/dist/config/presets/internal/security.preset.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.preset.js","names":[],"sources":["../../../../lib/config/presets/internal/security.preset.ts"],"sourcesContent":["import type { DatasourceName } from '../../../datasource-list.generated.ts';\nimport type { PackageRule } from '../../types.ts';\nimport { UpdateTypesOptions } from '../../types.ts';\nimport type { Preset } from '../types.ts';\n\ninterface MinimumReleaseAgeDatasource {\n  description: string;\n  minimumReleaseAge: string;\n}\n\n/**\n * Datasources for which we expose a `security:minimumReleaseAge*` preset.\n *\n * Only supported for Datasources that have `releaseTimestampSupport`.\n */\nconst minimumReleaseAgeDatasources: Partial<\n  Record<DatasourceName, MinimumReleaseAgeDatasource>\n> = {\n  crate: {\n    description:\n      \"Wait until the Crate version is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behaviour in crates, and b) reduces the risk of upgrading to a newly published crate that its owner deletes during crates.io's initial 72-hour deletion window.\",\n    minimumReleaseAge: '3 days',\n  },\n  npm: {\n    description:\n      'Wait until the npm package is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behaviour in packages, and b) prevents the maintainer and/or NPM from unpublishing a package you already upgraded to, breaking builds.',\n    minimumReleaseAge: '3 days',\n  },\n};\n\n/**\n * Certain update types don't currently support `releaseTimestamp`s, so applying `minimumReleaseAge` to them results in updates that will never come.\n *\n * Instead, we opt them out of `minimumReleaseAge`, and add a warning for the user.\n *\n * This must stay in sync with the update types documented as _not_ supported (❌) in `docs/usage/key-concepts/minimum-release-age.md`, so we opt-out any unsupported `updateType`s.\n *\n * These rules are datasource-agnostic (`matchDatasources` is added per preset), so they are shared across every generated `security:minimumReleaseAge*` preset to keep the warnings consistent.\n */\nconst unsupportedUpdateTypeRules: PackageRule[] = [\n  {\n    description:\n      'Do not require Minimum Release Age for update types that are controlled by the package manager',\n    matchUpdateTypes: ['lockFileMaintenance'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's lock file maintenance functionality does not support validating Minimum Release Age, as the package manager performs the required changes to update package(s). Confirm whether your package manager perform its own validation for the Minimum Release Age of packages.\",\n    ],\n  },\n  // TODO #39400\n  {\n    description: 'Do not require Minimum Release Age for package replacements',\n    matchUpdateTypes: ['replacement'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's replacement functionality [does not currently](https://github.com/renovatebot/renovate/issues/39400) wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).\",\n    ],\n  },\n  // TODO #40288\n  {\n    description: 'Do not require Minimum Release Age for package pinning',\n    matchUpdateTypes: ['pin'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's pin functionality [does not currently](https://github.com/renovatebot/renovate/issues/40288) wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).\",\n    ],\n  },\n  {\n    description:\n      'Do not require Minimum Release Age for update types that do not provide a release timestamp',\n    matchUpdateTypes: ['bump', 'lockfileUpdate', 'rollback'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      '⚠️ Renovate does not enforce Minimum Release Age for `bump`, `lockfileUpdate`, or `rollback` updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).',\n    ],\n  },\n];\n\nfunction buildMinimumReleaseAgePreset(\n  datasource: string,\n  { description, minimumReleaseAge }: MinimumReleaseAgeDatasource,\n): Preset {\n  const packageRules: PackageRule[] = [\n    {\n      internalChecksFilter: 'strict',\n      matchDatasources: [datasource],\n      minimumReleaseAge,\n    },\n    ...unsupportedUpdateTypeRules.map(\n      (rule): PackageRule => ({ ...rule, matchDatasources: [datasource] }),\n    ),\n  ];\n\n  return { description, packageRules };\n}\n\nfunction loadMinimumReleaseAgePresets(): Record<string, Preset> {\n  const presets: Record<string, Preset> = {};\n\n  for (const [datasource, config] of Object.entries(\n    minimumReleaseAgeDatasources,\n  )) {\n    const suffix = datasource[0].toUpperCase() + datasource.slice(1);\n    presets[`minimumReleaseAge${suffix}`] = buildMinimumReleaseAgePreset(\n      datasource,\n      config,\n    );\n  }\n\n  return presets;\n}\n\nexport const presets: Record<string, Preset> = {\n  gomodIndirectSecurityUpdates: {\n    description:\n      'Enable go.mod indirect dependency updates only when vulnerabilities have been detected.',\n    extends: [':enableVulnerabilityAlerts'],\n    packageRules: [\n      {\n        description: 'Enable lookups for indirect go.mod dependencies',\n        enabled: true,\n        matchDepTypes: ['indirect'],\n        matchManagers: ['gomod'],\n      },\n      {\n        description:\n          'Disable non-security updates for indirect go.mod dependencies (vulnerability alerts use force to override this)',\n        enabled: false,\n        matchDepTypes: ['indirect'],\n        matchManagers: ['gomod'],\n        matchUpdateTypes: [...UpdateTypesOptions],\n      },\n    ],\n  },\n  ...loadMinimumReleaseAgePresets(),\n  'only-security-updates': {\n    description:\n      'Only update dependencies if vulnerabilities have been detected.',\n    extends: ['config:recommended'],\n    osvVulnerabilityAlerts: true,\n    packageRules: [\n      {\n        enabled: false,\n        matchPackageNames: ['*'],\n      },\n    ],\n    vulnerabilityAlerts: {\n      enabled: true,\n    },\n  },\n  'openssf-scorecard': {\n    description: 'Show OpenSSF badge on pull requests.',\n    packageRules: [\n      {\n        matchSourceUrls: ['https://github.com/**'],\n        prBodyColumns: [\n          'Package',\n          'Type',\n          'Update',\n          