renovate 44.85.1 → 44.87.0

package/dist/modules/manager/helmv3/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":["hostRules.find","yaml.parseSingleYaml"],"sources":["../../../../lib/modules/manager/helmv3/artifacts.ts"],"sourcesContent":["import { isString, isTruthy } from '@sindresorhus/is';\nimport pMap from 'p-map';\nimport { quote } from 'shlex';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ToolConstraint } from '../../../util/exec/types.ts';\nimport {\n  getParentDir,\n  getSiblingFileName,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport * as yaml from '../../../util/yaml.ts';\nimport { DockerDatasource } from '../../datasource/docker/index.ts';\nimport { HelmDatasource } from '../../datasource/helm/index.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { generateHelmEnvs, generateLoginCmd } from './common.ts';\nimport { isOCIRegistry, removeOCIPrefix } from './oci.ts';\nimport type { ChartDefinition, Repository, RepositoryRule } from './types.ts';\nimport {\n  aliasRecordToRepositories,\n  getRepositories,\n  isFileInDir,\n} from './utils.ts';\n\nasync function helmCommands(\n  execOptions: ExecOptions,\n  manifestPath: string,\n  repositories: Repository[],\n): Promise<void> {\n  const cmd: string[] = [];\n  // get OCI registries and detect host rules\n  const registries: RepositoryRule[] = repositories\n    .filter(isOCIRegistry)\n    .map((value) => {\n      return {\n        ...value,\n        repository: removeOCIPrefix(value.repository),\n        hostRule: hostRules.find({\n          url: value.repository.replace('oci://', 'https://'), //TODO we need to replace this, as oci:// will not be accepted as protocol\n          hostType: DockerDatasource.id,\n        }),\n      };\n    });\n\n  // if credentials for the registry have been found, log into it\n  await pMap(registries, async (value) => {\n    const loginCmd = await generateLoginCmd(value);\n    if (loginCmd) {\n      cmd.push(loginCmd);\n    }\n  });\n\n  // find classic Chart repositories and fitting host rules\n  const classicRepositories: RepositoryRule[] = repositories\n    .filter((repository) => !isOCIRegistry(repository))\n    .map((value) => {\n      return {\n        ...value,\n        hostRule: hostRules.find({\n          url: value.repository,\n          hostType: HelmDatasource.id,\n        }),\n      };\n    });\n\n  // add helm repos if an alias or credentials for the url are defined\n  classicRepositories.forEach((value) => {\n    const { username, password } = value.hostRule;\n    const parameters = [`${quote(value.repository)}`, `--force-update`];\n    const isPrivateRepo = username && password;\n    if (isPrivateRepo) {\n      parameters.push(`--username ${quote(username)}`);\n      parameters.push(`--password ${quote(password)}`);\n    }\n\n    cmd.push(`helm repo add ${quote(value.name)} ${parameters.join(' ')}`);\n  });\n\n  cmd.push(`helm dependency update ${quote(getParentDir(manifestPath))}`);\n\n  await exec(cmd, execOptions);\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`helmv3.updateArtifacts(${packageFileName})`);\n\n  const { isLockFileMaintenance } = config;\n  const isUpdateOptionAddChartArchives = config.postUpdateOptions?.includes(\n    'helmUpdateSubChartArchives',\n  );\n\n  if (\n    !isLockFileMaintenance &&\n    (updatedDeps === undefined || updatedDeps.length < 1)\n  ) {\n    logger.debug('No updated helmv3 deps - returning null');\n    return null;\n  }\n\n  const lockFileName = getSiblingFileName(packageFileName, 'Chart.lock');\n  const existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent && !isUpdateOptionAddChartArchives) {\n    logger.debug('No Chart.lock found');\n    return null;\n  }\n  try {\n    // get repositories and registries defined in the package file\n    // TODO: use schema (#9610)\n    const packages = yaml.parseSingleYaml<ChartDefinition>(\n      newPackageFileContent,\n    );\n    const locks = existingLockFileContent\n      ? yaml.parseSingleYaml<ChartDefinition>(existingLockFileContent)\n      : { dependencies: [] };\n\n    const chartDefinitions: ChartDefinition[] = [];\n    // prioritize registryAlias naming for Helm repositories\n    if (config.registryAliases) {\n      chartDefinitions.push({\n        dependencies: aliasRecordToRepositories(config.registryAliases),\n      });\n    }\n    chartDefinitions.push(packages, locks);\n\n    const repositories = getRepositories(chartDefinitions);\n\n    await writeLocalFile(packageFileName, newPackageFileContent);\n    logger.debug('Updating Helm artifacts');\n    const helmToolConstraint: ToolConstraint = {\n      toolName: 'helm',\n      constraint: config.constraints?.helm,\n    };\n\n    const execOptions: ExecOptions = {\n      docker: {},\n      extraEnv: generateHelmEnvs(),\n      toolConstraints: [helmToolConstraint],\n    };\n    await helmCommands(execOptions, packageFileName, repositories);\n    logger.debug('Returning updated Helm artifacts');\n\n    const fileChanges: UpdateArtifactsResult[] = [];\n\n    if (isTruthy(existingLockFileContent)) {\n      const newHelmLockContent = await readLocalFile(lockFileName, 'utf8');\n      const isLockFileChanged =\n        !isString(newHelmLockContent) ||\n        isHelmLockChanged(existingLockFileContent, newHelmLockContent);\n      if (isLockFileChanged) {\n        fileChanges.push({\n          file: {\n            type: 'addition',\n            path: lockFileName,\n            contents: newHelmLockContent,\n          },\n        });\n      } else {\n        logger.debug('Chart.lock is unchanged');\n      }\n    }\n\n    // add modified helm chart archives to artifacts\n    if (isTruthy(isUpdateOptionAddChartArchives)) {\n      const chartsPath = getSiblingFileName(packageFileName, 'charts');\n      const status = await getRepoStatus();\n      const chartsAddition = coerceArray(status.not_added);\n      const chartsDeletion = coerceArray(status.deleted);\n\n      for (const file of chartsAddition) {\n        // only add artifacts in the chart sub path\n        if (!isFileInDir(chartsPath, file)) {\n          continue;\n        }\n        fileChanges.push({\n          file: {\n            type: 'addition',\n            path: file,\n            contents: await readLocalFile(file),\n          },\n        });\n      }\n\n      for (const file of chartsDeletion) {\n        // only add artifacts in the chart sub path\n        if (!isFileInDir(chartsPath, file)) {\n          continue;\n        }\n        fileChanges.push({\n          file: {\n            type: 'deletion',\n            path: file,\n          },\n        });\n      }\n    }\n\n    return fileChanges.length > 0 ? fileChanges : null;\n  } catch (err) {\n    // istanbul ignore if\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, 'Failed to update Helm lock file');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n\nfunction isHelmLockChanged(oldContent: string, newContent: string): boolean {\n  const regex = regEx(/^generated: \".+\"$/m);\n  return newContent.replace(regex, '') !== oldContent.replace(regex, '');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA8BA,eAAe,aACb,aACA,cACA,cACe;CACf,MAAM,MAAgB,CAAC;CAEvB,MAAM,aAA+B,aAClC,OAAO,aAAa,CAAC,CACrB,KAAK,UAAU;EACd,OAAO;GACL,GAAG;GACH,YAAY,gBAAgB,MAAM,UAAU;GAC5C,UAAUA,KAAe;IACvB,KAAK,MAAM,WAAW,QAAQ,UAAU,UAAU;IAClD,UAAU,iBAAiB;GAC7B,CAAC;EACH;CACF,CAAC;CAGH,MAAM,KAAK,YAAY,OAAO,UAAU;EACtC,MAAM,WAAW,MAAM,iBAAiB,KAAK;EAC7C,IAAI,UACF,IAAI,KAAK,QAAQ;CAErB,CAAC;CAgBD,aAZG,QAAQ,eAAe,CAAC,cAAc,UAAU,CAAC,CAAC,CAClD,KAAK,UAAU;EACd,OAAO;GACL,GAAG;GACH,UAAUA,KAAe;IACvB,KAAK,MAAM;IACX,UAAU,eAAe;GAC3B,CAAC;EACH;CACF,CAGgB,CAAC,CAAC,SAAS,UAAU;EACrC,MAAM,EAAE,UAAU,aAAa,MAAM;EACrC,MAAM,aAAa,CAAC,GAAG,MAAM,MAAM,UAAU,KAAK,gBAAgB;EAElE,IADsB,YAAY,UACf;GACjB,WAAW,KAAK,cAAc,MAAM,QAAQ,GAAG;GAC/C,WAAW,KAAK,cAAc,MAAM,QAAQ,GAAG;EACjD;EAEA,IAAI,KAAK,iBAAiB,MAAM,MAAM,IAAI,EAAE,GAAG,WAAW,KAAK,GAAG,GAAG;CACvE,CAAC;CAED,IAAI,KAAK,0BAA0B,MAAM,aAAa,YAAY,CAAC,GAAG;CAEtE,MAAM,KAAK,KAAK,WAAW;AAC7B;AAEA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,0BAA0B,gBAAgB,EAAE;CAEzD,MAAM,EAAE,0BAA0B;CAClC,MAAM,iCAAiC,OAAO,mBAAmB,SAC/D,4BACF;CAEA,IACE,CAAC,0BACA,gBAAgB,KAAA,KAAa,YAAY,SAAS,IACnD;EACA,OAAO,MAAM,yCAAyC;EACtD,OAAO;CACT;CAEA,MAAM,eAAe,mBAAmB,iBAAiB,YAAY;CACrE,MAAM,0BAA0B,MAAM,cAAc,cAAc,MAAM;CACxE,IAAI,CAAC,2BAA2B,CAAC,gCAAgC;EAC/D,OAAO,MAAM,qBAAqB;EAClC,OAAO;CACT;CACA,IAAI;EAGF,MAAM,WAAWC,gBACf,qBACF;EACA,MAAM,QAAQ,0BACVA,gBAAsC,uBAAuB,IAC7D,EAAE,cAAc,CAAC,EAAE;EAEvB,MAAM,mBAAsC,CAAC;EAE7C,IAAI,OAAO,iBACT,iBAAiB,KAAK,EACpB,cAAc,0BAA0B,OAAO,eAAe,EAChE,CAAC;EAEH,iBAAiB,KAAK,UAAU,KAAK;EAErC,MAAM,eAAe,gBAAgB,gBAAgB;EAErD,MAAM,eAAe,iBAAiB,qBAAqB;EAC3D,OAAO,MAAM,yBAAyB;EACtC,MAAM,qBAAqC;GACzC,UAAU;GACV,YAAY,OAAO,aAAa;EAClC;EAOA,MAAM,aAAa;GAJjB,QAAQ,CAAC;GACT,UAAU,iBAAiB;GAC3B,iBAAiB,CAAC,kBAAkB;EAET,GAAG,iBAAiB,YAAY;EAC7D,OAAO,MAAM,kCAAkC;EAE/C,MAAM,cAAuC,CAAC;EAE9C,IAAI,SAAS,uBAAuB,GAAG;GACrC,MAAM,qBAAqB,MAAM,cAAc,cAAc,MAAM;GAInE,IAFE,CAAC,SAAS,kBAAkB,KAC5B,kBAAkB,yBAAyB,kBAAkB,GAE7D,YAAY,KAAK,EACf,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU;GACZ,EACF,CAAC;QAED,OAAO,MAAM,yBAAyB;EAE1C;EAGA,IAAI,SAAS,8BAA8B,GAAG;GAC5C,MAAM,aAAa,mBAAmB,iBAAiB,QAAQ;GAC/D,MAAM,SAAS,MAAM,cAAc;GACnC,MAAM,iBAAiB,YAAY,OAAO,SAAS;GACnD,MAAM,iBAAiB,YAAY,OAAO,OAAO;GAEjD,KAAK,MAAM,QAAQ,gBAAgB;IAEjC,IAAI,CAAC,YAAY,YAAY,IAAI,GAC/B;IAEF,YAAY,KAAK,EACf,MAAM;KACJ,MAAM;KACN,MAAM;KACN,UAAU,MAAM,cAAc,IAAI;IACpC,EACF,CAAC;GACH;GAEA,KAAK,MAAM,QAAQ,gBAAgB;IAEjC,IAAI,CAAC,YAAY,YAAY,IAAI,GAC/B;IAEF,YAAY,KAAK,EACf,MAAM;KACJ,MAAM;KACN,MAAM;IACR,EACF,CAAC;GACH;EACF;EAEA,OAAO,YAAY,SAAS,IAAI,cAAc;CAChD,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,iCAAiC;EACvD,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF;AAEA,SAAS,kBAAkB,YAAoB,YAA6B;CAC1E,MAAM,QAAQ,MAAM,oBAAoB;CACxC,OAAO,WAAW,QAAQ,OAAO,EAAE,MAAM,WAAW,QAAQ,OAAO,EAAE;AACvE"}
+{"version":3,"file":"artifacts.js","names":["hostRules.find","yaml.parseSingleYaml"],"sources":["../../../../lib/modules/manager/helmv3/artifacts.ts"],"sourcesContent":["import { isString, isTruthy } from '@sindresorhus/is';\nimport pMap from 'p-map';\nimport { quote } from 'shlex';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ToolConstraint } from '../../../util/exec/types.ts';\nimport {\n  getParentDir,\n  getSiblingFileName,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport * as yaml from '../../../util/yaml.ts';\nimport { DockerDatasource } from '../../datasource/docker/index.ts';\nimport { HelmDatasource } from '../../datasource/helm/index.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\nimport { generateHelmEnvs, generateLoginCmd } from './common.ts';\nimport { isOCIRegistry, removeOCIPrefix } from './oci.ts';\nimport type { ChartDefinition, Repository, RepositoryRule } from './types.ts';\nimport {\n  aliasRecordToRepositories,\n  getRepositories,\n  isFileInDir,\n} from './utils.ts';\n\nasync function helmCommands(\n  execOptions: ExecOptions,\n  manifestPath: string,\n  repositories: Repository[],\n): Promise<void> {\n  const cmd: string[] = [];\n  // get OCI registries and detect host rules\n  const registries: RepositoryRule[] = repositories\n    .filter(isOCIRegistry)\n    .map((value) => {\n      return {\n        ...value,\n        repository: removeOCIPrefix(value.repository),\n        hostRule: hostRules.find({\n          url: value.repository.replace('oci://', 'https://'), //TODO we need to replace this, as oci:// will not be accepted as protocol\n          hostType: DockerDatasource.id,\n        }),\n      };\n    });\n\n  // if credentials for the registry have been found, log into it\n  await pMap(registries, async (value) => {\n    const loginCmd = await generateLoginCmd(value);\n    if (loginCmd) {\n      cmd.push(loginCmd);\n    }\n  });\n\n  // find classic Chart repositories and fitting host rules\n  const classicRepositories: RepositoryRule[] = repositories\n    .filter((repository) => !isOCIRegistry(repository))\n    .map((value) => {\n      return {\n        ...value,\n        hostRule: hostRules.find({\n          url: value.repository,\n          hostType: HelmDatasource.id,\n        }),\n      };\n    });\n\n  // add helm repos if an alias or credentials for the url are defined\n  classicRepositories.forEach((value) => {\n    const { username, password } = value.hostRule;\n    const parameters = [`${quote(value.repository)}`, `--force-update`];\n    const isPrivateRepo = username && password;\n    if (isPrivateRepo) {\n      parameters.push(`--username ${quote(username)}`);\n      parameters.push(`--password ${quote(password)}`);\n    }\n\n    cmd.push(`helm repo add ${quote(value.name)} ${parameters.join(' ')}`);\n  });\n\n  cmd.push(`helm dependency update ${quote(getParentDir(manifestPath))}`);\n\n  await exec(cmd, execOptions);\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`helmv3.updateArtifacts(${packageFileName})`);\n\n  const { isLockFileMaintenance } = config;\n  const isUpdateOptionAddChartArchives = config.postUpdateOptions?.includes(\n    'helmUpdateSubChartArchives',\n  );\n\n  if (\n    !isLockFileMaintenance &&\n    (updatedDeps === undefined || updatedDeps.length < 1)\n  ) {\n    logger.debug('No updated helmv3 deps - returning null');\n    return null;\n  }\n\n  const lockFileName = getSiblingFileName(packageFileName, 'Chart.lock');\n  const existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent && !isUpdateOptionAddChartArchives) {\n    logger.debug('No Chart.lock found');\n    return null;\n  }\n  try {\n    // get repositories and registries defined in the package file\n    // TODO: use schema (#9610)\n    const packages = yaml.parseSingleYaml<ChartDefinition>(\n      newPackageFileContent,\n    );\n    const locks = existingLockFileContent\n      ? yaml.parseSingleYaml<ChartDefinition>(existingLockFileContent)\n      : { dependencies: [] };\n\n    const chartDefinitions: ChartDefinition[] = [];\n    // prioritize registryAlias naming for Helm repositories\n    if (config.registryAliases) {\n      chartDefinitions.push({\n        dependencies: aliasRecordToRepositories(config.registryAliases),\n      });\n    }\n    chartDefinitions.push(packages, locks);\n\n    const repositories = getRepositories(chartDefinitions);\n\n    await writeLocalFile(packageFileName, newPackageFileContent);\n    logger.debug('Updating Helm artifacts');\n    const helmToolConstraint: ToolConstraint = {\n      toolName: 'helm',\n      constraint: await resolveToolConstraint(config, 'helm'),\n    };\n\n    const execOptions: ExecOptions = {\n      docker: {},\n      extraEnv: generateHelmEnvs(),\n      toolConstraints: [helmToolConstraint],\n    };\n    await helmCommands(execOptions, packageFileName, repositories);\n    logger.debug('Returning updated Helm artifacts');\n\n    const fileChanges: UpdateArtifactsResult[] = [];\n\n    if (isTruthy(existingLockFileContent)) {\n      const newHelmLockContent = await readLocalFile(lockFileName, 'utf8');\n      const isLockFileChanged =\n        !isString(newHelmLockContent) ||\n        isHelmLockChanged(existingLockFileContent, newHelmLockContent);\n      if (isLockFileChanged) {\n        fileChanges.push({\n          file: {\n            type: 'addition',\n            path: lockFileName,\n            contents: newHelmLockContent,\n          },\n        });\n      } else {\n        logger.debug('Chart.lock is unchanged');\n      }\n    }\n\n    // add modified helm chart archives to artifacts\n    if (isTruthy(isUpdateOptionAddChartArchives)) {\n      const chartsPath = getSiblingFileName(packageFileName, 'charts');\n      const status = await getRepoStatus();\n      const chartsAddition = coerceArray(status.not_added);\n      const chartsDeletion = coerceArray(status.deleted);\n\n      for (const file of chartsAddition) {\n        // only add artifacts in the chart sub path\n        if (!isFileInDir(chartsPath, file)) {\n          continue;\n        }\n        fileChanges.push({\n          file: {\n            type: 'addition',\n            path: file,\n            contents: await readLocalFile(file),\n          },\n        });\n      }\n\n      for (const file of chartsDeletion) {\n        // only add artifacts in the chart sub path\n        if (!isFileInDir(chartsPath, file)) {\n          continue;\n        }\n        fileChanges.push({\n          file: {\n            type: 'deletion',\n            path: file,\n          },\n        });\n      }\n    }\n\n    return fileChanges.length > 0 ? fileChanges : null;\n  } catch (err) {\n    // istanbul ignore if\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, 'Failed to update Helm lock file');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n\nfunction isHelmLockChanged(oldContent: string, newContent: string): boolean {\n  const regex = regEx(/^generated: \".+\"$/m);\n  return newContent.replace(regex, '') !== oldContent.replace(regex, '');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA+BA,eAAe,aACb,aACA,cACA,cACe;CACf,MAAM,MAAgB,CAAC;CAEvB,MAAM,aAA+B,aAClC,OAAO,aAAa,CAAC,CACrB,KAAK,UAAU;EACd,OAAO;GACL,GAAG;GACH,YAAY,gBAAgB,MAAM,UAAU;GAC5C,UAAUA,KAAe;IACvB,KAAK,MAAM,WAAW,QAAQ,UAAU,UAAU;IAClD,UAAU,iBAAiB;GAC7B,CAAC;EACH;CACF,CAAC;CAGH,MAAM,KAAK,YAAY,OAAO,UAAU;EACtC,MAAM,WAAW,MAAM,iBAAiB,KAAK;EAC7C,IAAI,UACF,IAAI,KAAK,QAAQ;CAErB,CAAC;CAgBD,aAZG,QAAQ,eAAe,CAAC,cAAc,UAAU,CAAC,CAAC,CAClD,KAAK,UAAU;EACd,OAAO;GACL,GAAG;GACH,UAAUA,KAAe;IACvB,KAAK,MAAM;IACX,UAAU,eAAe;GAC3B,CAAC;EACH;CACF,CAGgB,CAAC,CAAC,SAAS,UAAU;EACrC,MAAM,EAAE,UAAU,aAAa,MAAM;EACrC,MAAM,aAAa,CAAC,GAAG,MAAM,MAAM,UAAU,KAAK,gBAAgB;EAElE,IADsB,YAAY,UACf;GACjB,WAAW,KAAK,cAAc,MAAM,QAAQ,GAAG;GAC/C,WAAW,KAAK,cAAc,MAAM,QAAQ,GAAG;EACjD;EAEA,IAAI,KAAK,iBAAiB,MAAM,MAAM,IAAI,EAAE,GAAG,WAAW,KAAK,GAAG,GAAG;CACvE,CAAC;CAED,IAAI,KAAK,0BAA0B,MAAM,aAAa,YAAY,CAAC,GAAG;CAEtE,MAAM,KAAK,KAAK,WAAW;AAC7B;AAEA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,0BAA0B,gBAAgB,EAAE;CAEzD,MAAM,EAAE,0BAA0B;CAClC,MAAM,iCAAiC,OAAO,mBAAmB,SAC/D,4BACF;CAEA,IACE,CAAC,0BACA,gBAAgB,KAAA,KAAa,YAAY,SAAS,IACnD;EACA,OAAO,MAAM,yCAAyC;EACtD,OAAO;CACT;CAEA,MAAM,eAAe,mBAAmB,iBAAiB,YAAY;CACrE,MAAM,0BAA0B,MAAM,cAAc,cAAc,MAAM;CACxE,IAAI,CAAC,2BAA2B,CAAC,gCAAgC;EAC/D,OAAO,MAAM,qBAAqB;EAClC,OAAO;CACT;CACA,IAAI;EAGF,MAAM,WAAWC,gBACf,qBACF;EACA,MAAM,QAAQ,0BACVA,gBAAsC,uBAAuB,IAC7D,EAAE,cAAc,CAAC,EAAE;EAEvB,MAAM,mBAAsC,CAAC;EAE7C,IAAI,OAAO,iBACT,iBAAiB,KAAK,EACpB,cAAc,0BAA0B,OAAO,eAAe,EAChE,CAAC;EAEH,iBAAiB,KAAK,UAAU,KAAK;EAErC,MAAM,eAAe,gBAAgB,gBAAgB;EAErD,MAAM,eAAe,iBAAiB,qBAAqB;EAC3D,OAAO,MAAM,yBAAyB;EACtC,MAAM,qBAAqC;GACzC,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,MAAM;EACxD;EAOA,MAAM,aAAa;GAJjB,QAAQ,CAAC;GACT,UAAU,iBAAiB;GAC3B,iBAAiB,CAAC,kBAAkB;EAET,GAAG,iBAAiB,YAAY;EAC7D,OAAO,MAAM,kCAAkC;EAE/C,MAAM,cAAuC,CAAC;EAE9C,IAAI,SAAS,uBAAuB,GAAG;GACrC,MAAM,qBAAqB,MAAM,cAAc,cAAc,MAAM;GAInE,IAFE,CAAC,SAAS,kBAAkB,KAC5B,kBAAkB,yBAAyB,kBAAkB,GAE7D,YAAY,KAAK,EACf,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU;GACZ,EACF,CAAC;QAED,OAAO,MAAM,yBAAyB;EAE1C;EAGA,IAAI,SAAS,8BAA8B,GAAG;GAC5C,MAAM,aAAa,mBAAmB,iBAAiB,QAAQ;GAC/D,MAAM,SAAS,MAAM,cAAc;GACnC,MAAM,iBAAiB,YAAY,OAAO,SAAS;GACnD,MAAM,iBAAiB,YAAY,OAAO,OAAO;GAEjD,KAAK,MAAM,QAAQ,gBAAgB;IAEjC,IAAI,CAAC,YAAY,YAAY,IAAI,GAC/B;IAEF,YAAY,KAAK,EACf,MAAM;KACJ,MAAM;KACN,MAAM;KACN,UAAU,MAAM,cAAc,IAAI;IACpC,EACF,CAAC;GACH;GAEA,KAAK,MAAM,QAAQ,gBAAgB;IAEjC,IAAI,CAAC,YAAY,YAAY,IAAI,GAC/B;IAEF,YAAY,KAAK,EACf,MAAM;KACJ,MAAM;KACN,MAAM;IACR,EACF,CAAC;GACH;EACF;EAEA,OAAO,YAAY,SAAS,IAAI,cAAc;CAChD,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,iCAAiC;EACvD,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF;AAEA,SAAS,kBAAkB,YAAoB,YAA6B;CAC1E,MAAM,QAAQ,MAAM,oBAAoB;CACxC,OAAO,WAAW,QAAQ,OAAO,EAAE,MAAM,WAAW,QAAQ,OAAO,EAAE;AACvE"}

