renovate 44.85.1 → 44.86.0

package/dist/modules/manager/kustomize/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/kustomize/artifacts.ts"],"sourcesContent":["import { isNonEmptyString, isNullOrUndefined } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ToolConstraint } from '../../../util/exec/types.ts';\nimport {\n  deleteLocalFile,\n  getSiblingFileName,\n  localPathExists,\n  readLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport { DockerDatasource } from '../../datasource/docker/index.ts';\nimport { HelmDatasource } from '../../datasource/helm/index.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { generateHelmEnvs } from './common.ts';\nimport { parseKustomize } from './extract.ts';\n\nasync function localExistingChartPath(\n  chartHome: string,\n  dependencyName: string,\n  version?: string,\n): Promise<string | null> {\n  const folderName = `${dependencyName}-${version}`;\n  const path = upath.join(chartHome, folderName);\n  const pathExists = await localPathExists(path);\n\n  return pathExists ? path : null;\n}\n\nfunction helmRepositoryArgs(\n  repository: string,\n  depName: string,\n  datasource?: string,\n): string {\n  switch (datasource) {\n    case HelmDatasource.id:\n      return `--repo ${quote(repository)} ${quote(depName)}`;\n    case DockerDatasource.id:\n      return quote(`oci://${repository}`);\n    /* v8 ignore next: should never happen */\n    default:\n      throw new Error(`Unknown datasource: ${datasource}`);\n  }\n}\n\nasync function inflateHelmChart(\n  flagEnabled: boolean,\n  execOptions: ExecOptions,\n  chartHome: string,\n  depName: string,\n  repository: string,\n  currentVersion: string,\n  newVersion?: string,\n  datasource?: string,\n): Promise<void> {\n  const currentChartExistingPath = await localExistingChartPath(\n    chartHome,\n    depName,\n    currentVersion,\n  );\n\n  if (!flagEnabled && isNullOrUndefined(currentChartExistingPath)) {\n    logger.debug(\n      `Not inflating Helm chart for ${depName} as kustomizeInflateHelmCharts is not enabled and the current version isn't inflated`,\n    );\n    return;\n  }\n\n  if (\n    isNonEmptyString(currentChartExistingPath) &&\n    isNonEmptyString(newVersion)\n  ) {\n    logger.debug(`Deleting previous helm chart: ${currentChartExistingPath}`);\n    await deleteLocalFile(currentChartExistingPath);\n  }\n\n  const versionToPull = newVersion ?? currentVersion;\n  const versionToPullExistingPath = await localExistingChartPath(\n    chartHome,\n    depName,\n    versionToPull,\n  );\n\n  if (isNonEmptyString(versionToPullExistingPath)) {\n    logger.debug(\n      `Helm chart ${depName} version ${versionToPull} already exists at ${versionToPullExistingPath}`,\n    );\n    return;\n  }\n\n  const folderName = `${depName}-${versionToPull}`;\n  const untarDir = upath.join(chartHome, folderName);\n  logger.debug(\n    `Pulling helm chart ${depName} version ${versionToPull} to ${untarDir}`,\n  );\n\n  const cmd =\n    `helm pull --untar --untardir ${quote(untarDir)} ` +\n    `--version ${quote(versionToPull)} ${helmRepositoryArgs(repository, depName, datasource)}`;\n\n  await exec(cmd, execOptions);\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`kustomize.updateArtifacts(${packageFileName})`);\n  const project = parseKustomize(newPackageFileContent);\n  const isUpdateOptionInflateChartArchives =\n    config.postUpdateOptions?.includes('kustomizeInflateHelmCharts') === true;\n  if (isNullOrUndefined(project)) {\n    return [\n      {\n        artifactError: {\n          stderr: 'Failed to parse new package file content',\n        },\n      },\n    ];\n  }\n\n  const chartHome = getSiblingFileName(\n    packageFileName,\n    project.helmGlobals?.chartHome ?? 'charts',\n  );\n\n  try {\n    const helmToolConstraint: ToolConstraint = {\n      toolName: 'helm',\n      constraint: config.constraints?.helm,\n    };\n\n    const execOptions: ExecOptions = {\n      docker: {},\n      extraEnv: generateHelmEnvs(config),\n      toolConstraints: [helmToolConstraint],\n    };\n\n    for (const dependency of updatedDeps) {\n      if (!dependency.currentVersion) {\n        continue;\n      }\n\n      if (dependency.newVersion === dependency.currentVersion) {\n        continue;\n      }\n\n      if (!isNonEmptyString(dependency.depName)) {\n        continue;\n      }\n\n      if (dependency.depType !== 'HelmChart') {\n        continue;\n      }\n\n      let repository = null;\n\n      switch (dependency.datasource) {\n        case HelmDatasource.id:\n          repository = dependency.registryUrls?.[0];\n          break;\n        case DockerDatasource.id:\n          repository = dependency.packageName;\n          break;\n      }\n\n      if (isNullOrUndefined(repository)) {\n        continue;\n      }\n\n      await inflateHelmChart(\n        isUpdateOptionInflateChartArchives,\n        execOptions,\n        chartHome,\n        dependency.depName,\n        repository,\n        dependency.currentVersion,\n        dependency.newVersion,\n        dependency.datasource,\n      );\n    }\n\n    const status = await getRepoStatus();\n    const chartsAddition = coerceArray(status?.not_added);\n    const chartsDeletion = coerceArray(status?.deleted);\n\n    const fileChanges: UpdateArtifactsResult[] = [];\n\n    for (const file of chartsAddition) {\n      // only add artifacts in the chartHome path\n      if (!file.startsWith(chartHome)) {\n        continue;\n      }\n      fileChanges.push({\n        file: {\n          type: 'addition',\n          path: file,\n          contents: await readLocalFile(file),\n        },\n      });\n    }\n\n    for (const file of chartsDeletion) {\n      // only add artifacts in the chartHome path\n      if (!file.startsWith(chartHome)) {\n        continue;\n      }\n      fileChanges.push({\n        file: {\n          type: 'deletion',\n          path: file,\n        },\n      });\n    }\n\n    return fileChanges.length > 0 ? fileChanges : null;\n  } catch (err) {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, 'Failed to inflate helm chart');\n    return [\n      {\n        artifactError: {\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAqBA,eAAe,uBACb,WACA,gBACA,SACwB;CACxB,MAAM,aAAa,GAAG,eAAe,GAAG;CACxC,MAAM,OAAO,MAAM,KAAK,WAAW,UAAU;CAG7C,OAAO,MAFkB,gBAAgB,IAAI,IAEzB,OAAO;AAC7B;AAEA,SAAS,mBACP,YACA,SACA,YACQ;CACR,QAAQ,YAAR;EACE,KAAK,eAAe,IAClB,OAAO,UAAU,MAAM,UAAU,EAAE,GAAG,MAAM,OAAO;EACrD,KAAK,iBAAiB,IACpB,OAAO,MAAM,SAAS,YAAY;;EAEpC,SACE,MAAM,IAAI,MAAM,uBAAuB,YAAY;CACvD;AACF;AAEA,eAAe,iBACb,aACA,aACA,WACA,SACA,YACA,gBACA,YACA,YACe;CACf,MAAM,2BAA2B,MAAM,uBACrC,WACA,SACA,cACF;CAEA,IAAI,CAAC,eAAe,kBAAkB,wBAAwB,GAAG;EAC/D,OAAO,MACL,gCAAgC,QAAQ,qFAC1C;EACA;CACF;CAEA,IACE,iBAAiB,wBAAwB,KACzC,iBAAiB,UAAU,GAC3B;EACA,OAAO,MAAM,iCAAiC,0BAA0B;EACxE,MAAM,gBAAgB,wBAAwB;CAChD;CAEA,MAAM,gBAAgB,cAAc;CACpC,MAAM,4BAA4B,MAAM,uBACtC,WACA,SACA,aACF;CAEA,IAAI,iBAAiB,yBAAyB,GAAG;EAC/C,OAAO,MACL,cAAc,QAAQ,WAAW,cAAc,qBAAqB,2BACtE;EACA;CACF;CAEA,MAAM,aAAa,GAAG,QAAQ,GAAG;CACjC,MAAM,WAAW,MAAM,KAAK,WAAW,UAAU;CACjD,OAAO,MACL,sBAAsB,QAAQ,WAAW,cAAc,MAAM,UAC/D;CAEA,MAAM,MACJ,gCAAgC,MAAM,QAAQ,EAAE,aACnC,MAAM,aAAa,EAAE,GAAG,mBAAmB,YAAY,SAAS,UAAU;CAEzF,MAAM,KAAK,KAAK,WAAW;AAC7B;AAEA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,6BAA6B,gBAAgB,EAAE;CAC5D,MAAM,UAAU,eAAe,qBAAqB;CACpD,MAAM,qCACJ,OAAO,mBAAmB,SAAS,4BAA4B,MAAM;CACvE,IAAI,kBAAkB,OAAO,GAC3B,OAAO,CACL,EACE,eAAe,EACb,QAAQ,2CACV,EACF,CACF;CAGF,MAAM,YAAY,mBAChB,iBACA,QAAQ,aAAa,aAAa,QACpC;CAEA,IAAI;EACF,MAAM,qBAAqC;GACzC,UAAU;GACV,YAAY,OAAO,aAAa;EAClC;EAEA,MAAM,cAA2B;GAC/B,QAAQ,CAAC;GACT,UAAU,iBAAiB,MAAM;GACjC,iBAAiB,CAAC,kBAAkB;EACtC;EAEA,KAAK,MAAM,cAAc,aAAa;GACpC,IAAI,CAAC,WAAW,gBACd;GAGF,IAAI,WAAW,eAAe,WAAW,gBACvC;GAGF,IAAI,CAAC,iBAAiB,WAAW,OAAO,GACtC;GAGF,IAAI,WAAW,YAAY,aACzB;GAGF,IAAI,aAAa;GAEjB,QAAQ,WAAW,YAAnB;IACE,KAAK,eAAe;KAClB,aAAa,WAAW,eAAe;KACvC;IACF,KAAK,iBAAiB,IACpB,aAAa,WAAW;GAE5B;GAEA,IAAI,kBAAkB,UAAU,GAC9B;GAGF,MAAM,iBACJ,oCACA,aACA,WACA,WAAW,SACX,YACA,WAAW,gBACX,WAAW,YACX,WAAW,UACb;EACF;EAEA,MAAM,SAAS,MAAM,cAAc;EACnC,MAAM,iBAAiB,YAAY,QAAQ,SAAS;EACpD,MAAM,iBAAiB,YAAY,QAAQ,OAAO;EAElD,MAAM,cAAuC,CAAC;EAE9C,KAAK,MAAM,QAAQ,gBAAgB;GAEjC,IAAI,CAAC,KAAK,WAAW,SAAS,GAC5B;GAEF,YAAY,KAAK,EACf,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU,MAAM,cAAc,IAAI;GACpC,EACF,CAAC;EACH;EAEA,KAAK,MAAM,QAAQ,gBAAgB;GAEjC,IAAI,CAAC,KAAK,WAAW,SAAS,GAC5B;GAEF,YAAY,KAAK,EACf,MAAM;IACJ,MAAM;IACN,MAAM;GACR,EACF,CAAC;EACH;EAEA,OAAO,YAAY,SAAS,IAAI,cAAc;CAChD,SAAS,KAAK;EACZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,8BAA8B;EACpD,OAAO,CACL,EACE,eAAe,EACb,QAAQ,IAAI,QACd,EACF,CACF;CACF;AACF"}
+{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/kustomize/artifacts.ts"],"sourcesContent":["import { isNonEmptyString, isNullOrUndefined } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ToolConstraint } from '../../../util/exec/types.ts';\nimport {\n  deleteLocalFile,\n  getSiblingFileName,\n  localPathExists,\n  readLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport { DockerDatasource } from '../../datasource/docker/index.ts';\nimport { HelmDatasource } from '../../datasource/helm/index.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\nimport { generateHelmEnvs } from './common.ts';\nimport { parseKustomize } from './extract.ts';\n\nasync function localExistingChartPath(\n  chartHome: string,\n  dependencyName: string,\n  version?: string,\n): Promise<string | null> {\n  const folderName = `${dependencyName}-${version}`;\n  const path = upath.join(chartHome, folderName);\n  const pathExists = await localPathExists(path);\n\n  return pathExists ? path : null;\n}\n\nfunction helmRepositoryArgs(\n  repository: string,\n  depName: string,\n  datasource?: string,\n): string {\n  switch (datasource) {\n    case HelmDatasource.id:\n      return `--repo ${quote(repository)} ${quote(depName)}`;\n    case DockerDatasource.id:\n      return quote(`oci://${repository}`);\n    /* v8 ignore next: should never happen */\n    default:\n      throw new Error(`Unknown datasource: ${datasource}`);\n  }\n}\n\nasync function inflateHelmChart(\n  flagEnabled: boolean,\n  execOptions: ExecOptions,\n  chartHome: string,\n  depName: string,\n  repository: string,\n  currentVersion: string,\n  newVersion?: string,\n  datasource?: string,\n): Promise<void> {\n  const currentChartExistingPath = await localExistingChartPath(\n    chartHome,\n    depName,\n    currentVersion,\n  );\n\n  if (!flagEnabled && isNullOrUndefined(currentChartExistingPath)) {\n    logger.debug(\n      `Not inflating Helm chart for ${depName} as kustomizeInflateHelmCharts is not enabled and the current version isn't inflated`,\n    );\n    return;\n  }\n\n  if (\n    isNonEmptyString(currentChartExistingPath) &&\n    isNonEmptyString(newVersion)\n  ) {\n    logger.debug(`Deleting previous helm chart: ${currentChartExistingPath}`);\n    await deleteLocalFile(currentChartExistingPath);\n  }\n\n  const versionToPull = newVersion ?? currentVersion;\n  const versionToPullExistingPath = await localExistingChartPath(\n    chartHome,\n    depName,\n    versionToPull,\n  );\n\n  if (isNonEmptyString(versionToPullExistingPath)) {\n    logger.debug(\n      `Helm chart ${depName} version ${versionToPull} already exists at ${versionToPullExistingPath}`,\n    );\n    return;\n  }\n\n  const folderName = `${depName}-${versionToPull}`;\n  const untarDir = upath.join(chartHome, folderName);\n  logger.debug(\n    `Pulling helm chart ${depName} version ${versionToPull} to ${untarDir}`,\n  );\n\n  const cmd =\n    `helm pull --untar --untardir ${quote(untarDir)} ` +\n    `--version ${quote(versionToPull)} ${helmRepositoryArgs(repository, depName, datasource)}`;\n\n  await exec(cmd, execOptions);\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`kustomize.updateArtifacts(${packageFileName})`);\n  const project = parseKustomize(newPackageFileContent);\n  const isUpdateOptionInflateChartArchives =\n    config.postUpdateOptions?.includes('kustomizeInflateHelmCharts') === true;\n  if (isNullOrUndefined(project)) {\n    return [\n      {\n        artifactError: {\n          stderr: 'Failed to parse new package file content',\n        },\n      },\n    ];\n  }\n\n  const chartHome = getSiblingFileName(\n    packageFileName,\n    project.helmGlobals?.chartHome ?? 'charts',\n  );\n\n  try {\n    const helmConstraint = await resolveToolConstraint(config, 'helm');\n    const helmToolConstraint: ToolConstraint = {\n      toolName: 'helm',\n      constraint: helmConstraint,\n    };\n\n    const execOptions: ExecOptions = {\n      docker: {},\n      extraEnv: generateHelmEnvs(helmConstraint),\n      toolConstraints: [helmToolConstraint],\n    };\n\n    for (const dependency of updatedDeps) {\n      if (!dependency.currentVersion) {\n        continue;\n      }\n\n      if (dependency.newVersion === dependency.currentVersion) {\n        continue;\n      }\n\n      if (!isNonEmptyString(dependency.depName)) {\n        continue;\n      }\n\n      if (dependency.depType !== 'HelmChart') {\n        continue;\n      }\n\n      let repository = null;\n\n      switch (dependency.datasource) {\n        case HelmDatasource.id:\n          repository = dependency.registryUrls?.[0];\n          break;\n        case DockerDatasource.id:\n          repository = dependency.packageName;\n          break;\n      }\n\n      if (isNullOrUndefined(repository)) {\n        continue;\n      }\n\n      await inflateHelmChart(\n        isUpdateOptionInflateChartArchives,\n        execOptions,\n        chartHome,\n        dependency.depName,\n        repository,\n        dependency.currentVersion,\n        dependency.newVersion,\n        dependency.datasource,\n      );\n    }\n\n    const status = await getRepoStatus();\n    const chartsAddition = coerceArray(status?.not_added);\n    const chartsDeletion = coerceArray(status?.deleted);\n\n    const fileChanges: UpdateArtifactsResult[] = [];\n\n    for (const file of chartsAddition) {\n      // only add artifacts in the chartHome path\n      if (!file.startsWith(chartHome)) {\n        continue;\n      }\n      fileChanges.push({\n        file: {\n          type: 'addition',\n          path: file,\n          contents: await readLocalFile(file),\n        },\n      });\n    }\n\n    for (const file of chartsDeletion) {\n      // only add artifacts in the chartHome path\n      if (!file.startsWith(chartHome)) {\n        continue;\n      }\n      fileChanges.push({\n        file: {\n          type: 'deletion',\n          path: file,\n        },\n      });\n    }\n\n    return fileChanges.length > 0 ? fileChanges : null;\n  } catch (err) {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, 'Failed to inflate helm chart');\n    return [\n      {\n        artifactError: {\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAsBA,eAAe,uBACb,WACA,gBACA,SACwB;CACxB,MAAM,aAAa,GAAG,eAAe,GAAG;CACxC,MAAM,OAAO,MAAM,KAAK,WAAW,UAAU;CAG7C,OAAO,MAFkB,gBAAgB,IAAI,IAEzB,OAAO;AAC7B;AAEA,SAAS,mBACP,YACA,SACA,YACQ;CACR,QAAQ,YAAR;EACE,KAAK,eAAe,IAClB,OAAO,UAAU,MAAM,UAAU,EAAE,GAAG,MAAM,OAAO;EACrD,KAAK,iBAAiB,IACpB,OAAO,MAAM,SAAS,YAAY;;EAEpC,SACE,MAAM,IAAI,MAAM,uBAAuB,YAAY;CACvD;AACF;AAEA,eAAe,iBACb,aACA,aACA,WACA,SACA,YACA,gBACA,YACA,YACe;CACf,MAAM,2BAA2B,MAAM,uBACrC,WACA,SACA,cACF;CAEA,IAAI,CAAC,eAAe,kBAAkB,wBAAwB,GAAG;EAC/D,OAAO,MACL,gCAAgC,QAAQ,qFAC1C;EACA;CACF;CAEA,IACE,iBAAiB,wBAAwB,KACzC,iBAAiB,UAAU,GAC3B;EACA,OAAO,MAAM,iCAAiC,0BAA0B;EACxE,MAAM,gBAAgB,wBAAwB;CAChD;CAEA,MAAM,gBAAgB,cAAc;CACpC,MAAM,4BAA4B,MAAM,uBACtC,WACA,SACA,aACF;CAEA,IAAI,iBAAiB,yBAAyB,GAAG;EAC/C,OAAO,MACL,cAAc,QAAQ,WAAW,cAAc,qBAAqB,2BACtE;EACA;CACF;CAEA,MAAM,aAAa,GAAG,QAAQ,GAAG;CACjC,MAAM,WAAW,MAAM,KAAK,WAAW,UAAU;CACjD,OAAO,MACL,sBAAsB,QAAQ,WAAW,cAAc,MAAM,UAC/D;CAEA,MAAM,MACJ,gCAAgC,MAAM,QAAQ,EAAE,aACnC,MAAM,aAAa,EAAE,GAAG,mBAAmB,YAAY,SAAS,UAAU;CAEzF,MAAM,KAAK,KAAK,WAAW;AAC7B;AAEA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,6BAA6B,gBAAgB,EAAE;CAC5D,MAAM,UAAU,eAAe,qBAAqB;CACpD,MAAM,qCACJ,OAAO,mBAAmB,SAAS,4BAA4B,MAAM;CACvE,IAAI,kBAAkB,OAAO,GAC3B,OAAO,CACL,EACE,eAAe,EACb,QAAQ,2CACV,EACF,CACF;CAGF,MAAM,YAAY,mBAChB,iBACA,QAAQ,aAAa,aAAa,QACpC;CAEA,IAAI;EACF,MAAM,iBAAiB,MAAM,sBAAsB,QAAQ,MAAM;EACjE,MAAM,qBAAqC;GACzC,UAAU;GACV,YAAY;EACd;EAEA,MAAM,cAA2B;GAC/B,QAAQ,CAAC;GACT,UAAU,iBAAiB,cAAc;GACzC,iBAAiB,CAAC,kBAAkB;EACtC;EAEA,KAAK,MAAM,cAAc,aAAa;GACpC,IAAI,CAAC,WAAW,gBACd;GAGF,IAAI,WAAW,eAAe,WAAW,gBACvC;GAGF,IAAI,CAAC,iBAAiB,WAAW,OAAO,GACtC;GAGF,IAAI,WAAW,YAAY,aACzB;GAGF,IAAI,aAAa;GAEjB,QAAQ,WAAW,YAAnB;IACE,KAAK,eAAe;KAClB,aAAa,WAAW,eAAe;KACvC;IACF,KAAK,iBAAiB,IACpB,aAAa,WAAW;GAE5B;GAEA,IAAI,kBAAkB,UAAU,GAC9B;GAGF,MAAM,iBACJ,oCACA,aACA,WACA,WAAW,SACX,YACA,WAAW,gBACX,WAAW,YACX,WAAW,UACb;EACF;EAEA,MAAM,SAAS,MAAM,cAAc;EACnC,MAAM,iBAAiB,YAAY,QAAQ,SAAS;EACpD,MAAM,iBAAiB,YAAY,QAAQ,OAAO;EAElD,MAAM,cAAuC,CAAC;EAE9C,KAAK,MAAM,QAAQ,gBAAgB;GAEjC,IAAI,CAAC,KAAK,WAAW,SAAS,GAC5B;GAEF,YAAY,KAAK,EACf,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU,MAAM,cAAc,IAAI;GACpC,EACF,CAAC;EACH;EAEA,KAAK,MAAM,QAAQ,gBAAgB;GAEjC,IAAI,CAAC,KAAK,WAAW,SAAS,GAC5B;GAEF,YAAY,KAAK,EACf,MAAM;IACJ,MAAM;IACN,MAAM;GACR,EACF,CAAC;EACH;EAEA,OAAO,YAAY,SAAS,IAAI,cAAc;CAChD,SAAS,KAAK;EACZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,8BAA8B;EACpD,OAAO,CACL,EACE,eAAe,EACb,QAAQ,IAAI,QACd,EACF,CACF;CACF;AACF"}

package/dist/modules/manager/kustomize/common.js

@@ -2,14 +2,14 @@ import { privateCacheDir } from "../../../util/fs/index.js";
 import upath from "upath";
 import semver from "semver";
 //#region lib/modules/manager/kustomize/common.ts
-function generateHelmEnvs(config) {
+function generateHelmEnvs(helmConstraint) {
 	const cacheDir = privateCacheDir();
 	const envs = {
 		HELM_REGISTRY_CONFIG: upath.join(cacheDir, "registry.json"),
 		HELM_REPOSITORY_CONFIG: upath.join(cacheDir, "repositories.yaml"),
 		HELM_REPOSITORY_CACHE: upath.join(cacheDir, "repositories")
 	};
-	if (config.constraints?.helm && !semver.intersects(config.constraints.helm, ">=3.8.0")) envs.HELM_EXPERIMENTAL_OCI = "1";
+	if (helmConstraint && !semver.intersects(helmConstraint, ">=3.8.0")) envs.HELM_EXPERIMENTAL_OCI = "1";
 	return envs;
 }
 //#endregion

