.devcontainer/Dockerfile

-FROM ghcr.io/containerbase/node:18.16.1
+FROM ghcr.io/containerbase/node:20.9.0
 
 USER root
 
 RUN install-apt make g++
 
 # renovate: datasource=github-releases packageName=containerbase/python-prebuild
-RUN install-tool python 3.11.4
+RUN install-tool python 3.12.0
 
 # renovate: datasource=npm
-RUN install-tool yarn 1.22.19
+RUN install-tool corepack 0.22.0
+
+USER ubuntu

.devcontainer/devcontainer.json

 {
   "$schema": "https://raw.githubusercontent.com/devcontainers/spec/main/schemas/devContainer.schema.json",
+  "name": "Renovate",
+  "dockerFile": "Dockerfile",
+  "features": {
+    "ghcr.io/devcontainers/features/common-utils:2": {}
+  },
+  "capAdd": ["SYS_PTRACE"],
+  "privileged": true,
+  "securityOpt": ["seccomp=unconfined"],
   "hostRequirements": {
     "cpus": 4,
     "memory": "7gb",
     "storage": "32gb"
   },
-  "name": "Renovate",
-  "dockerFile": "Dockerfile",
   "customizations": {
     "vscode": {
-      "settings": {
-        "terminal.integrated.profiles.linux": {
-          "bash": { "path": "/bin/bash" }
-        },
-        "terminal.integrated.defaultProfile.linux": "bash"
-      },
       "extensions": [
         "dbaeumer.vscode-eslint",
         "esbenp.prettier-vscode",
@@ -24,11 +24,7 @@
       ]
     }
   },
-  "runArgs": [
-    "--cap-add=SYS_PTRACE",
-    "--security-opt",
-    "seccomp=unconfined",
-    "--privileged"
-  ],
-  "postCreateCommand": "yarn install"
+  "postCreateCommand": [".devcontainer/post-create.sh"],
+  // Otherwise jest watcher fails because deps were not installed yet
+  "waitFor": "postCreateCommand"
 }

.devcontainer/post-create.sh

+#!/bin/bash
+
+set -e
+
+if [[ "${CODESPACES}" == true ]]; then
+  echo "Fixing permissions of /tmp for GitHub Codespaces..." >&2
+  sudo chmod 1777 /tmp
+fi
+
+set -x
+
+exec pnpm install

.eslintrc.js

@@ -100,7 +100,7 @@ module.exports = {
 
     // TODO: fix lint
     '@typescript-eslint/no-explicit-any': 0,
-    // TODO: https://github.com/renovatebot/renovate/issues/7154
+    // TODO: https://github.com/renovatebot/renovate/discussions/22198
     '@typescript-eslint/no-non-null-assertion': 0,
     '@typescript-eslint/no-unused-vars': [
       2,

.github/CODEOWNERS

-/lib/modules/manager/git-submodules/           @JamieMagee
-
-/lib/modules/platform/azure/                   @JamieMagee

.github/DISCUSSION_TEMPLATE/ask-a-question.yml

@@ -27,7 +27,7 @@ body:
         - 'Azure DevOps Server'
         - 'Bitbucket Cloud (bitbucket.org)'
         - 'Bitbucket Server'
-        - 'Gitea'
+        - 'Gitea or Forgejo'
         - 'github.com'
         - 'GitHub Enterprise Server'
         - 'gitlab.com'
@@ -40,6 +40,7 @@ body:
     attributes:
       label: Was this something which used to work for you, and then stopped?
       options:
+        - 'Placeholder value, please select the correct response from the dropdown'
         - 'It used to work, and then stopped'
         - 'I never saw this working'
     validations:

.github/ISSUE_TEMPLATE/administration-only.yml

 name: Administration only
 description: For administrators only
-labels: ['status:ready', 'priority-3-medium', 'needs-discussion']
+labels: ['priority-3-medium', 'needs-discussion']
 body:
   - type: markdown
     attributes:
@@ -21,13 +21,6 @@ body:
     validations:
       required: true
 
-  - type: textarea
-    id: describe-why-we-need-want-these-changes
-    attributes:
-      label: Describe why we need/want these change(s).
-    validations:
-      required: true
-
   - type: markdown
     attributes:
       value: '# Reminder for administrators:'