package/dist/modules/manager/jsonnet-bundler/artifacts.js

@@ -5,6 +5,7 @@ import { logger } from "../../../logger/index.js";
 import { readLocalFile } from "../../../util/fs/index.js";
 import { exec } from "../../../util/exec/index.js";
 import { getRepoStatus } from "../../../util/git/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { quote } from "shlex";
 //#region lib/modules/manager/jsonnet-bundler/artifacts.ts
 function dependencyUrl(dep) {
@@ -25,7 +26,7 @@ async function updateArtifacts(updateArtifact) {
 		docker: {},
 		toolConstraints: [{
 			toolName: "jb",
-			constraint: config.constraints?.jb
+			constraint: await resolveToolConstraint(config, "jb")
 		}]
 	};
 	try {

package/dist/modules/manager/jsonnet-bundler/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/jsonnet-bundler/artifacts.ts"],"sourcesContent":["import { quote } from 'shlex';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ToolConstraint } from '../../../util/exec/types.ts';\nimport { readLocalFile } from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport type {\n  PackageDependency,\n  UpdateArtifact,\n  UpdateArtifactsResult,\n} from '../types.ts';\n\nfunction dependencyUrl(dep: PackageDependency): string {\n  const url = dep.packageName!;\n  if (dep.managerData?.subdir) {\n    return url.concat('/', dep.managerData.subdir);\n  }\n  return url;\n}\n\nexport async function updateArtifacts(\n  updateArtifact: UpdateArtifact,\n): Promise<UpdateArtifactsResult[] | null> {\n  const { packageFileName, updatedDeps, config } = updateArtifact;\n  logger.trace({ packageFileName }, 'jsonnet-bundler.updateArtifacts()');\n\n  const lockFileName = packageFileName.replace(regEx(/\\.json$/), '.lock.json');\n  const existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n\n  if (!existingLockFileContent) {\n    logger.debug('No jsonnetfile.lock.json found');\n    return null;\n  }\n\n  const jsonnetBundlerToolConstraint: ToolConstraint = {\n    toolName: 'jb',\n    constraint: config.constraints?.jb,\n  };\n\n  const execOptions: ExecOptions = {\n    cwdFile: packageFileName,\n    docker: {},\n    toolConstraints: [jsonnetBundlerToolConstraint],\n  };\n\n  try {\n    if (config.isLockFileMaintenance) {\n      await exec('jb update', execOptions);\n    } else {\n      const dependencyUrls = updatedDeps.map(dependencyUrl);\n      if (dependencyUrls.length > 0) {\n        await exec(\n          `jb update ${dependencyUrls.map(quote).join(' ')}`,\n          execOptions,\n        );\n      }\n    }\n\n    const status = await getRepoStatus();\n\n    if (status.isClean()) {\n      return null;\n    }\n\n    const res: UpdateArtifactsResult[] = [];\n\n    for (const f of coerceArray(status.modified)) {\n      res.push({\n        file: {\n          type: 'addition',\n          path: f,\n          contents: await readLocalFile(f),\n        },\n      });\n    }\n    for (const f of coerceArray(status.not_added)) {\n      res.push({\n        file: {\n          type: 'addition',\n          path: f,\n          contents: await readLocalFile(f),\n        },\n      });\n    }\n    for (const f of coerceArray(status.deleted)) {\n      res.push({\n        file: {\n          type: 'deletion',\n          path: f,\n        },\n      });\n    }\n\n    return res;\n  } catch (err) /* istanbul ignore next */ {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.stderr,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;AAeA,SAAS,cAAc,KAAgC;CACrD,MAAM,MAAM,IAAI;CAChB,IAAI,IAAI,aAAa,QACnB,OAAO,IAAI,OAAO,KAAK,IAAI,YAAY,MAAM;CAE/C,OAAO;AACT;AAEA,eAAsB,gBACpB,gBACyC;CACzC,MAAM,EAAE,iBAAiB,aAAa,WAAW;CACjD,OAAO,MAAM,EAAE,gBAAgB,GAAG,mCAAmC;CAErE,MAAM,eAAe,gBAAgB,QAAQ,MAAM,SAAS,GAAG,YAAY;CAG3E,IAAI,CAAC,MAFiC,cAAc,cAAc,MAAM,GAE1C;EAC5B,OAAO,MAAM,gCAAgC;EAC7C,OAAO;CACT;CAOA,MAAM,cAA2B;EAC/B,SAAS;EACT,QAAQ,CAAC;EACT,iBAAiB,CAAC;GAPlB,UAAU;GACV,YAAY,OAAO,aAAa;EAMa,CAAC;CAChD;CAEA,IAAI;EACF,IAAI,OAAO,uBACT,MAAM,KAAK,aAAa,WAAW;OAC9B;GACL,MAAM,iBAAiB,YAAY,IAAI,aAAa;GACpD,IAAI,eAAe,SAAS,GAC1B,MAAM,KACJ,aAAa,eAAe,IAAI,KAAK,CAAC,CAAC,KAAK,GAAG,KAC/C,WACF;EAEJ;EAEA,MAAM,SAAS,MAAM,cAAc;EAEnC,IAAI,OAAO,QAAQ,GACjB,OAAO;EAGT,MAAM,MAA+B,CAAC;EAEtC,KAAK,MAAM,KAAK,YAAY,OAAO,QAAQ,GACzC,IAAI,KAAK,EACP,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU,MAAM,cAAc,CAAC;EACjC,EACF,CAAC;EAEH,KAAK,MAAM,KAAK,YAAY,OAAO,SAAS,GAC1C,IAAI,KAAK,EACP,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU,MAAM,cAAc,CAAC;EACjC,EACF,CAAC;EAEH,KAAK,MAAM,KAAK,YAAY,OAAO,OAAO,GACxC,IAAI,KAAK,EACP,MAAM;GACJ,MAAM;GACN,MAAM;EACR,EACF,CAAC;EAGH,OAAO;CACT,SAAS,gCAAgC;EACvC,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF"}
+{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/jsonnet-bundler/artifacts.ts"],"sourcesContent":["import { quote } from 'shlex';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ToolConstraint } from '../../../util/exec/types.ts';\nimport { readLocalFile } from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport type {\n  PackageDependency,\n  UpdateArtifact,\n  UpdateArtifactsResult,\n} from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\n\nfunction dependencyUrl(dep: PackageDependency): string {\n  const url = dep.packageName!;\n  if (dep.managerData?.subdir) {\n    return url.concat('/', dep.managerData.subdir);\n  }\n  return url;\n}\n\nexport async function updateArtifacts(\n  updateArtifact: UpdateArtifact,\n): Promise<UpdateArtifactsResult[] | null> {\n  const { packageFileName, updatedDeps, config } = updateArtifact;\n  logger.trace({ packageFileName }, 'jsonnet-bundler.updateArtifacts()');\n\n  const lockFileName = packageFileName.replace(regEx(/\\.json$/), '.lock.json');\n  const existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n\n  if (!existingLockFileContent) {\n    logger.debug('No jsonnetfile.lock.json found');\n    return null;\n  }\n\n  const jsonnetBundlerToolConstraint: ToolConstraint = {\n    toolName: 'jb',\n    constraint: await resolveToolConstraint(config, 'jb'),\n  };\n\n  const execOptions: ExecOptions = {\n    cwdFile: packageFileName,\n    docker: {},\n    toolConstraints: [jsonnetBundlerToolConstraint],\n  };\n\n  try {\n    if (config.isLockFileMaintenance) {\n      await exec('jb update', execOptions);\n    } else {\n      const dependencyUrls = updatedDeps.map(dependencyUrl);\n      if (dependencyUrls.length > 0) {\n        await exec(\n          `jb update ${dependencyUrls.map(quote).join(' ')}`,\n          execOptions,\n        );\n      }\n    }\n\n    const status = await getRepoStatus();\n\n    if (status.isClean()) {\n      return null;\n    }\n\n    const res: UpdateArtifactsResult[] = [];\n\n    for (const f of coerceArray(status.modified)) {\n      res.push({\n        file: {\n          type: 'addition',\n          path: f,\n          contents: await readLocalFile(f),\n        },\n      });\n    }\n    for (const f of coerceArray(status.not_added)) {\n      res.push({\n        file: {\n          type: 'addition',\n          path: f,\n          contents: await readLocalFile(f),\n        },\n      });\n    }\n    for (const f of coerceArray(status.deleted)) {\n      res.push({\n        file: {\n          type: 'deletion',\n          path: f,\n        },\n      });\n    }\n\n    return res;\n  } catch (err) /* istanbul ignore next */ {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.stderr,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;AAgBA,SAAS,cAAc,KAAgC;CACrD,MAAM,MAAM,IAAI;CAChB,IAAI,IAAI,aAAa,QACnB,OAAO,IAAI,OAAO,KAAK,IAAI,YAAY,MAAM;CAE/C,OAAO;AACT;AAEA,eAAsB,gBACpB,gBACyC;CACzC,MAAM,EAAE,iBAAiB,aAAa,WAAW;CACjD,OAAO,MAAM,EAAE,gBAAgB,GAAG,mCAAmC;CAErE,MAAM,eAAe,gBAAgB,QAAQ,MAAM,SAAS,GAAG,YAAY;CAG3E,IAAI,CAAC,MAFiC,cAAc,cAAc,MAAM,GAE1C;EAC5B,OAAO,MAAM,gCAAgC;EAC7C,OAAO;CACT;CAOA,MAAM,cAA2B;EAC/B,SAAS;EACT,QAAQ,CAAC;EACT,iBAAiB,CAAC;GAPlB,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,IAAI;EAMP,CAAC;CAChD;CAEA,IAAI;EACF,IAAI,OAAO,uBACT,MAAM,KAAK,aAAa,WAAW;OAC9B;GACL,MAAM,iBAAiB,YAAY,IAAI,aAAa;GACpD,IAAI,eAAe,SAAS,GAC1B,MAAM,KACJ,aAAa,eAAe,IAAI,KAAK,CAAC,CAAC,KAAK,GAAG,KAC/C,WACF;EAEJ;EAEA,MAAM,SAAS,MAAM,cAAc;EAEnC,IAAI,OAAO,QAAQ,GACjB,OAAO;EAGT,MAAM,MAA+B,CAAC;EAEtC,KAAK,MAAM,KAAK,YAAY,OAAO,QAAQ,GACzC,IAAI,KAAK,EACP,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU,MAAM,cAAc,CAAC;EACjC,EACF,CAAC;EAEH,KAAK,MAAM,KAAK,YAAY,OAAO,SAAS,GAC1C,IAAI,KAAK,EACP,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU,MAAM,cAAc,CAAC;EACjC,EACF,CAAC;EAEH,KAAK,MAAM,KAAK,YAAY,OAAO,OAAO,GACxC,IAAI,KAAK,EACP,MAAM;GACJ,MAAM;GACN,MAAM;EACR,EACF,CAAC;EAGH,OAAO;CACT,SAAS,gCAAgC;EACvC,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF"}

package/dist/modules/manager/kustomize/artifacts.js

@@ -6,6 +6,7 @@ import { exec } from "../../../util/exec/index.js";
 import { getRepoStatus } from "../../../util/git/index.js";
 import { DockerDatasource } from "../../datasource/docker/index.js";
 import { HelmDatasource } from "../../datasource/helm/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { parseKustomize } from "./extract.js";
 import { generateHelmEnvs } from "./common.js";
 import { isNonEmptyString, isNullOrUndefined } from "@sindresorhus/is";
@@ -54,13 +55,14 @@ async function updateArtifacts({ packageFileName, updatedDeps, newPackageFileCon
 	if (isNullOrUndefined(project)) return [{ artifactError: { stderr: "Failed to parse new package file content" } }];
 	const chartHome = getSiblingFileName(packageFileName, project.helmGlobals?.chartHome ?? "charts");
 	try {
+		const helmConstraint = await resolveToolConstraint(config, "helm");
 		const helmToolConstraint = {
 			toolName: "helm",
-			constraint: config.constraints?.helm
+			constraint: helmConstraint
 		};
 		const execOptions = {
 			docker: {},
-			extraEnv: generateHelmEnvs(config),
+			extraEnv: generateHelmEnvs(helmConstraint),
 			toolConstraints: [helmToolConstraint]
 		};
 		for (const dependency of updatedDeps) {