'Change',\n          'Pending',\n          'OpenSSF',\n        ],\n        prBodyDefinitions: {\n          OpenSSF:\n            '[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/{{sourceRepo}}/badge)](https://securityscorecards.dev/viewer/?uri=github.com/{{sourceRepo}})',\n        },\n      },\n    ],\n  },\n};\n\nexport const minimumReleaseAgeDatasourceNames = Object.keys(\n  minimumReleaseAgeDatasources,\n);\n"],"mappings":";;;;;;;AAeA,MAAM,+BAEF;CACF,OAAO;EACL,aACE;EACF,mBAAmB;CACrB;CACA,KAAK;EACH,aACE;EACF,mBAAmB;CACrB;AACF;;;;;;;;;;AAWA,MAAM,6BAA4C;CAChD;EACE,aACE;EACF,kBAAkB,CAAC,qBAAqB;EACxC,mBAAmB;EACnB,aAAa,CACX,wRACF;CACF;CAEA;EACE,aAAa;EACb,kBAAkB,CAAC,aAAa;EAChC,mBAAmB;EACnB,aAAa,CACX,yRACF;CACF;CAEA;EACE,aAAa;EACb,kBAAkB,CAAC,KAAK;EACxB,mBAAmB;EACnB,aAAa,CACX,iRACF;CACF;CACA;EACE,aACE;EACF,kBAAkB;GAAC;GAAQ;GAAkB;EAAU;EACvD,mBAAmB;EACnB,aAAa,CACX,iPACF;CACF;AACF;AAEA,SAAS,6BACP,YACA,EAAE,aAAa,qBACP;CAYR,OAAO;EAAE;EAAa,cAAA,CAVpB;GACE,sBAAsB;GACtB,kBAAkB,CAAC,UAAU;GAC7B;EACF,GACA,GAAG,2BAA2B,KAC3B,UAAuB;GAAE,GAAG;GAAM,kBAAkB,CAAC,UAAU;EAAE,EACpE,CAG+B;CAAE;AACrC;AAEA,SAAS,+BAAuD;CAC9D,MAAM,UAAkC,CAAC;CAEzC,KAAK,MAAM,CAAC,YAAY,WAAW,OAAO,QACxC,4BACF,GAAG;EACD,MAAM,SAAS,WAAW,EAAE,CAAC,YAAY,IAAI,WAAW,MAAM,CAAC;EAC/D,QAAQ,oBAAoB,YAAY,6BACtC,YACA,MACF;CACF;CAEA,OAAO;AACT;AAEA,MAAa,UAAkC;CAC7C,8BAA8B;EAC5B,aACE;EACF,SAAS,CAAC,4BAA4B;EACtC,cAAc,CACZ;GACE,aAAa;GACb,SAAS;GACT,eAAe,CAAC,UAAU;GAC1B,eAAe,CAAC,OAAO;EACzB,GACA;GACE,aACE;GACF,SAAS;GACT,eAAe,CAAC,UAAU;GAC1B,eAAe,CAAC,OAAO;GACvB,kBAAkB,CAAC,GAAG,kBAAkB;EAC1C,CACF;CACF;CACA,GAAG,6BAA6B;CAChC,yBAAyB;EACvB,aACE;EACF,SAAS,CAAC,oBAAoB;EAC9B,wBAAwB;EACxB,cAAc,CACZ;GACE,SAAS;GACT,mBAAmB,CAAC,GAAG;EACzB,CACF;EACA,qBAAqB,EACnB,SAAS,KACX;CACF;CACA,qBAAqB;EACnB,aAAa;EACb,cAAc,CACZ;GACE,iBAAiB,CAAC,uBAAuB;GACzC,eAAe;IACb;IACA;IACA;IACA;IACA;IACA;GACF;GACA,mBAAmB,EACjB,SACE,4KACJ;EACF,CACF;CACF;AACF;AAEgD,OAAO,KACrD,4BACF"}
+{"version":3,"file":"security.preset.js","names":[],"sources":["../../../../lib/config/presets/internal/security.preset.ts"],"sourcesContent":["import type { DatasourceName } from '../../../datasource-list.generated.ts';\nimport type { PackageRule } from '../../types.ts';\nimport { UpdateTypesOptions } from '../../types.ts';\nimport type { Preset } from '../types.ts';\n\ninterface MinimumReleaseAgeDatasource {\n  description: string;\n  minimumReleaseAge: string;\n}\n\n/**\n * Datasources for which we expose a `security:minimumReleaseAge*` preset.\n *\n * Only supported for Datasources that have `releaseTimestampSupport`.\n */\nconst minimumReleaseAgeDatasources: Partial<\n  Record<DatasourceName, MinimumReleaseAgeDatasource>\n> = {\n  crate: {\n    description:\n      \"Wait until the Crate version is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behaviour in crates, and b) reduces the risk of upgrading to a newly published crate that its owner deletes during crates.io's initial 72-hour deletion window.\",\n    minimumReleaseAge: '3 days',\n  },\n  npm: {\n    description:\n      'Wait until the npm package is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behaviour in packages, and b) prevents the maintainer and/or NPM from unpublishing a package you already upgraded to, breaking builds.',\n    minimumReleaseAge: '3 days',\n  },\n  pypi: {\n    description:\n      'Wait until the Python package is three days old before raising the update. This introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behaviour in packages.',\n    minimumReleaseAge: '3 days',\n  },\n};\n\n/**\n * Certain update types don't currently support `releaseTimestamp`s, so applying `minimumReleaseAge` to them results in updates that will never come.\n *\n * Instead, we opt them out of `minimumReleaseAge`, and add a warning for the user.\n *\n * This must stay in sync with the update types documented as _not_ supported (❌) in `docs/usage/key-concepts/minimum-release-age.md`, so we opt-out any unsupported `updateType`s.\n *\n * These rules are datasource-agnostic (`matchDatasources` is added per preset), so they are shared across every generated `security:minimumReleaseAge*` preset to keep the warnings consistent.\n */\nconst unsupportedUpdateTypeRules: PackageRule[] = [\n  {\n    description:\n      'Do not require Minimum Release Age for update types that are controlled by the package manager',\n    matchUpdateTypes: ['lockFileMaintenance'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's lock file maintenance functionality does not support validating Minimum Release Age, as the package manager performs the required changes to update package(s). Confirm whether your package manager perform its own validation for the Minimum Release Age of packages.\",\n    ],\n  },\n  // TODO #39400\n  {\n    description: 'Do not require Minimum Release Age for package replacements',\n    matchUpdateTypes: ['replacement'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's replacement functionality [does not currently](https://github.com/renovatebot/renovate/issues/39400) wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).\",\n    ],\n  },\n  // TODO #40288\n  {\n    description: 'Do not require Minimum Release Age for package pinning',\n    matchUpdateTypes: ['pin'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      \"⚠️ Renovate's pin functionality [does not currently](https://github.com/renovatebot/renovate/issues/40288) wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).