.github/workflows/build.yml

@@ -404,7 +404,7 @@ jobs:
 
       - name: Save coverage artifacts
         if: (success() || failure()) && github.event.pull_request.draft != true && matrix.coverage
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
         with:
           name: ${{ matrix.upload-artifact-name }}
           path: |
@@ -424,7 +424,7 @@ jobs:
           show-progress: false
 
       - name: Download coverage reports
-        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           pattern: coverage-*
           path: coverage
@@ -460,7 +460,7 @@ jobs:
           os: ${{ runner.os }}
 
       - name: Download coverage reports
-        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           pattern: coverage-*
           path: coverage
@@ -560,7 +560,7 @@ jobs:
         run: pnpm test-e2e:pack
 
       - name: Upload
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
         with:
           name: renovate-package
           path: renovate-0.0.0-semantic-release.tgz
@@ -591,7 +591,7 @@ jobs:
         run: pnpm test:docs
 
       - name: Upload
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
         with:
           name: docs
           path: tmp/docs/
@@ -620,7 +620,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION_TEST }}
 
       - name: Download package
-        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: renovate-package
 

.github/workflows/scorecard.yml

@@ -43,7 +43,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: 'Upload artifact'
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
         with:
           name: SARIF file
           path: results.sarif

lib/workers/repository/process/lookup/filter.spec.ts

@@ -1,37 +1,38 @@
 import { partial } from '../../../../../test/util';
+import type { Release } from '../../../../modules/datasource/types';
 import * as allVersioning from '../../../../modules/versioning';
 import { filterVersions } from './filter';
 import type { FilterConfig } from './types';
 
 const versioning = allVersioning.get('semver');
 
-const releases = [
-  {
-    version: '1.0.1',
-    releaseTimestamp: '2021-01-01T00:00:01.000Z',
-  },
-  {
-    version: '1.2.0',
-    releaseTimestamp: '2021-01-03T00:00:00.000Z',
-  },
-  {
-    version: '2.0.0',
-    releaseTimestamp: '2021-01-05T00:00:00.000Z',
-  },
-  {
-    version: '2.1.0',
-    releaseTimestamp: '2021-01-07T00:00:00.000Z',
-  },
-  // for coverage
-  {
-    version: 'invalid.version',
-    releaseTimestamp: '2021-01-07T00:00:00.000Z',
-  },
-];
-
 describe('workers/repository/process/lookup/filter', () => {
   describe('.filterVersions()', () => {
     it('should filter versions allowed by semver syntax when allowedVersions is not valid version, range or pypi syntax', () => {
+      const releases = [
+        {
+          version: '1.0.1',
+          releaseTimestamp: '2021-01-01T00:00:01.000Z',
+        },
+        {
+          version: '1.2.0',
+          releaseTimestamp: '2021-01-03T00:00:00.000Z',
+        },
+        {
+          version: '2.0.0',
+          releaseTimestamp: '2021-01-05T00:00:00.000Z',
+        },
+        {
+          version: '2.1.0',
+          releaseTimestamp: '2021-01-07T00:00:00.000Z',
+        },
+        // for coverage
+        {
+          version: 'invalid.version',
+          releaseTimestamp: '2021-01-07T00:00:00.000Z',
+        },
+      ] satisfies Release[];
+
       const config = partial<FilterConfig>({
         ignoreUnstable: false,
         ignoreDeprecated: false,
@@ -41,9 +42,6 @@ describe('workers/repository/process/lookup/filter', () => {
       const currentVersion = '1.0.0';
       const latestVersion = '2.0.0';
 
