From 15855cf1117c9f24cd1c36d37b8e40be261712f4 Mon Sep 17 00:00:00 2001 From: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> Date: Thu, 25 Jul 2024 20:05:17 +0200 Subject: [PATCH 1/9] docs: release notes and commentary for v38 --- .../usage/release-notes-for-major-versions.md | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/docs/usage/release-notes-for-major-versions.md b/docs/usage/release-notes-for-major-versions.md index d42962fe917bc0..64539f1be51ec3 100644 --- a/docs/usage/release-notes-for-major-versions.md +++ b/docs/usage/release-notes-for-major-versions.md @@ -7,6 +7,36 @@ The most recent versions are always at the top of the page. This is because recent versions may revert changes made in an older version. You also don't have to scroll to the bottom of the page to find the latest release notes. +## Version 38 + +### Breaking changes for 38 + +- **bitbucket-server:** autodetect gitAuthor if possible ([#29525](https://github.com/renovatebot/renovate/pull/29525)) +- require node v20 ([#30291](https://github.com/renovatebot/renovate/pull/30291)) +- **http:** dnsCache is now removed +- **github:** platformCommit will be automatically enabled if running as a GitHub app +- **npm:** remove RENOVATE_CACHE_NPM_MINUTES ([#28715](https://github.com/renovatebot/renovate/pull/28715)) +- **git:** determine branch modification based on all branch commits ([#28225](https://github.com/renovatebot/renovate/pull/28225)) +- **packageRules:** matchPackageNames exact matches are now case-insensitive +- **datasource/docker: **Docker Hub lookups prefer hub.docker.com over index.docker.io. Set RENOVATE_X_DOCKER_HUB_TAGS_DISABLE=true in env to revert behavior. +- **package-rules:** matchPackageNames and related functions no longer fall back to checking depName. +- **logging:** File logging must now be set via env and not in config.js +- **config:** onboardingNoDeps changes from boolean to enum. Repositories with no dependencies will be onboarded unless in autodiscover mode. +- **npm:** Transitive remediation for npm <7 is no longer supported. +- **config:** Branch names for remediation will be sanitized to exclude special characters, potentially resulting in some autoclosing/replacing of existing PRs. +- Renovate docker images no longer have -slim tags. Drop the -slim prefix as this is now the default behavior. +- **gitea:** Gitea platfor authentication will now be done using Bearer auth instead of token auth. +- **manager/pep621:** depName for pep621 dependencies changes, which will lead to branch name changes, which will lead to some autoclosing and reopening of PRs. +- **config:** order of globalExtends resolution is changed so that it is applied first and remaining global config takes precedence. + +### Commentary for 38 + +For maintainers to fill out. + +### Link to release notes for 38 + +[Release notes for `v38` on GitHub](https://github.com/renovatebot/renovate/releases/tag/38.0.0). + ## Version 37 ### Breaking changes for 37 From 44a22abba1d0316f28eece2c2e9abbe44c1723a6 Mon Sep 17 00:00:00 2001 From: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> Date: Thu, 25 Jul 2024 20:10:04 +0200 Subject: [PATCH 2/9] Fix styling/spelling --- .../usage/release-notes-for-major-versions.md | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/docs/usage/release-notes-for-major-versions.md b/docs/usage/release-notes-for-major-versions.md index 64539f1be51ec3..902e1ffc2a9ea6 100644 --- a/docs/usage/release-notes-for-major-versions.md +++ b/docs/usage/release-notes-for-major-versions.md @@ -11,23 +11,23 @@ You also don't have to scroll to the bottom of the page to find the latest relea ### Breaking changes for 38 -- **bitbucket-server:** autodetect gitAuthor if possible ([#29525](https://github.com/renovatebot/renovate/pull/29525)) +- **bitbucket-server:** autodetect `gitAuthor` if possible ([#29525](https://github.com/renovatebot/renovate/pull/29525)) - require node v20 ([#30291](https://github.com/renovatebot/renovate/pull/30291)) -- **http:** dnsCache is now removed -- **github:** platformCommit will be automatically enabled if running as a GitHub app -- **npm:** remove RENOVATE_CACHE_NPM_MINUTES ([#28715](https://github.com/renovatebot/renovate/pull/28715)) +- **http:** `dnsCache` is