Skip to content

chore: Configure Renovate - #1

Closed
renovate[bot] wants to merge 13 commits into
mainfrom
renovate/configure
Closed

renovate[bot] wants to merge 13 commits into
mainfrom
renovate/configure

Conversation

@renovate

@renovate renovate Bot commented Nov 14, 2026

Copy link
Copy Markdown

Welcome to Renovate! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.

📚 See our Reading List for relevant documentation you may be interested in reading.

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to renovate.json in this branch. Renovate will update the Pull Request description the next time it runs.


Detected Package Files

  • .github/workflows/ci.yml (github-actions)
  • package.json (npm)
  • renovate.json (renovate-config)

Configuration Summary

Based on the default config's presets, Renovate will:

  • Start dependency updates only once this onboarding PR is merged
  • Hopefully safe environment variables to allow users to configure.
  • Show all Merge Confidence badges for pull requests.
  • Enable Renovate Dependency Dashboard creation.
  • Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
  • Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
  • Group known monorepo packages together.
  • Use curated list of recommended non-monorepo package groupings.
  • Show only the Age and Confidence Merge Confidence badges for pull requests.
  • Apply crowd-sourced package replacement rules.
  • Apply crowd-sourced workarounds for known problems with packages.
  • Update vulnerable PHP runtime pins for CVE-2026-109618 and CVE-2026-109619.
  • Ensure that every dependency pinned by digest and sourced from Forgejo contains a link to the commit-to-commit diff
  • Ensure that every dependency pinned by digest and sourced from Gitea contains a link to the commit-to-commit diff
  • Ensure that every dependency pinned by digest and sourced from GitHub.com and Github enterprise contains a link to the commit-to-commit diff
  • Ensure that every dependency pinned by digest and sourced from GitLab.com contains a link to the commit-to-commit diff
  • Correctly link to the source code for golang.org/x packages
  • Link to pkg.go.dev/... for golang.org/x packages' title
  • Provide a link to octochangelog's improved breakdown for Renovate's changelogs
  • Pin github-action digests.
  • Convert pinned GitHub Action digests to SemVer.
  • Pin dependency versions for development dependencies.

What to Expect

With your current configuration, Renovate will create 4 Pull Requests:

chore(deps): update dependency @​types/node to v26.6.6
  • Schedule: ["at any time"]
  • Branch name: renovate/node-26-x
  • Merge into: main
  • Upgrade @types/node to sha512-MzQj+8Kx3XI40OmUAE6Qoh58ZMNstNNMwn2nfd3qWsfe7nDNSqJNzes4njhz6AHwrSHOffSLwXU6yb474Q4aog==
chore(deps): update pnpm/setup action to v3.2.0
  • Schedule: ["at any time"]
  • Branch name: renovate/pnpm-setup-3-x
  • Merge into: main
  • Upgrade pnpm/setup to 731dfb6463bbd11c11fd0ee11fe00ed0e36d48a1
chore(deps): update dependency typescript to v7
  • Schedule: ["at any time"]
  • Branch name: renovate/typescript-7-x
  • Merge into: main
  • Upgrade typescript to sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==
chore(deps): update dependency ubuntu to v26
  • Schedule: ["at any time"]
  • Branch name: renovate/ubuntu-26-x
  • Merge into: main
  • Upgrade ubuntu to 26.04

🚸 PR creation will be limited to maximum 2 per hour, so it doesn't swamp any CI resources or overwhelm the project. See docs for prHourlyLimit for details.


❓ Got questions? Check out Renovate's Docs, particularly the Getting Started section.
If you need any further assistance then you can also request help here.


This PR was generated by Mend Renovate. View the repository job log.