.github/actions/calculate-prefetch-matrix/action.yml

@@ -26,7 +26,7 @@ runs:
     - name: Calculate cache keys
       id: cache-keys
       env:
-        HASH: ${{ hashFiles('yarn.lock') }}
+        HASH: ${{ hashFiles('pnpm-lock.yaml') }}
       shell: bash
       run: |
         echo 'MACOS_KEY=node_modules-macOS-${{ inputs.node-version }}-${{ env.HASH }}' >> "$GITHUB_ENV"
@@ -34,7 +34,7 @@ runs:
 
     - name: Check cache miss for MacOS
       id: macos-cache
-      uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+      uses: actions/cache/restore@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
       with:
         path: node_modules
         key: ${{ env.MACOS_KEY }}
@@ -43,7 +43,7 @@ runs:
 
     - name: Check cache miss for Windows
       id: windows-cache
-      uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+      uses: actions/cache/restore@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
       with:
         path: node_modules
         key: ${{ env.WINDOWS_KEY }}

.github/actions/setup-node/action.yml

@@ -17,7 +17,7 @@ inputs:
   save-cache:
     description: 'Save cache when needed'
     required: false
-    default: false
+    default: 'false'
 runs:
   using: 'composite'
   steps:
@@ -29,12 +29,12 @@ runs:
         }}-${{
           inputs.node-version
         }}-${{
-          hashFiles('yarn.lock')
+          hashFiles('pnpm-lock.yaml')
         }}' >> "$GITHUB_ENV"
 
     - name: Restore `node_modules`
       id: node-modules-restore
-      uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+      uses: actions/cache/restore@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
       with:
         path: node_modules
         key: ${{ env.CACHE_KEY }}
@@ -47,25 +47,27 @@ runs:
           (steps.node-modules-restore.outputs.cache-hit == 'true') && 'true' || ''
         }}' >> "$GITHUB_ENV"
 
+    - name: Enable corepack
+      shell: bash
+      run: corepack enable
+
     - name: Setup Node
-      uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
+      uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
       with:
         node-version: ${{ inputs.node-version }}
-        cache: ${{ env.CACHE_HIT != 'true' && 'yarn' || '' }}
+        cache: ${{ env.CACHE_HIT != 'true' && 'pnpm' || '' }}
 
     - name: Install dependencies
-      uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd # v2.8.3
+      uses: nick-fields/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2.9.0
       if: env.CACHE_HIT != 'true'
       with:
         timeout_minutes: 10
         max_attempts: 3
-        command: |
-          yarn install --frozen-lockfile --ignore-scripts
-          yarn prepare:re2
+        command: pnpm install
 
     - name: Write `node_modules` cache
       if: inputs.save-cache == 'true' && env.CACHE_HIT != 'true'
-      uses: actions/cache/save@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+      uses: actions/cache/save@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
       with:
         path: node_modules
         key: ${{ env.CACHE_KEY }}
@@ -75,7 +77,7 @@ runs:
       shell: bash
       run: >
         if [[ -d lib ]]; then
-          yarn prepare:generate;
+          pnpm prepare:generate;
         fi
 
     - name: Git config

.github/contributing.md

@@ -31,7 +31,40 @@ Before you start any Pull Request, it's recommended that you open a [discussion]
 That way you can be sure that the maintainer(s) agree on what to change and how, and you can hopefully get a quick merge afterwards.
 Also, let the maintainers know that you plan to work on a particular issue so that no one else starts any duplicate work.
 
-Pull Requests can only be merged once all status checks are green, which means `yarn test` passes, and coverage is 100%.
+### Tests
+
+Pull Requests can only be merged once all status checks are green, which means `pnpm test` passes, and coverage is 100%.
+
+Use these commands to help run your tests:
+
+- To run a single test folder, specify the path
+
+  ```bash
+  pnpm jest platform/gitlab
+  ```
+
+- To run against a single test file, specify down to the filename (suffix is not necessary)
+
+  ```bash
+  pnpm jest platform/gitlab/index
+  ```
+
+- To run a single test batch, the `-t` value must be part of the `describe` value of the test batch
+
+  ```bash
+  pnpm jest platform/gitlab/index -t "getJsonFile"
+  ```
+
+- To run a single test, the `-t` value must be part of the `it` value of the test batch
+
+  ```bash
+  pnpm jest platform/gitlab/index -t "returns file content from given repo"
+  ```
+
+And some options:
+
+- `--verbose=false` to avoid the test list
+- `--collectCoverage=false` to avoid collecting coverage, faster for the part you need the test to pass
 
