renovate 44.78.0 → 44.79.1

package/dist/config/presets/http/index.js

@@ -1,3 +1,4 @@
+import "../../../constants/error-messages.js";
 import { logger } from "../../../logger/index.js";
 import { parseUrl } from "../../../util/url.js";
 import { ExternalHostError } from "../../../types/errors/external-host-error.js";
@@ -5,7 +6,7 @@ import { PRESET_DEP_NOT_FOUND, parsePreset } from "../util.js";
 import { Http } from "../../../util/http/index.js";
 import { memCacheProvider } from "../../../util/http/cache/memory-http-cache-provider.js";
 //#region lib/config/presets/http/index.ts
-const http = new Http("preset");
+const http = new Http("preset", { responseBecomesConfig: true });
 async function getPreset({ repo: url }) {
 	const parsedUrl = parseUrl(url);
 	let response;
@@ -17,6 +18,7 @@ async function getPreset({ repo: url }) {
 		response = await http.getText(url, { cacheProvider: memCacheProvider });
 	} catch (err) {
 		if (err instanceof ExternalHostError) throw err;
+		if (err.message === "host-blocked") throw err;
 		logger.debug(`Preset file ${url} not found: ${err.message}`);
 		throw new Error(PRESET_DEP_NOT_FOUND);
 	}

package/dist/config/presets/http/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../../lib/config/presets/http/index.ts"],"sourcesContent":["import { logger } from '../../../logger/index.ts';\nimport { ExternalHostError } from '../../../types/errors/external-host-error.ts';\nimport { memCacheProvider } from '../../../util/http/cache/memory-http-cache-provider.ts';\nimport { Http } from '../../../util/http/index.ts';\nimport type { HttpResponse } from '../../../util/http/types.ts';\nimport { parseUrl } from '../../../util/url.ts';\nimport type { Preset, PresetConfig } from '../types.ts';\nimport { PRESET_DEP_NOT_FOUND, parsePreset } from '../util.ts';\n\nconst http = new Http('preset');\n\nexport async function getPreset({\n  repo: url,\n}: PresetConfig): Promise<Preset | null | undefined> {\n  const parsedUrl = parseUrl(url);\n  let response: HttpResponse;\n\n  if (!parsedUrl) {\n    logger.debug(`Preset URL ${url} is malformed`);\n    throw new Error(PRESET_DEP_NOT_FOUND);\n  }\n\n  try {\n    response = await http.getText(url, { cacheProvider: memCacheProvider });\n  } catch (err) {\n    if (err instanceof ExternalHostError) {\n      throw err;\n    }\n\n    logger.debug(`Preset file ${url} not found: ${err.message}`);\n    throw new Error(PRESET_DEP_NOT_FOUND);\n  }\n\n  return parsePreset(response.body, parsedUrl.pathname);\n}\n"],"mappings":";;;;;;;AASA,MAAM,OAAO,IAAI,KAAK,QAAQ;AAE9B,eAAsB,UAAU,EAC9B,MAAM,OAC6C;CACnD,MAAM,YAAY,SAAS,GAAG;CAC9B,IAAI;CAEJ,IAAI,CAAC,WAAW;EACd,OAAO,MAAM,cAAc,IAAI,cAAc;EAC7C,MAAM,IAAI,MAAM,oBAAoB;CACtC;CAEA,IAAI;EACF,WAAW,MAAM,KAAK,QAAQ,KAAK,EAAE,eAAe,iBAAiB,CAAC;CACxE,SAAS,KAAK;EACZ,IAAI,eAAe,mBACjB,MAAM;EAGR,OAAO,MAAM,eAAe,IAAI,cAAc,IAAI,SAAS;EAC3D,MAAM,IAAI,MAAM,oBAAoB;CACtC;CAEA,OAAO,YAAY,SAAS,MAAM,UAAU,QAAQ;AACtD"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../../lib/config/presets/http/index.ts"],"sourcesContent":["import { HOST_BLOCKED } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { ExternalHostError } from '../../../types/errors/external-host-error.ts';\nimport { memCacheProvider } from '../../../util/http/cache/memory-http-cache-provider.ts';\nimport { Http } from '../../../util/http/index.ts';\nimport type { HttpResponse } from '../../../util/http/types.ts';\nimport { parseUrl } from '../../../util/url.ts';\nimport type { Preset, PresetConfig } from '../types.ts';\nimport { PRESET_DEP_NOT_FOUND, parsePreset } from '../util.ts';\n\n// every response this instance fetches becomes Renovate configuration, so an internal host needs a deliberately-scoped `allowInternal` grant\nconst http = new Http('preset', { responseBecomesConfig: true });\n\nexport async function getPreset({\n  repo: url,\n}: PresetConfig): Promise<Preset | null | undefined> {\n  const parsedUrl = parseUrl(url);\n  let response: HttpResponse;\n\n  if (!parsedUrl) {\n    logger.debug(`Preset URL ${url} is malformed`);\n    throw new Error(PRESET_DEP_NOT_FOUND);\n  }\n\n  try {\n    response = await http.getText(url, { cacheProvider: memCacheProvider });\n  } catch (err) {\n    if (err instanceof ExternalHostError) {\n      throw err;\n    }\n\n    // keep the block distinguishable from a plain 404, so it surfaces as its own config validation error\n    if (err.message === HOST_BLOCKED) {\n      throw err;\n    }\n\n    logger.debug(`Preset file ${url} not found: ${err.message}`);\n    throw new Error(PRESET_DEP_NOT_FOUND);\n  }\n\n  return parsePreset(response.body, parsedUrl.pathname);\n}\n"],"mappings":";;;;;;;;AAWA,MAAM,OAAO,IAAI,KAAK,UAAU,EAAE,uBAAuB,KAAK,CAAC;AAE/D,eAAsB,UAAU,EAC9B,MAAM,OAC6C;CACnD,MAAM,YAAY,SAAS,GAAG;CAC9B,IAAI;CAEJ,IAAI,CAAC,WAAW;EACd,OAAO,MAAM,cAAc,IAAI,cAAc;EAC7C,MAAM,IAAI,MAAM,oBAAoB;CACtC;CAEA,IAAI;EACF,WAAW,MAAM,KAAK,QAAQ,KAAK,EAAE,eAAe,iBAAiB,CAAC;CACxE,SAAS,KAAK;EACZ,IAAI,eAAe,mBACjB,MAAM;EAIR,IAAI,IAAI,YAAA,gBACN,MAAM;EAGR,OAAO,MAAM,eAAe,IAAI,cAAc,IAAI,SAAS;EAC3D,MAAM,IAAI,MAAM,oBAAoB;CACtC;CAEA,OAAO,YAAY,SAAS,MAAM,UAAU,QAAQ;AACtD"}

package/dist/config/presets/index.js

@@ -206,7 +206,13 @@ async function fetchPreset(preset, baseConfig, inputConfig, existingPresets) {
 		if (err instanceof ExternalHostError) throw err;
 		if (err.message === "rate-limit-exceeded") throw err;
 		const error = new Error(CONFIG_VALIDATION);
-		if (err.message === "dep not found") error.validationError = `Cannot find preset's package (${preset})`;
+		if (err.message === "host-blocked") {
+			logger.warn({
+				preset,
+				documentationUrl: `${GlobalConfig.get("productLinks").documentation}self-hosted-configuration/#hostrulesallowinternal`
+			}, "Preset host is blocked by this Renovate instance");
+			error.validationError = `Preset host is blocked by this Renovate instance (${preset}). If this is intended, ask your Renovate administrator to permit it with a \`hostRules\` entry setting \`allowInternal=true\`, scoped either by \`hostType\` (for example \`preset\` or \`npm\`) or by a URL-prefix \`matchHost\``;
+		} else if (err.message === "dep not found") error.validationError = `Cannot find preset's package (${preset})`;
 		else if (err.message === "preset renovate-config not found") error.validationError = `Preset package is missing a renovate-config entry (${preset})`;
 		else if (err.message === "preset not found") error.validationError = `Preset name not found within published preset config (${preset})`;
 		else if (err.message === "invalid preset") error.validationError = `Preset is invalid (${preset})`;

package/dist/config/presets/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["internal.getPreset","memCache.get","migration.migrateConfig","massage.massageConfig","template.compile","internal.isInternal"],"sources":["../../../lib/config/presets/index.ts"],"sourcesContent":["import {\n  isArray,\n  isNullOrUndefined,\n  isObject,\n  isString,\n} from '@sindresorhus/is';\nimport {\n  CONFIG_VALIDATION,\n  PLATFORM_RATE_LIMIT_EXCEEDED,\n} from '../../constants/error-messages.ts';\nimport { logger } from '../../logger/index.ts';\nimport { ExternalHostError } from '../../types/errors/external-host-error.ts';\nimport { coerceArray } from '../../util/array.ts';\nimport * as memCache from '../../util/cache/memory/index.ts';\nimport { clone } from '../../util/clone.ts';\nimport { regEx } from '../../util/regex.ts';\nimport * as template from '../../util/template/index.ts';\nimport { GlobalConfig } from '../global.ts';\nimport * as massage from '../massage.ts';\nimport * as migration from '../migration.ts';\nimport type { AllConfig, RenovateConfig } from '../types.ts';\nimport { mergeChildConfig } from '../utils.ts';\nimport { removedPresets } from './common.ts';\nimport * as internal from './internal/index.ts';\nimport { parsePreset } from './parse.ts';\nimport { canonicalizeRelativePresets } from './relative.ts';\nimport type { Preset, PresetApi } from './types.ts';\nimport {\n  PRESET_DEP_NOT_FOUND,\n  PRESET_INVALID,\n  PRESET_INVALID_JSON,\n  PRESET_NOT_FOUND,\n  PRESET_PROHIBITED_SUBPRESET,\n  PRESET_RELATIVE_NO_PARENT,\n  PRESET_RENOVATE_CONFIG_NOT_FOUND,\n} from './util.ts';\n\ninterface PresetSource {\n  load: () => Promise<PresetApi>;\n\n  /**\n   * Whether presets from this source are hosted in a repository, which is what\n   * allows them to reference other presets relatively.\n   */\n  repoHosted: boolean;\n}\n\nconst presetSources: Record<string, PresetSource> = {\n  forgejo: { load: () => import('./forgejo/index.ts'), repoHosted: true },\n  gitea: { load: () => import('./gitea/index.ts'), repoHosted: true },\n  github: { load: () => import('./github/index.ts'), repoHosted: true },\n  gitlab: { load: () => import('./gitlab/index.ts'), repoHosted: true },\n  http: { load: () => import('./http/index.ts'), repoHosted: false },\n  local: { load: () => import('./local/index.ts'), repoHosted: true },\n  npm: { load: () => import('./npm/index.ts'), repoHosted: false },\n};\n\nconst presetCacheNamespace = 'preset';\n\nexport function replaceArgs(\n  obj: string,\n  argMapping: Record<string, any>,\n): string;\nexport function replaceArgs(\n  obj: string[],\n  argMapping: Record<string, any>,\n): string[];\nexport function replaceArgs(\n  obj: Record<string, any>,\n  argMapping: Record<string, any>,\n): Record<string, any>;\nexport function replaceArgs(\n  obj: Record<string, any>[],\n  argMapping: Record<string, any>,\n): Record<string, any>[];\n\n/**\n * TODO: fix me #22198\n * @param obj\n * @param argMapping\n */\nexport function replaceArgs(obj: any, argMapping: Record<string, any>): any;\nexport function replaceArgs(\n  obj: string | string[] | Record<string, any> | Record<string, any>[],\n  argMapping: Record<string, any>,\n): any {\n  if (isString(obj)) {\n    let returnStr = obj;\n    for (const [arg, argVal] of Object.entries(argMapping)) {\n      const re = regEx(`{{${arg}}}`, 'g', false);\n      returnStr = returnStr.replace(re, argVal);\n    }\n    return returnStr;\n  }\n  if (isArray(obj)) {\n    const returnArray = [];\n    for (const item of obj) {\n      returnArray.push(replaceArgs(item, argMapping));\n    }\n    return returnArray;\n  }\n  if (isObject(obj)) {\n    const returnObj: Record<string, any> = {};\n    for (const [key, val] of Object.entries(obj)) {\n      returnObj[key] = replaceArgs(val, argMapping);\n    }\n    return returnObj;\n  }\n  return obj;\n}\n\nexport async function getPreset(\n  preset: string,\n  baseConfig?: RenovateConfig,\n): Promise<RenovateConfig> {\n  logger.trace(`getPreset(${preset})`);\n  // Check if the preset has been removed or replaced\n  const newPreset = removedPresets[preset];\n  if (newPreset) {\n    return getPreset(newPreset, baseConfig);\n  }\n  if (newPreset === null) {\n    return {};\n  }\n  const parsedPreset = parsePreset(preset);\n  const { presetSource, repo, presetPath, presetName, tag, params, rawParams } =\n    parsedPreset;\n\n  if (presetSource === 'relative') {\n    throw new Error(PRESET_RELATIVE_NO_PARENT);\n  }\n\n  let presetConfig: Preset | null | undefined;\n\n  if (presetSource === 'internal') {\n    presetConfig = internal.getPreset({\n      repo,\n      presetPath,\n      presetName,\n      tag,\n    });\n  } else {\n    const cacheKey = `preset:${preset}`;\n    const presetCachePersistence = GlobalConfig.get('presetCachePersistence');\n\n    const packageCache = presetCachePersistence\n      ? await import('../../util/cache/package/index.ts')\n      : undefined;\n\n    if (packageCache) {\n      presetConfig = await packageCache.get(presetCacheNamespace, cacheKey);\n    } else {\n      presetConfig = memCache.get(cacheKey);\n    }\n\n    if (isNullOrUndefined(presetConfig)) {\n      const source = await presetSources[presetSource].load();\n      presetConfig = await source.getPreset({\n        repo,\n        presetPath,\n        presetName,\n        tag,\n      });\n      if (packageCache) {\n        await packageCache.set(\n          presetCacheNamespace,\n          cacheKey,\n          presetConfig,\n          15,\n        );\n      } else {\n        memCache.set(cacheKey, presetConfig);\n      }\n    }\n  }\n\n  if (!presetConfig) {\n    throw new Error(PRESET_DEP_NOT_FOUND);\n  }\n  logger.trace({ presetConfig }, `Found preset ${preset}`);\n  if (params) {\n    const argMapping: Record<string, string> = {};\n    for (const [index, value] of params.entries()) {\n      argMapping[`arg${index}`] = value;\n    }\n    if (rawParams) {\n      argMapping.args = rawParams;\n    }\n    presetConfig = replaceArgs(presetConfig, argMapping);\n  }\n  logger.trace({ presetConfig }, `Applied params to preset ${preset}`);\n  const presetKeys = Object.keys(presetConfig);\n  if (\n    presetKeys.length === 2 &&\n    presetKeys.includes('description') &&\n    presetKeys.includes('extends')\n  ) {\n    // preset is just a collection of other presets\n    delete presetConfig.description;\n  }\n  const packageListKeys = ['description', 'matchPackageNames'];\n  if (presetKeys.every((key) => packageListKeys.includes(key))) {\n    delete presetConfig.description;\n  }\n  const { migratedConfig } = migration.migrateConfig(presetConfig);\n  const massagedConfig = massage.massageConfig(migratedConfig);\n  if (presetSources[parsedPreset.presetSource]?.repoHosted) {\n    // only presets which are hosted in a repository can contain relative\n    // references, in all other presets they are left as they are and fail\n    // when they are resolved\n    canonicalizeRelativePresets(massagedConfig, parsedPreset);\n  }\n  return massagedConfig;\n}\n\nexport interface ResolveConfigPresetsResult {\n  config: AllConfig;\n  /** when resolving the given configuration, which internal/shared presets were discovered */\n  visitedPresets: {\n    /** which internal/shared presets were merged into the final config */\n    merged: string[];\n    /** which internal/shared presets were not merged into the final config */\n    unmerged: string[];\n  };\n}\n\n/**\n * @param [mergeInternalPresets=true] when resolving the config presets, whether to merge Renovate internal presets into the resulting configuration.\n *   When set to `false`, this will resolve these internal presets (recursively), but not merge them.\n *   This is primarily intended to be used by \"shallow config\" resolution (for logging purposes).