Merge branch 'main' into rework-nix

.devcontainer/Dockerfile

@@ -1 +1 @@
-FROM ghcr.io/containerbase/devcontainer:13.0.4
+FROM ghcr.io/containerbase/devcontainer:13.0.8

.github/label-actions.yml

@@ -27,6 +27,35 @@
 
     The Renovate team
 
+'auto:not-minimal-reproduction':
+  comment: >
+    Hi there,
+
+
+    We appreciate the effort you put into creating a reproduction. But your reproduction is not minimal yet, or is missing fields we ask for in our template.
+
+
+    Please re-read the steps and documentation given in the previous message, and try again to create a minimal reproduction.
+
+
+    Thanks, the Renovate team
+
+'auto:environment':
+  comment: >
+    Hi there,
+
+
+    This discussion needs more information about your environment.
+
+
+    Please specify in detail how you are running Renovate, for example:
+      - Are you running via an official Renovate image, or by using the Renovate npm package?
+      - Which exact image tag are you running?
+      - Which config/parameters are you using when running the image?
+      - Which config are you using in your CI/CD pipeline if relevant?
+
+    Thanks, the Renovate team
+
 'auto:logs':
   comment: >
     Hi there,
@@ -141,6 +170,19 @@
     If you're not sure, it's acceptable to paste the full logs, including into a gist. Please try to explain the problem in enough detail to give us starting points to debug. If you only paste the full log, and do nothing else, it is likely that we will take longer to help you, or we may not start to help you at all.
 
 
+    Thanks, the Renovate team
+
+'auto:too-much-redacting':
+  comment: >
+    Hi there,
+
+
+    You redacted too much information from your config or logs. This makes it hard for us to pinpoint the problem.
+
+
+    Please only redact truly sensitive information. Or consider an enterprise support contract, if Open Source support does not suit you.
+
+
     Thanks, the Renovate team
 
 'new package manager':
@@ -374,6 +416,19 @@
     As a general rule, we will read and respond to all discussions in this repository, so there is no need to mention us.
 
 
+    Thanks, the Renovate team
+
+'auto:meaningful-title':
+  comment: >
+    Hi there,
+
+
+    Please give your discussion a meaningful title. This helps others understand what your discussion is about, and increases the chances of getting help.
+
+
+    Do not use titles like "Need config help", "Renovate is not working", etc. Try to summarize the specifics of your problem or question in the title.
+
+
     Thanks, the Renovate team
 
 'auto:idea-rewrite':

.github/workflows/build.yml

@@ -30,7 +30,7 @@ concurrency:
 
 env:
   DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-  NODE_VERSION: 20
+  NODE_VERSION: 22
   PDM_VERSION: 2.20.0.post1 # renovate: datasource=pypi depName=pdm
   DRY_RUN: true
   TEST_LEGACY_DECRYPTION: true
@@ -683,7 +683,7 @@ jobs:
           show-progress: false
 
       - name: docker-config
-        uses: containerbase/internal-tools@24c6f15bd531c658751f021e3093c2ec4a569a5d # v3.4.34
+        uses: containerbase/internal-tools@bac5ab2e4e69658019ef136450b1941ace77a26a # v3.4.39
         with:
           command: docker-config
 

.github/workflows/update-data.yml

@@ -5,7 +5,7 @@ on:
   workflow_dispatch:
 
 env:
-  NODE_VERSION: 20
+  NODE_VERSION: 22
 
 permissions:
   contents: read

.nvmrc

@@ -1 +1 @@
-20.18.0
+22.11.0

data/node-js-schedule.json

@@ -124,7 +124,7 @@
     "lts": "2024-10-29",
     "maintenance": "2025-10-21",
     "end": "2027-04-30",
-    "codename": ""
+    "codename": "Jod"
   },
   "v23": {
     "start": "2024-10-16",

docs/usage/configuration-options.md

@@ -394,7 +394,12 @@ If `true`, Renovate removes special characters when slugifying the branch name:
 - only alphabetic characters are allowed
 - hyphens `-` are used to separate sections
 
-The default `false` behavior will mean that special characters like `.` may end up in the branch name.
+The default `false` behavior will mean that special characters like `.` and `/` may end up in the branch name.
+
+<!-- prettier-ignore -->
+!!! note
+    Renovate will not apply any search/replace to the `branchPrefix` part of the branch name.
+    If you don't want any `/` in your branch name then you will also need to change `branchPrefix` from the default `renovate/` value to something like `renovate-`.
 
