Merge remote-tracking branch 'upstream/main' into rework-nix

* upstream/main: (95 commits)
  fix(presets): use regex to match versions for :automergeStableNonMajor preset (renovatebot#32924)
  feat(bazel-module): add support for oci.pull (renovatebot#32453)
  fix(deps): update ghcr.io/containerbase/sidecar docker tag to v13.1.0 (renovatebot#32925)
  fix(bundler): gracefully ignore internal packages (renovatebot#32923)
  docs: list uv.lock as supported by lockFileMaintenance. (renovatebot#32897)
  chore(deps): update ghcr.io/containerbase/devcontainer docker tag to v13.1.0 (renovatebot#32920)
  refactor(bundler): refactor extraction regexes (renovatebot#32870)
  chore(deps): update dependency @types/node to v20.17.9 (renovatebot#32916)
  chore(deps): update python:3.13 docker digest to 220d075 (renovatebot#32914)
  chore(deps): update python:3.13 docker digest to 30fca17 (renovatebot#32912)
  chore(deps): update python docker tag to v3.13.1 (renovatebot#32913)
  fix(docs): typos (renovatebot#32888)
  chore(deps): update otel/opentelemetry-collector-contrib docker tag to v0.115.1 (renovatebot#32911)
  fix(deps): update ghcr.io/renovatebot/base-image docker tag to v9.14.1 (renovatebot#32910)
  fix(metadata): update changelog URL for mypy (renovatebot#32106)
  chore(deps): update dependency type-fest to v4.29.0 (renovatebot#32902)
  chore(deps): update python:3.13 docker digest to e95be02 (renovatebot#32900)
  docs(faq): mention weekly update goal for Mend Renovate app (renovatebot#32899)
  feat(deps): update ghcr.io/renovatebot/base-image docker tag to v9.14.0 (renovatebot#32896)
  chore(deps): update python:3.13 docker digest to 7861d60 (renovatebot#32895)
  ...

.devcontainer/Dockerfile

@@ -1 +1 @@
-FROM ghcr.io/containerbase/devcontainer:13.0.22
+FROM ghcr.io/containerbase/devcontainer:13.1.0

.github/workflows/build.yml

@@ -684,7 +684,7 @@ jobs:
           show-progress: false
 
       - name: docker-config
-        uses: containerbase/internal-tools@e386c8e7bd305d803e0874abccbe153ec1d33a6d # v3.5.2
+        uses: containerbase/internal-tools@fa96b70003f221771f8c015cd3f598818ebf4d78 # v3.5.4
         with:
           command: docker-config
 

.github/workflows/codeql-analysis.yml

@@ -41,7 +41,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/init@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
         with:
           languages: javascript
 
@@ -51,7 +51,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/autobuild@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -65,4 +65,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/analyze@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6

.github/workflows/scorecard.yml

@@ -51,6 +51,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: 'Upload to code-scanning'
-        uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
         with:
           sarif_file: results.sarif

.github/workflows/trivy.yml

@@ -31,7 +31,7 @@ jobs:
           format: 'sarif'
           output: 'trivy-results.sarif'
 
-      - uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+      - uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
         with:
           sarif_file: trivy-results.sarif
           category: 'docker-image-${{ matrix.tag }}'

.python-version

@@ -1 +1 @@
-3.13.0
+3.13.1

docs/usage/configuration-options.md

@@ -2246,6 +2246,7 @@ Supported lock files:
 - `pubspec.lock`
 - `pyproject.toml`
 - `requirements.txt`
+- `uv.lock`
 - `yarn.lock`
 
 Support for new lock files may be added via feature request.
@@ -2463,8 +2464,9 @@ Here's an example config to limit the "noisy" `aws-sdk` package to weekly update
 {
   "packageRules": [
     {
+      "description": "Schedule aws-sdk updates on Sunday nights (9 PM - 12 AM)",
       "matchPackageNames": ["aws-sdk"],
-      "schedule": ["after 9pm on sunday"]
+      "schedule": ["* 21-23 * * 0"]
     }
   ]
 }
@@ -3783,7 +3785,7 @@ If enabled Renovate tries to determine PR reviewers by matching rules defined in
 Read the docs for your platform for details on syntax and allowed file locations:
 
 - [GitHub Docs, About code owners](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners)
-- [GitLab, Code Owners](https://docs.gitlab.com/ee/user/project/code_owners.html)
+- [GitLab, Code Owners](https://docs.gitlab.com/ee/user/project/codeowners/)
 - [Bitbucket, Set up and use code owners](https://support.atlassian.com/bitbucket-cloud/docs/set-up-and-use-code-owners/)
 
 ## reviewersSampleSize
@@ -3843,6 +3845,7 @@ You could then configure a schedule like this at the repository level:
 
 ```json
 {
+  "description": "Schedule on weekdays at night (10 PM - 4 AM) and anytime on weekends",
   "schedule": ["* 22-23,0-4 * * *", "* * * * 0,6"]
 }
 ```

docs/usage/docker.md

@@ -307,7 +307,7 @@ Renovate will get the credentials with the [`google-auth-library`](https://www.n
     service_account: ${{ env.SERVICE_ACCOUNT }}
 