\n */\nexport async function resolveConfigPresets(\n  inputConfig: AllConfig,\n  baseConfig?: RenovateConfig,\n  _ignorePresets?: string[],\n  existingPresets: string[] = [],\n  mergeInternalPresets = true,\n): Promise<ResolveConfigPresetsResult> {\n  const allVisitedPresets = {\n    merged: new Set<string>(),\n    unmerged: new Set<string>(),\n  };\n\n  let ignorePresets = clone(_ignorePresets);\n  if (!ignorePresets || ignorePresets.length === 0) {\n    ignorePresets = coerceArray(inputConfig.ignorePresets);\n  }\n  logger.trace(\n    { config: inputConfig, existingPresets, mergeInternalPresets },\n    'resolveConfigPresets',\n  );\n\n  let config: AllConfig = {};\n  // First, merge all the preset configs from left to right\n  if (inputConfig.extends?.length) {\n    // Compile templates\n    inputConfig.extends = inputConfig.extends.map((tmpl) =>\n      template.compile(tmpl, {}),\n    );\n    for (const preset of inputConfig.extends) {\n      // don't attempt to merge any internal presets if we're not expecting to\n      if (!mergeInternalPresets && internal.isInternal(preset)) {\n        logger.once.trace(\n          { ignoredPreset: preset, mergeInternalPresets },\n          'Not merging preset',\n        );\n        // ... but make sure we note that we haven't resolved it\n        allVisitedPresets.unmerged.add(preset);\n        continue;\n      }\n\n      if (shouldResolvePreset(preset, existingPresets, ignorePresets)) {\n        logger.trace(`Resolving preset \"${preset}\"`);\n        const fetchedPreset = await fetchPreset(\n          preset,\n          baseConfig,\n          inputConfig,\n          existingPresets,\n        );\n        const { config: presetConfig, visitedPresets } =\n          await resolveConfigPresets(\n            fetchedPreset,\n            baseConfig ?? inputConfig,\n            ignorePresets,\n            existingPresets.concat([preset]),\n            mergeInternalPresets,\n          );\n        config = mergeChildConfig(config, presetConfig);\n        allVisitedPresets.merged.add(preset);\n\n        // then also make sure we've noted any nested presets we've merged\n        for (const mergedPreset of visitedPresets.merged) {\n          allVisitedPresets.merged.add(mergedPreset);\n        }\n        // ... or not merged\n        for (const unmergedPreset of visitedPresets.unmerged) {\n          allVisitedPresets.unmerged.add(unmergedPreset);\n        }\n      }\n    }\n  }\n  logger.trace({ config }, `Post-preset resolve config`);\n  // Now assign \"regular\" config on top\n  config = mergeChildConfig(config, inputConfig);\n  delete config.extends;\n  delete config.ignorePresets;\n  // Any description of this config replaces the ones collated from its presets.\n  // Check the length, because array options default to an empty array.\n  if (config.overrideDescription?.length) {\n    config.description = config.overrideDescription;\n  }\n  delete config.overrideDescription;\n  logger.trace({ config }, `Post-merge resolve config`);\n  for (const [key, val] of Object.entries(config) as [\n    keyof AllConfig,\n    unknown,\n  ][]) {\n    const ignoredKeys = ['content', 'onboardingConfig'];\n    if (isArray(val)) {\n      // Resolve nested objects inside arrays\n      config[key] = [] as never; // type can't be narrowed\n      for (const element of val) {\n        if (isObject(element)) {\n          const { config: presetConfig, visitedPresets: visited } =\n            await resolveConfigPresets(\n              element,\n              baseConfig,\n              ignorePresets,\n              existingPresets,\n              mergeInternalPresets,\n            );\n          (config[key] as RenovateConfig[]).push(presetConfig);\n\n          // then also make sure we've noted any nested presets we've merged\n          for (const mergedPreset of visited.merged) {\n            allVisitedPresets.merged.add(mergedPreset);\n          }\n          // ... or not merged\n          for (const unmergedPreset of visited.unmerged) {\n            allVisitedPresets.unmerged.add(unmergedPreset);\n          }\n        } else {\n          (config[key] as unknown[]).push(element);\n        }\n      }\n    } else if (isObject(val) && !ignoredKeys.includes(key)) {\n      // Resolve nested objects\n      logger.trace(`Resolving object \"${key}\"`);\n      const { config: presetConfig, visitedPresets: visited } =\n        await resolveConfigPresets(\n          val,\n          baseConfig,\n          ignorePresets,\n          existingPresets,\n          mergeInternalPresets,\n        );\n      config[key] = presetConfig as never; // type can't be narrowed\n\n      // then also make sure we've noted any nested presets we've merged\n      for (const mergedPreset of visited.merged) {\n        allVisitedPresets.merged.add(mergedPreset);\n      }\n      // ... or not merged\n      for (const unmergedPreset of visited.unmerged) {\n        allVisitedPresets.unmerged.add(unmergedPreset);\n      }\n    }\n  }\n  logger.trace({ config: inputConfig }, 'Input config');\n  logger.trace(\n    { config, visitedPresets: allVisitedPresets },\n    'Resolved config',\n  );\n\n  return {\n    config,\n    visitedPresets: {\n      merged: Array.from(allVisitedPresets.merged),\n      unmerged: Array.from(allVisitedPresets.unmerged),\n    },\n  };\n}\n\nasync function fetchPreset(\n  preset: string,\n  baseConfig: RenovateConfig | undefined,\n  inputConfig: AllConfig,\n  existingPresets: string[],\n): Promise<AllConfig> {\n  try {\n    return await getPreset(preset, baseConfig ?? inputConfig);\n  } catch (err) {\n    logger.debug({ preset, err }, 'Preset fetch error');\n    if (err instanceof ExternalHostError) {\n      throw err;\n    }\n    if (err.message === PLATFORM_RATE_LIMIT_EXCEEDED) {\n      throw err;\n    }\n    const error = new Error(CONFIG_VALIDATION);\n    if (err.message === PRESET_DEP_NOT_FOUND) {\n      error.validationError = `Cannot find preset's package (${preset})`;\n    } else if (err.message === PRESET_RENOVATE_CONFIG_NOT_FOUND) {\n      error.validationError = `Preset package is missing a renovate-config entry (${preset})`;\n    } else if (err.message === PRESET_NOT_FOUND) {\n      error.validationError = `Preset name not found within published preset config (${preset})`;\n    } else if (err.message === PRESET_INVALID) {\n      error.validationError = `Preset is invalid (${preset})`;\n    } else if (err.message === PRESET_PROHIBITED_SUBPRESET) {\n      error.validationError = `Sub-presets cannot be combined with a custom path (${preset})`;\n    } else if (err.message === PRESET_INVALID_JSON) {\n      error.validationError = `Preset is invalid JSON (${preset})`;\n    } else if (err.message === PRESET_RELATIVE_NO_PARENT) {\n      error.validationError = `Relative preset reference cannot be resolved (${preset}). Relative presets can only be used within presets from a supported source, must stay inside their repository, and cannot be templated or used outside of a preset (for example in the repository config, inherited config, or globalExtends)`;\n    } else {\n      error.validationError = `Preset caused unexpected error (${preset})`;\n    }\n    if (existingPresets.length) {\n      error.validationError +=\n        '. Note: this is a *nested* preset so please contact the preset author if you are unable to fix it yourself.';\n    }\n    logger.info(\n      { validationError: error.validationError },\n      'Throwing preset error',\n    );\n    throw error;\n  }\n}\n\nfunction shouldResolvePreset(\n  preset: string,\n  existingPresets: string[],\n  ignorePresets: string[],\n): boolean {\n  if (existingPresets.includes(preset)) {\n    logger.debug(\n      `Already seen preset ${preset} in [${existingPresets.join(', ')}]`,\n    );\n    return false;\n  }\n  if (ignorePresets.includes(preset)) {\n    logger.debug(\n      `Ignoring preset ${preset} in [${existingPresets.join(', ')}]`,\n    );\n    return false;\n  }\n  return true;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA+CA,MAAM,gBAA8C;CAClD,SAAS;EAAE,YAAY,OAAO;EAAuB,YAAY;CAAK;CACtE,OAAO;EAAE,YAAY,OAAO;EAAqB,YAAY;CAAK;CAClE,QAAQ;EAAE,YAAY,OAAO;EAAsB,YAAY;CAAK;CACpE,QAAQ;EAAE,YAAY,OAAO;EAAsB,YAAY;CAAK;CACpE,MAAM;EAAE,YAAY,OAAO;EAAoB,YAAY;CAAM;CACjE,OAAO;EAAE,YAAY,OAAO;EAAqB,YAAY;CAAK;CAClE,KAAK;EAAE,YAAY,OAAO;EAAmB,YAAY;CAAM;AACjE;AAEA,MAAM,uBAAuB;AAyB7B,SAAgB,YACd,KACA,YACK;CACL,IAAI,SAAS,GAAG,GAAG;EACjB,IAAI,YAAY;EAChB,KAAK,MAAM,CAAC,KAAK,WAAW,OAAO,QAAQ,UAAU,GAAG;GACtD,MAAM,KAAK,MAAM,KAAK,IAAI,KAAK,KAAK,KAAK;GACzC,YAAY,UAAU,QAAQ,IAAI,MAAM;EAC1C;EACA,OAAO;CACT;CACA,IAAI,QAAQ,GAAG,GAAG;EAChB,MAAM,cAAc,CAAC;EACrB,KAAK,MAAM,QAAQ,KACjB,YAAY,KAAK,YAAY,MAAM,UAAU,CAAC;EAEhD,OAAO;CACT;CACA,IAAI,SAAS,GAAG,GAAG;EACjB,MAAM,YAAiC,CAAC;EACxC,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,GAAG,GACzC,UAAU,OAAO,YAAY,KAAK,UAAU;EAE9C,OAAO;CACT;CACA,OAAO;AACT;AAEA,eAAsB,UACpB,QACA,YACyB;CACzB,OAAO,MAAM,aAAa,OAAO,EAAE;CAEnC,MAAM,YAAY,eAAe;CACjC,IAAI,WACF,OAAO,UAAU,WAAW,UAAU;CAExC,IAAI,cAAc,MAChB,OAAO,CAAC;CAEV,MAAM,eAAe,YAAY,MAAM;CACvC,MAAM,EAAE,cAAc,MAAM,YAAY,YAAY,KAAK,QAAQ,cAC/D;CAEF,IAAI,iBAAiB,YACnB,MAAM,IAAI,MAAM,yBAAyB;CAG3C,IAAI;CAEJ,IAAI,iBAAiB,YACnB,eAAeA,YAAmB;EAChC;EACA;EACA;EACA;CACF,CAAC;MACI;EACL,MAAM,WAAW,UAAU;EAG3B,MAAM,eAFyB,aAAa,IAAI,wBAEN,IACtC,MAAM,OAAO,uCACb,KAAA;EAEJ,IAAI,cACF,eAAe,MAAM,aAAa,IAAI,sBAAsB,QAAQ;OAEpE,eAAeC,IAAa,QAAQ;EAGtC,IAAI,kBAAkB,YAAY,GAAG;GAEnC,eAAe,OAAM,MADA,cAAc,aAAa,CAAC,KAAK,EAAA,CAC1B,UAAU;IACpC;IACA;IACA;IACA;GACF,CAAC;GACD,IAAI,cACF,MAAM,aAAa,IACjB,sBACA,UACA,cACA,EACF;QAEA,IAAa,UAAU,YAAY;EAEvC;CACF;CAEA,IAAI,CAAC,cACH,MAAM,IAAI,MAAM,oBAAoB;CAEtC,OAAO,MAAM,EAAE,aAAa,GAAG,gBAAgB,QAAQ;CACvD,IAAI,QAAQ;EACV,MAAM,aAAqC,CAAC;EAC5C,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,GAC1C,WAAW,MAAM,WAAW;EAE9B,IAAI,WACF,WAAW,OAAO;EAEpB,eAAe,YAAY,cAAc,UAAU;CACrD;CACA,OAAO,MAAM,EAAE,aAAa,GAAG,4BAA4B,QAAQ;CACnE,MAAM,aAAa,OAAO,KAAK,YAAY;CAC3C,IACE,WAAW,WAAW,KACtB,WAAW,SAAS,aAAa,KACjC,WAAW,SAAS,SAAS,GAG7B,OAAO,aAAa;CAEtB,MAAM,kBAAkB,CAAC,eAAe,mBAAmB;CAC3D,IAAI,WAAW,OAAO,QAAQ,gBAAgB,SAAS,GAAG,CAAC,GACzD,OAAO,aAAa;CAEtB,MAAM,EAAE,mBAAmBC,cAAwB,YAAY;CAC/D,MAAM,iBAAiBC,cAAsB,cAAc;CAC3D,IAAI,cAAc,aAAa,aAAa,EAAE,YAI5C,4BAA4B,gBAAgB,YAAY;CAE1D,OAAO;AACT;;;;;;AAkBA,eAAsB,qBACpB,aACA,YACA,gBACA,kBAA4B,CAAC,GAC7B,uBAAuB,MACc;CACrC,MAAM,oBAAoB;EACxB,wBAAQ,IAAI,IAAY;EACxB,0BAAU,IAAI,IAAY;CAC5B;CAEA,IAAI,gBAAgB,MAAM,cAAc;CACxC,IAAI,CAAC,iBAAiB,cAAc,WAAW,GAC7C,gBAAgB,YAAY,YAAY,aAAa;CAEvD,OAAO,MACL;EAAE,QAAQ;EAAa;EAAiB;CAAqB,GAC7D,sBACF;CAEA,IAAI,SAAoB,CAAC;CAEzB,IAAI,YAAY,SAAS,QAAQ;EAE/B,YAAY,UAAU,YAAY,QAAQ,KAAK,SAC7CC,QAAiB,MAAM,CAAC,CAAC,CAC3B;EACA,KAAK,MAAM,UAAU,YAAY,SAAS;GAExC,IAAI,CAAC,wBAAwBC,WAAoB,MAAM,GAAG;IACxD,OAAO,KAAK,MACV;KAAE,eAAe;KAAQ;IAAqB,GAC9C,oBACF;IAEA,kBAAkB,SAAS,IAAI,MAAM;IACrC;GACF;GAEA,IAAI,oBAAoB,QAAQ,iBAAiB,aAAa,GAAG;IAC/D,OAAO,MAAM,qBAAqB,OAAO,EAAE;IAO3C,MAAM,EAAE,QAAQ,cAAc,mBAC5B,MAAM,qBACJ,MARwB,YAC1B,QACA,YACA,aACA,eACF,GAII,cAAc,aACd,eACA,gBAAgB,OAAO,CAAC,MAAM,CAAC,GAC/B,oBACF;IACF,SAAS,iBAAiB,QAAQ,YAAY;IAC9C,kBAAkB,OAAO,IAAI,MAAM;IAGnC,KAAK,MAAM,gBAAgB,eAAe,QACxC,kBAAkB,OAAO,IAAI,YAAY;IAG3C,KAAK,MAAM,kBAAkB,eAAe,UAC1C,kBAAkB,SAAS,IAAI,cAAc;GAEjD;EACF;CACF;CACA,OAAO,MAAM,EAAE,OAAO,GAAG,4BAA4B;CAErD,SAAS,iBAAiB,QAAQ,WAAW;CAC7C,OAAO,OAAO;CACd,OAAO,OAAO;CAGd,IAAI,OAAO,qBAAqB,QAC9B,OAAO,cAAc,OAAO;CAE9B,OAAO,OAAO;CACd,OAAO,MAAM,EAAE,OAAO,GAAG,2BAA2B;CACpD,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,MAAM,GAGzC;EACH,MAAM,cAAc,CAAC,WAAW,kBAAkB;EAClD,IAAI,QAAQ,GAAG,GAAG;GAEhB,OAAO,OAAO,CAAC;GACf,KAAK,MAAM,WAAW,KACpB,IAAI,SAAS,OAAO,GAAG;IACrB,MAAM,EAAE,QAAQ,cAAc,gBAAgB,YAC5C,MAAM,qBACJ,SACA,YACA,eACA,iBACA,oBACF;IACF,OAAQ,IAAI,CAAsB,KAAK,YAAY;IAGnD,KAAK,MAAM,gBAAgB,QAAQ,QACjC,kBAAkB,OAAO,IAAI,YAAY;IAG3C,KAAK,MAAM,kBAAkB,QAAQ,UACnC,kBAAkB,SAAS,IAAI,cAAc;GAEjD,OACE,OAAQ,IAAI,CAAe,KAAK,OAAO;EAG7C,OAAO,IAAI,SAAS,GAAG,KAAK,CAAC,YAAY,SAAS,GAAG,GAAG;GAEtD,OAAO,MAAM,qBAAqB,IAAI,EAAE;GACxC,MAAM,EAAE,QAAQ,cAAc,gBAAgB,YAC5C,MAAM,qBACJ,KACA,YACA,eACA,iBACA,oBACF;GACF,OAAO,OAAO;GAGd,KAAK,MAAM,gBAAgB,QAAQ,QACjC,kBAAkB,OAAO,IAAI,YAAY;GAG3C,KAAK,MAAM,kBAAkB,QAAQ,UACnC,kBAAkB,SAAS,IAAI,cAAc;EAEjD;CACF;CACA,OAAO,MAAM,EAAE,QAAQ,YAAY,GAAG,cAAc;CACpD,OAAO,MACL;EAAE;EAAQ,gBAAgB;CAAkB,GAC5C,iBACF;CAEA,OAAO;EACL;EACA,gBAAgB;GACd,QAAQ,MAAM,KAAK,kBAAkB,MAAM;GAC3C,UAAU,MAAM,KAAK,kBAAkB,QAAQ;EACjD;CACF;AACF;AAEA,eAAe,YACb,QACA,YACA,aACA,iBACoB;CACpB,IAAI;EACF,OAAO,MAAM,UAAU,QAAQ,cAAc,WAAW;CAC1D,SAAS,KAAK;EACZ,OAAO,MAAM;GAAE;GAAQ;EAAI,GAAG,oBAAoB;EAClD,IAAI,eAAe,mBACjB,MAAM;EAER,IAAI,IAAI,YAAA,uBACN,MAAM;EAER,MAAM,QAAQ,IAAI,MAAM,iBAAiB;EACzC,IAAI,IAAI,YAAA,iBACN,MAAM,kBAAkB,iCAAiC,OAAO;OAC3D,IAAI,IAAI,YAAA,oCACb,MAAM,kBAAkB,sDAAsD,OAAO;OAChF,IAAI,IAAI,YAAA,oBACb,MAAM,kBAAkB,yDAAyD,OAAO;OACnF,IAAI,IAAI,YAAA,kBACb,MAAM,kBAAkB,sBAAsB,OAAO;OAChD,IAAI,IAAI,YAAA,yBACb,MAAM,kBAAkB,sDAAsD,OAAO;OAChF,IAAI,IAAI,YAAA,uBACb,MAAM,kBAAkB,2BAA2B,OAAO;OACrD,IAAI,IAAI,YAAA,iCACb,MAAM,kBAAkB,iDAAiD,OAAO;OAEhF,MAAM,kBAAkB,mCAAmC,OAAO;EAEpE,IAAI,gBAAgB,QAClB,MAAM,mBACJ;EAEJ,OAAO,KACL,EAAE,iBAAiB,MAAM,gBAAgB,GACzC,uBACF;EACA,MAAM;CACR;AACF;AAEA,SAAS,oBACP,QACA,iBACA,eACS;CACT,IAAI,gBAAgB,SAAS,MAAM,GAAG;EACpC,OAAO,MACL,uBAAuB,OAAO,OAAO,gBAAgB,KAAK,IAAI,EAAE,EAClE;EACA,OAAO;CACT;CACA,IAAI,cAAc,SAAS,MAAM,GAAG;EAClC,OAAO,MACL,mBAAmB,OAAO,OAAO,gBAAgB,KAAK,IAAI,EAAE,EAC9D;EACA,OAAO;CACT;CACA,OAAO;AACT"}