package/dist/modules/manager/kustomize/common.js.map

@@ -1 +1 @@
-{"version":3,"file":"common.js","names":[],"sources":["../../../../lib/modules/manager/kustomize/common.ts"],"sourcesContent":["import semver from 'semver';\nimport upath from 'upath';\nimport type { ExtraEnv } from '../../../util/exec/types.ts';\nimport { privateCacheDir } from '../../../util/fs/index.ts';\nimport type { UpdateArtifactsConfig } from '../types.ts';\n\nexport function generateHelmEnvs(config: UpdateArtifactsConfig): ExtraEnv {\n  const cacheDir = privateCacheDir();\n\n  const envs: ExtraEnv = {\n    // set cache and config files to a path in privateCacheDir to prevent file and credential leakage\n    HELM_REGISTRY_CONFIG: upath.join(cacheDir, 'registry.json'),\n    HELM_REPOSITORY_CONFIG: upath.join(cacheDir, 'repositories.yaml'),\n    HELM_REPOSITORY_CACHE: upath.join(cacheDir, 'repositories'),\n  };\n\n  if (\n    config.constraints?.helm &&\n    !semver.intersects(config.constraints.helm, '>=3.8.0')\n  ) {\n    envs.HELM_EXPERIMENTAL_OCI = '1';\n  }\n\n  return envs;\n}\n"],"mappings":";;;;AAMA,SAAgB,iBAAiB,QAAyC;CACxE,MAAM,WAAW,gBAAgB;CAEjC,MAAM,OAAiB;EAErB,sBAAsB,MAAM,KAAK,UAAU,eAAe;EAC1D,wBAAwB,MAAM,KAAK,UAAU,mBAAmB;EAChE,uBAAuB,MAAM,KAAK,UAAU,cAAc;CAC5D;CAEA,IACE,OAAO,aAAa,QACpB,CAAC,OAAO,WAAW,OAAO,YAAY,MAAM,SAAS,GAErD,KAAK,wBAAwB;CAG/B,OAAO;AACT"}
+{"version":3,"file":"common.js","names":[],"sources":["../../../../lib/modules/manager/kustomize/common.ts"],"sourcesContent":["import semver from 'semver';\nimport upath from 'upath';\nimport type { ExtraEnv } from '../../../util/exec/types.ts';\nimport { privateCacheDir } from '../../../util/fs/index.ts';\n\nexport function generateHelmEnvs(helmConstraint: string | undefined): ExtraEnv {\n  const cacheDir = privateCacheDir();\n\n  const envs: ExtraEnv = {\n    // set cache and config files to a path in privateCacheDir to prevent file and credential leakage\n    HELM_REGISTRY_CONFIG: upath.join(cacheDir, 'registry.json'),\n    HELM_REPOSITORY_CONFIG: upath.join(cacheDir, 'repositories.yaml'),\n    HELM_REPOSITORY_CACHE: upath.join(cacheDir, 'repositories'),\n  };\n\n  if (helmConstraint && !semver.intersects(helmConstraint, '>=3.8.0')) {\n    envs.HELM_EXPERIMENTAL_OCI = '1';\n  }\n\n  return envs;\n}\n"],"mappings":";;;;AAKA,SAAgB,iBAAiB,gBAA8C;CAC7E,MAAM,WAAW,gBAAgB;CAEjC,MAAM,OAAiB;EAErB,sBAAsB,MAAM,KAAK,UAAU,eAAe;EAC1D,wBAAwB,MAAM,KAAK,UAAU,mBAAmB;EAChE,uBAAuB,MAAM,KAAK,UAAU,cAAc;CAC5D;CAEA,IAAI,kBAAkB,CAAC,OAAO,WAAW,gBAAgB,SAAS,GAChE,KAAK,wBAAwB;CAG/B,OAAO;AACT"}

package/dist/modules/manager/maven-wrapper/artifacts.js

@@ -8,6 +8,7 @@ import { withCache } from "../../../util/cache/package/with-cache.js";
 import { Http } from "../../../util/http/index.js";
 import { exec } from "../../../util/exec/index.js";
 import { getRepoStatus } from "../../../util/git/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { isTruthy } from "@sindresorhus/is";
 import { quote } from "shlex";
 import upath from "upath";
@@ -177,7 +178,7 @@ async function executeWrapperCommand(cmd, config, packageFileName, extraEnv) {
 		extraEnv,
 		toolConstraints: [{
 			toolName: "java",
-			constraint: config.constraints?.java ?? getJavaConstraint(config.currentValue)
+			constraint: await resolveToolConstraint(config, "java", () => getJavaConstraint(config.currentValue))
 		}]
 	};
 	try {

