[pull] main from renovatebot:main

.github/workflows/find-issues-with-missing-labels.yml

@@ -5,6 +5,8 @@ on:
     # Run every Sunday at midnight
     - cron: '0 0 * * 0'
 
+permissions: {}
+
 jobs:
   check-unlabeled-issues:
     runs-on: ubuntu-latest

.github/workflows/undesirable-test-additions.yaml

@@ -4,6 +4,9 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
 
+permissions:
+  contents: read
+
 jobs:
   check_undesirable_code:
     if: "!contains(github.event.pull_request.labels.*.name, 'ci:allow-undesirable')"

.github/workflows/update-data.yml

@@ -7,8 +7,7 @@ on:
 env:
   NODE_VERSION: 22
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   update-data:

lib/modules/datasource/index.ts

@@ -388,7 +388,7 @@ function fetchCachedReleases(
   config: GetReleasesInternalConfig,
 ): Promise<ReleaseResult | null> {
   const { datasource, packageName, registryUrls } = config;
-  const cacheKey = `${cacheNamespace}${datasource}${packageName}${config.registryStrategy}${String(
+  const cacheKey = `datasource-mem:releases:${datasource}:${packageName}:${config.registryStrategy}:${String(
     registryUrls,
   )}`;
   // By returning a Promise and reusing it, we should only fetch each package at most once

lib/util/cache/memory/index.spec.ts

@@ -17,4 +17,52 @@ describe('util/cache/memory/index', () => {
     memCache.reset();
     expect(memCache.get('key3')).toBeUndefined();
   });
+
+  describe('cleanDatasourceKeys', () => {
+    beforeEach(() => {
+      memCache.init();
+    });
+
+    it('does nothing if no matching keys exist', () => {
+      memCache.set('normal-key', 'value');
+      memCache.set('another-key', 'data');
+      memCache.cleanDatasourceKeys();
+      expect(memCache.get('normal-key')).toBe('value');
+      expect(memCache.get('another-key')).toBe('data');
+    });
+
+    it('removes keys that start with datasource-mem:pkg-fetch:', () => {
+      memCache.set('datasource-mem:pkg-fetch:test', 'value');
+      memCache.set('normal-key', 'data');
+      memCache.cleanDatasourceKeys();
+      expect(memCache.get('datasource-mem:pkg-fetch:test')).toBeUndefined();
+      expect(memCache.get('normal-key')).toBe('data');
+    });
+
+    it('removes keys that start with datasource-releases', () => {
+      memCache.set('datasource-mem:pkg-fetch:npm', 'value');
+      memCache.set('normal-key', 'data');
+      memCache.cleanDatasourceKeys();
+      expect(memCache.get('datasource-mem:releases:npm')).toBeUndefined();
+      expect(memCache.get('normal-key')).toBe('data');
+    });
+
+    it('removes all matching keys while keeping others', () => {
+      memCache.set('datasource-mem:pkg-fetch:test1', 'value1');
+      memCache.set('datasource-mem:pkg-fetch:test2', 'value2');
+      memCache.set('datasource-mem:pkg-fetch:npm', 'npm-data');
+      memCache.set('datasource-mem:pkg-fetch:docker', 'docker-data');
+      memCache.set('normal-key1', 'normal1');
+      memCache.set('normal-key2', 'normal2');
+
+      memCache.cleanDatasourceKeys();
+
+      expect(memCache.get('datasource-mem:pkg-fetch:test1')).toBeUndefined();
+      expect(memCache.get('datasource-mem:pkg-fetch:test2')).toBeUndefined();
+      expect(memCache.get('datasource-mem:pkg-fetch:npm')).toBeUndefined();
+      expect(memCache.get('datasource-mem:pkg-fetch:docker')).toBeUndefined();
+      expect(memCache.get('normal-key1')).toBe('normal1');
+      expect(memCache.get('normal-key2')).toBe('normal2');
+    });
+  });
 });

lib/util/cache/memory/index.ts

@@ -1,19 +1,32 @@
-let repoCache: Record<string, any> | undefined;
+let memCache: Record<string, any> | undefined;
 
 export function init(): void {
-  repoCache = {};
+  memCache = {};
 }
 
 export function reset(): void {
-  repoCache = undefined;
+  memCache = undefined;
 }
 
 export function get<T = any>(key: string): T {
-  return repoCache?.[key];
+  return memCache?.[key];
 }
 
 export function set(key: string, value: unknown): void {
-  if (repoCache) {
-    repoCache[key] = value;
+  if (memCache) {
+    memCache[key] = value;
+  }
+}
+
+export function cleanDatasourceKeys(): void {
+  if (memCache) {
+    for (const key of Object.keys(memCache)) {
+      if (
+        key.startsWith('datasource-mem:pkg-fetch:') ||
+        key.startsWith('datasource-mem:releases:')
+      ) {
+        delete memCache[key];
+      }
+    }
   }
 }

lib/util/cache/package/key.spec.ts

@@ -4,7 +4,7 @@ describe('util/cache/package/key', () => {
   describe('getCombinedKey', () => {
     it('works', () => {
       expect(getCombinedKey('_test-namespace', 'foo:bar')).toBe(
-        'global%%_test-namespace%%foo:bar',
+        'datasource-mem:pkg-fetch:_test-namespace:foo:bar',
       );
     });
   });

lib/util/cache/package/key.ts

@@ -7,5 +7,5 @@ export function getCombinedKey(
   namespace: PackageCacheNamespace,
   key: string,
 ): CombinedKey {
-  return `global%%${namespace}%%${key}`;
+  return `datasource-mem:pkg-fetch:${namespace}:${key}`;
 }

lib/util/cache/package/types.ts

@@ -107,4 +107,5 @@ export type PackageCacheNamespace =
   | 'terraform-provider-hash'
   | 'url-sha256';
 