+{"version":3,"file":"index.js","names":["internal.getPreset","memCache.get","migration.migrateConfig","massage.massageConfig","template.compile","internal.isInternal"],"sources":["../../../lib/config/presets/index.ts"],"sourcesContent":["import {\n  isArray,\n  isNullOrUndefined,\n  isObject,\n  isString,\n} from '@sindresorhus/is';\nimport {\n  CONFIG_VALIDATION,\n  HOST_BLOCKED,\n  PLATFORM_RATE_LIMIT_EXCEEDED,\n} from '../../constants/error-messages.ts';\nimport { logger } from '../../logger/index.ts';\nimport { ExternalHostError } from '../../types/errors/external-host-error.ts';\nimport { coerceArray } from '../../util/array.ts';\nimport * as memCache from '../../util/cache/memory/index.ts';\nimport { clone } from '../../util/clone.ts';\nimport { regEx } from '../../util/regex.ts';\nimport * as template from '../../util/template/index.ts';\nimport { GlobalConfig } from '../global.ts';\nimport * as massage from '../massage.ts';\nimport * as migration from '../migration.ts';\nimport type { AllConfig, RenovateConfig } from '../types.ts';\nimport { mergeChildConfig } from '../utils.ts';\nimport { removedPresets } from './common.ts';\nimport * as internal from './internal/index.ts';\nimport { parsePreset } from './parse.ts';\nimport { canonicalizeRelativePresets } from './relative.ts';\nimport type { Preset, PresetApi } from './types.ts';\nimport {\n  PRESET_DEP_NOT_FOUND,\n  PRESET_INVALID,\n  PRESET_INVALID_JSON,\n  PRESET_NOT_FOUND,\n  PRESET_PROHIBITED_SUBPRESET,\n  PRESET_RELATIVE_NO_PARENT,\n  PRESET_RENOVATE_CONFIG_NOT_FOUND,\n} from './util.ts';\n\ninterface PresetSource {\n  load: () => Promise<PresetApi>;\n\n  /**\n   * Whether presets from this source are hosted in a repository, which is what\n   * allows them to reference other presets relatively.\n   */\n  repoHosted: boolean;\n}\n\nconst presetSources: Record<string, PresetSource> = {\n  forgejo: { load: () => import('./forgejo/index.ts'), repoHosted: true },\n  gitea: { load: () => import('./gitea/index.ts'), repoHosted: true },\n  github: { load: () => import('./github/index.ts'), repoHosted: true },\n  gitlab: { load: () => import('./gitlab/index.ts'), repoHosted: true },\n  http: { load: () => import('./http/index.ts'), repoHosted: false },\n  local: { load: () => import('./local/index.ts'), repoHosted: true },\n  npm: { load: () => import('./npm/index.ts'), repoHosted: false },\n};\n\nconst presetCacheNamespace = 'preset';\n\nexport function replaceArgs(\n  obj: string,\n  argMapping: Record<string, any>,\n): string;\nexport function replaceArgs(\n  obj: string[],\n  argMapping: Record<string, any>,\n): string[];\nexport function replaceArgs(\n  obj: Record<string, any>,\n  argMapping: Record<string, any>,\n): Record<string, any>;\nexport function replaceArgs(\n  obj: Record<string, any>[],\n  argMapping: Record<string, any>,\n): Record<string, any>[];\n\n/**\n * TODO: fix me #22198\n * @param obj\n * @param argMapping\n */\nexport function replaceArgs(obj: any, argMapping: Record<string, any>): any;\nexport function replaceArgs(\n  obj: string | string[] | Record<string, any> | Record<string, any>[],\n  argMapping: Record<string, any>,\n): any {\n  if (isString(obj)) {\n    let returnStr = obj;\n    for (const [arg, argVal] of Object.entries(argMapping)) {\n      const re = regEx(`{{${arg}}}`, 'g', false);\n      returnStr = returnStr.replace(re, argVal);\n    }\n    return returnStr;\n  }\n  if (isArray(obj)) {\n    const returnArray = [];\n    for (const item of obj) {\n      returnArray.push(replaceArgs(item, argMapping));\n    }\n    return returnArray;\n  }\n  if (isObject(obj)) {\n    const returnObj: Record<string, any> = {};\n    for (const [key, val] of Object.entries(obj)) {\n      returnObj[key] = replaceArgs(val, argMapping);\n    }\n    return returnObj;\n  }\n  return obj;\n}\n\nexport async function getPreset(\n  preset: string,\n  baseConfig?: RenovateConfig,\n): Promise<RenovateConfig> {\n  logger.trace(`getPreset(${preset})`);\n  // Check if the preset has been removed or replaced\n  const newPreset = removedPresets[preset];\n  if (newPreset) {\n    return getPreset(newPreset, baseConfig);\n  }\n  if (newPreset === null) {\n    return {};\n  }\n  const parsedPreset = parsePreset(preset);\n  const { presetSource, repo, presetPath, presetName, tag, params, rawParams } =\n    parsedPreset;\n\n  if (presetSource === 'relative') {\n    throw new Error(PRESET_RELATIVE_NO_PARENT);\n  }\n\n  let presetConfig: Preset | null | undefined;\n\n  if (presetSource === 'internal') {\n    presetConfig = internal.getPreset({\n      repo,\n      presetPath,\n      presetName,\n      tag,\n    });\n  } else {\n    const cacheKey = `preset:${preset}`;\n    const presetCachePersistence = GlobalConfig.get('presetCachePersistence');\n\n    const packageCache = presetCachePersistence\n      ? await import('../../util/cache/package/index.ts')\n      : undefined;\n\n    if (packageCache) {\n      presetConfig = await packageCache.get(presetCacheNamespace, cacheKey);\n    } else {\n      presetConfig = memCache.get(cacheKey);\n    }\n\n    if (isNullOrUndefined(presetConfig)) {\n      const source = await presetSources[presetSource].load();\n      presetConfig = await source.getPreset({\n        repo,\n        presetPath,\n        presetName,\n        tag,\n      });\n      if (packageCache) {\n        await packageCache.set(\n          presetCacheNamespace,\n          cacheKey,\n          presetConfig,\n          15,\n        );\n      } else {\n        memCache.set(cacheKey, presetConfig);\n      }\n    }\n  }\n\n  if (!presetConfig) {\n    throw new Error(PRESET_DEP_NOT_FOUND);\n  }\n  logger.trace({ presetConfig }, `Found preset ${preset}`);\n  if (params) {\n    const argMapping: Record<string, string> = {};\n    for (const [index, value] of params.entries()) {\n      argMapping[`arg${index}`] = value;\n    }\n    if (rawParams) {\n      argMapping.args = rawParams;\n    }\n    presetConfig = replaceArgs(presetConfig, argMapping);\n  }\n  logger.trace({ presetConfig }, `Applied params to preset ${preset}`);\n  const presetKeys = Object.keys(presetConfig);\n  if (\n    presetKeys.length === 2 &&\n    presetKeys.includes('description') &&\n    presetKeys.includes('extends')\n  ) {\n    // preset is just a collection of other presets\n    delete presetConfig.description;\n  }\n  const packageListKeys = ['description', 'matchPackageNames'];\n  if (presetKeys.every((key) => packageListKeys.includes(key))) {\n    delete presetConfig.description;\n  }\n  const { migratedConfig } = migration.migrateConfig(presetConfig);\n  const massagedConfig = massage.massageConfig(migratedConfig);\n  if (presetSources[parsedPreset.presetSource]?.repoHosted) {\n    // only presets which are hosted in a repository can contain relative\n    // references, in all other presets they are left as they are and fail\n    // when they are resolved\n    canonicalizeRelativePresets(massagedConfig, parsedPreset);\n  }\n  return massagedConfig;\n}\n\nexport interface ResolveConfigPresetsResult {\n  config: AllConfig;\n  /** when resolving the given configuration, which internal/shared presets were discovered */\n  visitedPresets: {\n    /** which internal/shared presets were merged into the final config */\n    merged: string[];\n    /** which internal/shared presets were not merged into the final config */\n    unmerged: string[];\n  };\n}\n\n/**\n * @param [mergeInternalPresets=true] when resolving the config presets, whether to merge Renovate internal presets into the resulting configuration.\n *   When set to `false`, this will resolve these internal presets (recursively), but not merge them.\n *   This is primarily intended to be used by \"shallow config\" resolution (for logging purposes).\n */\nexport async function resolveConfigPresets(\n  inputConfig: AllConfig,\n  baseConfig?: RenovateConfig,\n  _ignorePresets?: string[],\n  existingPresets: string[] = [],\n  mergeInternalPresets = true,\n): Promise<ResolveConfigPresetsResult> {\n  const allVisitedPresets = {\n    merged: new Set<string>(),\n    unmerged: new Set<string>(),\n  };\n\n  let ignorePresets = clone(_ignorePresets);\n  if (!ignorePresets || ignorePresets.length === 0) {\n    ignorePresets = coerceArray(inputConfig.ignorePresets);\n  }\n  logger.trace(\n    { config: inputConfig, existingPresets, mergeInternalPresets },\n    'resolveConfigPresets',\n  );\n\n  let config: AllConfig = {};\n  // First, merge all the preset configs from left to right\n  if (inputConfig.extends?.length) {\n    // Compile templates\n    inputConfig.extends = inputConfig.extends.map((tmpl) =>\n      template.compile(tmpl, {}),\n    );\n    for (const preset of inputConfig.extends) {\n      // don't attempt to merge any internal presets if we're not expecting to\n      if (!mergeInternalPresets && internal.isInternal(preset)) {\n        logger.once.trace(\n          { ignoredPreset: preset, mergeInternalPresets },\n          'Not merging preset',\n        );\n        // ... but make sure we note that we haven't resolved it\n        allVisitedPresets.unmerged.add(preset);\n        continue;\n      }\n\n      if (shouldResolvePreset(preset, existingPresets, ignorePresets)) {\n        logger.trace(`Resolving preset \"${preset}\"`);\n        const fetchedPreset = await fetchPreset(\n          preset,\n          baseConfig,\n          inputConfig,\n          existingPresets,\n        );\n        const { config: presetConfig, visitedPresets } =\n          await resolveConfigPresets(\n            fetchedPreset,\n            baseConfig ?? inputConfig,\n            ignorePresets,\n            existingPresets.concat([preset]),\n            mergeInternalPresets,\n          );\n        config = mergeChildConfig(config, presetConfig);\n        allVisitedPresets.merged.add(preset);\n\n        // then also make sure we've noted any nested presets we've merged\n        for (const mergedPreset of visitedPresets.merged) {\n          allVisitedPresets.merged.add(mergedPreset);\n        }\n        // ... or not merged\n        for (const unmergedPreset of visitedPresets.unmerged) {\n          allVisitedPresets.unmerged.add(unmergedPreset);\n        }\n      }\n    }\n  }\n  logger.trace({ config }, `Post-preset resolve config`);\n  // Now assign \"regular\" config on top\n  config = mergeChildConfig(config, inputConfig);\n  delete config.extends;\n  delete config.ignorePresets;\n  // Any description of this config replaces the ones collated from its presets.\n  // Check the length, because array options default to an empty array.\n  if (config.overrideDescription?.length) {\n    config.description = config.overrideDescription;\n  }\n  delete config.overrideDescription;\n  logger.trace({ config }, `Post-merge resolve config`);\n  for (const [key, val] of Object.entries(config) as [\n    keyof AllConfig,\n    unknown,\n  ][]) {\n    const ignoredKeys = ['content', 'onboardingConfig'];\n    if (isArray(val)) {\n      // Resolve nested objects inside arrays\n      config[key] = [] as never; // type can't be narrowed\n      for (const element of val) {\n        if (isObject(element)) {\n          const { config: presetConfig, visitedPresets: visited } =\n            await resolveConfigPresets(\n              element,\n              baseConfig,\n              ignorePresets,\n              existingPresets,\n              mergeInternalPresets,\n            );\n          (config[key] as RenovateConfig[]).push(presetConfig);\n\n          // then also make sure we've noted any nested presets we've merged\n          for (const mergedPreset of visited.merged) {\n            allVisitedPresets.merged.add(mergedPreset);\n          }\n          // ... or not merged\n          for (const unmergedPreset of visited.unmerged) {\n            allVisitedPresets.unmerged.add(unmergedPreset);\n          }\n        } else {\n          (config[key] as unknown[]).push(element);\n        }\n      }\n    } else if (isObject(val) && !ignoredKeys.includes(key)) {\n      // Resolve nested objects\n      logger.trace(`Resolving object \"${key}\"`);\n      const { config: presetConfig, visitedPresets: visited } =\n        await resolveConfigPresets(\n          val,\n          baseConfig,\n          ignorePresets,\n          existingPresets,\n          mergeInternalPresets,\n        );\n      config[key] = presetConfig as never; // type can't be narrowed\n\n      // then also make sure we've noted any nested presets we've merged\n      for (const mergedPreset of visited.merged) {\n        allVisitedPresets.merged.add(mergedPreset);\n      }\n      // ... or not merged\n      for (const unmergedPreset of visited.unmerged) {\n        allVisitedPresets.unmerged.add(unmergedPreset);\n      }\n    }\n  }\n  logger.trace({ config: inputConfig }, 'Input config');\n  logger.trace(\n    { config, visitedPresets: allVisitedPresets },\n    'Resolved config',\n  );\n\n  return {\n    config,\n    visitedPresets: {\n      merged: Array.from(allVisitedPresets.merged),\n      unmerged: Array.from(allVisitedPresets.unmerged),\n    },\n  };\n}\n\nasync function fetchPreset(\n  preset: string,\n  baseConfig: RenovateConfig | undefined,\n  inputConfig: AllConfig,\n  existingPresets: string[],\n): Promise<AllConfig> {\n  try {\n    return await getPreset(preset, baseConfig ?? inputConfig);\n  } catch (err) {\n    logger.debug({ preset, err }, 'Preset fetch error');\n    if (err instanceof ExternalHostError) {\n      throw err;\n    }\n    if (err.message === PLATFORM_RATE_LIMIT_EXCEEDED) {\n      throw err;\n    }\n    const error = new Error(CONFIG_VALIDATION);\n    if (err.message === HOST_BLOCKED) {\n      logger.warn(\n        {\n          preset,\n          documentationUrl: `${GlobalConfig.get('productLinks').documentation}self-hosted-configuration/#hostrulesallowinternal`,\n        },\n        'Preset host is blocked by this Renovate instance',\n      );\n      // a preset's response becomes configuration, so a plain hostname grant is not enough - say what the administrator actually has to configure\n      error.validationError = `Preset host is blocked by this Renovate instance (${preset}). If this is intended, ask your Renovate administrator to permit it with a \\`hostRules\\` entry setting \\`allowInternal=true\\`, scoped either by \\`hostType\\` (for example \\`preset\\` or \\`npm\\`) or by a URL-prefix \\`matchHost\\``;\n    } else if (err.message === PRESET_DEP_NOT_FOUND) {\n      error.validationError = `Cannot find preset's package (${preset})`;\n    } else if (err.message === PRESET_RENOVATE_CONFIG_NOT_FOUND) {\n      error.validationError = `Preset package is missing a renovate-config entry (${preset})`;\n    } else if (err.message === PRESET_NOT_FOUND) {\n      error.validationError = `Preset name not found within published preset config (${preset})`;\n    } else if (err.message === PRESET_INVALID) {\n      error.validationError = `Preset is invalid (${preset})`;\n    } else if (err.message === PRESET_PROHIBITED_SUBPRESET) {\n      error.validationError = `Sub-presets cannot be combined with a custom path (${preset})`;\n    } else if (err.message === PRESET_INVALID_JSON) {\n      error.validationError = `Preset is invalid JSON (${preset})`;\n    } else if (err.message === PRESET_RELATIVE_NO_PARENT) {\n      error.validationError = `Relative preset reference cannot be resolved (${preset}). Relative presets can only be used within presets from a supported source, must stay inside their repository, and cannot be