 ## Do not force push to your pull request branch
 
@@ -59,8 +92,8 @@ Read the [GitHub docs, Applying suggested changes](https://docs.github.com/en/pu
 
 ## Resolve review comments instead of commenting
 
-A maintainer/contributor can ask you to make changes, without providing a suggestion that you can apply.
-In this case you need to do some work yourself to address the feedback.
+A maintainer/contributor can ask you to make changes, without giving you a _suggestion_ that you can apply.
+In this case you should make the necessary changes.
 
 Once you've done the work, resolve the conversation by selecting the **Resolve conversation** button in the PR overview.
 Avoid posting comments like "I've done the work", or "Done".

.github/label-actions.yml

-'reproduction:needed':
+'auto:reproduction':
   comment: >
     Hi there,
 
 
-    Get your issue fixed faster by creating a minimal reproduction.
+    Get your discussion fixed faster by creating a minimal reproduction.
     This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.
 
 
@@ -14,7 +14,7 @@
     To get started, please read our guide on creating a [minimal reproduction](https://github.com/renovatebot/renovate/blob/main/docs/development/minimal-reproductions.md).
 
 
-    We may close the issue if you, or someone else, haven't created a minimal reproduction within two weeks.
+    We may close the discussion if you, or someone else, haven't created a minimal reproduction within two weeks.
     If you need more time, or are stuck, please ask for help or more time in a comment.
 
 
@@ -23,7 +23,7 @@
 
     The Renovate team
 
-'needs-logs':
+'auto:logs':
   comment: >
     Hi there,
 
@@ -119,7 +119,7 @@
 
     The Renovate team
 
-'retry latest version':
+'auto:retry-latest':
   comment: >
     Hi there,
 
@@ -133,7 +133,7 @@
 
     The Renovate team
 
-'pr:no-coverage-ignore':
+'auto:no-coverage-ignore':
   comment: >
     Hi there,
 
@@ -163,7 +163,7 @@
 
     The Renovate team
 
-'pr:no-done-comments':
+'auto:no-done-comments':
   comment: >
     Hi there,
 
@@ -178,7 +178,7 @@
 
     The Renovate team
 
-'pr:discussion-first':
+'auto:discussion-first':
   comment: >
     **Please create a GitHub Discussion before continuing with this PR.**
 
@@ -190,7 +190,7 @@
     Thanks, the Renovate team
   close: true
 
-'needs-details':
+'auto:more-details':
   comment: >
     Hi there,
 
@@ -202,7 +202,6 @@
   unlabel:
     - 'type:bug'
     - 'type:feature'
-    - 'priority-5-triage'
     - 'status:requirements'
   comment: >
     **Please create a GitHub Discussion instead of this issue.**
@@ -217,10 +216,8 @@
     Thanks, the Renovate team
   close: true
   close-reason: 'not planned'
-  lock: true
-  lock-reason: 'resolved'
 
-'format-code-comments':
+'auto:format-code':
   comment: >
     Hi, please format any copy/pasted code or logs so they're readable.
 
@@ -228,4 +225,80 @@
     You can find a Markdown code formatting guide [here](https://www.markdownguide.org/basic-syntax/#code) as well as some GitHub-specific information formatting code blocks [here](https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks).
 
