fix: pin npm:cpd to 5.0.10, catch custom.regex managers in mise.toml Renovate rule - #50
Merged
Conversation
Its .jinja extension keeps it out of tombi's default **/*.toml glob, so it wasn't getting linted despite being kept parseable as raw TOML.
hk-config's own renovate.json custom.regex manager bumps the `hk = "..."` line in mise.toml directly (grouped with hk.pkl's pin, by design) - a different manager identity than the built-in `mise` manager the existing disable rule matched on. That let hugoh/upd#313 open a Renovate PR bumping hk in mise.toml even though Copier already owns that pin. Broaden matchManagers to catch both.
cpd@5.0.12 pins broken jscpd-*@5.0.11 platform packages that were never published to npm. cpd@5.0.13 drops npm provenance attestation that every prior version (through 5.0.12) had, tripping aube's trust-downgrade guard when the npm backend enforces it. 5.0.10 is the last version that's both correctly pinned and fully attested.
2 tasks
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
template/mise.toml.jinja(its.jinjaextension kept it out of tombi's default**/*.tomlglob).mise.tomlRenovate disable rule to also matchcustom.regexmanagers, not just the built-inmisemanager. hk-config's owncustom.regexmanager bumps thehk = "..."line inmise.tomldirectly, and wasn't covered - that let chore(deps): update dependency jdx/hk to v1.53.0 - autoclosed upd#313 open a Renovate PR bumpinghkeven though Copier already owns that pin.npm:cpdto5.0.10:cpd@5.0.12pins brokenjscpd-*@5.0.11platform packages that were never published to npm;cpd@5.0.13drops npm provenance attestation that every prior version (through 5.0.12) had.5.0.10is the last version that's both correctly pinned and fully attested.Split out of #49: these three are safe to land on any mise version. The
mise installhardening that actually caught thecpdregression (forcing theaubenpm backend inrender-check) stays in #49, since it needs a mise release that auto-installsaubeon demand.Test plan
mise-tasks/render-checkpasses locally