package/dist/modules/manager/maven-wrapper/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":["mavenVersioning"],"sources":["../../../../lib/modules/manager/maven-wrapper/artifacts.ts"],"sourcesContent":["import type { Stats } from 'node:fs';\nimport os from 'node:os';\nimport { isTruthy } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { withCache } from '../../../util/cache/package/with-cache.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ExtraEnv } from '../../../util/exec/types.ts';\nimport {\n  chmodLocalFile,\n  deleteLocalFile,\n  readLocalFile,\n  statLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport type { StatusResult } from '../../../util/git/types.ts';\nimport { hashStream } from '../../../util/hash.ts';\nimport { Http } from '../../../util/http/index.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport mavenVersioning from '../../versioning/maven/index.ts';\nimport type {\n  PackageDependency,\n  UpdateArtifact,\n  UpdateArtifactsConfig,\n  UpdateArtifactsResult,\n} from '../types.ts';\n\nconst http = new Http('maven-wrapper');\nconst DEFAULT_MAVEN_REPO_URL = 'https://repo.maven.apache.org/maven2';\n\nfunction getChecksumFromUrl(url: string): Promise<string> {\n  return withCache(\n    {\n      namespace: 'url-sha256',\n      key: url,\n      ttlMinutes: 3 * 24 * 60, // 3 days\n    },\n    () => hashStream(http.stream(url), 'sha256'),\n  );\n}\n\nfunction getDistributionUrl(content: string): string | null {\n  const match = regEx(/^distributionUrl\\s*=\\s*(?<distributionUrl>.+)$/m).exec(\n    content,\n  );\n  return (\n    match?.groups?.distributionUrl?.replace(regEx(/\\\\:/g), ':').trim() ?? null\n  );\n}\n\nfunction getWrapperUrl(content: string): string | null {\n  const match = regEx(/^wrapperUrl\\s*=\\s*(?<wrapperUrl>.+)$/m).exec(content);\n  return match?.groups?.wrapperUrl?.replace(regEx(/\\\\:/g), ':').trim() ?? null;\n}\n\nfunction constructWrapperUrl(\n  version: string,\n  repoUrl: string = DEFAULT_MAVEN_REPO_URL,\n): string {\n  return `${repoUrl}/org/apache/maven/wrapper/maven-wrapper/${version}/maven-wrapper-${version}.jar`;\n}\n\nfunction getWrapperVersion(content: string): string | null {\n  const match = regEx(/^wrapperVersion\\s*=\\s*(?<wrapperVersion>.+)$/m).exec(\n    content,\n  );\n  return match?.groups?.wrapperVersion?.trim() ?? null;\n}\n\nfunction getDistributionType(content: string): string | null {\n  const match = regEx(/^distributionType\\s*=\\s*(?<distributionType>.+)$/m).exec(\n    content,\n  );\n  return match?.groups?.distributionType?.trim() ?? null;\n}\n\nfunction getChecksumValue(content: string, key: string): string | null {\n  const match = regEx(`^${key}\\\\s*=\\\\s*(?<value>.+)$`, 'm').exec(content);\n  return match?.groups?.value?.trim() ?? null;\n}\n\nfunction addChecksumAfterLine(\n  content: string,\n  lineRegex: RegExp,\n  key: string,\n  value: string,\n): string {\n  return content.replace(\n    regEx(lineRegex),\n    (lineMatch) => `${lineMatch}\\n${key}=${value}`,\n  );\n}\n\nasync function updateChecksums(\n  content: string,\n  updatedDeps: PackageDependency[],\n  addDistributionChecksum: boolean,\n  addWrapperChecksum: boolean,\n  originalContent: string,\n): Promise<string> {\n  let updatedContent = content;\n\n  // Update or add distribution checksum\n  if (addDistributionChecksum) {\n    const existingChecksum = getChecksumValue(\n      updatedContent,\n      'distributionSha256Sum',\n    );\n    const fallbackChecksum = getChecksumValue(\n      originalContent,\n      'distributionSha256Sum',\n    );\n    const distUrl = getDistributionUrl(updatedContent);\n    if (distUrl) {\n      try {\n        const checksum = await getChecksumFromUrl(distUrl);\n        if (existingChecksum) {\n          updatedContent = updatedContent.replace(\n            regEx(/distributionSha256Sum=.*/),\n            `distributionSha256Sum=${checksum}`,\n          );\n        } else {\n          // Add checksum after distributionUrl\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:distributionUrl\\s*=\\s*.+)$/m),\n            'distributionSha256Sum',\n            checksum,\n          );\n        }\n      } catch (err) {\n        logger.warn(\n          { err, url: distUrl },\n          'Failed to fetch distribution checksum',\n        );\n        if (!existingChecksum && fallbackChecksum) {\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:distributionUrl\\s*=\\s*.+)$/m),\n            'distributionSha256Sum',\n            fallbackChecksum,\n          );\n        }\n      }\n    }\n  }\n\n  // Update or add wrapper checksum\n  if (addWrapperChecksum) {\n    const existingChecksum = getChecksumValue(\n      updatedContent,\n      'wrapperSha256Sum',\n    );\n    const fallbackChecksum = getChecksumValue(\n      originalContent,\n      'wrapperSha256Sum',\n    );\n    let wrapperUrl = getWrapperUrl(updatedContent);\n\n    // If no wrapperUrl, try to construct from wrapperVersion\n    if (!wrapperUrl) {\n      const wrapperVersion = getWrapperVersion(updatedContent);\n      if (wrapperVersion) {\n        const customRepoUrl = getCustomMavenWrapperRepoUrl(updatedDeps);\n        wrapperUrl = constructWrapperUrl(\n          wrapperVersion,\n          customRepoUrl ?? DEFAULT_MAVEN_REPO_URL,\n        );\n      }\n    }\n\n    if (wrapperUrl) {\n      try {\n        const checksum = await getChecksumFromUrl(wrapperUrl);\n        if (existingChecksum) {\n          updatedContent = updatedContent.replace(\n            regEx(/wrapperSha256Sum=.*/),\n            `wrapperSha256Sum=${checksum}`,\n          );\n        } else {\n          // Add checksum after wrapperUrl or wrapperVersion\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:wrapperUrl\\s*=\\s*.+|wrapperVersion\\s*=\\s*.+)$/m),\n            'wrapperSha256Sum',\n            checksum,\n          );\n        }\n      } catch (err) {\n        logger.warn(\n          { err, url: wrapperUrl },\n          'Failed to fetch wrapper checksum',\n        );\n        if (!existingChecksum && fallbackChecksum) {\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:wrapperUrl\\s*=\\s*.+|wrapperVersion\\s*=\\s*.+)$/m),\n            'wrapperSha256Sum',\n            fallbackChecksum,\n          );\n        }\n      }\n    }\n  }\n\n  return updatedContent;\n}\n\ninterface MavenWrapperPaths {\n  wrapperExecutableFileName: string;\n  localProjectDir: string;\n  wrapperFullyQualifiedPath: string;\n}\n\nasync function addIfUpdated(\n  status: StatusResult,\n  fileProjectPath: string,\n): Promise<UpdateArtifactsResult | null> {\n  if (status.modified.includes(fileProjectPath)) {\n    return {\n      file: {\n        type: 'addition',\n        path: fileProjectPath,\n        contents: await readLocalFile(fileProjectPath),\n      },\n    };\n  }\n  return null;\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  newPackageFileContent,\n  updatedDeps,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  try {\n    logger.debug({ updatedDeps }, 'maven-wrapper.updateArtifacts()');\n\n    const hasMavenUpdate = updatedDeps.some((dep) => dep.depName === 'maven');\n    const hasWrapperUpdate = updatedDeps.some(\n      (dep) => dep.depName === 'maven-wrapper',\n    );\n    // Remember original content properties - we'll restore them after wrapper:wrapper\n    const hadDistributionChecksum = newPackageFileContent.includes(\n      'distributionSha256Sum=',\n    );\n    const hadWrapperChecksum =\n      newPackageFileContent.includes('wrapperSha256Sum=');\n    const originalDistributionType = getDistributionType(newPackageFileContent);\n\n    // Skip if no relevant updates\n    if (!hasWrapperUpdate && !(hasMavenUpdate && hadDistributionChecksum)) {\n      logger.debug(\n        'No Maven wrapper or distribution checksum updates - skipping Artifacts update',\n      );\n      return null;\n    }\n\n    // If wrapper is being updated, check if mvnw exists first\n    let cmd: string | null = null;\n    if (hasWrapperUpdate) {\n      cmd = await createWrapperCommand(\n        packageFileName,\n        originalDistributionType,\n      );\n\n      if (!cmd) {\n        logger.info('No mvnw found - skipping Artifacts update');\n        return null;\n      }\n    }\n\n    // Delete old maven-wrapper.jar if checksums exist and wrapper:wrapper will run\n    // This prevents checksum validation failure when wrapper:wrapper runs\n    if (hasWrapperUpdate && (hadWrapperChecksum || hadDistributionChecksum)) {\n      const jarPath = packageFileName.replace(\n        'maven-wrapper.properties',\n        'maven-wrapper.jar',\n      );\n      if (jarPath.endsWith('maven-wrapper.jar')) {\n        try {\n          await deleteLocalFile(jarPath);\n          logger.debug({ jarPath }, 'Deleted old maven-wrapper.jar');\n        } catch {\n          // File may not exist, ignore\n        }\n      }\n    }\n\n    // Strip checksum lines before running wrapper:wrapper to avoid validation failure\n    // (mvnw would try to validate NEW jar against OLD checksum)\n    let contentToWrite = newPackageFileContent;\n    if (hasWrapperUpdate && (hadWrapperChecksum || hadDistributionChecksum)) {\n      contentToWrite = contentToWrite\n        .replace(regEx(/^distributionSha256Sum=.*\\n?/m), '')\n        .replace(regEx(/^wrapperSha256Sum=.*\\n?/m), '');\n    }\n\n    // Write the properties file\n    await writeLocalFile(packageFileName, contentToWrite);\n\n    // Run wrapper:wrapper if the wrapper itself is being updated\n    if (hasWrapperUpdate && cmd) {\n      const extraEnv = getExtraEnvOptions(updatedDeps);\n      await executeWrapperCommand(cmd, config, packageFileName, extraEnv);\n    }\n\n    // Now update checksums AFTER wrapper:wrapper has run (if it ran)\n    // This ensures we compute checksums for the actual generated content\n    if (hadDistributionChecksum || hadWrapperChecksum) {\n      const currentContent = await readLocalFile(packageFileName, 'utf8');\n      if (currentContent) {\n        const contentWithChecksums = await updateChecksums(\n          currentContent,\n          updatedDeps,\n          hadDistributionChecksum,\n          hadWrapperChecksum,\n          newPackageFileContent,\n        );\n        await writeLocalFile(packageFileName, contentWithChecksums);\n      }\n    }\n\n    const status = await getRepoStatus();\n    const artifactFileNames = [\n      '.mvn/wrapper/maven-wrapper.properties',\n      '.mvn/wrapper/maven-wrapper.jar',\n      '.mvn/wrapper/MavenWrapperDownloader.java',\n      'mvnw',\n      'mvnw.cmd',\n    ].map(\n      (filename) =>\n        packageFileName.replace('.mvn/wrapper/maven-wrapper.properties', '') +\n        filename,\n    );\n    const updateArtifactsResult = (\n      await getUpdatedArtifacts(status, artifactFileNames)\n    ).filter(isTruthy);\n\n    logger.debug(\n      { files: updateArtifactsResult.map((r) => r.file?.path) },\n      `Returning updated maven-wrapper files`,\n    );\n    return updateArtifactsResult;\n  } catch (err) {\n    logger.debug({ err }, 'Error setting new Maven Wrapper release value');\n    return [\n      {\n        artifactError: {\n          fileName: packageFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n\nasync function getUpdatedArtifacts(\n  status: StatusResult,\n  artifactFileNames: string[],\n): Promise<UpdateArtifactsResult[]> {\n  const updatedResults: UpdateArtifactsResult[] = [];\n  for (const artifactFileName of artifactFileNames) {\n    const updatedResult = await addIfUpdated(status, artifactFileName);\n    if (updatedResult !== null) {\n      updatedResults.push(updatedResult);\n    }\n  }\n  return updatedResults;\n}\n\n/**\n * Find compatible java version for maven.\n * see https://maven.apache.org/developers/compatibility-plan.html\n * @param mavenWrapperVersion current maven version\n * @returns A Java semver range\n */\nexport function getJavaConstraint(\n  mavenWrapperVersion: string | null | undefined,\n): string | null {\n  const major = mavenWrapperVersion\n    ? mavenVersioning.getMajor(mavenWrapperVersion)\n    : null;\n\n  if (major && major >= 3) {\n    return '^17.0.0';\n  }\n\n  return '^8.0.0';\n}\n\nasync function executeWrapperCommand(\n  cmd: string,\n  config: UpdateArtifactsConfig,\n  packageFileName: string,\n  extraEnv: ExtraEnv,\n): Promise<void> {\n  logger.debug(`Updating maven wrapper: \"${cmd}\"`);\n  const { wrapperFullyQualifiedPath } = getMavenPaths(packageFileName);\n\n  const execOptions: ExecOptions = {\n    cwdFile: wrapperFullyQualifiedPath,\n    docker: {},\n    extraEnv,\n    toolConstraints: [\n      {\n        toolName: 'java',\n        constraint:\n          config.constraints?.java ?? getJavaConstraint(config.currentValue),\n      },\n    ],\n  };\n\n  try {\n    await exec(cmd, execOptions);\n  } catch (err) {\n    logger.error({ err }, 'Error executing maven wrapper update command.');\n    throw err;\n  }\n}\n\nfunction getExtraEnvOptions(deps: PackageDependency[]): ExtraEnv {\n  const customMavenWrapperUrl = getCustomMavenWrapperRepoUrl(deps);\n  if (customMavenWrapperUrl) {\n    return { MVNW_REPOURL: customMavenWrapperUrl };\n  }\n  return {};\n}\n\nfunction getCustomMavenWrapperRepoUrl(\n  deps: PackageDependency[],\n): string | null {\n  const replaceString = deps.find(\n    (dep) => dep.depName === 'maven-wrapper',\n  )?.replaceString;\n\n  if (!replaceString) {\n    return null;\n  }\n\n  const match = regEx(/^(?<repoUrl>.*?)\\/org\\/apache\\/maven\\/wrapper\\//).exec(\n    replaceString,\n  );\n\n  if (!match) {\n    return null;\n  }\n\n  return match.groups!.repoUrl === DEFAULT_MAVEN_REPO_URL\n    ? null\n    : match.groups!.repoUrl;\n}\n\nasync function createWrapperCommand(\n  packageFileName: string,\n  distributionType: string | null,\n): Promise<string | null> {\n  const {\n    wrapperExecutableFileName,\n    localProjectDir,\n    wrapperFullyQualifiedPath,\n  } = getMavenPaths(packageFileName);\n\n  // Use existing distributionType or default to 'script' to preserve JAR-based mode\n  // (prevents Maven 3.3.x from defaulting to only-script which doesn't support checksums)\n  const type = distributionType ?? 'script';\n  const args = `wrapper:wrapper -Dtype=${quote(type)}`;\n\n  return await prepareCommand(\n    wrapperExecutableFileName,\n    localProjectDir,\n    await statLocalFile(wrapperFullyQualifiedPath),\n    args,\n  );\n}\n\nfunction mavenWrapperFileName(): string {\n  if (\n    os.platform() === 'win32' &&\n    GlobalConfig.get('binarySource') !== 'docker'\n  ) {\n    return 'mvnw.cmd';\n  }\n  return './mvnw';\n}\n\nfunction getMavenPaths(packageFileName: string): MavenWrapperPaths {\n  const wrapperExecutableFileName = mavenWrapperFileName();\n  const localProjectDir = upath.join(\n    upath.dirname(packageFileName),\n    packageFileName.includes('mvnw') ? '.' : '../../',\n  );\n  const wrapperFullyQualifiedPath = upath.join(\n    localProjectDir,\n    wrapperExecutableFileName,\n  );\n  return {\n    wrapperExecutableFileName,\n    localProjectDir,\n    wrapperFullyQualifiedPath,\n  };\n}\n\nasync function prepareCommand(\n  fileName: string,\n  cwd: string | undefined,\n  pathFileStats: Stats | null,\n  args: string | null,\n): Promise<string | null> {\n  /* v8 ignore next -- hard to test */\n  if (pathFileStats?.isFile() === true) {\n    // if the file is not executable by others\n    if (os.platform() !== 'win32' && (pathFileStats.mode & 0o1) === 0) {\n      // add the execution permission to the owner, group and others\n      logger.warn('Maven wrapper is missing the executable bit');\n      await chmodLocalFile(\n        // TODO: types (#22198)\n        upath.join(cwd!, fileName),\n        pathFileStats.mode | 0o111,\n      );\n    }\n    if (args === null) {\n      return fileName;\n    }\n    return `${fileName} ${args}`;\n  }\n  return null;\n}\n"],"mappings":";;;;;;;;;;;;;;;AA8BA,MAAM,OAAO,IAAI,KAAK,eAAe;AACrC,MAAM,yBAAyB;AAE/B,SAAS,mBAAmB,KAA8B;CACxD,OAAO,UACL;EACE,WAAW;EACX,KAAK;EACL,YAAY;CACd,SACM,WAAW,KAAK,OAAO,GAAG,GAAG,QAAQ,CAC7C;AACF;AAEA,SAAS,mBAAmB,SAAgC;CAI1D,OAHc,MAAM,iDAAiD,CAAC,CAAC,KACrE,OAGI,CAAC,EAAE,QAAQ,iBAAiB,QAAQ,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK;AAE1E;AAEA,SAAS,cAAc,SAAgC;CAErD,OADc,MAAM,uCAAuC,CAAC,CAAC,KAAK,OACvD,CAAC,EAAE,QAAQ,YAAY,QAAQ,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK;AAC1E;AAEA,SAAS,oBACP,SACA,UAAkB,wBACV;CACR,OAAO,GAAG,QAAQ,0CAA0C,QAAQ,iBAAiB,QAAQ;AAC/F;AAEA,SAAS,kBAAkB,SAAgC;CAIzD,OAHc,MAAM,+CAA+C,CAAC,CAAC,KACnE,OAES,CAAC,EAAE,QAAQ,gBAAgB,KAAK,KAAK;AAClD;AAEA,SAAS,oBAAoB,SAAgC;CAI3D,OAHc,MAAM,mDAAmD,CAAC,CAAC,KACvE,OAES,CAAC,EAAE,QAAQ,kBAAkB,KAAK,KAAK;AACpD;AAEA,SAAS,iBAAiB,SAAiB,KAA4B;CAErE,OADc,MAAM,IAAI,IAAI,yBAAyB,GAAG,CAAC,CAAC,KAAK,OACpD,CAAC,EAAE,QAAQ,OAAO,KAAK,KAAK;AACzC;AAEA,SAAS,qBACP,SACA,WACA,KACA,OACQ;CACR,OAAO,QAAQ,QACb,MAAM,SAAS,IACd,cAAc,GAAG,UAAU,IAAI,IAAI,GAAG,OACzC;AACF;AAEA,eAAe,gBACb,SACA,aACA,yBACA,oBACA,iBACiB;CACjB,IAAI,iBAAiB;CAGrB,IAAI,yBAAyB;EAC3B,MAAM,mBAAmB,iBACvB,gBACA,uBACF;EACA,MAAM,mBAAmB,iBACvB,iBACA,uBACF;EACA,MAAM,UAAU,mBAAmB,cAAc;EACjD,IAAI,SACF,IAAI;GACF,MAAM,WAAW,MAAM,mBAAmB,OAAO;GACjD,IAAI,kBACF,iBAAiB,eAAe,QAC9B,MAAM,0BAA0B,GAChC,yBAAyB,UAC3B;QAGA,iBAAiB,qBACf,gBACA,MAAM,iCAAiC,GACvC,yBACA,QACF;EAEJ,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK,KAAK;GAAQ,GACpB,uCACF;GACA,IAAI,CAAC,oBAAoB,kBACvB,iBAAiB,qBACf,gBACA,MAAM,iCAAiC,GACvC,yBACA,gBACF;EAEJ;CAEJ;CAGA,IAAI,oBAAoB;EACtB,MAAM,mBAAmB,iBACvB,gBACA,kBACF;EACA,MAAM,mBAAmB,iBACvB,iBACA,kBACF;EACA,IAAI,aAAa,cAAc,cAAc;EAG7C,IAAI,CAAC,YAAY;GACf,MAAM,iBAAiB,kBAAkB,cAAc;GACvD,IAAI,gBAEF,aAAa,oBACX,gBAFoB,6BAA6B,WAGrC,KAAK,sBACnB;EAEJ;EAEA,IAAI,YACF,IAAI;GACF,MAAM,WAAW,MAAM,mBAAmB,UAAU;GACpD,IAAI,kBACF,iBAAiB,eAAe,QAC9B,MAAM,qBAAqB,GAC3B,oBAAoB,UACtB;QAGA,iBAAiB,qBACf,gBACA,MAAM,oDAAoD,GAC1D,oBACA,QACF;EAEJ,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK,KAAK;GAAW,GACvB,kCACF;GACA,IAAI,CAAC,oBAAoB,kBACvB,iBAAiB,qBACf,gBACA,MAAM,oDAAoD,GAC1D,oBACA,gBACF;EAEJ;CAEJ;CAEA,OAAO;AACT;AAQA,eAAe,aACb,QACA,iBACuC;CACvC,IAAI,OAAO,SAAS,SAAS,eAAe,GAC1C,OAAO,EACL,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU,MAAM,cAAc,eAAe;CAC/C,EACF;CAEF,OAAO;AACT;AAEA,eAAsB,gBAAgB,EACpC,iBACA,uBACA,aACA,UAC0D;CAC1D,IAAI;EACF,OAAO,MAAM,EAAE,YAAY,GAAG,iCAAiC;EAE/D,MAAM,iBAAiB,YAAY,MAAM,QAAQ,IAAI,YAAY,OAAO;EACxE,MAAM,mBAAmB,YAAY,MAClC,QAAQ,IAAI,YAAY,eAC3B;EAEA,MAAM,0BAA0B,sBAAsB,SACpD,wBACF;EACA,MAAM,qBACJ,sBAAsB,SAAS,mBAAmB;EACpD,MAAM,2BAA2B,oBAAoB,qBAAqB;EAG1E,IAAI,CAAC,oBAAoB,EAAE,kBAAkB,0BAA0B;GACrE,OAAO,MACL,+EACF;GACA,OAAO;EACT;EAGA,IAAI,MAAqB;EACzB,IAAI,kBAAkB;GACpB,MAAM,MAAM,qBACV,iBACA,wBACF;GAEA,IAAI,CAAC,KAAK;IACR,OAAO,KAAK,2CAA2C;IACvD,OAAO;GACT;EACF;EAIA,IAAI,qBAAqB,sBAAsB,0BAA0B;GACvE,MAAM,UAAU,gBAAgB,QAC9B,4BACA,mBACF;GACA,IAAI,QAAQ,SAAS,mBAAmB,GACtC,IAAI;IACF,MAAM,gBAAgB,OAAO;IAC7B,OAAO,MAAM,EAAE,QAAQ,GAAG,+BAA+B;GAC3D,QAAQ,CAER;EAEJ;EAIA,IAAI,iBAAiB;EACrB,IAAI,qBAAqB,sBAAsB,0BAC7C,iBAAiB,eACd,QAAQ,MAAM,+BAA+B,GAAG,EAAE,CAAC,CACnD,QAAQ,MAAM,0BAA0B,GAAG,EAAE;EAIlD,MAAM,eAAe,iBAAiB,cAAc;EAGpD,IAAI,oBAAoB,KAAK;GAC3B,MAAM,WAAW,mBAAmB,WAAW;GAC/C,MAAM,sBAAsB,KAAK,QAAQ,iBAAiB,QAAQ;EACpE;EAIA,IAAI,2BAA2B,oBAAoB;GACjD,MAAM,iBAAiB,MAAM,cAAc,iBAAiB,MAAM;GAClE,IAAI,gBAAgB;IAClB,MAAM,uBAAuB,MAAM,gBACjC,gBACA,aACA,yBACA,oBACA,qBACF;IACA,MAAM,eAAe,iBAAiB,oBAAoB;GAC5D;EACF;EAcA,MAAM,yBACJ,MAAM,oBAAoB,MAbP,cAAc,GACT;GACxB;GACA;GACA;GACA;GACA;EACF,CAAC,CAAC,KACC,aACC,gBAAgB,QAAQ,yCAAyC,EAAE,IACnE,QAGgD,CAAC,EAAA,CACnD,OAAO,QAAQ;EAEjB,OAAO,MACL,EAAE,OAAO,sBAAsB,KAAK,MAAM,EAAE,MAAM,IAAI,EAAE,GACxD,uCACF;EACA,OAAO;CACT,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,+CAA+C;EACrE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF;AAEA,eAAe,oBACb,QACA,mBACkC;CAClC,MAAM,iBAA0C,CAAC;CACjD,KAAK,MAAM,oBAAoB,mBAAmB;EAChD,MAAM,gBAAgB,MAAM,aAAa,QAAQ,gBAAgB;EACjE,IAAI,kBAAkB,MACpB,eAAe,KAAK,aAAa;CAErC;CACA,OAAO;AACT;;;;;;;AAQA,SAAgB,kBACd,qBACe;CACf,MAAM,QAAQ,sBACVA,IAAgB,SAAS,mBAAmB,IAC5C;CAEJ,IAAI,SAAS,SAAS,GACpB,OAAO;CAGT,OAAO;AACT;AAEA,eAAe,sBACb,KACA,QACA,iBACA,UACe;CACf,OAAO,MAAM,4BAA4B,IAAI,EAAE;CAC/C,MAAM,EAAE,8BAA8B,cAAc,eAAe;CAEnE,MAAM,cAA2B;EAC/B,SAAS;EACT,QAAQ,CAAC;EACT;EACA,iBAAiB,CACf;GACE,UAAU;GACV,YACE,OAAO,aAAa,QAAQ,kBAAkB,OAAO,YAAY;EACrE,CACF;CACF;CAEA,IAAI;EACF,MAAM,KAAK,KAAK,WAAW;CAC7B,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,+CAA+C;EACrE,MAAM;CACR;AACF;AAEA,SAAS,mBAAmB,MAAqC;CAC/D,MAAM,wBAAwB,6BAA6B,IAAI;CAC/D,IAAI,uBACF,OAAO,EAAE,cAAc,sBAAsB;CAE/C,OAAO,CAAC;AACV;AAEA,SAAS,6BACP,MACe;CACf,MAAM,gBAAgB,KAAK,MACxB,QAAQ,IAAI,YAAY,eAC3B,CAAC,EAAE;CAEH,IAAI,CAAC,eACH,OAAO;CAGT,MAAM,QAAQ,MAAM,iDAAiD,CAAC,CAAC,KACrE,aACF;CAEA,IAAI,CAAC,OACH,OAAO;CAGT,OAAO,MAAM,OAAQ,YAAY,yBAC7B,OACA,MAAM,OAAQ;AACpB;AAEA,eAAe,qBACb,iBACA,kBACwB;CACxB,MAAM,EACJ,2BACA,iBACA,8BACE,cAAc,eAAe;CAKjC,MAAM,OAAO,0BAA0B,MAD1B,oBAAoB,QACgB;CAEjD,OAAO,MAAM,eACX,2BACA,iBACA,MAAM,cAAc,yBAAyB,GAC7C,IACF;AACF;AAEA,SAAS,uBAA+B;CACtC,IACE,GAAG,SAAS,MAAM,WAClB,aAAa,IAAI,cAAc,MAAM,UAErC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,cAAc,iBAA4C;CACjE,MAAM,4BAA4B,qBAAqB;CACvD,MAAM,kBAAkB,MAAM,KAC5B,MAAM,QAAQ,eAAe,GAC7B,gBAAgB,SAAS,MAAM,IAAI,MAAM,QAC3C;CAKA,OAAO;EACL;EACA;EACA,2BAPgC,MAAM,KACtC,iBACA,yBAKwB;CAC1B;AACF;AAEA,eAAe,eACb,UACA,KACA,eACA,MACwB;;CAExB,IAAI,eAAe,OAAO,MAAM,MAAM;EAEpC,IAAI,GAAG,SAAS,MAAM,YAAY,cAAc,OAAO,OAAS,GAAG;GAEjE,OAAO,KAAK,6CAA6C;GACzD,MAAM,eAEJ,MAAM,KAAK,KAAM,QAAQ,GACzB,cAAc,OAAO,EACvB;EACF;EACA,IAAI,SAAS,MACX,OAAO;EAET,OAAO,GAAG,SAAS,GAAG;CACxB;CACA,OAAO;AACT"}