 
+    Thanks, the Renovate team
+
+'auto:discussion-closed':
+  comment: >
+    Hi there,
+
+
+    We're closing this discussion because it's missing some details, or because something else about it made it hard or impossible for us to help resolve the issue.
+
+
+    We want high quality discussions, so users can search them for answers.
+    This means we'll close (and later delete) low quality discussions.
+
+
+    You are welcome to create a new discussion with more details in future.
+
+
+    Thanks, the Renovate team.
+  close: true
+  close-reason: 'not planned'
+
+'auto:bad-vibes':
+  comment: >
+    Hi there,
+
+    A maintainer has flagged this discussion as giving off some bad vibes. **Maintainers will no longer participate in this discussion unless/until such "vibes" are resolved.**
+
+
+    This is typically when someone is overly critical of the product or the assistance they're receiving.
+    Or being unreasonably demanding or lazy, such as refusing to provide logs, or other information, when asked.
+
+
+    Open Source means you're welcome to use the software with few limits applied.
+    But you should _not_ give maintainers a bad day or contribute to Open Source burnout.
+
+
+    If you feel this message is wrong or due to a misunderstanding, please let us know. If you see this message but don't take it as a sign to cool off or back off, we may close the discussion and block you from the repository.
+
+
+    If you want to get the discussion back on track, we would like you to:
+    - Remove, or edit, the bad vibes parts of your comments
+    - Say that you understand the problem (we don't need a lengthy apology)
+    - Stop giving off more bad vibes
+
+
+    If you're unhappy with this, we suggest you stop using the repository discussions or the product altogether.
+
+
+    Thanks, the Renovate team
+
+'auto:one-topic':
+  comment: >
+    Hi there,
+
+    Please stick to one topic/question per Discussion. Start a new discussion per topic.
+
+    This prevents future users from finding this discussion and getting confused by multiple questions and answers. One question and answer per Discussion works best.
+
+    For example:
+     - Don't create a discussion with multiple questions requiring multiple answers
+     - If you got an answer to your first question, don't change topic like "Can I also ask you how I might..." which would then require a different answer. Mark the current discussion as answered and open a new one.
+
+
+    Thanks, the Renovate team
+
+'auto:no-mentions':
+  comment: >
+    Hi there,
+
+    Please do not unnecessarily `@` mention maintainers like `@rarkins` or `@viceice`. Doing so causes annoying notifications and makes it harder to maintain this repository.
+
+    For example, never `@` mention a maintainer when you are creating a discussion if your desire is to get attention. This is rude behavior, just like shouting out your coffee order in a Starbucks before it's your turn.
+
+    It's OK to comment in an issue or discussion after multiple days or weeks. But please, still don't `@` mention people. The maintainers try to answer most discussions, but they can't answer all discussions. If you're still not getting an answer, take a look at the information you've given us and see if you can improve it.
+
+
     Thanks, the Renovate team

.github/workflows/build.yml

@@ -38,7 +38,7 @@ env:
     data/
     tools/
     package.json
-    yarn.lock
+    pnpm-lock.yaml
     codecov.yml
 
 jobs:
@@ -94,7 +94,7 @@ jobs:
         run: gh api ${{ env.PR_URL }} | jq -rc '${{ env.JQ_FILTER }}' >> "$GITHUB_OUTPUT"
 
       - name: Checkout code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           sparse-checkout: ${{ env.SPARSE_CHECKOUT }}
 
@@ -121,7 +121,7 @@ jobs:
           FILTER_SHARDS: ${{ github.event.pull_request.draft && 'true' || '' }}
           CHANGED_FILES: ${{ steps.changed-files.outputs.changed-files }}
         run: |
-          echo "$(yarn -s schedule-test-shards)" >> "$GITHUB_OUTPUT"
+          echo "$(pnpm -s schedule-test-shards)" >> "$GITHUB_OUTPUT"
 
   prefetch:
     needs: [setup]
@@ -150,7 +150,7 @@ jobs:
     steps:
       - name: Checkout code
         if: needs.setup.outputs.os-matrix-is-full && runner.os != 'Linux'
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           sparse-checkout: ${{ env.SPARSE_CHECKOUT }}
 
@@ -172,7 +172,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
@@ -181,13 +181,13 @@ jobs:
           os: ${{ runner.os }}
 
       - name: Restore eslint cache
-        uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+        uses: actions/cache/restore@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: .cache/eslint
           key: eslint-main-cache
 
       - name: Lint
-        run: yarn -s eslint-ci
+        run: pnpm eslint-ci
 
       - name: Remove cache
         if: github.event_name == 'push'
@@ -200,7 +200,7 @@ jobs:
 