package/dist/modules/manager/kustomize/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/kustomize/artifacts.ts"],"sourcesContent":["import { isNonEmptyString, isNullOrUndefined } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ToolConstraint } from '../../../util/exec/types.ts';\nimport {\n  deleteLocalFile,\n  getSiblingFileName,\n  localPathExists,\n  readLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport { DockerDatasource } from '../../datasource/docker/index.ts';\nimport { HelmDatasource } from '../../datasource/helm/index.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { generateHelmEnvs } from './common.ts';\nimport { parseKustomize } from './extract.ts';\n\nasync function localExistingChartPath(\n  chartHome: string,\n  dependencyName: string,\n  version?: string,\n): Promise<string | null> {\n  const folderName = `${dependencyName}-${version}`;\n  const path = upath.join(chartHome, folderName);\n  const pathExists = await localPathExists(path);\n\n  return pathExists ? path : null;\n}\n\nfunction helmRepositoryArgs(\n  repository: string,\n  depName: string,\n  datasource?: string,\n): string {\n  switch (datasource) {\n    case HelmDatasource.id:\n      return `--repo ${quote(repository)} ${quote(depName)}`;\n    case DockerDatasource.id:\n      return quote(`oci://${repository}`);\n    /* v8 ignore next: should never happen */\n    default:\n      throw new Error(`Unknown datasource: ${datasource}`);\n  }\n}\n\nasync function inflateHelmChart(\n  flagEnabled: boolean,\n  execOptions: ExecOptions,\n  chartHome: string,\n  depName: string,\n  repository: string,\n  currentVersion: string,\n  newVersion?: string,\n  datasource?: string,\n): Promise<void> {\n  const currentChartExistingPath = await localExistingChartPath(\n    chartHome,\n    depName,\n    currentVersion,\n  );\n\n  if (!flagEnabled && isNullOrUndefined(currentChartExistingPath)) {\n    logger.debug(\n      `Not inflating Helm chart for ${depName} as kustomizeInflateHelmCharts is not enabled and the current version isn't inflated`,\n    );\n    return;\n  }\n\n  if (\n    isNonEmptyString(currentChartExistingPath) &&\n    isNonEmptyString(newVersion)\n  ) {\n    logger.debug(`Deleting previous helm chart: ${currentChartExistingPath}`);\n    await deleteLocalFile(currentChartExistingPath);\n  }\n\n  const versionToPull = newVersion ?? currentVersion;\n  const versionToPullExistingPath = await localExistingChartPath(\n    chartHome,\n    depName,\n    versionToPull,\n  );\n\n  if (isNonEmptyString(versionToPullExistingPath)) {\n    logger.debug(\n      `Helm chart ${depName} version ${versionToPull} already exists at ${versionToPullExistingPath}`,\n    );\n    return;\n  }\n\n  const folderName = `${depName}-${versionToPull}`;\n  const untarDir = upath.join(chartHome, folderName);\n  logger.debug(\n    `Pulling helm chart ${depName} version ${versionToPull} to ${untarDir}`,\n  );\n\n  const cmd =\n    `helm pull --untar --untardir ${quote(untarDir)} ` +\n    `--version ${quote(versionToPull)} ${helmRepositoryArgs(repository, depName, datasource)}`;\n\n  await exec(cmd, execOptions);\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`kustomize.updateArtifacts(${packageFileName})`);\n  const project = parseKustomize(newPackageFileContent);\n  const isUpdateOptionInflateChartArchives =\n    config.postUpdateOptions?.includes('kustomizeInflateHelmCharts') === true;\n  if (isNullOrUndefined(project)) {\n    return [\n      {\n        artifactError: {\n          stderr: 'Failed to parse new package file content',\n        },\n      },\n    ];\n  }\n\n  const chartHome = getSiblingFileName(\n    packageFileName,\n    project.helmGlobals?.chartHome ?? 'charts',\n  );\n\n  try {\n    const helmToolConstraint: ToolConstraint = {\n      toolName: 'helm',\n      constraint: config.constraints?.helm,\n    };\n\n    const execOptions: ExecOptions = {\n      docker: {},\n      extraEnv: generateHelmEnvs(config),\n      toolConstraints: [helmToolConstraint],\n    };\n\n    for (const dependency of updatedDeps) {\n      if (!dependency.currentVersion) {\n        continue;\n      }\n\n      if (dependency.newVersion === dependency.currentVersion) {\n        continue;\n      }\n\n      if (!isNonEmptyString(dependency.depName)) {\n        continue;\n      }\n\n      if (dependency.depType !== 'HelmChart') {\n        continue;\n      }\n\n      let repository = null;\n\n      switch (dependency.datasource) {\n        case HelmDatasource.id:\n          repository = dependency.registryUrls?.[0];\n          break;\n        case DockerDatasource.id:\n          repository = dependency.packageName;\n          break;\n      }\n\n      if (isNullOrUndefined(repository)) {\n        continue;\n      }\n\n      await inflateHelmChart(\n        isUpdateOptionInflateChartArchives,\n        execOptions,\n        chartHome,\n        dependency.depName,\n        repository,\n        dependency.currentVersion,\n        dependency.newVersion,\n        dependency.datasource,\n      );\n    }\n\n    const status = await getRepoStatus();\n    const chartsAddition = coerceArray(status?.not_added);\n    const chartsDeletion = coerceArray(status?.deleted);\n\n    const fileChanges: UpdateArtifactsResult[] = [];\n\n    for (const file of chartsAddition) {\n      // only add artifacts in the chartHome path\n      if (!file.startsWith(chartHome)) {\n        continue;\n      }\n      fileChanges.push({\n        file: {\n          type: 'addition',\n          path: file,\n          contents: await readLocalFile(file),\n        },\n      });\n    }\n\n    for (const file of chartsDeletion) {\n      // only add artifacts in the chartHome path\n      if (!file.startsWith(chartHome)) {\n        continue;\n      }\n      fileChanges.push({\n        file: {\n          type: 'deletion',\n          path: file,\n        },\n      });\n    }\n\n    return fileChanges.length > 0 ? fileChanges : null;\n  } catch (err) {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, 'Failed to inflate helm chart');\n    return [\n      {\n        artifactError: {\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAqBA,eAAe,uBACb,WACA,gBACA,SACwB;CACxB,MAAM,aAAa,GAAG,eAAe,GAAG;CACxC,MAAM,OAAO,MAAM,KAAK,WAAW,UAAU;CAG7C,OAAO,MAFkB,gBAAgB,IAAI,IAEzB,OAAO;AAC7B;AAEA,SAAS,mBACP,YACA,SACA,YACQ;CACR,QAAQ,YAAR;EACE,KAAK,eAAe,IAClB,OAAO,UAAU,MAAM,UAAU,EAAE,GAAG,MAAM,OAAO;EACrD,KAAK,iBAAiB,IACpB,OAAO,MAAM,SAAS,YAAY;;EAEpC,SACE,MAAM,IAAI,MAAM,uBAAuB,YAAY;CACvD;AACF;AAEA,eAAe,iBACb,aACA,aACA,WACA,SACA,YACA,gBACA,YACA,YACe;CACf,MAAM,2BAA2B,MAAM,uBACrC,WACA,SACA,cACF;CAEA,IAAI,CAAC,eAAe,kBAAkB,wBAAwB,GAAG;EAC/D,OAAO,MACL,gCAAgC,QAAQ,qFAC1C;EACA;CACF;CAEA,IACE,iBAAiB,wBAAwB,KACzC,iBAAiB,UAAU,GAC3B;EACA,OAAO,MAAM,iCAAiC,0BAA0B;EACxE,MAAM,gBAAgB,wBAAwB;CAChD;CAEA,MAAM,gBAAgB,cAAc;CACpC,MAAM,4BAA4B,MAAM,uBACtC,WACA,SACA,aACF;CAEA,IAAI,iBAAiB,yBAAyB,GAAG;EAC/C,OAAO,MACL,cAAc,QAAQ,WAAW,cAAc,qBAAqB,2BACtE;EACA;CACF;CAEA,MAAM,aAAa,GAAG,QAAQ,GAAG;CACjC,MAAM,WAAW,MAAM,KAAK,WAAW,UAAU;CACjD,OAAO,MACL,sBAAsB,QAAQ,WAAW,cAAc,MAAM,UAC/D;CAEA,MAAM,MACJ,gCAAgC,MAAM,QAAQ,EAAE,aACnC,MAAM,aAAa,EAAE,GAAG,mBAAmB,YAAY,SAAS,UAAU;CAEzF,MAAM,KAAK,KAAK,WAAW;AAC7B;AAEA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,6BAA6B,gBAAgB,EAAE;CAC5D,MAAM,UAAU,eAAe,qBAAqB;CACpD,MAAM,qCACJ,OAAO,mBAAmB,SAAS,4BAA4B,MAAM;CACvE,IAAI,kBAAkB,OAAO,GAC3B,OAAO,CACL,EACE,eAAe,EACb,QAAQ,2CACV,EACF,CACF;CAGF,MAAM,YAAY,mBAChB,iBACA,QAAQ,aAAa,aAAa,QACpC;CAEA,IAAI;EACF,MAAM,qBAAqC;GACzC,UAAU;GACV,YAAY,OAAO,aAAa;EAClC;EAEA,MAAM,cAA2B;GAC/B,QAAQ,CAAC;GACT,UAAU,iBAAiB,MAAM;GACjC,iBAAiB,CAAC,kBAAkB;EACtC;EAEA,KAAK,MAAM,cAAc,aAAa;GACpC,IAAI,CAAC,WAAW,gBACd;GAGF,IAAI,WAAW,eAAe,WAAW,gBACvC;GAGF,IAAI,CAAC,iBAAiB,WAAW,OAAO,GACtC;GAGF,IAAI,WAAW,YAAY,aACzB;GAGF,IAAI,aAAa;GAEjB,QAAQ,WAAW,YAAnB;IACE,KAAK,eAAe;KAClB,aAAa,WAAW,eAAe;KACvC;IACF,KAAK,iBAAiB,IACpB,aAAa,WAAW;GAE5B;GAEA,IAAI,kBAAkB,UAAU,GAC9B;GAGF,MAAM,iBACJ,oCACA,aACA,WACA,WAAW,SACX,YACA,WAAW,gBACX,WAAW,YACX,WAAW,UACb;EACF;EAEA,MAAM,SAAS,MAAM,cAAc;EACnC,MAAM,iBAAiB,YAAY,QAAQ,SAAS;EACpD,MAAM,iBAAiB,YAAY,QAAQ,OAAO;EAElD,MAAM,cAAuC,CAAC;EAE9C,KAAK,MAAM,QAAQ,gBAAgB;GAEjC,IAAI,CAAC,KAAK,WAAW,SAAS,GAC5B;GAEF,YAAY,KAAK,EACf,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU,MAAM,cAAc,IAAI;GACpC,EACF,CAAC;EACH;EAEA,KAAK,MAAM,QAAQ,gBAAgB;GAEjC,IAAI,CAAC,KAAK,WAAW,SAAS,GAC5B;GAEF,YAAY,KAAK,EACf,MAAM;IACJ,MAAM;IACN,MAAM;GACR,EACF,CAAC;EACH;EAEA,OAAO,YAAY,SAAS,IAAI,cAAc;CAChD,SAAS,KAAK;EACZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,8BAA8B;EACpD,OAAO,CACL,EACE,eAAe,EACb,QAAQ,IAAI,QACd,EACF,CACF;CACF;AACF"}
+{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/kustomize/artifacts.ts"],"sourcesContent":["import { isNonEmptyString, isNullOrUndefined } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ToolConstraint } from '../../../util/exec/types.ts';\nimport {\n  deleteLocalFile,\n  getSiblingFileName,\n  localPathExists,\n  readLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport { DockerDatasource } from '../../datasource/docker/index.ts';\nimport { HelmDatasource } from '../../datasource/helm/index.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\nimport { generateHelmEnvs } from './common.ts';\nimport { parseKustomize } from './extract.ts';\n\nasync function localExistingChartPath(\n  chartHome: string,\n  dependencyName: string,\n  version?: string,\n): Promise<string | null> {\n  const folderName = `${dependencyName}-${version}`;\n  const path = upath.join(chartHome, folderName);\n  const pathExists = await localPathExists(path);\n\n  return pathExists ? path : null;\n}\n\nfunction helmRepositoryArgs(\n  repository: string,\n  depName: string,\n  datasource?: string,\n): string {\n  switch (datasource) {\n    case HelmDatasource.id:\n      return `--repo ${quote(repository)} ${quote(depName)}`;\n    case DockerDatasource.id:\n      return quote(`oci://${repository}`);\n    /* v8 ignore next: should never happen */\n    default:\n      throw new Error(`Unknown datasource: ${datasource}`);\n  }\n}\n\nasync function inflateHelmChart(\n  flagEnabled: boolean,\n  execOptions: ExecOptions,\n  chartHome: string,\n  depName: string,\n  repository: string,\n  currentVersion: string,\n  newVersion?: string,\n  datasource?: string,\n): Promise<void> {\n  const currentChartExistingPath = await localExistingChartPath(\n    chartHome,\n    depName,\n    currentVersion,\n  );\n\n  if (!flagEnabled && isNullOrUndefined(currentChartExistingPath)) {\n    logger.debug(\n      `Not inflating Helm chart for ${depName} as kustomizeInflateHelmCharts is not enabled and the current version isn't inflated`,\n    );\n    return;\n  }\n\n  if (\n    isNonEmptyString(currentChartExistingPath) &&\n    isNonEmptyString(newVersion)\n  ) {\n    logger.debug(`Deleting previous helm chart: ${currentChartExistingPath}`);\n    await deleteLocalFile(currentChartExistingPath);\n  }\n\n  const versionToPull = newVersion ?? currentVersion;\n  const versionToPullExistingPath = await localExistingChartPath(\n    chartHome,\n    depName,\n    versionToPull,\n  );\n\n  if (isNonEmptyString(versionToPullExistingPath)) {\n    logger.debug(\n      `Helm chart ${depName} version ${versionToPull} already exists at ${versionToPullExistingPath}`,\n    );\n    return;\n  }\n\n  const folderName = `${depName}-${versionToPull}`;\n  const untarDir = upath.join(chartHome, folderName);\n  logger.debug(\n    `Pulling helm chart ${depName} version ${versionToPull} to ${untarDir}`,\n  );\n\n  const cmd =\n    `helm pull --untar --untardir ${quote(untarDir)} ` +\n    `--version ${quote(versionToPull)} ${helmRepositoryArgs(repository, depName, datasource)}`;\n\n  await exec(cmd, execOptions);\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`kustomize.updateArtifacts(${packageFileName})`);\n  const project = parseKustomize(newPackageFileContent);\n  const isUpdateOptionInflateChartArchives =\n    config.postUpdateOptions?.includes('kustomizeInflateHelmCharts') === true;\n  if (isNullOrUndefined(project)) {\n    return [\n      {\n        artifactError: {\n          stderr: 'Failed to parse new package file content',\n        },\n      },\n    ];\n  }\n\n  const chartHome = getSiblingFileName(\n    packageFileName,\n    project.helmGlobals?.chartHome ?? 'charts',\n  );\n\n  try {\n    const helmConstraint = await resolveToolConstraint(config, 'helm');\n    const helmToolConstraint: ToolConstraint = {\n      toolName: 'helm',\n      constraint: helmConstraint,\n    };\n\n    const execOptions: ExecOptions = {\n      docker: {},\n      extraEnv: generateHelmEnvs(helmConstraint),\n      toolConstraints: [helmToolConstraint],\n    };\n\n    for (const dependency of updatedDeps) {\n      if (!dependency.currentVersion) {\n        continue;\n      }\n\n      if (dependency.newVersion === dependency.currentVersion) {\n        continue;\n      }\n\n      if (!isNonEmptyString(dependency.depName)) {\n        continue;\n      }\n\n      if (dependency.depType !== 'HelmChart') {\n        continue;\n      }\n\n      let repository = null;\n\n      switch (dependency.datasource) {\n        case HelmDatasource.id:\n          repository = dependency.registryUrls?.[0];\n          break;\n        case DockerDatasource.id:\n          repository = dependency.packageName;\n          break;\n      }\n\n      if (isNullOrUndefined(repository)) {\n        continue;\n      }\n\n      await inflateHelmChart(\n        isUpdateOptionInflateChartArchives,\n        execOptions,\n        chartHome,\n        dependency.depName,\n        repository,\n        dependency.currentVersion,\n        dependency.newVersion,\n        dependency.datasource,\n      );\n    }\n\n    const status = await getRepoStatus();\n    const chartsAddition = coerceArray(status?.not_added);\n    const chartsDeletion = coerceArray(status?.deleted);\n\n    const fileChanges: UpdateArtifactsResult[] = [];\n\n    for (const file of chartsAddition) {\n      // only add artifacts in the chartHome path\n      if (!file.startsWith(chartHome)) {\n        continue;\n      }\n      fileChanges.push({\n        file: {\n          type: 'addition',\n          path: file,\n          contents: await readLocalFile(file),\n        },\n      });\n    }\n\n    for (const file of chartsDeletion) {\n      // only add artifacts in the chartHome path\n      if (!file.startsWith(chartHome)) {\n        continue;\n      }\n      fileChanges.push({\n        file: {\n          type: 'deletion',\n          path: file,\n        },\n      });\n    }\n\n    return fileChanges.length > 0 ? fileChanges : null;\n  } catch (err) {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, 'Failed to inflate helm chart');\n    return [\n      {\n        artifactError: {\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAsBA,eAAe,uBACb,WACA,gBACA,SACwB;CACxB,MAAM,aAAa,GAAG,eAAe,GAAG;CACxC,MAAM,OAAO,MAAM,KAAK,WAAW,UAAU;CAG7C,OAAO,MAFkB,gBAAgB,IAAI,IAEzB,OAAO;AAC7B;AAEA,SAAS,mBACP,YACA,SACA,YACQ;CACR,QAAQ,YAAR;EACE,KAAK,eAAe,IAClB,OAAO,UAAU,MAAM,UAAU,EAAE,GAAG,MAAM,OAAO;EACrD,KAAK,iBAAiB,IACpB,OAAO,MAAM,SAAS,YAAY;;EAEpC,SACE,MAAM,IAAI,MAAM,uBAAuB,YAAY;CACvD;AACF;AAEA,eAAe,iBACb,aACA,aACA,WACA,SACA,YACA,gBACA,YACA,YACe;CACf,MAAM,2BAA2B,MAAM,uBACrC,WACA,SACA,cACF;CAEA,IAAI,CAAC,eAAe,kBAAkB,wBAAwB,GAAG;EAC/D,OAAO,MACL,gCAAgC,QAAQ,qFAC1C;EACA;CACF;CAEA,IACE,iBAAiB,wBAAwB,KACzC,iBAAiB,UAAU,GAC3B;EACA,OAAO,MAAM,iCAAiC,0BAA0B;EACxE,MAAM,gBAAgB,wBAAwB;CAChD;CAEA,MAAM,gBAAgB,cAAc;CACpC,MAAM,4BAA4B,MAAM,uBACtC,WACA,SACA,aACF;CAEA,IAAI,iBAAiB,yBAAyB,GAAG;EAC/C,OAAO,MACL,cAAc,QAAQ,WAAW,cAAc,qBAAqB,2BACtE;EACA;CACF;CAEA,MAAM,aAAa,GAAG,QAAQ,GAAG;CACjC,MAAM,WAAW,MAAM,KAAK,WAAW,UAAU;CACjD,OAAO,MACL,sBAAsB,QAAQ,WAAW,cAAc,MAAM,UAC/D;CAEA,MAAM,MACJ,gCAAgC,MAAM,QAAQ,EAAE,aACnC,MAAM,aAAa,EAAE,GAAG,mBAAmB,YAAY,SAAS,UAAU;CAEzF,MAAM,KAAK,KAAK,WAAW;AAC7B;AAEA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,6BAA6B,gBAAgB,EAAE;CAC5D,MAAM,UAAU,eAAe,qBAAqB;CACpD,MAAM,qCACJ,OAAO,mBAAmB,SAAS,4BAA4B,MAAM;CACvE,IAAI,kBAAkB,OAAO,GAC3B,OAAO,CACL,EACE,eAAe,EACb,QAAQ,2CACV,EACF,CACF;CAGF,MAAM,YAAY,mBAChB,iBACA,QAAQ,aAAa,aAAa,QACpC;CAEA,IAAI;EACF,MAAM,iBAAiB,MAAM,sBAAsB,QAAQ,MAAM;EACjE,MAAM,qBAAqC;GACzC,UAAU;GACV,YAAY;EACd;EAEA,MAAM,cAA2B;GAC/B,QAAQ,CAAC;GACT,UAAU,iBAAiB,cAAc;GACzC,iBAAiB,CAAC,kBAAkB;EACtC;EAEA,KAAK,MAAM,cAAc,aAAa;GACpC,IAAI,CAAC,WAAW,gBACd;GAGF,IAAI,WAAW,eAAe,WAAW,gBACvC;GAGF,IAAI,CAAC,iBAAiB,WAAW,OAAO,GACtC;GAGF,IAAI,WAAW,YAAY,aACzB;GAGF,IAAI,aAAa;GAEjB,QAAQ,WAAW,YAAnB;IACE,KAAK,eAAe;KAClB,aAAa,WAAW,eAAe;KACvC;IACF,KAAK,iBAAiB,IACpB,aAAa,WAAW;GAE5B;GAEA,IAAI,kBAAkB,UAAU,GAC9B;GAGF,MAAM,iBACJ,oCACA,aACA,WACA,WAAW,SACX,YACA,WAAW,gBACX,WAAW,YACX,WAAW,UACb;EACF;EAEA,MAAM,SAAS,MAAM,cAAc;EACnC,MAAM,iBAAiB,YAAY,QAAQ,SAAS;EACpD,MAAM,iBAAiB,YAAY,QAAQ,OAAO;EAElD,MAAM,cAAuC,CAAC;EAE9C,KAAK,MAAM,QAAQ,gBAAgB;GAEjC,IAAI,CAAC,KAAK,WAAW,SAAS,GAC5B;GAEF,YAAY,KAAK,EACf,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU,MAAM,cAAc,IAAI;GACpC,EACF,CAAC;EACH;EAEA,KAAK,MAAM,QAAQ,gBAAgB;GAEjC,IAAI,CAAC,KAAK,WAAW,SAAS,GAC5B;GAEF,YAAY,KAAK,EACf,MAAM;IACJ,MAAM;IACN,MAAM;GACR,EACF,CAAC;EACH;EAEA,OAAO,YAAY,SAAS,IAAI,cAAc;CAChD,SAAS,KAAK;EACZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,8BAA8B;EACpD,OAAO,CACL,EACE,eAAe,EACb,QAAQ,IAAI,QACd,EACF,CACF;CACF;AACF"}

package/dist/modules/manager/kustomize/common.js

@@ -2,14 +2,14 @@ import { privateCacheDir } from "../../../util/fs/index.js";
 import upath from "upath";
 import semver from "semver";
 //#region lib/modules/manager/kustomize/common.ts
-function generateHelmEnvs(config) {
+function generateHelmEnvs(helmConstraint) {
 	const cacheDir = privateCacheDir();
 	const envs = {
 		HELM_REGISTRY_CONFIG: upath.join(cacheDir, "registry.json"),
 		HELM_REPOSITORY_CONFIG: upath.join(cacheDir, "repositories.yaml"),
 		HELM_REPOSITORY_CACHE: upath.join(cacheDir, "repositories")
 	};
-	if (config.constraints?.helm && !semver.intersects(config.constraints.helm, ">=3.8.0")) envs.HELM_EXPERIMENTAL_OCI = "1";
+	if (helmConstraint && !semver.intersects(helmConstraint, ">=3.8.0")) envs.HELM_EXPERIMENTAL_OCI = "1";
 	return envs;
 }
 //#endregion

package/dist/modules/manager/kustomize/common.js.map

@@ -1 +1 @@
-{"version":3,"file":"common.js","names":[],"sources":["../../../../lib/modules/manager/kustomize/common.ts"],"sourcesContent":["import semver from 'semver';\nimport upath from 'upath';\nimport type { ExtraEnv } from '../../../util/exec/types.ts';\nimport { privateCacheDir } from '../../../util/fs/index.ts';\nimport type { UpdateArtifactsConfig } from '../types.ts';\n\nexport function generateHelmEnvs(config: UpdateArtifactsConfig): ExtraEnv {\n  const cacheDir = privateCacheDir();\n\n  const envs: ExtraEnv = {\n    // set cache and config files to a path in privateCacheDir to prevent file and credential leakage\n    HELM_REGISTRY_CONFIG: upath.join(cacheDir, 'registry.json'),\n    HELM_REPOSITORY_CONFIG: upath.join(cacheDir, 'repositories.yaml'),\n    HELM_REPOSITORY_CACHE: upath.join(cacheDir, 'repositories'),\n  };\n\n  if (\n    config.constraints?.helm &&\n    !semver.intersects(config.constraints.helm, '>=3.8.0')\n  ) {\n    envs.HELM_EXPERIMENTAL_OCI = '1';\n  }\n\n  return envs;\n}\n"],"mappings":";;;;AAMA,SAAgB,iBAAiB,QAAyC;CACxE,MAAM,WAAW,gBAAgB;CAEjC,MAAM,OAAiB;EAErB,sBAAsB,MAAM,KAAK,UAAU,eAAe;EAC1D,wBAAwB,MAAM,KAAK,UAAU,mBAAmB;EAChE,uBAAuB,MAAM,KAAK,UAAU,cAAc;CAC5D;CAEA,IACE,OAAO,aAAa,QACpB,CAAC,OAAO,WAAW,OAAO,YAAY,MAAM,SAAS,GAErD,KAAK,wBAAwB;CAG/B,OAAO;AACT"}
+{"version":3,"file":"common.js","names":[],"sources":["../../../../lib/modules/manager/kustomize/common.ts"],"sourcesContent":["import semver from 'semver';\nimport upath from 'upath';\nimport type { ExtraEnv } from '../../../util/exec/types.ts';\nimport { privateCacheDir } from '../../../util/fs/index.ts';\n\nexport function generateHelmEnvs(helmConstraint: string | undefined): ExtraEnv {\n  const cacheDir = privateCacheDir();\n\n  const envs: ExtraEnv = {\n    // set cache and config files to a path in privateCacheDir to prevent file and credential leakage\n    HELM_REGISTRY_CONFIG: upath.join(cacheDir, 'registry.json'),\n    HELM_REPOSITORY_CONFIG: upath.join(cacheDir, 'repositories.yaml'),\n    HELM_REPOSITORY_CACHE: upath.join(cacheDir, 'repositories'),\n  };\n\n  if (helmConstraint && !semver.intersects(helmConstraint, '>=3.8.0')) {\n    envs.HELM_EXPERIMENTAL_OCI = '1';\n  }\n\n  return envs;\n}\n"],"mappings":";;;;AAKA,SAAgB,iBAAiB,gBAA8C;CAC7E,MAAM,WAAW,gBAAgB;CAEjC,MAAM,OAAiB;EAErB,sBAAsB,MAAM,KAAK,UAAU,eAAe;EAC1D,wBAAwB,MAAM,KAAK,UAAU,mBAAmB;EAChE,uBAAuB,MAAM,KAAK,UAAU,cAAc;CAC5D;CAEA,IAAI,kBAAkB,CAAC,OAAO,WAAW,gBAAgB,SAAS,GAChE,KAAK,wBAAwB;CAG/B,OAAO;AACT"}

package/dist/modules/manager/maven-wrapper/artifacts.js

@@ -8,6 +8,7 @@ import { withCache } from "../../../util/cache/package/with-cache.js";
 import { Http } from "../../../util/http/index.js";
 import { exec } from "../../../util/exec/index.js";
 import { getRepoStatus } from "../../../util/git/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { isTruthy } from "@sindresorhus/is";
 import { quote } from "shlex";
 import upath from "upath";
@@ -177,7 +178,7 @@ async function executeWrapperCommand(cmd, config, packageFileName, extraEnv) {
 		extraEnv,
 		toolConstraints: [{
 			toolName: "java",
-			constraint: config.constraints?.java ?? getJavaConstraint(config.currentValue)
+			constraint: await resolveToolConstraint(config, "java", () => getJavaConstraint(config.currentValue))
 		}]
 	};
 	try {