+{"version":3,"file":"artifacts.js","names":["mavenVersioning"],"sources":["../../../../lib/modules/manager/maven-wrapper/artifacts.ts"],"sourcesContent":["import type { Stats } from 'node:fs';\nimport os from 'node:os';\nimport { isTruthy } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { withCache } from '../../../util/cache/package/with-cache.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ExtraEnv } from '../../../util/exec/types.ts';\nimport {\n  chmodLocalFile,\n  deleteLocalFile,\n  readLocalFile,\n  statLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport type { StatusResult } from '../../../util/git/types.ts';\nimport { hashStream } from '../../../util/hash.ts';\nimport { Http } from '../../../util/http/index.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport mavenVersioning from '../../versioning/maven/index.ts';\nimport type {\n  PackageDependency,\n  UpdateArtifact,\n  UpdateArtifactsConfig,\n  UpdateArtifactsResult,\n} from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\n\nconst http = new Http('maven-wrapper');\nconst DEFAULT_MAVEN_REPO_URL = 'https://repo.maven.apache.org/maven2';\n\nfunction getChecksumFromUrl(url: string): Promise<string> {\n  return withCache(\n    {\n      namespace: 'url-sha256',\n      key: url,\n      ttlMinutes: 3 * 24 * 60, // 3 days\n    },\n    () => hashStream(http.stream(url), 'sha256'),\n  );\n}\n\nfunction getDistributionUrl(content: string): string | null {\n  const match = regEx(/^distributionUrl\\s*=\\s*(?<distributionUrl>.+)$/m).exec(\n    content,\n  );\n  return (\n    match?.groups?.distributionUrl?.replace(regEx(/\\\\:/g), ':').trim() ?? null\n  );\n}\n\nfunction getWrapperUrl(content: string): string | null {\n  const match = regEx(/^wrapperUrl\\s*=\\s*(?<wrapperUrl>.+)$/m).exec(content);\n  return match?.groups?.wrapperUrl?.replace(regEx(/\\\\:/g), ':').trim() ?? null;\n}\n\nfunction constructWrapperUrl(\n  version: string,\n  repoUrl: string = DEFAULT_MAVEN_REPO_URL,\n): string {\n  return `${repoUrl}/org/apache/maven/wrapper/maven-wrapper/${version}/maven-wrapper-${version}.jar`;\n}\n\nfunction getWrapperVersion(content: string): string | null {\n  const match = regEx(/^wrapperVersion\\s*=\\s*(?<wrapperVersion>.+)$/m).exec(\n    content,\n  );\n  return match?.groups?.wrapperVersion?.trim() ?? null;\n}\n\nfunction getDistributionType(content: string): string | null {\n  const match = regEx(/^distributionType\\s*=\\s*(?<distributionType>.+)$/m).exec(\n    content,\n  );\n  return match?.groups?.distributionType?.trim() ?? null;\n}\n\nfunction getChecksumValue(content: string, key: string): string | null {\n  const match = regEx(`^${key}\\\\s*=\\\\s*(?<value>.+)$`, 'm').exec(content);\n  return match?.groups?.value?.trim() ?? null;\n}\n\nfunction addChecksumAfterLine(\n  content: string,\n  lineRegex: RegExp,\n  key: string,\n  value: string,\n): string {\n  return content.replace(\n    regEx(lineRegex),\n    (lineMatch) => `${lineMatch}\\n${key}=${value}`,\n  );\n}\n\nasync function updateChecksums(\n  content: string,\n  updatedDeps: PackageDependency[],\n  addDistributionChecksum: boolean,\n  addWrapperChecksum: boolean,\n  originalContent: string,\n): Promise<string> {\n  let updatedContent = content;\n\n  // Update or add distribution checksum\n  if (addDistributionChecksum) {\n    const existingChecksum = getChecksumValue(\n      updatedContent,\n      'distributionSha256Sum',\n    );\n    const fallbackChecksum = getChecksumValue(\n      originalContent,\n      'distributionSha256Sum',\n    );\n    const distUrl = getDistributionUrl(updatedContent);\n    if (distUrl) {\n      try {\n        const checksum = await getChecksumFromUrl(distUrl);\n        if (existingChecksum) {\n          updatedContent = updatedContent.replace(\n            regEx(/distributionSha256Sum=.*/),\n            `distributionSha256Sum=${checksum}`,\n          );\n        } else {\n          // Add checksum after distributionUrl\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:distributionUrl\\s*=\\s*.+)$/m),\n            'distributionSha256Sum',\n            checksum,\n          );\n        }\n      } catch (err) {\n        logger.warn(\n          { err, url: distUrl },\n          'Failed to fetch distribution checksum',\n        );\n        if (!existingChecksum && fallbackChecksum) {\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:distributionUrl\\s*=\\s*.+)$/m),\n            'distributionSha256Sum',\n            fallbackChecksum,\n          );\n        }\n      }\n    }\n  }\n\n  // Update or add wrapper checksum\n  if (addWrapperChecksum) {\n    const existingChecksum = getChecksumValue(\n      updatedContent,\n      'wrapperSha256Sum',\n    );\n    const fallbackChecksum = getChecksumValue(\n      originalContent,\n      'wrapperSha256Sum',\n    );\n    let wrapperUrl = getWrapperUrl(updatedContent);\n\n    // If no wrapperUrl, try to construct from wrapperVersion\n    if (!wrapperUrl) {\n      const wrapperVersion = getWrapperVersion(updatedContent);\n      if (wrapperVersion) {\n        const customRepoUrl = getCustomMavenWrapperRepoUrl(updatedDeps);\n        wrapperUrl = constructWrapperUrl(\n          wrapperVersion,\n          customRepoUrl ?? DEFAULT_MAVEN_REPO_URL,\n        );\n      }\n    }\n\n    if (wrapperUrl) {\n      try {\n        const checksum = await getChecksumFromUrl(wrapperUrl);\n        if (existingChecksum) {\n          updatedContent = updatedContent.replace(\n            regEx(/wrapperSha256Sum=.*/),\n            `wrapperSha256Sum=${checksum}`,\n          );\n        } else {\n          // Add checksum after wrapperUrl or wrapperVersion\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:wrapperUrl\\s*=\\s*.+|wrapperVersion\\s*=\\s*.+)$/m),\n            'wrapperSha256Sum',\n            checksum,\n          );\n        }\n      } catch (err) {\n        logger.warn(\n          { err, url: wrapperUrl },\n          'Failed to fetch wrapper checksum',\n        );\n        if (!existingChecksum && fallbackChecksum) {\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:wrapperUrl\\s*=\\s*.+|wrapperVersion\\s*=\\s*.+)$/m),\n            'wrapperSha256Sum',\n            fallbackChecksum,\n          );\n        }\n      }\n    }\n  }\n\n  return updatedContent;\n}\n\ninterface MavenWrapperPaths {\n  wrapperExecutableFileName: string;\n  localProjectDir: string;\n  wrapperFullyQualifiedPath: string;\n}\n\nasync function addIfUpdated(\n  status: StatusResult,\n  fileProjectPath: string,\n): Promise<UpdateArtifactsResult | null> {\n  if (status.modified.includes(fileProjectPath)) {\n    return {\n      file: {\n        type: 'addition',\n        path: fileProjectPath,\n        contents: await readLocalFile(fileProjectPath),\n      },\n    };\n  }\n  return null;\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  newPackageFileContent,\n  updatedDeps,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  try {\n    logger.debug({ updatedDeps }, 'maven-wrapper.updateArtifacts()');\n\n    const hasMavenUpdate = updatedDeps.some((dep) => dep.depName === 'maven');\n    const hasWrapperUpdate = updatedDeps.some(\n      (dep) => dep.depName === 'maven-wrapper',\n    );\n    // Remember original content properties - we'll restore them after wrapper:wrapper\n    const hadDistributionChecksum = newPackageFileContent.includes(\n      'distributionSha256Sum=',\n    );\n    const hadWrapperChecksum =\n      newPackageFileContent.includes('wrapperSha256Sum=');\n    const originalDistributionType = getDistributionType(newPackageFileContent);\n\n    // Skip if no relevant updates\n    if (!hasWrapperUpdate && !(hasMavenUpdate && hadDistributionChecksum)) {\n      logger.debug(\n        'No Maven wrapper or distribution checksum updates - skipping Artifacts update',\n      );\n      return null;\n    }\n\n    // If wrapper is being updated, check if mvnw exists first\n    let cmd: string | null = null;\n    if (hasWrapperUpdate) {\n      cmd = await createWrapperCommand(\n        packageFileName,\n        originalDistributionType,\n      );\n\n      if (!cmd) {\n        logger.info('No mvnw found - skipping Artifacts update');\n        return null;\n      }\n    }\n\n    // Delete old maven-wrapper.jar if checksums exist and wrapper:wrapper will run\n    // This prevents checksum validation failure when wrapper:wrapper runs\n    if (hasWrapperUpdate && (hadWrapperChecksum || hadDistributionChecksum)) {\n      const jarPath = packageFileName.replace(\n        'maven-wrapper.properties',\n        'maven-wrapper.jar',\n      );\n      if (jarPath.endsWith('maven-wrapper.jar')) {\n        try {\n          await deleteLocalFile(jarPath);\n          logger.debug({ jarPath }, 'Deleted old maven-wrapper.jar');\n        } catch {\n          // File may not exist, ignore\n        }\n      }\n    }\n\n    // Strip checksum lines before running wrapper:wrapper to avoid validation failure\n    // (mvnw would try to validate NEW jar against OLD checksum)\n    let contentToWrite = newPackageFileContent;\n    if (hasWrapperUpdate && (hadWrapperChecksum || hadDistributionChecksum)) {\n      contentToWrite = contentToWrite\n        .replace(regEx(/^distributionSha256Sum=.*\\n?/m), '')\n        .replace(regEx(/^wrapperSha256Sum=.*\\n?/m), '');\n    }\n\n    // Write the properties file\n    await writeLocalFile(packageFileName, contentToWrite);\n\n    // Run wrapper:wrapper if the wrapper itself is being updated\n    if (hasWrapperUpdate && cmd) {\n      const extraEnv = getExtraEnvOptions(updatedDeps);\n      await executeWrapperCommand(cmd, config, packageFileName, extraEnv);\n    }\n\n    // Now update checksums AFTER wrapper:wrapper has run (if it ran)\n    // This ensures we compute checksums for the actual generated content\n    if (hadDistributionChecksum || hadWrapperChecksum) {\n      const currentContent = await readLocalFile(packageFileName, 'utf8');\n      if (currentContent) {\n        const contentWithChecksums = await updateChecksums(\n          currentContent,\n          updatedDeps,\n          hadDistributionChecksum,\n          hadWrapperChecksum,\n          newPackageFileContent,\n        );\n        await writeLocalFile(packageFileName, contentWithChecksums);\n      }\n    }\n\n    const status = await getRepoStatus();\n    const artifactFileNames = [\n      '.mvn/wrapper/maven-wrapper.properties',\n      '.mvn/wrapper/maven-wrapper.jar',\n      '.mvn/wrapper/MavenWrapperDownloader.java',\n      'mvnw',\n      'mvnw.cmd',\n    ].map(\n      (filename) =>\n        packageFileName.replace('.mvn/wrapper/maven-wrapper.properties', '') +\n        filename,\n    );\n    const updateArtifactsResult = (\n      await getUpdatedArtifacts(status, artifactFileNames)\n    ).filter(isTruthy);\n\n    logger.debug(\n      { files: updateArtifactsResult.map((r) => r.file?.path) },\n      `Returning updated maven-wrapper files`,\n    );\n    return updateArtifactsResult;\n  } catch (err) {\n    logger.debug({ err }, 'Error setting new Maven Wrapper release value');\n    return [\n      {\n        artifactError: {\n          fileName: packageFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n\nasync function getUpdatedArtifacts(\n  status: StatusResult,\n  artifactFileNames: string[],\n): Promise<UpdateArtifactsResult[]> {\n  const updatedResults: UpdateArtifactsResult[] = [];\n  for (const artifactFileName of artifactFileNames) {\n    const updatedResult = await addIfUpdated(status, artifactFileName);\n    if (updatedResult !== null) {\n      updatedResults.push(updatedResult);\n    }\n  }\n  return updatedResults;\n}\n\n/**\n * Find compatible java version for maven.\n * see https://maven.apache.org/developers/compatibility-plan.html\n * @param mavenWrapperVersion current maven version\n * @returns A Java semver range\n */\nexport function getJavaConstraint(\n  mavenWrapperVersion: string | null | undefined,\n): string | null {\n  const major = mavenWrapperVersion\n    ? mavenVersioning.getMajor(mavenWrapperVersion)\n    : null;\n\n  if (major && major >= 3) {\n    return '^17.0.0';\n  }\n\n  return '^8.0.0';\n}\n\nasync function executeWrapperCommand(\n  cmd: string,\n  config: UpdateArtifactsConfig,\n  packageFileName: string,\n  extraEnv: ExtraEnv,\n): Promise<void> {\n  logger.debug(`Updating maven wrapper: \"${cmd}\"`);\n  const { wrapperFullyQualifiedPath } = getMavenPaths(packageFileName);\n\n  const execOptions: ExecOptions = {\n    cwdFile: wrapperFullyQualifiedPath,\n    docker: {},\n    extraEnv,\n    toolConstraints: [\n      {\n        toolName: 'java',\n        constraint: await resolveToolConstraint(config, 'java', () =>\n          getJavaConstraint(config.currentValue),\n        ),\n      },\n    ],\n  };\n\n  try {\n    await exec(cmd, execOptions);\n  } catch (err) {\n    logger.error({ err }, 'Error executing maven wrapper update command.');\n    throw err;\n  }\n}\n\nfunction getExtraEnvOptions(deps: PackageDependency[]): ExtraEnv {\n  const customMavenWrapperUrl = getCustomMavenWrapperRepoUrl(deps);\n  if (customMavenWrapperUrl) {\n    return { MVNW_REPOURL: customMavenWrapperUrl };\n  }\n  return {};\n}\n\nfunction getCustomMavenWrapperRepoUrl(\n  deps: PackageDependency[],\n): string | null {\n  const replaceString = deps.find(\n    (dep) => dep.depName === 'maven-wrapper',\n  )?.replaceString;\n\n  if (!replaceString) {\n    return null;\n  }\n\n  const match = regEx(/^(?<repoUrl>.*?)\\/org\\/apache\\/maven\\/wrapper\\//).exec(\n    replaceString,\n  );\n\n  if (!match) {\n    return null;\n  }\n\n  return match.groups!.repoUrl === DEFAULT_MAVEN_REPO_URL\n    ? null\n    : match.groups!.repoUrl;\n}\n\nasync function createWrapperCommand(\n  packageFileName: string,\n  distributionType: string | null,\n): Promise<string | null> {\n  const {\n    wrapperExecutableFileName,\n    localProjectDir,\n    wrapperFullyQualifiedPath,\n  } = getMavenPaths(packageFileName);\n\n  // Use existing distributionType or default to 'script' to preserve JAR-based mode\n  // (prevents Maven 3.3.x from defaulting to only-script which doesn't support checksums)\n  const type = distributionType ?? 'script';\n  const args = `wrapper:wrapper -Dtype=${quote(type)}`;\n\n  return await prepareCommand(\n    wrapperExecutableFileName,\n    localProjectDir,\n    await statLocalFile(wrapperFullyQualifiedPath),\n    args,\n  );\n}\n\nfunction mavenWrapperFileName(): string {\n  if (\n    os.platform() === 'win32' &&\n    GlobalConfig.get('binarySource') !== 'docker'\n  ) {\n    return 'mvnw.cmd';\n  }\n  return './mvnw';\n}\n\nfunction getMavenPaths(packageFileName: string): MavenWrapperPaths {\n  const wrapperExecutableFileName = mavenWrapperFileName();\n  const localProjectDir = upath.join(\n    upath.dirname(packageFileName),\n    packageFileName.includes('mvnw') ? '.' : '../../',\n  );\n  const wrapperFullyQualifiedPath = upath.join(\n    localProjectDir,\n    wrapperExecutableFileName,\n  );\n  return {\n    wrapperExecutableFileName,\n    localProjectDir,\n    wrapperFullyQualifiedPath,\n  };\n}\n\nasync function prepareCommand(\n  fileName: string,\n  cwd: string | undefined,\n  pathFileStats: Stats | null,\n  args: string | null,\n): Promise<string | null> {\n  /* v8 ignore next -- hard to test */\n  if (pathFileStats?.isFile() === true) {\n    // if the file is not executable by others\n    if (os.platform() !== 'win32' && (pathFileStats.mode & 0o1) === 0) {\n      // add the execution permission to the owner, group and others\n      logger.warn('Maven wrapper is missing the executable bit');\n      await chmodLocalFile(\n        // TODO: types (#22198)\n        upath.join(cwd!, fileName),\n        pathFileStats.mode | 0o111,\n      );\n    }\n    if (args === null) {\n      return fileName;\n    }\n    return `${fileName} ${args}`;\n  }\n  return null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA+BA,MAAM,OAAO,IAAI,KAAK,eAAe;AACrC,MAAM,yBAAyB;AAE/B,SAAS,mBAAmB,KAA8B;CACxD,OAAO,UACL;EACE,WAAW;EACX,KAAK;EACL,YAAY;CACd,SACM,WAAW,KAAK,OAAO,GAAG,GAAG,QAAQ,CAC7C;AACF;AAEA,SAAS,mBAAmB,SAAgC;CAI1D,OAHc,MAAM,iDAAiD,CAAC,CAAC,KACrE,OAGI,CAAC,EAAE,QAAQ,iBAAiB,QAAQ,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK;AAE1E;AAEA,SAAS,cAAc,SAAgC;CAErD,OADc,MAAM,uCAAuC,CAAC,CAAC,KAAK,OACvD,CAAC,EAAE,QAAQ,YAAY,QAAQ,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK;AAC1E;AAEA,SAAS,oBACP,SACA,UAAkB,wBACV;CACR,OAAO,GAAG,QAAQ,0CAA0C,QAAQ,iBAAiB,QAAQ;AAC/F;AAEA,SAAS,kBAAkB,SAAgC;CAIzD,OAHc,MAAM,+CAA+C,CAAC,CAAC,KACnE,OAES,CAAC,EAAE,QAAQ,gBAAgB,KAAK,KAAK;AAClD;AAEA,SAAS,oBAAoB,SAAgC;CAI3D,OAHc,MAAM,mDAAmD,CAAC,CAAC,KACvE,OAES,CAAC,EAAE,QAAQ,kBAAkB,KAAK,KAAK;AACpD;AAEA,SAAS,iBAAiB,SAAiB,KAA4B;CAErE,OADc,MAAM,IAAI,IAAI,yBAAyB,GAAG,CAAC,CAAC,KAAK,OACpD,CAAC,EAAE,QAAQ,OAAO,KAAK,KAAK;AACzC;AAEA,SAAS,qBACP,SACA,WACA,KACA,OACQ;CACR,OAAO,QAAQ,QACb,MAAM,SAAS,IACd,cAAc,GAAG,UAAU,IAAI,IAAI,GAAG,OACzC;AACF;AAEA,eAAe,gBACb,SACA,aACA,yBACA,oBACA,iBACiB;CACjB,IAAI,iBAAiB;CAGrB,IAAI,yBAAyB;EAC3B,MAAM,mBAAmB,iBACvB,gBACA,uBACF;EACA,MAAM,mBAAmB,iBACvB,iBACA,uBACF;EACA,MAAM,UAAU,mBAAmB,cAAc;EACjD,IAAI,SACF,IAAI;GACF,MAAM,WAAW,MAAM,mBAAmB,OAAO;GACjD,IAAI,kBACF,iBAAiB,eAAe,QAC9B,MAAM,0BAA0B,GAChC,yBAAyB,UAC3B;QAGA,iBAAiB,qBACf,gBACA,MAAM,iCAAiC,GACvC,yBACA,QACF;EAEJ,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK,KAAK;GAAQ,GACpB,uCACF;GACA,IAAI,CAAC,oBAAoB,kBACvB,iBAAiB,qBACf,gBACA,MAAM,iCAAiC,GACvC,yBACA,gBACF;EAEJ;CAEJ;CAGA,IAAI,oBAAoB;EACtB,MAAM,mBAAmB,iBACvB,gBACA,kBACF;EACA,MAAM,mBAAmB,iBACvB,iBACA,kBACF;EACA,IAAI,aAAa,cAAc,cAAc;EAG7C,IAAI,CAAC,YAAY;GACf,MAAM,iBAAiB,kBAAkB,cAAc;GACvD,IAAI,gBAEF,aAAa,oBACX,gBAFoB,6BAA6B,WAGrC,KAAK,sBACnB;EAEJ;EAEA,IAAI,YACF,IAAI;GACF,MAAM,WAAW,MAAM,mBAAmB,UAAU;GACpD,IAAI,kBACF,iBAAiB,eAAe,QAC9B,MAAM,qBAAqB,GAC3B,oBAAoB,UACtB;QAGA,iBAAiB,qBACf,gBACA,MAAM,oDAAoD,GAC1D,oBACA,QACF;EAEJ,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK,KAAK;GAAW,GACvB,kCACF;GACA,IAAI,CAAC,oBAAoB,kBACvB,iBAAiB,qBACf,gBACA,MAAM,oDAAoD,GAC1D,oBACA,gBACF;EAEJ;CAEJ;CAEA,OAAO;AACT;AAQA,eAAe,aACb,QACA,iBACuC;CACvC,IAAI,OAAO,SAAS,SAAS,eAAe,GAC1C,OAAO,EACL,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU,MAAM,cAAc,eAAe;CAC/C,EACF;CAEF,OAAO;AACT;AAEA,eAAsB,gBAAgB,EACpC,iBACA,uBACA,aACA,UAC0D;CAC1D,IAAI;EACF,OAAO,MAAM,EAAE,YAAY,GAAG,iCAAiC;EAE/D,MAAM,iBAAiB,YAAY,MAAM,QAAQ,IAAI,YAAY,OAAO;EACxE,MAAM,mBAAmB,YAAY,MAClC,QAAQ,IAAI,YAAY,eAC3B;EAEA,MAAM,0BAA0B,sBAAsB,SACpD,wBACF;EACA,MAAM,qBACJ,sBAAsB,SAAS,mBAAmB;EACpD,MAAM,2BAA2B,oBAAoB,qBAAqB;EAG1E,IAAI,CAAC,oBAAoB,EAAE,kBAAkB,0BAA0B;GACrE,OAAO,MACL,+EACF;GACA,OAAO;EACT;EAGA,IAAI,MAAqB;EACzB,IAAI,kBAAkB;GACpB,MAAM,MAAM,qBACV,iBACA,wBACF;GAEA,IAAI,CAAC,KAAK;IACR,OAAO,KAAK,2CAA2C;IACvD,OAAO;GACT;EACF;EAIA,IAAI,qBAAqB,sBAAsB,0BAA0B;GACvE,MAAM,UAAU,gBAAgB,QAC9B,4BACA,mBACF;GACA,IAAI,QAAQ,SAAS,mBAAmB,GACtC,IAAI;IACF,MAAM,gBAAgB,OAAO;IAC7B,OAAO,MAAM,EAAE,QAAQ,GAAG,+BAA+B;GAC3D,QAAQ,CAER;EAEJ;EAIA,IAAI,iBAAiB;EACrB,IAAI,qBAAqB,sBAAsB,0BAC7C,iBAAiB,eACd,QAAQ,MAAM,+BAA+B,GAAG,EAAE,CAAC,CACnD,QAAQ,MAAM,0BAA0B,GAAG,EAAE;EAIlD,MAAM,eAAe,iBAAiB,cAAc;EAGpD,IAAI,oBAAoB,KAAK;GAC3B,MAAM,WAAW,mBAAmB,WAAW;GAC/C,MAAM,sBAAsB,KAAK,QAAQ,iBAAiB,QAAQ;EACpE;EAIA,IAAI,2BAA2B,oBAAoB;GACjD,MAAM,iBAAiB,MAAM,cAAc,iBAAiB,MAAM;GAClE,IAAI,gBAAgB;IAClB,MAAM,uBAAuB,MAAM,gBACjC,gBACA,aACA,yBACA,oBACA,qBACF;IACA,MAAM,eAAe,iBAAiB,oBAAoB;GAC5D;EACF;EAcA,MAAM,yBACJ,MAAM,oBAAoB,MAbP,cAAc,GACT;GACxB;GACA;GACA;GACA;GACA;EACF,CAAC,CAAC,KACC,aACC,gBAAgB,QAAQ,yCAAyC,EAAE,IACnE,QAGgD,CAAC,EAAA,CACnD,OAAO,QAAQ;EAEjB,OAAO,MACL,EAAE,OAAO,sBAAsB,KAAK,MAAM,EAAE,MAAM,IAAI,EAAE,GACxD,uCACF;EACA,OAAO;CACT,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,+CAA+C;EACrE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF;AAEA,eAAe,oBACb,QACA,mBACkC;CAClC,MAAM,iBAA0C,CAAC;CACjD,KAAK,MAAM,oBAAoB,mBAAmB;EAChD,MAAM,gBAAgB,MAAM,aAAa,QAAQ,gBAAgB;EACjE,IAAI,kBAAkB,MACpB,eAAe,KAAK,aAAa;CAErC;CACA,OAAO;AACT;;;;;;;AAQA,SAAgB,kBACd,qBACe;CACf,MAAM,QAAQ,sBACVA,IAAgB,SAAS,mBAAmB,IAC5C;CAEJ,IAAI,SAAS,SAAS,GACpB,OAAO;CAGT,OAAO;AACT;AAEA,eAAe,sBACb,KACA,QACA,iBACA,UACe;CACf,OAAO,MAAM,4BAA4B,IAAI,EAAE;CAC/C,MAAM,EAAE,8BAA8B,cAAc,eAAe;CAEnE,MAAM,cAA2B;EAC/B,SAAS;EACT,QAAQ,CAAC;EACT;EACA,iBAAiB,CACf;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,cAC9C,kBAAkB,OAAO,YAAY,CACvC;EACF,CACF;CACF;CAEA,IAAI;EACF,MAAM,KAAK,KAAK,WAAW;CAC7B,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,+CAA+C;EACrE,MAAM;CACR;AACF;AAEA,SAAS,mBAAmB,MAAqC;CAC/D,MAAM,wBAAwB,6BAA6B,IAAI;CAC/D,IAAI,uBACF,OAAO,EAAE,cAAc,sBAAsB;CAE/C,OAAO,CAAC;AACV;AAEA,SAAS,6BACP,MACe;CACf,MAAM,gBAAgB,KAAK,MACxB,QAAQ,IAAI,YAAY,eAC3B,CAAC,EAAE;CAEH,IAAI,CAAC,eACH,OAAO;CAGT,MAAM,QAAQ,MAAM,iDAAiD,CAAC,CAAC,KACrE,aACF;CAEA,IAAI,CAAC,OACH,OAAO;CAGT,OAAO,MAAM,OAAQ,YAAY,yBAC7B,OACA,MAAM,OAAQ;AACpB;AAEA,eAAe,qBACb,iBACA,kBACwB;CACxB,MAAM,EACJ,2BACA,iBACA,8BACE,cAAc,eAAe;CAKjC,MAAM,OAAO,0BAA0B,MAD1B,oBAAoB,QACgB;CAEjD,OAAO,MAAM,eACX,2BACA,iBACA,MAAM,cAAc,yBAAyB,GAC7C,IACF;AACF;AAEA,SAAS,uBAA+B;CACtC,IACE,GAAG,SAAS,MAAM,WAClB,aAAa,IAAI,cAAc,MAAM,UAErC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,cAAc,iBAA4C;CACjE,MAAM,4BAA4B,qBAAqB;CACvD,MAAM,kBAAkB,MAAM,KAC5B,MAAM,QAAQ,eAAe,GAC7B,gBAAgB,SAAS,MAAM,IAAI,MAAM,QAC3C;CAKA,OAAO;EACL;EACA;EACA,2BAPgC,MAAM,KACtC,iBACA,yBAKwB;CAC1B;AACF;AAEA,eAAe,eACb,UACA,KACA,eACA,MACwB;;CAExB,IAAI,eAAe,OAAO,MAAM,MAAM;EAEpC,IAAI,GAAG,SAAS,MAAM,YAAY,cAAc,OAAO,OAAS,GAAG;GAEjE,OAAO,KAAK,6CAA6C;GACzD,MAAM,eAEJ,MAAM,KAAK,KAAM,QAAQ,GACzB,cAAc,OAAO,EACvB;EACF;EACA,IAAI,SAAS,MACX,OAAO;EAET,OAAO,GAAG,SAAS,GAAG;CACxB;CACA,OAAO;AACT"}

