Mend Remediate Package Managers Release Notes

Overview

This page describes package manager updates for Mend Renovate and Mend Remediate.

These tools' release schedules and version numbers differ from those of other Mend products.

Click here to access all release notes for Mend’s products

Version 23.11.1

The Mend Renovate OSS was updated from 37.33.1 to 37.52.0.

New feature highlights:

Added support for Kotlin import directives in Gradle

Added ziphash fetching for Terraform lock refreshes

Added support for https options and platform in host rules from env

Made custom datasources mergeable

Added support for Java Semeru and Semeru JRE in ASDF

Added support for GitHub CLI in ASDF

Optimized npm dedupe option

Added support for ASDF plugin manager, SBT and Vault

NOTE: A full list of features can be found on Octoclairvoyant.

Version 23.10.2

The Mend Renovate OSS was updated from 36.100.0 to 37.33.1.

New feature highlights:

Added support for extracting buildkite plugins from Bitbucket Cloud

Added support for private crates for Cargo

Always uses 'source' for Terraform modules

Used maintenance fork of npm-run-all

Mapped PHP linters in default linters group

Ignored scripts for pnpm dedupe

Added automatic ghcr.io auth when using GitHub.com

Added support for services key in Woodpecker

Added Maven support for Artifact Registry via Google ADC

Sorted Nuget API response

NOTE: A full list of features can be found on Octoclairvoyant.

Version 23.9.2

The Mend Renovate OSS was updated from 36.97.1 to 36.100.0.

New feature highlights:

Added Bazel rule recognition that begins with an underscore
Added security group and OpenSSF badge preset
Added mavenPropertyVersions regexManager

NOTE: A full list of features can be found on Octoclairvoyant.

Version 23.9.1

The Mend Renovate OSS was updated from 36.68.0 to 36.97.1.

New feature highlights:

Added support for AWS machine images data source
Added support for Gitea package releases
Allowed versions without quotes in Ansible Galaxy yaml files
Added support for Woodpecker configuration format
Added support for Steampipe package manager
Increased maximum DockerHub package list
Added releaseTimestamp support for DockerHub tags
Added support for Gitea changelogs
Improved Docker data source to support annotations and schemas
Added support for digests from DockerHub

NOTE: A full list of features can be found on Octoclairvoyant.

Version 23.8.2

The Mend Renovate OSS was updated from 36.23.0 to 36.68.0.

New feature highlights:

Added new presets for scaffdog monorepo, Pulumi group, testcontainers-node monorepo, unocss monorepo
Improved support for GitHub Actions including auto detecting registry URLs and GitHub Actions runners
Enhanced Docker datasource to enable cache fallback and allow overriding max pages
Added schema validation and parsing for various formats like JSON, TOML, Zod
Extended Result class with methods like wrapNullable, unwrapOrNull, onValue, onError
Improved support for custom managers including customType field and custom.<customMgrName> syntax
Added gitea-tags datasource and allowed overriding package cache TTL
Added support for Nuget VersionPrefix bumping, Composer patch suffixes, and Gradle verification metadata updates

NOTE: A full list of features can be found on Octoclairvoyant.

Version 23.7.1

The Mend Renovate OSS was updated from 35.126.0 to 36.23.0.

New feature highlights:

postUpgradeTasks.fileFilters is now optional and defaults to all files
languages are now called categories instead. Use matchCategories in packageRules
Node v19 is no longer supported
datasource: semver-coerced is now the default versioning
presets: Preset config:base is now called config:recommended (will be migrated automatically)
remove BUILDPACK env support
package-rules: matchPackageNames now matches both depName (existing) and packageName (new) and warns if only depName matches
release-notes: Release notes won't be fetched early for commitBody insertion unless explicitly configured with fetchReleaseNotes=branch
dockerImagePrefix is now replaced by dockerSidecarImage
matchPaths and matchFiles are now combined into matchFileNames, supporting exact match and glob-only. The "any string match" functionality of matchPaths is now removed
presets: v25 compatibility for language-based branch prefixes is removed
npm: Rollback PRs will no longer be enabled by default for npm (they are now disabled by default for all managers)
post-upgrade-tasks: dot files will now be included by default for all minimatch results
platform/gitlab: GitLab gitAuthor will change from the account's "email" to "commit_email" if they are different.
automerge: Platform automerge will now be chosen by default whenever automerge is enabled.
Post upgrade templating is now allowed by default, as long as the post upgrade task command is itself already allowed.
Official Renovate Docker images now use the "slim" approach with binarySource=install by default. e.g. renovate/renovate:latest is the slim image, not full
The "full" image is now available via the tag full, e.g. renovate/renovate:36-full, and defaults to binarySource=global (no dynamic installs)
Third party tools in the full image have been updated to latest/LTS major version

NOTE: A full list of features can be found on Octoclairvoyant.