package/dist/modules/manager/maven-wrapper/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":["mavenVersioning"],"sources":["../../../../lib/modules/manager/maven-wrapper/artifacts.ts"],"sourcesContent":["import type { Stats } from 'node:fs';\nimport os from 'node:os';\nimport { isTruthy } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { withCache } from '../../../util/cache/package/with-cache.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ExtraEnv } from '../../../util/exec/types.ts';\nimport {\n  chmodLocalFile,\n  deleteLocalFile,\n  readLocalFile,\n  statLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport type { StatusResult } from '../../../util/git/types.ts';\nimport { hashStream } from '../../../util/hash.ts';\nimport { Http } from '../../../util/http/index.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport mavenVersioning from '../../versioning/maven/index.ts';\nimport type {\n  PackageDependency,\n  UpdateArtifact,\n  UpdateArtifactsConfig,\n  UpdateArtifactsResult,\n} from '../types.ts';\n\nconst http = new Http('maven-wrapper');\nconst DEFAULT_MAVEN_REPO_URL = 'https://repo.maven.apache.org/maven2';\n\nfunction getChecksumFromUrl(url: string): Promise<string> {\n  return withCache(\n    {\n      namespace: 'url-sha256',\n      key: url,\n      ttlMinutes: 3 * 24 * 60, // 3 days\n    },\n    () => hashStream(http.stream(url), 'sha256'),\n  );\n}\n\nfunction getDistributionUrl(content: string): string | null {\n  const match = regEx(/^distributionUrl\\s*=\\s*(?<distributionUrl>.+)$/m).exec(\n    content,\n  );\n  return (\n    match?.groups?.distributionUrl?.replace(regEx(/\\\\:/g), ':').trim() ?? null\n  );\n}\n\nfunction getWrapperUrl(content: string): string | null {\n  const match = regEx(/^wrapperUrl\\s*=\\s*(?<wrapperUrl>.+)$/m).exec(content);\n  return match?.groups?.wrapperUrl?.replace(regEx(/\\\\:/g), ':').trim() ?? null;\n}\n\nfunction constructWrapperUrl(\n  version: string,\n  repoUrl: string = DEFAULT_MAVEN_REPO_URL,\n): string {\n  return `${repoUrl}/org/apache/maven/wrapper/maven-wrapper/${version}/maven-wrapper-${version}.jar`;\n}\n\nfunction getWrapperVersion(content: string): string | null {\n  const match = regEx(/^wrapperVersion\\s*=\\s*(?<wrapperVersion>.+)$/m).exec(\n    content,\n  );\n  return match?.groups?.wrapperVersion?.trim() ?? null;\n}\n\nfunction getDistributionType(content: string): string | null {\n  const match = regEx(/^distributionType\\s*=\\s*(?<distributionType>.+)$/m).exec(\n    content,\n  );\n  return match?.groups?.distributionType?.trim() ?? null;\n}\n\nfunction getChecksumValue(content: string, key: string): string | null {\n  const match = regEx(`^${key}\\\\s*=\\\\s*(?<value>.+)$`, 'm').exec(content);\n  return match?.groups?.value?.trim() ?? null;\n}\n\nfunction addChecksumAfterLine(\n  content: string,\n  lineRegex: RegExp,\n  key: string,\n  value: string,\n): string {\n  return content.replace(\n    regEx(lineRegex),\n    (lineMatch) => `${lineMatch}\\n${key}=${value}`,\n  );\n}\n\nasync function updateChecksums(\n  content: string,\n  updatedDeps: PackageDependency[],\n  addDistributionChecksum: boolean,\n  addWrapperChecksum: boolean,\n  originalContent: string,\n): Promise<string> {\n  let updatedContent = content;\n\n  // Update or add distribution checksum\n  if (addDistributionChecksum) {\n    const existingChecksum = getChecksumValue(\n      updatedContent,\n      'distributionSha256Sum',\n    );\n    const fallbackChecksum = getChecksumValue(\n      originalContent,\n      'distributionSha256Sum',\n    );\n    const distUrl = getDistributionUrl(updatedContent);\n    if (distUrl) {\n      try {\n        const checksum = await getChecksumFromUrl(distUrl);\n        if (existingChecksum) {\n          updatedContent = updatedContent.replace(\n            regEx(/distributionSha256Sum=.*/),\n            `distributionSha256Sum=${checksum}`,\n          );\n        } else {\n          // Add checksum after distributionUrl\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:distributionUrl\\s*=\\s*.+)$/m),\n            'distributionSha256Sum',\n            checksum,\n          );\n        }\n      } catch (err) {\n        logger.warn(\n          { err, url: distUrl },\n          'Failed to fetch distribution checksum',\n        );\n        if (!existingChecksum && fallbackChecksum) {\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:distributionUrl\\s*=\\s*.+)$/m),\n            'distributionSha256Sum',\n            fallbackChecksum,\n          );\n        }\n      }\n    }\n  }\n\n  // Update or add wrapper checksum\n  if (addWrapperChecksum) {\n    const existingChecksum = getChecksumValue(\n      updatedContent,\n      'wrapperSha256Sum',\n    );\n    const fallbackChecksum = getChecksumValue(\n      originalContent,\n      'wrapperSha256Sum',\n    );\n    let wrapperUrl = getWrapperUrl(updatedContent);\n\n    // If no wrapperUrl, try to construct from wrapperVersion\n    if (!wrapperUrl) {\n      const wrapperVersion = getWrapperVersion(updatedContent);\n      if (wrapperVersion) {\n        const customRepoUrl = getCustomMavenWrapperRepoUrl(updatedDeps);\n        wrapperUrl = constructWrapperUrl(\n          wrapperVersion,\n          customRepoUrl ?? DEFAULT_MAVEN_REPO_URL,\n        );\n      }\n    }\n\n    if (wrapperUrl) {\n      try {\n        const checksum = await getChecksumFromUrl(wrapperUrl);\n        if (existingChecksum) {\n          updatedContent = updatedContent.replace(\n            regEx(/wrapperSha256Sum=.*/),\n            `wrapperSha256Sum=${checksum}`,\n          );\n        } else {\n          // Add checksum after wrapperUrl or wrapperVersion\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:wrapperUrl\\s*=\\s*.+|wrapperVersion\\s*=\\s*.+)$/m),\n            'wrapperSha256Sum',\n            checksum,\n          );\n        }\n      } catch (err) {\n        logger.warn(\n          { err, url: wrapperUrl },\n          'Failed to fetch wrapper checksum',\n        );\n        if (!existingChecksum && fallbackChecksum) {\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:wrapperUrl\\s*=\\s*.+|wrapperVersion\\s*=\\s*.+)$/m),\n            'wrapperSha256Sum',\n            fallbackChecksum,\n          );\n        }\n      }\n    }\n  }\n\n  return updatedContent;\n}\n\ninterface MavenWrapperPaths {\n  wrapperExecutableFileName: string;\n  localProjectDir: string;\n  wrapperFullyQualifiedPath: string;\n}\n\nasync function addIfUpdated(\n  status: StatusResult,\n  fileProjectPath: string,\n): Promise<UpdateArtifactsResult | null> {\n  if (status.modified.includes(fileProjectPath)) {\n    return {\n      file: {\n        type: 'addition',\n        path: fileProjectPath,\n        contents: await readLocalFile(fileProjectPath),\n      },\n    };\n  }\n  return null;\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  newPackageFileContent,\n  updatedDeps,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  try {\n    logger.debug({ updatedDeps }, 'maven-wrapper.updateArtifacts()');\n\n    const hasMavenUpdate = updatedDeps.some((dep) => dep.depName === 'maven');\n    const hasWrapperUpdate = updatedDeps.some(\n      (dep) => dep.depName === 'maven-wrapper',\n    );\n    // Remember original content properties - we'll restore them after wrapper:wrapper\n    const hadDistributionChecksum = newPackageFileContent.includes(\n      'distributionSha256Sum=',\n    );\n    const hadWrapperChecksum =\n      newPackageFileContent.includes('wrapperSha256Sum=');\n    const originalDistributionType = getDistributionType(newPackageFileContent);\n\n    // Skip if no relevant updates\n    if (!hasWrapperUpdate && !(hasMavenUpdate && hadDistributionChecksum)) {\n      logger.debug(\n        'No Maven wrapper or distribution checksum updates - skipping Artifacts update',\n      );\n      return null;\n    }\n\n    // If wrapper is being updated, check if mvnw exists first\n    let cmd: string | null = null;\n    if (hasWrapperUpdate) {\n      cmd = await createWrapperCommand(\n        packageFileName,\n        originalDistributionType,\n      );\n\n      if (!cmd) {\n        logger.info('No mvnw found - skipping Artifacts update');\n        return null;\n      }\n    }\n\n    // Delete old maven-wrapper.jar if checksums exist and wrapper:wrapper will run\n    // This prevents checksum validation failure when wrapper:wrapper runs\n    if (hasWrapperUpdate && (hadWrapperChecksum || hadDistributionChecksum)) {\n      const jarPath = packageFileName.replace(\n        'maven-wrapper.properties',\n        'maven-wrapper.jar',\n      );\n      if (jarPath.endsWith('maven-wrapper.jar')) {\n        try {\n          await deleteLocalFile(jarPath);\n          logger.debug({ jarPath }, 'Deleted old maven-wrapper.jar');\n        } catch {\n          // File may not exist, ignore\n        }\n      }\n    }\n\n    // Strip checksum lines before running wrapper:wrapper to avoid validation failure\n    // (mvnw would try to validate NEW jar against OLD checksum)\n    let contentToWrite = newPackageFileContent;\n    if (hasWrapperUpdate && (hadWrapperChecksum || hadDistributionChecksum)) {\n      contentToWrite = contentToWrite\n        .replace(regEx(/^distributionSha256Sum=.*\\n?/m), '')\n        .replace(regEx(/^wrapperSha256Sum=.*\\n?/m), '');\n    }\n\n    // Write the properties file\n    await writeLocalFile(packageFileName, contentToWrite);\n\n    // Run wrapper:wrapper if the wrapper itself is being updated\n    if (hasWrapperUpdate && cmd) {\n      const extraEnv = getExtraEnvOptions(updatedDeps);\n      await executeWrapperCommand(cmd, config, packageFileName, extraEnv);\n    }\n\n    // Now update checksums AFTER wrapper:wrapper has run (if it ran)\n    // This ensures we compute checksums for the actual generated content\n    if (hadDistributionChecksum || hadWrapperChecksum) {\n      const currentContent = await readLocalFile(packageFileName, 'utf8');\n      if (currentContent) {\n        const contentWithChecksums = await updateChecksums(\n          currentContent,\n          updatedDeps,\n          hadDistributionChecksum,\n          hadWrapperChecksum,\n          newPackageFileContent,\n        );\n        await writeLocalFile(packageFileName, contentWithChecksums);\n      }\n    }\n\n    const status = await getRepoStatus();\n    const artifactFileNames = [\n      '.mvn/wrapper/maven-wrapper.properties',\n      '.mvn/wrapper/maven-wrapper.jar',\n      '.mvn/wrapper/MavenWrapperDownloader.java',\n      'mvnw',\n      'mvnw.cmd',\n    ].map(\n      (filename) =>\n        packageFileName.replace('.mvn/wrapper/maven-wrapper.properties', '') +\n        filename,\n    );\n    const updateArtifactsResult = (\n      await getUpdatedArtifacts(status, artifactFileNames)\n    ).filter(isTruthy);\n\n    logger.debug(\n      { files: updateArtifactsResult.map((r) => r.file?.path) },\n      `Returning updated maven-wrapper files`,\n    );\n    return updateArtifactsResult;\n  } catch (err) {\n    logger.debug({ err }, 'Error setting new Maven Wrapper release value');\n    return [\n      {\n        artifactError: {\n          fileName: packageFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n\nasync function getUpdatedArtifacts(\n  status: StatusResult,\n  artifactFileNames: string[],\n): Promise<UpdateArtifactsResult[]> {\n  const updatedResults: UpdateArtifactsResult[] = [];\n  for (const artifactFileName of artifactFileNames) {\n    const updatedResult = await addIfUpdated(status, artifactFileName);\n    if (updatedResult !== null) {\n      updatedResults.push(updatedResult);\n    }\n  }\n  return updatedResults;\n}\n\n/**\n * Find compatible java version for maven.\n * see https://maven.apache.org/developers/compatibility-plan.html\n * @param mavenWrapperVersion current maven version\n * @returns A Java semver range\n */\nexport function getJavaConstraint(\n  mavenWrapperVersion: string | null | undefined,\n): string | null {\n  const major = mavenWrapperVersion\n    ? mavenVersioning.getMajor(mavenWrapperVersion)\n    : null;\n\n  if (major && major >= 3) {\n    return '^17.0.0';\n  }\n\n  return '^8.0.0';\n}\n\nasync function executeWrapperCommand(\n  cmd: string,\n  config: UpdateArtifactsConfig,\n  packageFileName: string,\n  extraEnv: ExtraEnv,\n): Promise<void> {\n  logger.debug(`Updating maven wrapper: \"${cmd}\"`);\n  const { wrapperFullyQualifiedPath } = getMavenPaths(packageFileName);\n\n  const execOptions: ExecOptions = {\n    cwdFile: wrapperFullyQualifiedPath,\n    docker: {},\n    extraEnv,\n    toolConstraints: [\n      {\n        toolName: 'java',\n        constraint:\n          config.constraints?.java ?? getJavaConstraint(config.currentValue),\n      },\n    ],\n  };\n\n  try {\n    await exec(cmd, execOptions);\n  } catch (err) {\n    logger.error({ err }, 'Error executing maven wrapper update command.');\n    throw err;\n  }\n}\n\nfunction getExtraEnvOptions(deps: PackageDependency[]): ExtraEnv {\n  const customMavenWrapperUrl = getCustomMavenWrapperRepoUrl(deps);\n  if (customMavenWrapperUrl) {\n    return { MVNW_REPOURL: customMavenWrapperUrl };\n  }\n  return {};\n}\n\nfunction getCustomMavenWrapperRepoUrl(\n  deps: PackageDependency[],\n): string | null {\n  const replaceString = deps.find(\n    (dep) => dep.depName === 'maven-wrapper',\n  )?.replaceString;\n\n  if (!replaceString) {\n    return null;\n  }\n\n  const match = regEx(/^(?<repoUrl>.*?)\\/org\\/apache\\/maven\\/wrapper\\//).exec(\n    replaceString,\n  );\n\n  if (!match) {\n    return null;\n  }\n\n  return match.groups!.repoUrl === DEFAULT_MAVEN_REPO_URL\n    ? null\n    : match.groups!.repoUrl;\n}\n\nasync function createWrapperCommand(\n  packageFileName: string,\n  distributionType: string | null,\n): Promise<string | null> {\n  const {\n    wrapperExecutableFileName,\n    localProjectDir,\n    wrapperFullyQualifiedPath,\n  } = getMavenPaths(packageFileName);\n\n  // Use existing distributionType or default to 'script' to preserve JAR-based mode\n  // (prevents Maven 3.3.x from defaulting to only-script which doesn't support checksums)\n  const type = distributionType ?? 