templated or used outside of a preset (for example in the repository config, inherited config, or globalExtends)`;\n    } else {\n      error.validationError = `Preset caused unexpected error (${preset})`;\n    }\n    if (existingPresets.length) {\n      error.validationError +=\n        '. Note: this is a *nested* preset so please contact the preset author if you are unable to fix it yourself.';\n    }\n    logger.info(\n      { validationError: error.validationError },\n      'Throwing preset error',\n    );\n    throw error;\n  }\n}\n\nfunction shouldResolvePreset(\n  preset: string,\n  existingPresets: string[],\n  ignorePresets: string[],\n): boolean {\n  if (existingPresets.includes(preset)) {\n    logger.debug(\n      `Already seen preset ${preset} in [${existingPresets.join(', ')}]`,\n    );\n    return false;\n  }\n  if (ignorePresets.includes(preset)) {\n    logger.debug(\n      `Ignoring preset ${preset} in [${existingPresets.join(', ')}]`,\n    );\n    return false;\n  }\n  return true;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAgDA,MAAM,gBAA8C;CAClD,SAAS;EAAE,YAAY,OAAO;EAAuB,YAAY;CAAK;CACtE,OAAO;EAAE,YAAY,OAAO;EAAqB,YAAY;CAAK;CAClE,QAAQ;EAAE,YAAY,OAAO;EAAsB,YAAY;CAAK;CACpE,QAAQ;EAAE,YAAY,OAAO;EAAsB,YAAY;CAAK;CACpE,MAAM;EAAE,YAAY,OAAO;EAAoB,YAAY;CAAM;CACjE,OAAO;EAAE,YAAY,OAAO;EAAqB,YAAY;CAAK;CAClE,KAAK;EAAE,YAAY,OAAO;EAAmB,YAAY;CAAM;AACjE;AAEA,MAAM,uBAAuB;AAyB7B,SAAgB,YACd,KACA,YACK;CACL,IAAI,SAAS,GAAG,GAAG;EACjB,IAAI,YAAY;EAChB,KAAK,MAAM,CAAC,KAAK,WAAW,OAAO,QAAQ,UAAU,GAAG;GACtD,MAAM,KAAK,MAAM,KAAK,IAAI,KAAK,KAAK,KAAK;GACzC,YAAY,UAAU,QAAQ,IAAI,MAAM;EAC1C;EACA,OAAO;CACT;CACA,IAAI,QAAQ,GAAG,GAAG;EAChB,MAAM,cAAc,CAAC;EACrB,KAAK,MAAM,QAAQ,KACjB,YAAY,KAAK,YAAY,MAAM,UAAU,CAAC;EAEhD,OAAO;CACT;CACA,IAAI,SAAS,GAAG,GAAG;EACjB,MAAM,YAAiC,CAAC;EACxC,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,GAAG,GACzC,UAAU,OAAO,YAAY,KAAK,UAAU;EAE9C,OAAO;CACT;CACA,OAAO;AACT;AAEA,eAAsB,UACpB,QACA,YACyB;CACzB,OAAO,MAAM,aAAa,OAAO,EAAE;CAEnC,MAAM,YAAY,eAAe;CACjC,IAAI,WACF,OAAO,UAAU,WAAW,UAAU;CAExC,IAAI,cAAc,MAChB,OAAO,CAAC;CAEV,MAAM,eAAe,YAAY,MAAM;CACvC,MAAM,EAAE,cAAc,MAAM,YAAY,YAAY,KAAK,QAAQ,cAC/D;CAEF,IAAI,iBAAiB,YACnB,MAAM,IAAI,MAAM,yBAAyB;CAG3C,IAAI;CAEJ,IAAI,iBAAiB,YACnB,eAAeA,YAAmB;EAChC;EACA;EACA;EACA;CACF,CAAC;MACI;EACL,MAAM,WAAW,UAAU;EAG3B,MAAM,eAFyB,aAAa,IAAI,wBAEN,IACtC,MAAM,OAAO,uCACb,KAAA;EAEJ,IAAI,cACF,eAAe,MAAM,aAAa,IAAI,sBAAsB,QAAQ;OAEpE,eAAeC,IAAa,QAAQ;EAGtC,IAAI,kBAAkB,YAAY,GAAG;GAEnC,eAAe,OAAM,MADA,cAAc,aAAa,CAAC,KAAK,EAAA,CAC1B,UAAU;IACpC;IACA;IACA;IACA;GACF,CAAC;GACD,IAAI,cACF,MAAM,aAAa,IACjB,sBACA,UACA,cACA,EACF;QAEA,IAAa,UAAU,YAAY;EAEvC;CACF;CAEA,IAAI,CAAC,cACH,MAAM,IAAI,MAAM,oBAAoB;CAEtC,OAAO,MAAM,EAAE,aAAa,GAAG,gBAAgB,QAAQ;CACvD,IAAI,QAAQ;EACV,MAAM,aAAqC,CAAC;EAC5C,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,GAC1C,WAAW,MAAM,WAAW;EAE9B,IAAI,WACF,WAAW,OAAO;EAEpB,eAAe,YAAY,cAAc,UAAU;CACrD;CACA,OAAO,MAAM,EAAE,aAAa,GAAG,4BAA4B,QAAQ;CACnE,MAAM,aAAa,OAAO,KAAK,YAAY;CAC3C,IACE,WAAW,WAAW,KACtB,WAAW,SAAS,aAAa,KACjC,WAAW,SAAS,SAAS,GAG7B,OAAO,aAAa;CAEtB,MAAM,kBAAkB,CAAC,eAAe,mBAAmB;CAC3D,IAAI,WAAW,OAAO,QAAQ,gBAAgB,SAAS,GAAG,CAAC,GACzD,OAAO,aAAa;CAEtB,MAAM,EAAE,mBAAmBC,cAAwB,YAAY;CAC/D,MAAM,iBAAiBC,cAAsB,cAAc;CAC3D,IAAI,cAAc,aAAa,aAAa,EAAE,YAI5C,4BAA4B,gBAAgB,YAAY;CAE1D,OAAO;AACT;;;;;;AAkBA,eAAsB,qBACpB,aACA,YACA,gBACA,kBAA4B,CAAC,GAC7B,uBAAuB,MACc;CACrC,MAAM,oBAAoB;EACxB,wBAAQ,IAAI,IAAY;EACxB,0BAAU,IAAI,IAAY;CAC5B;CAEA,IAAI,gBAAgB,MAAM,cAAc;CACxC,IAAI,CAAC,iBAAiB,cAAc,WAAW,GAC7C,gBAAgB,YAAY,YAAY,aAAa;CAEvD,OAAO,MACL;EAAE,QAAQ;EAAa;EAAiB;CAAqB,GAC7D,sBACF;CAEA,IAAI,SAAoB,CAAC;CAEzB,IAAI,YAAY,SAAS,QAAQ;EAE/B,YAAY,UAAU,YAAY,QAAQ,KAAK,SAC7CC,QAAiB,MAAM,CAAC,CAAC,CAC3B;EACA,KAAK,MAAM,UAAU,YAAY,SAAS;GAExC,IAAI,CAAC,wBAAwBC,WAAoB,MAAM,GAAG;IACxD,OAAO,KAAK,MACV;KAAE,eAAe;KAAQ;IAAqB,GAC9C,oBACF;IAEA,kBAAkB,SAAS,IAAI,MAAM;IACrC;GACF;GAEA,IAAI,oBAAoB,QAAQ,iBAAiB,aAAa,GAAG;IAC/D,OAAO,MAAM,qBAAqB,OAAO,EAAE;IAO3C,MAAM,EAAE,QAAQ,cAAc,mBAC5B,MAAM,qBACJ,MARwB,YAC1B,QACA,YACA,aACA,eACF,GAII,cAAc,aACd,eACA,gBAAgB,OAAO,CAAC,MAAM,CAAC,GAC/B,oBACF;IACF,SAAS,iBAAiB,QAAQ,YAAY;IAC9C,kBAAkB,OAAO,IAAI,MAAM;IAGnC,KAAK,MAAM,gBAAgB,eAAe,QACxC,kBAAkB,OAAO,IAAI,YAAY;IAG3C,KAAK,MAAM,kBAAkB,eAAe,UAC1C,kBAAkB,SAAS,IAAI,cAAc;GAEjD;EACF;CACF;CACA,OAAO,MAAM,EAAE,OAAO,GAAG,4BAA4B;CAErD,SAAS,iBAAiB,QAAQ,WAAW;CAC7C,OAAO,OAAO;CACd,OAAO,OAAO;CAGd,IAAI,OAAO,qBAAqB,QAC9B,OAAO,cAAc,OAAO;CAE9B,OAAO,OAAO;CACd,OAAO,MAAM,EAAE,OAAO,GAAG,2BAA2B;CACpD,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,MAAM,GAGzC;EACH,MAAM,cAAc,CAAC,WAAW,kBAAkB;EAClD,IAAI,QAAQ,GAAG,GAAG;GAEhB,OAAO,OAAO,CAAC;GACf,KAAK,MAAM,WAAW,KACpB,IAAI,SAAS,OAAO,GAAG;IACrB,MAAM,EAAE,QAAQ,cAAc,gBAAgB,YAC5C,MAAM,qBACJ,SACA,YACA,eACA,iBACA,oBACF;IACF,OAAQ,IAAI,CAAsB,KAAK,YAAY;IAGnD,KAAK,MAAM,gBAAgB,QAAQ,QACjC,kBAAkB,OAAO,IAAI,YAAY;IAG3C,KAAK,MAAM,kBAAkB,QAAQ,UACnC,kBAAkB,SAAS,IAAI,cAAc;GAEjD,OACE,OAAQ,IAAI,CAAe,KAAK,OAAO;EAG7C,OAAO,IAAI,SAAS,GAAG,KAAK,CAAC,YAAY,SAAS,GAAG,GAAG;GAEtD,OAAO,MAAM,qBAAqB,IAAI,EAAE;GACxC,MAAM,EAAE,QAAQ,cAAc,gBAAgB,YAC5C,MAAM,qBACJ,KACA,YACA,eACA,iBACA,oBACF;GACF,OAAO,OAAO;GAGd,KAAK,MAAM,gBAAgB,QAAQ,QACjC,kBAAkB,OAAO,IAAI,YAAY;GAG3C,KAAK,MAAM,kBAAkB,QAAQ,UACnC,kBAAkB,SAAS,IAAI,cAAc;EAEjD;CACF;CACA,OAAO,MAAM,EAAE,QAAQ,YAAY,GAAG,cAAc;CACpD,OAAO,MACL;EAAE;EAAQ,gBAAgB;CAAkB,GAC5C,iBACF;CAEA,OAAO;EACL;EACA,gBAAgB;GACd,QAAQ,MAAM,KAAK,kBAAkB,MAAM;GAC3C,UAAU,MAAM,KAAK,kBAAkB,QAAQ;EACjD;CACF;AACF;AAEA,eAAe,YACb,QACA,YACA,aACA,iBACoB;CACpB,IAAI;EACF,OAAO,MAAM,UAAU,QAAQ,cAAc,WAAW;CAC1D,SAAS,KAAK;EACZ,OAAO,MAAM;GAAE;GAAQ;EAAI,GAAG,oBAAoB;EAClD,IAAI,eAAe,mBACjB,MAAM;EAER,IAAI,IAAI,YAAA,uBACN,MAAM;EAER,MAAM,QAAQ,IAAI,MAAM,iBAAiB;EACzC,IAAI,IAAI,YAAA,gBAA0B;GAChC,OAAO,KACL;IACE;IACA,kBAAkB,GAAG,aAAa,IAAI,cAAc,CAAC,CAAC,cAAc;GACtE,GACA,kDACF;GAEA,MAAM,kBAAkB,qDAAqD,OAAO;EACtF,OAAO,IAAI,IAAI,YAAA,iBACb,MAAM,kBAAkB,iCAAiC,OAAO;OAC3D,IAAI,IAAI,YAAA,oCACb,MAAM,kBAAkB,sDAAsD,OAAO;OAChF,IAAI,IAAI,YAAA,oBACb,MAAM,kBAAkB,yDAAyD,OAAO;OACnF,IAAI,IAAI,YAAA,kBACb,MAAM,kBAAkB,sBAAsB,OAAO;OAChD,IAAI,IAAI,YAAA,yBACb,MAAM,kBAAkB,sDAAsD,OAAO;OAChF,IAAI,IAAI,YAAA,uBACb,MAAM,kBAAkB,2BAA2B,OAAO;OACrD,IAAI,IAAI,YAAA,iCACb,MAAM,kBAAkB,iDAAiD,OAAO;OAEhF,MAAM,kBAAkB,mCAAmC,OAAO;EAEpE,IAAI,gBAAgB,QAClB,MAAM,mBACJ;EAEJ,OAAO,KACL,EAAE,iBAAiB,MAAM,gBAAgB,GACzC,uBACF;EACA,MAAM;CACR;AACF;AAEA,SAAS,oBACP,QACA,iBACA,eACS;CACT,IAAI,gBAAgB,SAAS,MAAM,GAAG;EACpC,OAAO,MACL,uBAAuB,OAAO,OAAO,gBAAgB,KAAK,IAAI,EAAE,EAClE;EACA,OAAO;CACT;CACA,IAAI,cAAc,SAAS,MAAM,GAAG;EAClC,OAAO,MACL,mBAAmB,OAAO,OAAO,gBAAgB,KAAK,IAAI,EAAE,EAC9D;EACA,OAAO;CACT;CACA,OAAO;AACT"}

package/dist/config/presets/npm/index.js

@@ -1,3 +1,4 @@
+import "../../../constants/error-messages.js";
 import { logger } from "../../../logger/index.js";
 import { PRESET_DEP_NOT_FOUND, PRESET_NOT_FOUND, PRESET_RENOVATE_CONFIG_NOT_FOUND } from "../util.js";
 import { Http } from "../../../util/http/index.js";
@@ -5,7 +6,7 @@ import { memCacheProvider } from "../../../util/http/cache/memory-http-cache-pro
 import { NpmResponse } from "../../../modules/datasource/npm/schema.js";
 import { resolvePackageUrl, resolveRegistryUrl } from "../../../modules/datasource/npm/npmrc.js";
 //#region lib/config/presets/npm/index.ts
-const http = new Http("npm");
+const http = new Http("npm", { responseBecomesConfig: true });
 async function getPreset({ repo: pkg, presetName = "default" }) {
 	let dep;
 	try {
@@ -17,7 +18,8 @@ async function getPreset({ repo: pkg, presetName = "default" }) {
 		const packageUrl = resolvePackageUrl(registryUrl, pkg);
 		const body = (await http.getJson(packageUrl, { cacheProvider: memCacheProvider }, NpmResponse)).body;
 		dep = body.versions[body["dist-tags"].latest];
-	} catch {
+	} catch (err) {
+		if (err.message === "host-blocked") throw err;
 		throw new Error(PRESET_DEP_NOT_FOUND);
 	}
 	if (!dep?.["renovate-config"]) throw new Error(PRESET_RENOVATE_CONFIG_NOT_FOUND);

package/dist/config/presets/npm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../../lib/config/presets/npm/index.ts"],"sourcesContent":["import { logger } from '../../../logger/index.ts';\nimport {\n  resolvePackageUrl,\n  resolveRegistryUrl,\n} from '../../../modules/datasource/npm/npmrc.ts';\nimport type { NpmResponseVersion } from '../../../modules/datasource/npm/schema.ts';\nimport { NpmResponse } from '../../../modules/datasource/npm/schema.ts';\nimport { memCacheProvider } from '../../../util/http/cache/memory-http-cache-provider.ts';\nimport { Http } from '../../../util/http/index.ts';\nimport type { Preset, PresetConfig } from '../types.ts';\nimport {\n  PRESET_DEP_NOT_FOUND,\n  PRESET_NOT_FOUND,\n  PRESET_RENOVATE_CONFIG_NOT_FOUND,\n} from '../util.ts';\n\nconst id = 'npm';\n\nconst http = new Http(id);\n\nexport async function getPreset({\n  repo: pkg,\n  presetName = 'default',\n}: PresetConfig): Promise<Preset | undefined> {\n  let dep: (NpmResponseVersion & { 'renovate-config'?: any }) | undefined;\n  try {\n    const registryUrl = resolveRegistryUrl(pkg);\n    logger.once.warn(\n      { registryUrl, pkg },\n      'Using npm packages for Renovate presets is now deprecated. Please migrate to repository-based presets instead.',\n    );\n    const packageUrl = resolvePackageUrl(registryUrl, pkg);\n    const body = (\n      await http.getJson(\n        packageUrl,\n        { cacheProvider: memCacheProvider },\n        NpmResponse,\n      )\n    ).body;\n    // TODO: check null #22198\n    dep = body.versions![body['dist-tags']!.latest];\n  } catch {\n    throw new Error(PRESET_DEP_NOT_FOUND);\n  }\n  if (!dep?.['renovate-config']) {\n    throw new Error(PRESET_RENOVATE_CONFIG_NOT_FOUND);\n  }\n  const presetConfig = dep['renovate-config'][presetName];\n  if (!presetConfig) {\n    const presetNames = Object.keys(dep['renovate-config']);\n    logger.debug(\n      { presetNames, presetName },\n      'Preset not found within renovate-config',\n    );\n    throw new Error(PRESET_NOT_FOUND);\n  }\n  return presetConfig;\n}\n"],"mappings":";;;;;;;AAkBA,MAAM,OAAO,IAAI,KAAK,KAAE;AAExB,eAAsB,UAAU,EAC9B,MAAM,KACN,aAAa,aAC+B;CAC5C,IAAI;CACJ,IAAI;EACF,MAAM,cAAc,mBAAmB,GAAG;EAC1C,OAAO,KAAK,KACV;GAAE;GAAa;EAAI,GACnB,gHACF;EACA,MAAM,aAAa,kBAAkB,aAAa,GAAG;EACrD,MAAM,QACJ,MAAM,KAAK,QACT,YACA,EAAE,eAAe,iBAAiB,GAClC,WACF,EAAA,CACA;EAEF,MAAM,KAAK,SAAU,KAAK,YAAY,CAAE;CAC1C,QAAQ;EACN,MAAM,IAAI,MAAM,oBAAoB;CACtC;CACA,IAAI,CAAC,MAAM,oBACT,MAAM,IAAI,MAAM,gCAAgC;CAElD,MAAM,eAAe,IAAI,kBAAkB,CAAC;CAC5C,IAAI,CAAC,cAAc;EACjB,MAAM,cAAc,OAAO,KAAK,IAAI,kBAAkB;EACtD,OAAO,MACL;GAAE;GAAa;EAAW,GAC1B,yCACF;EACA,MAAM,IAAI,MAAM,gBAAgB;CAClC;CACA,OAAO;AACT"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../../lib/config/presets/npm/index.ts"],"sourcesContent":["import { HOST_BLOCKED } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport {\n  resolvePackageUrl,\n  resolveRegistryUrl,\n} from '../../../modules/datasource/npm/npmrc.ts';\nimport type { NpmResponseVersion } from '../../../modules/datasource/npm/schema.ts';\nimport { NpmResponse } from '../../../modules/datasource/npm/schema.ts';\nimport { memCacheProvider } from '../../../util/http/cache/memory-http-cache-provider.ts';\nimport { Http } from '../../../util/http/index.ts';\nimport type { Preset, PresetConfig } from '../types.ts';\nimport {\n  PRESET_DEP_NOT_FOUND,\n  PRESET_NOT_FOUND,\n  PRESET_RENOVATE_CONFIG_NOT_FOUND,\n} from '../util.ts';\n\nconst id = 'npm';\n\n// the registry URL comes from `npmrc`, which a repository can set for itself, and the `renovate-config` fetched from it becomes Renovate configuration - so an internal host needs a deliberately-scoped `allowInternal` grant, as for any other preset source\nconst http = new Http(id, { responseBecomesConfig: true });\n\nexport async function getPreset({\n  repo: pkg,\n  presetName = 'default',\n}: PresetConfig): Promise<Preset | undefined> {\n  let dep: (NpmResponseVersion & { 'renovate-config'?: any }) | undefined;\n  try {\n    const registryUrl = resolveRegistryUrl(pkg);\n    logger.once.warn(\n      { registryUrl, pkg },\n      'Using npm packages for Renovate presets is now deprecated. Please migrate to repository-based presets instead.',\n    );\n    const packageUrl = resolvePackageUrl(registryUrl, pkg);\n    const body = (\n      await http.getJson(\n        packageUrl,\n        { cacheProvider: memCacheProvider },\n        NpmResponse,\n      )\n    ).body;\n    // TODO: check null #22198\n    dep = body.versions![body['dist-tags']!.latest];\n  } catch (err) {\n    // keep the block distinguishable from a missing package, so it surfaces as its own config validation error\n    if (err.message === HOST_BLOCKED) {\n      throw err;\n    }\n\n    throw new Error(PRESET_DEP_NOT_FOUND);\n  }\n  if (!dep?.['renovate-config']) {\n    throw new Error(PRESET_RENOVATE_CONFIG_NOT_FOUND);\n  }\n  const presetConfig = dep['renovate-config'][presetName];\n  if (!presetConfig) {\n    const presetNames = Object.keys(dep['renovate-config']);\n    logger.debug(\n      { presetNames, presetName },\n      'Preset not found within renovate-config',\n    );\n    throw new Error(PRESET_NOT_FOUND);\n  }\n  return presetConfig;\n}\n"],"mappings":";;;;;;;;AAoBA,MAAM,OAAO,IAAI,KAAK,OAAI,EAAE,uBAAuB,KAAK,CAAC;AAEzD,eAAsB,UAAU,EAC9B,MAAM,KACN,aAAa,aAC+B;CAC5C,IAAI;CACJ,IAAI;EACF,MAAM,cAAc,mBAAmB,GAAG;EAC1C,OAAO,KAAK,KACV;GAAE;GAAa;EAAI,GACnB,gHACF;EACA,MAAM,aAAa,kBAAkB,aAAa,GAAG;EACrD,MAAM,QACJ,MAAM,KAAK,QACT,YACA,EAAE,eAAe,iBAAiB,GAClC,WACF,EAAA,CACA;EAEF,MAAM,KAAK,SAAU,KAAK,YAAY,CAAE;CAC1C,SAAS,KAAK;EAEZ,IAAI,IAAI,YAAA,gBACN,MAAM;EAGR,MAAM,IAAI,MAAM,oBAAoB;CACtC;CACA,IAAI,CAAC,MAAM,oBACT,MAAM,IAAI,MAAM,gCAAgC;CAElD,MAAM,eAAe,IAAI,kBAAkB,CAAC;CAC5C,IAAI,CAAC,cAAc;EACjB,MAAM,cAAc,OAAO,KAAK,IAAI,kBAAkB;EACtD,OAAO,MACL;GAAE;GAAa;EAAW,GAC1B,yCACF;EACA,MAAM,IAAI,MAAM,gBAAgB;CAClC;CACA,OAAO;AACT"}

package/dist/config/types.d.ts

@@ -19,6 +19,7 @@ type RenovateSplit = 'init' | 'onboarding' | 'extract' | 'lookup' | 'update';
 type RepositoryCacheConfig = 'disabled' | 'enabled' | 'reset';
 type RepositoryCacheType = 'local' | (string & {});
 type DryRunConfig = 'extract' | 'lookup' | 'full';
+type InternalHostAccess = 'allow' | 'warn' | 'block';
 type RequiredConfig = 'required' | 'optional' | 'ignored';
 interface GroupConfig extends Record<string, unknown> {
   branchName?: string;
@@ -226,6 +227,8 @@ interface RepoGlobalConfig extends GlobalInheritableConfig {
   gitTimeout?: number;
   githubTokenWarn?: boolean;
   includeMirrors?: boolean;
+  inheritConfigTrusted?: boolean;
+  internalHostAccess?: InternalHostAccess;