Version 23.6.2

The Mend Renovate OSS was updated from 35.104.0 to 35.126.0.

New feature highlights:

Added timed presets to give Renovate more time to create branches
Added XState monorepo preset
Added endoflife.date datasource
Added support for Java Temurin and Temurin JRE to ASDF manager
Added support for git_override in Bazel module manager
Added support for archive_override and local_path_override in Bazel module manager
Added support for constraints and Erlang v26 to Mix manager
Added support for parsing lockfileVersion=3 to NPM manager
Added incremental sync for version lists to Rubygems manager

NOTE: A full list of features can be found on Octoclairvoyant.

Version 23.5.2

The Mend Renovate OSS was updated from 35.56.0 to 35.104.0.

New feature highlights:

Added Poetry support to the ASDF manager
Added Bazel datasource
Added AzureAD/microsoft-identity-web to monorepos preset
Added branch caching for onboarding
Added support for pnpm lock files
Added Flux manager support for OCI Helm repositories
Added properties map support for Gradle kts
Added ECSpresso to ASDF manager
Added support for registry aliases in Terraform manager
Added YAMLfmt to ASDF manager

NOTE: A full list of features can be found on Octoclairvoyant.

Version 23.4.2

The Mend Renovate OSS was updated from 35.23.3 to 35.56.0.

New feature highlights:

Support for registry proxy for Docker digest updates
Consolidation of replacement rules
Support for Docker image object in Bitbucket Pipelines
Support for rules_oci/oci_pull for Bazel
Support for years, months, weeks in pretty-time utility
Use of cache to check if repo is onboarded
Addition of JSON parsing functions
Detection of kustomization.yaml for Helmfile
Support for depth argument in Terraform modules
Deprecation of npm-based presets

NOTE: A full list of features can be found on Octoclairvoyant.

Version 23.3.2

The Mend Renovate OSS was updated from 35.17.0 to 35.23.3.

New feature highlights:

Better defaults for Codespaces configuration
config: multi-org secrets decrypt
presets:
- added containerbase workarounds
- added more containerbase replacements

NOTE: A full list of features can be found on Octoclairvoyant.

Version 23.3.1

The Mend Renovate OSS was updated from 34.100.1 to 35.17.0.

New feature highlights:

Node v18.12+ is the required runtime for Renovate.
config:
- Forked repos will now be processed automatically if autodiscover=false. includeForks is removed and replaced by new option forkProcessing.
- containerbase/ account used for sidecar containers instead of renovate/
- Renovate now defaults to applying hourly and concurrent PR limits. To revert to unlimited, configure them back to 0.
- Renovate will now default to updating locked dependency versions. To revert to previous behavior, configure rangeStrategy=replace.
- PyPI releases will no longer be filtered by default based on constraints.python compatibility. To retain existing functionality, set constraintsFiltering=strict.
Internal checks such as renovate/stability-days will no longer count as passing/green, meaning that actions such as automerge won't occur if the only checks are Renovate internal ones. Set internalChecksAsSuccess=true to restore existing behavior.
versioning: default versioning is now semver-coerced, instead of semver.
datasource/github-releases: Regex Manager configurations relying on the github-release data-source with digests will have different digest semantics. The digest will now always correspond to the underlying Git SHA of the release/version. The old behavior can be preserved by switching to the github-release-attachments datasource.
go: Renovate will now use go's default GOPROXY settings. To avoid using the public proxy, configure GOPROXY=direct.
datasource/npm: Package cache will include entries for up to 24 hours after the last lookup. Set cacheHardTtlMinutes=0 to revert to existing behavior.
manager/composer: support git-tags hostRules for github.com when updating artifacts

NOTE: A full list of features can be found on Octoclairvoyant.

Version 23.1.2

The Mend Renovate OSS was updated from 34.100.0 to 34.100.1.

NOTE: A full list of features can be found on Octoclairvoyant.

Version 23.1.1

The Mend Renovate OSS was updated from 32.229.0 to 34.100.0.

New feature highlights:

Node 16 is the required runtime for Renovate.
config: internalChecksFilter default value is now "strict"
config: ignoreScripts default value is now true. If allowScripts=true in global config, ignoreScripts must be set to false in repo config if you want all repos to run scripts.
config: autodiscover filters can no longer include commas
config: boolean variables must be true or false when configured in environment variables, and errors will be thrown for invalid values. Previously invalided values were ignored and treated as false.
datasource/go: git-tags datasource will be used as the fallback instead of github-tags if a go package's host type is unknown.
jsonnet-bundler: depName now uses the "absolute import" format (e.g. bar → github.com/foo/bar/baz-wow)
azure-pipelines: azure-pipelines manager is now disabled by default.
github: No longer necessary to configure forkMode. The forking mode is now experimental.
Users of containerbase images (such as official Renovate images) will now have dynamic package manager installs enabled by default.
Dependencies are no longer automatically pinned if rangeStrategy=auto, pinning must be opted into using rangeStrategy=pin

NOTE: A full list of features can be found on Octoclairvoyant.

