Close correctness gaps against Renovate and cut scope - #158
Merged
Conversation
Audited every mode against the Renovate source and fixed the divergences that produced wrong writes, most importantly local `file:`/`link:` npm dependencies being resolvable against the public registry. Several features were partial reimplementations of Renovate that kept generating bugs without earning their weight, so they are removed rather than repaired: preset resolution, rangeStrategy, requires-python filtering, Docker architecture selection, Dockerfile variable defaults, Yarn catalogs, Go toolchain directives, and multi-major probing. Writers rescanned the whole manifest per dependency, and glob matching could backtrack exponentially on config-supplied patterns. Both are now single-pass, and startup no longer eagerly loads the full bundle. Co-Authored-By: Claude (Opus 5) <noreply@anthropic.com>
The unscoped _auth test only set HOME, which Windows does not consult, so the fake home npmrc was never found and no credential was applied. Co-Authored-By: Claude (Opus 5) <noreply@anthropic.com>
Co-Authored-By: Claude (Opus 5) <noreply@anthropic.com>
silverwind
added a commit
that referenced
this pull request
Aug 21, 2026
* Restore behavior lost in #158 #158 turned several "skip this input" paths into throws or silent drops, and narrowed matchers that were deliberately broad. Dependencies went missing from runs, some updates were reported but never written, and two inputs aborted the run outright. The widest ones: CRLF workflow files yielded zero Docker dependencies, `exclude: ["*"]` (what a Renovate `enabled: false` maps to) stopped matching any name containing a slash, nested npm overrides collapsed onto one key so the wrong entry was written, and a spaced `[workspace . dependencies]` header aborted everything. A pnpm workspace default registry also suppressed a more specific scoped `.npmrc` registry, which sent private package names to the public registry without their token. Two expectations in #158 encoded the regressions rather than the intended behavior, so they are restored with the code. Co-Authored-By: Claude (Opus 5) <noreply@anthropic.com> * Give the version-layout fixture a module type The fixture simulates a real package root but omitted `"type": "module"`, so Node 24 and 26 emitted MODULE_TYPELESS_PACKAGE_JSON on stderr and the test's empty-stderr assertion failed. Node 22 does not warn, and a local `--no-warnings` in NODE_OPTIONS hid it outside CI. Co-Authored-By: Claude (Opus 5) <noreply@anthropic.com> --------- Co-authored-by: Claude (Opus 5) <noreply@anthropic.com>
silverwind
added a commit
that referenced
this pull request
Aug 22, 2026
#158 routed every sha pin with a trailing comment through a digest-only refresh, so `uses: x@<sha> # v2.17.0` never moved off v2.17.0 and its repo's tags were never listed at all. A comment naming a version is a version consumer again. One naming a branch or other moving ref keeps the digest-only path, and a version with nothing newer falls back to it, so a retagged release still updates the sha. Co-Authored-By: Claude (Opus 5) <noreply@anthropic.com>
silverwind
added a commit
that referenced
this pull request
Aug 22, 2026
* update deps (silverwind) * Keep hot-path reuse behavior-preserving (silverwind) * Avoid redundant registry and Forge requests (silverwind) * Take Docker Hub tag digests from the listing (silverwind) * Stop a run stalling on rate limits and proxy fallbacks (silverwind) * Restore version bumping for sha-pinned actions (silverwind) * Cut redundant work from dependency lookup hot paths (silverwind) * Restore behavior lost in #158 (#159) (silverwind) * Close correctness gaps against Renovate and cut scope (#158) (silverwind)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Audited every mode against the Renovate source and fixed the divergences that produced wrong writes.
Correctness
file:/link:npm deps could be replaced by same-named public registry packagesrequireupdates also rewrote matchingexclude/replacelines, and import rewriting hit comments and strings~=dropped epochs, local versions produced invalid specifiersScope cuts. These were partial Renovate reimplementations that kept generating bugs: preset resolution,
rangeStrategy,requires-pythonfiltering, Docker architecture selection, Dockerfile variable defaults, Yarn catalogs, Go toolchain directives, multi-major probing.Security
.npmrccould redirect the global_authcredential to an attacker hostversionwas cross-rewritten when any sibling updateduses:insiderun: |block scalarsPerformance. Writers rescanned the manifest per dependency (Cargo 736ms to 0.8ms at 1500 deps, Go 259ms to 0.8ms, Compose 590ms to 0.8ms). Glob matching backtracked exponentially on config-supplied patterns (1540ms to 0.05ms). Startup no longer eagerly loads the full bundle.
npm-1500warm is ~14% faster.Net -1196 lines.
make build,make lint,make testpass (679 vitest, 678 bun).Written by Claude.