\",\n    ],\n  },\n  {\n    description:\n      'Do not require Minimum Release Age for update types that do not provide a release timestamp',\n    matchUpdateTypes: ['bump', 'lockfileUpdate', 'rollback'],\n    minimumReleaseAge: null,\n    prBodyNotes: [\n      '⚠️ Renovate does not enforce Minimum Release Age for `bump`, `lockfileUpdate`, or `rollback` updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).',\n    ],\n  },\n];\n\nfunction buildMinimumReleaseAgePreset(\n  datasource: string,\n  { description, minimumReleaseAge }: MinimumReleaseAgeDatasource,\n): Preset {\n  const packageRules: PackageRule[] = [\n    {\n      internalChecksFilter: 'strict',\n      matchDatasources: [datasource],\n      minimumReleaseAge,\n    },\n    ...unsupportedUpdateTypeRules.map(\n      (rule): PackageRule => ({ ...rule, matchDatasources: [datasource] }),\n    ),\n  ];\n\n  return { description, packageRules };\n}\n\nfunction loadMinimumReleaseAgePresets(): Record<string, Preset> {\n  const presets: Record<string, Preset> = {};\n\n  for (const [datasource, config] of Object.entries(\n    minimumReleaseAgeDatasources,\n  )) {\n    const suffix = datasource[0].toUpperCase() + datasource.slice(1);\n    presets[`minimumReleaseAge${suffix}`] = buildMinimumReleaseAgePreset(\n      datasource,\n      config,\n    );\n  }\n\n  return presets;\n}\n\nexport const presets: Record<string, Preset> = {\n  gomodIndirectSecurityUpdates: {\n    description:\n      'Enable go.mod indirect dependency updates only when vulnerabilities have been detected.',\n    extends: [':enableVulnerabilityAlerts'],\n    packageRules: [\n      {\n        description: 'Enable lookups for indirect go.mod dependencies',\n        enabled: true,\n        matchDepTypes: ['indirect'],\n        matchManagers: ['gomod'],\n      },\n      {\n        description:\n          'Disable non-security updates for indirect go.mod dependencies (vulnerability alerts use force to override this)',\n        enabled: false,\n        matchDepTypes: ['indirect'],\n        matchManagers: ['gomod'],\n        matchUpdateTypes: [...UpdateTypesOptions],\n      },\n    ],\n  },\n  ...loadMinimumReleaseAgePresets(),\n  'only-security-updates': {\n    description:\n      'Only update dependencies if vulnerabilities have been detected.',\n    extends: ['config:recommended'],\n    osvVulnerabilityAlerts: true,\n    packageRules: [\n      {\n        enabled: false,\n        matchPackageNames: ['*'],\n      },\n    ],\n    vulnerabilityAlerts: {\n      enabled: true,\n    },\n  },\n  'openssf-scorecard': {\n    description: 'Show OpenSSF badge on pull requests.',\n    packageRules: [\n      {\n        matchSourceUrls: ['https://github.com/**'],\n        prBodyColumns: [\n          'Package',\n          'Type',\n          'Update',\n          'Change',\n          'Pending',\n          'OpenSSF',\n        ],\n        prBodyDefinitions: {\n          OpenSSF:\n            '[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/{{sourceRepo}}/badge)](https://securityscorecards.dev/viewer/?uri=github.com/{{sourceRepo}})',\n        },\n      },\n    ],\n  },\n};\n\nexport const minimumReleaseAgeDatasourceNames = Object.keys(\n  minimumReleaseAgeDatasources,\n);\n"],"mappings":";;;;;;;AAeA,MAAM,+BAEF;CACF,OAAO;EACL,aACE;EACF,mBAAmB;CACrB;CACA,KAAK;EACH,aACE;EACF,mBAAmB;CACrB;CACA,MAAM;EACJ,aACE;EACF,mBAAmB;CACrB;AACF;;;;;;;;;;AAWA,MAAM,6BAA4C;CAChD;EACE,aACE;EACF,kBAAkB,CAAC,qBAAqB;EACxC,mBAAmB;EACnB,aAAa,CACX,wRACF;CACF;CAEA;EACE,aAAa;EACb,kBAAkB,CAAC,aAAa;EAChC,mBAAmB;EACnB,aAAa,CACX,yRACF;CACF;CAEA;EACE,aAAa;EACb,kBAAkB,CAAC,KAAK;EACxB,mBAAmB;EACnB,aAAa,CACX,iRACF;CACF;CACA;EACE,aACE;EACF,kBAAkB;GAAC;GAAQ;GAAkB;EAAU;EACvD,mBAAmB;EACnB,aAAa,CACX,iPACF;CACF;AACF;AAEA,SAAS,6BACP,YACA,EAAE,aAAa,qBACP;CAYR,OAAO;EAAE;EAAa,cAAA,CAVpB;GACE,sBAAsB;GACtB,kBAAkB,CAAC,UAAU;GAC7B;EACF,GACA,GAAG,2BAA2B,KAC3B,UAAuB;GAAE,GAAG;GAAM,kBAAkB,CAAC,UAAU;EAAE,EACpE,CAG+B;CAAE;AACrC;AAEA,SAAS,+BAAuD;CAC9D,MAAM,UAAkC,CAAC;CAEzC,KAAK,MAAM,CAAC,YAAY,WAAW,OAAO,QACxC,4BACF,GAAG;EACD,MAAM,SAAS,WAAW,EAAE,CAAC,YAAY,IAAI,WAAW,MAAM,CAAC;EAC/D,QAAQ,oBAAoB,YAAY,6BACtC,YACA,MACF;CACF;CAEA,OAAO;AACT;AAEA,MAAa,UAAkC;CAC7C,8BAA8B;EAC5B,aACE;EACF,SAAS,CAAC,4BAA4B;EACtC,cAAc,CACZ;GACE,aAAa;GACb,SAAS;GACT,eAAe,CAAC,UAAU;GAC1B,eAAe,CAAC,OAAO;EACzB,GACA;GACE,aACE;GACF,SAAS;GACT,eAAe,CAAC,UAAU;GAC1B,eAAe,CAAC,OAAO;GACvB,kBAAkB,CAAC,GAAG,kBAAkB;EAC1C,CACF;CACF;CACA,GAAG,6BAA6B;CAChC,yBAAyB;EACvB,aACE;EACF,SAAS,CAAC,oBAAoB;EAC9B,wBAAwB;EACxB,cAAc,CACZ;GACE,SAAS;GACT,mBAAmB,CAAC,GAAG;EACzB,CACF;EACA,qBAAqB,EACnB,SAAS,KACX;CACF;CACA,qBAAqB;EACnB,aAAa;EACb,cAAc,CACZ;GACE,iBAAiB,CAAC,uBAAuB;GACzC,eAAe;IACb;IACA;IACA;IACA;IACA;IACA;GACF;GACA,mBAAmB,EACjB,SACE,4KACJ;EACF,CACF;CACF;AACF;AAEgD,OAAO,KACrD,4BACF"}

package/dist/modules/datasource/npm/get.js

@@ -121,7 +121,11 @@ async function getDependency(http, registryUrl, packageName) {
 			}
 			throw err;
 		}
-		logger.debug({ err }, "Unknown npm lookup error");
+		logger.debug({
+			err,
+			packageName,
+			registryUrl
+		}, "Unknown npm lookup error");
 		return null;
 	}
 }

package/dist/modules/datasource/npm/get.js.map

@@ -1 +1 @@
-{"version":3,"file":"get.js","names":["hostRules.find"],"sources":["../../../../lib/modules/datasource/npm/get.ts"],"sourcesContent":["import { isNonEmptyString, isString } from '@sindresorhus/is';\nimport { z } from 'zod/v4';\nimport { HOST_DISABLED } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { ExternalHostError } from '../../../types/errors/external-host-error.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { PackageHttpCacheProvider } from '../../../util/http/cache/package-http-cache-provider.ts';\nimport type { Http } from '../../../util/http/index.ts';\nimport type { HttpOptions } from '../../../util/http/types.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { DeepNullish } from '../../../util/schema-utils/index.ts';\nimport { asTimestamp } from '../../../util/timestamp.ts';\nimport { joinUrlParts } from '../../../util/url.ts';\nimport type { Release, ReleaseResult } from '../types.ts';\nimport { defaultRegistryUrl } from './common.ts';\nimport { CachedPackument, NpmResponse } from './schema.ts';\n\nconst SHORT_REPO_REGEX = regEx(\n  /^((?<platform>bitbucket|github|gitlab):)?(?