   migratePresets?: Record<string, string>;
   platform?: PlatformId;
   prCacheSyncMaxPages?: number;
@@ -680,5 +683,5 @@ interface RepoToolSettingsOptions {
   nodeMaxMemory?: number;
 }
 //#endregion
-export { AllConfig, AllowedParents, AllowedUnsafeExecution, AssigneesAndReviewersConfig, BinarySource, BumpVersionConfig, ConfigMigration, ConstraintsFilter, CustomDatasourceConfig, CustomDatasourceFormats, DryRunConfig, ExecutionMode, FetchChangeLogsOptions, GlobalInheritableConfig, GlobalOnlyConfigLegacy, GlobalToolSettingsOptions, GroupConfig, InternalGlobalConfigOptions, LegacyAdminConfig, ManagerConfig, MatchStringsStrategy, MergeStrategy, MigratedConfig, MigratedRenovateConfig, MinimumReleaseAgeBehaviour, PackageRule, PackageRuleInputConfig, PlatformCommitOptions, PostUpgradeTasks, RecreateWhen, RenovateArrayOption, RenovateBooleanOption, RenovateConfig, RenovateConfigStage, RenovateIntegerOption, RenovateInternalConfig, RenovateNumberArrayOption, RenovateObjectOption, RenovateOptionBase, RenovateOptions, RenovateRepository, RenovateRepositoryEntry, RenovateRequiredOption, RenovateSharedConfig, RenovateSplit, RenovateStringArrayOption, RenovateStringOption, RepoGlobalConfig, RepoToolSettingsOptions, RepositoryCacheConfig, RepositoryCacheType, RequiredConfig, StatusCheckKey, StatusCheckWhen, UpdateConfig, UpdateType, UpdateTypeOptions, UpdateTypesOptions, UseBaseBranchConfigType, ValidationMessage, ValidationResult, allowedStatusCheckStrings };
+export { AllConfig, AllowedParents, AllowedUnsafeExecution, AssigneesAndReviewersConfig, BinarySource, BumpVersionConfig, ConfigMigration, ConstraintsFilter, CustomDatasourceConfig, CustomDatasourceFormats, DryRunConfig, ExecutionMode, FetchChangeLogsOptions, GlobalInheritableConfig, GlobalOnlyConfigLegacy, GlobalToolSettingsOptions, GroupConfig, InternalGlobalConfigOptions, InternalHostAccess, LegacyAdminConfig, ManagerConfig, MatchStringsStrategy, MergeStrategy, MigratedConfig, MigratedRenovateConfig, MinimumReleaseAgeBehaviour, PackageRule, PackageRuleInputConfig, PlatformCommitOptions, PostUpgradeTasks, RecreateWhen, RenovateArrayOption, RenovateBooleanOption, RenovateConfig, RenovateConfigStage, RenovateIntegerOption, RenovateInternalConfig, RenovateNumberArrayOption, RenovateObjectOption, RenovateOptionBase, RenovateOptions, RenovateRepository, RenovateRepositoryEntry, RenovateRequiredOption, RenovateSharedConfig, RenovateSplit, RenovateStringArrayOption, RenovateStringOption, RepoGlobalConfig, RepoToolSettingsOptions, RepositoryCacheConfig, RepositoryCacheType, RequiredConfig, StatusCheckKey, StatusCheckWhen, UpdateConfig, UpdateType, UpdateTypeOptions, UpdateTypesOptions, UseBaseBranchConfigType, ValidationMessage, ValidationResult, allowedStatusCheckStrings };
 //# sourceMappingURL=types.d.ts.map

package/dist/config/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","names":[],"sources":["../../lib/config/types.ts"],"sourcesContent":["import type { Category, PlatformId } from '../constants/index.ts';\nimport type { LogLevelRemap } from '../logger/types.ts';\nimport type { ManagerName } from '../manager-list.generated.ts';\nimport type { CustomManager } from '../modules/manager/custom/types.ts';\nimport type {\n  GitUrlOption,\n  RepoSortMethod,\n  SortMethod,\n} from '../modules/platform/types.ts';\nimport type {\n  AutoMergeType,\n  HostRule,\n  Nullish,\n  RangeStrategy,\n  SkipReason,\n} from '../types/index.ts';\nimport type { StageName } from '../types/skip-reason.ts';\nimport type {\n  AdditionalConstraintName,\n  ConstraintName,\n  ToolName,\n} from '../util/exec/types.ts';\nimport type { GitNoVerifyOption } from '../util/git/types.ts';\nimport type { MergeConfidence } from '../util/merge-confidence/types.ts';\nimport type { Timestamp } from '../util/timestamp.ts';\nimport type { ConfigValidationTopic } from './validation-helpers/types.ts';\n\nexport type RenovateConfigStage =\n  'global' | 'inherit' | 'repository' | 'package' | 'branch' | 'pr';\n\nexport type RenovateSplit =\n  'init' | 'onboarding' | 'extract' | 'lookup' | 'update';\n\nexport type RepositoryCacheConfig = 'disabled' | 'enabled' | 'reset';\nexport type RepositoryCacheType = 'local' | (string & {});\nexport type DryRunConfig = 'extract' | 'lookup' | 'full';\nexport type RequiredConfig = 'required' | 'optional' | 'ignored';\n\nexport interface GroupConfig extends Record<string, unknown> {\n  branchName?: string;\n  branchTopic?: string;\n}\n\nexport type RecreateWhen = 'auto' | 'never' | 'always';\nexport type StatusCheckWhen = 'always' | 'never' | 'failed';\nexport type PlatformCommitOptions = 'auto' | 'disabled' | 'enabled';\n\nexport type BinarySource = 'docker' | 'global' | 'install' | 'hermit';\n\n// TODO: Proper typings\n/**\n * Any configuration that could be used either top-level in a repository config (or Global, Inherited or Shareable Preset configuration), or:\n *\n * - in a datasource-specific configuration\n * - in a manager-specific configuration\n * - in a Package Rule\n *\n * @see RenovateConfig for the superset of all configuration allowed in a given repository\n *\n */\nexport interface RenovateSharedConfig {\n  $schema?: string;\n  abandonmentThreshold?: Nullish<string>;\n  addLabels?: string[];\n  assignAutomerge?: boolean;\n  autoApprove?: boolean;\n  autoReplaceGlobalMatch?: boolean;\n  automerge?: boolean;\n  automergeSchedule?: string[];\n  automergeStrategy?: MergeStrategy;\n  automergeType?: AutoMergeType;\n  azureWorkItemId?: number;\n  azureWorkItemType?: string;\n  branchName?: string;\n  branchNameStrict?: boolean;\n  branchPrefix?: string;\n  branchPrefixOld?: string;\n  bumpVersions?: BumpVersionConfig[];\n  commitBody?: string;\n  commitBodyTable?: boolean;\n  commitMessage?: string;\n  commitMessageAction?: string;\n  commitMessageExtra?: string;\n  commitMessageLowerCase?: 'auto' | 'never';\n  commitMessagePrefix?: string;\n  commitMessageTopic?: string;\n  commitTrailers?: string[];\n  confidential?: boolean;\n  configValidationError?: boolean;\n  changelogUrl?: string;\n  dependencyDashboardApproval?: boolean;\n  draftPR?: boolean;\n  enabled?: boolean;\n  enabledManagers?: string[];\n  encrypted?: Record<string, string>;\n  extends?: string[];\n  extractVersion?: string;\n  managerFilePatterns?: string[];\n  followTag?: string;\n  force?: RenovateConfig;\n  gitIgnoredAuthors?: string[];\n  group?: GroupConfig;\n  groupName?: string;\n  groupSingleUpdates?: boolean;\n  groupSlug?: string;\n  hashedBranchLength?: number;\n  ignoreDeps?: string[];\n  ignorePaths?: string[];\n  ignoreTests?: boolean;\n  ignoreUnstable?: boolean;\n  includePaths?: string[];\n  internalChecksAsSuccess?: boolean;\n  internalChecksFilter?: 'strict' | 'flexible' | 'none';\n  keepUpdatedLabel?: string;\n  labels?: string[];\n  manager?: string;\n  milestone?: number;\n  minimumReleaseAge?: Nullish<string>;\n  npmrc?: string;\n  npmrcMerge?: boolean;\n  npmToken?: string;\n\n  pinDigests?: boolean;\n  platformAutomerge?: boolean;\n  platformCommit?: PlatformCommitOptions;\n  postUpgradeTasks?: PostUpgradeTasks;\n  prBodyColumns?: string[];\n  prBodyDefinitions?: Record<string, string>;\n  prBodyHeadingDefinitions?: Record<string, string>;\n  prBodyNotes?: string[];\n  prCreation?: 'immediate' | 'not-pending' | 'status-success' | 'approval';\n  prFooter?: string;\n  prHeader?: string;\n  prPriority?: number;\n  prTitle?: string;\n  prTitleStrict?: boolean;\n  pruneBranchAfterAutomerge?: boolean;\n  rangeStrategy?: RangeStrategy;\n  rebaseLabel?: string;\n  rebaseWhen?: string;\n  recreateClosed?: boolean;\n  recreateWhen?: RecreateWhen;\n  repository?: string;\n  repositoryCache?: RepositoryCacheConfig;\n  repositoryCacheType?: RepositoryCacheType;\n  respectLatest?: boolean;\n  rollbackPrs?: boolean;\n  schedule?: string[];\n  semanticCommitScope?: string | null;\n  semanticCommitType?: string;\n  semanticCommits?: 'auto' | 'enabled' | 'disabled';\n  separateMajorMinor?: boolean;\n  separateMinorPatch?: boolean;\n  separateMultipleMajor?: boolean;\n  separateMultipleMinor?: boolean;\n  skipArtifactsUpdate?: boolean;\n  stopUpdatingLabel?: string;\n  suppressNotifications?: string[];\n  timezone?: string;\n  unicodeEmoji?: boolean;\n  updateNotScheduled?: boolean;\n  versioning?: string;\n  versionCompatibility?: string;\n}\n\n/**\n * Contains all options with globalOnly=true && inheritConfigSupport=true\n */\nexport interface GlobalInheritableConfig {\n  bbUseDevelopmentBranch?: boolean;\n  configFileNames?: string[];\n  onboarding?: boolean;\n  onboardingAutoCloseAge?: number;\n  onboardingBranch?: string;\n  onboardingCommitMessage?: string;\n  onboardingConfig?: RenovateConfig;\n  onboardingConfigFileName?: string;\n  onboardingNoDeps?: 'auto' | 'enabled' | 'disabled';\n  onboardingPrTitle?: string;\n  requireConfig?: RequiredConfig;\n}\n\n// Config options used only within the global worker\n// The below should contain config options where stage=global\n/** @deprecated use `RepoGlobalConfig` instead **/\nexport interface GlobalOnlyConfigLegacy {\n  autodiscover?: boolean;\n  autodiscoverFilter?: string[] | string;\n  autodiscoverNamespaces?: string[];\n  autodiscoverProjects?: string[];\n  autodiscoverTopics?: string[];\n  baseDir?: string;\n  cacheDir?: string;\n  containerbaseDir?: string;\n  detectHostRulesFromEnv?: boolean;\n  dockerCliOptions?: string;\n  endpoint?: string;\n  exitCodeForErrors?: boolean;\n  forceCli?: boolean;\n  gitNoVerify?: GitNoVerifyOption[];\n  gitPrivateKey?: string;\n  gitPrivateKeyPassphrase?: string;\n  globalExtends?: string[];\n  mergeConfidenceDatasources?: string[];\n  mergeConfidenceEndpoint?: string;\n  platform?: PlatformId;\n  processEnv?: Record<string, string>;\n  prCommitsPerRunLimit?: number;\n  privateKey?: string;\n  privateKeyOld?: string;\n  privateKeyPath?: string;\n  privateKeyPathOld?: string;\n  redisPrefix?: string;\n  redisUrl?: string;\n  repositories?: RenovateRepository[];\n  useCloudMetadataServices?: boolean;\n  deleteConfigFile?: boolean;\n  deleteAdditionalConfigFile?: boolean;\n}\n\n/**\n * Any global-only configuration set by self-hosted administrators.\n *\n * Used within the repository worker.\n *\n * Should only contain config options where globalOnly=true.\n */\nexport interface RepoGlobalConfig extends GlobalInheritableConfig {\n  allowedCommands?: string[];\n  allowCustomCrateRegistries?: boolean;\n  allowPlugins?: boolean;\n  allowScripts?: boolean;\n  allowShellExecutorForPostUpgradeCommands?: boolean;\n  allowedEnv?: string[];\n  allowedHeaders?: string[];\n  binarySource?: BinarySource;\n  cacheDir?: string;\n  cacheHardTtlMinutes?: number;\n  cacheTtlOverride?: Record<string, number>;\n  checkedBranches?: string[];\n  containerbaseDir?: string;\n  customEnvVariables?: Record<string, string>;\n  dockerChildPrefix?: string;\n  dockerCliOptions?: string;\n  dockerSidecarImage?: string;\n  dockerUser?: string;\n  dryRun?: DryRunConfig;\n  encryptedWarning?: string;\n  endpoint?: string;\n  executionTimeout?: number;\n  exposeAllEnv?: boolean;\n  gitTimeout?: number;\n  githubTokenWarn?: boolean;\n  includeMirrors?: boolean;\n  migratePresets?: Record<string, string>;\n  platform?: PlatformId;\n  prCacheSyncMaxPages?: number;\n  presetCachePersistence?: boolean;\n  httpCacheTtlDays?: number;\n  autodiscoverRepoSort?: RepoSortMethod;\n  autodiscoverRepoOrder?: SortMethod;\n  userAgent?: string;\n  dockerMaxPages?: number;\n  s3Endpoint?: string;\n  s3PathStyle?: boolean;\n  cachePrivatePackages?: boolean;\n  repositoryCacheForceLocal?: boolean;\n  configFileNames?: string[];\n  ignorePrAuthor?: boolean;\n  allowedUnsafeExecutions?: AllowedUnsafeExecution[];\n  onboardingAutoCloseAge?: number;\n  productLinks?: Record<string, string>;\n  rebaseAllOpenBranches?: boolean;\n  toolSettings?: GlobalToolSettingsOptions;\n}\n\n/**\n * Internal variables which are referenced from `GlobalConfig`, but are *not* user-configurable options.\n */\nexport interface InternalGlobalConfigOptions {\n  localDir?: string;\n}\n\n/**\n * Those options are global only but still passed into the repository worker config.\n *\n * @deprecated https://github.com/renovatebot/renovate/issues/39693\n */\nexport interface LegacyAdminConfig {\n  baseDir?: string;\n  localDir?: string;\n\n  logContext?: string;\n\n  onboarding?: boolean;\n  onboardingBranch?: string;\n  onboardingNoDeps?: 'auto' | 'enabled' | 'disabled';\n  onboardingRebaseCheckbox?: boolean;\n  onboardingConfig?: RenovateConfig;\n  onboardingConfigFileName?: string;\n\n  optimizeForDisabled?: boolean;\n\n  persistRepoData?: boolean;\n\n  prCommitsPerRunLimit?: number;\n\n  requireConfig?: RequiredConfig;\n\n  useCloudMetadataServices?: boolean;\n\n  writeDiscoveredRepos?: string;\n}\n\nexport type ExecutionMode = 'branch' | 'update';\n\nexport interface PostUpgradeTasks {\n  commands?: string[];\n  workingDirTemplate?: string;\n  dataFileTemplate?: string;\n  fileFilters?: string[];\n  executionMode: ExecutionMode;\n  installTools?: Partial<Record<ToolName, Record<never, never>>>;\n}\n\nexport type UpdateConfig<\n  T extends RenovateSharedConfig = RenovateSharedConfig,\n> = Partial<Record<UpdateType, T | null>>;\n\nexport type RenovateRepositoryEntry = AllConfig & {\n  repository: string;\n};\n\nexport type RenovateRepository = string | RenovateRepositoryEntry;\n\nexport type UseBaseBranchConfigType = 'merge' | 'none';\nexport type ConstraintsFilter = 'strict' | 'none';\nexport type MinimumReleaseAgeBehaviour =\n  'timestamp-required' | 'timestamp-optional';\n\nexport const allowedStatusCheckStrings = [\n  'minimumReleaseAge',\n  'mergeConfidence',\n  'configValidation',\n  'artifactError',\n] as const;\nexport type StatusCheckKey = (typeof allowedStatusCheckStrings)[number];\ntype UserEnv = Record<string, string>;\n\n/**\n * Computed properties, for internal use only\n */\nexport interface RenovateInternalConfig {\n  /** computed base branch from patterns - for internal use only */\n  baseBranches?: string[];\n  currentCompatibility?: string;\n  datasource?: string;\n  hasBaseBranches?: boolean;\n  isFork?: boolean;\n  isVulnerabilityAlert?: boolean;\n\n  /** What is this used for? */\n  remediations?: unknown;\n  /** What is this used for? */\n  vulnerabilityAlertsOnly?: boolean;\n}\n\n// TODO: Proper typings\n/**\n * Configuration that could be used either top-level in a repository config (or Global, Inherited or Shareable Preset configuration).