From c2fc83de2d6b201abfffbddf1f802566b951037c Mon Sep 17 00:00:00 2001 From: Derek Lewis Date: Sat, 8 Aug 2026 15:14:02 +0000 Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=8F=97=EF=B8=8F=F0=9F=94=A7=EF=BC=9Au?= =?UTF-8?q?pdate=20the=20dprint=20plugins?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The dockerfile plugin has been pinned at 0.3.0 since 2022 and cannot parse a digest on a FROM line -- it stops at the `@` and reports `expected EOI`. That is what fails #1268, which pins the dev container base image, and it would fail any future attempt to pin an image digest here. The toml plugin was a year and a half behind for the same reason: nothing was watching either of them. 0.4.1 parses the digest form. Neither bump reformats a single file, so this is a newer parser and nothing else. Co-Authored-By: Claude Opus 5 --- dprint.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dprint.json b/dprint.json index b84f3baee..271081aca 100644 --- a/dprint.json +++ b/dprint.json @@ -3,7 +3,7 @@ "dockerfile": {}, "excludes": [], "plugins": [ - "https://plugins.dprint.dev/toml-0.6.1.wasm", - "https://plugins.dprint.dev/dockerfile-0.3.0.wasm" + "https://plugins.dprint.dev/toml-0.7.0.wasm", + "https://plugins.dprint.dev/dockerfile-0.4.1.wasm" ] } From 7f707c32b912be392cc0241c12589e52c16b8d04 Mon Sep 17 00:00:00 2001 From: Derek Lewis Date: Sat, 8 Aug 2026 15:14:03 +0000 Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=8F=97=EF=B8=8F=E2=9C=A8=EF=BC=9Alet?= =?UTF-8?q?=20renovate=20track=20the=20versions=20pinned=20outside=20npm?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every dependency installed through npm is already covered, and github action digests are pinned by the best-practices preset. A version written into a URL or a shell variable is invisible to renovate unless it is told about it, which is how the dprint dockerfile plugin sat untouched from 2022 until it broke. Two custom managers. The first reads the version out of the dprint plugin URLs and maps it to the matching dprint/dprint-plugin-* repository. The second reads `# renovate:` annotations, which are now on the fisher and nvm.fish pins in the dev container script -- the same class of pin, added recently enough to fix before it rots. Verified by running both matchStrings against the real files: they capture toml 0.7.0, dockerfile 0.4.1, fisher 4.4.8 and nvm.fish 2.2.17, all four depNames resolve to real repositories, and each captured version already equals that repository's latest release, so this opens nothing today. Co-Authored-By: Claude Opus 5 --- .devcontainer/post-create.sh | 6 ++++++ .renovaterc.json5 | 26 ++++++++++++++++++++++++++ 2 files changed, 32 insertions(+) diff --git a/.devcontainer/post-create.sh b/.devcontainer/post-create.sh index bb271de79..cc3412c05 100755 --- a/.devcontainer/post-create.sh +++ b/.devcontainer/post-create.sh @@ -23,7 +23,13 @@ set -euo pipefail +# These are pinned because the fisher bootstrap below is remote code being +# sourced, and a pin nothing watches is how a version ends up four years +# stale. The annotations let renovate track them; see customManagers in +# .renovaterc.json5. +# renovate: datasource=github-releases depName=jorgebucaran/fisher readonly FISHER_VERSION=4.4.8 +# renovate: datasource=github-releases depName=jorgebucaran/nvm.fish readonly NVM_FISH_VERSION=2.2.17 # .nvmrc is what nvm.fish reads; engines.node is what pnpm enforces. Both files diff --git a/.renovaterc.json5 b/.renovaterc.json5 index f39cbdfd4..018289d7a 100755 --- a/.renovaterc.json5 +++ b/.renovaterc.json5 @@ -25,6 +25,32 @@ semanticCommits: "enabled", commitMessageAction: "bump", commitMessageTopic: "{{depName}}", + // Nothing else watches these two files. Everything installed through npm is + // covered by the managers above, but a version pinned in a URL or a shell + // variable is invisible to renovate without being told -- which is how the + // dprint dockerfile plugin reached four years out of date and stopped being + // able to parse a digest-pinned FROM line. + customManagers: [ + { + customType: "regex", + description: "dprint plugins, pinned by URL in dprint.json", + managerFilePatterns: ["/^dprint\\.json$/"], + matchStrings: [ + "https://plugins\\.dprint\\.dev/(?[a-z-]+)-(?\\d+\\.\\d+\\.\\d+)\\.wasm", + ], + depNameTemplate: "dprint/dprint-plugin-{{{depName}}}", + datasourceTemplate: "github-releases", + }, + { + customType: "regex", + description: "fish tooling pinned in the dev container post-create script", + managerFilePatterns: ["/^\\.devcontainer/post-create\\.sh$/"], + matchStrings: [ + "# renovate: datasource=(?\\S+) depName=(?\\S+)\\sreadonly \\w+=(?\\S+)", + ], + }, + ], + packageRules: [ { matchUpdateTypes: ["minor", "patch", "pin", "digest"],