Merge branch 'main' into feat/gradle-content-descriptors

.devcontainer/Dockerfile

@@ -1 +1,5 @@
-FROM ghcr.io/containerbase/devcontainer:13.7.2
+FROM ghcr.io/containerbase/devcontainer:13.7.6
+
+# https://github.com/pnpm/pnpm/issues/8971
+# renovate: datasource=npm
+RUN install-tool pnpm 9.15.4

.devcontainer/post-create.sh

@@ -7,4 +7,4 @@ if [[ "${CODESPACES}" == true ]]; then
   sudo chmod 1777 /tmp
 fi
 
-COREPACK_ENABLE_DOWNLOAD_PROMPT=0 pnpm install
+pnpm install --reporter append-only --aggregate-output

.github/label-actions.yml

@@ -100,16 +100,6 @@
     </details>
 
 
-    ### Insufficient logs
-
-    <details><summary>Select me to read instructions</summary>
-
-
-    If you already gave us a log, and the Renovate team said it's not enough, then follow the instructions from the **No logs at all** section.
-
-    </details>
-
-
     ### Formatting your logs
 
     <details><summary>Select me to read instructions</summary>
@@ -137,12 +127,31 @@
 
     The Renovate team
 
+'auto:logs-insufficient':
+  comment: >
+    Hi there,
+
+
+    The logs you provided are insufficient to help you.
+
+
+    Please provide more logs, or more detailed logs, so we can help you. Be sure to include _DEBUG_ logs, and don't excessively redact or truncate them.
+
+
+    If you feel the logs are too large to paste here, please use a service like [GitHub Gist](https://gist.github.com/) and paste the link here.
+
+
+    Read the [Renovate docs, Troubleshooting](https://docs.renovatebot.com/troubleshooting/) to learn more about getting the correct logs.
+
+
+    Thanks, the Renovate team
+
 'auto:logs-packages':
   comment: >
     Hi there,
 
 
-    A maintainer wants you to find and share a specific log message (`packageFiles with updates`) from your repository or environment.
+    Please locate the debug message `packageFiles with updates` in your logs and paste the contents here. Depending on your question, we may need the full list of packages or only one.
 
 
     If you self-host Renovate: make sure you run Renovate with `LOG_LEVEL=debug` to get the debug log messages! Next, open the debug-level logs and search for `packageFiles with updates`. This text marks the start of a structured log message that shows every package file, dependency, and update that Renovate found.
@@ -263,6 +272,21 @@
     Good luck,
 
 
+    The Renovate team
+
+'auto:no-merge-from-main':
+  comment: >
+    Hi there,
+
+
+    Please don't merge from `main` into your PR's branch unless you have a merge conflict or have a specific reason to do so.
+    Doing so consumes CI systems unnecessarily, and also resets CI approvals if this is your first PR to the repo.
+    This repo uses GitHub's Merge Queue, which will automatically test your PR against `main` before merging, so it's no longer necessary to always keep branches up-to-date.
+
+
+    Thanks,
+
+
     The Renovate team
 
 'auto:discussion-first':
@@ -516,3 +540,25 @@
 
 
     Thanks, the Renovate team
+
+'auto:inactive-pr':
+  comment: >
+    Hi there,
+
+
+    This PR appears to have been inactive for a while. Please let us know if you are still working on it, or if we can close it for now.
+
+
+    Thanks, the Renovate team
+
+'auto:close-inactive-pr':
+  comment: >
+    Hi there,
+
+
+    We're closing this PR due to inactivity, but we are happy for you, or others, to finish the PR if time allows.
+
+
+    Thanks, the Renovate team
+
+  close: true

.github/workflows/build.yml

@@ -690,7 +690,7 @@ jobs:
           show-progress: false
 
       - name: docker-config
-        uses: containerbase/internal-tools@1d0c5b3aabe4a10a264d309f65ecbbd83d0e672e # v3.5.21
+        uses: containerbase/internal-tools@bbbf98bb61968071a4052c89fccd25a292d69c73 # v3.5.22
         with:
           command: docker-config
 

.github/workflows/codeql-analysis.yml

@@ -41,7 +41,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4 # v3.28.5
+        uses: github/codeql-action/init@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
         with:
           languages: javascript
 
@@ -51,7 +51,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4 # v3.28.5
+        uses: github/codeql-action/autobuild@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -65,4 +65,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4 # v3.28.5
+        uses: github/codeql-action/analyze@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8

.github/workflows/scorecard.yml

@@ -51,6 +51,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: 'Upload to code-scanning'
-        uses: github/codeql-action/upload-sarif@f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4 # v3.28.5
+        uses: github/codeql-action/upload-sarif@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
         with:
           sarif_file: results.sarif

.github/workflows/trivy.yml

@@ -31,7 +31,7 @@ jobs:
           format: 'sarif'
           output: 'trivy-results.sarif'
 