\n *\n * This is a superset of any configuration that a Renovate user (not self-hosted administrator) can set.\n */\nexport interface RenovateConfig\n  extends\n    LegacyAdminConfig,\n    RenovateSharedConfig,\n    UpdateConfig<PackageRule>,\n    AssigneesAndReviewersConfig,\n    ConfigMigration,\n    RenovateInternalConfig {\n  s3Endpoint?: string;\n  s3PathStyle?: boolean;\n  reportFormatting?: boolean;\n  reportPath?: string;\n  reportType?: 'logging' | 'file' | 's3' | null;\n  depName?: string;\n  /** user configurable base branch patterns*/\n  baseBranchPatterns?: string[];\n  useBaseBranchConfig?: UseBaseBranchConfigType;\n  baseBranch?: string;\n  defaultBranch?: string;\n  branchList?: string[];\n  cloneSubmodules?: boolean;\n  cloneSubmodulesFilter?: string[];\n  description?: string | string[];\n  overrideDescription?: string | string[];\n  detectGlobalManagerConfig?: boolean;\n  errors?: ValidationMessage[];\n  forkModeDisallowMaintainerEdits?: boolean;\n  forkProcessing?: 'auto' | 'enabled' | 'disabled';\n  forkToken?: string;\n\n  gitAuthor?: string;\n\n  hostRules?: HostRule[];\n\n  inheritConfig?: boolean;\n  inheritConfigFileName?: string;\n  inheritConfigRepoName?: string;\n  inheritConfigStrict?: boolean;\n\n  ignorePresets?: string[];\n\n  fileList?: string[];\n  configWarningReuseIssue?: boolean;\n  dependencyDashboard?: boolean;\n  dependencyDashboardAutoclose?: boolean;\n  dependencyDashboardChecks?: Record<string, string>;\n  dependencyDashboardIssue?: number;\n  dependencyDashboardTitle?: string;\n  dependencyDashboardHeader?: string;\n  dependencyDashboardFooter?: string;\n  dependencyDashboardLabels?: string[];\n  dependencyDashboardOSVVulnerabilitySummary?: 'none' | 'all' | 'unresolved';\n  dependencyDashboardReportAbandonment?: boolean;\n  mode?: 'silent' | 'full';\n  packageFile?: string;\n  packageRules?: PackageRule[];\n  postUpdateOptions?: string[];\n  branchConcurrentLimit?: number | null;\n  parentOrg?: string;\n  prConcurrentLimit?: number;\n  commitHourlyLimit?: number;\n  prHourlyLimit?: number;\n\n  printConfig?: boolean;\n\n  pruneStaleBranches?: boolean;\n\n  defaultRegistryUrls?: string[];\n  registryUrls?: string[] | null;\n  registryAliases?: Record<string, string>;\n\n  /**\n   * What is this used for?\n   * @deprecated\n   */\n  renovateJsonPresent?: boolean;\n\n  repoIsOnboarded?: boolean;\n  repoIsActivated?: boolean;\n\n  topLevelOrg?: string;\n  updateInternalDeps?: boolean;\n  updateType?: UpdateType;\n\n  warnings?: ValidationMessage[];\n  vulnerabilityAlerts?: RenovateSharedConfig;\n  osvVulnerabilityAlerts?: boolean;\n  vulnerabilitySeverity?: string;\n  customManagers?: CustomManager[];\n  customDatasources?: Record<string, CustomDatasourceConfig>;\n\n  fetchChangeLogs?: FetchChangeLogsOptions;\n  secrets?: Record<string, string>;\n  variables?: Record<string, string>;\n\n  constraints?: Partial<Record<ConstraintName, string>>;\n  /**\n   * Any specific overrides for the versioning for the `AdditionalConstraintName`s.\n   */\n  constraintsVersioning?: Partial<Record<AdditionalConstraintName, string>>;\n  skipInstalls?: boolean | null;\n\n  constraintsFiltering?: ConstraintsFilter;\n\n  customizeDashboard?: Record<string, string>;\n\n  statusCheckNames?: Record<StatusCheckKey, string | null>;\n  statusCheckWhen?: Partial<Record<StatusCheckKey, StatusCheckWhen>>;\n  /**\n   * User configured environment variables that Renovate uses when executing package manager commands\n   */\n  env?: UserEnv;\n  logLevelRemap?: LogLevelRemap[];\n\n  branchTopic?: string;\n  additionalBranchPrefix?: string;\n  sharedVariableName?: string;\n  minimumGroupSize?: number;\n  configFileNames?: string[];\n  minimumReleaseAgeBehaviour?: MinimumReleaseAgeBehaviour;\n  toolSettings?: RepoToolSettingsOptions;\n}\n\nconst CustomDatasourceFormats = [\n  'html',\n  'json',\n  'plain',\n  'toml',\n  'yaml',\n] as const;\nexport type CustomDatasourceFormats = (typeof CustomDatasourceFormats)[number];\n\nexport interface CustomDatasourceConfig {\n  defaultRegistryUrlTemplate?: string;\n  format?: CustomDatasourceFormats;\n  transformTemplates?: string[];\n}\n\n/**\n * The superset of all configuration that a self-hosted administrator can set, alongside all repository-level configuration.\n *\n */\nexport interface AllConfig\n  extends RenovateConfig, GlobalOnlyConfigLegacy, RepoGlobalConfig {\n  gitUrl?: GitUrlOption;\n  password?: string;\n  token?: string;\n  username?: string;\n}\n\nexport interface AssigneesAndReviewersConfig {\n  assigneesFromCodeOwners?: boolean;\n  expandCodeOwnersGroups?: boolean;\n  assignees?: string[];\n  assigneesSampleSize?: number;\n  ignoreReviewers?: string[];\n  reviewersFromCodeOwners?: boolean;\n  reviewers?: string[];\n  reviewersSampleSize?: number;\n  additionalReviewers?: string[];\n  filterUnavailableUsers?: boolean;\n}\n\nexport type UpdateType =\n  | 'major'\n  | 'minor'\n  | 'patch'\n  | 'pin'\n  | 'digest'\n  | 'pinDigest'\n  | 'lockFileMaintenance'\n  | 'lockfileUpdate'\n  | 'rollback'\n  | 'bump'\n  | 'replacement';\n\n// These are the update types which can have configuration\nexport const UpdateTypesOptions = [\n  'major',\n  'minor',\n  'patch',\n  'pin',\n  'digest',\n  'pinDigest',\n  'lockFileMaintenance',\n  'rollback',\n  'replacement',\n] as const;\n\nexport type UpdateTypeOptions = (typeof UpdateTypesOptions)[number];\n\nexport type FetchChangeLogsOptions = 'off' | 'branch' | 'pr';\n\nexport type MatchStringsStrategy = 'any' | 'recursive' | 'combination';\n\nexport type MergeStrategy =\n  | 'auto'\n  | 'fast-forward'\n  | 'merge-commit'\n  | 'rebase'\n  | 'rebase-merge'\n  | 'squash';\n\n// This list should be added to as any new unsafe execution commands should be permitted\nexport type AllowedUnsafeExecution =\n  'bazelModDeps' | 'goGenerate' | 'gradleWrapper' | 'mise' | 'pixi';\n\n// TODO: Proper typings\nexport interface PackageRule\n  extends RenovateSharedConfig, RenovateInternalConfig, UpdateConfig {\n  allowedVersions?: string;\n  description?: string | string[];\n  matchBaseBranches?: string[];\n  matchCategories?: string[];\n  matchConfidence?: MergeConfidence[];\n  matchCurrentAge?: string;\n  matchCurrentValue?: string;\n  matchCurrentVersion?: string;\n  matchDatasources?: string[];\n  matchDepNames?: string[];\n  matchDepTypes?: string[];\n  matchFileNames?: string[];\n  matchManagers?: string[];\n  matchNewValue?: string;\n  matchPackageNames?: string[];\n  matchRepositories?: string[];\n  matchSourceUrls?: string[];\n  matchRegistryUrls?: string[];\n  matchUpdateTypes?: UpdateType[];\n  matchJsonata?: string[];\n  overrideDatasource?: string;\n  overrideDepName?: string;\n  overridePackageName?: string;\n  registryUrls?: string[] | null;\n  replacementName?: string;\n  replacementVersion?: string;\n  sourceUrl?: string;\n  sourceDirectory?: string;\n  vulnerabilitySeverity?: string;\n  vulnerabilityFixVersion?: string;\n}\n\nexport interface ValidationMessage {\n  // Topic is either the known list of topics, or a dynamically generated one\n  topic: ConfigValidationTopic | (string & {});\n  message: string;\n}\n\nexport type AllowedParents =\n  | '.'\n  | 'bumpVersions'\n  | 'customDatasources'\n  | 'customManagers'\n  | 'hostRules'\n  | 'logLevelRemap'\n  | 'packageRules'\n  | 'postUpgradeTasks'\n  | 'vulnerabilityAlerts'\n  | 'toolSettings'\n  | ManagerName\n  | UpdateTypeOptions;\nexport interface RenovateOptionBase {\n  /**\n   * If true, the option can only be configured by people with access to the Renovate instance.\n   * Furthermore, the option should be documented in docs/usage/self-hosted-configuration.md.\n   */\n  globalOnly?: boolean;\n\n  /**\n   * If true, this option **MUST** be checked at the trust boundary: after resolving the full config that sets it, but **before** the value is applied.\n   *\n   * This is in addition to any existing config validation, and ensures that these options are re-validated due to their sensitive nature.\n   *\n   * A failure of that check **must** lead to a {@link ConfigValidationTopic.Security} error (which is then a full config validation error), stopping the Renovate run.\n   *\n   * After this check has been performed, additional filtering (for defence in depth) could be performed, but may not have an indication of what is repo- or preset-config vs global self-hosted config.\n   */\n  requiresCheckAtTrustBoundary?: boolean;\n\n  inheritConfigSupport?: boolean;\n\n  allowedValues?: string[];\n\n  allowString?: boolean;\n\n  cli?: boolean;\n\n  description: string;\n\n  env?: false | string;\n\n  /**\n   * Do not validate object children\n   */\n  freeChoice?: boolean;\n\n  mergeable?: boolean;\n\n  autogenerated?: boolean;\n\n  name: string;\n\n  parents?: AllowedParents[];\n\n  stage?: RenovateConfigStage;\n\n  experimental?: boolean;\n\n  experimentalDescription?: string;\n\n  experimentalIssues?: number[];\n\n  advancedUse?: boolean;\n\n  /**\n   * This is used to add a deprecation message in the docs\n   */\n  deprecationMsg?: string;\n\n  /**\n   * For internal use only: add it to any config option that supports regex or glob matching\n   */\n  patternMatch?: boolean;\n\n  /**\n   * For internal use only: add it to any config option of type integer that supports negative integers\n   */\n  allowNegative?: boolean;\n\n  /**\n   * Managers which support this option, leave undefined if all managers support it.\n   */\n  supportedManagers?: string[];\n\n  /**\n   * Platforms which support this option, leave undefined if all platforms support it.\n   */\n  supportedPlatforms?: PlatformId[];\n\n  /**\n   * Conditions that must be met for this option to be required.\n   */\n  requiredIf?: RenovateRequiredOption[];\n\n  /**\n   * If true, the option's value supports Renovate templating.\n   * @see https://docs.renovatebot.com/templates/\n   */\n  supportsTemplating?: boolean;\n}\n\nexport interface RenovateRequiredOption {\n  siblingProperties: { property: string; value: string }[];\n}\n\nexport interface RenovateArrayOption<\n  T extends string | number | Record<string, unknown> = Record<string, unknown>,\n> extends RenovateOptionBase {\n  default?: T[] | null;\n  mergeable?: boolean;\n  type: 'array';\n  subType?: 'string' | 'object' | 'number';\n}\n\nexport interface RenovateStringArrayOption extends RenovateArrayOption<string> {\n  format?: 'regex';\n  subType: 'string';\n}\n\nexport interface RenovateNumberArrayOption extends RenovateArrayOption<number> {\n  subType: 'number';\n}\n\nexport interface RenovateBooleanOption extends RenovateOptionBase {\n  default?: boolean | null;\n  type: 'boolean';\n}\n\nexport interface RenovateIntegerOption extends RenovateOptionBase {\n  default?: number | null;\n  type: 'integer';\n}\n\nexport interface RenovateStringOption extends RenovateOptionBase {\n  default?: string | null;\n  format?: 'regex';\n\n  // Not used\n  replaceLineReturns?: boolean;\n  type: 'string';\n}\n\nexport interface RenovateObjectOption extends RenovateOptionBase {\n  default?: any;\n  additionalProperties?: Record<string, unknown> | boolean;\n  mergeable?: boolean;\n  type: 'object';\n}\n\nexport type RenovateOptions =\n  | RenovateStringOption\n  | RenovateNumberArrayOption\n  | RenovateStringArrayOption\n  | RenovateIntegerOption\n  | RenovateBooleanOption\n  | RenovateArrayOption\n  | RenovateObjectOption;\n\nexport interface PackageRuleInputConfig extends RenovateConfig {\n  versioning?: string;\n  packageFile?: string;\n  lockFiles?: string[];\n  depType?: string;\n  depTypes?: string[];\n  depName?: string;\n  packageName?: string | null;\n  newValue?: string | null;\n  currentValue?: string | null;\n  currentVersion?: string;\n  lockedVersion?: string;\n  updateType?: UpdateType;\n  mergeConfidenceLevel?: MergeConfidence | undefined;\n  isBump?: boolean;\n  sourceUrl?: string | null;\n  categories?: string[];\n  baseBranch?: string;\n  manager?: string;\n  datasource?: string;\n  packageRules?: (PackageRule & PackageRuleInputConfig)[];\n  releaseTimestamp?: Timestamp | null;\n  repository?: string;\n  currentVersionAgeInDays?: number;\n  currentVersionTimestamp?: string;\n  enabled?: boolean;\n  skipReason?: SkipReason;\n  skipStage?: StageName;\n}\n\nexport interface ConfigMigration {\n  configMigration?: boolean;\n}\n\nexport interface MigratedConfig {\n  /**\n   * Indicates whether there was a migration applied to the configuration.\n   *\n   * @returns\n   * `false` if the configuration does not need migrating, and `migratedConfig` can be ignored\n   * `true` if the configuration was migrated, and if so, `migratedConfig` should be used instead of the provided config\n   */\n  isMigrated: boolean;\n  migratedConfig: RenovateConfig;\n}\n\nexport interface MigratedRenovateConfig extends RenovateConfig {\n  endpoints?: HostRule[];\n  pathRules: PackageRule[];\n  packages: PackageRule[];\n\n  node?: RenovateConfig;\n  travis?: RenovateConfig;\n  gradle?: RenovateConfig;\n}\n\nexport interface ManagerConfig extends RenovateConfig {\n  manager: string;\n  categories?: Category[];\n}\n\nexport interface ValidationResult {\n  errors: ValidationMessage[];\n  warnings: ValidationMessage[];\n}\n\nexport interface BumpVersionConfig {\n  bumpType?: string;\n  filePatterns: string[];\n  matchStrings: string[];\n  name?: string;\n}\n\n/**\n * Global Config for specified `toolSettings` options.\n *\n */\nexport interface GlobalToolSettingsOptions {\n  /** An upper limit on what the Java Virtual Machine's maximum memory can be set to. Repositories can specify <= this value */\n  jvmMaxMemory?: number;\n  /** An upper limit on what the Java Virtual Machine's starting memory can be set to. Repositories can specify <= this value */\n  jvmMemory?: number;\n  /** An upper limit on what the Node.JS process' maximum memory can be set to. Repositories can specify <= this value */\n  nodeMaxMemory?: number;\n}\n\n/**\n * Repository config options for `toolSettings` options.\n */\nexport interface RepoToolSettingsOptions {\n  /** The maximum memory the Java Virtual Machine can use. If greater than the Global Self-Hosted configuration setting, it will be set to that limit **/\n  jvmMaxMemory?: number;\n  /** The starting memory the Java Virtual Machine can use. If greater than the Global Self-Hosted configuration setting, it will be set to that limit **/\n  jvmMemory?: number;\n  /** The maximum memory child Node.JS processes can use. If greater than the Global Self-Hosted configuration setting, it will be set to that limit **/\n  nodeMaxMemory?: number;\n}\n"],"mappings":";AAoVA,MAAa,4BAA4B;CACvC;CACA;CACA;CACA;AACF;AA6MA,MAAa,qBAAqB;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}