       - name: Save eslint cache
         if: github.event_name == 'push'
-        uses: actions/cache/save@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+        uses: actions/cache/save@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: .cache/eslint
           key: eslint-main-cache
@@ -215,7 +215,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
@@ -224,13 +224,13 @@ jobs:
           os: ${{ runner.os }}
 
       - name: Restore prettier cache
-        uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+        uses: actions/cache/restore@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: .cache/prettier
           key: prettier-main-cache
 
       - name: Lint
-        run: yarn -s prettier --cache-location .cache/prettier
+        run: pnpm prettier --cache-location .cache/prettier
 
       - name: Remove cache
         if: github.event_name == 'push'
@@ -243,7 +243,7 @@ jobs:
 
       - name: Save prettier cache
         if: github.event_name == 'push'
-        uses: actions/cache/save@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+        uses: actions/cache/save@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: .cache/prettier
           key: prettier-main-cache
@@ -255,7 +255,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
@@ -264,13 +264,16 @@ jobs:
           os: ${{ runner.os }}
 
       - name: Lint markdown
-        uses: DavidAnson/markdownlint-cli2-action@bb4bb94c73936643d73d345b48fead3e96f90a5e # v10.0.1
+        uses: DavidAnson/markdownlint-cli2-action@ed4dec634fd2ef689c7061d5647371d8248064f1 # v13.0.0
 
       - name: Lint fenced code blocks
-        run: yarn -s doc-fence-check
+        run: pnpm doc-fence-check
 
-      - name: Lint website docs
-        run: yarn -s lint-website-docs
+      - name: Lint documentation
+        run: pnpm lint-documentation
+
+      - name: Markdown lint
+        run: pnpm markdown-lint
 
   lint-other:
     needs: [setup]
@@ -279,7 +282,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
@@ -287,14 +290,17 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           os: ${{ runner.os }}
 
+      - name: Type check
+        run: pnpm type-check
+
       - name: Lint project file structure
-        run: yarn -s ls-lint
+        run: pnpm ls-lint
 
       - name: Check git version
-        run: yarn -s git-check
+        run: pnpm git-check
 
       - name: Test schema
-        run: yarn -s test-schema
+        run: pnpm test-schema
 
   test:
     needs: [setup, prefetch]
@@ -313,7 +319,7 @@ jobs:
         include: ${{ fromJSON(needs.setup.outputs.test-shard-matrix) }}
 
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
@@ -322,7 +328,7 @@ jobs:
           os: ${{ runner.os }}
 
       - name: Cache jest
-        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: .cache/jest
           key: |
@@ -331,7 +337,7 @@ jobs:
             }}-${{
               env.NODE_VERSION
             }}-${{
-              hashFiles('yarn.lock')
+              hashFiles('pnpm-lock.yaml')
             }}-${{
               matrix.cache-key
             }}
@@ -341,7 +347,7 @@ jobs:
         run: |
           for shard in ${{ matrix.shards }};
           do
-            TEST_SHARD="$shard" yarn -s jest \
+            TEST_SHARD="$shard" pnpm jest \
               --ci \
               --test-timeout ${{ matrix.test-timeout-milliseconds }} \
               --coverage ${{ matrix.coverage }}
@@ -360,7 +366,7 @@ jobs:
 
       - name: Save coverage artifacts
         if: (success() || failure()) && github.event.pull_request.draft != true && matrix.coverage
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: coverage
           path: |
@@ -374,7 +380,7 @@ jobs:
     if: (success() || failure()) && github.event.pull_request.draft != true
     steps:
       - name: Checkout code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           sparse-checkout: ${{ env.SPARSE_CHECKOUT }}
 
@@ -396,12 +402,15 @@ jobs:
           os: ${{ runner.os }}
 
       - name: Merge coverage reports
-        run: yarn -s nyc merge ./coverage/json ./coverage/nyc/coverage.json
+        run: pnpm nyc merge ./coverage/json ./coverage/nyc/coverage.json
+
+      - name: Report coverage
+        run: pnpm nyc report -t ./coverage/nyc --skip-full -r text -r text-summary
 