-      - uses: github/codeql-action/upload-sarif@f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4 # v3.28.5
+      - uses: github/codeql-action/upload-sarif@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
         with:
           sarif_file: trivy-results.sarif
           category: 'docker-image-${{ matrix.tag }}'

docs/development/local-development.md

@@ -12,7 +12,7 @@ You need the following dependencies for local development:
 
 - Git `>=2.45.1`
 - Node.js `^20.15.1`
-- pnpm `^9.0.0` (use corepack)
+- pnpm `^9.0.0`
 - C++ compiler
 
 We recommend you use the version of Node.js defined in the repository's `.nvmrc` or use [Volta](https://volta.sh/) to manage your tool versions.
@@ -26,12 +26,12 @@ You can use the following commands on Ubuntu.
 curl -sL https://deb.nodesource.com/setup_20.x | sudo -E bash -
 sudo apt-get update
 sudo apt-get install -y git build-essential nodejs
-corepack enable
+npm install -g pnpm@latest-10
 ```
 
 #### Nix
 
-To enter a development shell with the necessary packages, run `nix-shell --packages gcc gitFull nodejs` and then `corepack enable`.
+To enter a development shell with the necessary packages, run `nix-shell --packages gcc gitFull nodejs` and then `npm install -global pnpm@latest-10`.
 
 #### Windows
 
@@ -41,7 +41,7 @@ If you already installed a part, skip the corresponding step.
 - Install [Git](https://git-scm.com/downloads). Make sure you've [configured your username and email](https://git-scm.com/book/en/v2/Getting-Started-First-Time-Git-Setup)
 - Install [Node.js LTS](https://nodejs.org/en/download/)
 - In an Administrator PowerShell prompt, run `npm install -global npm` and then `npm --debug install --global windows-build-tools`
-- Enable corepack with: `corepack enable`
+- Install pnpm with: `npm install -global pnpm@latest-10`
 
   You can see what versions you're using like this:
 

docs/usage/bazel.md

@@ -80,6 +80,7 @@ If Renovate finds a newer version, it updates `0.15.0` to match that version.
 #### `git_override`
 
 If Renovate finds a [`git_override`](https://bazel.build/rules/lib/globals/module#git_override), it ignores the related `bazel_dep` entry and instead evaluates the `commit` value at the specified `remote`.
+When using `git_override`, the `version` parameter on the `bazel_dep` is optional.
 
 ```python
 bazel_dep(name = "cgrindel_bazel_starlib", version = "0.15.0")
@@ -89,6 +90,13 @@ git_override(
     commit = "fb47f0e9f7c376a7700fc9fe3319231ae57880df",
     remote = "https://github.com/cgrindel/bazel-starlib.git",
 )
+
+bazel_dep(name = "rules_foo")
+git_override(
+    module_name = "rules_foo",
+    remote = "https://github.com/foo/rules_foo.git",
+    commit = "8a1e9abe415eda7cd7f2a744fdac7499ce42cdca",
+)
 ```
 
 If the primary branch has a newer commit than in the list, Renovate updates the `commit` value.
@@ -101,6 +109,7 @@ Renovate only evaluates _two_ attributes from this declaration: `version` and `r
 If a `version` is specified, it overrides the version in the `bazel_dep`.
 In the following example, Renovate notices that the version is pinned to `1.2.3`.
 This results in `rules_foo` being ignored for update evaluation.
+When using `single_version_override`, the `version` parameter on the `bazel_dep` is optional.
 
 ```python
 bazel_dep(name = "rules_foo", version = "1.2.4")
@@ -109,6 +118,13 @@ single_version_override(
   module_name = "rules_foo",
   version = "1.2.3",
 )
+
+bazel_dep(name = "rules_bar")
+
+single_version_override(
+  module_name = "rules_bar",
+  version = "1.2.3",
+)
 ```
 
 If a `registry` is specified, Renovate uses the specified registry URL to check for a new version.
@@ -128,6 +144,7 @@ single_version_override(
 
 If Renovate finds an [`archive_override`](https://bazel.build/rules/lib/globals/module#archive_override) or a [`local_path_override`](https://bazel.build/rules/lib/globals/module#local_path_override), it ignores the related `bazel_dep`.
 Because these declarations lack versionable attributes, Renovate does not update them.
+When using `archive_override` and `local_path_override`, the `version` parameter on the `bazel_dep` is optional.
 
 ```python
 bazel_dep(name = "rules_foo", version = "1.2.3")
@@ -138,6 +155,15 @@ archive_override(
     "https://example.com/archive.tar.gz",
   ],
 )
+
+bazel_dep(name = "rules_bar")
+
+archive_override(
+  module_name = "rules_bar",
+  urls = [
+    "https://example.com/archive.tar.gz",
+  ],
+)
 ```
 
 #### `multiple_version_override`