mschfh and others added 13 commits November 13, 2026 19:28
Extract the netlog-to-WprGo converter into packages/netlog2wpr/ as a
private ESM workspace package, kept extractable to its own repo later.
The package carries its own tsconfig (strict checkJs over src/**/*.mjs),
test script and devDependencies; the root typecheck script delegates to
it and the root test/test:ci scripts pick up the package's tests from
the root so the @reporters/github reporter keeps resolving there. CI
gains the typecheck step, and Docker/.dockerignore ship the package
manifest for the frozen install. NetLogError lands first as the
typechecker's live input and gains an error-code union.
Port the netlog reader into the package: the 90% cap rejection, the
NDJSON sniffing and streaming (with the required constants and end
records), legacy single-JSON parsing and BOM/whitespace tolerance.
The env-configured cap moves out of the package (config.mjs only keeps
DEFAULT_NETLOG_CAP_MB and NETLOG_REJECT_RATIO; the app reads
MAX_NETLOG_MB itself), and reader errors now carry codes (CAP_REACHED,
TRUNCATED, INVALID). Tests port with fixtures helper and code
assertions.
Port the HTTP header parsing helpers: Go-style canonical MIME header
keys, logged header-list splitting, strict Content-Length parsing,
chunked Transfer-Encoding detection (last coding wins), request-line
parsing (origin and absolute form) and the request/response header-list
parsers behind the exchange reconstruction.
Port the HTTP/2 DATA-frame extraction over the logged TLS payload
plaintext of a connection: connection-preface sniffing, per-stream
concatenation, padded-frame handling with the RFC 9113 pad-length
validation, and truncation flagging for incomplete or malformed
trailers. The fixtures helper gains the h2SentBytes byte builder.
Port the exchange reconstruction as parseNetLog: event-position
ordering, redirect-hop sealing, failure attribution only from the
START_JOB/REQUEST_ALIVE end events, h1 and h2 request-body correlation
before hop filtering, chunked-upload rejection (code CHUNKED_UPLOAD)
and malformed-input hardening. Warnings replace console.warn with the
onWarning callback (UNPARSABLE_STATUS), exchanges drop the internal
binding fields (requestHeaders, boundSessions, boundSocketId,
eventIndex) after ordering, and the parser reports stats
({ exchanges, dropped: { failed, unparsable } }). At this point every
URL_REQUEST source is kept.
Export isInternalRequest(startJobParams): a request is internal when
either the network isolation key or the network anonymization key
starts with "null" (both keys are checked independently, fixing the
reference's ?? chain) or when a 'not an origin' initiator issues a
non-navigation request_type. parseNetLog gains dropInternalRequests
(default true): one match excludes the whole source, skipped before
body correlation; when disabled, internal traffic goes through the
normal path including the chunked-upload rejection. Dropped sources
are reported as stats.dropped.internalRequests.
Port the WprGo serializer from the app: HTTP_REASONS with the BSD-3
attribution for Go's StatusText table, sorted headers, Go
Request.Write/Response.Write framing (length/zero/chunked/close/eof,
HEAD, 1xx/204/304, HTTP/1.0, Connection: close), the h2 status line,
the declared-length rules, truncated HTTP/1 body dropping (now reported
through onWarning as TRUNCATED_BODY instead of console.warn) and the
Archive field order. archiveFromExchanges gains the metadata option;
CSP seeding follows separately.
Port seedCspReplayNonce and its helpers unchanged into csp.mjs,
including the full doc comment on how wpr picks its nonce source and
rewrite target. archiveFromExchanges gains the replayNonce option
(a fresh random base64 nonce by default) and seeds every HTML 200
exchange's enforced CSP headers before serialization, so wpr's
replay-time script injection is authorized without relaxing the site's
policy.
Rename the placeholder renderer to renderDeterministicScript and add
createRecordingContext: it seeds the whole-second time seed exactly
like wpr record (1000 * time.Now().Unix()), renders the record-time
injection with the Math.random constant rendered as null, and returns
the archiveFromExchanges options embedding the unrendered script for
replay-time injection.
netlogToWprArchive chains parseNetLog and archiveFromExchanges and
returns { archive, stats, warnings }: it throws NO_REQUESTS when
nothing was reconstructed, ALL_DROPPED when serialization dropped
everything, collects every warning in the returned array while
forwarding it to onWarning, and merges the parser stats with the
archive host count and the truncated-body drop count. The other public
exports (parseNetLog, archiveFromExchanges, isInternalRequest,
createRecordingContext, renderDeterministicScript, NetLogError,
DEFAULT_NETLOG_CAP_MB) re-exported, plus a short README documenting the
API, the capture requirements, the deterministic-script gap and the
wpr-go target commit.
@renovate

renovate Bot commented Nov 14, 2026

Copy link
Copy Markdown
Author

Renovate is disabled

Renovate is disabled because there is no Renovate configuration file. To enable Renovate, you can either (a) change this PR's title to get a new onboarding PR, and merge the new onboarding PR, or (b) create a Renovate config file, and commit that file to your base branch.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant