Merge branch 'main' into patch-1

Author: marklai1998

.devcontainer/Dockerfile

@@ -1 +1 @@
-FROM ghcr.io/containerbase/devcontainer:13.25.24
+FROM ghcr.io/containerbase/devcontainer:13.26.0

.github/workflows/build.yml

@@ -213,6 +213,9 @@ jobs:
           node-version: ${{ needs.setup-build.outputs.node-version }}
           os: ${{ runner.os }}
 
+      - name: Lint with oxlint
+        run: pnpm oxlint
+
       - name: Restore eslint cache
         uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
@@ -221,7 +224,7 @@ jobs:
           key: eslint-cache-${{ hashFiles('pnpm-lock.yaml', 'package.json') }}
           restore-keys: eslint-cache-${{ hashFiles('pnpm-lock.yaml', 'package.json') }}-
 
-      - name: Lint
+      - name: Lint with eslint
         run: pnpm eslint-ci
         env:
           NODE_OPTIONS: --max-old-space-size=8192

.nvmrc

@@ -1 +1 @@
-24.12.0
+24.13.0

.oxlintrc.json

@@ -0,0 +1,83 @@
+{
+  "$schema": "https://raw.githubusercontent.com/oxc-project/oxc/main/npm/oxlint/configuration_schema.json",
+  "plugins": ["import", "typescript"],
+  "categories": {},
+  "rules": {
+    "eqeqeq": "error",
+    "no-console": "error",
+    "no-param-reassign": "error",
+    "no-negated-condition": "error",
+    "no-template-curly-in-string": "error",
+    "curly": "error",
+    "radix": ["error", "as-needed"],
+    "sort-imports": [
+      "error",
+      {
+        "ignoreCase": false,
+        "ignoreDeclarationSort": true,
+        "ignoreMemberSort": false,
+        "memberSyntaxSortOrder": ["none", "all", "multiple", "single"]
+      }
+    ],
+    "import/no-cycle": "error",
+    "import/default": "error",
+    "import/named": "error",
+    "import/namespace": "error",
+    "typescript/consistent-type-imports": [
+      "error",
+      {
+        "disallowTypeAnnotations": false
+      }
+    ],
+    "no-unused-vars": "off"
+  },
+  "overrides": [
+    {
+      "files": ["**/*.spec.ts", "test/**"],
+      "rules": {
+        "no-template-curly-in-string": "off"
+      }
+    },
+    {
+      "files": [
+        "*.config.cjs",
+        "*.config.cts",
+        "*.config.js",
+        "*.config.mjs",
+        "*.config.mts",
+        "*.config.ts",
+        "tools/**/*.cjs",
+        "tools/**/*.cts",
+        "tools/**/*.js",
+        "tools/**/*.mjs",
+        "tools/**/*.mts",
+        "tools/**/*.ts"
+      ],
+      "rules": {
+        "no-console": "off"
+      }
+    }
+  ],
+  "ignorePatterns": [
+    "**/node_modules",
+    "**/.pnpm-store",
+    "**/dist",
+    "**/coverage",
+    "**/__fixtures__/**/*",
+    "**/__mocks__/**/*",
+    "**/*.d.ts",
+    "config.js",
+    "**/.clinic/",
+    "**/.cache/",
+    "**/*.generated.ts",
+    "tools/dist",
+    "patches",
+    "**/tmp/",
+    "**/.venv/",
+    "tools/mkdocs/docs",
+    "tools/mkdocs/site",
+    ".github/workflows/**/*.js",
+    ".worktrees/**/*",
+    ".markdownlint-cli2.mjs"
+  ]
+}

.vscode/extensions.json

@@ -1,6 +1,7 @@
 {
   "recommendations": [
     "dbaeumer.vscode-eslint",
+    "oxc.oxc-vscode",
     "esbenp.prettier-vscode",
     "vitest.explorer",
     "editorconfig.editorconfig",

docs/development/local-development.md

@@ -174,6 +174,23 @@ You usually don't need to fix any Prettier errors by hand.
 