Version 22.9.1

The Mend Renovate OSS was updated from 32.105.0 to 32.229.0.

New feature highlights:

Renovate now logs when the PR was created and updated in the description of PR.
github: added support of unprefixed App Installation Token.
github: Added a log with warning when GitHub token is not configured
Added support for Hermit and Hermit package manager
Added support for librarian-puppet.
gradle: added support for further apply-from patterns.
manager/elixir: added support for install binary source.
Add support for Kotlin Script.

NOTE: A full list of features can be found on Octoclairvoyant.

Version 22.6.2

Mend Renovate

The Mend Renovate OSS was updated from 32.89.1 to 32.105.0.

New feature highlights:

bazelisk: added support for bazelisk bazelversion files.
go: added support for GOINSECURE.
gradle: added interpolation for local name variable in registry URL.
config: added a print of hostRules when printConfig=true.
clojure: added support dependencies in bb.edn.
gradle: added support for versions with underscores.
versioning/redhat: added support for Red Hat release versioning.

NOTE: A full list of features can be found on Octoclairvoyant.

Version 22.6.1

Mend Renovate

The Mend Renovate OSS was updated from 32.10.2 to 32.89.1.

New feature highlights:

yarn: added support to yarn metadata dependency version, it was ignored.
github: created cache data structure that can be used for any paginated data that have number and updated_at field.
nuget: dotnet restore applied to all the project files that are dependent on the project file being operated on. This regenerates lock files needed for multi-project builds to succeed.
presets: added mono repository Azure Active Directory IdentityModel Extensions for .NET to config presets.
migrations: added support of regular expression as property name for custom migrations.
clojure: Enhanced support for deps.edn files

NOTE: A full list of features can be found on Octoclairvoyant.

Package Managers

The following package manager default versions have been updated:

dotnet@3.1.420
composer@2.3.7
lerna@5.1.4
got@11.8.5
yarn@1.22.19
python@3.10.5
php@8.1.17
pnpm@7.2.1
npm@8.12.2
pipenv@2022.6.7
express@4.18.1

Version 22.5.2

Package Managers

The following package manager default versions have been updated:

gradle@7.4.2
php@8.1.6
pnpm@7.1.6
npm@8.11.0
node@16.15.1
helm@3.9.0
git@2.36.1
ruby@3.1.2
php@7.4.29
golang@1.18.3
elixir@1.13.4
pipenv@2022.5.2
python@3.10.4
rust@1.61.0
dotnet@3.1.419
composer@2.3.6

Version 22.3.2

Mend Renovate

The Mend Renovate OSS was updated from 31.28.2 to 32.10.2.

New feature highlights:

gradle: Option deepExtract is now removed and will be ignored
Support for cron syntax for schedules
pip_requirements: added support for packages from a git repository
node: added support for Node.js codenames
ubuntu: added support for Ubuntu codenames
config: read config from branches in baseBranches
npm: support for custom registryUrls

NOTE: A full list of features can be found on Octoclairvoyant.

Package Managers

The following package manager default versions have been updated:

poetry@1.1.13
gradle@6.9.2
composer@2.3.1
elixir@1.13.3
git@2.35.1
golang@1.18.0
dotnet@3.1.417
cocoapods@1.11.3
yarn@1.22.18
php@7.4.28
hashin@0.17.0
helm@3.8.1
npm@8.5.5
pnpm@6.32.3
ruby@3.1.1
rust@1.59.0
pipenv@2022
node@16.14.2

Version 22.2.2

Mend Renovate

The Mend Renovate OSS was updated from 29.18.0 to 31.28.2.

New feature highlights:

Support for Confidential issues in GitLab.
Terraform modules using bitbucket source URLs can be parsed as the bitbucket-tags datasource. This will enable the StabilityDays functionality.
Support for updates for buildkite plugins hosted on Github.
Support for plugin entries in the Gradle catalog using the short string-form syntax.
Ssupport for the composer platform package for constraint extraction.
Added sentry-dotnet monorepo.
Added ZXing.Net monorepo.
Support getDigest for GitLab repositories.
Added 'and', 'or' and 'containsString' to handlebar helpers
Added autodiscovery support for Github App

NOTE: A full list of features can be found on Octoclairvoyant.

Package Managers

The following package manager default versions have been updated:

node@16.13.1
npm@8.3.0
dotnet@3.1.416

Version 21.11.1

Mend Renovate

The Mend Renovate OSS was updated from 27.31.10 to 29.18.0.

