Merge branch 'main' into feat/disable-cloud-metadata-services

.devcontainer/Dockerfile

@@ -1 +1 @@
-FROM ghcr.io/containerbase/devcontainer:9.30.9
+FROM ghcr.io/containerbase/devcontainer:9.31.4

.github/actions/calculate-prefetch-matrix/action.yml

@@ -34,7 +34,7 @@ runs:
 
     - name: Check cache miss for MacOS
       id: macos-cache
-      uses: actions/cache/restore@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+      uses: actions/cache/restore@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
       with:
         path: node_modules
         key: ${{ env.MACOS_KEY }}
@@ -43,7 +43,7 @@ runs:
 
     - name: Check cache miss for Windows
       id: windows-cache
-      uses: actions/cache/restore@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+      uses: actions/cache/restore@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
       with:
         path: node_modules
         key: ${{ env.WINDOWS_KEY }}

.github/actions/setup-node/action.yml

@@ -34,7 +34,7 @@ runs:
 
     - name: Restore `node_modules`
       id: node-modules-restore
-      uses: actions/cache/restore@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+      uses: actions/cache/restore@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
       with:
         path: node_modules
         key: ${{ env.CACHE_KEY }}
@@ -67,7 +67,7 @@ runs:
 
     - name: Write `node_modules` cache
       if: inputs.save-cache == 'true' && env.CACHE_HIT != 'true'
-      uses: actions/cache/save@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+      uses: actions/cache/save@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
       with:
         path: node_modules
         key: ${{ env.CACHE_KEY }}

.github/workflows/build.yml

@@ -181,7 +181,7 @@ jobs:
           os: ${{ runner.os }}
 
       - name: Restore eslint cache
-        uses: actions/cache/restore@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        uses: actions/cache/restore@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
         with:
           path: .cache/eslint
           key: eslint-main-cache
@@ -200,7 +200,7 @@ jobs:
 
       - name: Save eslint cache
         if: github.event_name == 'push'
-        uses: actions/cache/save@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        uses: actions/cache/save@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
         with:
           path: .cache/eslint
           key: eslint-main-cache
@@ -224,7 +224,7 @@ jobs:
           os: ${{ runner.os }}
 
       - name: Restore prettier cache
-        uses: actions/cache/restore@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        uses: actions/cache/restore@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
         with:
           path: .cache/prettier
           key: prettier-main-cache
@@ -243,7 +243,7 @@ jobs:
 
       - name: Save prettier cache
         if: github.event_name == 'push'
-        uses: actions/cache/save@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        uses: actions/cache/save@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
         with:
           path: .cache/prettier
           key: prettier-main-cache
@@ -328,7 +328,7 @@ jobs:
           os: ${{ runner.os }}
 
       - name: Cache jest
-        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
         with:
           path: .cache/jest
           key: |

.github/workflows/codeql-analysis.yml

@@ -39,7 +39,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@03e7845b7bfcd5e7fb63d1ae8c61b0e791134fab # v2.22.11
+        uses: github/codeql-action/init@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3.23.0
         with:
           languages: javascript
 
@@ -49,7 +49,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@03e7845b7bfcd5e7fb63d1ae8c61b0e791134fab # v2.22.11
+        uses: github/codeql-action/autobuild@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3.23.0
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -63,4 +63,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@03e7845b7bfcd5e7fb63d1ae8c61b0e791134fab # v2.22.11
+        uses: github/codeql-action/analyze@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3.23.0

.github/workflows/dependency-review.yml

@@ -12,4 +12,4 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@01bc87099ba56df1e897b6874784491ea6309bc4 # v3.1.4
+        uses: actions/dependency-review-action@c74b580d73376b7750d3d2a50bfb8adc2c937507 # v3.1.5

.github/workflows/scorecard.yml

@@ -50,6 +50,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: 'Upload to code-scanning'
-        uses: github/codeql-action/upload-sarif@305f6546310b9203e892c28c1484e82977f4f63d # v2.22.10
+        uses: github/codeql-action/upload-sarif@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3.23.0
         with:
           sarif_file: results.sarif