package/dist/modules/manager/mise/artifacts.js

@@ -6,6 +6,7 @@ import { find } from "../../../util/host-rules.js";
 import { readLocalFile } from "../../../util/fs/index.js";
 import { api } from "../../versioning/semver/index.js";
 import { exec } from "../../../util/exec/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { findGithubToken } from "../../../util/check-token.js";
 import { getConfigType, getLockFileName } from "./lockfile.js";
 import { isNonEmptyStringAndNotWhitespace, isString } from "@sindresorhus/is";
@@ -63,29 +64,29 @@ function versionSupportsSafeFeatures(version) {
 * @see https://mise.jdx.dev/dev-tools/backends/go.html
 * @see https://mise.jdx.dev/dev-tools/backends/gem.html
 */
-function getMiseLockToolConstraints(constraints, safeMode = false) {
-	const miseConstraint = {
+async function getMiseLockToolConstraints(config, miseConstraint, safeMode = false) {
+	const miseToolConstraint = {
 		toolName: "mise",
-		constraint: constraints?.mise
+		constraint: miseConstraint
 	};
-	if (safeMode) return [miseConstraint];
+	if (safeMode) return [miseToolConstraint];
 	return [
-		miseConstraint,
+		miseToolConstraint,
 		{
 			toolName: "node",
-			constraint: constraints?.node
+			constraint: await resolveToolConstraint(config, "node")
 		},
 		{
 			toolName: "npm",
-			constraint: constraints?.npm
+			constraint: await resolveToolConstraint(config, "npm")
 		},
 		{
 			toolName: "golang",
-			constraint: constraints?.go
+			constraint: await resolveToolConstraint(config, "go")
 		},
 		{
 			toolName: "ruby",
-			constraint: constraints?.ruby
+			constraint: await resolveToolConstraint(config, "ruby")
 		}
 	];
 }
@@ -101,12 +102,13 @@ async function updateArtifacts({ packageFileName, updatedDeps, config }) {
 		return null;
 	}
 	const miseAllowlisted = GlobalConfig.get("allowedUnsafeExecutions").includes("mise");
+	const miseConstraint = await resolveToolConstraint(config, "mise");
 	let miseSupportsSafeFeatures = false;
 	if (!miseAllowlisted || config.isLockFileMaintenance) miseSupportsSafeFeatures = versionSupportsSafeFeatures(await detectMiseVersion({
 		cwdFile: packageFileName,
 		toolConstraints: [{
 			toolName: "mise",
-			constraint: config.constraints?.mise
+			constraint: miseConstraint
 		}],
 		docker: {}
 	}));
@@ -134,7 +136,7 @@ async function updateArtifacts({ packageFileName, updatedDeps, config }) {
 	const execOptions = {
 		cwdFile: packageFileName,
 		extraEnv,
-		toolConstraints: getMiseLockToolConstraints(config.constraints, safeMode),
+		toolConstraints: await getMiseLockToolConstraints(config, miseConstraint, safeMode),
 		docker: {}
 	};
 	const commands = safeMode ? [lockCmd] : [`mise trust ${quote(upath.basename(packageFileName))}`, lockCmd];