'script';\n  const args = `wrapper:wrapper -Dtype=${quote(type)}`;\n\n  return await prepareCommand(\n    wrapperExecutableFileName,\n    localProjectDir,\n    await statLocalFile(wrapperFullyQualifiedPath),\n    args,\n  );\n}\n\nfunction mavenWrapperFileName(): string {\n  if (\n    os.platform() === 'win32' &&\n    GlobalConfig.get('binarySource') !== 'docker'\n  ) {\n    return 'mvnw.cmd';\n  }\n  return './mvnw';\n}\n\nfunction getMavenPaths(packageFileName: string): MavenWrapperPaths {\n  const wrapperExecutableFileName = mavenWrapperFileName();\n  const localProjectDir = upath.join(\n    upath.dirname(packageFileName),\n    packageFileName.includes('mvnw') ? '.' : '../../',\n  );\n  const wrapperFullyQualifiedPath = upath.join(\n    localProjectDir,\n    wrapperExecutableFileName,\n  );\n  return {\n    wrapperExecutableFileName,\n    localProjectDir,\n    wrapperFullyQualifiedPath,\n  };\n}\n\nasync function prepareCommand(\n  fileName: string,\n  cwd: string | undefined,\n  pathFileStats: Stats | null,\n  args: string | null,\n): Promise<string | null> {\n  /* v8 ignore next -- hard to test */\n  if (pathFileStats?.isFile() === true) {\n    // if the file is not executable by others\n    if (os.platform() !== 'win32' && (pathFileStats.mode & 0o1) === 0) {\n      // add the execution permission to the owner, group and others\n      logger.warn('Maven wrapper is missing the executable bit');\n      await chmodLocalFile(\n        // TODO: types (#22198)\n        upath.join(cwd!, fileName),\n        pathFileStats.mode | 0o111,\n      );\n    }\n    if (args === null) {\n      return fileName;\n    }\n    return `${fileName} ${args}`;\n  }\n  return null;\n}\n"],"mappings":";;;;;;;;;;;;;;;AA8BA,MAAM,OAAO,IAAI,KAAK,eAAe;AACrC,MAAM,yBAAyB;AAE/B,SAAS,mBAAmB,KAA8B;CACxD,OAAO,UACL;EACE,WAAW;EACX,KAAK;EACL,YAAY;CACd,SACM,WAAW,KAAK,OAAO,GAAG,GAAG,QAAQ,CAC7C;AACF;AAEA,SAAS,mBAAmB,SAAgC;CAI1D,OAHc,MAAM,iDAAiD,CAAC,CAAC,KACrE,OAGI,CAAC,EAAE,QAAQ,iBAAiB,QAAQ,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK;AAE1E;AAEA,SAAS,cAAc,SAAgC;CAErD,OADc,MAAM,uCAAuC,CAAC,CAAC,KAAK,OACvD,CAAC,EAAE,QAAQ,YAAY,QAAQ,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK;AAC1E;AAEA,SAAS,oBACP,SACA,UAAkB,wBACV;CACR,OAAO,GAAG,QAAQ,0CAA0C,QAAQ,iBAAiB,QAAQ;AAC/F;AAEA,SAAS,kBAAkB,SAAgC;CAIzD,OAHc,MAAM,+CAA+C,CAAC,CAAC,KACnE,OAES,CAAC,EAAE,QAAQ,gBAAgB,KAAK,KAAK;AAClD;AAEA,SAAS,oBAAoB,SAAgC;CAI3D,OAHc,MAAM,mDAAmD,CAAC,CAAC,KACvE,OAES,CAAC,EAAE,QAAQ,kBAAkB,KAAK,KAAK;AACpD;AAEA,SAAS,iBAAiB,SAAiB,KAA4B;CAErE,OADc,MAAM,IAAI,IAAI,yBAAyB,GAAG,CAAC,CAAC,KAAK,OACpD,CAAC,EAAE,QAAQ,OAAO,KAAK,KAAK;AACzC;AAEA,SAAS,qBACP,SACA,WACA,KACA,OACQ;CACR,OAAO,QAAQ,QACb,MAAM,SAAS,IACd,cAAc,GAAG,UAAU,IAAI,IAAI,GAAG,OACzC;AACF;AAEA,eAAe,gBACb,SACA,aACA,yBACA,oBACA,iBACiB;CACjB,IAAI,iBAAiB;CAGrB,IAAI,yBAAyB;EAC3B,MAAM,mBAAmB,iBACvB,gBACA,uBACF;EACA,MAAM,mBAAmB,iBACvB,iBACA,uBACF;EACA,MAAM,UAAU,mBAAmB,cAAc;EACjD,IAAI,SACF,IAAI;GACF,MAAM,WAAW,MAAM,mBAAmB,OAAO;GACjD,IAAI,kBACF,iBAAiB,eAAe,QAC9B,MAAM,0BAA0B,GAChC,yBAAyB,UAC3B;QAGA,iBAAiB,qBACf,gBACA,MAAM,iCAAiC,GACvC,yBACA,QACF;EAEJ,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK,KAAK;GAAQ,GACpB,uCACF;GACA,IAAI,CAAC,oBAAoB,kBACvB,iBAAiB,qBACf,gBACA,MAAM,iCAAiC,GACvC,yBACA,gBACF;EAEJ;CAEJ;CAGA,IAAI,oBAAoB;EACtB,MAAM,mBAAmB,iBACvB,gBACA,kBACF;EACA,MAAM,mBAAmB,iBACvB,iBACA,kBACF;EACA,IAAI,aAAa,cAAc,cAAc;EAG7C,IAAI,CAAC,YAAY;GACf,MAAM,iBAAiB,kBAAkB,cAAc;GACvD,IAAI,gBAEF,aAAa,oBACX,gBAFoB,6BAA6B,WAGrC,KAAK,sBACnB;EAEJ;EAEA,IAAI,YACF,IAAI;GACF,MAAM,WAAW,MAAM,mBAAmB,UAAU;GACpD,IAAI,kBACF,iBAAiB,eAAe,QAC9B,MAAM,qBAAqB,GAC3B,oBAAoB,UACtB;QAGA,iBAAiB,qBACf,gBACA,MAAM,oDAAoD,GAC1D,oBACA,QACF;EAEJ,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK,KAAK;GAAW,GACvB,kCACF;GACA,IAAI,CAAC,oBAAoB,kBACvB,iBAAiB,qBACf,gBACA,MAAM,oDAAoD,GAC1D,oBACA,gBACF;EAEJ;CAEJ;CAEA,OAAO;AACT;AAQA,eAAe,aACb,QACA,iBACuC;CACvC,IAAI,OAAO,SAAS,SAAS,eAAe,GAC1C,OAAO,EACL,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU,MAAM,cAAc,eAAe;CAC/C,EACF;CAEF,OAAO;AACT;AAEA,eAAsB,gBAAgB,EACpC,iBACA,uBACA,aACA,UAC0D;CAC1D,IAAI;EACF,OAAO,MAAM,EAAE,YAAY,GAAG,iCAAiC;EAE/D,MAAM,iBAAiB,YAAY,MAAM,QAAQ,IAAI,YAAY,OAAO;EACxE,MAAM,mBAAmB,YAAY,MAClC,QAAQ,IAAI,YAAY,eAC3B;EAEA,MAAM,0BAA0B,sBAAsB,SACpD,wBACF;EACA,MAAM,qBACJ,sBAAsB,SAAS,mBAAmB;EACpD,MAAM,2BAA2B,oBAAoB,qBAAqB;EAG1E,IAAI,CAAC,oBAAoB,EAAE,kBAAkB,0BAA0B;GACrE,OAAO,MACL,+EACF;GACA,OAAO;EACT;EAGA,IAAI,MAAqB;EACzB,IAAI,kBAAkB;GACpB,MAAM,MAAM,qBACV,iBACA,wBACF;GAEA,IAAI,CAAC,KAAK;IACR,OAAO,KAAK,2CAA2C;IACvD,OAAO;GACT;EACF;EAIA,IAAI,qBAAqB,sBAAsB,0BAA0B;GACvE,MAAM,UAAU,gBAAgB,QAC9B,4BACA,mBACF;GACA,IAAI,QAAQ,SAAS,mBAAmB,GACtC,IAAI;IACF,MAAM,gBAAgB,OAAO;IAC7B,OAAO,MAAM,EAAE,QAAQ,GAAG,+BAA+B;GAC3D,QAAQ,CAER;EAEJ;EAIA,IAAI,iBAAiB;EACrB,IAAI,qBAAqB,sBAAsB,0BAC7C,iBAAiB,eACd,QAAQ,MAAM,+BAA+B,GAAG,EAAE,CAAC,CACnD,QAAQ,MAAM,0BAA0B,GAAG,EAAE;EAIlD,MAAM,eAAe,iBAAiB,cAAc;EAGpD,IAAI,oBAAoB,KAAK;GAC3B,MAAM,WAAW,mBAAmB,WAAW;GAC/C,MAAM,sBAAsB,KAAK,QAAQ,iBAAiB,QAAQ;EACpE;EAIA,IAAI,2BAA2B,oBAAoB;GACjD,MAAM,iBAAiB,MAAM,cAAc,iBAAiB,MAAM;GAClE,IAAI,gBAAgB;IAClB,MAAM,uBAAuB,MAAM,gBACjC,gBACA,aACA,yBACA,oBACA,qBACF;IACA,MAAM,eAAe,iBAAiB,oBAAoB;GAC5D;EACF;EAcA,MAAM,yBACJ,MAAM,oBAAoB,MAbP,cAAc,GACT;GACxB;GACA;GACA;GACA;GACA;EACF,CAAC,CAAC,KACC,aACC,gBAAgB,QAAQ,yCAAyC,EAAE,IACnE,QAGgD,CAAC,EAAA,CACnD,OAAO,QAAQ;EAEjB,OAAO,MACL,EAAE,OAAO,sBAAsB,KAAK,MAAM,EAAE,MAAM,IAAI,EAAE,GACxD,uCACF;EACA,OAAO;CACT,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,+CAA+C;EACrE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF;AAEA,eAAe,oBACb,QACA,mBACkC;CAClC,MAAM,iBAA0C,CAAC;CACjD,KAAK,MAAM,oBAAoB,mBAAmB;EAChD,MAAM,gBAAgB,MAAM,aAAa,QAAQ,gBAAgB;EACjE,IAAI,kBAAkB,MACpB,eAAe,KAAK,aAAa;CAErC;CACA,OAAO;AACT;;;;;;;AAQA,SAAgB,kBACd,qBACe;CACf,MAAM,QAAQ,sBACVA,IAAgB,SAAS,mBAAmB,IAC5C;CAEJ,IAAI,SAAS,SAAS,GACpB,OAAO;CAGT,OAAO;AACT;AAEA,eAAe,sBACb,KACA,QACA,iBACA,UACe;CACf,OAAO,MAAM,4BAA4B,IAAI,EAAE;CAC/C,MAAM,EAAE,8BAA8B,cAAc,eAAe;CAEnE,MAAM,cAA2B;EAC/B,SAAS;EACT,QAAQ,CAAC;EACT;EACA,iBAAiB,CACf;GACE,UAAU;GACV,YACE,OAAO,aAAa,QAAQ,kBAAkB,OAAO,YAAY;EACrE,CACF;CACF;CAEA,IAAI;EACF,MAAM,KAAK,KAAK,WAAW;CAC7B,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,+CAA+C;EACrE,MAAM;CACR;AACF;AAEA,SAAS,mBAAmB,MAAqC;CAC/D,MAAM,wBAAwB,6BAA6B,IAAI;CAC/D,IAAI,uBACF,OAAO,EAAE,cAAc,sBAAsB;CAE/C,OAAO,CAAC;AACV;AAEA,SAAS,6BACP,MACe;CACf,MAAM,gBAAgB,KAAK,MACxB,QAAQ,IAAI,YAAY,eAC3B,CAAC,EAAE;CAEH,IAAI,CAAC,eACH,OAAO;CAGT,MAAM,QAAQ,MAAM,iDAAiD,CAAC,CAAC,KACrE,aACF;CAEA,IAAI,CAAC,OACH,OAAO;CAGT,OAAO,MAAM,OAAQ,YAAY,yBAC7B,OACA,MAAM,OAAQ;AACpB;AAEA,eAAe,qBACb,iBACA,kBACwB;CACxB,MAAM,EACJ,2BACA,iBACA,8BACE,cAAc,eAAe;CAKjC,MAAM,OAAO,0BAA0B,MAD1B,oBAAoB,QACgB;CAEjD,OAAO,MAAM,eACX,2BACA,iBACA,MAAM,cAAc,yBAAyB,GAC7C,IACF;AACF;AAEA,SAAS,uBAA+B;CACtC,IACE,GAAG,SAAS,MAAM,WAClB,aAAa,IAAI,cAAc,MAAM,UAErC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,cAAc,iBAA4C;CACjE,MAAM,4BAA4B,qBAAqB;CACvD,MAAM,kBAAkB,MAAM,KAC5B,MAAM,QAAQ,eAAe,GAC7B,gBAAgB,SAAS,MAAM,IAAI,MAAM,QAC3C;CAKA,OAAO;EACL;EACA;EACA,2BAPgC,MAAM,KACtC,iBACA,yBAKwB;CAC1B;AACF;AAEA,eAAe,eACb,UACA,KACA,eACA,MACwB;;CAExB,IAAI,eAAe,OAAO,MAAM,MAAM;EAEpC,IAAI,GAAG,SAAS,MAAM,YAAY,cAAc,OAAO,OAAS,GAAG;GAEjE,OAAO,KAAK,6CAA6C;GACzD,MAAM,eAEJ,MAAM,KAAK,KAAM,QAAQ,GACzB,cAAc,OAAO,EACvB;EACF;EACA,IAAI,SAAS,MACX,OAAO;EAET,OAAO,GAAG,SAAS,GAAG;CACxB;CACA,OAAO;AACT"}
+{"version":3,"file":"artifacts.js","names":["mavenVersioning"],"sources":["../../../../lib/modules/manager/maven-wrapper/artifacts.ts"],"sourcesContent":["import type { Stats } from 'node:fs';\nimport os from 'node:os';\nimport { isTruthy } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { withCache } from '../../../util/cache/package/with-cache.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ExtraEnv } from '../../../util/exec/types.ts';\nimport {\n  chmodLocalFile,\n  deleteLocalFile,\n  readLocalFile,\n  statLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport type { StatusResult } from '../../../util/git/types.ts';\nimport { hashStream } from '../../../util/hash.ts';\nimport { Http } from '../../../util/http/index.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport mavenVersioning from '../../versioning/maven/index.ts';\nimport type {\n  PackageDependency,\n  UpdateArtifact,\n  UpdateArtifactsConfig,\n  UpdateArtifactsResult,\n} from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\n\nconst http = new Http('maven-wrapper');\nconst DEFAULT_MAVEN_REPO_URL = 'https://repo.maven.apache.org/maven2';\n\nfunction getChecksumFromUrl(url: string): Promise<string> {\n  return withCache(\n    {\n      namespace: 'url-sha256',\n      key: url,\n      ttlMinutes: 3 * 24 * 60, // 3 days\n    },\n    () => hashStream(http.stream(url), 'sha256'),\n  );\n}\n\nfunction getDistributionUrl(content: string): string | null {\n  const match = regEx(/^distributionUrl\\s*=\\s*(?<distributionUrl>.+)$/m).exec(\n    content,\n  );\n  return (\n    match?.groups?.distributionUrl?.replace(regEx(/\\\\:/g), ':').trim() ?? null\n  );\n}\n\nfunction getWrapperUrl(content: string): string | null {\n  const match = regEx(/^wrapperUrl\\s*=\\s*(?<wrapperUrl>.+)$/m).exec(content);\n  return match?.groups?.wrapperUrl?.replace(regEx(/\\\\:/g), ':').trim() ?? null;\n}\n\nfunction constructWrapperUrl(\n  version: string,\n  repoUrl: string = DEFAULT_MAVEN_REPO_URL,\n): string {\n  return `${repoUrl}/org/apache/maven/wrapper/maven-wrapper/${version}/maven-wrapper-${version}.jar`;\n}\n\nfunction getWrapperVersion(content: string): string | null {\n  const match = regEx(/^wrapperVersion\\s*=\\s*(?<wrapperVersion>.+)$/m).exec(\n    content,\n  );\n  return match?.groups?.wrapperVersion?.trim() ?? null;\n}\n\nfunction getDistributionType(content: string): string | null {\n  const match = regEx(/^distributionType\\s*=\\s*(?<distributionType>.+)$/m).exec(\n    content,\n  );\n  return match?.groups?.distributionType?.trim() ?? null;\n}\n\nfunction getChecksumValue(content: string, key: string): string | null {\n  const match = regEx(`^${key}\\\\s*=\\\\s*(?<value>.+)$`, 'm').exec(content);\n  return match?.groups?.value?.trim() ?? null;\n}\n\nfunction addChecksumAfterLine(\n  content: string,\n  lineRegex: RegExp,\n  key: string,\n  value: string,\n): string {\n  return content.replace(\n    regEx(lineRegex),\n    (lineMatch) => `${lineMatch}\\n${key}=${value}`,\n  );\n}\n\nasync function updateChecksums(\n  content: string,\n  updatedDeps: PackageDependency[],\n  addDistributionChecksum: boolean,\n  addWrapperChecksum: boolean,\n  originalContent: string,\n): Promise<string> {\n  let updatedContent = content;\n\n  // Update or add distribution checksum\n  if (addDistributionChecksum) {\n    const existingChecksum = getChecksumValue(\n      updatedContent,\n      'distributionSha256Sum',\n    );\n    const fallbackChecksum = getChecksumValue(\n      originalContent,\n      'distributionSha256Sum',\n    );\n    const distUrl = getDistributionUrl(updatedContent);\n    if (distUrl) {\n      try {\n        const checksum = await getChecksumFromUrl(distUrl);\n        if (existingChecksum) {\n          updatedContent = updatedContent.replace(\n            regEx(/distributionSha256Sum=.*/),\n            `distributionSha256Sum=${checksum}`,\n          );\n        } else {\n          // Add checksum after distributionUrl\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:distributionUrl\\s*=\\s*.+)$/m),\n            'distributionSha256Sum',\n            checksum,\n          );\n        }\n      } catch (err) {\n        logger.warn(\n          { err, url: distUrl },\n          'Failed to fetch distribution checksum',\n        );\n        if (!existingChecksum && fallbackChecksum) {\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:distributionUrl\\s*=\\s*.+)$/m),\n            'distributionSha256Sum',\n            fallbackChecksum,\n          );\n        }\n      }\n    }\n  }\n\n  // Update or add wrapper checksum\n  if (addWrapperChecksum) {\n    const existingChecksum = getChecksumValue(\n      updatedContent,\n      'wrapperSha256Sum',\n    );\n    const fallbackChecksum = getChecksumValue(\n      originalContent,\n      'wrapperSha256Sum',\n    );\n    let wrapperUrl = getWrapperUrl(updatedContent);\n\n    // If no wrapperUrl, try to construct from wrapperVersion\n    if (!wrapperUrl) {\n      const wrapperVersion = getWrapperVersion(updatedContent);\n      if (wrapperVersion) {\n        const customRepoUrl = getCustomMavenWrapperRepoUrl(updatedDeps);\n        wrapperUrl = constructWrapperUrl(\n          wrapperVersion,\n          customRepoUrl ?? DEFAULT_MAVEN_REPO_URL,\n        );\n      }\n    }\n\n    if (wrapperUrl) {\n      try {\n        const checksum = await getChecksumFromUrl(wrapperUrl);\n        if (existingChecksum) {\n          updatedContent = updatedContent.replace(\n            regEx(/wrapperSha256Sum=.*/),\n            `wrapperSha256Sum=${checksum}`,\n          );\n        } else {\n          // Add checksum after wrapperUrl or wrapperVersion\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:wrapperUrl\\s*=\\s*.+|wrapperVersion\\s*=\\s*.+)$/m),\n            'wrapperSha256Sum',\n            checksum,\n          );\n        }\n      } catch (err) {\n        logger.warn(\n          { err, url: wrapperUrl },\n          'Failed to fetch wrapper checksum',\n        );\n        if (!existingChecksum && fallbackChecksum) {\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:wrapperUrl\\s*=\\s*.+|wrapperVersion\\s*=\\s*.+)$/m),\n            'wrapperSha256Sum',\n            fallbackChecksum,\n          );\n        }\n      }\n    }\n  }\n\n  return updatedContent;\n}\n\ninterface MavenWrapperPaths {\n  wrapperExecutableFileName: string;\n  localProjectDir: string;\n  wrapperFullyQualifiedPath: string;\n}\n\nasync function addIfUpdated(\n  status: StatusResult,\n  fileProjectPath: string,\n): Promise<UpdateArtifactsResult | null> {\n  if (status.modified.includes(fileProjectPath)) {\n    return {\n      file: {\n        type: 'addition',\n        path: fileProjectPath,\n        contents: await readLocalFile(fileProjectPath),\n      },\n    };\n  }\n  return null;\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  newPackageFileContent,\n  updatedDeps,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  try {\n    logger.debug({ updatedDeps }, 'maven-wrapper.updateArtifacts()');\n\n    const hasMavenUpdate = updatedDeps.some((dep) => dep.depName === 'maven');\n    const hasWrapperUpdate = updatedDeps.some(\n      (dep) => dep.depName === 'maven-wrapper',\n    );\n    // Remember original content properties - we'll restore them after wrapper:wrapper\n    const hadDistributionChecksum = newPackageFileContent.includes(\n      'distributionSha256Sum=',\n    );\n    const hadWrapperChecksum =\n      newPackageFileContent.includes('wrapperSha256Sum=');\n    const originalDistributionType = getDistributionType(newPackageFileContent);\n\n    // Skip if no relevant updates\n    if (!hasWrapperUpdate && !