+{"version":3,"file":"types.js","names":[],"sources":["../../lib/config/types.ts"],"sourcesContent":["import type { Category, PlatformId } from '../constants/index.ts';\nimport type { LogLevelRemap } from '../logger/types.ts';\nimport type { ManagerName } from '../manager-list.generated.ts';\nimport type { CustomManager } from '../modules/manager/custom/types.ts';\nimport type {\n  GitUrlOption,\n  RepoSortMethod,\n  SortMethod,\n} from '../modules/platform/types.ts';\nimport type {\n  AutoMergeType,\n  HostRule,\n  Nullish,\n  RangeStrategy,\n  SkipReason,\n} from '../types/index.ts';\nimport type { StageName } from '../types/skip-reason.ts';\nimport type {\n  AdditionalConstraintName,\n  ConstraintName,\n  ToolName,\n} from '../util/exec/types.ts';\nimport type { GitNoVerifyOption } from '../util/git/types.ts';\nimport type { MergeConfidence } from '../util/merge-confidence/types.ts';\nimport type { Timestamp } from '../util/timestamp.ts';\nimport type { ConfigValidationTopic } from './validation-helpers/types.ts';\n\nexport type RenovateConfigStage =\n  'global' | 'inherit' | 'repository' | 'package' | 'branch' | 'pr';\n\nexport type RenovateSplit =\n  'init' | 'onboarding' | 'extract' | 'lookup' | 'update';\n\nexport type RepositoryCacheConfig = 'disabled' | 'enabled' | 'reset';\nexport type RepositoryCacheType = 'local' | (string & {});\nexport type DryRunConfig = 'extract' | 'lookup' | 'full';\nexport type InternalHostAccess = 'allow' | 'warn' | 'block';\nexport type RequiredConfig = 'required' | 'optional' | 'ignored';\n\nexport interface GroupConfig extends Record<string, unknown> {\n  branchName?: string;\n  branchTopic?: string;\n}\n\nexport type RecreateWhen = 'auto' | 'never' | 'always';\nexport type StatusCheckWhen = 'always' | 'never' | 'failed';\nexport type PlatformCommitOptions = 'auto' | 'disabled' | 'enabled';\n\nexport type BinarySource = 'docker' | 'global' | 'install' | 'hermit';\n\n// TODO: Proper typings\n/**\n * Any configuration that could be used either top-level in a repository config (or Global, Inherited or Shareable Preset configuration), or:\n *\n * - in a datasource-specific configuration\n * - in a manager-specific configuration\n * - in a Package Rule\n *\n * @see RenovateConfig for the superset of all configuration allowed in a given repository\n *\n */\nexport interface RenovateSharedConfig {\n  $schema?: string;\n  abandonmentThreshold?: Nullish<string>;\n  addLabels?: string[];\n  assignAutomerge?: boolean;\n  autoApprove?: boolean;\n  autoReplaceGlobalMatch?: boolean;\n  automerge?: boolean;\n  automergeSchedule?: string[];\n  automergeStrategy?: MergeStrategy;\n  automergeType?: AutoMergeType;\n  azureWorkItemId?: number;\n  azureWorkItemType?: string;\n  branchName?: string;\n  branchNameStrict?: boolean;\n  branchPrefix?: string;\n  branchPrefixOld?: string;\n  bumpVersions?: BumpVersionConfig[];\n  commitBody?: string;\n  commitBodyTable?: boolean;\n  commitMessage?: string;\n  commitMessageAction?: string;\n  commitMessageExtra?: string;\n  commitMessageLowerCase?: 'auto' | 'never';\n  commitMessagePrefix?: string;\n  commitMessageTopic?: string;\n  commitTrailers?: string[];\n  confidential?: boolean;\n  configValidationError?: boolean;\n  changelogUrl?: string;\n  dependencyDashboardApproval?: boolean;\n  draftPR?: boolean;\n  enabled?: boolean;\n  enabledManagers?: string[];\n  encrypted?: Record<string, string>;\n  extends?: string[];\n  extractVersion?: string;\n  managerFilePatterns?: string[];\n  followTag?: string;\n  force?: RenovateConfig;\n  gitIgnoredAuthors?: string[];\n  group?: GroupConfig;\n  groupName?: string;\n  groupSingleUpdates?: boolean;\n  groupSlug?: string;\n  hashedBranchLength?: number;\n  ignoreDeps?: string[];\n  ignorePaths?: string[];\n  ignoreTests?: boolean;\n  ignoreUnstable?: boolean;\n  includePaths?: string[];\n  internalChecksAsSuccess?: boolean;\n  internalChecksFilter?: 'strict' | 'flexible' | 'none';\n  keepUpdatedLabel?: string;\n  labels?: string[];\n  manager?: string;\n  milestone?: number;\n  minimumReleaseAge?: Nullish<string>;\n  npmrc?: string;\n  npmrcMerge?: boolean;\n  npmToken?: string;\n\n  pinDigests?: boolean;\n  platformAutomerge?: boolean;\n  platformCommit?: PlatformCommitOptions;\n  postUpgradeTasks?: PostUpgradeTasks;\n  prBodyColumns?: string[];\n  prBodyDefinitions?: Record<string, string>;\n  prBodyHeadingDefinitions?: Record<string, string>;\n  prBodyNotes?: string[];\n  prCreation?: 'immediate' | 'not-pending' | 'status-success' | 'approval';\n  prFooter?: string;\n  prHeader?: string;\n  prPriority?: number;\n  prTitle?: string;\n  prTitleStrict?: boolean;\n  pruneBranchAfterAutomerge?: boolean;\n  rangeStrategy?: RangeStrategy;\n  rebaseLabel?: string;\n  rebaseWhen?: string;\n  recreateClosed?: boolean;\n  recreateWhen?: RecreateWhen;\n  repository?: string;\n  repositoryCache?: RepositoryCacheConfig;\n  repositoryCacheType?: RepositoryCacheType;\n  respectLatest?: boolean;\n  rollbackPrs?: boolean;\n  schedule?: string[];\n  semanticCommitScope?: string | null;\n  semanticCommitType?: string;\n  semanticCommits?: 'auto' | 'enabled' | 'disabled';\n  separateMajorMinor?: boolean;\n  separateMinorPatch?: boolean;\n  separateMultipleMajor?: boolean;\n  separateMultipleMinor?: boolean;\n  skipArtifactsUpdate?: boolean;\n  stopUpdatingLabel?: string;\n  suppressNotifications?: string[];\n  timezone?: string;\n  unicodeEmoji?: boolean;\n  updateNotScheduled?: boolean;\n  versioning?: string;\n  versionCompatibility?: string;\n}\n\n/**\n * Contains all options with globalOnly=true && inheritConfigSupport=true\n */\nexport interface GlobalInheritableConfig {\n  bbUseDevelopmentBranch?: boolean;\n  configFileNames?: string[];\n  onboarding?: boolean;\n  onboardingAutoCloseAge?: number;\n  onboardingBranch?: string;\n  onboardingCommitMessage?: string;\n  onboardingConfig?: RenovateConfig;\n  onboardingConfigFileName?: string;\n  onboardingNoDeps?: 'auto' | 'enabled' | 'disabled';\n  onboardingPrTitle?: string;\n  requireConfig?: RequiredConfig;\n}\n\n// Config options used only within the global worker\n// The below should contain config options where stage=global\n/** @deprecated use `RepoGlobalConfig` instead **/\nexport interface GlobalOnlyConfigLegacy {\n  autodiscover?: boolean;\n  autodiscoverFilter?: string[] | string;\n  autodiscoverNamespaces?: string[];\n  autodiscoverProjects?: string[];\n  autodiscoverTopics?: string[];\n  baseDir?: string;\n  cacheDir?: string;\n  containerbaseDir?: string;\n  detectHostRulesFromEnv?: boolean;\n  dockerCliOptions?: string;\n  endpoint?: string;\n  exitCodeForErrors?: boolean;\n  forceCli?: boolean;\n  gitNoVerify?: GitNoVerifyOption[];\n  gitPrivateKey?: string;\n  gitPrivateKeyPassphrase?: string;\n  globalExtends?: string[];\n  mergeConfidenceDatasources?: string[];\n  mergeConfidenceEndpoint?: string;\n  platform?: PlatformId;\n  processEnv?: Record<string, string>;\n  prCommitsPerRunLimit?: number;\n  privateKey?: string;\n  privateKeyOld?: string;\n  privateKeyPath?: string;\n  privateKeyPathOld?: string;\n  redisPrefix?: string;\n  redisUrl?: string;\n  repositories?: RenovateRepository[];\n  useCloudMetadataServices?: boolean;\n  deleteConfigFile?: boolean;\n  deleteAdditionalConfigFile?: boolean;\n}\n\n/**\n * Any global-only configuration set by self-hosted administrators.\n *\n * Used within the repository worker.\n *\n * Should only contain config options where globalOnly=true.\n */\nexport interface RepoGlobalConfig extends GlobalInheritableConfig {\n  allowedCommands?: string[];\n  allowCustomCrateRegistries?: boolean;\n  allowPlugins?: boolean;\n  allowScripts?: boolean;\n  allowShellExecutorForPostUpgradeCommands?: boolean;\n  allowedEnv?: string[];\n  allowedHeaders?: string[];\n  binarySource?: BinarySource;\n  cacheDir?: string;\n  cacheHardTtlMinutes?: number;\n  cacheTtlOverride?: Record<string, number>;\n  checkedBranches?: string[];\n  containerbaseDir?: string;\n  customEnvVariables?: Record<string, string>;\n  dockerChildPrefix?: string;\n  dockerCliOptions?: string;\n  dockerSidecarImage?: string;\n  dockerUser?: string;\n  dryRun?: DryRunConfig;\n  encryptedWarning?: string;\n  endpoint?: string;\n  executionTimeout?: number;\n  exposeAllEnv?: boolean;\n  gitTimeout?: number;\n  githubTokenWarn?: boolean;\n  includeMirrors?: boolean;\n  inheritConfigTrusted?: boolean;\n  internalHostAccess?: InternalHostAccess;\n  migratePresets?: Record<string, string>;\n  platform?: PlatformId;\n  prCacheSyncMaxPages?: number;\n  presetCachePersistence?: boolean;\n  httpCacheTtlDays?: number;\n  autodiscoverRepoSort?: RepoSortMethod;\n  autodiscoverRepoOrder?: SortMethod;\n  userAgent?: string;\n  dockerMaxPages?: number;\n  s3Endpoint?: string;\n  s3PathStyle?: boolean;\n  cachePrivatePackages?: boolean;\n  repositoryCacheForceLocal?: boolean;\n  configFileNames?: string[];\n  ignorePrAuthor?: boolean;\n  allowedUnsafeExecutions?: AllowedUnsafeExecution[];\n  onboardingAutoCloseAge?: number;\n  productLinks?: Record<string, string>;\n  rebaseAllOpenBranches?: boolean;\n  toolSettings?: GlobalToolSettingsOptions;\n}\n\n/**\n * Internal variables which are referenced from `GlobalConfig`, but are *not* user-configurable options.\n */\nexport interface InternalGlobalConfigOptions {\n  localDir?: string;\n}\n\n/**\n * Those options are global only but still passed into the repository worker config.\n *\n * @deprecated https://github.com/renovatebot/renovate/issues/39693\n */\nexport interface LegacyAdminConfig {\n  baseDir?: string;\n  localDir?: string;\n\n  logContext?: string;\n\n  onboarding?: boolean;\n  onboardingBranch?: string;\n  onboardingNoDeps?: 'auto' | 'enabled' | 'disabled';\n  onboardingRebaseCheckbox?: boolean;\n  onboardingConfig?: RenovateConfig;\n  onboardingConfigFileName?: string;\n\n  optimizeForDisabled?: boolean;\n\n  persistRepoData?: boolean;\n\n  prCommitsPerRunLimit?: number;\n\n  requireConfig?: RequiredConfig;\n\n  useCloudMetadataServices?: boolean;\n\n  writeDiscoveredRepos?: string;\n}\n\nexport type ExecutionMode = 'branch' | 'update';\n\nexport interface PostUpgradeTasks {\n  commands?: string[];\n  workingDirTemplate?: string;\n  dataFileTemplate?: string;\n  fileFilters?: string[];\n  executionMode: ExecutionMode;\n  installTools?: Partial<Record<ToolName, Record<never, never>>>;\n}\n\nexport type UpdateConfig<\n  T extends RenovateSharedConfig = RenovateSharedConfig,\n> = Partial<Record<UpdateType, T | null>>;\n\nexport type RenovateRepositoryEntry = AllConfig & {\n  repository: string;\n};\n\nexport type RenovateRepository = string | RenovateRepositoryEntry;\n\nexport type UseBaseBranchConfigType = 'merge' | 'none';\nexport type ConstraintsFilter = 'strict' | 'none';\nexport type MinimumReleaseAgeBehaviour =\n  'timestamp-required' | 'timestamp-optional';\n\nexport const allowedStatusCheckStrings = [\n  'minimumReleaseAge',\n  'mergeConfidence',\n  'configValidation',\n  'artifactError',\n] as const;\nexport type StatusCheckKey = (typeof allowedStatusCheckStrings)[number];\ntype UserEnv = Record<string, string>;\n\n/**\n * Computed properties, for internal use only\n */\nexport interface RenovateInternalConfig {\n  /** computed base branch from patterns - for internal use only */\n  baseBranches?: string[];\n  currentCompatibility?: string;\n  datasource?: string;\n  hasBaseBranches?: boolean;\n  isFork?: boolean;\n  isVulnerabilityAlert?: boolean;\n\n  /** What is this used for? */\n  remediations?: unknown;\n  /** What is this used for? */\n  vulnerabilityAlertsOnly?: boolean;\n}\n\n// TODO: Proper typings\n/**\n * Configuration that could be used either top-level in a repository config (or Global, Inherited or Shareable Preset configuration).\n *\n * This is a superset of any configuration that a Renovate user (not self-hosted administrator) can set.\n */\nexport interface RenovateConfig\n  extends\n    LegacyAdminConfig,\n    RenovateSharedConfig,\n    UpdateConfig<PackageRule>,\n    AssigneesAndReviewersConfig,\n    ConfigMigration,\n    RenovateInternalConfig {\n  s3Endpoint?: string;\n  s3PathStyle?: boolean;\n  reportFormatting?: boolean;\n  reportPath?: string;\n  reportType?: 'logging' | 'file' | 's3' | null;\n  depName?: string;\n  /** user configurable base branch patterns*/\n  baseBranchPatterns?: string[];\n  useBaseBranchConfig?: UseBaseBranchConfigType;\n  baseBranch?: string;\n  defaultBranch?: string;\n  branchList?: string[];\n  cloneSubmodules?: boolean;\n  cloneSubmodulesFilter?: string[];\n  description?: string | string[];\n  overrideDescription?: string | string[];\n  detectGlobalManagerConfig?: boolean;\n  errors?: ValidationMessage[];\n  forkModeDisallowMaintainerEdits?: boolean;\n  forkProcessing?: 'auto' | 'enabled' | 'disabled';\n  forkToken?: string;\n\n  gitAuthor?: string;\n\n  hostRules?: HostRule[];\n\n  inheritConfig?: boolean;\n  inheritConfigFileName?: string;\n  inheritConfigRepoName?: string;\n  inheritConfigStrict?: boolean;\n\n  ignorePresets?: string[];\n\n  fileList?: string[];\n  configWarningReuseIssue?: boolean;\n  dependencyDashboard?: boolean;\n  dependencyDashboardAutoclose?: boolean;\n  dependencyDashboardChecks?: Record<string, string>;\n  dependencyDashboardIssue?: number;\n  dependencyDashboardTitle?: string;\n  dependencyDashboardHeader?: string;\n  dependencyDashboardFooter?: string;\n  dependencyDashboardLabels?: string[];\n  dependencyDashboardOSVVulnerabilitySummary?: 'none' | 'all' | 'unresolved';\n  dependencyDashboardReportAbandonment?: boolean;\n  mode?: 'silent' | 'full';\n  packageFile?: string;\n  packageRules?: PackageRule[];\n  postUpdateOptions?: string[];\n  branchConcurrentLimit?: number | null;\n  parentOrg?: string;\n  prConcurrentLimit?: number;\n  commitHourlyLimit?: number;\n  prHourlyLimit?: number;\n\n  printConfig?: boolean;\n\n  pruneStaleBranches?: boolean;\n\n  defaultRegistryUrls?: string[];\n  registryUrls?: string[] | null;\n  registryAliases?: Record<string, string>;\n\n  /**\n   * What is this used for?