now removed +- **github:** `platformCommit` will be automatically enabled if running as a GitHub app +- **npm:** remove `RENOVATE_CACHE_NPM_MINUTES` ([#28715](https://github.com/renovatebot/renovate/pull/28715)) - **git:** determine branch modification based on all branch commits ([#28225](https://github.com/renovatebot/renovate/pull/28225)) -- **packageRules:** matchPackageNames exact matches are now case-insensitive -- **datasource/docker: **Docker Hub lookups prefer hub.docker.com over index.docker.io. Set RENOVATE_X_DOCKER_HUB_TAGS_DISABLE=true in env to revert behavior. -- **package-rules:** matchPackageNames and related functions no longer fall back to checking depName. -- **logging:** File logging must now be set via env and not in config.js -- **config:** onboardingNoDeps changes from boolean to enum. Repositories with no dependencies will be onboarded unless in autodiscover mode. +- **packageRules:** `matchPackageNames` exact matches are now case-insensitive +- **datasource/docker:** Docker Hub lookups prefer `hub.docker.com` over `index.docker.io`. Set `RENOVATE_X_DOCKER_HUB_TAGS_DISABLE=true` in env to revert behavior. +- **package-rules:** `matchPackageNames` and related functions no longer fall back to checking `depName`. +- **logging:** File logging must now be set via env and not in `config.js` +- **config:** `onboardingNoDeps` changes from `boolean` to `enum`. Repositories with no dependencies will be onboarded unless in `autodiscover` mode. - **npm:** Transitive remediation for npm <7 is no longer supported. - **config:** Branch names for remediation will be sanitized to exclude special characters, potentially resulting in some autoclosing/replacing of existing PRs. -- Renovate docker images no longer have -slim tags. Drop the -slim prefix as this is now the default behavior. -- **gitea:** Gitea platfor authentication will now be done using Bearer auth instead of token auth. -- **manager/pep621:** depName for pep621 dependencies changes, which will lead to branch name changes, which will lead to some autoclosing and reopening of PRs. -- **config:** order of globalExtends resolution is changed so that it is applied first and remaining global config takes precedence. +- Renovate Docker images no longer have `-slim` tags. Drop the `-slim` prefix as this is now the default behavior. +- **gitea:** Gitea platform authentication will now be done with "Bearer auth" instead of "token auth". +- **manager/pep621:** `depName` for `pep621` dependencies changes, which will lead to branch name changes, which will lead to some autoclosing and re-opening of PRs. +- **config:** order of `globalExtends` resolution is changed so that it is applied first and remaining global config takes precedence. ### Commentary for 38 From 37fe61e1e700aeb69687ce9c82bf1f185dbfea05 Mon Sep 17 00:00:00 2001 From: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> Date: Thu, 25 Jul 2024 20:23:42 +0200 Subject: [PATCH 3/9] Group similar changelog items --- .../usage/release-notes-for-major-versions.md | 31 +++++++++++-------- 1 file changed, 18 insertions(+), 13 deletions(-) diff --git a/docs/usage/release-notes-for-major-versions.md b/docs/usage/release-notes-for-major-versions.md index 902e1ffc2a9ea6..e42146a2d495f1 100644 --- a/docs/usage/release-notes-for-major-versions.md +++ b/docs/usage/release-notes-for-major-versions.md @@ -11,23 +11,28 @@ You also don't have to scroll to the bottom of the page to find the latest relea ### Breaking changes for 38 -- **bitbucket-server:** autodetect `gitAuthor` if possible ([#29525](https://github.com/renovatebot/renovate/pull/29525)) +General: + - require node v20 ([#30291](https://github.com/renovatebot/renovate/pull/30291)) -- **http:** `dnsCache` is now removed +- Renovate Docker images no longer have `-slim` tags. Drop the `-slim` prefix, as this is now the default behavior. + +Specific: + +- **bitbucket-server:** autodetect `gitAuthor`, if possible ([#29525](https://github.com/renovatebot/renovate/pull/29525)) +- **config:** `onboardingNoDeps` changes from `boolean` to `enum`. Repositories with no dependencies will be onboarded unless in `autodiscover` mode +- **config:** Branch names for remediation will be sanitized