(hasMavenUpdate && hadDistributionChecksum)) {\n      logger.debug(\n        'No Maven wrapper or distribution checksum updates - skipping Artifacts update',\n      );\n      return null;\n    }\n\n    // If wrapper is being updated, check if mvnw exists first\n    let cmd: string | null = null;\n    if (hasWrapperUpdate) {\n      cmd = await createWrapperCommand(\n        packageFileName,\n        originalDistributionType,\n      );\n\n      if (!cmd) {\n        logger.info('No mvnw found - skipping Artifacts update');\n        return null;\n      }\n    }\n\n    // Delete old maven-wrapper.jar if checksums exist and wrapper:wrapper will run\n    // This prevents checksum validation failure when wrapper:wrapper runs\n    if (hasWrapperUpdate && (hadWrapperChecksum || hadDistributionChecksum)) {\n      const jarPath = packageFileName.replace(\n        'maven-wrapper.properties',\n        'maven-wrapper.jar',\n      );\n      if (jarPath.endsWith('maven-wrapper.jar')) {\n        try {\n          await deleteLocalFile(jarPath);\n          logger.debug({ jarPath }, 'Deleted old maven-wrapper.jar');\n        } catch {\n          // File may not exist, ignore\n        }\n      }\n    }\n\n    // Strip checksum lines before running wrapper:wrapper to avoid validation failure\n    // (mvnw would try to validate NEW jar against OLD checksum)\n    let contentToWrite = newPackageFileContent;\n    if (hasWrapperUpdate && (hadWrapperChecksum || hadDistributionChecksum)) {\n      contentToWrite = contentToWrite\n        .replace(regEx(/^distributionSha256Sum=.*\\n?/m), '')\n        .replace(regEx(/^wrapperSha256Sum=.*\\n?/m), '');\n    }\n\n    // Write the properties file\n    await writeLocalFile(packageFileName, contentToWrite);\n\n    // Run wrapper:wrapper if the wrapper itself is being updated\n    if (hasWrapperUpdate && cmd) {\n      const extraEnv = getExtraEnvOptions(updatedDeps);\n      await executeWrapperCommand(cmd, config, packageFileName, extraEnv);\n    }\n\n    // Now update checksums AFTER wrapper:wrapper has run (if it ran)\n    // This ensures we compute checksums for the actual generated content\n    if (hadDistributionChecksum || hadWrapperChecksum) {\n      const currentContent = await readLocalFile(packageFileName, 'utf8');\n      if (currentContent) {\n        const contentWithChecksums = await updateChecksums(\n          currentContent,\n          updatedDeps,\n          hadDistributionChecksum,\n          hadWrapperChecksum,\n          newPackageFileContent,\n        );\n        await writeLocalFile(packageFileName, contentWithChecksums);\n      }\n    }\n\n    const status = await getRepoStatus();\n    const artifactFileNames = [\n      '.mvn/wrapper/maven-wrapper.properties',\n      '.mvn/wrapper/maven-wrapper.jar',\n      '.mvn/wrapper/MavenWrapperDownloader.java',\n      'mvnw',\n      'mvnw.cmd',\n    ].map(\n      (filename) =>\n        packageFileName.replace('.mvn/wrapper/maven-wrapper.properties', '') +\n        filename,\n    );\n    const updateArtifactsResult = (\n      await getUpdatedArtifacts(status, artifactFileNames)\n    ).filter(isTruthy);\n\n    logger.debug(\n      { files: updateArtifactsResult.map((r) => r.file?.path) },\n      `Returning updated maven-wrapper files`,\n    );\n    return updateArtifactsResult;\n  } catch (err) {\n    logger.debug({ err }, 'Error setting new Maven Wrapper release value');\n    return [\n      {\n        artifactError: {\n          fileName: packageFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n\nasync function getUpdatedArtifacts(\n  status: StatusResult,\n  artifactFileNames: string[],\n): Promise<UpdateArtifactsResult[]> {\n  const updatedResults: UpdateArtifactsResult[] = [];\n  for (const artifactFileName of artifactFileNames) {\n    const updatedResult = await addIfUpdated(status, artifactFileName);\n    if (updatedResult !== null) {\n      updatedResults.push(updatedResult);\n    }\n  }\n  return updatedResults;\n}\n\n/**\n * Find compatible java version for maven.\n * see https://maven.apache.org/developers/compatibility-plan.html\n * @param mavenWrapperVersion current maven version\n * @returns A Java semver range\n */\nexport function getJavaConstraint(\n  mavenWrapperVersion: string | null | undefined,\n): string | null {\n  const major = mavenWrapperVersion\n    ? mavenVersioning.getMajor(mavenWrapperVersion)\n    : null;\n\n  if (major && major >= 3) {\n    return '^17.0.0';\n  }\n\n  return '^8.0.0';\n}\n\nasync function executeWrapperCommand(\n  cmd: string,\n  config: UpdateArtifactsConfig,\n  packageFileName: string,\n  extraEnv: ExtraEnv,\n): Promise<void> {\n  logger.debug(`Updating maven wrapper: \"${cmd}\"`);\n  const { wrapperFullyQualifiedPath } = getMavenPaths(packageFileName);\n\n  const execOptions: ExecOptions = {\n    cwdFile: wrapperFullyQualifiedPath,\n    docker: {},\n    extraEnv,\n    toolConstraints: [\n      {\n        toolName: 'java',\n        constraint: await resolveToolConstraint(config, 'java', () =>\n          getJavaConstraint(config.currentValue),\n        ),\n      },\n    ],\n  };\n\n  try {\n    await exec(cmd, execOptions);\n  } catch (err) {\n    logger.error({ err }, 'Error executing maven wrapper update command.');\n    throw err;\n  }\n}\n\nfunction getExtraEnvOptions(deps: PackageDependency[]): ExtraEnv {\n  const customMavenWrapperUrl = getCustomMavenWrapperRepoUrl(deps);\n  if (customMavenWrapperUrl) {\n    return { MVNW_REPOURL: customMavenWrapperUrl };\n  }\n  return {};\n}\n\nfunction getCustomMavenWrapperRepoUrl(\n  deps: PackageDependency[],\n): string | null {\n  const replaceString = deps.find(\n    (dep) => dep.depName === 'maven-wrapper',\n  )?.replaceString;\n\n  if (!replaceString) {\n    return null;\n  }\n\n  const match = regEx(/^(?<repoUrl>.*?)\\/org\\/apache\\/maven\\/wrapper\\//).exec(\n    replaceString,\n  );\n\n  if (!match) {\n    return null;\n  }\n\n  return match.groups!.repoUrl === DEFAULT_MAVEN_REPO_URL\n    ? null\n    : match.groups!.repoUrl;\n}\n\nasync function createWrapperCommand(\n  packageFileName: string,\n  distributionType: string | null,\n): Promise<string | null> {\n  const {\n    wrapperExecutableFileName,\n    localProjectDir,\n    wrapperFullyQualifiedPath,\n  } = getMavenPaths(packageFileName);\n\n  // Use existing distributionType or default to 'script' to preserve JAR-based mode\n  // (prevents Maven 3.3.x from defaulting to only-script which doesn't support checksums)\n  const type = distributionType ?? 'script';\n  const args = `wrapper:wrapper -Dtype=${quote(type)}`;\n\n  return await prepareCommand(\n    wrapperExecutableFileName,\n    localProjectDir,\n    await statLocalFile(wrapperFullyQualifiedPath),\n    args,\n  );\n}\n\nfunction mavenWrapperFileName(): string {\n  if (\n    os.platform() === 'win32' &&\n    GlobalConfig.get('binarySource') !== 'docker'\n  ) {\n    return 'mvnw.cmd';\n  }\n  return './mvnw';\n}\n\nfunction getMavenPaths(packageFileName: string): MavenWrapperPaths {\n  const wrapperExecutableFileName = mavenWrapperFileName();\n  const localProjectDir = upath.join(\n    upath.dirname(packageFileName),\n    packageFileName.includes('mvnw') ? '.' : '../../',\n  );\n  const wrapperFullyQualifiedPath = upath.join(\n    localProjectDir,\n    wrapperExecutableFileName,\n  );\n  return {\n    wrapperExecutableFileName,\n    localProjectDir,\n    wrapperFullyQualifiedPath,\n  };\n}\n\nasync function prepareCommand(\n  fileName: string,\n  cwd: string | undefined,\n  pathFileStats: Stats | null,\n  args: string | null,\n): Promise<string | null> {\n  /* v8 ignore next -- hard to test */\n  if (pathFileStats?.isFile() === true) {\n    // if the file is not executable by others\n    if (os.platform() !== 'win32' && (pathFileStats.mode & 0o1) === 0) {\n      // add the execution permission to the owner, group and others\n      logger.warn('Maven wrapper is missing the executable bit');\n      await chmodLocalFile(\n        // TODO: types (#22198)\n        upath.join(cwd!, fileName),\n        pathFileStats.mode | 0o111,\n      );\n    }\n    if (args === null) {\n      return fileName;\n    }\n    return `${fileName} ${args}`;\n  }\n  return null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA+BA,MAAM,OAAO,IAAI,KAAK,eAAe;AACrC,MAAM,yBAAyB;AAE/B,SAAS,mBAAmB,KAA8B;CACxD,OAAO,UACL;EACE,WAAW;EACX,KAAK;EACL,YAAY;CACd,SACM,WAAW,KAAK,OAAO,GAAG,GAAG,QAAQ,CAC7C;AACF;AAEA,SAAS,mBAAmB,SAAgC;CAI1D,OAHc,MAAM,iDAAiD,CAAC,CAAC,KACrE,OAGI,CAAC,EAAE,QAAQ,iBAAiB,QAAQ,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK;AAE1E;AAEA,SAAS,cAAc,SAAgC;CAErD,OADc,MAAM,uCAAuC,CAAC,CAAC,KAAK,OACvD,CAAC,EAAE,QAAQ,YAAY,QAAQ,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK;AAC1E;AAEA,SAAS,oBACP,SACA,UAAkB,wBACV;CACR,OAAO,GAAG,QAAQ,0CAA0C,QAAQ,iBAAiB,QAAQ;AAC/F;AAEA,SAAS,kBAAkB,SAAgC;CAIzD,OAHc,MAAM,+CAA+C,CAAC,CAAC,KACnE,OAES,CAAC,EAAE,QAAQ,gBAAgB,KAAK,KAAK;AAClD;AAEA,SAAS,oBAAoB,SAAgC;CAI3D,OAHc,MAAM,mDAAmD,CAAC,CAAC,KACvE,OAES,CAAC,EAAE,QAAQ,kBAAkB,KAAK,KAAK;AACpD;AAEA,SAAS,iBAAiB,SAAiB,KAA4B;CAErE,OADc,MAAM,IAAI,IAAI,yBAAyB,GAAG,CAAC,CAAC,KAAK,OACpD,CAAC,EAAE,QAAQ,OAAO,KAAK,KAAK;AACzC;AAEA,SAAS,qBACP,SACA,WACA,KACA,OACQ;CACR,OAAO,QAAQ,QACb,MAAM,SAAS,IACd,cAAc,GAAG,UAAU,IAAI,IAAI,GAAG,OACzC;AACF;AAEA,eAAe,gBACb,SACA,aACA,yBACA,oBACA,iBACiB;CACjB,IAAI,iBAAiB;CAGrB,IAAI,yBAAyB;EAC3B,MAAM,mBAAmB,iBACvB,gBACA,uBACF;EACA,MAAM,mBAAmB,iBACvB,iBACA,uBACF;EACA,MAAM,UAAU,mBAAmB,cAAc;EACjD,IAAI,SACF,IAAI;GACF,MAAM,WAAW,MAAM,mBAAmB,OAAO;GACjD,IAAI,kBACF,iBAAiB,eAAe,QAC9B,MAAM,0BAA0B,GAChC,yBAAyB,UAC3B;QAGA,iBAAiB,qBACf,gBACA,MAAM,iCAAiC,GACvC,yBACA,QACF;EAEJ,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK,KAAK;GAAQ,GACpB,uCACF;GACA,IAAI,CAAC,oBAAoB,kBACvB,iBAAiB,qBACf,gBACA,MAAM,iCAAiC,GACvC,yBACA,gBACF;EAEJ;CAEJ;CAGA,IAAI,oBAAoB;EACtB,MAAM,mBAAmB,iBACvB,gBACA,kBACF;EACA,MAAM,mBAAmB,iBACvB,iBACA,kBACF;EACA,IAAI,aAAa,cAAc,cAAc;EAG7C,IAAI,CAAC,YAAY;GACf,MAAM,iBAAiB,kBAAkB,cAAc;GACvD,IAAI,gBAEF,aAAa,oBACX,gBAFoB,6BAA6B,WAGrC,KAAK,sBACnB;EAEJ;EAEA,IAAI,YACF,IAAI;GACF,MAAM,WAAW,MAAM,mBAAmB,UAAU;GACpD,IAAI,kBACF,iBAAiB,eAAe,QAC9B,MAAM,qBAAqB,GAC3B,oBAAoB,UACtB;QAGA,iBAAiB,qBACf,gBACA,MAAM,oDAAoD,GAC1D,oBACA,QACF;EAEJ,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK,KAAK;GAAW,GACvB,kCACF;GACA,IAAI,CAAC,oBAAoB,kBACvB,iBAAiB,qBACf,gBACA,MAAM,oDAAoD,GAC1D,oBACA,gBACF;EAEJ;CAEJ;CAEA,OAAO;AACT;AAQA,eAAe,aACb,QACA,iBACuC;CACvC,IAAI,OAAO,SAAS,SAAS,eAAe,GAC1C,OAAO,EACL,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU,MAAM,cAAc,eAAe;CAC/C,EACF;CAEF,OAAO;AACT;AAEA,eAAsB,gBAAgB,EACpC,iBACA,uBACA,aACA,UAC0D;CAC1D,IAAI;EACF,OAAO,MAAM,EAAE,YAAY,GAAG,iCAAiC;EAE/D,MAAM,iBAAiB,YAAY,MAAM,QAAQ,IAAI,YAAY,OAAO;EACxE,MAAM,mBAAmB,YAAY,MAClC,QAAQ,IAAI,YAAY,eAC3B;EAEA,MAAM,0BAA0B,sBAAsB,SACpD,wBACF;EACA,MAAM,qBACJ,sBAAsB,SAAS,mBAAmB;EACpD,MAAM,2BAA2B,oBAAoB,qBAAqB;EAG1E,IAAI,CAAC,oBAAoB,EAAE,kBAAkB,0BAA0B;GACrE,OAAO,MACL,+EACF;GACA,OAAO;EACT;EAGA,IAAI,MAAqB;EACzB,IAAI,kBAAkB;GACpB,MAAM,MAAM,qBACV,iBACA,wBACF;GAEA,IAAI,CAAC,KAAK;IACR,OAAO,KAAK,2CAA2C;IACvD,OAAO;GACT;EACF;EAIA,IAAI,qBAAqB,sBAAsB,0BAA0B;GACvE,MAAM,UAAU,gBAAgB,QAC9B,4BACA,mBACF;GACA,IAAI,QAAQ,SAAS,mBAAmB,GACtC,IAAI;IACF,MAAM,gBAAgB,OAAO;IAC7B,OAAO,MAAM,EAAE,QAAQ,GAAG,+BAA+B;GAC3D,QAAQ,CAER;EAEJ;EAIA,IAAI,iBAAiB;EACrB,IAAI,qBAAqB,sBAAsB,0BAC7C,iBAAiB,eACd,QAAQ,MAAM,+BAA+B,GAAG,EAAE,CAAC,CACnD,QAAQ,MAAM,0BAA0B,GAAG,EAAE;EAIlD,MAAM,eAAe,iBAAiB,cAAc;EAGpD,IAAI,oBAAoB,KAAK;GAC3B,MAAM,WAAW,mBAAmB,WAAW;GAC/C,MAAM,sBAAsB,KAAK,QAAQ,iBAAiB,QAAQ;EACpE;EAIA,IAAI,2BAA2B,oBAAoB;GACjD,MAAM,iBAAiB,MAAM,cAAc,iBAAiB,MAAM;GAClE,IAAI,gBAAgB;IAClB,MAAM,uBAAuB,MAAM,gBACjC,gBACA,aACA,yBACA,oBACA,qBACF;IACA,MAAM,eAAe,iBAAiB,oBAAoB;GAC5D;EACF;EAcA,MAAM,yBACJ,MAAM,oBAAoB,MAbP,cAAc,GACT;GACxB;GACA;GACA;GACA;GACA;EACF,CAAC,CAAC,KACC,aACC,gBAAgB,QAAQ,yCAAyC,EAAE,IACnE,QAGgD,CAAC,EAAA,CACnD,OAAO,QAAQ;EAEjB,OAAO,MACL,EAAE,OAAO,sBAAsB,KAAK,MAAM,EAAE,MAAM,IAAI,EAAE,GACxD,uCACF;EACA,OAAO;CACT,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,+CAA+C;EACrE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF;AAEA,eAAe,oBACb,QACA,mBACkC;CAClC,MAAM,iBAA0C,CAAC;CACjD,KAAK,MAAM,oBAAoB,mBAAmB;EAChD,MAAM,gBAAgB,MAAM,aAAa,QAAQ,gBAAgB;EACjE,IAAI,kBAAkB,MACpB,eAAe,KAAK,aAAa;CAErC;CACA,OAAO;AACT;;;;;;;AAQA,SAAgB,kBACd,qBACe;CACf,MAAM,QAAQ,sBACVA,IAAgB,SAAS,mBAAmB,IAC5C;CAEJ,IAAI,SAAS,SAAS,GACpB,OAAO;CAGT,OAAO;AACT;AAEA,eAAe,sBACb,KACA,QACA,iBACA,UACe;CACf,OAAO,MAAM,4BAA4B,IAAI,EAAE;CAC/C,MAAM,EAAE,8BAA8B,cAAc,eAAe;CAEnE,MAAM,cAA2B;EAC/B,SAAS;EACT,QAAQ,CAAC;EACT;EACA,iBAAiB,CACf;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,cAC9C,kBAAkB,OAAO,YAAY,CACvC;EACF,CACF;CACF;CAEA,IAAI;EACF,MAAM,KAAK,KAAK,WAAW;CAC7B,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,+CAA+C;EACrE,MAAM;CACR;AACF;AAEA,SAAS,mBAAmB,MAAqC;CAC/D,MAAM,wBAAwB,6BAA6B,IAAI;CAC/D,IAAI,uBACF,OAAO,EAAE,cAAc,sBAAsB;CAE/C,OAAO,CAAC;AACV;AAEA,SAAS,6BACP,MACe;CACf,MAAM,gBAAgB,KAAK,MACxB,QAAQ,IAAI,YAAY,eAC3B,CAAC,EAAE;CAEH,IAAI,CAAC,eACH,OAAO;CAGT,MAAM,QAAQ,MAAM,iDAAiD,CAAC,CAAC,KACrE,aACF;CAEA,IAAI,CAAC,OACH,OAAO;CAGT,OAAO,MAAM,OAAQ,YAAY,yBAC7B,OACA,MAAM,OAAQ;AACpB;AAEA,eAAe,qBACb,iBACA,kBACwB;CACxB,MAAM,EACJ,2BACA,iBACA,8BACE,cAAc,eAAe;CAKjC,MAAM,OAAO,0BAA0B,MAD1B,oBAAoB,QACgB;CAEjD,OAAO,MAAM,eACX,2BACA,iBACA,MAAM,cAAc,yBAAyB,GAC7C,IACF;AACF;AAEA,SAAS,uBAA+B;CACtC,IACE,GAAG,SAAS,MAAM,WAClB,aAAa,IAAI,cAAc,MAAM,UAErC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,cAAc,iBAA4C;CACjE,MAAM,4BAA4B,qBAAqB;CACvD,MAAM,kBAAkB,MAAM,KAC5B,MAAM,QAAQ,eAAe,GAC7B,gBAAgB,SAAS,MAAM,IAAI,MAAM,QAC3C;CAKA,OAAO;EACL;EACA;EACA,2BAPgC,MAAM,KACtC,iBACA,yBAKwB;CAC1B;AACF;AAEA,eAAe,eACb,UACA,KACA,eACA,MACwB;;CAExB,IAAI,eAAe,OAAO,MAAM,MAAM;EAEpC,IAAI,GAAG,SAAS,MAAM,YAAY,cAAc,OAAO,OAAS,GAAG;GAEjE,OAAO,KAAK,6CAA6C;GACzD,MAAM,eAEJ,MAAM,KAAK,KAAM,QAAQ,GACzB,cAAc,OAAO,EACvB;EACF;EACA,IAAI,SAAS,MACX,OAAO;EAET,OAAO,GAAG,SAAS,GAAG;CACxB;CACA,OAAO;AACT"}

