🏗️🔧：update dprint plugins & track pins renovate cannot see - #1777
Merged
Conversation
The dockerfile plugin has been pinned at 0.3.0 since 2022 and cannot parse a digest on a FROM line -- it stops at the `@` and reports `expected EOI`. That is what fails #1268, which pins the dev container base image, and it would fail any future attempt to pin an image digest here. The toml plugin was a year and a half behind for the same reason: nothing was watching either of them. 0.4.1 parses the digest form. Neither bump reformats a single file, so this is a newer parser and nothing else. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Every dependency installed through npm is already covered, and github action digests are pinned by the best-practices preset. A version written into a URL or a shell variable is invisible to renovate unless it is told about it, which is how the dprint dockerfile plugin sat untouched from 2022 until it broke. Two custom managers. The first reads the version out of the dprint plugin URLs and maps it to the matching dprint/dprint-plugin-* repository. The second reads `# renovate:` annotations, which are now on the fisher and nvm.fish pins in the dev container script -- the same class of pin, added recently enough to fix before it rots. Verified by running both matchStrings against the real files: they capture toml 0.7.0, dockerfile 0.4.1, fisher 4.4.8 and nvm.fish 2.2.17, all four depNames resolve to real repositories, and each captured version already equals that repository's latest release, so this opens nothing today. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
✅ Deploy Preview for gh-pages-openinf ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
OpenINFbot
approved these changes
Aug 8, 2026
OpenINFbot
changed the title
DerekNonGeneric
added a commit
that referenced
this pull request
Aug 9, 2026
PR URL: #1777 Reviewed-by: @OpenINFbot ------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🏗️🔧 #1268 is red, and the reason is not the pin it proposes.
That PR has been open since 2024-05-27, but renovate has rebased it: it no
longer touches the old base image, it now pins the Dockerfile added in
#1775. The pin itself is fine. What fails is
Verify Dockerfile:Column 65 is where
@sha256:begins. dprint's dockerfile plugin cannotparse a digest. Both forms fail -- with the tag and without it.
The plugin is pinned at 0.3.0, released 2022-08-27. Four releases have
shipped since. The toml plugin is in the same state, a year and a half
behind at 0.6.1.
They rotted because nothing watches them. Every npm dependency here is
pinned and updated religiously, and github action digests are handled by
the best-practices preset, but a version living inside a URL is invisible
to renovate unless it is told.
Two commits
Update the plugins to toml 0.7.0 and dockerfile 0.4.1. Verified: the
digest form parses, the current unpinned Dockerfile still parses, and
neither bump reformats a single file. That unblocks #1268 -- renovate
should rebase it green.
Add custom managers so this class of pin is tracked from now on. One
reads the version out of the dprint plugin URLs and maps it to the matching
dprint/dprint-plugin-*repository. The other reads# renovate:annotations, now added to the fisher and nvm.fish pins in the dev container
script -- the same kind of pin, caught early rather than in four years.
Both matchStrings were run against the real files: they capture toml
0.7.0, dockerfile 0.4.1, fisher 4.4.8 and nvm.fish 2.2.17. All four
depNames resolve to real repositories, and every captured version already
equals that repository's latest release, so merging this opens no PRs
today -- only future ones.
Worth deciding separately
Digest-pinning the dev container base is consistent with how everything
else here is pinned, but it does mean a renovate PR every time Microsoft
rebuilds that image, which for a
-trixietag is frequent. Reasonableeither way; this PR only removes the reason it currently cannot merge.