docs/development/style-guide.md

@@ -21,6 +21,24 @@ Second sentence on a new line.
 And so on.
 ```
 
+## Avoid manually ordering numbered lists
+
+Avoid:
+
+```markdown
+1. First item
+2. Second item
+3. Third item
+```
+
+Do:
+
+```markdown
+1. First item
+1. Second item
+1. Third item
+```
+
 ## Avoid punctuation at the end of list items
 
 In Markdown files, avoid punctuation at the end of a list item.

docs/usage/.pages

@@ -4,8 +4,8 @@ nav:
   - ... | getting-started
   - Troubleshooting: 'troubleshooting.md'
   - Configuration:
-      - 'Self-hosted': 'self-hosted-configuration.md'
       - 'Repository': 'configuration-options.md'
+      - 'Self-hosted': 'self-hosted-configuration.md'
       - 'Presets': 'config-presets.md'
       - 'Validation': 'config-validation.md'
   - ... | key-concepts

docs/usage/configuration-options.md

@@ -410,10 +410,21 @@ This is an advance field and it's recommend you seek a config review before appl
 
 ## bumpVersion
 
-Currently this setting supports `helmv3`, `npm`, `nuget`, `maven`, `pep621` and `sbt` only, so raise a feature request if you have a use for it with other package managers.
-Currently this setting supports `helmv3`, `npm`, `nuget`, `maven`, `pep621`, `poetry` and `sbt` only, so raise a feature request if you have a use for it with other package managers.
-Its purpose is if you want Renovate to update the `version` field within your package file any time it updates dependencies within.
-Usually this is for automatic release purposes, so that you don't need to add another step after Renovate before you can release a new version.
+Currently, this config option only works with these managers:
+
+- `helmv3`
+- `npm`
+- `nuget`
+- `maven`
+- `ocb`
+- `pep621`
+- `poetry`
+- `sbt`
+
+Raise a feature request if you want to use this config option with other package managers.
+
+Use `bumpVersion` if you want Renovate to update the `version` field in your package file when it updates the dependencies in that file.
+This can be handy when you have automated your package's release, as you you don't need extra steps after the Renovate upgrade, you can just release a new version.
 
 Configure this value to `"prerelease"`, `"patch"`, `"minor"` or `"major"` to have Renovate update the version in your edited package file.
 e.g. if you wish Renovate to always increase the target `package.json` version with a patch update, configure this to `"patch"`.

docs/usage/configuration-templates.md

@@ -32,7 +32,7 @@ Be careful, and consider creating a new "config help" post at the [discussions t
 Renovate uses one commit per branch.
 The `commitMessage` reflects the contents of the branch and is usually the same as the PR title.
 
-`commitMessage` has a default value of `{{commitMessagePrefix}} {{commitMessageAction}} {{commitMessageTopic}} {{commitMessageExtra}} {{commitMessageSuffix}}`, with the intention that you only edit some of those subcomponents.
+`commitMessage` has a default value of `{{{commitMessagePrefix}}} {{{commitMessageAction}}} {{{commitMessageTopic}}} {{{commitMessageExtra}}} {{{commitMessageSuffix}}}`, with the intention that you only edit some of those subcomponents.
 
 You usually don't need to edit `commitMessagePrefix`, this option is used by Renovate if it needs to add a prefix to conform to the Semantic Commit convention.
 Avoid editing the commit message, unless you know what you're doing.

docs/usage/docker.md

@@ -383,7 +383,7 @@ To get access to the token a custom Renovate Docker image is needed that include
 The Dockerfile to create such an image can look like this:
 
 ```Dockerfile
-FROM renovate/renovate:37.102.0
+FROM renovate/renovate:37.126.2
 # Include the "Docker tip" which you can find here https://cloud.google.com/sdk/docs/install
 # under "Installation" for "Debian/Ubuntu"
 RUN ...

docs/usage/merge-confidence.md

@@ -29,6 +29,7 @@ Renovate will show Merge Confidence badges for these languages:
 
 | Language   | Datasource  |
 | ---------- | ----------- |
+| Golang     | `go`        |
 | JavaScript | `npm`       |
 | Java       | `maven`     |
 | Python     | `pypi`      |

docs/usage/self-hosted-configuration.md

@@ -5,7 +5,11 @@ description: Self-Hosted configuration usable in config file, CLI or environment
 
 # Self-Hosted configuration options
 
-You can only use these configuration options when you're self-hosting Renovate.
+Only use these configuration options when you _self-host_ Renovate.
+
+Do _not_ put the self-hosted config options listed on this page in your "repository config" file (`renovate.json` for example), because Renovate will ignore those config options, and may also create a config error issue.
+
+The config options below _must_ be configured in the bot/admin config, so in either a environment variable, CLI option, or a special file like `config.js`.
 
 Please also see [Self-Hosted Experimental Options](./self-hosted-experimental.md).
 
@@ -771,6 +775,11 @@ Used as an alternative to `privateKeyOld`, if you want the key to be read from d
 
 Override this object if you want to change the URLs that Renovate links to, e.g. if you have an internal forum for asking for help.
 
+## redisPrefix
+
+If this value is set then Renovate will prepend this string to the name of all Redis cache entries used in Renovate.
+It's only used if `redisUrl` is configured.
+
 ## redisUrl
 
 If this value is set then Renovate will use Redis for its global cache instead of the local file system.

docs/usage/self-hosted-experimental.md

@@ -96,7 +96,7 @@ If set, Renovate will terminate the whole process group of a terminated child pr
 ## `RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS`
 
 If set to an positive integer, Renovate will use this as the number of attempts to check if a merge request on GitLab is mergable before trying to automerge.
-The formula for the delay between attempts is `250 * attempt * attempt` milliseconds.
+The formula for the delay between attempts is `RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY * attempt * attempt` milliseconds.
 
 Default value: `5` (attempts results in max. 13.75 seconds timeout).
 