package/dist/modules/manager/mise/artifacts.js

@@ -6,6 +6,7 @@ import { find } from "../../../util/host-rules.js";
 import { readLocalFile } from "../../../util/fs/index.js";
 import { api } from "../../versioning/semver/index.js";
 import { exec } from "../../../util/exec/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { findGithubToken } from "../../../util/check-token.js";
 import { getConfigType, getLockFileName } from "./lockfile.js";
 import { isNonEmptyStringAndNotWhitespace, isString } from "@sindresorhus/is";
@@ -63,29 +64,29 @@ function versionSupportsSafeFeatures(version) {
 * @see https://mise.jdx.dev/dev-tools/backends/go.html
 * @see https://mise.jdx.dev/dev-tools/backends/gem.html
 */
-function getMiseLockToolConstraints(constraints, safeMode = false) {
-	const miseConstraint = {
+async function getMiseLockToolConstraints(config, miseConstraint, safeMode = false) {
+	const miseToolConstraint = {
 		toolName: "mise",
-		constraint: constraints?.mise
+		constraint: miseConstraint
 	};
-	if (safeMode) return [miseConstraint];
+	if (safeMode) return [miseToolConstraint];
 	return [
-		miseConstraint,
+		miseToolConstraint,
 		{
 			toolName: "node",
-			constraint: constraints?.node
+			constraint: await resolveToolConstraint(config, "node")
 		},
 		{
 			toolName: "npm",
-			constraint: constraints?.npm
+			constraint: await resolveToolConstraint(config, "npm")
 		},
 		{
 			toolName: "golang",
-			constraint: constraints?.go
+			constraint: await resolveToolConstraint(config, "go")
 		},
 		{
 			toolName: "ruby",
-			constraint: constraints?.ruby
+			constraint: await resolveToolConstraint(config, "ruby")
 		}
 	];
 }
@@ -101,12 +102,13 @@ async function updateArtifacts({ packageFileName, updatedDeps, config }) {
 		return null;
 	}
 	const miseAllowlisted = GlobalConfig.get("allowedUnsafeExecutions").includes("mise");
+	const miseConstraint = await resolveToolConstraint(config, "mise");
 	let miseSupportsSafeFeatures = false;
 	if (!miseAllowlisted || config.isLockFileMaintenance) miseSupportsSafeFeatures = versionSupportsSafeFeatures(await detectMiseVersion({
 		cwdFile: packageFileName,
 		toolConstraints: [{
 			toolName: "mise",
-			constraint: config.constraints?.mise
+			constraint: miseConstraint
 		}],
 		docker: {}
 	}));
@@ -134,7 +136,7 @@ async function updateArtifacts({ packageFileName, updatedDeps, config }) {
 	const execOptions = {
 		cwdFile: packageFileName,
 		extraEnv,
-		toolConstraints: getMiseLockToolConstraints(config.constraints, safeMode),
+		toolConstraints: await getMiseLockToolConstraints(config, miseConstraint, safeMode),
 		docker: {}
 	};
 	const commands = safeMode ? [lockCmd] : [`mise trust ${quote(upath.basename(packageFileName))}`, lockCmd];

package/dist/modules/manager/mise/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":["miseVersioning","hostRules.find"],"sources":["../../../../lib/modules/manager/mise/artifacts.ts"],"sourcesContent":["import { isNonEmptyStringAndNotWhitespace, isString } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { findGithubToken } from '../../../util/check-token.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type {\n  ConstraintName,\n  ExecOptions,\n  ExtraEnv,\n  ToolConstraint,\n} from '../../../util/exec/types.ts';\nimport { readLocalFile } from '../../../util/fs/index.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { api as miseVersioning } from '../../versioning/semver/index.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { getConfigType, getLockFileName } from './lockfile.ts';\n\n/**\n * First mise release that supports the features this manager relies on:\n * `MISE_SAFE=1` safe mode (a hard boundary against project config executing\n * code during `mise lock`) and `mise lock --bump` (advancing fuzzy selectors).\n *\n * Safe mode (jdx/mise#11146) and lockfile bumping (jdx/mise#11145) merged after\n * v2026.7.11 and first shipped in v2026.7.12.\n *\n * @see https://github.com/jdx/mise/pull/11146\n * @see https://github.com/jdx/mise/pull/11145\n * @see https://mise.jdx.dev/configuration/settings.html#safe\n */\nconst MISE_SAFE_MODE_MIN_VERSION = '2026.7.12';\n\n/**\n * Detects the mise version that will actually run, by executing `mise version`.\n * `mise version` only prints the binary's version — it does not load or execute\n * project configuration — so it is safe to run even without allowlisting.\n *\n * Output looks like `2026.7.12 macos-arm64 (2026-07-21)`; we take the leading\n * `major.minor.patch`. Returns `null` if the probe fails or cannot be parsed,\n * in which case callers fall back to the conservative (pre-safe-mode) behavior.\n */\nasync function detectMiseVersion(\n  execOptions: ExecOptions,\n): Promise<string | null> {\n  try {\n    const { stdout } = await exec('mise version', execOptions);\n    const version = regEx(/\\d+\\.\\d+\\.\\d+/).exec(stdout)?.[0];\n    if (version && miseVersioning.isVersion(version)) {\n      return version;\n    }\n    logger.debug({ stdout }, 'Could not parse mise version output');\n    return null;\n  } catch (err) {\n    logger.debug({ err }, 'Failed to determine mise version');\n    return null;\n  }\n}\n\n/** True when `version` is at or above the safe-mode / `--bump` release. */\nfunction versionSupportsSafeFeatures(version: string | null): boolean {\n  return (\n    !!version &&\n    (miseVersioning.equals(version, MISE_SAFE_MODE_MIN_VERSION) ||\n      miseVersioning.isGreaterThan(version, MISE_SAFE_MODE_MIN_VERSION))\n  );\n}\n\n/**\n * Resolver tools that mise may invoke while running `mise lock`, for instance to convert an inexact version like `1` against the npm registry.\n *\n * NOTE: this will install all relevant tools, regardless of what the given mise configuration uses.\n *\n * In safe mode these are unnecessary: npm version listing uses mise's built-in\n * registry HTTP client and go runs with `GOTOOLCHAIN=local`, so `mise lock`\n * resolves versions over HTTP without shelling out to node/npm/ruby.\n *\n * @see https://mise.jdx.dev/dev-tools/backends/npm.html\n * @see https://mise.jdx.dev/dev-tools/backends/go.html\n * @see https://mise.jdx.dev/dev-tools/backends/gem.html\n */\nfunction getMiseLockToolConstraints(\n  constraints?: Partial<Record<ConstraintName, string>> | null,\n  safeMode = false,\n): ToolConstraint[] {\n  const miseConstraint: ToolConstraint = {\n    toolName: 'mise',\n    constraint: constraints?.mise,\n  };\n  if (safeMode) {\n    return [miseConstraint];\n  }\n  return [\n    miseConstraint,\n    { toolName: 'node', constraint: constraints?.node },\n    { toolName: 'npm', constraint: constraints?.npm },\n    { toolName: 'golang', constraint: constraints?.go },\n    { toolName: 'ruby', constraint: constraints?.ruby },\n  ];\n}\n\n/**\n * Updates mise lock files when dependencies are updated.\n * Runs `mise lock` for lock file maintenance or `mise lock <tools>` for targeted updates.\n */\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  const lockFileName = getLockFileName(packageFileName);\n  const existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent) {\n    logger.debug({ lockFileName }, 'No mise lock file found');\n    return null;\n  }\n\n  // `mise lock` normally executes the project's mise config, so it requires\n  // `allowedUnsafeExecutions`. When the mise that will run supports safe mode,\n  // we instead run with `MISE_SAFE=1`, which is a hard boundary against the\n  // config executing code — so the allowlist is not required on that path.\n  const allowlist = GlobalConfig.get('allowedUnsafeExecutions');\n  const miseAllowlisted = allowlist.includes('mise');\n\n  // The mise version is needed to decide safe mode (untrusted path) and\n  // `mise lock --bump` (lock file maintenance). Detect it at runtime rather\n  // than requiring a pinned `constraints.mise`. Skip the probe when it cannot\n  // change the outcome: an allowlisted, non-maintenance run behaves the same\n  // regardless of version.\n  let miseSupportsSafeFeatures = false;\n  if (!miseAllowlisted || config.isLockFileMaintenance) {\n    const miseVersion = await detectMiseVersion({\n      cwdFile: packageFileName,\n      toolConstraints: [\n        { toolName: 'mise', constraint: config.constraints?.mise },\n      ],\n      docker: {},\n    });\n    miseSupportsSafeFeatures = versionSupportsSafeFeatures(miseVersion);\n  }\n\n  const safeMode = !miseAllowlisted && miseSupportsSafeFeatures;\n  if (!miseAllowlisted && !safeMode) {\n    logger.once.warn(\n      { safeModeMinVersion: MISE_SAFE_MODE_MIN_VERSION },\n      '`mise lock` requires either `mise` in `allowedUnsafeExecutions`, or a mise version that supports safe mode',\n    );\n    return null;\n  }\n\n  const { isLocal, env } = getConfigType(packageFileName);\n  const localFlag = isLocal ? ' --local' : '';\n\n  let lockCmd: string;\n  if (config.isLockFileMaintenance) {\n    // Lock file maintenance means \"update to the latest versions\". Plain\n    // `mise lock` only refreshes metadata for already-locked versions, so use\n    // `mise lock --bump` to also advance fuzzy selectors (e.g. `node = \"22\"`)\n    // to the latest matching version. `--bump` requires a new enough mise, so\n    // fall back to a plain refresh when the version cannot be guaranteed.\n    const bumpFlag = miseSupportsSafeFeatures ? ' --bump' : '';\n    lockCmd = `mise lock${localFlag}${bumpFlag}`;\n  } else {\n    const tools = updatedDeps\n      .map(({ depName }) => depName)\n      .filter(isNonEmptyStringAndNotWhitespace)\n      .map(quote)\n      .join(' ');\n    lockCmd = tools\n      ? `mise lock${localFlag} ${tools}`\n      : `mise lock${localFlag}`;\n  }\n\n  const extraEnv: ExtraEnv = {};\n  if (env) {\n    extraEnv.MISE_ENV = env;\n  }\n  if (safeMode) {\n    extraEnv.MISE_SAFE = '1';\n  }\n  const token = findGithubToken(\n    hostRules.find({\n      hostType: 'github',\n      url: 'https://api.github.com/',\n    }),\n  );\n  if (token) {\n    extraEnv.GITHUB_TOKEN = token;\n  }\n\n  const execOptions: ExecOptions = {\n    cwdFile: packageFileName,\n    extraEnv,\n    toolConstraints: getMiseLockToolConstraints(config.constraints, safeMode),\n    docker: {},\n  };\n\n  // `mise trust` is only needed on the allowlisted path. In safe mode mise\n  // loads untrusted config without a trust prompt (the config is inert — it\n  // can neither execute code nor inject environment), so the trust step is\n  // unnecessary and is skipped.\n  const commands = safeMode\n    ? [lockCmd]\n    : [`mise trust ${quote(upath.basename(packageFileName))}`, lockCmd];\n\n  try {\n    await exec(commands, execOptions);\n    const newLockFileContent = await readLocalFile(lockFileName, 'utf8');\n    if (!newLockFileContent || existingLockFileContent === newLockFileContent) {\n      return null;\n    }\n\n    logger.debug({ lockFileName }, 'Returning updated mise lock file');\n    return [\n      {\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: newLockFileContent,\n        },\n      },\n    ];\n  } catch (err) {\n    // istanbul ignore if: not worth testing\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n\n    const errorOutput = [err.stdout, err.stderr, err.message]\n      .filter(isString)\n      .join('\\n');\n\n    logger.warn({ err, lockFileName }, 'Error updating mise lock file');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: errorOutput,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,MAAM,6BAA6B;;;;;;;;;;AAWnC,eAAe,kBACb,aACwB;CACxB,IAAI;EACF,MAAM,EAAE,WAAW,MAAM,KAAK,gBAAgB,WAAW;EACzD,MAAM,UAAU,MAAM,eAAe,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG;EACtD,IAAI,WAAWA,IAAe,UAAU,OAAO,GAC7C,OAAO;EAET,OAAO,MAAM,EAAE,OAAO,GAAG,qCAAqC;EAC9D,OAAO;CACT,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,kCAAkC;EACxD,OAAO;CACT;AACF;;AAGA,SAAS,4BAA4B,SAAiC;CACpE,OACE,CAAC,CAAC,YACDA,IAAe,OAAO,SAAS,0BAA0B,KACxDA,IAAe,cAAc,SAAS,0BAA0B;AAEtE;;;;;;;;;;;;;;AAeA,SAAS,2BACP,aACA,WAAW,OACO;CAClB,MAAM,iBAAiC;EACrC,UAAU;EACV,YAAY,aAAa;CAC3B;CACA,IAAI,UACF,OAAO,CAAC,cAAc;CAExB,OAAO;EACL;EACA;GAAE,UAAU;GAAQ,YAAY,aAAa;EAAK;EAClD;GAAE,UAAU;GAAO,YAAY,aAAa;EAAI;EAChD;GAAE,UAAU;GAAU,YAAY,aAAa;EAAG;EAClD;GAAE,UAAU;GAAQ,YAAY,aAAa;EAAK;CACpD;AACF;;;;;AAMA,eAAsB,gBAAgB,EACpC,iBACA,aACA,UAC0D;CAC1D,MAAM,eAAe,gBAAgB,eAAe;CACpD,MAAM,0BAA0B,MAAM,cAAc,cAAc,MAAM;CACxE,IAAI,CAAC,yBAAyB;EAC5B,OAAO,MAAM,EAAE,aAAa,GAAG,yBAAyB;EACxD,OAAO;CACT;CAOA,MAAM,kBADY,aAAa,IAAI,yBACH,CAAC,CAAC,SAAS,MAAM;CAOjD,IAAI,2BAA2B;CAC/B,IAAI,CAAC,mBAAmB,OAAO,uBAQ7B,2BAA2B,4BAA4B,MAP7B,kBAAkB;EAC1C,SAAS;EACT,iBAAiB,CACf;GAAE,UAAU;GAAQ,YAAY,OAAO,aAAa;EAAK,CAC3D;EACA,QAAQ,CAAC;CACX,CAAC,CACiE;CAGpE,MAAM,WAAW,CAAC,mBAAmB;CACrC,IAAI,CAAC,mBAAmB,CAAC,UAAU;EACjC,OAAO,KAAK,KACV,EAAE,oBAAoB,2BAA2B,GACjD,4GACF;EACA,OAAO;CACT;CAEA,MAAM,EAAE,SAAS,QAAQ,cAAc,eAAe;CACtD,MAAM,YAAY,UAAU,aAAa;CAEzC,IAAI;CACJ,IAAI,OAAO,uBAOT,UAAU,YAAY,YADL,2BAA2B,YAAY;MAEnD;EACL,MAAM,QAAQ,YACX,KAAK,EAAE,cAAc,OAAO,CAAC,CAC7B,OAAO,gCAAgC,CAAC,CACxC,IAAI,KAAK,CAAC,CACV,KAAK,GAAG;EACX,UAAU,QACN,YAAY,UAAU,GAAG,UACzB,YAAY;CAClB;CAEA,MAAM,WAAqB,CAAC;CAC5B,IAAI,KACF,SAAS,WAAW;CAEtB,IAAI,UACF,SAAS,YAAY;CAEvB,MAAM,QAAQ,gBACZC,KAAe;EACb,UAAU;EACV,KAAK;CACP,CAAC,CACH;CACA,IAAI,OACF,SAAS,eAAe;CAG1B,MAAM,cAA2B;EAC/B,SAAS;EACT;EACA,iBAAiB,2BAA2B,OAAO,aAAa,QAAQ;EACxE,QAAQ,CAAC;CACX;CAMA,MAAM,WAAW,WACb,CAAC,OAAO,IACR,CAAC,cAAc,MAAM,MAAM,SAAS,eAAe,CAAC,KAAK,OAAO;CAEpE,IAAI;EACF,MAAM,KAAK,UAAU,WAAW;EAChC,MAAM,qBAAqB,MAAM,cAAc,cAAc,MAAM;EACnE,IAAI,CAAC,sBAAsB,4BAA4B,oBACrD,OAAO;EAGT,OAAO,MAAM,EAAE,aAAa,GAAG,kCAAkC;EACjE,OAAO,CACL,EACE,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF,CACF;CACF,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAGR,MAAM,cAAc;GAAC,IAAI;GAAQ,IAAI;GAAQ,IAAI;EAAO,CAAC,CACtD,OAAO,QAAQ,CAAC,CAChB,KAAK,IAAI;EAEZ,OAAO,KAAK;GAAE;GAAK;EAAa,GAAG,+BAA+B;EAClE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ;EACV,EACF,CACF;CACF;AACF"}
+{"version":3,"file":"artifacts.js","names":["miseVersioning","hostRules.find"],"sources":["../../../../lib/modules/manager/mise/artifacts.ts"],"sourcesContent":["import { isNonEmptyStringAndNotWhitespace, isString } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { findGithubToken } from '../../../util/check-token.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type {\n  ExecOptions,\n  ExtraEnv,\n  ToolConstraint,\n} from '../../../util/exec/types.ts';\nimport { readLocalFile } from '../../../util/fs/index.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { api as miseVersioning } from '../../versioning/semver/index.ts';\nimport type {\n  ToolConstraintsConfig,\n  UpdateArtifact,\n  UpdateArtifactsResult,\n} from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\nimport { getConfigType, getLockFileName } from './lockfile.ts';\n\n/**\n * First mise release that supports the features this manager relies on:\n * `MISE_SAFE=1` safe mode (a hard boundary against project config executing\n * code during `mise lock`) and `mise lock --bump` (advancing fuzzy selectors).\n *\n * Safe mode (jdx/mise#11146) and lockfile bumping (jdx/mise#11145) merged after\n * v2026.7.11 and first shipped in v2026.7.12.\n *\n * @see https://github.com/jdx/mise/pull/11146\n * @see https://github.com/jdx/mise/pull/11145\n * @see https://mise.jdx.dev/configuration/settings.html#safe\n */\nconst MISE_SAFE_MODE_MIN_VERSION = '2026.7.12';\n\n/**\n * Detects the mise version that will actually run, by executing `mise version`.\n * `mise version` only prints the binary's version — it does not load or execute\n * project configuration — so it is safe to run even without allowlisting.\n *\n * Output looks like `2026.7.12 macos-arm64 (2026-07-21)`; we take the leading\n * `major.minor.patch`. Returns `null` if the probe fails or cannot be parsed,\n * in which case callers fall back to the conservative (pre-safe-mode) behavior.\n */\nasync function detectMiseVersion(\n  execOptions: ExecOptions,\n): Promise<string | null> {\n  try {\n    const { stdout } = await exec('mise version', execOptions);\n    const version = regEx(/\\d+\\.\\d+\\.\\d+/).exec(stdout)?.[0];\n    if (version && miseVersioning.isVersion(version)) {\n      return version;\n    }\n    logger.debug({ stdout }, 'Could not parse mise version output');\n    return null;\n  } catch (err) {\n    logger.debug({ err }, 'Failed to determine mise version');\n    return null;\n  }\n}\n\n/** True when `version` is at or above the safe-mode / `--bump` release. */\nfunction versionSupportsSafeFeatures(version: string | null): boolean {\n  return (\n    !!version &&\n    (miseVersioning.equals(version, MISE_SAFE_MODE_MIN_VERSION) ||\n      miseVersioning.isGreaterThan(version, MISE_SAFE_MODE_MIN_VERSION))\n  );\n}\n\n/**\n * Resolver tools that mise may invoke while running `mise lock`, for instance to convert an inexact version like `1` against the npm registry.\n *\n * NOTE: this will install all relevant tools, regardless of what the given mise configuration uses.\n *\n * In safe mode these are unnecessary: npm version listing uses mise's built-in\n * registry HTTP client and go runs with `GOTOOLCHAIN=local`, so `mise lock`\n * resolves versions over HTTP without shelling out to node/npm/ruby.\n *\n * @see https://mise.jdx.dev/dev-tools/backends/npm.html\n * @see https://mise.jdx.dev/dev-tools/backends/go.html\n * @see https://mise.jdx.dev/dev-tools/backends/gem.html\n */\nasync function getMiseLockToolConstraints(\n  config: ToolConstraintsConfig,\n  miseConstraint: string | undefined,\n  safeMode = false,\n): Promise<ToolConstraint[]> {\n  const miseToolConstraint: ToolConstraint = {\n    toolName: 'mise',\n    constraint: miseConstraint,\n  };\n  if (safeMode) {\n    return [miseToolConstraint];\n  }\n  return [\n    miseToolConstraint,\n    {\n      toolName: 'node',\n      constraint: await resolveToolConstraint(config, 'node'),\n    },\n    {\n      toolName: 'npm',\n      constraint: await resolveToolConstraint(config, 'npm'),\n    },\n    {\n      // the golang tool is constrained by the `go` constraint\n      toolName: 'golang',\n      constraint: await resolveToolConstraint(config, 'go'),\n    },\n    {\n      toolName: 'ruby',\n      constraint: await resolveToolConstraint(config, 'ruby'),\n    },\n  ];\n}\n\n/**\n * Updates mise lock files when dependencies are updated.\n * Runs `mise lock` for lock file maintenance or `mise lock <tools>` for targeted updates.\n */\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  const lockFileName = getLockFileName(packageFileName);\n  const existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent) {\n    logger.debug({ lockFileName }, 'No mise lock file found');\n    return null;\n  }\n\n  // `mise lock` normally executes the project's mise config, so it requires\n  // `allowedUnsafeExecutions`. When the mise that will run supports safe mode,\n  // we instead run with `MISE_SAFE=1`, which is a hard boundary against the\n  // config executing code — so the allowlist is not required on that path.\n  const allowlist = GlobalConfig.get('allowedUnsafeExecutions');\n  const miseAllowlisted = allowlist.includes('mise');\n\n  // The mise version is needed to decide safe mode (untrusted path) and\n  // `mise lock --bump` (lock file maintenance). Detect it at runtime rather\n  // than requiring a pinned `constraints.mise`. Skip the probe when it cannot\n  // change the outcome: an allowlisted, non-maintenance run behaves the same\n  // regardless of version.\n  const miseConstraint = await resolveToolConstraint(config, 'mise');\n  let miseSupportsSafeFeatures = false;\n  if (!miseAllowlisted || config.isLockFileMaintenance) {\n    const miseVersion = await detectMiseVersion({\n      cwdFile: packageFileName,\n      toolConstraints: [{ toolName: 'mise', constraint: miseConstraint }],\n      docker: {},\n    });\n    miseSupportsSafeFeatures = versionSupportsSafeFeatures(miseVersion);\n  }\n\n  const safeMode = !miseAllowlisted && miseSupportsSafeFeatures;\n  if (!miseAllowlisted && !safeMode) {\n    logger.once.warn(\n      { safeModeMinVersion: MISE_SAFE_MODE_MIN_VERSION },\n      '`mise lock` requires either `mise` in `allowedUnsafeExecutions`, or a mise version that supports safe mode',\n    );\n    return null;\n  }\n\n  const { isLocal, env } = getConfigType(packageFileName);\n  const localFlag = isLocal ? ' --local' : '';\n\n  let lockCmd: string;\n  if (config.isLockFileMaintenance) {\n    // Lock file maintenance means \"update to the latest versions\". Plain\n    // `mise lock` only refreshes metadata for already-locked versions, so use\n    // `mise lock --bump` to also advance fuzzy selectors (e.g. `node = \"22\"`)\n    // to the latest matching version. `--bump` requires a new enough mise, so\n    // fall back to a plain refresh when the version cannot be guaranteed.\n    const bumpFlag = miseSupportsSafeFeatures ? ' --bump' : '';\n    lockCmd = `mise lock${localFlag}${bumpFlag}`;\n  } else {\n    const tools = updatedDeps\n      .map(({ depName }) => depName)\n      .filter(isNonEmptyStringAndNotWhitespace)\n      .map(quote)\n      .join(' ');\n    lockCmd = tools\n      ? `mise lock${localFlag} ${tools}`\n      : `mise lock${localFlag}`;\n  }\n\n  const extraEnv: ExtraEnv = {};\n  if (env) {\n    extraEnv.MISE_ENV = env;\n  }\n  if (safeMode) {\n    extraEnv.MISE_SAFE = '1';\n  }\n  const token = findGithubToken(\n    hostRules.find({\n      hostType: 'github',\n      url: 'https://api.github.com/',\n    }),\n  );\n  if (token) {\n    extraEnv.GITHUB_TOKEN = token;\n  }\n\n  const execOptions: ExecOptions = {\n    cwdFile: packageFileName,\n    extraEnv,\n    toolConstraints: await getMiseLockToolConstraints(\n      config,\n      miseConstraint,\n      safeMode,\n    ),\n    docker: {},\n  };\n\n  // `mise trust` is only needed on the allowlisted path. In safe mode mise\n  // loads untrusted config without a trust prompt (the config is inert — it\n  // can neither execute code nor inject environment), so the trust step is\n  // unnecessary and is skipped.\n  const commands = safeMode\n    ? [lockCmd]\n    : [`mise trust ${quote(upath.basename(packageFileName))}`, lockCmd];\n\n  try {\n    await exec(commands, execOptions);\n    const newLockFileContent = await readLocalFile(lockFileName, 'utf8');\n    if (!newLockFileContent || existingLockFileContent === newLockFileContent) {\n      return null;\n    }\n\n    logger.debug({ lockFileName }, 'Returning updated mise lock file');\n    return [\n      {\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: newLockFileContent,\n        },\n      },\n    ];\n  } catch (err) {\n    // istanbul ignore if: not worth testing\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n\n    const errorOutput = [err.stdout, err.stderr, err.message]\n      .filter(isString)\n      .join('\\n');\n\n    logger.warn({ err, lockFileName }, 'Error updating mise lock file');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: errorOutput,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,MAAM,6BAA6B;;;;;;;;;;AAWnC,eAAe,kBACb,aACwB;CACxB,IAAI;EACF,MAAM,EAAE,WAAW,MAAM,KAAK,gBAAgB,WAAW;EACzD,MAAM,UAAU,MAAM,eAAe,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG;EACtD,IAAI,WAAWA,IAAe,UAAU,OAAO,GAC7C,OAAO;EAET,OAAO,MAAM,EAAE,OAAO,GAAG,qCAAqC;EAC9D,OAAO;CACT,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,kCAAkC;EACxD,OAAO;CACT;AACF;;AAGA,SAAS,4BAA4B,SAAiC;CACpE,OACE,CAAC,CAAC,YACDA,IAAe,OAAO,SAAS,0BAA0B,KACxDA,IAAe,cAAc,SAAS,0BAA0B;AAEtE;;;;;;;;;;;;;;AAeA,eAAe,2BACb,QACA,gBACA,WAAW,OACgB;CAC3B,MAAM,qBAAqC;EACzC,UAAU;EACV,YAAY;CACd;CACA,IAAI,UACF,OAAO,CAAC,kBAAkB;CAE5B,OAAO;EACL;EACA;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,MAAM;EACxD;EACA;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,KAAK;EACvD;EACA;GAEE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,IAAI;EACtD;EACA;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,MAAM;EACxD;CACF;AACF;;;;;AAMA,eAAsB,gBAAgB,EACpC,iBACA,aACA,UAC0D;CAC1D,MAAM,eAAe,gBAAgB,eAAe;CACpD,MAAM,0BAA0B,MAAM,cAAc,cAAc,MAAM;CACxE,IAAI,CAAC,yBAAyB;EAC5B,OAAO,MAAM,EAAE,aAAa,GAAG,yBAAyB;EACxD,OAAO;CACT;CAOA,MAAM,kBADY,aAAa,IAAI,yBACH,CAAC,CAAC,SAAS,MAAM;CAOjD,MAAM,iBAAiB,MAAM,sBAAsB,QAAQ,MAAM;CACjE,IAAI,2BAA2B;CAC/B,IAAI,CAAC,mBAAmB,OAAO,uBAM7B,2BAA2B,4BAA4B,MAL7B,kBAAkB;EAC1C,SAAS;EACT,iBAAiB,CAAC;GAAE,UAAU;GAAQ,YAAY;EAAe,CAAC;EAClE,QAAQ,CAAC;CACX,CAAC,CACiE;CAGpE,MAAM,WAAW,CAAC,mBAAmB;CACrC,IAAI,CAAC,mBAAmB,CAAC,UAAU;EACjC,OAAO,KAAK,KACV,EAAE,oBAAoB,2BAA2B,GACjD,4GACF;EACA,OAAO;CACT;CAEA,MAAM,EAAE,SAAS,QAAQ,cAAc,eAAe;CACtD,MAAM,YAAY,UAAU,aAAa;CAEzC,IAAI;CACJ,IAAI,OAAO,uBAOT,UAAU,YAAY,YADL,2BAA2B,YAAY;MAEnD;EACL,MAAM,QAAQ,YACX,KAAK,EAAE,cAAc,OAAO,CAAC,CAC7B,OAAO,gCAAgC,CAAC,CACxC,IAAI,KAAK,CAAC,CACV,KAAK,GAAG;EACX,UAAU,QACN,YAAY,UAAU,GAAG,UACzB,YAAY;CAClB;CAEA,MAAM,WAAqB,CAAC;CAC5B,IAAI,KACF,SAAS,WAAW;CAEtB,IAAI,UACF,SAAS,YAAY;CAEvB,MAAM,QAAQ,gBACZC,KAAe;EACb,UAAU;EACV,KAAK;CACP,CAAC,CACH;CACA,IAAI,OACF,SAAS,eAAe;CAG1B,MAAM,cAA2B;EAC/B,SAAS;EACT;EACA,iBAAiB,MAAM,2BACrB,QACA,gBACA,QACF;EACA,QAAQ,CAAC;CACX;CAMA,MAAM,WAAW,WACb,CAAC,OAAO,IACR,CAAC,cAAc,MAAM,MAAM,SAAS,eAAe,CAAC,KAAK,OAAO;CAEpE,IAAI;EACF,MAAM,KAAK,UAAU,WAAW;EAChC,MAAM,qBAAqB,MAAM,cAAc,cAAc,MAAM;EACnE,IAAI,CAAC,sBAAsB,4BAA4B,oBACrD,OAAO;EAGT,OAAO,MAAM,EAAE,aAAa,GAAG,kCAAkC;EACjE,OAAO,CACL,EACE,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF,CACF;CACF,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAGR,MAAM,cAAc;GAAC,IAAI;GAAQ,IAAI;GAAQ,IAAI;EAAO,CAAC,CACtD,OAAO,QAAQ,CAAC,CAChB,KAAK,IAAI;EAEZ,OAAO,KAAK;GAAE;GAAK;EAAa,GAAG,+BAA+B;EAClE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ;EACV,EACF,CACF;CACF;AACF"}