       - name: Check coverage threshold
         run: |
-          yarn -s nyc check-coverage -t ./coverage/nyc \
-            --branches 98 \
+          pnpm nyc check-coverage -t ./coverage/nyc \
+            --branches 100 \
             --functions 100 \
             --lines 100 \
             --statements 100
@@ -446,7 +455,7 @@ jobs:
     if: github.event.pull_request.draft != true
     steps:
       - name: Checkout code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
@@ -455,16 +464,16 @@ jobs:
           os: ${{ runner.os }}
 
       - name: Build
-        run: yarn -s build
+        run: pnpm build
 
       - name: Pack
-        run: yarn -s test-e2e:pack
+        run: pnpm test-e2e:pack
 
       - name: Upload
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: renovate-package
-          path: renovate-v0.0.0-semantic-release.tgz
+          path: renovate-0.0.0-semantic-release.tgz
 
   build-docs:
     needs: [lint-docs]
@@ -473,7 +482,7 @@ jobs:
     if: github.event.pull_request.draft != true
     steps:
       - name: Checkout code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
@@ -482,10 +491,10 @@ jobs:
           os: ${{ runner.os }}
 
       - name: Build
-        run: yarn -s build:docs
+        run: pnpm build:docs
 
       - name: Upload
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: docs
           path: tmp/docs/
@@ -499,23 +508,27 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
+      - name: Enable corepack
+        shell: bash
+        run: corepack enable
+
       - name: Download package
         uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: renovate-package
 
       - name: Install dependencies
-        run: yarn -s test-e2e:install
+        run: pnpm test-e2e:install
 
       - name: E2E Test
-        run: yarn -s test-e2e:run
+        run: pnpm test-e2e:run
 
   release:
     needs:
@@ -538,7 +551,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0 # zero stands for full checkout, which is required for semantic-release
 
@@ -560,8 +573,8 @@ jobs:
 
       - name: semantic-release
         run: |
-          echo '//registry.yarnpkg.com/:_authToken=${NPM_TOKEN}' >> ./.npmrc
-          yarn -s semantic-release --dry-run ${{env.DRY_RUN}}
+          echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' >> ./.npmrc
+          pnpm semantic-release --dry-run ${{env.DRY_RUN}}
           git checkout -- .npmrc
         env:
           GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}

.github/workflows/codeql-analysis.yml

@@ -21,15 +21,17 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
-  security-events: write
+  contents: read
 
 jobs:
   CodeQL-Build:
     runs-on: ubuntu-latest
     if: github.event.pull_request.draft != true
+    permissions:
+      security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Delete fixtures to suppress false positives
         run: |
@@ -37,7 +39,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f6e388ebf0efc915c6c5b165b019ee61a6746a38 # v2.20.1
+        uses: github/codeql-action/init@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5
         with:
           languages: javascript
 
@@ -47,7 +49,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@f6e388ebf0efc915c6c5b165b019ee61a6746a38 # v2.20.1
+        uses: github/codeql-action/autobuild@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -61,4 +63,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f6e388ebf0efc915c6c5b165b019ee61a6746a38 # v2.20.1
+        uses: github/codeql-action/analyze@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5

.github/workflows/dependency-review.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@1360a344ccb0ab6e9475edef90ad2f46bf8003b1 # v3.0.6
+        uses: actions/dependency-review-action@6c5ccdad469c9f8a2996bfecaec55a631a347034 # v3.1.0

.github/workflows/devcontainer.yml

@@ -9,15 +9,18 @@ on:
       - reopened
       - ready_for_review
 
+permissions:
+  contents: read
+
 jobs:
   devcontainer-test:
     runs-on: ubuntu-latest
     if: github.event.pull_request.draft != true
     steps:
       - name: Checkout
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Build and run dev container task
         uses: devcontainers/ci@57eaf0c9b518a76872bc429cdceefd65a912309b # v0.3.1900000329
         with:
-          runCmd: yarn build
+          runCmd: pnpm build

.github/workflows/mend-slack.yml

+name: 'Mend Slack Notifier'
+
+on:
+  discussion:
+    types: [labeled]
+
+permissions:
+  discussions: read
+
+jobs:
+  slack:
+    if: contains(github.event.label.name, 'mend-app')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Post to Slack
+        id: slack
+        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
+        with:
+          channel-id: 'C05NLTMGCJC'
+          # For posting a simple plain text message
+          slack-message: '<${{ github.event.discussion.html_url }}|${{ github.event.discussion.title }}>'
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