<shortRepo>[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+)$/,\n);\n\nconst platformMapping: Record<string, string> = {\n  bitbucket: 'https://bitbucket.org/',\n  github: 'https://github.com/',\n  gitlab: 'https://gitlab.com/',\n};\n\ninterface PackageSource {\n  sourceUrl: string | null;\n  sourceDirectory: string | null;\n}\n\nconst PackageSource = z\n  .union([\n    z\n      .string()\n      .nonempty()\n      .transform((repository): PackageSource => {\n        let sourceUrl: string | null = null;\n        const sourceDirectory = null;\n        const shortMatch = repository.match(SHORT_REPO_REGEX);\n        if (shortMatch?.groups) {\n          const { platform = 'github', shortRepo } = shortMatch.groups;\n          sourceUrl = platformMapping[platform] + shortRepo;\n        } else {\n          sourceUrl = repository;\n        }\n        return { sourceUrl, sourceDirectory };\n      }),\n    DeepNullish(\n      z.object({\n        url: z.string().nonempty().optional(),\n        directory: z.string().nonempty().optional(),\n      }),\n    ).transform(({ url, directory }) => {\n      const res: PackageSource = { sourceUrl: null, sourceDirectory: null };\n\n      if (url) {\n        res.sourceUrl = url;\n      }\n\n      if (directory) {\n        res.sourceDirectory = directory;\n      }\n\n      return res;\n    }),\n  ])\n  .catch({ sourceUrl: null, sourceDirectory: null });\n\nexport async function getDependency(\n  http: Http,\n  registryUrl: string,\n  packageName: string,\n): Promise<ReleaseResult | null> {\n  logger.trace(`npm.getDependency(${packageName})`);\n\n  const packageUrl = joinUrlParts(registryUrl, packageName.replace('/', '%2F'));\n\n  try {\n    const cacheProvider = new PackageHttpCacheProvider({\n      namespace: 'datasource-npm:cache-provider',\n      checkAuthorizationHeader: false, // We don't rely on whether user token is provided or not\n      checkCacheControlHeader: true,\n      writeSchema: CachedPackument,\n    });\n    const options: HttpOptions = { cacheProvider };\n\n    // set abortOnError for registry.npmjs.org if no hostRule with explicit abortOnError exists\n    if (\n      registryUrl === defaultRegistryUrl &&\n      hostRules.find({ url: defaultRegistryUrl })?.abortOnError === undefined\n    ) {\n      logger.trace(\n        { packageName, registry: defaultRegistryUrl },\n        'setting abortOnError hostRule for well known host',\n      );\n      hostRules.add({\n        matchHost: defaultRegistryUrl,\n        abortOnError: true,\n      });\n    }\n\n    const resp = await http.getJson(packageUrl, options, NpmResponse);\n    const { body: res } = resp;\n    if (!res.versions || !Object.keys(res.versions).length) {\n      // Registry returned a 200 OK but with no versions\n      logger.debug(`No versions returned for npm dependency ${packageName}`);\n      return null;\n    }\n\n    const latestVersion = res.versions[res['dist-tags']?.latest ?? ''];\n    res.repository ??= latestVersion?.repository;\n    res.homepage ??= latestVersion?.homepage;\n\n    const { sourceUrl, sourceDirectory } = PackageSource.parse(res.repository);\n\n    // Simplify response before caching and returning\n    const dep: ReleaseResult = {\n      homepage: res.homepage,\n      releases: [],\n      tags: res['dist-tags'],\n      registryUrl,\n    };\n\n    if (sourceUrl) {\n      dep.sourceUrl = sourceUrl;\n    }\n\n    if (sourceDirectory) {\n      dep.sourceDirectory = sourceDirectory;\n    }\n\n    if (latestVersion?.deprecated) {\n      dep.deprecationMessage = `On registry \\`${registryUrl}\\`, the \"latest\" version of dependency \\`${packageName}\\` has the following deprecation notice:\\n\\n\\`${latestVersion.deprecated}\\`\\n\\nMarking the latest version of an npm package as deprecated results in the entire package being considered deprecated, so contact the package author you think this is a mistake.`;\n    }\n    dep.releases = Object.keys(res.versions).map((version) => {\n      const release: Release = {\n        version,\n        gitRef: res.versions?.[version].gitHead,\n        dependencies: res.versions?.[version].dependencies,\n        devDependencies: res.versions?.[version].devDependencies,\n        attestation: isString(res.versions?.[version].dist?.attestations?.url),\n      };\n      const releaseTimestamp = asTimestamp(res.time?.[version]);\n      if (releaseTimestamp) {\n        release.releaseTimestamp = releaseTimestamp;\n      }\n      if (res.versions?.[version].deprecated) {\n        release.isDeprecated = true;\n      }\n      const nodeConstraint = res.versions?.[version].engines?.node;\n      if (isNonEmptyString(nodeConstraint)) {\n        release.constraints = { node: [nodeConstraint] };\n      }\n      const source = PackageSource.parse(res.versions?.[version].repository);\n      if (source.sourceUrl && source.sourceUrl !== dep.sourceUrl) {\n        release.sourceUrl = source.sourceUrl;\n      }\n      if (\n        source.sourceDirectory &&\n        source.sourceDirectory !== dep.sourceDirectory\n      ) {\n        release.sourceDirectory = source.sourceDirectory;\n      }\n      if (dep.deprecationMessage) {\n        release.isDeprecated = true;\n      }\n      return release;\n    });\n\n    const isPublic = resp.headers?.['cache-control']\n      ?.toLocaleLowerCase()\n      ?.split(regEx(/\\s*,\\s*/))\n      ?.includes('public');\n    if (!isPublic) {\n      dep.isPrivate = true;\n    }\n\n    logger.trace({ dep }, 'dep');\n    return dep;\n  } catch (err) {\n    const actualError = err instanceof ExternalHostError ? err.err : err;\n    const ignoredStatusCodes = [401, 402, 403, 404];\n    const ignoredResponseCodes = ['ENOTFOUND'];\n    if (\n      actualError.message === HOST_DISABLED ||\n      ignoredStatusCodes.includes(actualError.statusCode) ||\n      ignoredResponseCodes.includes(actualError.code)\n    ) {\n      return null;\n    }\n\n    if (err instanceof ExternalHostError) {\n      if (actualError.name === 'ParseError' && actualError.body) {\n        actualError.body = 'err.body deleted by Renovate';\n        err.err = actualError;\n      }\n      throw err;\n    }\n    logger.debug({ err }, 'Unknown npm lookup error');\n    return