package/dist/modules/manager/mise/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":["miseVersioning","hostRules.find"],"sources":["../../../../lib/modules/manager/mise/artifacts.ts"],"sourcesContent":["import { isNonEmptyStringAndNotWhitespace, isString } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { findGithubToken } from '../../../util/check-token.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type {\n  ConstraintName,\n  ExecOptions,\n  ExtraEnv,\n  ToolConstraint,\n} from '../../../util/exec/types.ts';\nimport { readLocalFile } from '../../../util/fs/index.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { api as miseVersioning } from '../../versioning/semver/index.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { getConfigType, getLockFileName } from './lockfile.ts';\n\n/**\n * First mise release that supports the features this manager relies on:\n * `MISE_SAFE=1` safe mode (a hard boundary against project config executing\n * code during `mise lock`) and `mise lock --bump` (advancing fuzzy selectors).\n *\n * Safe mode (jdx/mise#11146) and lockfile bumping (jdx/mise#11145) merged after\n * v2026.7.11 and first shipped in v2026.7.12.\n *\n * @see https://github.com/jdx/mise/pull/11146\n * @see https://github.com/jdx/mise/pull/11145\n * @see https://mise.jdx.dev/configuration/settings.html#safe\n */\nconst MISE_SAFE_MODE_MIN_VERSION = '2026.7.12';\n\n/**\n * Detects the mise version that will actually run, by executing `mise version`.\n * `mise version` only prints the binary's version — it does not load or execute\n * project configuration — so it is safe to run even without allowlisting.\n *\n * Output looks like `2026.7.12 macos-arm64 (2026-07-21)`; we take the leading\n * `major.minor.patch`. Returns `null` if the probe fails or cannot be parsed,\n * in which case callers fall back to the conservative (pre-safe-mode) behavior.\n */\nasync function detectMiseVersion(\n  execOptions: ExecOptions,\n): Promise<string | null> {\n  try {\n    const { stdout } = await exec('mise version', execOptions);\n    const version = regEx(/\\d+\\.\\d+\\.\\d+/).exec(stdout)?.[0];\n    if (version && miseVersioning.isVersion(version)) {\n      return version;\n    }\n    logger.debug({ stdout }, 'Could not parse mise version output');\n    return null;\n  } catch (err) {\n    logger.debug({ err }, 'Failed to determine mise version');\n    return null;\n  }\n}\n\n/** True when `version` is at or above the safe-mode / `--bump` release. */\nfunction versionSupportsSafeFeatures(version: string | null): boolean {\n  return (\n    !!version &&\n    (miseVersioning.equals(version, MISE_SAFE_MODE_MIN_VERSION) ||\n      miseVersioning.isGreaterThan(version, MISE_SAFE_MODE_MIN_VERSION))\n  );\n}\n\n/**\n * Resolver tools that mise may invoke while running `mise lock`, for instance to convert an inexact version like `1` against the npm registry.\n *\n * NOTE: this will install all relevant tools, regardless of what the given mise configuration uses.\n *\n * In safe mode these are unnecessary: npm version listing uses mise's built-in\n * registry HTTP client and go runs with `GOTOOLCHAIN=local`, so `mise lock`\n * resolves versions over HTTP without shelling out to node/npm/ruby.\n *\n * @see https://mise.jdx.dev/dev-tools/backends/npm.html\n * @see https://mise.jdx.dev/dev-tools/backends/go.html\n * @see https://mise.jdx.dev/dev-tools/backends/gem.html\n */\nfunction getMiseLockToolConstraints(\n  constraints?: Partial<Record<ConstraintName, string>> | null,\n  safeMode = false,\n): ToolConstraint[] {\n  const miseConstraint: ToolConstraint = {\n    toolName: 'mise',\n    constraint: constraints?.mise,\n  };\n  if (safeMode) {\n    return [miseConstraint];\n  }\n  return [\n    miseConstraint,\n    { toolName: 'node', constraint: constraints?.node },\n    { toolName: 'npm', constraint: constraints?.npm },\n    { toolName: 'golang', constraint: constraints?.go },\n    { toolName: 'ruby', constraint: constraints?.ruby },\n  ];\n}\n\n/**\n * Updates mise lock files when dependencies are updated.\n * Runs `mise lock` for lock file maintenance or `mise lock <tools>` for targeted updates.\n */\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  const lockFileName = getLockFileName(packageFileName);\n  const existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent) {\n    logger.debug({ lockFileName }, 'No mise lock file found');\n    return null;\n  }\n\n  // `mise lock` normally executes the project's mise config, so it requires\n  // `allowedUnsafeExecutions`. When the mise that will run supports safe mode,\n  // we instead run with `MISE_SAFE=1`, which is a hard boundary against the\n  // config executing code — so the allowlist is not required on that path.\n  const allowlist = GlobalConfig.get('allowedUnsafeExecutions');\n  const miseAllowlisted = allowlist.includes('mise');\n\n  // The mise version is needed to decide safe mode (untrusted path) and\n  // `mise lock --bump` (lock file maintenance). Detect it at runtime rather\n  // than requiring a pinned `constraints.mise`. Skip the probe when it cannot\n  // change the outcome: an allowlisted, non-maintenance run behaves the same\n  // regardless of version.\n  let miseSupportsSafeFeatures = false;\n  if (!miseAllowlisted || config.isLockFileMaintenance) {\n    const miseVersion = await detectMiseVersion({\n      cwdFile: packageFileName,\n      toolConstraints: [\n        { toolName: 'mise', constraint: config.constraints?.mise },\n      ],\n      docker: {},\n    });\n    miseSupportsSafeFeatures = versionSupportsSafeFeatures(miseVersion);\n  }\n\n  const safeMode = !miseAllowlisted && miseSupportsSafeFeatures;\n  if (!miseAllowlisted && !safeMode) {\n    logger.once.warn(\n      { safeModeMinVersion: MISE_SAFE_MODE_MIN_VERSION },\n      '`mise lock` requires either `mise` in `allowedUnsafeExecutions`, or a mise version that supports safe mode',\n    );\n    return null;\n  }\n\n  const { isLocal, env } = getConfigType(packageFileName);\n  const localFlag = isLocal ? ' --local' : '';\n\n  let lockCmd: string;\n  if (config.isLockFileMaintenance) {\n    // Lock file maintenance means \"update to the latest versions\". Plain\n    // `mise lock` only refreshes metadata for already-locked versions, so use\n    // `mise lock --bump` to also advance fuzzy selectors (e.g. `node = \"22\"`)\n    // to the latest matching version. `--bump` requires a new enough mise, so\n    // fall back to a plain refresh when the version cannot be guaranteed.\n    const bumpFlag = miseSupportsSafeFeatures ? ' --bump' : '';\n    lockCmd = `mise lock${localFlag}${bumpFlag}`;\n  } else {\n    const tools = updatedDeps\n      .map(({ depName }) => depName)\n      .filter(isNonEmptyStringAndNotWhitespace)\n      .map(quote)\n      .join(' ');\n    lockCmd = tools\n      ? `mise lock${localFlag} ${tools}`\n      : `mise lock${localFlag}`;\n  }\n\n  const extraEnv: ExtraEnv = {};\n  if (env) {\n    extraEnv.MISE_ENV = env;\n  }\n  if (safeMode) {\n    extraEnv.MISE_SAFE = '1';\n  }\n  const token = findGithubToken(\n    hostRules.find({\n      hostType: 'github',\n      url: 'https://api.github.com/',\n    }),\n  );\n  if (token) {\n    extraEnv.GITHUB_TOKEN = token;\n  }\n\n  const execOptions: ExecOptions = {\n    cwdFile: packageFileName,\n    extraEnv,\n    toolConstraints: getMiseLockToolConstraints(config.constraints, safeMode),\n    docker: {},\n  };\n\n  // `mise trust` is only needed on the allowlisted path. In safe mode mise\n  // loads untrusted config without a trust prompt (the config is inert — it\n  // can neither execute code nor inject environment), so the trust step is\n  // unnecessary and is skipped.\n  const commands = safeMode\n    ? [lockCmd]\n    : [`mise trust ${quote(upath.basename(packageFileName))}`, lockCmd];\n\n  try {\n    await exec(commands, execOptions);\n    const newLockFileContent = await readLocalFile(lockFileName, 'utf8');\n    if (!newLockFileContent || existingLockFileContent === newLockFileContent) {\n      return null;\n    }\n\n    logger.debug({ lockFileName }, 'Returning updated mise lock file');\n    return [\n      {\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: newLockFileContent,\n        },\n      },\n    ];\n  } catch (err) {\n    // istanbul ignore if: not worth testing\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n\n    const errorOutput = [err.stdout, err.stderr, err.message]\n      .filter(isString)\n      .join('\\n');\n\n    logger.warn({ err, lockFileName }, 'Error updating mise lock file');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: errorOutput,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,MAAM,6BAA6B;;;;;;;;;;AAWnC,eAAe,kBACb,aACwB;CACxB,IAAI;EACF,MAAM,EAAE,WAAW,MAAM,KAAK,gBAAgB,WAAW;EACzD,MAAM,UAAU,MAAM,eAAe,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG;EACtD,IAAI,WAAWA,IAAe,UAAU,OAAO,GAC7C,OAAO;EAET,OAAO,MAAM,EAAE,OAAO,GAAG,qCAAqC;EAC9D,OAAO;CACT,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,kCAAkC;EACxD,OAAO;CACT;AACF;;AAGA,SAAS,4BAA4B,SAAiC;CACpE,OACE,CAAC,CAAC,YACDA,IAAe,OAAO,SAAS,0BAA0B,KACxDA,IAAe,cAAc,SAAS,0BAA0B;AAEtE;;;;;;;;;;;;;;AAeA,SAAS,2BACP,aACA,WAAW,OACO;CAClB,MAAM,iBAAiC;EACrC,UAAU;EACV,YAAY,aAAa;CAC3B;CACA,IAAI,UACF,OAAO,CAAC,cAAc;CAExB,OAAO;EACL;EACA;GAAE,UAAU;GAAQ,YAAY,aAAa;EAAK;EAClD;GAAE,UAAU;GAAO,YAAY,aAAa;EAAI;EAChD;GAAE,UAAU;GAAU,YAAY,aAAa;EAAG;EAClD;GAAE,UAAU;GAAQ,YAAY,aAAa;EAAK;CACpD;AACF;;;;;AAMA,eAAsB,gBAAgB,EACpC,iBACA,aACA,UAC0D;CAC1D,MAAM,eAAe,gBAAgB,eAAe;CACpD,MAAM,0BAA0B,MAAM,cAAc,cAAc,MAAM;CACxE,IAAI,CAAC,yBAAyB;EAC5B,OAAO,MAAM,EAAE,aAAa,GAAG,yBAAyB;EACxD,OAAO;CACT;CAOA,MAAM,kBADY,aAAa,IAAI,yBACH,CAAC,CAAC,SAAS,MAAM;CAOjD,IAAI,2BAA2B;CAC/B,IAAI,CAAC,mBAAmB,OAAO,uBAQ7B,2BAA2B,4BAA4B,MAP7B,kBAAkB;EAC1C,SAAS;EACT,iBAAiB,CACf;GAAE,UAAU;GAAQ,YAAY,OAAO,aAAa;EAAK,CAC3D;EACA,QAAQ,CAAC;CACX,CAAC,CACiE;CAGpE,MAAM,WAAW,CAAC,mBAAmB;CACrC,IAAI,CAAC,mBAAmB,CAAC,UAAU;EACjC,OAAO,KAAK,KACV,EAAE,oBAAoB,2BAA2B,GACjD,4GACF;EACA,OAAO;CACT;CAEA,MAAM,EAAE,SAAS,QAAQ,cAAc,eAAe;CACtD,MAAM,YAAY,UAAU,aAAa;CAEzC,IAAI;CACJ,IAAI,OAAO,uBAOT,UAAU,YAAY,YADL,2BAA2B,YAAY;MAEnD;EACL,MAAM,QAAQ,YACX,KAAK,EAAE,cAAc,OAAO,CAAC,CAC7B,OAAO,gCAAgC,CAAC,CACxC,IAAI,KAAK,CAAC,CACV,KAAK,GAAG;EACX,UAAU,QACN,YAAY,UAAU,GAAG,UACzB,YAAY;CAClB;CAEA,MAAM,WAAqB,CAAC;CAC5B,IAAI,KACF,SAAS,WAAW;CAEtB,IAAI,UACF,SAAS,YAAY;CAEvB,MAAM,QAAQ,gBACZC,KAAe;EACb,UAAU;EACV,KAAK;CACP,CAAC,CACH;CACA,IAAI,OACF,SAAS,eAAe;CAG1B,MAAM,cAA2B;EAC/B,SAAS;EACT;EACA,iBAAiB,2BAA2B,OAAO,aAAa,QAAQ;EACxE,QAAQ,CAAC;CACX;CAMA,MAAM,WAAW,WACb,CAAC,OAAO,IACR,CAAC,cAAc,MAAM,MAAM,SAAS,eAAe,CAAC,KAAK,OAAO;CAEpE,IAAI;EACF,MAAM,KAAK,UAAU,WAAW;EAChC,MAAM,qBAAqB,MAAM,cAAc,cAAc,MAAM;EACnE,IAAI,CAAC,sBAAsB,4BAA4B,oBACrD,OAAO;EAGT,OAAO,MAAM,EAAE,aAAa,GAAG,kCAAkC;EACjE,OAAO,CACL,EACE,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF,CACF;CACF,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAGR,MAAM,cAAc;GAAC,IAAI;GAAQ,IAAI;GAAQ,IAAI;EAAO,CAAC,CACtD,OAAO,QAAQ,CAAC,CAChB,KAAK,IAAI;EAEZ,OAAO,KAAK;GAAE;GAAK;EAAa,GAAG,+BAA+B;EAClE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ;EACV,EACF,CACF;CACF;AACF"}
+{"version":3,"file":"artifacts.js","names":["miseVersioning","hostRules.find"],"sources":["../../../../lib/modules/manager/mise/artifacts.ts"],"sourcesContent":["import { isNonEmptyStringAndNotWhitespace, isString } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { findGithubToken } from '../../../util/check-token.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type {\n  ExecOptions,\n  ExtraEnv,\n  ToolConstraint,\n} from '../../../util/exec/types.ts';\nimport { readLocalFile } from '../../../util/fs/index.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { api as miseVersioning } from '../../versioning/semver/index.ts';\nimport type {\n  ToolConstraintsConfig,\n  UpdateArtifact,\n  UpdateArtifactsResult,\n} from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\nimport { getConfigType, getLockFileName } from './lockfile.ts';\n\n/**\n * First mise release that supports the features this manager relies on:\n * `MISE_SAFE=1` safe mode (a hard boundary against project config executing\n * code during `mise lock`) and `mise lock --bump` (advancing fuzzy selectors).\n *\n * Safe mode (jdx/mise#11146) and lockfile bumping (jdx/mise#11145) merged after\n * v2026.7.11 and first shipped in v2026.7.12.\n *\n * @see https://github.com/jdx/mise/pull/11146\n * @see https://github.com/jdx/mise/pull/11145\n * @see https://mise.jdx.dev/configuration/settings.html#safe\n */\nconst MISE_SAFE_MODE_MIN_VERSION = '2026.7.12';\n\n/**\n * Detects the mise version that will actually run, by executing `mise version`.\n * `mise version` only prints the binary's version — it does not load or execute\n * project configuration — so it is safe to run even without allowlisting.\n *\n * Output looks like `2026.7.12 macos-arm64 (2026-07-21)`; we take the leading\n * `major.minor.patch`. Returns `null` if the probe fails or cannot be parsed,\n * in which case callers fall back to the conservative (pre-safe-mode) behavior.\n */\nasync function detectMiseVersion(\n  execOptions: ExecOptions,\n): Promise<string | null> {\n  try {\n    const { stdout } = await exec('mise version', execOptions);\n    const version = regEx(/\\d+\\.\\d+\\.\\d+/).exec(stdout)?.[0];\n    if (version && miseVersioning.isVersion(version)) {\n      return version;\n    }\n    logger.debug({ stdout }, 'Could not parse mise version output');\n    return null;\n  } catch (err) {\n    logger.debug({ err }, 'Failed to determine mise version');\n    return null;\n  }\n}\n\n/** True when `version` is at or above the safe-mode / `--bump` release. */\nfunction versionSupportsSafeFeatures(version: string | null): boolean {\n  return (\n    !!version &&\n    (miseVersioning.equals(version, MISE_SAFE_MODE_MIN_VERSION) ||\n      miseVersioning.isGreaterThan(version, MISE_SAFE_MODE_MIN_VERSION))\n  );\n}\n\n/**\n * Resolver tools that mise may invoke while running `mise lock`, for instance to convert an inexact version like `1` against the npm registry.\n *\n * NOTE: this will install all relevant tools, regardless of what the given mise configuration uses.\n *\n * In safe mode these are unnecessary: npm version listing uses mise's built-in\n * registry HTTP client and go runs with `GOTOOLCHAIN=local`, so `mise lock`\n * resolves versions over HTTP without shelling out to node/npm/ruby.\n *\n * @see https://mise.jdx.dev/dev-tools/backends/npm.html\n * @see https://mise.jdx.dev/dev-tools/backends/go.html\n * @see https://mise.jdx.dev/dev-tools/backends/gem.html\n */\nasync function getMiseLockToolConstraints(\n  config: ToolConstraintsConfig,\n  miseConstraint: string | undefined,\n  safeMode = false,\n): Promise<ToolConstraint[]> {\n  const miseToolConstraint: ToolConstraint = {\n    toolName: 'mise',\n    constraint: miseConstraint,\n  };\n  if (safeMode) {\n    return [miseToolConstraint];\n  }\n  return [\n    miseToolConstraint,\n    {\n      toolName: 'node',\n      constraint: await resolveToolConstraint(config, 'node'),\n    },\n    {\n      toolName: 'npm',\n      constraint: await resolveToolConstraint(config, 'npm'),\n    },\n    {\n      // the golang tool is constrained by the `go` constraint\n      toolName: 'golang',\n      constraint: await resolveToolConstraint(config, 'go'),\n    },\n    {\n      toolName: 'ruby',\n      constraint: await resolveToolConstraint(config, 'ruby'),\n    },\n  ];\n}\n\n/**\n * Updates mise lock files when dependencies are updated.\n * Runs `mise lock` for lock file maintenance or `mise lock <tools>` for targeted updates.\n */\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  const lockFileName = getLockFileName(packageFileName);\n  const existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent) {\n    logger.debug({ lockFileName }, 'No mise lock file found');\n    return null;\n  }\n\n  // `mise lock` normally executes the project's mise config, so it requires\n  // `allowedUnsafeExecutions`. When the mise that will run supports safe mode,\n  // we instead run with `MISE_SAFE=1`, which is a hard boundary against the\n  // config executing code — so the allowlist is not required on that path.\n  const allowlist = GlobalConfig.get('allowedUnsafeExecutions');\n  const miseAllowlisted = allowlist.includes('mise');\n\n  // The mise version is needed to decide safe mode (untrusted path) and\n  // `mise lock --bump` (lock file maintenance). Detect it at runtime rather\n  // than requiring a pinned `constraints.mise`. Skip the probe when it cannot\n  // change the outcome: an allowlisted, non-maintenance run behaves the same\n  // regardless of version.\n  const miseConstraint = await resolveToolConstraint(config, 'mise');\n  let miseSupportsSafeFeatures = false;\n  if (!miseAllowlisted || config.isLockFileMaintenance) {\n    const miseVersion = await detectMiseVersion({\n      cwdFile: packageFileName,\n      toolConstraints: [{ toolName: 'mise', constraint: miseConstraint }],\n      docker: {},\n    });\n    miseSupportsSafeFeatures = versionSupportsSafeFeatures(miseVersion);\n  }\n\n  const safeMode = !miseAllowlisted && miseSupportsSafeFeatures;\n  if (!miseAllowlisted && !safeMode) {\n    logger.once.warn(\n      { safeModeMinVersion: MISE_SAFE_MODE_MIN_VERSION },\n      '`mise lock` requires either `mise` in `allowedUnsafeExecutions`, or a mise version that supports safe mode',\n    );\n    return null;\n  }\n\n  const { isLocal, env } = getConfigType(packageFileName);\n  const localFlag = isLocal ? ' --local' : '';\n\n  let lockCmd: string;\n  if (config.isLockFileMaintenance) {\n    // Lock file maintenance means \"update to the latest versions\". Plain\n    // `mise lock` only refreshes metadata for already-locked versions, so use\n    // `mise lock --bump` to also advance fuzzy selectors (e.g. `node = \"22\"`)\n    // to the latest matching version. `--bump` requires a new enough mise, so\n    // fall back to a plain refresh when the version cannot be guaranteed.\n    const bumpFlag = miseSupportsSafeFeatures ? ' --bump' : '';\n    lockCmd = `mise lock${localFlag}${bumpFlag}`;\n  } else {\n    const tools = updatedDeps\n      .map(({ depName }) => depName)\n      .filter(isNonEmptyStringAndNotWhitespace)\n      .map(quote)\n      .join(' ');\n    lockCmd = tools\n      ? `mise lock${localFlag} ${tools}`\n      : `mise lock${localFlag}`;\n  }\n\n  const extraEnv: ExtraEnv = {};\n  if (env) {\n    extraEnv.MISE_ENV = env;\n  }\n  if (safeMode) {\n    extraEnv.MISE_SAFE = '1';\n  }\n  const token = findGithubToken(\n    hostRules.find({\n      hostType: 'github',\n      url: 'https://api.github.com/',\n    }),\n  );\n  if (token) {\n    extraEnv.GITHUB_TOKEN = token;\n  }\n\n  const execOptions: ExecOptions = {\n    cwdFile: packageFileName,\n    extraEnv,\n    toolConstraints: await getMiseLockToolConstraints(\n      config,\n      miseConstraint,\n      safeMode,\n    ),\n    docker: {},\n  };\n\n  // `mise trust` is only needed on the allowlisted path. In safe mode mise\n  // loads untrusted config without a trust prompt (the config is inert — it\n  // can neither execute code nor inject environment), so the trust step is\n  // unnecessary and is skipped.\n  const commands = safeMode\n    ? [lockCmd]\n    : [`mise trust ${quote(upath.basename(packageFileName))}`, lockCmd];\n\n  try {\n    await exec(commands, execOptions);\n    const newLockFileContent = await readLocalFile(lockFileName, 'utf8');\n    if (!newLockFileContent || existingLockFileContent === newLockFileContent) {\n      return null;\n    }\n\n    logger.debug({ lockFileName }, 'Returning updated mise lock file');\n    return [\n      {\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: newLockFileContent,\n        },\n      },\n    ];\n  } catch (err) {\n    // istanbul ignore if: not worth testing\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n\n    const errorOutput = [err.stdout, err.stderr, err.message]\n      .filter(isString)\n      .join('\\n');\n\n    logger.warn({ err, lockFileName }, 'Error updating mise lock file');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: errorOutput,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,MAAM,6BAA6B;;;;;;;;;;AAWnC,eAAe,kBACb,aACwB;CACxB,IAAI;EACF,MAAM,EAAE,WAAW,MAAM,KAAK,gBAAgB,WAAW;EACzD,MAAM,UAAU,MAAM,eAAe,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG;EACtD,IAAI,WAAWA,IAAe,UAAU,OAAO,GAC7C,OAAO;EAET,OAAO,MAAM,EAAE,OAAO,GAAG,qCAAqC;EAC9D,OAAO;CACT,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,kCAAkC;EACxD,OAAO;CACT;AACF;;AAGA,SAAS,4BAA4B,SAAiC;CACpE,OACE,CAAC,CAAC,YACDA,IAAe,OAAO,SAAS,0BAA0B,KACxDA,IAAe,cAAc,SAAS,0BAA0B;AAEtE;;;;;;;;;;;;;;AAeA,eAAe,2BACb,QACA,gBACA,WAAW,OACgB;CAC3B,MAAM,qBAAqC;EACzC,UAAU;EACV,YAAY;CACd;CACA,IAAI,UACF,OAAO,CAAC,kBAAkB;CAE5B,OAAO;EACL;EACA;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,MAAM;EACxD;EACA;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,KAAK;EACvD;EACA;GAEE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,IAAI;EACtD;EACA;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,MAAM;EACxD;CACF;AACF;;;;;AAMA,eAAsB,gBAAgB,EACpC,iBACA,aACA,UAC0D;CAC1D,MAAM,eAAe,gBAAgB,eAAe;CACpD,MAAM,0BAA0B,MAAM,cAAc,cAAc,MAAM;CACxE,IAAI,CAAC,yBAAyB;EAC5B,OAAO,MAAM,EAAE,aAAa,GAAG,yBAAyB;EACxD,OAAO;CACT;CAOA,MAAM,kBADY,aAAa,IAAI,yBACH,CAAC,CAAC,SAAS,MAAM;CAOjD,MAAM,iBAAiB,MAAM,sBAAsB,QAAQ,MAAM;CACjE,IAAI,2BAA2B;CAC/B,IAAI,CAAC,mBAAmB,OAAO,uBAM7B,2BAA2B,4BAA4B,MAL7B,kBAAkB;EAC1C,SAAS;EACT,iBAAiB,CAAC;GAAE,UAAU;GAAQ,YAAY;EAAe,CAAC;EAClE,QAAQ,CAAC;CACX,CAAC,CACiE;CAGpE,MAAM,WAAW,CAAC,mBAAmB;CACrC,IAAI,CAAC,mBAAmB,CAAC,UAAU;EACjC,OAAO,KAAK,KACV,EAAE,oBAAoB,2BAA2B,GACjD,4GACF;EACA,OAAO;CACT;CAEA,MAAM,EAAE,SAAS,QAAQ,cAAc,eAAe;CACtD,MAAM,YAAY,UAAU,aAAa;CAEzC,IAAI;CACJ,IAAI,OAAO,uBAOT,UAAU,YAAY,YADL,2BAA2B,YAAY;MAEnD;EACL,MAAM,QAAQ,YACX,KAAK,EAAE,cAAc,OAAO,CAAC,CAC7B,OAAO,gCAAgC,CAAC,CACxC,IAAI,KAAK,CAAC,CACV,KAAK,GAAG;EACX,UAAU,QACN,YAAY,UAAU,GAAG,UACzB,YAAY;CAClB;CAEA,MAAM,WAAqB,CAAC;CAC5B,IAAI,KACF,SAAS,WAAW;CAEtB,IAAI,UACF,SAAS,YAAY;CAEvB,MAAM,QAAQ,gBACZC,KAAe;EACb,UAAU;EACV,KAAK;CACP,CAAC,CACH;CACA,IAAI,OACF,SAAS,eAAe;CAG1B,MAAM,cAA2B;EAC/B,SAAS;EACT;EACA,iBAAiB,MAAM,2BACrB,QACA,gBACA,QACF;EACA,QAAQ,CAAC;CACX;CAMA,MAAM,WAAW,WACb,CAAC,OAAO,IACR,CAAC,cAAc,MAAM,MAAM,SAAS,eAAe,CAAC,KAAK,OAAO;CAEpE,IAAI;EACF,MAAM,KAAK,UAAU,WAAW;EAChC,MAAM,qBAAqB,MAAM,cAAc,cAAc,MAAM;EACnE,IAAI,CAAC,sBAAsB,4BAA4B,oBACrD,OAAO;EAGT,OAAO,MAAM,EAAE,aAAa,GAAG,kCAAkC;EACjE,OAAO,CACL,EACE,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF,CACF;CACF,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAGR,MAAM,cAAc;GAAC,IAAI;GAAQ,IAAI;GAAQ,IAAI;EAAO,CAAC,CACtD,OAAO,QAAQ,CAAC,CAChB,KAAK,IAAI;EAEZ,OAAO,KAAK;GAAE;GAAK;EAAa,GAAG,+BAA+B;EAClE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ;EACV,EACF,CACF;CACF;AACF"}

package/dist/modules/manager/mix/artifacts.js

@@ -5,6 +5,7 @@ import { logger } from "../../../logger/index.js";
 import { find, getAll } from "../../../util/host-rules.js";
 import { deleteLocalFile, ensureCacheDir, findLocalSiblingOrParent, getSiblingFileName, localPathExists, readLocalFile, writeLocalFile } from "../../../util/fs/index.js";
 import { exec } from "../../../util/exec/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { isEmptyArray, isString } from "@sindresorhus/is";
 import { quote } from "shlex";
 //#region lib/modules/manager/mix/artifacts.ts
@@ -84,10 +85,10 @@ async function updateArtifacts({ packageFileName, updatedDeps, newPackageFileCon
 		docker: {},
 		toolConstraints: [{
 			toolName: "erlang",
-			constraint: config.constraints?.erlang ?? `^26`
+			constraint: await resolveToolConstraint(config, "erlang") ?? `^26`
 		}, {
 			toolName: "elixir",
-			constraint: config.constraints?.elixir
+			constraint: await resolveToolConstraint(config, "elixir")
 		}],
 		preCommands
 	};