to exclude special characters, potentially resulting in some autoclosing/replacing of existing PRs +- **config:** order of `globalExtends` resolution is changed so that it is applied first and remaining global config takes precedence +- **datasource/docker:** Docker Hub lookups prefer `hub.docker.com` over `index.docker.io`. Set `RENOVATE_X_DOCKER_HUB_TAGS_DISABLE=true` in env to revert behavior +- **git:** determine branch modification based on all branch commits ([#28225](https://github.com/renovatebot/renovate/pull/28225)) +- **gitea:** Gitea platform authentication will now be done with "Bearer auth" instead of "token auth" - **github:** `platformCommit` will be automatically enabled if running as a GitHub app +- **http:** `dnsCache` is now removed +- **logging:** File logging must now be set via env, and not in `config.js` +- **manager/pep621:** `depName` for `pep621` dependencies changes, which will lead to branch name changes, which will lead to autoclosing and re-opening of some PRs +- **npm:** Transitive remediation for npm <7 is no longer supported - **npm:** remove `RENOVATE_CACHE_NPM_MINUTES` ([#28715](https://github.com/renovatebot/renovate/pull/28715)) -- **git:** determine branch modification based on all branch commits ([#28225](https://github.com/renovatebot/renovate/pull/28225)) +- **package-rules:** `matchPackageNames` and related functions no longer fall back to checking `depName` - **packageRules:** `matchPackageNames` exact matches are now case-insensitive -- **datasource/docker:** Docker Hub lookups prefer `hub.docker.com` over `index.docker.io`. Set `RENOVATE_X_DOCKER_HUB_TAGS_DISABLE=true` in env to revert behavior. -- **package-rules:** `matchPackageNames` and related functions no longer fall back to checking `depName`. -- **logging:** File logging must now be set via env and not in `config.js` -- **config:** `onboardingNoDeps` changes from `boolean` to `enum`. Repositories with no dependencies will be onboarded unless in `autodiscover` mode. -- **npm:** Transitive remediation for npm <7 is no longer supported. -- **config:** Branch names for remediation will be sanitized to exclude special characters, potentially resulting in some autoclosing/replacing of existing PRs. -- Renovate Docker images no longer have `-slim` tags. Drop the `-slim` prefix as this is now the default behavior. -- **gitea:** Gitea platform authentication will now be done with "Bearer auth" instead of "token auth". -- **manager/pep621:** `depName` for `pep621` dependencies changes, which will lead to branch name changes, which will lead to some autoclosing and re-opening of PRs. -- **config:** order of `globalExtends` resolution is changed so that it is applied first and remaining global config takes precedence. ### Commentary for 38 From 86e73f8b7b6f65d71ea49551625c03ddcc3d3ca3 Mon Sep 17 00:00:00 2001 From: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> Date: Thu, 25 Jul 2024 20:35:26 +0200 Subject: [PATCH 4/9] Rewrite most changelog items --- docs/usage/release-notes-for-major-versions.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/usage/release-notes-for-major-versions.md b/docs/usage/release-notes-for-major-versions.md index e42146a2d495f1..4bc1d56742e655 100644 --- a/docs/usage/release-notes-for-major-versions.md +++ b/docs/usage/release-notes-for-major-versions.md @@ -20,18 +20,18 @@ Specific: - **bitbucket-server:** autodetect `gitAuthor`, if possible ([#29525](https://github.com/renovatebot/renovate/pull/29525)) - **config:** `onboardingNoDeps` changes from `boolean` to `enum`. Repositories with no dependencies will be onboarded unless in `autodiscover` mode -- **config:** Branch names for remediation will be sanitized to exclude special characters, potentially resulting in some autoclosing/replacing of existing PRs +- **config:** sanitize special characters from branch names for remediation type PRs, this may cause Renovate to autoclose/replace existing PRs - **config:** order of `globalExtends` resolution is changed so that it is applied first and remaining global config takes precedence - **datasource/docker:** Docker Hub lookups prefer `hub.docker.com` over `index.docker.io`. Set `RENOVATE_X_DOCKER_HUB_TAGS_DISABLE=true` in env to revert