null;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAiBA,MAAM,mBAAmB,MACvB,0FACF;AAEA,MAAM,kBAA0C;CAC9C,WAAW;CACX,QAAQ;CACR,QAAQ;AACV;AAOA,MAAM,gBAAgB,EACnB,MAAM,CACL,EACG,OAAO,CAAC,CACR,SAAS,CAAC,CACV,WAAW,eAA8B;CACxC,IAAI,YAA2B;CAC/B,MAAM,kBAAkB;CACxB,MAAM,aAAa,WAAW,MAAM,gBAAgB;CACpD,IAAI,YAAY,QAAQ;EACtB,MAAM,EAAE,WAAW,UAAU,cAAc,WAAW;EACtD,YAAY,gBAAgB,YAAY;CAC1C,OACE,YAAY;CAEd,OAAO;EAAE;EAAW;CAAgB;AACtC,CAAC,GACH,YACE,EAAE,OAAO;CACP,KAAK,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CACpC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;AAC5C,CAAC,CACH,CAAC,CAAC,WAAW,EAAE,KAAK,gBAAgB;CAClC,MAAM,MAAqB;EAAE,WAAW;EAAM,iBAAiB;CAAK;CAEpE,IAAI,KACF,IAAI,YAAY;CAGlB,IAAI,WACF,IAAI,kBAAkB;CAGxB,OAAO;AACT,CAAC,CACH,CAAC,CAAC,CACD,MAAM;CAAE,WAAW;CAAM,iBAAiB;AAAK,CAAC;AAEnD,eAAsB,cACpB,MACA,aACA,aAC+B;CAC/B,OAAO,MAAM,qBAAqB,YAAY,EAAE;CAEhD,MAAM,aAAa,aAAa,aAAa,YAAY,QAAQ,KAAK,KAAK,CAAC;CAE5E,IAAI;EAOF,MAAM,UAAuB,EAAE,eAAA,IANL,yBAAyB;GACjD,WAAW;GACX,0BAA0B;GAC1B,yBAAyB;GACzB,aAAa;EACf,CAC2C,EAAE;EAG7C,IACE,gBAAA,gCACAA,KAAe,EAAE,KAAA,6BAAwB,CAAC,CAAC,EAAE,iBAAiB,KAAA,GAC9D;GACA,OAAO,MACL;IAAE;IAAa,UAAU;GAAmB,GAC5C,mDACF;GACA,IAAc;IACZ,WAAW;IACX,cAAc;GAChB,CAAC;EACH;EAEA,MAAM,OAAO,MAAM,KAAK,QAAQ,YAAY,SAAS,WAAW;EAChE,MAAM,EAAE,MAAM,QAAQ;EACtB,IAAI,CAAC,IAAI,YAAY,CAAC,OAAO,KAAK,IAAI,QAAQ,CAAC,CAAC,QAAQ;GAEtD,OAAO,MAAM,2CAA2C,aAAa;GACrE,OAAO;EACT;EAEA,MAAM,gBAAgB,IAAI,SAAS,IAAI,YAAY,EAAE,UAAU;EAC/D,IAAI,eAAe,eAAe;EAClC,IAAI,aAAa,eAAe;EAEhC,MAAM,EAAE,WAAW,oBAAoB,cAAc,MAAM,IAAI,UAAU;EAGzE,MAAM,MAAqB;GACzB,UAAU,IAAI;GACd,UAAU,CAAC;GACX,MAAM,IAAI;GACV;EACF;EAEA,IAAI,WACF,IAAI,YAAY;EAGlB,IAAI,iBACF,IAAI,kBAAkB;EAGxB,IAAI,eAAe,YACjB,IAAI,qBAAqB,iBAAiB,YAAY,2CAA2C,YAAY,gDAAgD,cAAc,WAAW;EAExL,IAAI,WAAW,OAAO,KAAK,IAAI,QAAQ,CAAC,CAAC,KAAK,YAAY;GACxD,MAAM,UAAmB;IACvB;IACA,QAAQ,IAAI,WAAW,QAAQ,CAAC;IAChC,cAAc,IAAI,WAAW,QAAQ,CAAC;IACtC,iBAAiB,IAAI,WAAW,QAAQ,CAAC;IACzC,aAAa,SAAS,IAAI,WAAW,QAAQ,CAAC,MAAM,cAAc,GAAG;GACvE;GACA,MAAM,mBAAmB,YAAY,IAAI,OAAO,QAAQ;GACxD,IAAI,kBACF,QAAQ,mBAAmB;GAE7B,IAAI,IAAI,WAAW,QAAQ,CAAC,YAC1B,QAAQ,eAAe;GAEzB,MAAM,iBAAiB,IAAI,WAAW,QAAQ,CAAC,SAAS;GACxD,IAAI,iBAAiB,cAAc,GACjC,QAAQ,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE;GAEjD,MAAM,SAAS,cAAc,MAAM,IAAI,WAAW,QAAQ,CAAC,UAAU;GACrE,IAAI,OAAO,aAAa,OAAO,cAAc,IAAI,WAC/C,QAAQ,YAAY,OAAO;GAE7B,IACE,OAAO,mBACP,OAAO,oBAAoB,IAAI,iBAE/B,QAAQ,kBAAkB,OAAO;GAEnC,IAAI,IAAI,oBACN,QAAQ,eAAe;GAEzB,OAAO;EACT,CAAC;EAMD,IAAI,CAJa,KAAK,UAAU,gBAAgB,EAC5C,kBAAkB,CAAC,EACnB,MAAM,MAAM,SAAS,CAAC,CAAC,EACvB,SAAS,QAAQ,GAEnB,IAAI,YAAY;EAGlB,OAAO,MAAM,EAAE,IAAI,GAAG,KAAK;EAC3B,OAAO;CACT,SAAS,KAAK;EACZ,MAAM,cAAc,eAAe,oBAAoB,IAAI,MAAM;EAGjE,IACE,YAAY,YAAA,mBACZ;GAJ0B;GAAK;GAAK;GAAK;EAIxB,CAAC,CAAC,SAAS,YAAY,UAAU,KAClD,CAJ4B,WAIT,CAAC,CAAC,SAAS,YAAY,IAAI,GAE9C,OAAO;EAGT,IAAI,eAAe,mBAAmB;GACpC,IAAI,YAAY,SAAS,gBAAgB,YAAY,MAAM;IACzD,YAAY,OAAO;IACnB,IAAI,MAAM;GACZ;GACA,MAAM;EACR;EACA,OAAO,MAAM,EAAE,IAAI,GAAG,0BAA0B;EAChD,OAAO;CACT;AACF"}
+{"version":3,"file":"get.js","names":["hostRules.find"],"sources":["../../../../lib/modules/datasource/npm/get.ts"],"sourcesContent":["import { isNonEmptyString, isString } from '@sindresorhus/is';\nimport { z } from 'zod/v4';\nimport { HOST_DISABLED } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { ExternalHostError } from '../../../types/errors/external-host-error.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { PackageHttpCacheProvider } from '../../../util/http/cache/package-http-cache-provider.ts';\nimport type { Http } from '../../../util/http/index.ts';\nimport type { HttpOptions } from '../../../util/http/types.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { DeepNullish } from '../../../util/schema-utils/index.ts';\nimport { asTimestamp } from '../../../util/timestamp.ts';\nimport { joinUrlParts } from '../../../util/url.ts';\nimport type { Release, ReleaseResult } from '../types.ts';\nimport { defaultRegistryUrl } from './common.ts';\nimport { CachedPackument, NpmResponse } from './schema.ts';\n\nconst SHORT_REPO_REGEX = regEx(\n  /^((?<platform>bitbucket|github|gitlab):)?(?<shortRepo>[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+)$/,\n);\n\nconst platformMapping: Record<string, string> = {\n  bitbucket: 'https://bitbucket.org/',\n  github: 'https://github.com/',\n  gitlab: 'https://gitlab.com/',\n};\n\ninterface PackageSource {\n  sourceUrl: string | null;\n  sourceDirectory: string | null;\n}\n\nconst PackageSource = z\n  .union([\n    z\n      .string()\n      .nonempty()\n      .transform((repository): PackageSource => {\n        let sourceUrl: string | null = null;\n        const sourceDirectory = null;\n        const shortMatch = repository.match(SHORT_REPO_REGEX);\n        if (shortMatch?.groups) {\n          const { platform = 'github', shortRepo } = shortMatch.groups;\n          sourceUrl = platformMapping[platform] + shortRepo;\n        } else {\n          sourceUrl = repository;\n        }\n        return { sourceUrl, sourceDirectory };\n      }),\n    DeepNullish(\n      z.object({\n        url: z.string().nonempty().optional(),\n        directory: z.string().nonempty().optional(),\n      }),\n    ).transform(({ url, directory }) => {\n      const res: PackageSource = { sourceUrl: null, sourceDirectory: null };\n\n      if (url) {\n        res.sourceUrl = url;\n      }\n\n      if (directory) {\n        res.sourceDirectory = directory;\n      }\n\n      return res;\n    }),\n  ])\n  .catch({ sourceUrl: null, sourceDirectory: null });\n\nexport async function getDependency(\n  http: Http,\n  registryUrl: string,\n  packageName: string,\n): Promise<ReleaseResult | null> {\n  logger.trace(`npm.getDependency(${packageName})`);\n\n  const packageUrl = joinUrlParts(registryUrl, packageName.replace('/', '%2F'));\n\n  try {\n    const cacheProvider = new PackageHttpCacheProvider({\n      namespace: 'datasource-npm:cache-provider',\n      checkAuthorizationHeader: false, // We don't rely on whether user token is provided or not\n      checkCacheControlHeader: true,\n      writeSchema: CachedPackument,\n    });\n    const options: HttpOptions = { cacheProvider };\n\n    // set abortOnError for registry.npmjs.org if no hostRule with explicit abortOnError exists\n    if (\n      registryUrl === defaultRegistryUrl &&\n      hostRules.find({ url: defaultRegistryUrl })?.abortOnError === undefined\n    ) {\n      logger.trace(\n        { packageName, registry: defaultRegistryUrl },\n        'setting abortOnError hostRule for well known host',\n      );\n      hostRules.add({\n        matchHost: defaultRegistryUrl,\n        abortOnError: true,\n      });\n    }\n\n    const resp = await http.getJson(packageUrl, options, NpmResponse);\n    const { body: res } = resp;\n    if (!res.versions || !Object.keys(res.versions).length) {\n      // Registry returned a 200 OK but with no versions\n      logger.debug(`No versions returned for npm dependency ${packageName}`);\n      return null;\n    }\n\n    const latestVersion = res.versions[res['dist-tags']?.latest ?? ''];\n    res.repository ??