-export type CombinedKey = `global%%${PackageCacheNamespace}%%${string}`;
+export type CombinedKey =
+  `datasource-mem:pkg-fetch:${PackageCacheNamespace}:${string}`;

lib/util/exec/hermit.spec.ts

@@ -1,5 +1,5 @@
 import { codeBlock } from 'common-tags';
-import _findUp from 'find-up';
+import { findUp as _findUp } from 'find-up';
 import upath from 'upath';
 import { GlobalConfig } from '../../config/global';
 import { findHermitCwd, getHermitEnvs, isHermit } from './hermit';

lib/util/fs/index.spec.ts

@@ -1,4 +1,4 @@
-import _findUp from 'find-up';
+import { findUp as _findUp } from 'find-up';
 import fs from 'fs-extra';
 import type { DirectoryResult } from 'tmp-promise';
 import tmp from 'tmp-promise';

lib/util/fs/index.ts

@@ -1,7 +1,7 @@
 import stream from 'node:stream';
 import util from 'node:util';
 import is from '@sindresorhus/is';
-import findUp from 'find-up';
+import { findUp } from 'find-up';
 import fs from 'fs-extra';
 import upath from 'upath';
 import { GlobalConfig } from '../../config/global';

lib/workers/repository/process/extract-update.ts

@@ -4,6 +4,7 @@ import { logger } from '../../../logger';
 import { hashMap } from '../../../modules/manager';
 import type { PackageFile } from '../../../modules/manager/types';
 import { scm } from '../../../modules/platform/scm';
+import * as memCache from '../../../util/cache/memory';
 import { getCache } from '../../../util/cache/repository';
 import type { BaseBranchCache } from '../../../util/cache/repository/types';
 import { checkGithubToken as ensureGithubToken } from '../../../util/check-token';
@@ -212,6 +213,7 @@ export async function lookup(
 ): Promise<ExtractResult> {
   await fetchVulnerabilities(config, packageFiles);
   await fetchUpdates(config, packageFiles);
+  memCache.cleanDatasourceKeys();
   calculateLibYears(config, packageFiles);
   const { branches, branchList } = await branchifyUpgrades(
     config,

package.json

@@ -169,7 +169,7 @@
     "@opentelemetry/sdk-trace-base": "2.0.0",
     "@opentelemetry/sdk-trace-node": "2.0.0",
     "@opentelemetry/semantic-conventions": "1.32.0",
-    "@pnpm/parse-overrides": "1000.0.2",
+    "@pnpm/parse-overrides": "1001.0.0",
     "@qnighy/marshal": "0.1.3",
     "@renovatebot/detect-tools": "1.1.0",
     "@renovatebot/kbpgp": "4.0.1",
@@ -196,7 +196,7 @@
     "cronstrue": "2.59.0",
     "deepmerge": "4.3.1",
     "dequal": "2.0.3",
-    "detect-indent": "6.1.0",
+    "detect-indent": "7.0.1",
     "diff": "7.0.0",
     "editorconfig": "2.0.1",
     "email-addresses": "5.0.0",
@@ -205,7 +205,7 @@
     "emojibase-regex": "16.0.0",
     "extract-zip": "2.0.1",
     "find-packages": "10.0.4",
-    "find-up": "5.0.0",
+    "find-up": "7.0.0",
     "fs-extra": "11.3.0",
     "git-url-parse": "16.1.0",
     "github-url-from-git": "1.5.0",
@@ -219,7 +219,7 @@
     "ignore": "7.0.4",
     "ini": "5.0.0",
     "json-dup-key-validator": "1.0.3",
-    "json-stringify-pretty-compact": "3.0.0",
+    "json-stringify-pretty-compact": "4.0.0",
     "json5": "2.2.3",
     "jsonata": "2.0.6",
     "jsonc-parser": "3.3.1",
@@ -274,7 +274,7 @@
     "@ls-lint/ls-lint": "2.3.0",
     "@openpgp/web-stream-tools": "0.1.3",
     "@semantic-release/exec": "7.0.3",
-    "@smithy/util-stream": "3.3.4",
+    "@smithy/util-stream": "4.2.0",
     "@types/auth-header": "1.0.6",
     "@types/aws4": "1.11.6",
     "@types/better-sqlite3": "7.6.13",
@@ -310,7 +310,6 @@
     "@types/semver-utils": "1.1.3",
     "@types/tar": "6.1.13",
     "@types/tmp": "0.2.6",
-    "@types/url-join": "5.0.0",
     "@types/validate-npm-package-name": "4.0.2",
     "@types/xmldoc": "1.1.9",
     "@vitest/coverage-v8": "3.1.2",
@@ -342,7 +341,7 @@
     "semantic-release": "24.2.3",
     "tar": "7.4.3",
     "tmp-promise": "3.0.3",
-    "tsx": "4.19.3",
+    "tsx": "4.19.4",
     "type-fest": "4.40.1",
     "typescript": "5.8.3",
     "typescript-eslint": "8.31.1",