behavior - **git:** determine branch modification based on all branch commits ([#28225](https://github.com/renovatebot/renovate/pull/28225)) -- **gitea:** Gitea platform authentication will now be done with "Bearer auth" instead of "token auth" -- **github:** `platformCommit` will be automatically enabled if running as a GitHub app -- **http:** `dnsCache` is now removed -- **logging:** File logging must now be set via env, and not in `config.js` -- **manager/pep621:** `depName` for `pep621` dependencies changes, which will lead to branch name changes, which will lead to autoclosing and re-opening of some PRs -- **npm:** Transitive remediation for npm <7 is no longer supported +- **gitea:** use "bearer auth" instead of "token auth" to authenticate to the Gitea platform +- **github:** if you run Renovate as a GitHub app then `platformCommit` is automatically enabled +- **http:** remove `dnsCache` +- **logging:** you must set file logging via env, not in `config.js` +- **manager/pep621:** change `depName` for `pep621` dependencies, this leads to branch name changes, which leads to Renovate autoclosing and re-opening some PRs +- **npm:** drop support for transitive remediation for npm <7 - **npm:** remove `RENOVATE_CACHE_NPM_MINUTES` ([#28715](https://github.com/renovatebot/renovate/pull/28715)) -- **package-rules:** `matchPackageNames` and related functions no longer fall back to checking `depName` +- **packageRules:** `matchPackageNames` and related functions no longer fall back to checking `depName` - **packageRules:** `matchPackageNames` exact matches are now case-insensitive ### Commentary for 38 From 5224da5643c523f58ba233760aba0dac14e16233 Mon Sep 17 00:00:00 2001 From: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> Date: Thu, 25 Jul 2024 21:08:27 +0200 Subject: [PATCH 5/9] Rewrite changelog items, draft topics for maintainers --- .../usage/release-notes-for-major-versions.md | 28 ++++++++++++------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/docs/usage/release-notes-for-major-versions.md b/docs/usage/release-notes-for-major-versions.md index 4bc1d56742e655..4c448a21c9b845 100644 --- a/docs/usage/release-notes-for-major-versions.md +++ b/docs/usage/release-notes-for-major-versions.md @@ -13,30 +13,38 @@ You also don't have to scroll to the bottom of the page to find the latest relea General: -- require node v20 ([#30291](https://github.com/renovatebot/renovate/pull/30291)) -- Renovate Docker images no longer have `-slim` tags. Drop the `-slim` prefix, as this is now the default behavior. +- Require Node.js 20 ([#30291](https://github.com/renovatebot/renovate/pull/30291)) +- The Renovate Docker images no longer have `-slim` tags. You must stop using the `-slim` prefix. Renovate now defaults to the `-slim` tag type behavior. Specific: - **bitbucket-server:** autodetect `gitAuthor`, if possible ([#29525](https://github.com/renovatebot/renovate/pull/29525)) -- **config:** `onboardingNoDeps` changes from `boolean` to `enum`. Repositories with no dependencies will be onboarded unless in `autodiscover` mode -- **config:** sanitize special characters from branch names for remediation type PRs, this may cause Renovate to autoclose/replace existing PRs -- **config:** order of `globalExtends` resolution is changed so that it is applied first and remaining global config takes precedence -- **datasource/docker:** Docker Hub lookups prefer `hub.docker.com` over `index.docker.io`. Set `RENOVATE_X_DOCKER_HUB_TAGS_DISABLE=true` in env to revert behavior -- **git:** determine branch modification based on all branch commits ([#28225](https://github.com/renovatebot/renovate/pull/28225)) +- **config:** change from `boolean` to `enum` for `onboardingNoDeps`. Renovate now onboards repositories with no dependencies, with one exception: if you run Renovate in `autodiscover` mode then you must manually onboard Renovate for repos with no dependencies +- **config:** sanitize special characters from branch names for vulnerability type PRs. This may cause Renovate to autoclose/replace existing PRs +- **config:** change the order of `globalExtends` resolution, it is applied _first_ and remaining global config takes precedence +- **datasource/docker:** Docker Hub lookups