= latestVersion?.repository;\n    res.homepage ??= latestVersion?.homepage;\n\n    const { sourceUrl, sourceDirectory } = PackageSource.parse(res.repository);\n\n    // Simplify response before caching and returning\n    const dep: ReleaseResult = {\n      homepage: res.homepage,\n      releases: [],\n      tags: res['dist-tags'],\n      registryUrl,\n    };\n\n    if (sourceUrl) {\n      dep.sourceUrl = sourceUrl;\n    }\n\n    if (sourceDirectory) {\n      dep.sourceDirectory = sourceDirectory;\n    }\n\n    if (latestVersion?.deprecated) {\n      dep.deprecationMessage = `On registry \\`${registryUrl}\\`, the \"latest\" version of dependency \\`${packageName}\\` has the following deprecation notice:\\n\\n\\`${latestVersion.deprecated}\\`\\n\\nMarking the latest version of an npm package as deprecated results in the entire package being considered deprecated, so contact the package author you think this is a mistake.`;\n    }\n    dep.releases = Object.keys(res.versions).map((version) => {\n      const release: Release = {\n        version,\n        gitRef: res.versions?.[version].gitHead,\n        dependencies: res.versions?.[version].dependencies,\n        devDependencies: res.versions?.[version].devDependencies,\n        attestation: isString(res.versions?.[version].dist?.attestations?.url),\n      };\n      const releaseTimestamp = asTimestamp(res.time?.[version]);\n      if (releaseTimestamp) {\n        release.releaseTimestamp = releaseTimestamp;\n      }\n      if (res.versions?.[version].deprecated) {\n        release.isDeprecated = true;\n      }\n      const nodeConstraint = res.versions?.[version].engines?.node;\n      if (isNonEmptyString(nodeConstraint)) {\n        release.constraints = { node: [nodeConstraint] };\n      }\n      const source = PackageSource.parse(res.versions?.[version].repository);\n      if (source.sourceUrl && source.sourceUrl !== dep.sourceUrl) {\n        release.sourceUrl = source.sourceUrl;\n      }\n      if (\n        source.sourceDirectory &&\n        source.sourceDirectory !== dep.sourceDirectory\n      ) {\n        release.sourceDirectory = source.sourceDirectory;\n      }\n      if (dep.deprecationMessage) {\n        release.isDeprecated = true;\n      }\n      return release;\n    });\n\n    const isPublic = resp.headers?.['cache-control']\n      ?.toLocaleLowerCase()\n      ?.split(regEx(/\\s*,\\s*/))\n      ?.includes('public');\n    if (!isPublic) {\n      dep.isPrivate = true;\n    }\n\n    logger.trace({ dep }, 'dep');\n    return dep;\n  } catch (err) {\n    const actualError = err instanceof ExternalHostError ? err.err : err;\n    const ignoredStatusCodes = [401, 402, 403, 404];\n    const ignoredResponseCodes = ['ENOTFOUND'];\n    if (\n      actualError.message === HOST_DISABLED ||\n      ignoredStatusCodes.includes(actualError.statusCode) ||\n      ignoredResponseCodes.includes(actualError.code)\n    ) {\n      return null;\n    }\n\n    if (err instanceof ExternalHostError) {\n      if (actualError.name === 'ParseError' && actualError.body) {\n        actualError.body = 'err.body deleted by Renovate';\n        err.err = actualError;\n      }\n      throw err;\n    }\n    logger.debug({ err, packageName, registryUrl }, 'Unknown npm lookup error');\n    return null;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAiBA,MAAM,mBAAmB,MACvB,0FACF;AAEA,MAAM,kBAA0C;CAC9C,WAAW;CACX,QAAQ;CACR,QAAQ;AACV;AAOA,MAAM,gBAAgB,EACnB,MAAM,CACL,EACG,OAAO,CAAC,CACR,SAAS,CAAC,CACV,WAAW,eAA8B;CACxC,IAAI,YAA2B;CAC/B,MAAM,kBAAkB;CACxB,MAAM,aAAa,WAAW,MAAM,gBAAgB;CACpD,IAAI,YAAY,QAAQ;EACtB,MAAM,EAAE,WAAW,UAAU,cAAc,WAAW;EACtD,YAAY,gBAAgB,YAAY;CAC1C,OACE,YAAY;CAEd,OAAO;EAAE;EAAW;CAAgB;AACtC,CAAC,GACH,YACE,EAAE,OAAO;CACP,KAAK,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CACpC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;AAC5C,CAAC,CACH,CAAC,CAAC,WAAW,EAAE,KAAK,gBAAgB;CAClC,MAAM,MAAqB;EAAE,WAAW;EAAM,iBAAiB;CAAK;CAEpE,IAAI,KACF,IAAI,YAAY;CAGlB,IAAI,WACF,IAAI,kBAAkB;CAGxB,OAAO;AACT,CAAC,CACH,CAAC,CAAC,CACD,MAAM;CAAE,WAAW;CAAM,iBAAiB;AAAK,CAAC;AAEnD,eAAsB,cACpB,MACA,aACA,aAC+B;CAC/B,OAAO,MAAM,qBAAqB,YAAY,EAAE;CAEhD,MAAM,aAAa,aAAa,aAAa,YAAY,QAAQ,KAAK,KAAK,CAAC;CAE5E,IAAI;EAOF,MAAM,UAAuB,EAAE,eAAA,IANL,yBAAyB;GACjD,WAAW;GACX,0BAA0B;GAC1B,yBAAyB;GACzB,aAAa;EACf,CAC2C,EAAE;EAG7C,IACE,gBAAA,gCACAA,KAAe,EAAE,KAAA,6BAAwB,CAAC,CAAC,EAAE,iBAAiB,KAAA,GAC9D;GACA,OAAO,MACL;IAAE;IAAa,UAAU;GAAmB,GAC5C,mDACF;GACA,IAAc;IACZ,WAAW;IACX,cAAc;GAChB,CAAC;EACH;EAEA,MAAM,OAAO,MAAM,KAAK,QAAQ,YAAY,SAAS,WAAW;EAChE,MAAM,EAAE,MAAM,QAAQ;EACtB,IAAI,CAAC,IAAI,YAAY,CAAC,OAAO,KAAK,IAAI,QAAQ,CAAC,CAAC,QAAQ;GAEtD,OAAO,MAAM,2CAA2C,aAAa;GACrE,OAAO;EACT;EAEA,MAAM,gBAAgB,IAAI,SAAS,IAAI,YAAY,EAAE,UAAU;EAC/D,IAAI,eAAe,eAAe;EAClC,IAAI,aAAa,eAAe;EAEhC,MAAM,EAAE,WAAW,oBAAoB,cAAc,MAAM,IAAI,UAAU;EAGzE,MAAM,MAAqB;GACzB,UAAU,IAAI;GACd,UAAU,CAAC;GACX,MAAM,IAAI;GACV;EACF;EAEA,IAAI,WACF,IAAI,YAAY;EAGlB,IAAI,iBACF,IAAI,kBAAkB;EAGxB,IAAI,eAAe,YACjB,IAAI,qBAAqB,iBAAiB,YAAY,2CAA2C,YAAY,gDAAgD,cAAc,WAAW;EAExL,IAAI,WAAW,OAAO,KAAK,IAAI,QAAQ,CAAC,CAAC,KAAK,YAAY;GACxD,MAAM,UAAmB;IACvB;IACA,QAAQ,IAAI,WAAW,QAAQ,CAAC;IAChC,cAAc,IAAI,WAAW,QAAQ,CAAC;IACtC,iBAAiB,IAAI,WAAW,QAAQ,CAAC;IACzC,aAAa,SAAS,IAAI,WAAW,QAAQ,CAAC,MAAM,cAAc,GAAG;GACvE;GACA,MAAM,mBAAmB,YAAY,IAAI,OAAO,QAAQ;GACxD,IAAI,kBACF,QAAQ,mBAAmB;GAE7B,IAAI,IAAI,WAAW,QAAQ,CAAC,YAC1B,QAAQ,eAAe;GAEzB,MAAM,iBAAiB,IAAI,WAAW,QAAQ,CAAC,SAAS;GACxD,IAAI,iBAAiB,cAAc,GACjC,QAAQ,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE;GAEjD,MAAM,SAAS,cAAc,MAAM,IAAI,WAAW,QAAQ,CAAC,UAAU;GACrE,IAAI,OAAO,aAAa,OAAO,cAAc,IAAI,WAC/C,QAAQ,YAAY,OAAO;GAE7B,IACE,OAAO,mBACP,OAAO,oBAAoB,IAAI,iBAE/B,QAAQ,kBAAkB,OAAO;GAEnC,IAAI,IAAI,oBACN,QAAQ,eAAe;GAEzB,OAAO;EACT,CAAC;EAMD,IAAI,CAJa,KAAK,UAAU,gBAAgB,EAC5C,kBAAkB,CAAC,EACnB,MAAM,MAAM,SAAS,CAAC,CAAC,EACvB,SAAS,QAAQ,GAEnB,IAAI,YAAY;EAGlB,OAAO,MAAM,EAAE,IAAI,GAAG,KAAK;EAC3B,OAAO;CACT,SAAS,KAAK;EACZ,MAAM,cAAc,eAAe,oBAAoB,IAAI,MAAM;EAGjE,IACE,YAAY,YAAA,mBACZ;GAJ0B;GAAK;GAAK;GAAK;EAIxB,CAAC,CAAC,SAAS,YAAY,UAAU,KAClD,CAJ4B,WAIT,CAAC,CAAC,SAAS,YAAY,IAAI,GAE9C,OAAO;EAGT,IAAI,eAAe,mBAAmB;GACpC,IAAI,YAAY,SAAS,gBAAgB,YAAY,MAAM;IACzD,YAAY,OAAO;IACnB,IAAI,MAAM;GACZ;GACA,MAAM;EACR;EACA,OAAO,MAAM;GAAE;GAAK;GAAa;EAAY,GAAG,0BAA0B;EAC1E,OAAO;CACT;AACF"}