 If you're only working on the documentation files, you can use the `pnpm doc-fix` command to format your work.
 
+### IDE extensions
+
+We recommend installing the extensions listed in `.vscode/extensions.json`.
+VS Code will prompt you to install them when you open the project.
+
+For linting, we use both ESLint and [oxlint](https://oxc.rs):
+
+- **ESLint** handles type-aware rules (requires TypeScript)
+- **oxlint** handles syntax rules (near-instant feedback)
+
+To get real-time oxlint diagnostics, install the extension for your editor:
+
+- **VS Code**: [oxc](https://marketplace.visualstudio.com/items?itemName=oxc.oxc-vscode)
+- **Zed**: [oxc](https://github.com/zed-extensions/oxc)
+- **IntelliJ/WebStorm**: [Oxlint](https://plugins.jetbrains.com/plugin/25948-oxlint)
+- **Neovim**: [nvim-oxlint](https://github.com/soulsam480/nvim-oxlint) or via native LSP
+
 ## Documentation
 
 We use [MkDocs](https://www.mkdocs.org) to generate the documentation.

docs/usage/configuration-options.md

@@ -4324,6 +4324,7 @@ Renovate applies _all_ `registryAliases` objects, from top to bottom.
 This feature works with the following managers:
 
 - [`ansible`](modules/manager/ansible/index.md)
+- [`bazel-module`](modules/manager/bazel-module/index.md)
 - [`bitbucket-pipelines`](modules/manager/bitbucket-pipelines/index.md)
 - [`circleci`](modules/manager/circleci/index.md)
 - [`crow`](modules/manager/crow/index.md)

docs/usage/security-and-permissions.md

@@ -99,7 +99,7 @@ This is particularly true during, for example:
 These scripts can contain arbitrary code.
 This may pose a significant security risk if the repository's integrity is compromised, or if the repository maintainers have malicious intentions.
 
-Because such insider attack is an inherent and unavoidable risk, the Renovate project will not issue CVEs for such attacks or weaknesses other than in exceptional circumstances.
+Because such insider attack is an inherent and unavoidable risk, the Renovate project will not issue CVEs (or GHSAs) for such attacks or weaknesses other than in exceptional circumstances.
 
 Note that when Renovate runs `postUpgradeTasks`, the script executes inside a shell, which means that they can call out to other commands or access shell variables, if the allowlist via `allowedCommands` does not restrict it.
 As it is difficult to craft a regular expression that may deny usage of special characters to shells, it is likely that this will not be possible to avoid at this time.

eslint.config.mjs

@@ -4,6 +4,7 @@ import vitest from '@vitest/eslint-plugin';
 import eslintConfigPrettier from 'eslint-config-prettier';
 import { createTypeScriptImportResolver } from 'eslint-import-resolver-typescript';
 import * as importX from 'eslint-plugin-import-x';
+import oxlint from 'eslint-plugin-oxlint';
 import eslintPluginPromise from 'eslint-plugin-promise';
 import globals from 'globals';
 import tseslint from 'typescript-eslint';
@@ -333,4 +334,9 @@ export default tseslint.config(
       '@typescript-eslint/no-floating-promises': 0,
     },
   },
+
+  // Disable ESLint rules that oxlint handles (must be last).
+  // This reads .oxlintrc.json and turns off corresponding ESLint rules,
+  // avoiding duplicate diagnostics while allowing gradual migration to oxlint.
+  ...oxlint.buildFromOxlintConfigFile('./.oxlintrc.json'),
 );

lib/config-validator.ts

@@ -156,7 +156,7 @@ interface PackageJson {
   }
   logger.info('Config validated successfully');
 })().catch((e) => {
-  // eslint-disable-next-line no-console
+  // oxlint-disable-next-line no-console -- intentional: display critical error on CLI
   console.error(e);
   process.exit(99);
 });