Feedback wanted: what's on your wishlist?

[jamietanna]

We (the Renovate maintainers) are looking to get an additional gauge of what's important to the community in terms of planned features/bug fixes.

In addition to our understanding of the needs of the community, requests from Mend's customers and the wider package management ecosystem, we'd like to see if we're missing any other signals.

Please follow the template below when commenting.

Please share a URL to an Issue/Discussion to more easily categorise the replies.
This means that it'd be very appreciated if you could ?? to see if there's already a feature request raised for it.

Template:

I am a (select multiple if appropriate):

- [ ] user
- [ ] person in a security-focussed role
- [ ] person in a legal-focussed role
- [ ] self-hosted administrator

<!-- NOTE: please only submit one distinct request per comment -->
Issue/Discussion I am interested in being implemented:

Why am I interested in this? <!-- This is optional, if you feel it's fairly self-explanatory - but additional context would be appreciated to help understand the needs -->

If someone has already posted the Issue/Discussion you're interested, please add an upvote to their comment. If there is any additional context you'd like to share about it, please add it in the threaded replies.

(Note that responding to this Discussion isn't definitely going to get it on our roadmap, but it'll help if we see a significant set of interest in a feature/bug that we've not seen indicated in other data before)

[Sironheart]

I am a (select multiple if appropriate):

• user
• person in a security-focussed role
• person in a legal-focussed role
• self-hosted administrator

Issue/Discussion I am interested in being implemented:
#38024

Why am I interested in this?
Especially in bigger ecosystems, the extends or the nestings/merges of different configurations, either from a central management or a per-repo, can be quite exhausting to understand/follow along.

Having a single point to look up the final position would be incredible. You wouldn't have to rely on having access to the pipeline logs or need to store them for some time to follow changes in those. You could enter the issue and see the most previously applied configuration. Having all information on a per-repository basis would be insanely valuable for (first) sanity checks.

[mschoettle]

I am a (select multiple if appropriate):

• user
• person in a security-focussed role
• person in a legal-focussed role
• self-hosted administrator

Issue/Discussion I am interested in being implemented: Config migration that keeps comments/formatting in JSON5/JSONC files (I am struggling to find the relevant issue, most relevant might be #27972)

Why am I interested in this?

We currently use JSON5 files to configure Renovate. We did this to use comments. I see that JSONC is supported now but there doesn't seem to be a way to use .jsonc files out-of-the-box. We've had to apply config migrations a few times but could not merge the PRs, and looking at the diff it was difficult to see what actually needed to change.

[guerda]

I am a (select multiple if appropriate):

• user
• person in a security-focussed role
• person in a legal-focussed role
• self-hosted administrator

Issue/Discussion I am interested in being implemented:

It would be great if Mend Renovate Cloud would support Codeberg.

Why am I interested in this?
Codeberg is a great repo hosting service which is less dependent on US services and it would be great if Mend Renovate would be usable with Codeberg too.

[guerda]

Ah, sorry, I meant the Developer Platform hosted by mend.io: https://developer.mend.io/

[SchroederSteffen]

I am a (select multiple if appropriate):

• user
• person in a security-focussed role
• person in a legal-focussed role
• self-hosted administrator

Issue/Discussion I am interested in being implemented:

• Renovate not creating PRs to update npm security vulnerabilities by Dependabot #28451

Why am I interested in this?
In most NPM projects, there are way more transitive security vulnerabilities reported than for direct dependencies.
As Renovate is not able to create PRs for transitive dependencies, this means that Renovate provides only little use to solve security updates.
We always have to manually trigger full lock file maintenances that bring in more updates than required.
Considering the recent increase in reported security vulnerabilities, it would be great if Renovate would support transitive security-related updates.

This was supported in the past but got removed:

• feat(npm)!: drop transitiveRemediation option #27985

[gaeljw]

transient transitive (for clarity :) )

[gaeljw]

This is not specific to NPM though. I guess it could make sense in most managers that support the ability to "override" a transitive dependency version (Maven/SBT would support that).

It means Renovate have knowledge of the transitive graph though. I guess it has with NPM lock file but not without specific manager knowledge (Maven/SBT dependency tree command to run/analyze).

I'm just thinking out loud :)

[SchroederSteffen]

transient transitive (for clarity :) )

Thank you! I edited my comment.

[carlos-lehmann]

• user
• person in a security-focussed role
• person in a legal-focussed role
• self-hosted administrator

Even tho it's mentioned here, that Renovate don't and won't approve it's own MR, I'd like to mention it here that we'd like to work with CODEOWNERS in a self-hosted Gitlab. There's no open issue for it I'm afraid.

[rachelf42]

I am a (select multiple if appropriate):

• user
• person in a security-focussed role
• person in a legal-focussed role
• self-hosted administrator

Issue/Discussion I am interested in being implemented: organization level dashboard

Why am I interested in this?

i run my homelab in a micro-repo architecture, so have many different repos all with their own renovate dashboards

it would be great if i had a centralized place i could go to see a summary of all repos's dashboards for everything under my gitlab group, just to keep an eye on things

[gaeljw]

+1

I haven't tried it yet but I was planning to use https://github.com/mogenius/renovate-operator which includes such a dashboard (I think?)