package/dist/modules/datasource/npm/schema.d.ts

@@ -11,8 +11,8 @@ declare const NpmResponseVersion: z.ZodObject<{
   homepage: z.ZodCatch<z.ZodOptional<z.ZodString>>;
   deprecated: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>;
   gitHead: z.ZodOptional<z.ZodString>;
-  dependencies: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-  devDependencies: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+  dependencies: z.ZodOptional<z.ZodType<Record<string, string>, any, z.core.$ZodTypeInternals<Record<string, string>, any>>>;
+  devDependencies: z.ZodOptional<z.ZodType<Record<string, string>, any, z.core.$ZodTypeInternals<Record<string, string>, any>>>;
   engines: z.ZodCatch<z.ZodOptional<z.ZodObject<{
     node: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>>>;
@@ -35,8 +35,8 @@ declare const CachedPackument: z.ZodObject<{
     homepage: z.ZodCatch<z.ZodOptional<z.ZodString>>;
     deprecated: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>;
     gitHead: z.ZodOptional<z.ZodString>;
-    dependencies: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    devDependencies: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    dependencies: z.ZodOptional<z.ZodType<Record<string, string>, any, z.core.$ZodTypeInternals<Record<string, string>, any>>>;
+    devDependencies: z.ZodOptional<z.ZodType<Record<string, string>, any, z.core.$ZodTypeInternals<Record<string, string>, any>>>;
     engines: z.ZodCatch<z.ZodOptional<z.ZodObject<{
       node: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>>;
@@ -71,8 +71,8 @@ declare const NpmResponse: z.ZodObject<{
     homepage: z.ZodCatch<z.ZodOptional<z.ZodString>>;
     deprecated: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>;
     gitHead: z.ZodOptional<z.ZodString>;
-    dependencies: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    devDependencies: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    dependencies: z.ZodOptional<z.ZodType<Record<string, string>, any, z.core.$ZodTypeInternals<Record<string, string>, any>>>;
+    devDependencies: z.ZodOptional<z.ZodType<Record<string, string>, any, z.core.$ZodTypeInternals<Record<string, string>, any>>>;
     engines: z.ZodCatch<z.ZodOptional<z.ZodObject<{
       node: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>>;

package/dist/modules/datasource/npm/schema.js

@@ -13,8 +13,8 @@ const NpmResponseVersion = z.object({
 	homepage: z.string().optional().catch(void 0),
 	deprecated: z.union([z.string(), z.boolean()]).optional(),
 	gitHead: z.string().optional(),
-	dependencies: z.record(z.string(), z.string()).optional(),
-	devDependencies: z.record(z.string(), z.string()).optional(),
+	dependencies: LooseRecord(z.string()).optional(),
+	devDependencies: LooseRecord(z.string()).optional(),
 	engines: z.object({ node: z.string().optional() }).optional().catch(void 0),
 	dist: Distribution.optional()
 });

package/dist/modules/datasource/npm/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","names":[],"sources":["../../../../lib/modules/datasource/npm/schema.ts"],"sourcesContent":["import { z } from 'zod/v4';\nimport { DeepNullish, LooseRecord } from '../../../util/schema-utils/index.ts';\n\nconst Repository = z.union([\n  z.string(),\n  DeepNullish(\n    z.object({\n      url: z.string().optional(),\n      directory: z.string().optional(),\n    }),\n  ),\n]);\n\nconst RepositoryNpmResponse = z\n  .unknown()\n  .transform((val) => (Array.isArray(val) ? val[0] : val))\n  .pipe(Repository);\n\nconst Attestations = z.object({\n  url: z.string().optional(),\n});\n\nconst Distribution = z.object({\n  attestations: Attestations.optional(),\n});\n\nexport const NpmResponseVersion = z.object({\n  repository: RepositoryNpmResponse.optional(),\n  homepage: z.string().optional().catch(undefined),\n  deprecated: z.union([z.string(), z.boolean()]).optional(),\n  gitHead: z.string().optional(),\n  dependencies: z.record(z.string(), z.string()).optional(),\n  devDependencies: z.record(z.string(), z.string()).optional(),\n  engines: z\n    .object({ node: z.string().optional() })\n    .optional()\n    .catch(undefined),\n  dist: Distribution.optional(),\n});\nexport type NpmResponseVersion = z.infer<typeof NpmResponseVersion>;\n\nexport const CachedPackument = z.object({\n  versions: z.record(z.string(), NpmResponseVersion).optional(),\n  repository: Repository.optional(),\n  homepage: z.string().optional(),\n  // `LooseRecord` drops non-string entries (e.g. Artifactory's\n  // `\"unpublished\": null`) instead of invalidating the whole packument.\n  time: LooseRecord(z.string()).optional(),\n  'dist-tags': z.record(z.string(), z.string()).optional(),\n});\n\n/**\n * Full NpmResponse schema — used when fetching from the npm registry.\n * Lenient: only validates fields Renovate actually reads.\n * Uses loose() on the version objects to preserve extra fields\n * (e.g. 'renovate-config' used by config/presets/npm/index.ts).