package/dist/modules/manager/mix/artifacts.js

@@ -5,6 +5,7 @@ import { logger } from "../../../logger/index.js";
 import { find, getAll } from "../../../util/host-rules.js";
 import { deleteLocalFile, ensureCacheDir, findLocalSiblingOrParent, getSiblingFileName, localPathExists, readLocalFile, writeLocalFile } from "../../../util/fs/index.js";
 import { exec } from "../../../util/exec/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { isEmptyArray, isString } from "@sindresorhus/is";
 import { quote } from "shlex";
 //#region lib/modules/manager/mix/artifacts.ts
@@ -84,10 +85,10 @@ async function updateArtifacts({ packageFileName, updatedDeps, newPackageFileCon
 		docker: {},
 		toolConstraints: [{
 			toolName: "erlang",
-			constraint: config.constraints?.erlang ?? `^26`
+			constraint: await resolveToolConstraint(config, "erlang") ?? `^26`
 		}, {
 			toolName: "elixir",
-			constraint: config.constraints?.elixir
+			constraint: await resolveToolConstraint(config, "elixir")
 		}],
 		preCommands
 	};

package/dist/modules/manager/mix/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":["hostRules\n    .getAll","hostRules.find"],"sources":["../../../../lib/modules/manager/mix/artifacts.ts"],"sourcesContent":["import { isEmptyArray, isString } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  deleteLocalFile,\n  ensureCacheDir,\n  findLocalSiblingOrParent,\n  getSiblingFileName,\n  localPathExists,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { regEx } from '../../../util/regex.ts';\n\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\n\nconst hexRepoUrl = 'https://hex.pm/';\nconst hexRepoOrgUrlRegex = regEx(\n  `^https://hex\\\\.pm/api/repos/(?<organization>[a-z0-9_]+)/$`,\n);\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`mix.getArtifacts(${packageFileName})`);\n  const { isLockFileMaintenance } = config;\n\n  if (isEmptyArray(updatedDeps) && !isLockFileMaintenance) {\n    logger.debug('No updated mix deps');\n    return null;\n  }\n\n  let lockFileName = getSiblingFileName(packageFileName, 'mix.lock');\n  let isUmbrella = false;\n\n  let existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent) {\n    const lockFileError = await checkLockFileReadError(lockFileName);\n    if (lockFileError) {\n      return lockFileError;\n    }\n\n    const parentLockFileName = await findLocalSiblingOrParent(\n      packageFileName,\n      'mix.lock',\n    );\n    existingLockFileContent =\n      parentLockFileName && (await readLocalFile(parentLockFileName, 'utf8'));\n\n    if (parentLockFileName && existingLockFileContent) {\n      lockFileName = parentLockFileName;\n      isUmbrella = true;\n    } else if (parentLockFileName) {\n      const lockFileError = await checkLockFileReadError(parentLockFileName);\n      if (lockFileError) {\n        return lockFileError;\n      }\n    }\n  }\n\n  if (isLockFileMaintenance && isUmbrella) {\n    logger.debug(\n      `Cannot use lockFileMaintenance in an umbrella project, see ${GlobalConfig.get('productLinks').documentation}modules/manager/mix/#lockFileMaintenance`,\n    );\n    return null;\n  }\n\n  if (isLockFileMaintenance && !existingLockFileContent) {\n    logger.debug(\n      'Cannot use lockFileMaintenance when no mix.lock file is present',\n    );\n    return null;\n  }\n\n  try {\n    await writeLocalFile(packageFileName, newPackageFileContent);\n    if (isLockFileMaintenance) {\n      await deleteLocalFile(lockFileName);\n    }\n  } catch (err) {\n    logger.warn({ err }, 'mix.exs could not be written');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n\n  if (!existingLockFileContent) {\n    logger.debug('No mix.lock found');\n    return null;\n  }\n\n  const organizations = new Set<string>();\n\n  const hexHostRulesWithMatchHost = hostRules\n    .getAll()\n    .filter(\n      (hostRule) =>\n        !!hostRule.matchHost && hexRepoOrgUrlRegex.test(hostRule.matchHost),\n    );\n\n  for (const { matchHost } of hexHostRulesWithMatchHost) {\n    if (matchHost) {\n      const result = hexRepoOrgUrlRegex.exec(matchHost);\n\n      if (result?.groups) {\n        const { organization } = result.groups;\n        organizations.add(organization);\n      }\n    }\n  }\n\n  for (const { packageName } of updatedDeps) {\n    if (packageName) {\n      const [, organization] = packageName.split(':');\n\n      if (organization) {\n        organizations.add(organization);\n      }\n    }\n  }\n\n  const preCommands = Array.from(organizations).reduce((acc, organization) => {\n    const url = `${hexRepoUrl}api/repos/${organization}/`;\n    const { token } = hostRules.find({ url });\n\n    if (token) {\n      logger.debug(`Authenticating to hex organization ${organization}`);\n      const authCommand = `mix hex.organization auth ${quote(organization)} --key ${quote(token)}`;\n      return [...acc, authCommand];\n    }\n\n    return acc;\n  }, [] as string[]);\n\n  // renovate: will update this\n  const erlangVersion = '26';\n\n  const execOptions: ExecOptions = {\n    extraEnv: {\n      // https://hexdocs.pm/mix/1.15.0/Mix.Tasks.Archive.html\n      // TODO: should include a version constraint\n      MIX_ARCHIVES: await ensureCacheDir('mix_archives'),\n    },\n    cwdFile: lockFileName,\n    docker: {},\n    toolConstraints: [\n      {\n        toolName: 'erlang',\n        // https://hexdocs.pm/elixir/1.14.5/compatibility-and-deprecations.html#compatibility-between-elixir-and-erlang-otp\n        constraint: config.constraints?.erlang ?? `^${erlangVersion}`,\n      },\n      {\n        toolName: 'elixir',\n        constraint: config.constraints?.elixir,\n      },\n    ],\n    preCommands,\n  };\n\n  let command: string;\n  if (isLockFileMaintenance) {\n    command = 'mix deps.get';\n  } else {\n    command = [\n      'mix',\n      'deps.update',\n      ...updatedDeps\n        .map((dep) => dep.depName)\n        .filter(isString)\n        .map((dep) => quote(dep)),\n    ].join(' ');\n  }\n\n  try {\n    await exec(command, execOptions);\n  } catch (err) {\n    /* v8 ignore if -- defensive rethrow of TEMPORARY_ERROR from exec, not reproduced in mix specs */\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n\n    logger.debug(\n      { err, message: err.message, command },\n      'Failed to update Mix lock file',\n    );\n\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n\n  const newMixLockContent = await readLocalFile(lockFileName, 'utf8');\n  if (existingLockFileContent === newMixLockContent) {\n    logger.debug('mix.lock is unchanged');\n    return null;\n  }\n  logger.debug('Returning updated mix.lock');\n  return [\n    {\n      file: {\n        type: 'addition',\n        path: lockFileName,\n        contents: newMixLockContent,\n      },\n    },\n  ];\n}\n\nasync function checkLockFileReadError(\n  lockFileName: string,\n): Promise<UpdateArtifactsResult[] | null> {\n  if (await localPathExists(lockFileName)) {\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: `Error reading ${lockFileName}`,\n        },\n      },\n    ];\n  }\n  return null;\n}\n"],"mappings":";;;;;;;;;;AAqBA,MAAM,aAAa;AACnB,MAAM,qBAAqB,MACzB,2DACF;AAEA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,oBAAoB,gBAAgB,EAAE;CACnD,MAAM,EAAE,0BAA0B;CAElC,IAAI,aAAa,WAAW,KAAK,CAAC,uBAAuB;EACvD,OAAO,MAAM,qBAAqB;EAClC,OAAO;CACT;CAEA,IAAI,eAAe,mBAAmB,iBAAiB,UAAU;CACjE,IAAI,aAAa;CAEjB,IAAI,0BAA0B,MAAM,cAAc,cAAc,MAAM;CACtE,IAAI,CAAC,yBAAyB;EAC5B,MAAM,gBAAgB,MAAM,uBAAuB,YAAY;EAC/D,IAAI,eACF,OAAO;EAGT,MAAM,qBAAqB,MAAM,yBAC/B,iBACA,UACF;EACA,0BACE,sBAAuB,MAAM,cAAc,oBAAoB,MAAM;EAEvE,IAAI,sBAAsB,yBAAyB;GACjD,eAAe;GACf,aAAa;EACf,OAAO,IAAI,oBAAoB;GAC7B,MAAM,gBAAgB,MAAM,uBAAuB,kBAAkB;GACrE,IAAI,eACF,OAAO;EAEX;CACF;CAEA,IAAI,yBAAyB,YAAY;EACvC,OAAO,MACL,8DAA8D,aAAa,IAAI,cAAc,CAAC,CAAC,cAAc,yCAC/G;EACA,OAAO;CACT;CAEA,IAAI,yBAAyB,CAAC,yBAAyB;EACrD,OAAO,MACL,iEACF;EACA,OAAO;CACT;CAEA,IAAI;EACF,MAAM,eAAe,iBAAiB,qBAAqB;EAC3D,IAAI,uBACF,MAAM,gBAAgB,YAAY;CAEtC,SAAS,KAAK;EACZ,OAAO,KAAK,EAAE,IAAI,GAAG,8BAA8B;EACnD,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;CAEA,IAAI,CAAC,yBAAyB;EAC5B,OAAO,MAAM,mBAAmB;EAChC,OAAO;CACT;CAEA,MAAM,gCAAgB,IAAI,IAAY;CAEtC,MAAM,4BAA4BA,OACxB,CAAC,CACR,QACE,aACC,CAAC,CAAC,SAAS,aAAa,mBAAmB,KAAK,SAAS,SAAS,CACtE;CAEF,KAAK,MAAM,EAAE,eAAe,2BAC1B,IAAI,WAAW;EACb,MAAM,SAAS,mBAAmB,KAAK,SAAS;EAEhD,IAAI,QAAQ,QAAQ;GAClB,MAAM,EAAE,iBAAiB,OAAO;GAChC,cAAc,IAAI,YAAY;EAChC;CACF;CAGF,KAAK,MAAM,EAAE,iBAAiB,aAC5B,IAAI,aAAa;EACf,MAAM,GAAG,gBAAgB,YAAY,MAAM,GAAG;EAE9C,IAAI,cACF,cAAc,IAAI,YAAY;CAElC;CAGF,MAAM,cAAc,MAAM,KAAK,aAAa,CAAC,CAAC,QAAQ,KAAK,iBAAiB;EAC1E,MAAM,MAAM,GAAG,WAAW,YAAY,aAAa;EACnD,MAAM,EAAE,UAAUC,KAAe,EAAE,IAAI,CAAC;EAExC,IAAI,OAAO;GACT,OAAO,MAAM,sCAAsC,cAAc;GACjE,MAAM,cAAc,6BAA6B,MAAM,YAAY,EAAE,SAAS,MAAM,KAAK;GACzF,OAAO,CAAC,GAAG,KAAK,WAAW;EAC7B;EAEA,OAAO;CACT,GAAG,CAAC,CAAa;CAKjB,MAAM,cAA2B;EAC/B,UAAU,EAGR,cAAc,MAAM,eAAe,cAAc,EACnD;EACA,SAAS;EACT,QAAQ,CAAC;EACT,iBAAiB,CACf;GACE,UAAU;GAEV,YAAY,OAAO,aAAa,UAAU;EAC5C,GACA;GACE,UAAU;GACV,YAAY,OAAO,aAAa;EAClC,CACF;EACA;CACF;CAEA,IAAI;CACJ,IAAI,uBACF,UAAU;MAEV,UAAU;EACR;EACA;EACA,GAAG,YACA,KAAK,QAAQ,IAAI,OAAO,CAAC,CACzB,OAAO,QAAQ,CAAC,CAChB,KAAK,QAAQ,MAAM,GAAG,CAAC;CAC5B,CAAC,CAAC,KAAK,GAAG;CAGZ,IAAI;EACF,MAAM,KAAK,SAAS,WAAW;CACjC,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAGR,OAAO,MACL;GAAE;GAAK,SAAS,IAAI;GAAS;EAAQ,GACrC,gCACF;EAEA,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;CAEA,MAAM,oBAAoB,MAAM,cAAc,cAAc,MAAM;CAClE,IAAI,4BAA4B,mBAAmB;EACjD,OAAO,MAAM,uBAAuB;EACpC,OAAO;CACT;CACA,OAAO,MAAM,4BAA4B;CACzC,OAAO,CACL,EACE,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU;CACZ,EACF,CACF;AACF;AAEA,eAAe,uBACb,cACyC;CACzC,IAAI,MAAM,gBAAgB,YAAY,GACpC,OAAO,CACL,EACE,eAAe;EACb,UAAU;EACV,QAAQ,iBAAiB;CAC3B,EACF,CACF;CAEF,OAAO;AACT"}
+{"version":3,"file":"artifacts.js","names":["hostRules\n    .getAll","hostRules.find"],"sources":["../../../../lib/modules/manager/mix/artifacts.ts"],"sourcesContent":["import { isEmptyArray, isString } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  deleteLocalFile,\n  ensureCacheDir,\n  findLocalSiblingOrParent,\n  getSiblingFileName,\n  localPathExists,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { regEx } from '../../../util/regex.ts';\n\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\n\nconst hexRepoUrl = 'https://hex.pm/';\nconst hexRepoOrgUrlRegex = regEx(\n  `^https://hex\\\\.pm/api/repos/(?<organization>[a-z0-9_]+)/$`,\n);\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`mix.getArtifacts(${packageFileName})`);\n  const { isLockFileMaintenance } = config;\n\n  if (isEmptyArray(updatedDeps) && !isLockFileMaintenance) {\n    logger.debug('No updated mix deps');\n    return null;\n  }\n\n  let lockFileName = getSiblingFileName(packageFileName, 'mix.lock');\n  let isUmbrella = false;\n\n  let existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent) {\n    const lockFileError = await checkLockFileReadError(lockFileName);\n    if (lockFileError) {\n      return lockFileError;\n    }\n\n    const parentLockFileName = await findLocalSiblingOrParent(\n      packageFileName,\n      'mix.lock',\n    );\n    existingLockFileContent =\n      parentLockFileName && (await readLocalFile(parentLockFileName, 'utf8'));\n\n    if (parentLockFileName && existingLockFileContent) {\n      lockFileName = parentLockFileName;\n      isUmbrella = true;\n    } else if (parentLockFileName) {\n      const lockFileError = await checkLockFileReadError(parentLockFileName);\n      if (lockFileError) {\n        return lockFileError;\n      }\n    }\n  }\n\n  if (isLockFileMaintenance && isUmbrella) {\n    logger.debug(\n      `Cannot use lockFileMaintenance in an umbrella project, see ${GlobalConfig.get('productLinks').documentation}modules/manager/mix/#lockFileMaintenance`,\n    );\n    return null;\n  }\n\n  if (isLockFileMaintenance && !existingLockFileContent) {\n    logger.debug(\n      'Cannot use lockFileMaintenance when no mix.lock file is present',\n    );\n    return null;\n  }\n\n  try {\n    await writeLocalFile(packageFileName, newPackageFileContent);\n    if (isLockFileMaintenance) {\n      await deleteLocalFile(lockFileName);\n    }\n  } catch (err) {\n    logger.warn({ err }, 'mix.exs could not be written');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n\n  if (!existingLockFileContent) {\n    logger.debug('No mix.lock found');\n    return null;\n  }\n\n  const organizations = new Set<string>();\n\n  const hexHostRulesWithMatchHost = hostRules\n    .getAll()\n    .filter(\n      (hostRule) =>\n        !!hostRule.matchHost && hexRepoOrgUrlRegex.test(hostRule.matchHost),\n    );\n\n  for (const { matchHost } of hexHostRulesWithMatchHost) {\n    if (matchHost) {\n      const result = hexRepoOrgUrlRegex.exec(matchHost);\n\n      if (result?.groups) {\n        const { organization } = result.groups;\n        organizations.add(organization);\n      }\n    }\n  }\n\n  for (const { packageName } of updatedDeps) {\n    if (packageName) {\n      const [, organization] = packageName.split(':');\n\n      if (organization) {\n        organizations.add(organization);\n      }\n    }\n  }\n\n  const preCommands = Array.from(organizations).reduce((acc, organization) => {\n    const url = `${hexRepoUrl}api/repos/${organization}/`;\n    const { token } = hostRules.find({ url });\n\n    if (token) {\n      logger.debug(`Authenticating to hex organization ${organization}`);\n      const authCommand = `mix hex.organization auth ${quote(organization)} --key ${quote(token)}`;\n      return [...acc, authCommand];\n    }\n\n    return acc;\n  }, [] as string[]);\n\n  // renovate: will update this\n  const erlangVersion = '26';\n\n  const execOptions: ExecOptions = {\n    extraEnv: {\n      // https://hexdocs.pm/mix/1.15.0/Mix.Tasks.Archive.html\n      // TODO: should include a version constraint\n      MIX_ARCHIVES: await ensureCacheDir('mix_archives'),\n    },\n    cwdFile: lockFileName,\n    docker: {},\n    toolConstraints: [\n      {\n        toolName: 'erlang',\n        // https://hexdocs.pm/elixir/1.14.5/compatibility-and-deprecations.html#compatibility-between-elixir-and-erlang-otp\n        constraint:\n          (await resolveToolConstraint(config, 'erlang')) ??\n          `^${erlangVersion}`,\n      },\n      {\n        toolName: 'elixir',\n        constraint: await resolveToolConstraint(config, 'elixir'),\n      },\n    ],\n    preCommands,\n  };\n\n  let command: string;\n  if (isLockFileMaintenance) {\n    command = 'mix deps.get';\n  } else {\n    command = [\n      'mix',\n      'deps.update',\n      ...updatedDeps\n        .map((dep) => dep.depName)\n        .filter(isString)\n        .map((dep) => quote(dep)),\n    ].join(' ');\n  }\n\n  try {\n    await exec(command, execOptions);\n  } catch (err) {\n    /* v8 ignore if -- defensive rethrow of TEMPORARY_ERROR from exec, not reproduced in mix specs */\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n\n    logger.debug(\n      { err, message: err.message, command },\n      'Failed to update Mix lock file',\n    );\n\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n\n  const newMixLockContent = await readLocalFile(lockFileName, 'utf8');\n  if (existingLockFileContent === newMixLockContent) {\n    logger.debug('mix.lock is unchanged');\n    return null;\n  }\n  logger.debug('Returning updated mix.lock');\n  return [\n    {\n      file: {\n        type: 'addition',\n        path: lockFileName,\n        contents: newMixLockContent,\n      },\n    },\n  ];\n}\n\nasync function checkLockFileReadError(\n  lockFileName: string,\n): Promise<UpdateArtifactsResult[] | null> {\n  if (await localPathExists(lockFileName)) {\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: `Error reading ${lockFileName}`,\n        },\n      },\n    ];\n  }\n  return null;\n}\n"],"mappings":";;;;;;;;;;;AAsBA,MAAM,aAAa;AACnB,MAAM,qBAAqB,MACzB,2DACF;AAEA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,oBAAoB,gBAAgB,EAAE;CACnD,MAAM,EAAE,0BAA0B;CAElC,IAAI,aAAa,WAAW,KAAK,CAAC,uBAAuB;EACvD,OAAO,MAAM,qBAAqB;EAClC,OAAO;CACT;CAEA,IAAI,eAAe,mBAAmB,iBAAiB,UAAU;CACjE,IAAI,aAAa;CAEjB,IAAI,0BAA0B,MAAM,cAAc,cAAc,MAAM;CACtE,IAAI,CAAC,yBAAyB;EAC5B,MAAM,gBAAgB,MAAM,uBAAuB,YAAY;EAC/D,IAAI,eACF,OAAO;EAGT,MAAM,qBAAqB,MAAM,yBAC/B,iBACA,UACF;EACA,0BACE,sBAAuB,MAAM,cAAc,oBAAoB,MAAM;EAEvE,IAAI,sBAAsB,yBAAyB;GACjD,eAAe;GACf,aAAa;EACf,OAAO,IAAI,oBAAoB;GAC7B,MAAM,gBAAgB,MAAM,uBAAuB,kBAAkB;GACrE,IAAI,eACF,OAAO;EAEX;CACF;CAEA,IAAI,yBAAyB,YAAY;EACvC,OAAO,MACL,8DAA8D,aAAa,IAAI,cAAc,CAAC,CAAC,cAAc,yCAC/G;EACA,OAAO;CACT;CAEA,IAAI,yBAAyB,CAAC,yBAAyB;EACrD,OAAO,MACL,iEACF;EACA,OAAO;CACT;CAEA,IAAI;EACF,MAAM,eAAe,iBAAiB,qBAAqB;EAC3D,IAAI,uBACF,MAAM,gBAAgB,YAAY;CAEtC,SAAS,KAAK;EACZ,OAAO,KAAK,EAAE,IAAI,GAAG,8BAA8B;EACnD,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;CAEA,IAAI,CAAC,yBAAyB;EAC5B,OAAO,MAAM,mBAAmB;EAChC,OAAO;CACT;CAEA,MAAM,gCAAgB,IAAI,IAAY;CAEtC,MAAM,4BAA4BA,OACxB,CAAC,CACR,QACE,aACC,CAAC,CAAC,SAAS,aAAa,mBAAmB,KAAK,SAAS,SAAS,CACtE;CAEF,KAAK,MAAM,EAAE,eAAe,2BAC1B,IAAI,WAAW;EACb,MAAM,SAAS,mBAAmB,KAAK,SAAS;EAEhD,IAAI,QAAQ,QAAQ;GAClB,MAAM,EAAE,iBAAiB,OAAO;GAChC,cAAc,IAAI,YAAY;EAChC;CACF;CAGF,KAAK,MAAM,EAAE,iBAAiB,aAC5B,IAAI,aAAa;EACf,MAAM,GAAG,gBAAgB,YAAY,MAAM,GAAG;EAE9C,IAAI,cACF,cAAc,IAAI,YAAY;CAElC;CAGF,MAAM,cAAc,MAAM,KAAK,aAAa,CAAC,CAAC,QAAQ,KAAK,iBAAiB;EAC1E,MAAM,MAAM,GAAG,WAAW,YAAY,aAAa;EACnD,MAAM,EAAE,UAAUC,KAAe,EAAE,IAAI,CAAC;EAExC,IAAI,OAAO;GACT,OAAO,MAAM,sCAAsC,cAAc;GACjE,MAAM,cAAc,6BAA6B,MAAM,YAAY,EAAE,SAAS,MAAM,KAAK;GACzF,OAAO,CAAC,GAAG,KAAK,WAAW;EAC7B;EAEA,OAAO;CACT,GAAG,CAAC,CAAa;CAKjB,MAAM,cAA2B;EAC/B,UAAU,EAGR,cAAc,MAAM,eAAe,cAAc,EACnD;EACA,SAAS;EACT,QAAQ,CAAC;EACT,iBAAiB,CACf;GACE,UAAU;GAEV,YACG,MAAM,sBAAsB,QAAQ,QAAQ,KAC7C;EACJ,GACA;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,QAAQ;EAC1D,CACF;EACA;CACF;CAEA,IAAI;CACJ,IAAI,uBACF,UAAU;MAEV,UAAU;EACR;EACA;EACA,GAAG,YACA,KAAK,QAAQ,IAAI,OAAO,CAAC,CACzB,OAAO,QAAQ,CAAC,CAChB,KAAK,QAAQ,MAAM,GAAG,CAAC;CAC5B,CAAC,CAAC,KAAK,GAAG;CAGZ,IAAI;EACF,MAAM,KAAK,SAAS,WAAW;CACjC,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAGR,OAAO,MACL;GAAE;GAAK,SAAS,IAAI;GAAS;EAAQ,GACrC,gCACF;EAEA,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;CAEA,MAAM,oBAAoB,MAAM,cAAc,cAAc,MAAM;CAClE,IAAI,4BAA4B,mBAAmB;EACjD,OAAO,MAAM,uBAAuB;EACpC,OAAO;CACT;CACA,OAAO,MAAM,4BAA4B;CACzC,OAAO,CACL,EACE,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU;CACZ,EACF,CACF;AACF;AAEA,eAAe,uBACb,cACyC;CACzC,IAAI,MAAM,gBAAgB,YAAY,GACpC,OAAO,CACL,EACE,eAAe;EACb,UAAU;EACV,QAAQ,iBAAiB;CAC3B,EACF,CACF;CAEF,OAAO;AACT"}

package/dist/modules/manager/nix/artifacts.js

@@ -4,6 +4,7 @@ import { find } from "../../../util/host-rules.js";
 import { readLocalFile } from "../../../util/fs/index.js";
 import { exec } from "../../../util/exec/index.js";
 import { getRepoStatus } from "../../../util/git/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { findGithubToken } from "../../../util/check-token.js";
 import { isNonEmptyStringAndNotWhitespace } from "@sindresorhus/is";
 import { quote } from "shlex";
@@ -29,7 +30,7 @@ async function updateArtifacts({ packageFileName, config, updatedDeps }) {
 		cwdFile: packageFileName,
 		toolConstraints: [{
 			toolName: "nix",
-			constraint: config.constraints?.nix
+			constraint: await resolveToolConstraint(config, "nix")
 		}],
 		docker: {}
 	};

package/dist/modules/manager/nix/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":["hostRules.find"],"sources":["../../../../lib/modules/manager/nix/artifacts.ts"],"sourcesContent":["import { isNonEmptyStringAndNotWhitespace } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport { logger } from '../../../logger/index.ts';\nimport { findGithubToken } from '../../../util/check-token.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport { readLocalFile } from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\n\nexport async function updateArtifacts({\n  packageFileName,\n  config,\n  updatedDeps,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  const lockFileName = packageFileName.replace(regEx(/\\.nix$/), '.lock');\n  const existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent) {\n    logger.debug('No flake.lock found');\n    return null;\n  }\n\n  let cmd = `nix --extra-experimental-features 'nix-command flakes' `;\n\n  const token = findGithubToken(\n    hostRules.find({\n      hostType: 'github',\n      url: 'https://api.github.com/',\n    }),\n  );\n\n  if (token) {\n    cmd += `--extra-access-tokens github.com=${quote(token)} `;\n  }\n\n  if (config.isLockFileMaintenance) {\n    cmd += 'flake update';\n  } else {\n    const inputs = updatedDeps\n      .map(({ depName }) => depName)\n      .filter(isNonEmptyStringAndNotWhitespace)\n      .map((depName) => quote(depName))\n      .join(' ');\n    cmd += `flake update ${inputs}`;\n  }\n  const execOptions: ExecOptions = {\n    cwdFile: packageFileName,\n    toolConstraints: [\n      {\n        toolName: 'nix',\n        constraint: config.constraints?.nix,\n      },\n    ],\n    docker: {},\n  };\n\n  try {\n    await exec(cmd, execOptions);\n\n    const status = await getRepoStatus();\n    if (!status.modified.includes(lockFileName)) {\n      return null;\n    }\n    logger.debug('Returning updated flake.lock');\n    return [\n      {\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: await readLocalFile(lockFileName),\n        },\n      },\n    ];\n  } catch (err) {\n    logger.warn({ err }, 'Error updating flake.lock');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;AAYA,eAAsB,gBAAgB,EACpC,iBACA,QACA,eAC0D;CAC1D,MAAM,eAAe,gBAAgB,QAAQ,MAAM,QAAQ,GAAG,OAAO;CAErE,IAAI,CAAC,MADiC,cAAc,cAAc,MAAM,GAC1C;EAC5B,OAAO,MAAM,qBAAqB;EAClC,OAAO;CACT;CAEA,IAAI,MAAM;CAEV,MAAM,QAAQ,gBACZA,KAAe;EACb,UAAU;EACV,KAAK;CACP,CAAC,CACH;CAEA,IAAI,OACF,OAAO,oCAAoC,MAAM,KAAK,EAAE;CAG1D,IAAI,OAAO,uBACT,OAAO;MACF;EACL,MAAM,SAAS,YACZ,KAAK,EAAE,cAAc,OAAO,CAAC,CAC7B,OAAO,gCAAgC,CAAC,CACxC,KAAK,YAAY,MAAM,OAAO,CAAC,CAAC,CAChC,KAAK,GAAG;EACX,OAAO,gBAAgB;CACzB;CACA,MAAM,cAA2B;EAC/B,SAAS;EACT,iBAAiB,CACf;GACE,UAAU;GACV,YAAY,OAAO,aAAa;EAClC,CACF;EACA,QAAQ,CAAC;CACX;CAEA,IAAI;EACF,MAAM,KAAK,KAAK,WAAW;EAG3B,IAAI,EAAC,MADgB,cAAc,EAAA,CACvB,SAAS,SAAS,YAAY,GACxC,OAAO;EAET,OAAO,MAAM,8BAA8B;EAC3C,OAAO,CACL,EACE,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU,MAAM,cAAc,YAAY;EAC5C,EACF,CACF;CACF,SAAS,KAAK;EACZ,OAAO,KAAK,EAAE,IAAI,GAAG,2BAA2B;EAChD,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF"}
+{"version":3,"file":"artifacts.js","names":["hostRules.find"],"sources":["../../../../lib/modules/manager/nix/artifacts.ts"],"sourcesContent":["import { isNonEmptyStringAndNotWhitespace } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport { logger } from '../../../logger/index.ts';\nimport { findGithubToken } from '../../../util/check-token.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport { readLocalFile } from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\n\nexport async function updateArtifacts({\n  packageFileName,\n  config,\n  updatedDeps,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  const lockFileName = packageFileName.replace(regEx(/\\.nix$/), '.lock');\n  const existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent) {\n    logger.debug('No flake.lock found');\n    return null;\n  }\n\n  let cmd = `nix --extra-experimental-features 'nix-command flakes' `;\n\n  const token = findGithubToken(\n    hostRules.find({\n      hostType: 'github',\n      url: 'https://api.github.com/',\n    }),\n  );\n\n  if (token) {\n    cmd += `--extra-access-tokens github.com=${quote(token)} `;\n  }\n\n  if (config.isLockFileMaintenance) {\n    cmd += 'flake update';\n  } else {\n    const inputs = updatedDeps\n      .map(({ depName }) => depName)\n      .filter(isNonEmptyStringAndNotWhitespace)\n      .map((depName) => quote(depName))\n      .join(' ');\n    cmd += `flake update ${inputs}`;\n  }\n  const execOptions: ExecOptions = {\n    cwdFile: packageFileName,\n    toolConstraints: [\n      {\n        toolName: 'nix',\n        constraint: await resolveToolConstraint(config, 'nix'),\n      },\n    ],\n    docker: {},\n  };\n\n  try {\n    await exec(cmd, execOptions);\n\n    const status = await getRepoStatus();\n    if (!status.modified.includes(lockFileName)) {\n      return null;\n    }\n    logger.debug('Returning updated flake.lock');\n    return [\n      {\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: await readLocalFile(lockFileName),\n        },\n      },\n    ];\n  } catch (err) {\n    logger.warn({ err }, 'Error updating flake.lock');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;AAaA,eAAsB,gBAAgB,EACpC,iBACA,QACA,eAC0D;CAC1D,MAAM,eAAe,gBAAgB,QAAQ,MAAM,QAAQ,GAAG,OAAO;CAErE,IAAI,CAAC,MADiC,cAAc,cAAc,MAAM,GAC1C;EAC5B,OAAO,MAAM,qBAAqB;EAClC,OAAO;CACT;CAEA,IAAI,MAAM;CAEV,MAAM,QAAQ,gBACZA,KAAe;EACb,UAAU;EACV,KAAK;CACP,CAAC,CACH;CAEA,IAAI,OACF,OAAO,oCAAoC,MAAM,KAAK,EAAE;CAG1D,IAAI,OAAO,uBACT,OAAO;MACF;EACL,MAAM,SAAS,YACZ,KAAK,EAAE,cAAc,OAAO,CAAC,CAC7B,OAAO,gCAAgC,CAAC,CACxC,KAAK,YAAY,MAAM,OAAO,CAAC,CAAC,CAChC,KAAK,GAAG;EACX,OAAO,gBAAgB;CACzB;CACA,MAAM,cAA2B;EAC/B,SAAS;EACT,iBAAiB,CACf;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,KAAK;EACvD,CACF;EACA,QAAQ,CAAC;CACX;CAEA,IAAI;EACF,MAAM,KAAK,KAAK,WAAW;EAG3B,IAAI,EAAC,MADgB,cAAc,EAAA,CACvB,SAAS,SAAS,YAAY,GACxC,OAAO;EAET,OAAO,MAAM,8BAA8B;EAC3C,OAAO,CACL,EACE,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU,MAAM,cAAc,YAAY;EAC5C,EACF,CACF;CACF,SAAS,KAAK;EACZ,OAAO,KAAK,EAAE,IAAI,GAAG,2BAA2B;EAChD,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF"}

package/dist/modules/manager/npm/artifacts.js

@@ -4,6 +4,7 @@ import { matchRegexOrGlob } from "../../../util/string-match.js";
 import { logger } from "../../../logger/index.js";
 import { ensureCacheDir, localPathExists, readLocalFile, writeLocalFile } from "../../../util/fs/index.js";
 import { exec } from "../../../util/exec/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { PNPM_CACHE_DIR, PNPM_STORE_DIR } from "./constants.js";
 import { getNodeToolConstraint } from "./post-update/node-version.js";
 import { processHostRules } from "./post-update/rules.js";
@@ -52,7 +53,7 @@ async function handlePackageManagerUpdates(updateArtifactsConfig) {
 		},
 		toolConstraints: [nodeConstraints, {
 			toolName: "corepack",
-			constraint: config.constraints?.corepack
+			constraint: await resolveToolConstraint(config, "corepack")
 		}],
 		docker: {}
 	};