 ## branchPrefix
 
@@ -1486,7 +1491,13 @@ You can't use other filenames because Renovate only checks the default filename
 
 ## gitAuthor
 
-You can customize the Git author that's used whenever Renovate creates a commit.
+You can customize the Git author that's used whenever Renovate creates a commit, although we do not recommend this.
+When this field is unset (default), Renovate will use its platform credentials (e.g. token) to learn/discover its account's git author automatically.
+
+<!-- prettier-ignore -->
+!!! note
+    If running as a GitHub App and using `platformCommit`, GitHub itself sets the git author in commits so you should not configure this field.
+
 The `gitAuthor` option accepts a [RFC5322](https://datatracker.ietf.org/doc/html/rfc5322)-compliant string.
 It's recommended to include a name followed by an email address, e.g.
 
@@ -1502,6 +1513,7 @@ Development Bot <[email protected]>
 ## gitIgnoredAuthors
 
 Specify commit authors ignored by Renovate.
+This field accepts [RFC5322](https://datatracker.ietf.org/doc/html/rfc5322)-compliant strings.
 
 By default, Renovate will treat any PR as modified if another Git author has added to the branch.
 When a PR is considered modified, Renovate won't perform any further commits such as if it's conflicted or needs a version update.
@@ -3317,6 +3329,10 @@ It does not apply when you use a Personal Access Token as credential.
 When `platformCommit` is enabled, Renovate will create commits with GitHub's API instead of using `git` directly.
 This way Renovate can use GitHub's [Commit signing support for bots and other GitHub Apps](https://github.blog/2019-08-15-commit-signing-support-for-bots-and-other-github-apps/) feature.
 
+<!-- prettier-ignore -->
+!!! note
+    When using platform commits, GitHub determines the git author string to use and Renovate's own gitAuthor is ignored.
+
 ## postUpdateOptions
 
 Table with options:

docs/usage/docker.md

@@ -307,7 +307,7 @@ Renovate will get the credentials with the [`google-auth-library`](https://www.n
     service_account: ${{ env.SERVICE_ACCOUNT }}
 