\n */\nconst NpmResponseVersionLoose = NpmResponseVersion.loose();\n\nexport const NpmResponse = z.object({\n  _id: z.string().optional(),\n  name: z.string().optional(),\n  versions: z.record(z.string(), NpmResponseVersionLoose).optional(),\n  repository: RepositoryNpmResponse.optional(),\n  homepage: z.string().optional(),\n  time: LooseRecord(z.string()).optional(),\n  'dist-tags': z.record(z.string(), z.string()).optional(),\n});\n\nexport type NpmResponse = z.infer<typeof NpmResponse>;\n"],"mappings":";;;AAGA,MAAM,aAAa,EAAE,MAAM,CACzB,EAAE,OAAO,GACT,YACE,EAAE,OAAO;CACP,KAAK,EAAE,OAAO,CAAC,CAAC,SAAS;CACzB,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AACjC,CAAC,CACH,CACF,CAAC;AAED,MAAM,wBAAwB,EAC3B,QAAQ,CAAC,CACT,WAAW,QAAS,MAAM,QAAQ,GAAG,IAAI,IAAI,KAAK,GAAI,CAAC,CACvD,KAAK,UAAU;AAElB,MAAM,eAAe,EAAE,OAAO,EAC5B,KAAK,EAAE,OAAO,CAAC,CAAC,SAAS,EAC3B,CAAC;AAED,MAAM,eAAe,EAAE,OAAO,EAC5B,cAAc,aAAa,SAAS,EACtC,CAAC;AAED,MAAa,qBAAqB,EAAE,OAAO;CACzC,YAAY,sBAAsB,SAAS;CAC3C,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,KAAA,CAAS;CAC/C,YAAY,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;CACxD,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACxD,iBAAiB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CAC3D,SAAS,EACN,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CACvC,SAAS,CAAC,CACV,MAAM,KAAA,CAAS;CAClB,MAAM,aAAa,SAAS;AAC9B,CAAC;AAGD,MAAa,kBAAkB,EAAE,OAAO;CACtC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,kBAAkB,CAAC,CAAC,SAAS;CAC5D,YAAY,WAAW,SAAS;CAChC,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAG9B,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACvC,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;AACzD,CAAC;;;;;;;AAQD,MAAM,0BAA0B,mBAAmB,MAAM;AAEzD,MAAa,cAAc,EAAE,OAAO;CAClC,KAAK,EAAE,OAAO,CAAC,CAAC,SAAS;CACzB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,uBAAuB,CAAC,CAAC,SAAS;CACjE,YAAY,sBAAsB,SAAS;CAC3C,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACvC,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;AACzD,CAAC"}
+{"version":3,"file":"schema.js","names":[],"sources":["../../../../lib/modules/datasource/npm/schema.ts"],"sourcesContent":["import { z } from 'zod/v4';\nimport { DeepNullish, LooseRecord } from '../../../util/schema-utils/index.ts';\n\nconst Repository = z.union([\n  z.string(),\n  DeepNullish(\n    z.object({\n      url: z.string().optional(),\n      directory: z.string().optional(),\n    }),\n  ),\n]);\n\nconst RepositoryNpmResponse = z\n  .unknown()\n  .transform((val) => (Array.isArray(val) ? val[0] : val))\n  .pipe(Repository);\n\nconst Attestations = z.object({\n  url: z.string().optional(),\n});\n\nconst Distribution = z.object({\n  attestations: Attestations.optional(),\n});\n\nexport const NpmResponseVersion = z.object({\n  repository: RepositoryNpmResponse.optional(),\n  homepage: z.string().optional().catch(undefined),\n  deprecated: z.union([z.string(), z.boolean()]).optional(),\n  gitHead: z.string().optional(),\n  // `LooseRecord` drops non-string entries i.e. pre-1.0 npm's nested a full dependency tree under `devDependencies`\n  // (e.g. `{ \"foo\": { \"version\": \"1.0.0\" } }`) instead of a version string.\n  dependencies: LooseRecord(z.string()).optional(),\n  devDependencies: LooseRecord(z.string()).optional(),\n  engines: z\n    .object({ node: z.string().optional() })\n    .optional()\n    .catch(undefined),\n  dist: Distribution.optional(),\n});\nexport type NpmResponseVersion = z.infer<typeof NpmResponseVersion>;\n\nexport const CachedPackument = z.object({\n  versions: z.record(z.string(), NpmResponseVersion).optional(),\n  repository: Repository.optional(),\n  homepage: z.string().optional(),\n  // `LooseRecord` drops non-string entries (e.g. Artifactory's\n  // `\"unpublished\": null`) instead of invalidating the whole packument.\n  time: LooseRecord(z.string()).optional(),\n  'dist-tags': z.record(z.string(), z.string()).optional(),\n});\n\n/**\n * Full NpmResponse schema — used when fetching from the npm registry.\n * Lenient: only validates fields Renovate actually reads.\n * Uses loose() on the version objects to preserve extra fields\n * (e.g. 'renovate-config' used by config/presets/npm/index.ts).\n */\nconst NpmResponseVersionLoose = NpmResponseVersion.loose();\n\nexport const NpmResponse = z.object({\n  _id: z.string().optional(),\n  name: z.string().optional(),\n  versions: z.record(z.string(), NpmResponseVersionLoose).optional(),\n  repository: RepositoryNpmResponse.optional(),\n  homepage: z.string().optional(),\n  time: LooseRecord(z.string()).optional(),\n  'dist-tags': z.record(z.string(), z.string()).optional(),\n});\n\nexport type NpmResponse = z.infer<typeof NpmResponse>;\n"],"mappings":";;;AAGA,MAAM,aAAa,EAAE,MAAM,CACzB,EAAE,OAAO,GACT,YACE,EAAE,OAAO;CACP,KAAK,EAAE,OAAO,CAAC,CAAC,SAAS;CACzB,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AACjC,CAAC,CACH,CACF,CAAC;AAED,MAAM,wBAAwB,EAC3B,QAAQ,CAAC,CACT,WAAW,QAAS,MAAM,QAAQ,GAAG,IAAI,IAAI,KAAK,GAAI,CAAC,CACvD,KAAK,UAAU;AAElB,MAAM,eAAe,EAAE,OAAO,EAC5B,KAAK,EAAE,OAAO,CAAC,CAAC,SAAS,EAC3B,CAAC;AAED,MAAM,eAAe,EAAE,OAAO,EAC5B,cAAc,aAAa,SAAS,EACtC,CAAC;AAED,MAAa,qBAAqB,EAAE,OAAO;CACzC,YAAY,sBAAsB,SAAS;CAC3C,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,KAAA,CAAS;CAC/C,YAAY,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;CACxD,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAG7B,cAAc,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CAC/C,iBAAiB,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CAClD,SAAS,EACN,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CACvC,SAAS,CAAC,CACV,MAAM,KAAA,CAAS;CAClB,MAAM,aAAa,SAAS;AAC9B,CAAC;AAGD,MAAa,kBAAkB,EAAE,OAAO;CACtC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,kBAAkB,CAAC,CAAC,SAAS;CAC5D,YAAY,WAAW,SAAS;CAChC,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAG9B,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACvC,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;AACzD,CAAC;;;;;;;AAQD,MAAM,0BAA0B,mBAAmB,MAAM;AAEzD,MAAa,cAAc,EAAE,OAAO;CAClC,KAAK,EAAE,OAAO,CAAC,CAAC,SAAS;CACzB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,uBAAuB,CAAC,CAAC,SAAS;CACjE,YAAY,sBAAsB,SAAS;CAC3C,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACvC,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;AACzD,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "renovate",
   "description": "Automated dependency updates. Flexible so you don't need to be.",
-  "version": "44.7.4",
+  "version": "44.8.0",
   "type": "module",
   "bin": {
     "renovate": "dist/renovate.js",

package/renovate-schema.json

@@ -1,8 +1,8 @@
 {
   "$id": "https://docs.renovatebot.com/renovate-schema.json",
-  "title": "JSON schema for Renovate 44.7.4 config files (https://renovatebot.com/)",
+  "title": "JSON schema for Renovate 44.8.0 config files (https://renovatebot.com/)",
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "x-renovate-version": "44.7.4",
+  "x-renovate-version": "44.8.0",
   "allowComments": true,
   "type": "object",
   "definitions": {