renovate

Breaking changes for 35

• breaking

  Require NodeJS v18.12+

• breaking

  config: Forked repos will now be processed automatically if autodiscover=false. includeForks is removed and replaced by new option forkProcessing

• breaking

  Internal checks such as renovate/stability-days will no longer count as passing/green, meaning that actions such as automerge won't occur if the only checks are Renovate internal ones. Set internalChecksAsSuccess=true to restore existing behavior

• breaking

  versioning: default versioning is now semver-coerced, instead of semver

• breaking

  datasource/github-releases: Regex Manager configurations relying on the github-release data-source with digests will have different digest semantics. The digest will now always correspond to the underlying Git SHA of the release/version. The old behavior can be preserved by switching to the github-release-attachments datasource

• breaking

  versioning: bump short ranges to version

• breaking

  config: containerbase/ account used for sidecar containers instead of renovate/

• breaking

  go: Renovate will now use go's default GOPROXY settings. To avoid using the public proxy, configure GOPROXY=direct

• breaking

  datasource/npm: Package cache will include entries for up to 24 hours after the last lookup. Set cacheHardTtlMinutes=0 to revert to existing behavior

• breaking

  config: Renovate now defaults to applying hourly and concurrent PR limits. To revert to unlimited, configure them back to 0

• breaking

  config: Renovate will now default to updating locked dependency versions. To revert to previous behavior, configure rangeStrategy=replace

• breaking

  config: PyPI releases will no longer be filtered by default based on constraints.python compatibility. To retain existing functionality, set constraintsFiltering=strict

Commentary for 35

Most of these changes will be invisible to the majority of users.
They may be "breaking" (change of behavior) but good changes of defaults to make.

The biggest change is defaulting rangeStrategy=auto to use update-lockfile instead of replace, which impacts anyone using the recommended config:base.
This will mean that you start seeing some "lockfile-only" PRs for in-range updates, such as updating package-lock.json when a range exists in package.json.

Breaking changes

• breaking

  Require NodeJS v18.12+

• breaking

  config: Forked repos will now be processed automatically if autodiscover=false. includeForks is removed and replaced by new option forkProcessing.

• breaking

  Internal checks such as renovate/stability-days will no longer count as passing/green, meaning that actions such as automerge won't
  occur if the only checks are Renovate internal ones. Set internalChecksAsSuccess=true to restore existing behavior.

• breaking

  versioning: default versioning is now semver-coerced, instead of semver.

• breaking

  datasource/github-releases: Regex Manager configurations relying on the github-release data-source with digests will have different digest semantics. The digest
  will now always correspond to the underlying Git SHA of the release/version. The old behavior can be preserved by switching to the
  github-release-attachments datasource.

• breaking

  versioning: bump short ranges to version

• breaking

  config: containerbase/ account used for sidecar containers instead of renovate/

• breaking

  go: Renovate will now use go's default GOPROXY settings. To avoid using the public proxy, configure GOPROXY=direct.

• breaking

  datasource/npm: Package cache will include entries for up to 24 hours after the last lookup. Set cacheHardTtlMinutes=0 to revert to existing behavior.

• breaking

  config: Renovate now defaults to applying hourly and concurrent PR limits. To revert to unlimited, configure them back to 0.

• breaking

  config: Renovate will now default to updating locked dependency versions. To revert to previous behavior, configure rangeStrategy=replace.

• breaking

  config: PyPI releases will no longer be filtered by default based on constraints.python compatibility. To retain existing functionality, set
  constraintsFiltering=strict.

Features

• cache: file cache cleanup (#20061) (222cda6), closes #13732

• config: add new option constraintsFiltering (#19992) (dcd298a), closes #19979

• config: default dockerImagePrefix to containerbase

• config: default to rangeStrategy=auto, prefer update-lockfile (#19942) (016e647), closes #19800

• config: forkProcessing (#20759) (a4ab452), closes #20752

• config: non-zero defaults for PR concurrent, hourly limits (#19958) (a75f9d7), closes #19800

• datasource/github-releases: digest computation use git tag, not file digest (#20178) (177ffed), closes #20160 #19552

• datasource/npm: default cacheHardTtlMinutes to 24 hours

• go: default GOPROXY (#20081) (d92e194), closes #20040

• internalChecksAsSuccess (#20572) (f765e6f), closes #7800

• breaking

  Require NodeJS v18.12+

• versioning: default to semver-coerced instead of semver

Bug Fixes

• regex: don’t escape forward slash in fileMatch

• versioning: bump short ranges to version (#20494) (73c8227), closes #20488