prefers `hub.docker.com` over `index.docker.io`. To revert to the old behavior: set `RENOVATE_X_DOCKER_HUB_TAGS_DISABLE=true` in your env +- **git:** check _all_ commits on the branch to decide if the branch was modified ([#28225](https://github.com/renovatebot/renovate/pull/28225)) - **gitea:** use "bearer auth" instead of "token auth" to authenticate to the Gitea platform - **github:** if you run Renovate as a GitHub app then `platformCommit` is automatically enabled - **http:** remove `dnsCache` - **logging:** you must set file logging via env, not in `config.js` -- **manager/pep621:** change `depName` for `pep621` dependencies, this leads to branch name changes, which leads to Renovate autoclosing and re-opening some PRs -- **npm:** drop support for transitive remediation for npm <7 +- **manager/pep621:** change `depName` for `pep621` dependencies. This also changes the branch name for `pep621` updates, which may cause Renovate to autoclose and re-open some `pep621` PRs +- **npm:** for npm versions lower than 7, drop support for remediating vulnerabilities in _transitive_ dependencies - **npm:** remove `RENOVATE_CACHE_NPM_MINUTES` ([#28715](https://github.com/renovatebot/renovate/pull/28715)) -- **packageRules:** `matchPackageNames` and related functions no longer fall back to checking `depName` +- **packageRules:** `matchPackageNames` (and related functions) no longer fall back to checking `depName` - **packageRules:** `matchPackageNames` exact matches are now case-insensitive ### Commentary for 38 For maintainers to fill out. +You should probably explain: + +- The Node.js 20 change +- The Docker `-slim` tags change +- Why you dropped support for vulnerability PRs for `npm <7` for transitive dependencies (I think because it did not work reliably?) +- Why you set `platformCommit` for GitHub app users? +- Why logging must be set in env, not in `config.js`? +- Why the changes to `matchPackageNames`? ### Link to release notes for 38 From 0691ac094e3b745307661c45bcd425266df18634 Mon Sep 17 00:00:00 2001 From: Rhys Arkins Date: Mon, 29 Jul 2024 10:53:40 +0200 Subject: [PATCH 6/9] Update docs/usage/release-notes-for-major-versions.md Co-authored-by: Sebastian Poxhofer --- docs/usage/release-notes-for-major-versions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/usage/release-notes-for-major-versions.md b/docs/usage/release-notes-for-major-versions.md index 4c448a21c9b845..1153a9df0cf939 100644 --- a/docs/usage/release-notes-for-major-versions.md +++ b/docs/usage/release-notes-for-major-versions.md @@ -28,7 +28,7 @@ Specific: - **github:** if you run Renovate as a GitHub app then `platformCommit` is automatically enabled - **http:** remove `dnsCache` - **logging:** you must set file logging via env, not in `config.js` -- **manager/pep621:** change `depName` for `pep621` dependencies. This also changes the branch name for `pep621` updates, which may cause Renovate to autoclose and re-open some `pep621` PRs +- **manager/pep621:** change `depName` for `pep621` dependencies. This also changes the branch name for `pep621` updates, which may cause Renovate to autoclose and re-open some `pep621` PRs. Further this roll changes into a single PR which have not been grouped before. - **npm:** for npm versions lower than 7, drop support for remediating vulnerabilities in _transitive_ dependencies - **npm:** remove `RENOVATE_CACHE_NPM_MINUTES` ([#28715](https://github.com/renovatebot/renovate/pull/28715)) - **packageRules:** `matchPackageNames` (and related functions) no longer fall back to checking `depName` From d039099957c127234a734b7556842a8751de657e Mon Sep 17 00:00:00 2001 From: Rhys Arkins Date: Mon, 29 Jul 2024 14:01:15 +0200 Subject: [PATCH 7/9] Update release-notes-for-major-versions.md --- .../usage/release-notes-for-major-versions.md | 25 ++++++++++++------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/docs/usage/release-notes-for-major-versions.md b/docs/usage/release-notes-for-major-versions.md index 1153a9df0cf939..d165a71475774a 100644 --- a/docs/usage/release-notes-for-major-versions.md +++ b/docs/usage/release-notes-for-major-versions.md @@ -36,15 +36,22 @@ Specific: ### Commentary for 38 -For maintainers to fill out. -You should probably explain: - -- The Node.js 20 change -- The Docker `-slim` tags change -- Why you dropped support for vulnerability PRs for `npm <7` for transitive dependencies (I think because it did not work reliably?) -- Why you set `platformCommit` for GitHub app users? -- Why logging must be set in env, not in `config.js`? -- Why the changes to `matchPackageNames`? +If you're self-hosting using Renovate's Docker `-slim` images, you need to now drop that suffix - Renovate's default tags such as `38.0.0` are "slim" by default. +There's no change if you're using the `-full` images. + +If you're self-hosting without Renovate's Docker images (e.g. building your own image, or running from the `renovate` npm package), then note that Renovate now requires Node.js `^20.15.1` to run. +We dropped Node.js 18 and do not yet support Node.js 22 as it's non-LTS and not recommended for production. +We decided to require the current non-vulnerable Node.js release (`20.15.1`) or above although do not plan to bump this minimum Node.js v20 required version in any non-major releases. +Please ensure you are running the a secure version of Node.js v20 in future as sometimes Node.js vulnerabilities can impact Renovate. + +We recommend all users running as a GitHub App utilize `platformCommit` so have refactored it to default to enabled whenever a GitHub App token is detected. +For PATs, it's still recommend to use regular commits. + +File-based logging must be configured using environment variables (e.g. `LOG_FILE`) now and not in file or CLI (such as `logFile`). +This to ensure that logging can begin at the start of Renovate execution and captures the parsing of configs too. + +Finally, we have consolidated may `matchPackage*` and `excludePackage*` options into `matchPackageNames` by enabling patterns. +You can now do like `"matchPackageNames": "/^com.renovatebot/"` (regex) or `"matchPackageNames": "@renovate/*"` (glob) in addition to exact name matching. ### Link to release notes for 38 From 982506fc7a2da46d4885bc6e7a03ec88d29abfd5 Mon Sep 17 00:00:00 2001 From: Rhys Arkins Date: Wed, 31 Jul 2024 13:14:30 +0200 Subject: [PATCH 8/9] Apply suggestions from code review Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> --- .../usage/release-notes-for-major-versions.md | 58 +++++++++++++++---- 1 file changed, 46 insertions(+), 12 deletions(-) diff --git a/docs/usage/release-notes-for-major-versions.md b/docs/usage/release-notes-for-major-versions.md index d165a71475774a..d351222d2b8084 100644 --- a/docs/usage/release-notes-for-major-versions.md +++ b/docs/usage/release-notes-for-major-versions.md @@ -28,7 +28,7 @@ Specific: - **github:** if you run Renovate as a GitHub app then `platformCommit` is automatically enabled - **http:** remove `dnsCache` - **logging:** you must set file logging via env, not in `config.js` -- **manager/pep621:** change `depName` for `pep621` dependencies. This also changes the branch name for `pep621` updates, which may cause Renovate to autoclose and re-open some `pep621` PRs. Further this roll changes into a single PR which have not been grouped before. +- **manager/pep621:** change `depName` for `pep621` dependencies. This causes the branch name for `pep621` updates to change, which in turn means Renovate may autoclose and re-open some `pep621` PRs. Also, Renovate may start grouping dependencies into a single PR. - **npm:** for npm versions lower than 7, drop support for remediating vulnerabilities in _transitive_ dependencies - **npm:** remove `RENOVATE_CACHE_NPM_MINUTES` ([#28715](https://github.com/renovatebot/renovate/pull/28715)) - **packageRules:** `matchPackageNames` (and related functions) no longer fall back to checking `depName` @@ -36,22 +36,56 @@ Specific: ### Commentary for 38 -If you're self-hosting using Renovate's Docker `-slim` images, you need to now drop that suffix - Renovate's default tags such as `38.0.0` are "slim" by default. +#### Our Docker images are slim by default + +If you self-host using Renovate's Docker `-slim` images: drop the `-slim` suffix, and switch to the default tags. +Renovate's default tags like `38.0.0` are "slim" by default. There's no change if you're using the `-full` images. -If you're self-hosting without Renovate's Docker images (e.g. building your own image, or running from the `renovate` npm package), then note that Renovate now requires Node.js `^20.15.1` to run. -We dropped Node.js 18 and do not yet support Node.js 22 as it's non-LTS and not recommended for production. -We decided to require the current non-vulnerable Node.js release (`20.15.1`) or above although do not plan to bump this minimum Node.js v20 required version in any non-major releases. -Please ensure you are running the a secure version of Node.js v20 in future as sometimes Node.js vulnerabilities can impact Renovate. +#### Renovate needs Node.js 20 + +Renovate now needs Node.js `^20.15.1` to run. +Our Docker images already use the correct version of Node.js. + +But if you self-host _without_ using our Docker image, then you must update the version of Node.js. +You must update manually, if for example: you build your own image, or run the `renovate` npm package. +##### Why we picked Node 20 + +We dropped Node.js 18, and do not yet support Node.js 22 as it's non-LTS and not recommended for production. + +##### Why we picked a non-vulnerable version of Node + +We decided to require the current non-vulnerable version of Node.js (`20.15.1` or newer). +If we ever need to bump the minimum version of Node.js v20, we will release a new _major_ version of Renovate. + +If you self-host: we recommend you always run a secure version of Node.js v20. +This is because security vulnerabilities in Node.js can affect Renovate too. + +#### If you use Mend's Renovate GitHub app + +We recommend that all users running Renovate as a GitHub App use `platformCommit`. +Renovate now defaults to `platformCommit` is enabled, when Renovate detects a GitHub App token. +For PATs, we still recommend regular commits. + +#### Log file configuration requires env settings + +File-based logging must be configured using environment variables (e.g. `LOG_FILE`). +Do _not_ set logging in files or CLI (such as `logFile`). + +This ensures that logging begins right when Renovate starts a run. +It also means Renovates logs how it parses the config. + +#### Changes to package matching + +Finally, we merged the `matchPackage*` and `excludePackage*` options into `matchPackageNames`. +We also enabled patterns for the `matchPackageNames` config option. -We recommend all users running as a GitHub App utilize `platformCommit` so have refactored it to default to enabled whenever a GitHub App token is detected. -For PATs, it's still recommend to use regular commits. +This means you can now use regex or glob patterns: -File-based logging must be configured using environment variables (e.g. `LOG_FILE`) now and not in file or CLI (such as `logFile`). -This to ensure that logging can begin at the start of Renovate execution and captures the parsing of configs too. +- `"matchPackageNames": "/^com.renovatebot/"` (regex) +- `"matchPackageNames": "@renovate/*"` (glob) -Finally, we have consolidated may `matchPackage*` and `excludePackage*` options into `matchPackageNames` by enabling patterns. -You can now do like `"matchPackageNames": "/^com.renovatebot/"` (regex) or `"matchPackageNames": "@renovate/*"` (glob) in addition to exact name matching. +And of course, you can still use exact name matching. ### Link to release notes for 38 From 7bf7d7ae37fe22b9a4aa42851f9700eafc0cc1b1 Mon Sep 17 00:00:00 2001 From: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> Date: Wed, 31 Jul 2024 14:57:32 +0200 Subject: [PATCH 9/9] Fix lint error --- docs/usage/release-notes-for-major-versions.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/usage/release-notes-for-major-versions.md b/docs/usage/release-notes-for-major-versions.md index d351222d2b8084..52178fad45408c 100644 --- a/docs/usage/release-notes-for-major-versions.md +++ b/docs/usage/release-notes-for-major-versions.md @@ -49,6 +49,7 @@ Our Docker images already use the correct version of Node.js. But if you self-host _without_ using our Docker image, then you must update the version of Node.js. You must update manually, if for example: you build your own image, or run the `renovate` npm package. + ##### Why we picked Node 20 We dropped Node.js 18, and do not yet support Node.js 22 as it's non-LTS and not recommended for production.