 - name: renovate
-  uses: renovatebot/[email protected].4
+  uses: renovatebot/[email protected].5
   env:
     RENOVATE_HOST_RULES: |
       [
@@ -478,7 +478,7 @@ Make sure to install the Google Cloud SDK into the custom image, as you need the
 For example:
 
 ```Dockerfile
-FROM renovate/renovate:39.28.0
+FROM renovate/renovate:39.42.4
 # Include the "Docker tip" which you can find here https://cloud.google.com/sdk/docs/install
 # under "Installation" for "Debian/Ubuntu"
 RUN ...

docs/usage/examples/opentelemetry.md

@@ -19,7 +19,7 @@ services:
       - '4317'
 
   otel-collector:
-    image: otel/opentelemetry-collector-contrib:0.114.0
+    image: otel/opentelemetry-collector-contrib:0.115.1
     command: ['--config=/etc/otel-collector-config.yml']
     volumes:
       - ./otel-collector-config.yml:/etc/otel-collector-config.yml

docs/usage/examples/self-hosting.md

@@ -25,8 +25,8 @@ It builds `latest` based on the `main` branch and all SemVer tags are published
 ```sh title="Example of valid tags"
 docker run --rm renovate/renovate
 docker run --rm renovate/renovate:39
-docker run --rm renovate/renovate:39.28
-docker run --rm renovate/renovate:39.28.0
+docker run --rm renovate/renovate:39.42
+docker run --rm renovate/renovate:39.42.4
 ```
 
 <!-- prettier-ignore -->
@@ -62,7 +62,7 @@ spec:
             - name: renovate
               # Update this to the latest available and then enable Renovate on
               # the manifest
-              image: renovate/renovate:39.28.0
+              image: renovate/renovate:39.42.4
               args:
                 - user/repo
               # Environment Variables
@@ -121,7 +121,7 @@ spec:
       template:
         spec:
           containers:
-            - image: renovate/renovate:39.28.0
+            - image: renovate/renovate:39.42.4
               name: renovate-bot
               env: # For illustration purposes, please use secrets.
                 - name: RENOVATE_PLATFORM
@@ -367,7 +367,7 @@ spec:
           containers:
             - name: renovate
               # Update this to the latest available and then enable Renovate on the manifest
-              image: renovate/renovate:39.28.0
+              image: renovate/renovate:39.42.4
               volumeMounts:
                 - name: ssh-key-volume
                   readOnly: true

docs/usage/faq.md

@@ -32,8 +32,9 @@ If you're self hosting Renovate, use the latest release if possible.
 ## When is the Mend Renovate App updated with new Renovate versions?
 
 The Renovate maintainers manually update the app.
-The maintainers don't follow any release schedule or release cadence.
+The maintainers don't follow any release schedule or release cadence, but try to update at least once a week.
 This means the Mend Renovate App can lag a few hours to a week behind the open source version.
+
 Major releases of Renovate are held back until the maintainers are reasonably certain it works for most users.
 
 ## How can I see which version the Mend Renovate app is using?

docs/usage/getting-started/private-packages.md

@@ -36,7 +36,7 @@ However if you do still use them, private modules should work if you configure `
 It is strongly recommended not to use private modules on a private registry and a warning will be logged if that is found.
 Credentials stored on disk (e.g. in `~/.npmrc`) are no longer supported.
 
-The recommended way of using local presets is to configure then using "local" presets, e.g. `"extends": ["local>myorg/renovate-config"]`, and ensure that the platform token has access to that repo.
+The recommended way of using local presets is to configure them using "local" presets, e.g. `"extends": ["local>myorg/renovate-config"]`, and ensure that the platform token has access to that repo.
 
 It's not recommended that you use a private repository to host your config while then extending it from a public repository.
 If your preset doesn't have secrets then you should make it public, while if it does have secrets then it's better to split your preset between a public one which all repos extend, and a private one with secrets which only other private repos extend.
@@ -499,7 +499,7 @@ private-package==1.2.3
 
 #### Packages that Renovate needs
 
-Renovate relies on `pip`'s integration with the Python [keyring](https://pypi.org/project/keyring/) package along with the [keyrigs.envvars](https://pypi.org/project/keyrings.envvars/) backend for this.
+Renovate relies on `pip`'s integration with the Python [keyring](https://pypi.org/project/keyring/) package along with the [keyrings.envvars](https://pypi.org/project/keyrings.envvars/) backend for this.
 
 ##### Self-hosting Renovate
 
@@ -511,7 +511,7 @@ But if you are self-hosting Renovate and:
 - _not_ running Renovate in a Containerbase environment
 - or, _not_ using the Docker sidecar container
 
-Then you must install the Python keyring package and the keyrigs.envvars package into your self-hosted environment.
+Then you must install the Python keyring package and the keyrings.envvars package into your self-hosted environment.
 
 ### poetry
 

docs/usage/java.md

@@ -46,6 +46,18 @@ Renovate does not support:
 - Catalogs with custom names that do not end in `.toml`
 - Catalogs outside the `gradle` folder whose names do not end in `.versions.toml` (unless overridden via [`fileMatch`](./configuration-options.md#filematch) configuration)
 
+### Gradle Plugin Support
+
+Renovate can also update [Gradle plugins](https://docs.gradle.org/current/userguide/plugins.html).
+It supports the `id(<pluginId>)` syntax as well as the `kotlin(<kotlinPluginId>)` shortcut for `id(org.jetbrains.kotlin.<kotlinPluginId>)`.
+
+For specifying `packageRules` it is important to know how `depName` and `packageName` are defined for a Gradle plugin:
+
+- The `depName` field is equal to `<pluginId>`
+- The `packageName` field is equal to `<pluginId>:<pluginId>.gradle.plugin`
+
+This is a direct consequence of the [Plugin Marker Artifact](https://docs.gradle.org/current/userguide/plugins.html#sec:plugin_markers) naming convention.
+
 ## Gradle Wrapper
 
 Renovate can update the [Gradle Wrapper](https://docs.gradle.org/current/userguide/gradle_wrapper.html) of a project.

docs/usage/key-concepts/scheduling.md

@@ -93,17 +93,15 @@ Some config examples:
 