@@ -108,6 +108,12 @@ Can be useful for slow-running, self-hosted GitLab instances that don't react fa
 
 Default value: `1000` (milliseconds).
 
+## `RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY`
+
+If set, Renovate will use this as a delay to proceed with an automerge.
+
+Default value: `250` (milliseconds).
+
 ## `RENOVATE_X_HARD_EXIT`
 
 If set to any value, Renovate will use a "hard" `process.exit()` once all work is done, even if a sub-process is otherwise delaying Node.js from exiting.
@@ -126,6 +132,11 @@ Skip initializing `RE2` for regular expressions and instead use Node-native `Reg
 If set, Renovate will query this API for Merge Confidence data.
 This feature is in private beta.
 
+## `RENOVATE_X_MERGE_CONFIDENCE_SUPPORTED_DATASOURCES`
+
+If set, Renovate will query the merge-confidence JSON API only for datasources that are part of this list.
+The expected value for this environment variable is a JSON array of strings.
+
 ## `RENOVATE_X_PLATFORM_VERSION`
 
 If set, Renovate will use this string as GitLab server version instead of checking via the GitLab API.

lib/config/options/index.ts

@@ -342,6 +342,13 @@ const options: RenovateOptions[] = [
     type: 'string',
     globalOnly: true,
   },
+  {
+    name: 'redisPrefix',
+    description: 'Key prefix for redis cache entries.',
+    stage: 'global',
+    type: 'string',
+    globalOnly: true,
+  },
   {
     name: 'baseDir',
     description:
@@ -401,7 +408,7 @@ const options: RenovateOptions[] = [
     description:
       'Change this value to override the default Renovate sidecar image.',
     type: 'string',
-    default: 'ghcr.io/containerbase/sidecar:9.30.9',
+    default: 'ghcr.io/containerbase/sidecar:9.31.4',
     globalOnly: true,
   },
   {
@@ -1050,7 +1057,7 @@ const options: RenovateOptions[] = [
     description: 'Set to `true` to automatically approve PRs.',
     type: 'boolean',
     default: false,
-    supportedPlatforms: ['azure', 'gitlab'],
+    supportedPlatforms: ['azure', 'gerrit', 'gitlab'],
   },
   // depType
   {
@@ -1836,7 +1843,7 @@ const options: RenovateOptions[] = [
     type: 'string',
     allowedValues: ['auto', 'fast-forward', 'merge-commit', 'rebase', 'squash'],
     default: 'auto',
-    supportedPlatforms: ['bitbucket', 'gitea'],
+    supportedPlatforms: ['azure', 'bitbucket', 'gitea'],
   },
   {
     name: 'automergeComment',

lib/config/presets/internal/group.ts

@@ -318,7 +318,7 @@ const staticGroups = {
       {
         groupName: 'PHPStan packages',
         matchDatasources: ['packagist'],
-        matchPackagePatterns: ['^phpstan/phpstan$', '/phpstan-'],
+        matchPackagePatterns: ['^phpstan/phpstan$', '/phpstan-', '/larastan'],
       },
     ],
   },

lib/config/presets/internal/helpers.ts

@@ -30,4 +30,15 @@ export const presets: Record<string, Preset> = {
       },
     ],
   },
+  pinGitHubActionDigestsToSemver: {
+    description: 'Convert pinned GitHub Action digests to SemVer.',
+    packageRules: [
+      {
+        extends: ['helpers:pinGitHubActionDigests'],
+        extractVersion: '^(?<version>v\\d+\\.\\d+\\.\\d+)$',
+        versioning:
+          'regex:^v(?<major>\\d+)(\\.(?<minor>\\d+)\\.(?<patch>\\d+))?$',
+      },
+    ],
+  },
 };

lib/config/presets/internal/merge-confidence.ts

@@ -1,19 +1,21 @@
 import type { Preset } from '../types';
 
+export const supportedDatasources = [
+  'go',
+  'maven',
+  'npm',
+  'nuget',
+  'packagist',
+  'pypi',
+  'rubygems',
+];
+
 export const presets: Record<string, Preset> = {
   'all-badges': {
     description: 'Show all Merge Confidence badges for pull requests.',
     packageRules: [
       {
-        matchDatasources: [
-          'maven',
-          'npm',
-          'nuget',
-          'packagist',
-          'pypi',
-          'rubygems',
-          'go',
-        ],
+        matchDatasources: supportedDatasources,
         matchUpdateTypes: ['patch', 'minor', 'major'],
         prBodyColumns: [
           'Package',
@@ -31,15 +33,7 @@ export const presets: Record<string, Preset> = {
       'Show only the Age and Confidence Merge Confidence badges for pull requests.',
     packageRules: [
       {
-        matchDatasources: [
-          'maven',
-          'npm',
-          'nuget',
-          'packagist',
-          'pypi',
-          'rubygems',
-          'go',
-        ],
+        matchDatasources: supportedDatasources,
         matchUpdateTypes: ['patch', 'minor', 'major'],
         prBodyColumns: ['Package', 'Change', 'Age', 'Confidence'],
       },