-      jest.spyOn(versioning, 'isVersion').mockReturnValue(true);
-      jest.spyOn(versioning, 'isGreaterThan').mockReturnValue(true);
-
       const filteredVersions = filterVersions(
         config,
         currentVersion,
@@ -57,5 +55,31 @@ describe('workers/repository/process/lookup/filter', () => {
         { version: '2.1.0', releaseTimestamp: '2021-01-07T00:00:00.000Z' },
       ]);
     });
+
+    it('allows unstable major upgrades', () => {
+      const nodeVersioning = allVersioning.get('node');
+
+      const releases = [
+        { version: '1.0.0-alpha' },
+        { version: '1.2.3-beta' },
+      ] satisfies Release[];
+
+      const config = partial<FilterConfig>({
+        ignoreUnstable: true,
+        ignoreDeprecated: true,
+      });
+      const currentVersion = '1.0.0-alpha';
+      const latestVersion = '1.2.3-beta';
+
+      const filteredVersions = filterVersions(
+        config,
+        currentVersion,
+        latestVersion,
+        releases,
+        nodeVersioning,
+      );
+
+      expect(filteredVersions).toEqual([{ version: '1.2.3-beta' }]);
+    });
   });
 });

lib/workers/repository/process/lookup/filter.ts

@@ -78,7 +78,11 @@ export function filterVersions(
       );
       filteredReleases = filteredReleases.filter((r) =>
         semver.satisfies(
-          semver.valid(r.version) ? r.version : semver.coerce(r.version)!,
+          semver.valid(r.version)
+            ? r.version
+            : /* istanbul ignore next: not reachable, but it's safer to preserve it */ semver.coerce(
+                r.version,
+              )!,
           allowedVersions,
         ),
       );
@@ -126,24 +130,28 @@ export function filterVersions(
     return filteredReleases.filter((r) => isReleaseStable(r, versioning));
   }
 
-  // if current is unstable then allow unstable in the current major only
-  // Allow unstable only in current major
+  const currentMajor = versioning.getMajor(currentVersion);
+  const currentMinor = versioning.getMinor(currentVersion);
+  const currentPatch = versioning.getPatch(currentVersion);
+
   return filteredReleases.filter((r) => {
     if (isReleaseStable(r, versioning)) {
       return true;
     }
-    if (
-      versioning.getMajor(r.version) !== versioning.getMajor(currentVersion)
-    ) {
+
+    const major = versioning.getMajor(r.version);
+
+    if (major !== currentMajor) {
       return false;
     }
-    // istanbul ignore if: test passes without touching this
+
     if (versioning.allowUnstableMajorUpgrades) {
       return true;
     }
-    return (
-      versioning.getMinor(r.version) === versioning.getMinor(currentVersion) &&
-      versioning.getPatch(r.version) === versioning.getPatch(currentVersion)
-    );
+
+    const minor = versioning.getMinor(r.version);
+    const patch = versioning.getPatch(r.version);
+
+    return minor === currentMinor && patch === currentPatch;
   });
 }

tools/docker/Dockerfile

@@ -3,17 +3,17 @@ ARG BASE_IMAGE_TYPE=slim
 # --------------------------------------
 # slim image
 # --------------------------------------
-FROM ghcr.io/renovatebot/base-image:2.24.0@sha256:f659e0c7589ef608805887ab0d668f67c4b5d5ce0612e62538b17322a92f928d AS slim-base
+FROM ghcr.io/renovatebot/base-image:2.24.1@sha256:3ce9895bce94ae22146e4399d49af8a820ec24ec247252c7a4c08fc10badb143 AS slim-base
 
 # --------------------------------------
 # full image
 # --------------------------------------
-FROM ghcr.io/renovatebot/base-image:2.24.0-full@sha256:323eb53c3a1706e6bf87d4e8ebf5a2d15de4509b75dab613c7b32ddc5826b49a AS full-base
+FROM ghcr.io/renovatebot/base-image:2.24.1-full@sha256:a3ea4cb6d8c804113e1c724427abcc96ec9b447e3cae9e31c1b575ff595ef799 AS full-base
 
 # --------------------------------------
 # build image
 # --------------------------------------
-FROM --platform=$BUILDPLATFORM ghcr.io/renovatebot/base-image:2.24.0@sha256:f659e0c7589ef608805887ab0d668f67c4b5d5ce0612e62538b17322a92f928d AS build
+FROM --platform=$BUILDPLATFORM ghcr.io/renovatebot/base-image:2.24.1@sha256:3ce9895bce94ae22146e4399d49af8a820ec24ec247252c7a4c08fc10badb143 AS build
 
 ARG TARGETPLATFORM
 ARG BUILDPLATFORM