 ```json title="Renovate should run each day before 4 am"
 {
-  "schedule": ["before 4am"]
+  "description": "Schedule daily before 4 AM",
+  "schedule": ["* 0-3 * * *"]
 }
 ```
 
 ```json title="Renovate should run outside of common office hours"
 {
-  "schedule": [
-    "after 10pm every weekday",
-    "before 5am every weekday",
-    "every weekend"
-  ]
+  "description": "Schedule during typical non-office hours on weekdays (i.e., 10 PM - 5 AM) and anytime on weekends",
+  "schedule": ["* 0-4,22-23 * * 1-5", "* * * * 0,6"]
 }
 ```
 
@@ -121,8 +119,9 @@ The scheduling feature can be very useful for "noisy" packages that are updated
 {
   "packageRules": [
     {
+      "description": "Schedule aws-sdk updates on Sunday nights (9 PM - 12 AM)",
       "matchPackageNames": ["aws-sdk"],
-      "schedule": ["after 9pm on sunday"]
+      "schedule": ["* 21-23 * * 0"]
     }
   ]
 }

docs/usage/noise-reduction.md

@@ -91,9 +91,10 @@ You don't want to get too far behind, so how about we update `eslint` packages o
 {
   "packageRules": [
     {
+      "description": "Schedule updates on first day of each month",
       "matchPackageNames": ["/eslint/"],
       "groupName": "eslint",
-      "schedule": ["on the first day of the month"]
+      "schedule": ["* * 1 * *"]
     }
   ]
 }
@@ -105,9 +106,10 @@ Or perhaps at least weekly:
 {
   "packageRules": [
     {
+      "description": "Schedule updates on Monday mornings(before 4 AM)",
       "matchPackageNames": ["/eslint/"],
       "groupName": "eslint",
-      "schedule": ["before 4am on monday"]
+      "schedule": ["* 0-3 * * 1"]
     }
   ]
 }
@@ -165,9 +167,10 @@ Let's automerge it if all the linting updates pass:
 {
   "packageRules": [
     {
+      "description": "Schedule updates on Monday mornings(before 4 AM)",
       "matchPackageNames": ["/eslint/"],
       "groupName": "eslint",
-      "schedule": ["before 4am on monday"],
+      "schedule": ["* 0-3 * * 1"],
       "automerge": true,
       "automergeType": "branch"
     }

lib/config/options/index.spec.ts

@@ -41,4 +41,10 @@ describe('config/options/index', () => {
         }
       });
   });
+
+  it('should not contain duplicate option names', () => {
+    const optsNames = getOptions().map((option) => option.name);
+    const optsNameSet = new Set(optsNames);
+    expect(optsNames).toHaveLength(optsNameSet.size);
+  });
 });

lib/config/options/index.ts

@@ -515,7 +515,7 @@ const options: RenovateOptions[] = [
     description:
       'Change this value to override the default Renovate sidecar image.',
     type: 'string',
-    default: 'ghcr.io/containerbase/sidecar:13.0.22',
+    default: 'ghcr.io/containerbase/sidecar:13.1.0',
     globalOnly: true,
   },
   {

lib/config/presets/internal/default.ts

@@ -96,7 +96,7 @@ export const presets: Record<string, Preset> = {
     packageRules: [
       {
         automerge: true,
-        matchCurrentVersion: '>= 1.0.0',
+        matchCurrentVersion: '!/^0/',
         matchUpdateTypes: ['minor', 'patch'],
       },
     ],

lib/config/presets/internal/schedule.spec.ts

@@ -89,6 +89,7 @@ describe('config/presets/internal/schedule', () => {
     it.each`
       datetime                     | expected
       ${'2017-01-01T00:50:00.000'} | ${true}
+      ${'2017-01-02T00:50:00.000'} | ${false}
       ${'2017-04-01T01:50:00.000'} | ${true}
       ${'2017-07-01T02:50:00.000'} | ${true}
       ${'2017-10-01T03:50:00.000'} | ${true}