 - name: renovate
-  uses: renovatebot/[email protected].4
+  uses: renovatebot/[email protected].5
   env:
     RENOVATE_HOST_RULES: |
       [
@@ -478,7 +478,7 @@ Make sure to install the Google Cloud SDK into the custom image, as you need the
 For example:
 
 ```Dockerfile
-FROM renovate/renovate:38.132.3
+FROM renovate/renovate:38.142.5
 # Include the "Docker tip" which you can find here https://cloud.google.com/sdk/docs/install
 # under "Installation" for "Debian/Ubuntu"
 RUN ...

docs/usage/examples/self-hosting.md

@@ -25,8 +25,8 @@ It builds `latest` based on the `main` branch and all SemVer tags are published
 ```sh title="Example of valid tags"
 docker run --rm renovate/renovate
 docker run --rm renovate/renovate:38
-docker run --rm renovate/renovate:38.132
-docker run --rm renovate/renovate:38.132.3
+docker run --rm renovate/renovate:38.142
+docker run --rm renovate/renovate:38.142.5
 ```
 
 <!-- prettier-ignore -->
@@ -62,7 +62,7 @@ spec:
             - name: renovate
               # Update this to the latest available and then enable Renovate on
               # the manifest
-              image: renovate/renovate:38.132.3
+              image: renovate/renovate:38.142.5
               args:
                 - user/repo
               # Environment Variables
@@ -121,7 +121,7 @@ spec:
       template:
         spec:
           containers:
-            - image: renovate/renovate:38.132.3
+            - image: renovate/renovate:38.142.5
               name: renovate-bot
               env: # For illustration purposes, please use secrets.
                 - name: RENOVATE_PLATFORM
@@ -367,7 +367,7 @@ spec:
           containers:
             - name: renovate
               # Update this to the latest available and then enable Renovate on the manifest
-              image: renovate/renovate:38.132.3
+              image: renovate/renovate:38.142.5
               volumeMounts:
                 - name: ssh-key-volume
                   readOnly: true
@@ -436,7 +436,7 @@ COPY self-signed-certificate.crt /usr/local/share/ca-certificates/
 RUN update-ca-certificates
 
 # Change back to the Ubuntu user
-USER 1000
+USER 12021
 
 # OpenSSL
 ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt

docs/usage/self-hosted-configuration.md

@@ -1243,12 +1243,9 @@ Otherwise, it will default to `RenovateBot/${renovateVersion} (https://github.co
 
 ## username
 
-You may need to set a `username` if you:
-
-- use the Bitbucket platform, or
-- use a self-hosted GitHub App with CLI (required)
-
-If you're using a Personal Access Token (PAT) to authenticate then you should not set a `username`.
+The only time where `username` is required is if using `username` + `password` credentials for the `bitbucket` platform.
+You don't need to configure `username` directly if you have already configured `token`.
+Renovate will use the token to discover its username on the platform, including if you're running Renovate as a GitHub App.
 
 ## writeDiscoveredRepos
 

lib/config/options/index.ts

@@ -515,7 +515,7 @@ const options: RenovateOptions[] = [
     description:
       'Change this value to override the default Renovate sidecar image.',
     type: 'string',
-    default: 'ghcr.io/containerbase/sidecar:11.11.41',
+    default: 'ghcr.io/containerbase/sidecar:13.0.6',
     globalOnly: true,
   },
   {
@@ -2650,13 +2650,13 @@ const options: RenovateOptions[] = [
       Pending: '{{{displayPending}}}',
       References: '{{{references}}}',
       'Package file': '{{{packageFile}}}',
-      Age: "{{#if newVersion}}[![age](https://developer.mend.io/api/mc/badges/age/{{datasource}}/{{replace '/' '%2f' depName}}/{{{newVersion}}}?slim=true)](https://docs.renovatebot.com/merge-confidence/){{/if}}",
+      Age: "{{#if newVersion}}[![age](https://developer.mend.io/api/mc/badges/age/{{datasource}}/{{replace '/' '%2f' packageName}}/{{{newVersion}}}?slim=true)](https://docs.renovatebot.com/merge-confidence/){{/if}}",
       Adoption:
-        "{{#if newVersion}}[![adoption](https://developer.mend.io/api/mc/badges/adoption/{{datasource}}/{{replace '/' '%2f' depName}}/{{{newVersion}}}?slim=true)](https://docs.renovatebot.com/merge-confidence/){{/if}}",
+        "{{#if newVersion}}[![adoption](https://developer.mend.io/api/mc/badges/adoption/{{datasource}}/{{replace '/' '%2f' packageName}}/{{{newVersion}}}?slim=true)](https://docs.renovatebot.com/merge-confidence/){{/if}}",
       Passing:
-        "{{#if newVersion}}[![passing](https://developer.mend.io/api/mc/badges/compatibility/{{datasource}}/{{replace '/' '%2f' depName}}/{{{currentVersion}}}/{{{newVersion}}}?slim=true)](https://docs.renovatebot.com/merge-confidence/){{/if}}",
+        "{{#if newVersion}}[![passing](https://developer.mend.io/api/mc/badges/compatibility/{{datasource}}/{{replace '/' '%2f' packageName}}/{{{currentVersion}}}/{{{newVersion}}}?slim=true)](https://docs.renovatebot.com/merge-confidence/){{/if}}",