package/dist/modules/manager/mix/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":["hostRules\n    .getAll","hostRules.find"],"sources":["../../../../lib/modules/manager/mix/artifacts.ts"],"sourcesContent":["import { isEmptyArray, isString } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  deleteLocalFile,\n  ensureCacheDir,\n  findLocalSiblingOrParent,\n  getSiblingFileName,\n  localPathExists,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { regEx } from '../../../util/regex.ts';\n\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\n\nconst hexRepoUrl = 'https://hex.pm/';\nconst hexRepoOrgUrlRegex = regEx(\n  `^https://hex\\\\.pm/api/repos/(?<organization>[a-z0-9_]+)/$`,\n);\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`mix.getArtifacts(${packageFileName})`);\n  const { isLockFileMaintenance } = config;\n\n  if (isEmptyArray(updatedDeps) && !isLockFileMaintenance) {\n    logger.debug('No updated mix deps');\n    return null;\n  }\n\n  let lockFileName = getSiblingFileName(packageFileName, 'mix.lock');\n  let isUmbrella = false;\n\n  let existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent) {\n    const lockFileError = await checkLockFileReadError(lockFileName);\n    if (lockFileError) {\n      return lockFileError;\n    }\n\n    const parentLockFileName = await findLocalSiblingOrParent(\n      packageFileName,\n      'mix.lock',\n    );\n    existingLockFileContent =\n      parentLockFileName && (await readLocalFile(parentLockFileName, 'utf8'));\n\n    if (parentLockFileName && existingLockFileContent) {\n      lockFileName = parentLockFileName;\n      isUmbrella = true;\n    } else if (parentLockFileName) {\n      const lockFileError = await checkLockFileReadError(parentLockFileName);\n      if (lockFileError) {\n        return lockFileError;\n      }\n    }\n  }\n\n  if (isLockFileMaintenance && isUmbrella) {\n    logger.debug(\n      `Cannot use lockFileMaintenance in an umbrella project, see ${GlobalConfig.get('productLinks').documentation}modules/manager/mix/#lockFileMaintenance`,\n    );\n    return null;\n  }\n\n  if (isLockFileMaintenance && !existingLockFileContent) {\n    logger.debug(\n      'Cannot use lockFileMaintenance when no mix.lock file is present',\n    );\n    return null;\n  }\n\n  try {\n    await writeLocalFile(packageFileName, newPackageFileContent);\n    if (isLockFileMaintenance) {\n      await deleteLocalFile(lockFileName);\n    }\n  } catch (err) {\n    logger.warn({ err }, 'mix.exs could not be written');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n\n  if (!existingLockFileContent) {\n    logger.debug('No mix.lock found');\n    return null;\n  }\n\n  const organizations = new Set<string>();\n\n  const hexHostRulesWithMatchHost = hostRules\n    .getAll()\n    .filter(\n      (hostRule) =>\n        !!hostRule.matchHost && hexRepoOrgUrlRegex.test(hostRule.matchHost),\n    );\n\n  for (const { matchHost } of hexHostRulesWithMatchHost) {\n    if (matchHost) {\n      const result = hexRepoOrgUrlRegex.exec(matchHost);\n\n      if (result?.groups) {\n        const { organization } = result.groups;\n        organizations.add(organization);\n      }\n    }\n  }\n\n  for (const { packageName } of updatedDeps) {\n    if (packageName) {\n      const [, organization] = packageName.split(':');\n\n      if (organization) {\n        organizations.add(organization);\n      }\n    }\n  }\n\n  const preCommands = Array.from(organizations).reduce((acc, organization) => {\n    const url = `${hexRepoUrl}api/repos/${organization}/`;\n    const { token } = hostRules.find({ url });\n\n    if (token) {\n      logger.debug(`Authenticating to hex organization ${organization}`);\n      const authCommand = `mix hex.organization auth ${quote(organization)} --key ${quote(token)}`;\n      return [...acc, authCommand];\n    }\n\n    return acc;\n  }, [] as string[]);\n\n  // renovate: will update this\n  const erlangVersion = '26';\n\n  const execOptions: ExecOptions = {\n    extraEnv: {\n      // https://hexdocs.pm/mix/1.15.0/Mix.Tasks.Archive.html\n      // TODO: should include a version constraint\n      MIX_ARCHIVES: await ensureCacheDir('mix_archives'),\n    },\n    cwdFile: lockFileName,\n    docker: {},\n    toolConstraints: [\n      {\n        toolName: 'erlang',\n        // https://hexdocs.pm/elixir/1.14.5/compatibility-and-deprecations.html#compatibility-between-elixir-and-erlang-otp\n        constraint: config.constraints?.erlang ?? `^${erlangVersion}`,\n      },\n      {\n        toolName: 'elixir',\n        constraint: config.constraints?.elixir,\n      },\n    ],\n    preCommands,\n  };\n\n  let command: string;\n  if (isLockFileMaintenance) {\n    command = 'mix deps.get';\n  } else {\n    command = [\n      'mix',\n      'deps.update',\n      ...updatedDeps\n        .map((dep) => dep.depName)\n        .filter(isString)\n        .map((dep) => quote(dep)),\n    ].join(' ');\n  }\n\n  try {\n    await exec(command, execOptions);\n  } catch (err) {\n    /* v8 ignore if -- defensive rethrow of TEMPORARY_ERROR from exec, not reproduced in mix specs */\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n\n    logger.debug(\n      { err, message: err.message, command },\n      'Failed to update Mix lock file',\n    );\n\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n\n  const newMixLockContent = await readLocalFile(lockFileName, 'utf8');\n  if (existingLockFileContent === newMixLockContent) {\n    logger.debug('mix.lock is unchanged');\n    return null;\n  }\n  logger.debug('Returning updated mix.lock');\n  return [\n    {\n      file: {\n        type: 'addition',\n        path: lockFileName,\n        contents: newMixLockContent,\n      },\n    },\n  ];\n}\n\nasync function checkLockFileReadError(\n  lockFileName: string,\n): Promise<UpdateArtifactsResult[] | null> {\n  if (await localPathExists(lockFileName)) {\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: `Error reading ${lockFileName}`,\n        },\n      },\n    ];\n  }\n  return null;\n}\n"],"mappings":";;;;;;;;;;AAqBA,MAAM,aAAa;AACnB,MAAM,qBAAqB,MACzB,2DACF;AAEA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,oBAAoB,gBAAgB,EAAE;CACnD,MAAM,EAAE,0BAA0B;CAElC,IAAI,aAAa,WAAW,KAAK,CAAC,uBAAuB;EACvD,OAAO,MAAM,qBAAqB;EAClC,OAAO;CACT;CAEA,IAAI,eAAe,mBAAmB,iBAAiB,UAAU;CACjE,IAAI,aAAa;CAEjB,IAAI,0BAA0B,MAAM,cAAc,cAAc,MAAM;CACtE,IAAI,CAAC,yBAAyB;EAC5B,MAAM,gBAAgB,MAAM,uBAAuB,YAAY;EAC/D,IAAI,eACF,OAAO;EAGT,MAAM,qBAAqB,MAAM,yBAC/B,iBACA,UACF;EACA,0BACE,sBAAuB,MAAM,cAAc,oBAAoB,MAAM;EAEvE,IAAI,sBAAsB,yBAAyB;GACjD,eAAe;GACf,aAAa;EACf,OAAO,IAAI,oBAAoB;GAC7B,MAAM,gBAAgB,MAAM,uBAAuB,kBAAkB;GACrE,IAAI,eACF,OAAO;EAEX;CACF;CAEA,IAAI,yBAAyB,YAAY;EACvC,OAAO,MACL,8DAA8D,aAAa,IAAI,cAAc,CAAC,CAAC,cAAc,yCAC/G;EACA,OAAO;CACT;CAEA,IAAI,yBAAyB,CAAC,yBAAyB;EACrD,OAAO,MACL,iEACF;EACA,OAAO;CACT;CAEA,IAAI;EACF,MAAM,eAAe,iBAAiB,qBAAqB;EAC3D,IAAI,uBACF,MAAM,gBAAgB,YAAY;CAEtC,SAAS,KAAK;EACZ,OAAO,KAAK,EAAE,IAAI,GAAG,8BAA8B;EACnD,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;CAEA,IAAI,CAAC,yBAAyB;EAC5B,OAAO,MAAM,mBAAmB;EAChC,OAAO;CACT;CAEA,MAAM,gCAAgB,IAAI,IAAY;CAEtC,MAAM,4BAA4BA,OACxB,CAAC,CACR,QACE,aACC,CAAC,CAAC,SAAS,aAAa,mBAAmB,KAAK,SAAS,SAAS,CACtE;CAEF,KAAK,MAAM,EAAE,eAAe,2BAC1B,IAAI,WAAW;EACb,MAAM,SAAS,mBAAmB,KAAK,SAAS;EAEhD,IAAI,QAAQ,QAAQ;GAClB,MAAM,EAAE,iBAAiB,OAAO;GAChC,cAAc,IAAI,YAAY;EAChC;CACF;CAGF,KAAK,MAAM,EAAE,iBAAiB,aAC5B,IAAI,aAAa;EACf,MAAM,GAAG,gBAAgB,YAAY,MAAM,GAAG;EAE9C,IAAI,cACF,cAAc,IAAI,YAAY;CAElC;CAGF,MAAM,cAAc,MAAM,KAAK,aAAa,CAAC,CAAC,QAAQ,KAAK,iBAAiB;EAC1E,MAAM,MAAM,GAAG,WAAW,YAAY,aAAa;EACnD,MAAM,EAAE,UAAUC,KAAe,EAAE,IAAI,CAAC;EAExC,IAAI,OAAO;GACT,OAAO,MAAM,sCAAsC,cAAc;GACjE,MAAM,cAAc,6BAA6B,MAAM,YAAY,EAAE,SAAS,MAAM,KAAK;GACzF,OAAO,CAAC,GAAG,KAAK,WAAW;EAC7B;EAEA,OAAO;CACT,GAAG,CAAC,CAAa;CAKjB,MAAM,cAA2B;EAC/B,UAAU,EAGR,cAAc,MAAM,eAAe,cAAc,EACnD;EACA,SAAS;EACT,QAAQ,CAAC;EACT,iBAAiB,CACf;GACE,UAAU;GAEV,YAAY,OAAO,aAAa,UAAU;EAC5C,GACA;GACE,UAAU;GACV,YAAY,OAAO,aAAa;EAClC,CACF;EACA;CACF;CAEA,IAAI;CACJ,IAAI,uBACF,UAAU;MAEV,UAAU;EACR;EACA;EACA,GAAG,YACA,KAAK,QAAQ,IAAI,OAAO,CAAC,CACzB,OAAO,QAAQ,CAAC,CAChB,KAAK,QAAQ,MAAM,GAAG,CAAC;CAC5B,CAAC,CAAC,KAAK,GAAG;CAGZ,IAAI;EACF,MAAM,KAAK,SAAS,WAAW;CACjC,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAGR,OAAO,MACL;GAAE;GAAK,SAAS,IAAI;GAAS;EAAQ,GACrC,gCACF;EAEA,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;CAEA,MAAM,oBAAoB,MAAM,cAAc,cAAc,MAAM;CAClE,IAAI,4BAA4B,mBAAmB;EACjD,OAAO,MAAM,uBAAuB;EACpC,OAAO;CACT;CACA,OAAO,MAAM,4BAA4B;CACzC,OAAO,CACL,EACE,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU;CACZ,EACF,CACF;AACF;AAEA,eAAe,uBACb,cACyC;CACzC,IAAI,MAAM,gBAAgB,YAAY,GACpC,OAAO,CACL,EACE,eAAe;EACb,UAAU;EACV,QAAQ,iBAAiB;CAC3B,EACF,CACF;CAEF,OAAO;AACT"}
+{"version":3,"file":"artifacts.js","names":["hostRules\n    .getAll","hostRules.find"],"sources":["../../../../lib/modules/manager/mix/artifacts.ts"],"sourcesContent":["import { isEmptyArray, isString } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  deleteLocalFile,\n  ensureCacheDir,\n  findLocalSiblingOrParent,\n  getSiblingFileName,\n  localPathExists,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { regEx } from '../../../util/regex.ts';\n\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\n\nconst hexRepoUrl = 'https://hex.pm/';\nconst hexRepoOrgUrlRegex = regEx(\n  `^https://hex\\\\.pm/api/repos/(?<organization>[a-z0-9_]+)/$`,\n);\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`mix.getArtifacts(${packageFileName})`);\n  const { isLockFileMaintenance } = config;\n\n  if (isEmptyArray(updatedDeps) && !isLockFileMaintenance) {\n    logger.debug('No updated mix deps');\n    return null;\n  }\n\n  let lockFileName = getSiblingFileName(packageFileName, 'mix.lock');\n  let isUmbrella = false;\n\n  let existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent) {\n    const lockFileError = await checkLockFileReadError(lockFileName);\n    if (lockFileError) {\n      return lockFileError;\n    }\n\n    const parentLockFileName = await findLocalSiblingOrParent(\n      packageFileName,\n      'mix.lock',\n    );\n    existingLockFileContent =\n      parentLockFileName && (await readLocalFile(parentLockFileName, 'utf8'));\n\n    if (parentLockFileName && existingLockFileContent) {\n      lockFileName = parentLockFileName;\n      isUmbrella = true;\n    } else if (parentLockFileName) {\n      const lockFileError = await checkLockFileReadError(parentLockFileName);\n      if (lockFileError) {\n        return lockFileError;\n      }\n    }\n  }\n\n  if (isLockFileMaintenance && isUmbrella) {\n    logger.debug(\n      `Cannot use lockFileMaintenance in an umbrella project, see ${GlobalConfig.get('productLinks').documentation}modules/manager/mix/#lockFileMaintenance`,\n    );\n    return null;\n  }\n\n  if (isLockFileMaintenance && !existingLockFileContent) {\n    logger.debug(\n      'Cannot use lockFileMaintenance when no mix.lock file is present',\n    );\n    return null;\n  }\n\n  try {\n    await writeLocalFile(packageFileName, newPackageFileContent);\n    if (isLockFileMaintenance) {\n      await deleteLocalFile(lockFileName);\n    }\n  } catch (err) {\n    logger.warn({ err }, 'mix.exs could not be written');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n\n  if (!existingLockFileContent) {\n    logger.debug('No mix.lock found');\n    return null;\n  }\n\n  const organizations = new Set<string>();\n\n  const hexHostRulesWithMatchHost = hostRules\n    .getAll()\n    .filter(\n      (hostRule) =>\n        !!hostRule.matchHost && hexRepoOrgUrlRegex.test(hostRule.matchHost),\n    );\n\n  for (const { matchHost } of hexHostRulesWithMatchHost) {\n    if (matchHost) {\n      const result = hexRepoOrgUrlRegex.exec(matchHost);\n\n      if (result?.groups) {\n        const { organization } = result.groups;\n        organizations.add(organization);\n      }\n    }\n  }\n\n  for (const { packageName } of updatedDeps) {\n    if (packageName) {\n      const [, organization] = packageName.split(':');\n\n      if (organization) {\n        organizations.add(organization);\n      }\n    }\n  }\n\n  const preCommands = Array.from(organizations).reduce((acc, organization) => {\n    const url = `${hexRepoUrl}api/repos/${organization}/`;\n    const { token } = hostRules.find({ url });\n\n    if (token) {\n      logger.debug(`Authenticating to hex organization ${organization}`);\n      const authCommand = `mix hex.organization auth ${quote(organization)} --key ${quote(token)}`;\n      return [...acc, authCommand];\n    }\n\n    return acc;\n  }, [] as string[]);\n\n  // renovate: will update this\n  const erlangVersion = '26';\n\n  const execOptions: ExecOptions = {\n    extraEnv: {\n      // https://hexdocs.pm/mix/1.15.0/Mix.Tasks.Archive.html\n      // TODO: should include a version constraint\n      MIX_ARCHIVES: await ensureCacheDir('mix_archives'),\n    },\n    cwdFile: lockFileName,\n    docker: {},\n    toolConstraints: [\n      {\n        toolName: 'erlang',\n        // https://hexdocs.pm/elixir/1.14.5/compatibility-and-deprecations.html#compatibility-between-elixir-and-erlang-otp\n        constraint:\n          (await resolveToolConstraint(config, 'erlang')) ??\n          `^${erlangVersion}`,\n      },\n      {\n        toolName: 'elixir',\n        constraint: await resolveToolConstraint(config, 'elixir'),\n      },\n    ],\n    preCommands,\n  };\n\n  let command: string;\n  if (isLockFileMaintenance) {\n    command = 'mix deps.get';\n  } else {\n    command = [\n      'mix',\n      'deps.update',\n      ...updatedDeps\n        .map((dep) => dep.depName)\n        .filter(isString)\n        .map((dep) => quote(dep)),\n    ].join(' ');\n  }\n\n  try {\n    await exec(command, execOptions);\n  } catch (err) {\n    /* v8 ignore if -- defensive rethrow of TEMPORARY_ERROR from exec, not reproduced in mix specs */\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n\n    logger.debug(\n      { err, message: err.message, command },\n      'Failed to update Mix lock file',\n    );\n\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n\n  const newMixLockContent = await readLocalFile(lockFileName, 'utf8');\n  if (existingLockFileContent === newMixLockContent) {\n    logger.debug('mix.lock is unchanged');\n    return null;\n  }\n  logger.debug('Returning updated mix.lock');\n  return [\n    {\n      file: {\n        type: 'addition',\n        path: lockFileName,\n        contents: newMixLockContent,\n      },\n    },\n  ];\n}\n\nasync function checkLockFileReadError(\n  lockFileName: string,\n): Promise<UpdateArtifactsResult[] | null> {\n  if (await localPathExists(lockFileName)) {\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: `Error reading ${lockFileName}`,\n        },\n      },\n    ];\n  }\n  return null;\n}\n"],"mappings":";;;;;;;;;;;AAsBA,MAAM,aAAa;AACnB,MAAM,qBAAqB,MACzB,2DACF;AAEA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,oBAAoB,gBAAgB,EAAE;CACnD,MAAM,EAAE,0BAA0B;CAElC,IAAI,aAAa,WAAW,KAAK,CAAC,uBAAuB;EACvD,OAAO,MAAM,qBAAqB;EAClC,OAAO;CACT;CAEA,IAAI,eAAe,mBAAmB,iBAAiB,UAAU;CACjE,IAAI,aAAa;CAEjB,IAAI,0BAA0B,MAAM,cAAc,cAAc,MAAM;CACtE,IAAI,CAAC,yBAAyB;EAC5B,MAAM,gBAAgB,MAAM,uBAAuB,YAAY;EAC/D,IAAI,eACF,OAAO;EAGT,MAAM,qBAAqB,MAAM,yBAC/B,iBACA,UACF;EACA,0BACE,sBAAuB,MAAM,cAAc,oBAAoB,MAAM;EAEvE,IAAI,sBAAsB,yBAAyB;GACjD,eAAe;GACf,aAAa;EACf,OAAO,IAAI,oBAAoB;GAC7B,MAAM,gBAAgB,MAAM,uBAAuB,kBAAkB;GACrE,IAAI,eACF,OAAO;EAEX;CACF;CAEA,IAAI,yBAAyB,YAAY;EACvC,OAAO,MACL,8DAA8D,aAAa,IAAI,cAAc,CAAC,CAAC,cAAc,yCAC/G;EACA,OAAO;CACT;CAEA,IAAI,yBAAyB,CAAC,yBAAyB;EACrD,OAAO,MACL,iEACF;EACA,OAAO;CACT;CAEA,IAAI;EACF,MAAM,eAAe,iBAAiB,qBAAqB;EAC3D,IAAI,uBACF,MAAM,gBAAgB,YAAY;CAEtC,SAAS,KAAK;EACZ,OAAO,KAAK,EAAE,IAAI,GAAG,8BAA8B;EACnD,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;CAEA,IAAI,CAAC,yBAAyB;EAC5B,OAAO,MAAM,mBAAmB;EAChC,OAAO;CACT;CAEA,MAAM,gCAAgB,IAAI,IAAY;CAEtC,MAAM,4BAA4BA,OACxB,CAAC,CACR,QACE,aACC,CAAC,CAAC,SAAS,aAAa,mBAAmB,KAAK,SAAS,SAAS,CACtE;CAEF,KAAK,MAAM,EAAE,eAAe,2BAC1B,IAAI,WAAW;EACb,MAAM,SAAS,mBAAmB,KAAK,SAAS;EAEhD,IAAI,QAAQ,QAAQ;GAClB,MAAM,EAAE,iBAAiB,OAAO;GAChC,cAAc,IAAI,YAAY;EAChC;CACF;CAGF,KAAK,MAAM,EAAE,iBAAiB,aAC5B,IAAI,aAAa;EACf,MAAM,GAAG,gBAAgB,YAAY,MAAM,GAAG;EAE9C,IAAI,cACF,cAAc,IAAI,YAAY;CAElC;CAGF,MAAM,cAAc,MAAM,KAAK,aAAa,CAAC,CAAC,QAAQ,KAAK,iBAAiB;EAC1E,MAAM,MAAM,GAAG,WAAW,YAAY,aAAa;EACnD,MAAM,EAAE,UAAUC,KAAe,EAAE,IAAI,CAAC;EAExC,IAAI,OAAO;GACT,OAAO,MAAM,sCAAsC,cAAc;GACjE,MAAM,cAAc,6BAA6B,MAAM,YAAY,EAAE,SAAS,MAAM,KAAK;GACzF,OAAO,CAAC,GAAG,KAAK,WAAW;EAC7B;EAEA,OAAO;CACT,GAAG,CAAC,CAAa;CAKjB,MAAM,cAA2B;EAC/B,UAAU,EAGR,cAAc,MAAM,eAAe,cAAc,EACnD;EACA,SAAS;EACT,QAAQ,CAAC;EACT,iBAAiB,CACf;GACE,UAAU;GAEV,YACG,MAAM,sBAAsB,QAAQ,QAAQ,KAC7C;EACJ,GACA;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,QAAQ;EAC1D,CACF;EACA;CACF;CAEA,IAAI;CACJ,IAAI,uBACF,UAAU;MAEV,UAAU;EACR;EACA;EACA,GAAG,YACA,KAAK,QAAQ,IAAI,OAAO,CAAC,CACzB,OAAO,QAAQ,CAAC,CAChB,KAAK,QAAQ,MAAM,GAAG,CAAC;CAC5B,CAAC,CAAC,KAAK,GAAG;CAGZ,IAAI;EACF,MAAM,KAAK,SAAS,WAAW;CACjC,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAGR,OAAO,MACL;GAAE;GAAK,SAAS,IAAI;GAAS;EAAQ,GACrC,gCACF;EAEA,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;CAEA,MAAM,oBAAoB,MAAM,cAAc,cAAc,MAAM;CAClE,IAAI,4BAA4B,mBAAmB;EACjD,OAAO,MAAM,uBAAuB;EACpC,OAAO;CACT;CACA,OAAO,MAAM,4BAA4B;CACzC,OAAO,CACL,EACE,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU;CACZ,EACF,CACF;AACF;AAEA,eAAe,uBACb,cACyC;CACzC,IAAI,MAAM,gBAAgB,YAAY,GACpC,OAAO,CACL,EACE,eAAe;EACb,UAAU;EACV,QAAQ,iBAAiB;CAC3B,EACF,CACF;CAEF,OAAO;AACT"}

package/dist/modules/manager/nix/artifacts.js

@@ -4,6 +4,7 @@ import { find } from "../../../util/host-rules.js";
 import { readLocalFile } from "../../../util/fs/index.js";
 import { exec } from "../../../util/exec/index.js";
 import { getRepoStatus } from "../../../util/git/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { findGithubToken } from "../../../util/check-token.js";
 import { isNonEmptyStringAndNotWhitespace } from "@sindresorhus/is";
 import { quote } from "shlex";
@@ -29,7 +30,7 @@ async function updateArtifacts({ packageFileName, config, updatedDeps }) {
 		cwdFile: packageFileName,
 		toolConstraints: [{
 			toolName: "nix",
-			constraint: config.constraints?.nix
+			constraint: await resolveToolConstraint(config, "nix")
 		}],
 		docker: {}
 	};

package/dist/modules/manager/nix/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":["hostRules.find"],"sources":["../../../../lib/modules/manager/nix/artifacts.ts"],"sourcesContent":["import { isNonEmptyStringAndNotWhitespace } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport { logger } from '../../../logger/index.ts';\nimport { findGithubToken } from '../../../util/check-token.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport { readLocalFile } from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\n\nexport async function updateArtifacts({\n  packageFileName,\n  config,\n  updatedDeps,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  const lockFileName = packageFileName.replace(regEx(/\\.nix$/), '.lock');\n  const existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent) {\n    logger.debug('No flake.lock found');\n    return null;\n  }\n\n  let cmd = `nix --extra-experimental-features 'nix-command flakes' `;\n\n  const token = findGithubToken(\n    hostRules.find({\n      hostType: 'github',\n      url: 'https://api.github.com/',\n    }),\n  );\n\n  if (token) {\n    cmd += `--extra-access-tokens github.com=${quote(token)} `;\n  }\n\n  if (config.isLockFileMaintenance) {\n    cmd += 'flake update';\n  } else {\n    const inputs = updatedDeps\n      .map(({ depName }) => depName)\n      .filter(isNonEmptyStringAndNotWhitespace)\n      .map((depName) => quote(depName))\n      .join(' ');\n    cmd += `flake update ${inputs}`;\n  }\n  const execOptions: ExecOptions = {\n    cwdFile: packageFileName,\n    toolConstraints: [\n      {\n        toolName: 'nix',\n        constraint: config.constraints?.nix,\n      },\n    ],\n    docker: {},\n  };\n\n  try {\n    await exec(cmd, execOptions);\n\n    const status = await getRepoStatus();\n    if (!status.modified.includes(lockFileName)) {\n      return null;\n    }\n    logger.debug('Returning updated flake.lock');\n    return [\n      {\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: await readLocalFile(lockFileName),\n        },\n      },\n    ];\n  } catch (err) {\n    logger.warn({ err }, 'Error updating flake.lock');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;AAYA,eAAsB,gBAAgB,EACpC,iBACA,QACA,eAC0D;CAC1D,MAAM,eAAe,gBAAgB,QAAQ,MAAM,QAAQ,GAAG,OAAO;CAErE,IAAI,CAAC,MADiC,cAAc,cAAc,MAAM,GAC1C;EAC5B,OAAO,MAAM,qBAAqB;EAClC,OAAO;CACT;CAEA,IAAI,MAAM;CAEV,MAAM,QAAQ,gBACZA,KAAe;EACb,UAAU;EACV,KAAK;CACP,CAAC,CACH;CAEA,IAAI,OACF,OAAO,oCAAoC,MAAM,KAAK,EAAE;CAG1D,IAAI,OAAO,uBACT,OAAO;MACF;EACL,MAAM,SAAS,YACZ,KAAK,EAAE,cAAc,OAAO,CAAC,CAC7B,OAAO,gCAAgC,CAAC,CACxC,KAAK,YAAY,MAAM,OAAO,CAAC,CAAC,CAChC,KAAK,GAAG;EACX,OAAO,gBAAgB;CACzB;CACA,MAAM,cAA2B;EAC/B,SAAS;EACT,iBAAiB,CACf;GACE,UAAU;GACV,YAAY,OAAO,aAAa;EAClC,CACF;EACA,QAAQ,CAAC;CACX;CAEA,IAAI;EACF,MAAM,KAAK,KAAK,WAAW;EAG3B,IAAI,EAAC,MADgB,cAAc,EAAA,CACvB,SAAS,SAAS,YAAY,GACxC,OAAO;EAET,OAAO,MAAM,8BAA8B;EAC3C,OAAO,CACL,EACE,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU,MAAM,cAAc,YAAY;EAC5C,EACF,CACF;CACF,SAAS,KAAK;EACZ,OAAO,KAAK,EAAE,IAAI,GAAG,2BAA2B;EAChD,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF"}
+{"version":3,"file":"artifacts.js","names":["hostRules.find"],"sources":["../../../../lib/modules/manager/nix/artifacts.ts"],"sourcesContent":["import { isNonEmptyStringAndNotWhitespace } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport { logger } from '../../../logger/index.ts';\nimport { findGithubToken } from '../../../util/check-token.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport { readLocalFile } from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\n\nexport async function updateArtifacts({\n  packageFileName,\n  config,\n  updatedDeps,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  const lockFileName = packageFileName.replace(regEx(/\\.nix$/), '.lock');\n  const existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent) {\n    logger.debug('No flake.lock found');\n    return null;\n  }\n\n  let cmd = `nix --extra-experimental-features 'nix-command flakes' `;\n\n  const token = findGithubToken(\n    hostRules.find({\n      hostType: 'github',\n      url: 'https://api.github.com/',\n    }),\n  );\n\n  if (token) {\n    cmd += `--extra-access-tokens github.com=${quote(token)} `;\n  }\n\n  if (config.isLockFileMaintenance) {\n    cmd += 'flake update';\n  } else {\n    const inputs = updatedDeps\n      .map(({ depName }) => depName)\n      .filter(isNonEmptyStringAndNotWhitespace)\n      .map((depName) => quote(depName))\n      .join(' ');\n    cmd += `flake update ${inputs}`;\n  }\n  const execOptions: ExecOptions = {\n    cwdFile: packageFileName,\n    toolConstraints: [\n      {\n        toolName: 'nix',\n        constraint: await resolveToolConstraint(config, 'nix'),\n      },\n    ],\n    docker: {},\n  };\n\n  try {\n    await exec(cmd, execOptions);\n\n    const status = await getRepoStatus();\n    if (!status.modified.includes(lockFileName)) {\n      return null;\n    }\n    logger.debug('Returning updated flake.lock');\n    return [\n      {\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: await readLocalFile(lockFileName),\n        },\n      },\n    ];\n  } catch (err) {\n    logger.warn({ err }, 'Error updating flake.lock');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;AAaA,eAAsB,gBAAgB,EACpC,iBACA,QACA,eAC0D;CAC1D,MAAM,eAAe,gBAAgB,QAAQ,MAAM,QAAQ,GAAG,OAAO;CAErE,IAAI,CAAC,MADiC,cAAc,cAAc,MAAM,GAC1C;EAC5B,OAAO,MAAM,qBAAqB;EAClC,OAAO;CACT;CAEA,IAAI,MAAM;CAEV,MAAM,QAAQ,gBACZA,KAAe;EACb,UAAU;EACV,KAAK;CACP,CAAC,CACH;CAEA,IAAI,OACF,OAAO,oCAAoC,MAAM,KAAK,EAAE;CAG1D,IAAI,OAAO,uBACT,OAAO;MACF;EACL,MAAM,SAAS,YACZ,KAAK,EAAE,cAAc,OAAO,CAAC,CAC7B,OAAO,gCAAgC,CAAC,CACxC,KAAK,YAAY,MAAM,OAAO,CAAC,CAAC,CAChC,KAAK,GAAG;EACX,OAAO,gBAAgB;CACzB;CACA,MAAM,cAA2B;EAC/B,SAAS;EACT,iBAAiB,CACf;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,KAAK;EACvD,CACF;EACA,QAAQ,CAAC;CACX;CAEA,IAAI;EACF,MAAM,KAAK,KAAK,WAAW;EAG3B,IAAI,EAAC,MADgB,cAAc,EAAA,CACvB,SAAS,SAAS,YAAY,GACxC,OAAO;EAET,OAAO,MAAM,8BAA8B;EAC3C,OAAO,CACL,EACE,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU,MAAM,cAAc,YAAY;EAC5C,EACF,CACF;CACF,SAAS,KAAK;EACZ,OAAO,KAAK,EAAE,IAAI,GAAG,2BAA2B;EAChD,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF"}