\n   * @deprecated\n   */\n  renovateJsonPresent?: boolean;\n\n  repoIsOnboarded?: boolean;\n  repoIsActivated?: boolean;\n\n  topLevelOrg?: string;\n  updateInternalDeps?: boolean;\n  updateType?: UpdateType;\n\n  warnings?: ValidationMessage[];\n  vulnerabilityAlerts?: RenovateSharedConfig;\n  osvVulnerabilityAlerts?: boolean;\n  vulnerabilitySeverity?: string;\n  customManagers?: CustomManager[];\n  customDatasources?: Record<string, CustomDatasourceConfig>;\n\n  fetchChangeLogs?: FetchChangeLogsOptions;\n  secrets?: Record<string, string>;\n  variables?: Record<string, string>;\n\n  constraints?: Partial<Record<ConstraintName, string>>;\n  /**\n   * Any specific overrides for the versioning for the `AdditionalConstraintName`s.\n   */\n  constraintsVersioning?: Partial<Record<AdditionalConstraintName, string>>;\n  skipInstalls?: boolean | null;\n\n  constraintsFiltering?: ConstraintsFilter;\n\n  customizeDashboard?: Record<string, string>;\n\n  statusCheckNames?: Record<StatusCheckKey, string | null>;\n  statusCheckWhen?: Partial<Record<StatusCheckKey, StatusCheckWhen>>;\n  /**\n   * User configured environment variables that Renovate uses when executing package manager commands\n   */\n  env?: UserEnv;\n  logLevelRemap?: LogLevelRemap[];\n\n  branchTopic?: string;\n  additionalBranchPrefix?: string;\n  sharedVariableName?: string;\n  minimumGroupSize?: number;\n  configFileNames?: string[];\n  minimumReleaseAgeBehaviour?: MinimumReleaseAgeBehaviour;\n  toolSettings?: RepoToolSettingsOptions;\n}\n\nconst CustomDatasourceFormats = [\n  'html',\n  'json',\n  'plain',\n  'toml',\n  'yaml',\n] as const;\nexport type CustomDatasourceFormats = (typeof CustomDatasourceFormats)[number];\n\nexport interface CustomDatasourceConfig {\n  defaultRegistryUrlTemplate?: string;\n  format?: CustomDatasourceFormats;\n  transformTemplates?: string[];\n}\n\n/**\n * The superset of all configuration that a self-hosted administrator can set, alongside all repository-level configuration.\n *\n */\nexport interface AllConfig\n  extends RenovateConfig, GlobalOnlyConfigLegacy, RepoGlobalConfig {\n  gitUrl?: GitUrlOption;\n  password?: string;\n  token?: string;\n  username?: string;\n}\n\nexport interface AssigneesAndReviewersConfig {\n  assigneesFromCodeOwners?: boolean;\n  expandCodeOwnersGroups?: boolean;\n  assignees?: string[];\n  assigneesSampleSize?: number;\n  ignoreReviewers?: string[];\n  reviewersFromCodeOwners?: boolean;\n  reviewers?: string[];\n  reviewersSampleSize?: number;\n  additionalReviewers?: string[];\n  filterUnavailableUsers?: boolean;\n}\n\nexport type UpdateType =\n  | 'major'\n  | 'minor'\n  | 'patch'\n  | 'pin'\n  | 'digest'\n  | 'pinDigest'\n  | 'lockFileMaintenance'\n  | 'lockfileUpdate'\n  | 'rollback'\n  | 'bump'\n  | 'replacement';\n\n// These are the update types which can have configuration\nexport const UpdateTypesOptions = [\n  'major',\n  'minor',\n  'patch',\n  'pin',\n  'digest',\n  'pinDigest',\n  'lockFileMaintenance',\n  'rollback',\n  'replacement',\n] as const;\n\nexport type UpdateTypeOptions = (typeof UpdateTypesOptions)[number];\n\nexport type FetchChangeLogsOptions = 'off' | 'branch' | 'pr';\n\nexport type MatchStringsStrategy = 'any' | 'recursive' | 'combination';\n\nexport type MergeStrategy =\n  | 'auto'\n  | 'fast-forward'\n  | 'merge-commit'\n  | 'rebase'\n  | 'rebase-merge'\n  | 'squash';\n\n// This list should be added to as any new unsafe execution commands should be permitted\nexport type AllowedUnsafeExecution =\n  'bazelModDeps' | 'goGenerate' | 'gradleWrapper' | 'mise' | 'pixi';\n\n// TODO: Proper typings\nexport interface PackageRule\n  extends RenovateSharedConfig, RenovateInternalConfig, UpdateConfig {\n  allowedVersions?: string;\n  description?: string | string[];\n  matchBaseBranches?: string[];\n  matchCategories?: string[];\n  matchConfidence?: MergeConfidence[];\n  matchCurrentAge?: string;\n  matchCurrentValue?: string;\n  matchCurrentVersion?: string;\n  matchDatasources?: string[];\n  matchDepNames?: string[];\n  matchDepTypes?: string[];\n  matchFileNames?: string[];\n  matchManagers?: string[];\n  matchNewValue?: string;\n  matchPackageNames?: string[];\n  matchRepositories?: string[];\n  matchSourceUrls?: string[];\n  matchRegistryUrls?: string[];\n  matchUpdateTypes?: UpdateType[];\n  matchJsonata?: string[];\n  overrideDatasource?: string;\n  overrideDepName?: string;\n  overridePackageName?: string;\n  registryUrls?: string[] | null;\n  replacementName?: string;\n  replacementVersion?: string;\n  sourceUrl?: string;\n  sourceDirectory?: string;\n  vulnerabilitySeverity?: string;\n  vulnerabilityFixVersion?: string;\n}\n\nexport interface ValidationMessage {\n  // Topic is either the known list of topics, or a dynamically generated one\n  topic: ConfigValidationTopic | (string & {});\n  message: string;\n}\n\nexport type AllowedParents =\n  | '.'\n  | 'bumpVersions'\n  | 'customDatasources'\n  | 'customManagers'\n  | 'hostRules'\n  | 'logLevelRemap'\n  | 'packageRules'\n  | 'postUpgradeTasks'\n  | 'vulnerabilityAlerts'\n  | 'toolSettings'\n  | ManagerName\n  | UpdateTypeOptions;\nexport interface RenovateOptionBase {\n  /**\n   * If true, the option can only be configured by people with access to the Renovate instance.\n   * Furthermore, the option should be documented in docs/usage/self-hosted-configuration.md.\n   */\n  globalOnly?: boolean;\n\n  /**\n   * If true, this option **MUST** be checked at the trust boundary: after resolving the full config that sets it, but **before** the value is applied.\n   *\n   * This is in addition to any existing config validation, and ensures that these options are re-validated due to their sensitive nature.\n   *\n   * A failure of that check **must** lead to a {@link ConfigValidationTopic.Security} error (which is then a full config validation error), stopping the Renovate run.\n   *\n   * After this check has been performed, additional filtering (for defence in depth) could be performed, but may not have an indication of what is repo- or preset-config vs global self-hosted config.\n   */\n  requiresCheckAtTrustBoundary?: boolean;\n\n  inheritConfigSupport?: boolean;\n\n  allowedValues?: string[];\n\n  allowString?: boolean;\n\n  cli?: boolean;\n\n  description: string;\n\n  env?: false | string;\n\n  /**\n   * Do not validate object children\n   */\n  freeChoice?: boolean;\n\n  mergeable?: boolean;\n\n  autogenerated?: boolean;\n\n  name: string;\n\n  parents?: AllowedParents[];\n\n  stage?: RenovateConfigStage;\n\n  experimental?: boolean;\n\n  experimentalDescription?: string;\n\n  experimentalIssues?: number[];\n\n  advancedUse?: boolean;\n\n  /**\n   * This is used to add a deprecation message in the docs\n   */\n  deprecationMsg?: string;\n\n  /**\n   * For internal use only: add it to any config option that supports regex or glob matching\n   */\n  patternMatch?: boolean;\n\n  /**\n   * For internal use only: add it to any config option of type integer that supports negative integers\n   */\n  allowNegative?: boolean;\n\n  /**\n   * Managers which support this option, leave undefined if all managers support it.\n   */\n  supportedManagers?: string[];\n\n  /**\n   * Platforms which support this option, leave undefined if all platforms support it.\n   */\n  supportedPlatforms?: PlatformId[];\n\n  /**\n   * Conditions that must be met for this option to be required.\n   */\n  requiredIf?: RenovateRequiredOption[];\n\n  /**\n   * If true, the option's value supports Renovate templating.\n   * @see https://docs.renovatebot.com/templates/\n   */\n  supportsTemplating?: boolean;\n}\n\nexport interface RenovateRequiredOption {\n  siblingProperties: { property: string; value: string }[];\n}\n\nexport interface RenovateArrayOption<\n  T extends string | number | Record<string, unknown> = Record<string, unknown>,\n> extends RenovateOptionBase {\n  default?: T[] | null;\n  mergeable?: boolean;\n  type: 'array';\n  subType?: 'string' | 'object' | 'number';\n}\n\nexport interface RenovateStringArrayOption extends RenovateArrayOption<string> {\n  format?: 'regex';\n  subType: 'string';\n}\n\nexport interface RenovateNumberArrayOption extends RenovateArrayOption<number> {\n  subType: 'number';\n}\n\nexport interface RenovateBooleanOption extends RenovateOptionBase {\n  default?: boolean | null;\n  type: 'boolean';\n}\n\nexport interface RenovateIntegerOption extends RenovateOptionBase {\n  default?: number | null;\n  type: 'integer';\n}\n\nexport interface RenovateStringOption extends RenovateOptionBase {\n  default?: string | null;\n  format?: 'regex';\n\n  // Not used\n  replaceLineReturns?: boolean;\n  type: 'string';\n}\n\nexport interface RenovateObjectOption extends RenovateOptionBase {\n  default?: any;\n  additionalProperties?: Record<string, unknown> | boolean;\n  mergeable?: boolean;\n  type: 'object';\n}\n\nexport type RenovateOptions =\n  | RenovateStringOption\n  | RenovateNumberArrayOption\n  | RenovateStringArrayOption\n  | RenovateIntegerOption\n  | RenovateBooleanOption\n  | RenovateArrayOption\n  | RenovateObjectOption;\n\nexport interface PackageRuleInputConfig extends RenovateConfig {\n  versioning?: string;\n  packageFile?: string;\n  lockFiles?: string[];\n  depType?: string;\n  depTypes?: string[];\n  depName?: string;\n  packageName?: string | null;\n  newValue?: string | null;\n  currentValue?: string | null;\n  currentVersion?: string;\n  lockedVersion?: string;\n  updateType?: UpdateType;\n  mergeConfidenceLevel?: MergeConfidence | undefined;\n  isBump?: boolean;\n  sourceUrl?: string | null;\n  categories?: string[];\n  baseBranch?: string;\n  manager?: string;\n  datasource?: string;\n  packageRules?: (PackageRule & PackageRuleInputConfig)[];\n  releaseTimestamp?: Timestamp | null;\n  repository?: string;\n  currentVersionAgeInDays?: number;\n  currentVersionTimestamp?: string;\n  enabled?: boolean;\n  skipReason?: SkipReason;\n  skipStage?: StageName;\n}\n\nexport interface ConfigMigration {\n  configMigration?: boolean;\n}\n\nexport interface MigratedConfig {\n  /**\n   * Indicates whether there was a migration applied to the configuration.\n   *\n   * @returns\n   * `false` if the configuration does not need migrating, and `migratedConfig` can be ignored\n   * `true` if the configuration was migrated, and if so, `migratedConfig` should be used instead of the provided config\n   */\n  isMigrated: boolean;\n  migratedConfig: RenovateConfig;\n}\n\nexport interface MigratedRenovateConfig extends RenovateConfig {\n  endpoints?: HostRule[];\n  pathRules: PackageRule[];\n  packages: PackageRule[];\n\n  node?: RenovateConfig;\n  travis?: RenovateConfig;\n  gradle?: RenovateConfig;\n}\n\nexport interface ManagerConfig extends RenovateConfig {\n  manager: string;\n  categories?: Category[];\n}\n\nexport interface ValidationResult {\n  errors: ValidationMessage[];\n  warnings: ValidationMessage[];\n}\n\nexport interface BumpVersionConfig {\n  bumpType?: string;\n  filePatterns: string[];\n  matchStrings: string[];\n  name?: string;\n}\n\n/**\n * Global Config for specified `toolSettings` options.\n *\n */\nexport interface GlobalToolSettingsOptions {\n  /** An upper limit on what the Java Virtual Machine's maximum memory can be set to. Repositories can specify <= this value */\n  jvmMaxMemory?: number;\n  /** An upper limit on what the Java Virtual Machine's starting memory can be set to. Repositories can specify <= this value */\n  jvmMemory?: number;\n  /** An upper limit on what the Node.JS process' maximum memory can be set to. Repositories can specify <= this value */\n  nodeMaxMemory?: number;\n}\n\n/**\n * Repository config options for `toolSettings` options.\n */\nexport interface RepoToolSettingsOptions {\n  /** The maximum memory the Java Virtual Machine can use. If greater than the Global Self-Hosted configuration setting, it will be set to that limit **/\n  jvmMaxMemory?: number;\n  /** The starting memory the Java Virtual Machine can use. If greater than the Global Self-Hosted configuration setting, it will be set to that limit **/\n  jvmMemory?: number;\n  /** The maximum memory child Node.JS processes can use. If greater than the Global Self-Hosted configuration setting, it will be set to that limit **/\n  nodeMaxMemory?: number;\n}\n"],"mappings":";AAuVA,MAAa,4BAA4B;CACvC;CACA;CACA;CACA;AACF;AA6MA,MAAa,qBAAqB;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}

package/dist/config/validation.js

@@ -143,6 +143,20 @@ function stripRelativePresetsFromValue(value) {
 	}
 	return stripped;
 }
+/**
+* Whether a `hostRules` `allowInternal` is honored from this kind of config.
+*
+* Only the self-hosted administrator's own configuration may grant access to internal hosts. The inherited config repository belongs to the organization rather than to them, so its rules only count where the administrator has opted into trusting them with `inheritConfigTrusted`.
+*/
+function mayGrantInternalHostAccess(configType) {
+	if (configType === "global") return true;
+	if (configType === "inherit") return GlobalConfig.get("inheritConfigTrusted");
+	return false;
+}
+function allowInternalNotAllowedMessage(configType) {
+	if (configType === "inherit") return "hostRules `allowInternal` is not allowed in inherited config, as this Renovate instance has not set `inheritConfigTrusted=true`. The administrator can either set it, or move the rule to their global config or a `repositories[]` entry.";
+	return `hostRules \`allowInternal\` is only allowed in the self-hosted administrator's own configuration.`;
+}
 async function validateConfig(configType, config, isPreset, parentPath) {
 	return instrument(`validateConfig(${configType}, ${JSON.stringify(parentPath)})`, async () => {
 		initOptions();
@@ -612,6 +626,10 @@ async function validateConfig(configType, config, isPreset, parentPath) {
 						topic: ConfigValidationTopic.Error,
 						message: "Invalid value for hostRules matchHost. It cannot be an empty string."
 					});
+					if (!isUndefined(rule.allowInternal) && !mayGrantInternalHostAccess(configType)) errors.push({
+						topic: parentPath ? ConfigValidationTopic.Error : ConfigValidationTopic.Security,
+						message: allowInternalNotAllowedMessage(configType)
+					});
 					if (!rule.headers) continue;
 					for (const [header, value] of Object.entries(rule.headers)) {
 						if (!isString(value)) errors.push({