       Confidence:
-        "{{#if newVersion}}[![confidence](https://developer.mend.io/api/mc/badges/confidence/{{datasource}}/{{replace '/' '%2f' depName}}/{{{currentVersion}}}/{{{newVersion}}}?slim=true)](https://docs.renovatebot.com/merge-confidence/){{/if}}",
+        "{{#if newVersion}}[![confidence](https://developer.mend.io/api/mc/badges/confidence/{{datasource}}/{{replace '/' '%2f' packageName}}/{{{currentVersion}}}/{{{newVersion}}}?slim=true)](https://docs.renovatebot.com/merge-confidence/){{/if}}",
     },
   },
   {

lib/data/monorepo.json

@@ -378,6 +378,7 @@
     "mutation-testing-elements": "https://github.com/stryker-mutator/mutation-testing-elements",
     "nest": [
       "https://github.com/nestjs/nest",
+      "https://github.com/nestjs/nest-cli",
       "https://github.com/nestjs/passport",
       "https://github.com/nestjs/schematics",
       "https://github.com/nestjs/terminus"

lib/modules/datasource/docker/schema.ts

@@ -68,6 +68,7 @@ export const OciImageManifest = ManifestObject.extend({
       'application/vnd.oci.image.config.v1+json',
       'application/vnd.cncf.helm.config.v1+json',
       'application/vnd.devcontainers',
+      'application/vnd.oci.empty.v1+json',
     ]),
   }),
   annotations: z.record(z.string()).nullish(),

lib/modules/datasource/go/releases-goproxy.spec.ts

@@ -557,6 +557,43 @@ describe('modules/datasource/go/releases-goproxy', () => {
       });
     });
 
+    it('handles baseURL with slash at the end', async () => {
+      process.env.GOPROXY = `${baseUrl}/`;
+
+      httpMock
+        .scope(`${baseUrl}/gopkg.in/foo`)
+        .get('.v0/@v/list')
+        .reply(200, ['v0.1.0', 'v0.2.0', '  \n'].join('\n'))
+        .get('.v0/@v/v0.1.0.info')
+        .reply(200, { Version: 'v0.1.0', Time: '2017-01-01T00:00:00Z' })
+        .get('.v0/@v/v0.2.0.info')
+        .reply(200, { Version: 'v0.2.0', Time: '2017-02-01T00:00:00Z' })
+        .get('.v0/@latest')
+        .reply(200, { Version: 'v0.2.0' })
+        .get('.v1/@v/list')
+        .reply(200, ['v1.0.0', '\n'].join('\n'))
+        .get('.v1/@v/v1.0.0.info')
+        .reply(200, { Version: 'v1.0.0', Time: '2018-01-01T00:00:00Z' })
+        .get('.v1/@latest')
+        .reply(200, { Version: 'v1.0.0' })
+        .get('.v2/@v/list')
+        .reply(404);
+
+      const res = await datasource.getReleases({
+        packageName: 'gopkg.in/foo.v0',
+      });
+
+      expect(res).toEqual({
+        releases: [
+          { releaseTimestamp: '2017-01-01T00:00:00Z', version: 'v0.1.0' },
+          { releaseTimestamp: '2017-02-01T00:00:00Z', version: 'v0.2.0' },
+          { releaseTimestamp: '2018-01-01T00:00:00Z', version: 'v1.0.0' },
+        ],
+        sourceUrl: 'https://github.com/go-foo/foo',
+        tags: { latest: 'v1.0.0' },
+      });
+    });
+
     it('continues if package returns no releases', async () => {
       process.env.GOPROXY = baseUrl;
 

lib/modules/datasource/go/releases-goproxy.ts

@@ -7,6 +7,7 @@ import { filterMap } from '../../../util/filter-map';
 import { HttpError } from '../../../util/http';
 import * as p from '../../../util/promises';
 import { newlineRegex, regEx } from '../../../util/regex';
+import { joinUrlParts } from '../../../util/url';
 import goVersioning from '../../versioning/go-mod-directive';
 import { Datasource } from '../datasource';
 import type { GetReleasesConfig, Release, ReleaseResult } from '../types';
@@ -129,7 +130,12 @@ export class GoProxyDatasource extends Datasource {
   }
 
   async listVersions(baseUrl: string, packageName: string): Promise<Release[]> {
-    const url = `${baseUrl}/${this.encodeCase(packageName)}/@v/list`;
+    const url = joinUrlParts(
+      baseUrl,
+      this.encodeCase(packageName),
+      '@v',
+      'list',
+    );
     const { body } = await this.http.get(url);
     return filterMap(body.split(newlineRegex), (str) => {
       if (!is.nonEmptyStringAndNotWhitespace(str)) {
@@ -152,7 +158,12 @@ export class GoProxyDatasource extends Datasource {
     packageName: string,
     version: string,
   ): Promise<Release> {
-    const url = `${baseUrl}/${this.encodeCase(packageName)}/@v/${version}.info`;
+    const url = joinUrlParts(
+      baseUrl,
+      this.encodeCase(packageName),
+      '@v',
+      `${version}.info`,
+    );
     const res = await this.http.getJson<VersionInfo>(url);
 
     const result: Release = {
@@ -171,7 +182,11 @@ export class GoProxyDatasource extends Datasource {
     packageName: string,
   ): Promise<string | null> {
     try {
-      const url = `${baseUrl}/${this.encodeCase(packageName)}/@latest`;
+      const url = joinUrlParts(
+        baseUrl,
+        this.encodeCase(packageName),
+        '@latest',
+      );
       const res = await this.http.getJson<VersionInfo>(url);
       return res.body.Version;
     } catch (err) {