.github/workflows/release-npm.yml

@@ -39,15 +39,19 @@ jobs:
             echo "NPM_TAG=${{ github.event.inputs.tag }}" >> "$GITHUB_ENV"
           fi
 
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           ref: ${{ env.GIT_SHA }}
 
+      - name: Enable corepack
+        shell: bash
+        run: corepack enable
+
       - name: Set up Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: yarn
+          cache: pnpm
 
       - name: Init platform
         run: |
@@ -55,17 +59,16 @@ jobs:
           git config --global core.symlinks true
           git config --global user.email 'renovate@whitesourcesoftware.com'
           git config --global user.name  'Renovate Bot'
-          yarn config set version-git-tag false
 
       - name: Installing dependencies
-        uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd # v2.8.3
+        uses: nick-fields/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2.9.0
         with:
           timeout_minutes: 10
           max_attempts: 3
-          command: yarn install --frozen-lockfile
+          command: pnpm install
 
       - name: Build ${{ env.NPM_VERSION }}
-        run: yarn build
+        run: pnpm build
 
       - name: Prepare  ${{ env.NPM_VERSION }}
         run: |

.github/workflows/scorecard.yml

+name: Scorecard supply-chain security
+on:
+  schedule:
+    - cron: '0 5 * * 1'
+  push:
+    branches:
+      - main
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+
+    steps:
+      - name: 'Checkout code'
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
+
+      - name: 'Run analysis'
+        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: 'Upload artifact'
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: 'Upload to code-scanning'
+        uses: github/codeql-action/upload-sarif@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5
+        with:
+          sarif_file: results.sarif

.github/workflows/stale-action.yml

-# Go to https://github.com/actions/stale for the full documentation of these options.
-
-name: 'Close stale bug reports that lack reproduction'
-on:
-  schedule:
-    - cron: '30 1 * * *'
-
-permissions:
-  issues: write
-  pull-requests: write
-
-jobs:
-  stale:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/stale@1160a2240286f5da8ec72b1c0816ce2481aabf84 # v8.0.0
-        with:
-          # Rate limit per run, (defaults to 30, but we've increased it to 40 for now).
-          operations-per-run: 40
-
-          # Only issues with both `reproduction:needed` and `type:bug` will be touched by the stale bot.
-          only-issue-labels: 'reproduction:needed,type:bug'
-
-          # A issue that has any assignee is getting worked on, so is exempt from stale bot.
-          exempt-all-issue-assignees: true
-
-          # Remove stale label from issue/PR on updates or comments, defaults to true.
-          remove-stale-when-updated: true
-
-          # Wait 14 days until making issue stale and posting a message.
-          days-before-issue-stale: 14
-          stale-issue-message: 'When a bug has been marked as needing a reproduction, it means nobody can work on it until one is provided. In cases where no reproduction is possible, or the issue creator does not have the time to reproduce, we unfortunately need to close such issues as they are non-actionable and serve no benefit by remaining open. This issue will be closed after 7 days of inactivity.'
-          stale-issue-label: 'stale'
-
-          # Close out issue after 7 stale days.
-          days-before-issue-close: 7
-          close-issue-message: 'This bug report has been closed as we need a reproduction to work on this. If the original poster or anybody else with the same problem discovers that they can reproduce it, please create a new issue, and reference this issue.'
-
-          # Never label/close any pull requests.
-          days-before-pr-close: -1
-          days-before-pr-stale: -1

.github/workflows/update-data.yml

@@ -8,29 +8,35 @@ env:
   NODE_VERSION: 18
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   update-data:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - name: Enable corepack
+        shell: bash
+        run: corepack enable
 
       - name: Set up Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: yarn
+          cache: pnpm
 
       - name: Install dependencies
-        run: yarn install --frozen-lockfile
+        run: pnpm install
 
       - name: Update static data
-        run: yarn run update-static-data
+        run: pnpm run update-static-data
 
       - name: Run Prettier
-        run: yarn prettier-fix
+        run: pnpm prettier-fix
 
       - name: Create pull request
         uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 # v5.0.2