New feature highlights:

Platform automerge is no longer enabled by default.
Go: modules lookups will now no longer fallback to Renovate native lookups if GOPROXY is configured and without "direct" explicitly configured.
Manager/regex: allow arbitrary regex groups for templates.
Config: hostRules are no longer automatically derived from env variables such as NPM_X_TOKEN.

NOTE: A full list of features can be found on Octoclairvoyant.

Package Managers

The following package manager default versions have been updated:

yarn@1.22.17
php@7.4.26
composer@2.1.12
golang@1.17.3
pipenv@2021.11.15
rust@1.56.1
pnp@6.22.2
dotnet@3.1.415
helm@3.7.1

Version 21.9.1.1

Mend Renovate

The Mend Renovate OSS was updated from 27.14.2 to 27.31.10.

New feature highlights:

Added option to write discovered repositories to a json.
Composer: added support for authentication for http-basic and bearer types.
Go modules: added support for in gitlab subgroups.
Docker: added support for authenticating at ECR with session tokens.
GitHub Actions: added support for composite actions.
Helm: added support for inline image definitions.

NOTE: A full list of features can be found on Octoclairvoyant.

Package Managers

The following package manager default versions have been updated:

node@14.18.1
yarn@1.22.15
gradle@6.9.1
elixir@1.12.3
php@7.4.24
composer@2.1.9
golang@1.17.2
python@3.9.7
poetry@1.1.11
rust@1.55.0
cocoapods@1.11.2
pnpm@6.16.1
dotnet@3.1.414
helm@3.7.0

Version 21.8.2

Mend Renovate

The Mend Renovate OSS was updated from 25.76.2 to 27.14.2.

Important or breaking changes:

git-submodules: Git Submodules cloning now needs to be explicitly enabled
yarn: It is no longer supported to configure a "yarnrc" override in Renovate config
gradle: Gradle extraction now defaults to JS-based parsing (previously "gradle-lite")
pre-commit manager is no longer enabled by default and must be opted into manually
Dependency Dashboard is now enabled by default in the config:base preset
Git: Blobless git cloning is now used, instead of shallow clone

Significant features:

go: GOPROXY support
rubygems: support GitHub Packages
docker: use HEAD requests as optimization
git: gitAuthor is repo-configurable
gradle: Add support for Gradle's TOML version Catalogs
helmv3: support helm chart dependencies in OCI images

Package Managers

Third-party package managers are unchanged.

Version 21.8.1

Mend Renovate

The Mend Renovate OSS was updated from 25.48.0 to 25.76.2. These changes mostly do not affect Remediate users, which use Remediate-only mode and have not enabled Renovate.

New feature highlights:

Added dependency dashboard label configuration
Added support for Terraform community providers during lock file generation.
The regex versioning now supports an optional build match group, which is handled as 4th version part.
Added an implementation of getDigest() for the github-releases datasource.
Supporting tag dependencies extraction for the GitLab and vanilla git

NOTE: A full list of features can be found on Octoclairvoyant

Package Managers

The following package manager default versions have been updated:

cocoapods@1.10.2
composer@2.1.6
dotnet@3.1.412
elixir@1.12.2
git@2.33.0
golang@1.17.0
helm@3.6.3
java@11.0.12
node@14.17.5
openjdk@16.0.2
php@7.4.22
pnpm@6.12.1
poetry@1.1.8
python@3.9.6
ruby@3.0.2
rust@1.54.0
yarn@1.22.11

Version 21.6.2

Mend Renovate

The Mend Renovate OSS was updated from 24.119.14 to 25.48.0. These changes mostly do not affect Remediate users, which use Remediate-only mode and have not enabled Renovate.

Important changes:

Remediate will no longer read ~/.npmrc from disk. npm credentials can be configured in multiple other ways described in Private Packages, including environment variables or a configuration file.
Major updates for Docker dependencies will now be enabled by default.
Grouping of Node.js packages into a single PR is no longer hardcoded. If you are not already using the config:base preset then you can add group:Nodejs to your extends instead.
Patch updates are not considered updateType=minor by default, so any rules you have for minor need to have patch added to them in order to take effect. It is no necessary to configure separateMinorPatch in order to apply patch rules.
trustLevel is no longer supported and instead broken into allowCustomCrateRegistries, allowScripts, and exposeAllEnv.

NOTE: A full list of changes can be found on Octoclairvoyant

Package Managers

The following package manager default versions have been updated:

git@2.32.2
node@14.17.1
elixir@1.12.1
php@7.4.20
composer@2.1.3
golang@1.16.5
python@3.9.5
pipenv@2021.5.29
rust@1.53.0
pnpm@6.8.0
dotnet@3.1.410
lerna@4.0.0
helm@3.6.1