package/dist/modules/manager/npm/artifacts.js

@@ -4,6 +4,7 @@ import { matchRegexOrGlob } from "../../../util/string-match.js";
 import { logger } from "../../../logger/index.js";
 import { ensureCacheDir, localPathExists, readLocalFile, writeLocalFile } from "../../../util/fs/index.js";
 import { exec } from "../../../util/exec/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { PNPM_CACHE_DIR, PNPM_STORE_DIR } from "./constants.js";
 import { getNodeToolConstraint } from "./post-update/node-version.js";
 import { processHostRules } from "./post-update/rules.js";
@@ -52,7 +53,7 @@ async function handlePackageManagerUpdates(updateArtifactsConfig) {
 		},
 		toolConstraints: [nodeConstraints, {
 			toolName: "corepack",
-			constraint: config.constraints?.corepack
+			constraint: await resolveToolConstraint(config, "corepack")
 		}],
 		docker: {}
 	};

package/dist/modules/manager/npm/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/npm/artifacts.ts"],"sourcesContent":["import { isEmptyArray, isNonEmptyObject, isString } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport type { Scalar, YAMLSeq } from 'yaml';\nimport { isScalar, isSeq, parseDocument } from 'yaml';\nimport { logger } from '../../../logger/index.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  ensureCacheDir,\n  localPathExists,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { coerceObject } from '../../../util/object.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { matchRegexOrGlob } from '../../../util/string-match.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { PNPM_CACHE_DIR, PNPM_STORE_DIR } from './constants.ts';\nimport { getNodeToolConstraint } from './post-update/node-version.ts';\nimport { processHostRules } from './post-update/rules.ts';\nimport { lazyLoadPackageJson } from './post-update/utils.ts';\nimport {\n  getNpmrcContent,\n  resetNpmrcContent,\n  updateNpmrcContent,\n} from './utils.ts';\n\n// eg. 8.15.5+sha256.4b4efa12490e5055d59b9b9fc9438b7d581a6b7af3b5675eb5c5f447cee1a589\nconst versionWithHashRegString = '^(?<version>.*)\\\\+(?<hash>.*)';\n\n// Execute 'corepack use' command for npm manager updates\n// This step is necessary because Corepack recommends attaching a hash after the version\n// The hash is generated only after running 'corepack use' and cannot be fetched from the npm registry\nexport async function updateArtifacts(\n  updateArtifactsConfig: UpdateArtifact,\n): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`npm.updateArtifacts(${updateArtifactsConfig.packageFileName})`);\n  let res: UpdateArtifactsResult[] = [];\n  res.push(\n    coerceObject(await handlePackageManagerUpdates(updateArtifactsConfig)),\n  );\n  res.push(coerceObject(await updatePnpmWorkspace(updateArtifactsConfig)));\n\n  res = res.filter(isNonEmptyObject);\n  if (res.length === 0) {\n    return null;\n  }\n\n  return res;\n}\n\nasync function handlePackageManagerUpdates(\n  updateArtifactsConfig: UpdateArtifact,\n): Promise<UpdateArtifactsResult | null> {\n  const {\n    packageFileName,\n    config,\n    updatedDeps,\n    newPackageFileContent: existingPackageFileContent,\n  } = updateArtifactsConfig;\n  const packageManagerUpdate = updatedDeps.find(\n    (dep) => dep.depType === 'packageManager',\n  );\n\n  if (!packageManagerUpdate) {\n    logger.debug('No packageManager updates - returning null');\n    return null;\n  }\n\n  const { currentValue, depName, newVersion } = packageManagerUpdate;\n\n  // Execute 'corepack use' command only if the currentValue already has hash in it\n  if (!currentValue || !regEx(versionWithHashRegString).test(currentValue)) {\n    return null;\n  }\n\n  // write old updates before executing corepack update so that they are not removed from package file\n  await writeLocalFile(packageFileName, existingPackageFileContent);\n\n  // Asumming that corepack only needs to modify the package.json file in the root folder\n  // As it should not be regular practice to have different package managers in different workspaces\n  const pkgFileDir = upath.dirname(packageFileName);\n  const { additionalNpmrcContent } = processHostRules();\n  const npmrcContent = await getNpmrcContent(pkgFileDir);\n  const lazyPkgJson = lazyLoadPackageJson(pkgFileDir);\n  const cmd = `corepack use ${quote(`${depName}@${newVersion}`)}`;\n\n  const nodeConstraints = await getNodeToolConstraint(\n    config,\n    updatedDeps,\n    pkgFileDir,\n    lazyPkgJson,\n  );\n\n  const pnpmConfigCacheDir = await ensureCacheDir(PNPM_CACHE_DIR);\n  const pnpmConfigStoreDir = await ensureCacheDir(PNPM_STORE_DIR);\n  const execOptions: ExecOptions = {\n    cwdFile: packageFileName,\n    extraEnv: {\n      // To make sure pnpm store location is consistent between \"corepack use\"\n      // here and the pnpm commands in ./post-update/pnpm.ts. Check\n      // ./post-update/pnpm.ts for more details.\n      npm_config_cache_dir: pnpmConfigCacheDir,\n      npm_config_store_dir: pnpmConfigStoreDir,\n      pnpm_config_cache_dir: pnpmConfigCacheDir,\n      pnpm_config_store_dir: pnpmConfigStoreDir,\n    },\n    toolConstraints: [\n      nodeConstraints,\n      {\n        toolName: 'corepack',\n        constraint: config.constraints?.corepack,\n      },\n    ],\n    docker: {},\n  };\n\n  await updateNpmrcContent(pkgFileDir, npmrcContent, additionalNpmrcContent);\n  try {\n    await exec(cmd, execOptions);\n    await resetNpmrcContent(pkgFileDir, npmrcContent);\n    const newPackageFileContent = await readLocalFile(packageFileName, 'utf8');\n    if (\n      !newPackageFileContent ||\n      existingPackageFileContent === newPackageFileContent\n    ) {\n      return null;\n    }\n    logger.debug('Returning updated package.json');\n    return {\n      file: {\n        type: 'addition',\n        path: packageFileName,\n        contents: newPackageFileContent,\n      },\n    };\n  } catch (err) {\n    logger.warn({ err }, 'Error updating package.json');\n    await resetNpmrcContent(pkgFileDir, npmrcContent);\n    return {\n      artifactError: {\n        fileName: packageFileName,\n        stderr: err.message,\n      },\n    };\n  }\n}\n\n/**\n * Update the minimumReleaseAgeExclude setting in pnpm-workspace.yaml if needed\n */\nasync function updatePnpmWorkspace(\n  updateArtifactsConfig: UpdateArtifact,\n): Promise<UpdateArtifactsResult | null> {\n  const upgrades = updateArtifactsConfig.updatedDeps.filter(\n    (u) => u.isVulnerabilityAlert,\n  );\n  // return early if no security updates are present\n  if (isEmptyArray(upgrades)) {\n    return null;\n  }\n\n  const pnpmLockFile = upgrades[0].managerData?.pnpmLockFile;\n  if (!isString(pnpmLockFile)) {\n    logger.debug(\n      'No pnpm shrinkwrap found, not attempting to update pnpm-workspace.yaml',\n    );\n    return null;\n  }\n  const lockFileDir = upath.dirname(pnpmLockFile);\n  const pnpmWorkspaceFilePath = upath.join(lockFileDir, 'pnpm-workspace.yaml');\n\n  if (!(await localPathExists(pnpmWorkspaceFilePath))) {\n    return null;\n  }\n\n  // use already-updated content when updating the workspace file itself\n  const packageFileContent =\n    updateArtifactsConfig.packageFileName === pnpmWorkspaceFilePath\n      ? updateArtifactsConfig.newPackageFileContent\n      : (await readLocalFile(pnpmWorkspaceFilePath, 'utf8'))!;\n  const doc = parseDocument(packageFileContent);\n\n  if (!doc.get('minimumReleaseAge')) {\n    return null;\n  }\n\n  let updated = false;\n\n  for (const upgrade of upgrades) {\n    let excludeNode = doc.getIn(['minimumReleaseAgeExclude']) as YAMLSeq | null;\n    // v8 ignore next -- TODO: add test #40625\n    const newVersion = upgrade.newVersion ?? upgrade.newValue;\n    // For pnpm overrides with range selectors (e.g. \"pkg@<=1.0.0\"), depName contains\n    // the full key including the selector. Use packageName (bare package name) for\n    // minimumReleaseAgeExclude entries which require exact versions only.\n    const excludeDepName = upgrade.packageName ?? upgrade.depName;\n\n    /* v8 ignore if -- should not happen, adding for type narrowing*/\n    if (excludeNode && !isSeq(excludeNode)) {\n      return null;\n    }\n\n    if (!excludeNode) {\n      logger.debug('Adding new exclude block');\n      excludeNode = doc.createNode([]);\n      const newItem = doc.createNode(`${excludeDepName}@${newVersion}`);\n      newItem.commentBefore = ` Renovate security update: ${excludeDepName}@${newVersion}`;\n      excludeNode.items.push(newItem);\n      doc.set('minimumReleaseAgeExclude', excludeNode);\n      updated = true;\n      continue;\n    }\n\n    const {\n      item: matchedItem,\n      allExcluded,\n      malformed,\n    } = getMatchedItem(excludeDepName!, excludeNode.items);\n\n    if (allExcluded) {\n      // still clean up any malformed entries even when a wildcard covers the package\n    } else if (malformed && isScalar<string>(matchedItem)) {\n      logger.debug(\n        { entry: matchedItem.value, excludeDepName, newVersion },\n        'Replacing malformed minimumReleaseAgeExclude entry',\n      );\n      matchedItem.value = `${excludeDepName}@${newVersion}`;\n      matchedItem.commentBefore = ` Renovate security update: ${excludeDepName}@${newVersion}`;\n      updated = true;\n    } else if (isScalar<string>(matchedItem)) {\n      // if we have a comment before the list, which includes the dependency\n      if (excludeNode?.commentBefore?.includes(`${excludeDepName}@`)) {\n        // and it doesn't already have the version included in it\n        if (\n          !minimumReleaseAgeExcludeIncludesDepNameAndVersion(\n            excludeNode.commentBefore,\n            excludeDepName,\n            newVersion,\n          )\n        ) {\n          // then append it\n\n          // normalize value (no quote handling needed)\n          excludeNode.commentBefore = `${excludeNode.commentBefore} || ${newVersion}`;\n          updated = true;\n        }\n      }\n      // otherwise, if it's in our matched item's comment\n      else if (matchedItem.commentBefore) {\n        // add it\n        if (\n          !minimumReleaseAgeExcludeIncludesDepNameAndVersion(\n            matchedItem.commentBefore,\n            excludeDepName,\n            newVersion,\n          )\n        ) {\n          // normalize value (no quote handling needed)\n          matchedItem.commentBefore = `${matchedItem.commentBefore} || ${newVersion}`;\n          updated = true;\n        }\n      } else {\n        matchedItem.commentBefore = ` Renovate security update: ${excludeDepName}@${newVersion}`;\n        updated = true;\n      }\n\n      if (\n        !minimumReleaseAgeExcludeIncludesDepNameAndVersion(\n          matchedItem.value,\n          excludeDepName,\n          newVersion,\n        )\n      ) {\n        matchedItem.value = `${matchedItem.value} || ${newVersion}`;\n        updated = true;\n      }\n    } else {\n      // add new entry\n      const newItem = doc.createNode(`${excludeDepName}@${newVersion}`);\n      newItem.commentBefore = ` Renovate security update: ${excludeDepName}@${newVersion}`;\n\n      excludeNode.items.push(newItem);\n      updated = true;\n    }\n\n    // Remove any malformed entries for the same package left over from the prior bug\n    for (let i = excludeNode.items.length - 1; i >= 0; i--) {\n      const item = excludeNode.items[i];\n      if (\n        item !== matchedItem &&\n        isScalar(item) &&\n        isString(item.value) &&\n        item.value.startsWith(`${excludeDepName}@`) &&\n        !isValidMinimumReleaseAgeExcludeEntry(item.value, excludeDepName!)\n      ) {\n        excludeNode.items.splice(i, 1);\n        updated = true;\n      }\n    }\n  }\n\n  if (!updated) {\n    return null;\n  }\n\n  const newContent = doc.toString();\n  await writeLocalFile(pnpmWorkspaceFilePath, newContent);\n\n  return {\n    file: {\n      type: 'addition',\n      path: pnpmWorkspaceFilePath,\n      contents: newContent,\n    },\n  };\n}\n\nfunction getMatchedItem(\n  depName: string,\n  items: unknown[],\n): {\n  item: Scalar | null;\n  allExcluded: boolean;\n  malformed?: boolean;\n} {\n  let malformedItem: Scalar | null = null;\n\n  for (const item of items) {\n    /* v8 ignore if -- should not happen */\n    if (!isScalar(item) || !isString(item.value)) {\n      continue;\n    }\n\n    if (item.value.startsWith(`${depName}@`)) {\n      if (isValidMinimumReleaseAgeExcludeEntry(item.value, depName)) {\n        return {\n          allExcluded: false,\n          item,\n        };\n      }\n      malformedItem ??= item;\n      continue;\n    }\n\n    if (item.value === depName || matchRegexOrGlob(depName, item.value)) {\n      return {\n        allExcluded: true,\n        item,\n      };\n    }\n  }\n\n  if (malformedItem) {\n    return {\n      allExcluded: false,\n      item: malformedItem,\n      malformed: true,\n    };\n  }\n\n  return {\n    item: null,\n    allExcluded: false,\n  };\n}\n\n/** pnpm requires package@version entries without range selectors or extra @ in the version part */\nfunction isValidMinimumReleaseAgeExcludeEntry(\n  value: string,\n  packageName: string,\n): boolean {\n  return !value.slice(`${packageName}@`.length).includes('@');\n}\n\n/** determine whether a comment or a list item contains the depName at a given newVersion */\nfunction minimumReleaseAgeExcludeIncludesDepNameAndVersion(\n  line: string,\n  depName: string | undefined,\n  newVersion: string | undefined,\n): boolean {\n  if (line.includes(`${depName}@${newVersion}`)) {\n    return true;\n  }\n\n  if (line.includes(`|| ${newVersion}`)) {\n    return true;\n  }\n\n  return false;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA6BA,MAAM,2BAA2B;AAKjC,eAAsB,gBACpB,uBACyC;CACzC,OAAO,MAAM,uBAAuB,sBAAsB,gBAAgB,EAAE;CAC5E,IAAI,MAA+B,CAAC;CACpC,IAAI,KACF,aAAa,MAAM,4BAA4B,qBAAqB,CAAC,CACvE;CACA,IAAI,KAAK,aAAa,MAAM,oBAAoB,qBAAqB,CAAC,CAAC;CAEvE,MAAM,IAAI,OAAO,gBAAgB;CACjC,IAAI,IAAI,WAAW,GACjB,OAAO;CAGT,OAAO;AACT;AAEA,eAAe,4BACb,uBACuC;CACvC,MAAM,EACJ,iBACA,QACA,aACA,uBAAuB,+BACrB;CACJ,MAAM,uBAAuB,YAAY,MACtC,QAAQ,IAAI,YAAY,gBAC3B;CAEA,IAAI,CAAC,sBAAsB;EACzB,OAAO,MAAM,4CAA4C;EACzD,OAAO;CACT;CAEA,MAAM,EAAE,cAAc,SAAS,eAAe;CAG9C,IAAI,CAAC,gBAAgB,CAAC,MAAM,wBAAwB,CAAC,CAAC,KAAK,YAAY,GACrE,OAAO;CAIT,MAAM,eAAe,iBAAiB,0BAA0B;CAIhE,MAAM,aAAa,MAAM,QAAQ,eAAe;CAChD,MAAM,EAAE,2BAA2B,iBAAiB;CACpD,MAAM,eAAe,MAAM,gBAAgB,UAAU;CACrD,MAAM,cAAc,oBAAoB,UAAU;CAClD,MAAM,MAAM,gBAAgB,MAAM,GAAG,QAAQ,GAAG,YAAY;CAE5D,MAAM,kBAAkB,MAAM,sBAC5B,QACA,aACA,YACA,WACF;CAEA,MAAM,qBAAqB,MAAM,eAAe,cAAc;CAC9D,MAAM,qBAAqB,MAAM,eAAe,cAAc;CAC9D,MAAM,cAA2B;EAC/B,SAAS;EACT,UAAU;GAIR,sBAAsB;GACtB,sBAAsB;GACtB,uBAAuB;GACvB,uBAAuB;EACzB;EACA,iBAAiB,CACf,iBACA;GACE,UAAU;GACV,YAAY,OAAO,aAAa;EAClC,CACF;EACA,QAAQ,CAAC;CACX;CAEA,MAAM,mBAAmB,YAAY,cAAc,sBAAsB;CACzE,IAAI;EACF,MAAM,KAAK,KAAK,WAAW;EAC3B,MAAM,kBAAkB,YAAY,YAAY;EAChD,MAAM,wBAAwB,MAAM,cAAc,iBAAiB,MAAM;EACzE,IACE,CAAC,yBACD,+BAA+B,uBAE/B,OAAO;EAET,OAAO,MAAM,gCAAgC;EAC7C,OAAO,EACL,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF;CACF,SAAS,KAAK;EACZ,OAAO,KAAK,EAAE,IAAI,GAAG,6BAA6B;EAClD,MAAM,kBAAkB,YAAY,YAAY;EAChD,OAAO,EACL,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF;CACF;AACF;;;;AAKA,eAAe,oBACb,uBACuC;CACvC,MAAM,WAAW,sBAAsB,YAAY,QAChD,MAAM,EAAE,oBACX;CAEA,IAAI,aAAa,QAAQ,GACvB,OAAO;CAGT,MAAM,eAAe,SAAS,EAAE,CAAC,aAAa;CAC9C,IAAI,CAAC,SAAS,YAAY,GAAG;EAC3B,OAAO,MACL,wEACF;EACA,OAAO;CACT;CACA,MAAM,cAAc,MAAM,QAAQ,YAAY;CAC9C,MAAM,wBAAwB,MAAM,KAAK,aAAa,qBAAqB;CAE3E,IAAI,CAAE,MAAM,gBAAgB,qBAAqB,GAC/C,OAAO;CAIT,MAAM,qBACJ,sBAAsB,oBAAoB,wBACtC,sBAAsB,wBACrB,MAAM,cAAc,uBAAuB,MAAM;CACxD,MAAM,MAAM,cAAc,kBAAkB;CAE5C,IAAI,CAAC,IAAI,IAAI,mBAAmB,GAC9B,OAAO;CAGT,IAAI,UAAU;CAEd,KAAK,MAAM,WAAW,UAAU;EAC9B,IAAI,cAAc,IAAI,MAAM,CAAC,0BAA0B,CAAC;;EAExD,MAAM,aAAa,QAAQ,cAAc,QAAQ;EAIjD,MAAM,iBAAiB,QAAQ,eAAe,QAAQ;;EAGtD,IAAI,eAAe,CAAC,MAAM,WAAW,GACnC,OAAO;EAGT,IAAI,CAAC,aAAa;GAChB,OAAO,MAAM,0BAA0B;GACvC,cAAc,IAAI,WAAW,CAAC,CAAC;GAC/B,MAAM,UAAU,IAAI,WAAW,GAAG,eAAe,GAAG,YAAY;GAChE,QAAQ,gBAAgB,8BAA8B,eAAe,GAAG;GACxE,YAAY,MAAM,KAAK,OAAO;GAC9B,IAAI,IAAI,4BAA4B,WAAW;GAC/C,UAAU;GACV;EACF;EAEA,MAAM,EACJ,MAAM,aACN,aACA,cACE,eAAe,gBAAiB,YAAY,KAAK;EAErD,IAAI,aAAa,CAEjB,OAAO,IAAI,aAAa,SAAiB,WAAW,GAAG;GACrD,OAAO,MACL;IAAE,OAAO,YAAY;IAAO;IAAgB;GAAW,GACvD,oDACF;GACA,YAAY,QAAQ,GAAG,eAAe,GAAG;GACzC,YAAY,gBAAgB,8BAA8B,eAAe,GAAG;GAC5E,UAAU;EACZ,OAAO,IAAI,SAAiB,WAAW,GAAG;GAExC,IAAI,aAAa,eAAe,SAAS,GAAG,eAAe,EAAE,GAGzD;QAAA,CAAC,kDACC,YAAY,eACZ,gBACA,UACF,GACA;KAIA,YAAY,gBAAgB,GAAG,YAAY,cAAc,MAAM;KAC/D,UAAU;IACZ;UAGG,IAAI,YAAY,eAGjB;QAAA,CAAC,kDACC,YAAY,eACZ,gBACA,UACF,GACA;KAEA,YAAY,gBAAgB,GAAG,YAAY,cAAc,MAAM;KAC/D,UAAU;IACZ;UACK;IACL,YAAY,gBAAgB,8BAA8B,eAAe,GAAG;IAC5E,UAAU;GACZ;GAEA,IACE,CAAC,kDACC,YAAY,OACZ,gBACA,UACF,GACA;IACA,YAAY,QAAQ,GAAG,YAAY,MAAM,MAAM;IAC/C,UAAU;GACZ;EACF,OAAO;GAEL,MAAM,UAAU,IAAI,WAAW,GAAG,eAAe,GAAG,YAAY;GAChE,QAAQ,gBAAgB,8BAA8B,eAAe,GAAG;GAExE,YAAY,MAAM,KAAK,OAAO;GAC9B,UAAU;EACZ;EAGA,KAAK,IAAI,IAAI,YAAY,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK;GACtD,MAAM,OAAO,YAAY,MAAM;GAC/B,IACE,SAAS,eACT,SAAS,IAAI,KACb,SAAS,KAAK,KAAK,KACnB,KAAK,MAAM,WAAW,GAAG,eAAe,EAAE,KAC1C,CAAC,qCAAqC,KAAK,OAAO,cAAe,GACjE;IACA,YAAY,MAAM,OAAO,GAAG,CAAC;IAC7B,UAAU;GACZ;EACF;CACF;CAEA,IAAI,CAAC,SACH,OAAO;CAGT,MAAM,aAAa,IAAI,SAAS;CAChC,MAAM,eAAe,uBAAuB,UAAU;CAEtD,OAAO,EACL,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU;CACZ,EACF;AACF;AAEA,SAAS,eACP,SACA,OAKA;CACA,IAAI,gBAA+B;CAEnC,KAAK,MAAM,QAAQ,OAAO;;EAExB,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,GACzC;EAGF,IAAI,KAAK,MAAM,WAAW,GAAG,QAAQ,EAAE,GAAG;GACxC,IAAI,qCAAqC,KAAK,OAAO,OAAO,GAC1D,OAAO;IACL,aAAa;IACb;GACF;GAEF,kBAAkB;GAClB;EACF;EAEA,IAAI,KAAK,UAAU,WAAW,iBAAiB,SAAS,KAAK,KAAK,GAChE,OAAO;GACL,aAAa;GACb;EACF;CAEJ;CAEA,IAAI,eACF,OAAO;EACL,aAAa;EACb,MAAM;EACN,WAAW;CACb;CAGF,OAAO;EACL,MAAM;EACN,aAAa;CACf;AACF;;AAGA,SAAS,qCACP,OACA,aACS;CACT,OAAO,CAAC,MAAM,MAAM,GAAG,YAAY,GAAG,MAAM,CAAC,CAAC,SAAS,GAAG;AAC5D;;AAGA,SAAS,kDACP,MACA,SACA,YACS;CACT,IAAI,KAAK,SAAS,GAAG,QAAQ,GAAG,YAAY,GAC1C,OAAO;CAGT,IAAI,KAAK,SAAS,MAAM,YAAY,GAClC,OAAO;CAGT,OAAO;AACT"}
+{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/npm/artifacts.ts"],"sourcesContent":["import { isEmptyArray, isNonEmptyObject, isString } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport type { Scalar, YAMLSeq } from 'yaml';\nimport { isScalar, isSeq, parseDocument } from 'yaml';\nimport { logger } from '../../../logger/index.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  ensureCacheDir,\n  localPathExists,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { coerceObject } from '../../../util/object.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { matchRegexOrGlob } from '../../../util/string-match.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\nimport { PNPM_CACHE_DIR, PNPM_STORE_DIR } from './constants.ts';\nimport { getNodeToolConstraint } from './post-update/node-version.ts';\nimport { processHostRules } from './post-update/rules.ts';\nimport { lazyLoadPackageJson } from './post-update/utils.ts';\nimport {\n  getNpmrcContent,\n  resetNpmrcContent,\n  updateNpmrcContent,\n} from './utils.ts';\n\n// eg. 8.15.5+sha256.4b4efa12490e5055d59b9b9fc9438b7d581a6b7af3b5675eb5c5f447cee1a589\nconst versionWithHashRegString = '^(?<version>.*)\\\\+(?<hash>.*)';\n\n// Execute 'corepack use' command for npm manager updates\n// This step is necessary because Corepack recommends attaching a hash after the version\n// The hash is generated only after running 'corepack use' and cannot be fetched from the npm registry\nexport async function updateArtifacts(\n  updateArtifactsConfig: UpdateArtifact,\n): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`npm.updateArtifacts(${updateArtifactsConfig.packageFileName})`);\n  let res: UpdateArtifactsResult[] = [];\n  res.push(\n    coerceObject(await handlePackageManagerUpdates(updateArtifactsConfig)),\n  );\n  res.push(coerceObject(await updatePnpmWorkspace(updateArtifactsConfig)));\n\n  res = res.filter(isNonEmptyObject);\n  if (res.length === 0) {\n    return null;\n  }\n\n  return res;\n}\n\nasync function handlePackageManagerUpdates(\n  updateArtifactsConfig: UpdateArtifact,\n): Promise<UpdateArtifactsResult | null> {\n  const {\n    packageFileName,\n    config,\n    updatedDeps,\n    newPackageFileContent: existingPackageFileContent,\n  } = updateArtifactsConfig;\n  const packageManagerUpdate = updatedDeps.find(\n    (dep) => dep.depType === 'packageManager',\n  );\n\n  if (!packageManagerUpdate) {\n    logger.debug('No packageManager updates - returning null');\n    return null;\n  }\n\n  const { currentValue, depName, newVersion } = packageManagerUpdate;\n\n  // Execute 'corepack use' command only if the currentValue already has hash in it\n  if (!currentValue || !regEx(versionWithHashRegString).test(currentValue)) {\n    return null;\n  }\n\n  // write old updates before executing corepack update so that they are not removed from package file\n  await writeLocalFile(packageFileName, existingPackageFileContent);\n\n  // Asumming that corepack only needs to modify the package.json file in the root folder\n  // As it should not be regular practice to have different package managers in different workspaces\n  const pkgFileDir = upath.dirname(packageFileName);\n  const { additionalNpmrcContent } = processHostRules();\n  const npmrcContent = await getNpmrcContent(pkgFileDir);\n  const lazyPkgJson = lazyLoadPackageJson(pkgFileDir);\n  const cmd = `corepack use ${quote(`${depName}@${newVersion}`)}`;\n\n  const nodeConstraints = await getNodeToolConstraint(\n    config,\n    updatedDeps,\n    pkgFileDir,\n    lazyPkgJson,\n  );\n\n  const pnpmConfigCacheDir = await ensureCacheDir(PNPM_CACHE_DIR);\n  const pnpmConfigStoreDir = await ensureCacheDir(PNPM_STORE_DIR);\n  const execOptions: ExecOptions = {\n    cwdFile: packageFileName,\n    extraEnv: {\n      // To make sure pnpm store location is consistent between \"corepack use\"\n      // here and the pnpm commands in ./post-update/pnpm.ts. Check\n      // ./post-update/pnpm.ts for more details.\n      npm_config_cache_dir: pnpmConfigCacheDir,\n      npm_config_store_dir: pnpmConfigStoreDir,\n      pnpm_config_cache_dir: pnpmConfigCacheDir,\n      pnpm_config_store_dir: pnpmConfigStoreDir,\n    },\n    toolConstraints: [\n      nodeConstraints,\n      {\n        toolName: 'corepack',\n        constraint: await resolveToolConstraint(config, 'corepack'),\n      },\n    ],\n    docker: {},\n  };\n\n  await updateNpmrcContent(pkgFileDir, npmrcContent, additionalNpmrcContent);\n  try {\n    await exec(cmd, execOptions);\n    await resetNpmrcContent(pkgFileDir, npmrcContent);\n    const newPackageFileContent = await readLocalFile(packageFileName, 'utf8');\n    if (\n      !newPackageFileContent ||\n      existingPackageFileContent === newPackageFileContent\n    ) {\n      return null;\n    }\n    logger.debug('Returning updated package.json');\n    return {\n      file: {\n        type: 'addition',\n        path: packageFileName,\n        contents: newPackageFileContent,\n      },\n    };\n  } catch (err) {\n    logger.warn({ err }, 'Error updating package.json');\n    await resetNpmrcContent(pkgFileDir, npmrcContent);\n    return {\n      artifactError: {\n        fileName: packageFileName,\n        stderr: err.message,\n      },\n    };\n  }\n}\n\n/**\n * Update the minimumReleaseAgeExclude setting in pnpm-workspace.yaml if needed\n */\nasync function updatePnpmWorkspace(\n  updateArtifactsConfig: UpdateArtifact,\n): Promise<UpdateArtifactsResult | null> {\n  const upgrades = updateArtifactsConfig.updatedDeps.filter(\n    (u) => u.isVulnerabilityAlert,\n  );\n  // return early if no security updates are present\n  if (isEmptyArray(upgrades)) {\n    return null;\n  }\n\n  const pnpmLockFile = upgrades[0].managerData?.pnpmLockFile;\n  if (!isString(pnpmLockFile)) {\n    logger.debug(\n      'No pnpm shrinkwrap found, not attempting to update pnpm-workspace.yaml',\n    );\n    return null;\n  }\n  const lockFileDir = upath.dirname(pnpmLockFile);\n  const pnpmWorkspaceFilePath = upath.join(lockFileDir, 'pnpm-workspace.yaml');\n\n  if (!(await localPathExists(pnpmWorkspaceFilePath))) {\n    return null;\n  }\n\n  // use already-updated content when updating the workspace file itself\n  const packageFileContent =\n    updateArtifactsConfig.packageFileName === pnpmWorkspaceFilePath\n      ? updateArtifactsConfig.newPackageFileContent\n      : (await readLocalFile(pnpmWorkspaceFilePath, 'utf8'))!;\n  const doc = parseDocument(packageFileContent);\n\n  if (!doc.get('minimumReleaseAge')) {\n    return null;\n  }\n\n  let updated = false;\n\n  for (const upgrade of upgrades) {\n    let excludeNode = doc.getIn(['minimumReleaseAgeExclude']) as YAMLSeq | null;\n    // v8 ignore next -- TODO: add test #40625\n    const newVersion = upgrade.newVersion ?? upgrade.newValue;\n    // For pnpm overrides with range selectors (e.g. \"pkg@<=1.0.0\"), depName contains\n    // the full key including the selector. Use packageName (bare package name) for\n    // minimumReleaseAgeExclude entries which require exact versions only.\n    const excludeDepName = upgrade.packageName ?? upgrade.depName;\n\n    /* v8 ignore if -- should not happen, adding for type narrowing*/\n    if (excludeNode && !isSeq(excludeNode)) {\n      return null;\n    }\n\n    if (!excludeNode) {\n      logger.debug('Adding new exclude block');\n      excludeNode = doc.createNode([]);\n      const newItem = doc.createNode(`${excludeDepName}@${newVersion}`);\n      newItem.commentBefore = ` Renovate security update: ${excludeDepName}@${newVersion}`;\n      excludeNode.items.push(newItem);\n      doc.set('minimumReleaseAgeExclude', excludeNode);\n      updated = true;\n      continue;\n    }\n\n    const {\n      item: matchedItem,\n      allExcluded,\n      malformed,\n    } = getMatchedItem(excludeDepName!, excludeNode.items);\n\n    if (allExcluded) {\n      // still clean up any malformed entries even when a wildcard covers the package\n    } else if (malformed && isScalar<string>(matchedItem)) {\n      logger.debug(\n        { entry: matchedItem.value, excludeDepName, newVersion },\n        'Replacing malformed minimumReleaseAgeExclude entry',\n      );\n      matchedItem.value = `${excludeDepName}@${newVersion}`;\n      matchedItem.commentBefore = ` Renovate security update: ${excludeDepName}@${newVersion}`;\n      updated = true;\n    } else if (isScalar<string>(matchedItem)) {\n      // if we have a comment before the list, which includes the dependency\n      if (excludeNode?.commentBefore?.includes(`${excludeDepName}@`)) {\n        // and it doesn't already have the version included in it\n        if (\n          !minimumReleaseAgeExcludeIncludesDepNameAndVersion(\n            excludeNode.commentBefore,\n            excludeDepName,\n            newVersion,\n          )\n        ) {\n          // then append it\n\n          // normalize value (no quote handling needed)\n          excludeNode.commentBefore = `${excludeNode.commentBefore} || ${newVersion}`;\n          updated = true;\n        }\n      }\n      // otherwise, if it's in our matched item's comment\n      else if (matchedItem.commentBefore) {\n        // add it\n        if (\n          !minimumReleaseAgeExcludeIncludesDepNameAndVersion(\n            matchedItem.commentBefore,\n            excludeDepName,\n            newVersion,\n          )\n        ) {\n          // normalize value (no quote handling needed)\n          matchedItem.commentBefore = `${matchedItem.commentBefore} || ${newVersion}`;\n          updated = true;\n        }\n      } else {\n        matchedItem.commentBefore = ` Renovate security update: ${excludeDepName}@${newVersion}`;\n        updated = true;\n      }\n\n      if (\n        !minimumReleaseAgeExcludeIncludesDepNameAndVersion(\n          matchedItem.value,\n          excludeDepName,\n          newVersion,\n        )\n      ) {\n        matchedItem.value = `${matchedItem.value} || ${newVersion}`;\n        updated = true;\n      }\n    } else {\n      // add new entry\n      const newItem = doc.createNode(`${excludeDepName}@${newVersion}`);\n      newItem.commentBefore = ` Renovate security update: ${excludeDepName}@${newVersion}`;\n\n      excludeNode.items.push(newItem);\n      updated = true;\n    }\n\n    // Remove any malformed entries for the same package left over from the prior bug\n    for (let i = excludeNode.items.length - 1; i >= 0; i--) {\n      const item = excludeNode.items[i];\n      if (\n        item !== matchedItem &&\n        isScalar(item) &&\n        isString(item.value) &&\n        item.value.startsWith(`${excludeDepName}@`) &&\n        !isValidMinimumReleaseAgeExcludeEntry(item.value, excludeDepName!)\n      ) {\n        excludeNode.items.splice(i, 1);\n        updated = true;\n      }\n    }\n  }\n\n  if (!updated) {\n    return null;\n  }\n\n  const newContent = doc.toString();\n  await writeLocalFile(pnpmWorkspaceFilePath, newContent);\n\n  return {\n    file: {\n      type: 'addition',\n      path: pnpmWorkspaceFilePath,\n      contents: newContent,\n    },\n  };\n}\n\nfunction getMatchedItem(\n  depName: string,\n  items: unknown[],\n): {\n  item: Scalar | null;\n  allExcluded: boolean;\n  malformed?: boolean;\n} {\n  let malformedItem: Scalar | null = null;\n\n  for (const item of items) {\n    /* v8 ignore if -- should not happen */\n    if (!isScalar(item) || !isString(item.value)) {\n      continue;\n    }\n\n    if (item.value.startsWith(`${depName}@`)) {\n      if (isValidMinimumReleaseAgeExcludeEntry(item.value, depName)) {\n        return {\n          allExcluded: false,\n          item,\n        };\n      }\n      malformedItem ??= item;\n      continue;\n    }\n\n    if (item.value === depName || matchRegexOrGlob(depName, item.value)) {\n      return {\n        allExcluded: true,\n        item,\n      };\n    }\n  }\n\n  if (malformedItem) {\n    return {\n      allExcluded: false,\n      item: malformedItem,\n      malformed: true,\n    };\n  }\n\n  return {\n    item: null,\n    allExcluded: false,\n  };\n}\n\n/** pnpm requires package@version entries without range selectors or extra @ in the version part */\nfunction isValidMinimumReleaseAgeExcludeEntry(\n  value: string,\n  packageName: string,\n): boolean {\n  return !value.slice(`${packageName}@`.length).includes('@');\n}\n\n/** determine whether a comment or a list item contains the depName at a given newVersion */\nfunction minimumReleaseAgeExcludeIncludesDepNameAndVersion(\n  line: string,\n  depName: string | undefined,\n  newVersion: string | undefined,\n): boolean {\n  if (line.includes(`${depName}@${newVersion}`)) {\n    return true;\n  }\n\n  if (line.includes(`|| ${newVersion}`)) {\n    return true;\n  }\n\n  return false;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA8BA,MAAM,2BAA2B;AAKjC,eAAsB,gBACpB,uBACyC;CACzC,OAAO,MAAM,uBAAuB,sBAAsB,gBAAgB,EAAE;CAC5E,IAAI,MAA+B,CAAC;CACpC,IAAI,KACF,aAAa,MAAM,4BAA4B,qBAAqB,CAAC,CACvE;CACA,IAAI,KAAK,aAAa,MAAM,oBAAoB,qBAAqB,CAAC,CAAC;CAEvE,MAAM,IAAI,OAAO,gBAAgB;CACjC,IAAI,IAAI,WAAW,GACjB,OAAO;CAGT,OAAO;AACT;AAEA,eAAe,4BACb,uBACuC;CACvC,MAAM,EACJ,iBACA,QACA,aACA,uBAAuB,+BACrB;CACJ,MAAM,uBAAuB,YAAY,MACtC,QAAQ,IAAI,YAAY,gBAC3B;CAEA,IAAI,CAAC,sBAAsB;EACzB,OAAO,MAAM,4CAA4C;EACzD,OAAO;CACT;CAEA,MAAM,EAAE,cAAc,SAAS,eAAe;CAG9C,IAAI,CAAC,gBAAgB,CAAC,MAAM,wBAAwB,CAAC,CAAC,KAAK,YAAY,GACrE,OAAO;CAIT,MAAM,eAAe,iBAAiB,0BAA0B;CAIhE,MAAM,aAAa,MAAM,QAAQ,eAAe;CAChD,MAAM,EAAE,2BAA2B,iBAAiB;CACpD,MAAM,eAAe,MAAM,gBAAgB,UAAU;CACrD,MAAM,cAAc,oBAAoB,UAAU;CAClD,MAAM,MAAM,gBAAgB,MAAM,GAAG,QAAQ,GAAG,YAAY;CAE5D,MAAM,kBAAkB,MAAM,sBAC5B,QACA,aACA,YACA,WACF;CAEA,MAAM,qBAAqB,MAAM,eAAe,cAAc;CAC9D,MAAM,qBAAqB,MAAM,eAAe,cAAc;CAC9D,MAAM,cAA2B;EAC/B,SAAS;EACT,UAAU;GAIR,sBAAsB;GACtB,sBAAsB;GACtB,uBAAuB;GACvB,uBAAuB;EACzB;EACA,iBAAiB,CACf,iBACA;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,UAAU;EAC5D,CACF;EACA,QAAQ,CAAC;CACX;CAEA,MAAM,mBAAmB,YAAY,cAAc,sBAAsB;CACzE,IAAI;EACF,MAAM,KAAK,KAAK,WAAW;EAC3B,MAAM,kBAAkB,YAAY,YAAY;EAChD,MAAM,wBAAwB,MAAM,cAAc,iBAAiB,MAAM;EACzE,IACE,CAAC,yBACD,+BAA+B,uBAE/B,OAAO;EAET,OAAO,MAAM,gCAAgC;EAC7C,OAAO,EACL,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF;CACF,SAAS,KAAK;EACZ,OAAO,KAAK,EAAE,IAAI,GAAG,6BAA6B;EAClD,MAAM,kBAAkB,YAAY,YAAY;EAChD,OAAO,EACL,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF;CACF;AACF;;;;AAKA,eAAe,oBACb,uBACuC;CACvC,MAAM,WAAW,sBAAsB,YAAY,QAChD,MAAM,EAAE,oBACX;CAEA,IAAI,aAAa,QAAQ,GACvB,OAAO;CAGT,MAAM,eAAe,SAAS,EAAE,CAAC,aAAa;CAC9C,IAAI,CAAC,SAAS,YAAY,GAAG;EAC3B,OAAO,MACL,wEACF;EACA,OAAO;CACT;CACA,MAAM,cAAc,MAAM,QAAQ,YAAY;CAC9C,MAAM,wBAAwB,MAAM,KAAK,aAAa,qBAAqB;CAE3E,IAAI,CAAE,MAAM,gBAAgB,qBAAqB,GAC/C,OAAO;CAIT,MAAM,qBACJ,sBAAsB,oBAAoB,wBACtC,sBAAsB,wBACrB,MAAM,cAAc,uBAAuB,MAAM;CACxD,MAAM,MAAM,cAAc,kBAAkB;CAE5C,IAAI,CAAC,IAAI,IAAI,mBAAmB,GAC9B,OAAO;CAGT,IAAI,UAAU;CAEd,KAAK,MAAM,WAAW,UAAU;EAC9B,IAAI,cAAc,IAAI,MAAM,CAAC,0BAA0B,CAAC;;EAExD,MAAM,aAAa,QAAQ,cAAc,QAAQ;EAIjD,MAAM,iBAAiB,QAAQ,eAAe,QAAQ;;EAGtD,IAAI,eAAe,CAAC,MAAM,WAAW,GACnC,OAAO;EAGT,IAAI,CAAC,aAAa;GAChB,OAAO,MAAM,0BAA0B;GACvC,cAAc,IAAI,WAAW,CAAC,CAAC;GAC/B,MAAM,UAAU,IAAI,WAAW,GAAG,eAAe,GAAG,YAAY;GAChE,QAAQ,gBAAgB,8BAA8B,eAAe,GAAG;GACxE,YAAY,MAAM,KAAK,OAAO;GAC9B,IAAI,IAAI,4BAA4B,WAAW;GAC/C,UAAU;GACV;EACF;EAEA,MAAM,EACJ,MAAM,aACN,aACA,cACE,eAAe,gBAAiB,YAAY,KAAK;EAErD,IAAI,aAAa,CAEjB,OAAO,IAAI,aAAa,SAAiB,WAAW,GAAG;GACrD,OAAO,MACL;IAAE,OAAO,YAAY;IAAO;IAAgB;GAAW,GACvD,oDACF;GACA,YAAY,QAAQ,GAAG,eAAe,GAAG;GACzC,YAAY,gBAAgB,8BAA8B,eAAe,GAAG;GAC5E,UAAU;EACZ,OAAO,IAAI,SAAiB,WAAW,GAAG;GAExC,IAAI,aAAa,eAAe,SAAS,GAAG,eAAe,EAAE,GAGzD;QAAA,CAAC,kDACC,YAAY,eACZ,gBACA,UACF,GACA;KAIA,YAAY,gBAAgB,GAAG,YAAY,cAAc,MAAM;KAC/D,UAAU;IACZ;UAGG,IAAI,YAAY,eAGjB;QAAA,CAAC,kDACC,YAAY,eACZ,gBACA,UACF,GACA;KAEA,YAAY,gBAAgB,GAAG,YAAY,cAAc,MAAM;KAC/D,UAAU;IACZ;UACK;IACL,YAAY,gBAAgB,8BAA8B,eAAe,GAAG;IAC5E,UAAU;GACZ;GAEA,IACE,CAAC,kDACC,YAAY,OACZ,gBACA,UACF,GACA;IACA,YAAY,QAAQ,GAAG,YAAY,MAAM,MAAM;IAC/C,UAAU;GACZ;EACF,OAAO;GAEL,MAAM,UAAU,IAAI,WAAW,GAAG,eAAe,GAAG,YAAY;GAChE,QAAQ,gBAAgB,8BAA8B,eAAe,GAAG;GAExE,YAAY,MAAM,KAAK,OAAO;GAC9B,UAAU;EACZ;EAGA,KAAK,IAAI,IAAI,YAAY,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK;GACtD,MAAM,OAAO,YAAY,MAAM;GAC/B,IACE,SAAS,eACT,SAAS,IAAI,KACb,SAAS,KAAK,KAAK,KACnB,KAAK,MAAM,WAAW,GAAG,eAAe,EAAE,KAC1C,CAAC,qCAAqC,KAAK,OAAO,cAAe,GACjE;IACA,YAAY,MAAM,OAAO,GAAG,CAAC;IAC7B,UAAU;GACZ;EACF;CACF;CAEA,IAAI,CAAC,SACH,OAAO;CAGT,MAAM,aAAa,IAAI,SAAS;CAChC,MAAM,eAAe,uBAAuB,UAAU;CAEtD,OAAO,EACL,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU;CACZ,EACF;AACF;AAEA,SAAS,eACP,SACA,OAKA;CACA,IAAI,gBAA+B;CAEnC,KAAK,MAAM,QAAQ,OAAO;;EAExB,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,GACzC;EAGF,IAAI,KAAK,MAAM,WAAW,GAAG,QAAQ,EAAE,GAAG;GACxC,IAAI,qCAAqC,KAAK,OAAO,OAAO,GAC1D,OAAO;IACL,aAAa;IACb;GACF;GAEF,kBAAkB;GAClB;EACF;EAEA,IAAI,KAAK,UAAU,WAAW,iBAAiB,SAAS,KAAK,KAAK,GAChE,OAAO;GACL,aAAa;GACb;EACF;CAEJ;CAEA,IAAI,eACF,OAAO;EACL,aAAa;EACb,MAAM;EACN,WAAW;CACb;CAGF,OAAO;EACL,MAAM;EACN,aAAa;CACf;AACF;;AAGA,SAAS,qCACP,OACA,aACS;CACT,OAAO,CAAC,MAAM,MAAM,GAAG,YAAY,GAAG,MAAM,CAAC,CAAC,SAAS,GAAG;AAC5D;;AAGA,SAAS,kDACP,MACA,SACA,YACS;CACT,IAAI,KAAK,SAAS,GAAG,QAAQ,GAAG,YAAY,GAC1C,OAAO;CAGT,IAAI,KAAK,SAAS,MAAM,YAAY,GAClC,OAAO;CAGT,OAAO;AACT"}

package/dist/modules/manager/npm/post-update/node-version.js

@@ -1,6 +1,7 @@
 import { newlineRegex, regEx } from "../../../../util/regex.js";
 import { logger } from "../../../../logger/index.js";
 import { readLocalFile } from "../../../../util/fs/index.js";
+import { resolveToolConstraint } from "../../util.js";
 import upath from "upath";
 import semver from "semver";
 //#region lib/modules/manager/npm/post-update/node-version.ts
@@ -35,7 +36,7 @@ async function getPackageJsonConstraint(pkg) {
 	return null;
 }
 async function getNodeConstraint(config, upgrades, lockFileDir, pkg) {
-	const constraint = getNodeUpdate(upgrades) ?? config.constraints?.node ?? await getNodeFile(upath.join(lockFileDir, ".nvmrc")) ?? await getNodeFile(upath.join(lockFileDir, ".node-version")) ?? await getPackageJsonConstraint(pkg);
+	const constraint = getNodeUpdate(upgrades) ?? await resolveToolConstraint(config, "node", async () => await getNodeFile(upath.join(lockFileDir, ".nvmrc")) ?? await getNodeFile(upath.join(lockFileDir, ".node-version")) ?? await getPackageJsonConstraint(pkg)) ?? null;
 	if (!constraint) logger.debug("No node constraint found - using latest");
 	return constraint;
 }