pinup · documentation
Managers, datasources, versionings
Three registries, addressed by the names a configuration uses. A manager reads a file and yields dependencies with byte ranges. A datasource answers a dependency's releases. A versioning orders them and rewrites the value.
enabledManagersis a closed list: a manager not listed there does not runcustom.regexmust be named for the custom managers to run
Managers
| Name | Reads | Notes |
|---|---|---|
dockerfile | Dockerfile, Containerfile, *.Dockerfile | FROM, COPY --from, # syntax=; ARG-interpolated images; digest pins stay or arrive with pinDigests |
gitlabci | .gitlab-ci.yml | image: and services: at any depth, as a string and as an object; include: component: pins (gitlab-tags on the component's project); $VAR tags are reported as unresolvable, not guessed |
kustomize | kustomization.yaml | images: with newTag/digest, remote resources and components with ?ref=, helmCharts: |
npm | package.json, lock files | dependencies of every kind, engines.node (node-version), packageManager, pnpm.overrides; workspaces read and refresh the root lock |
composer | composer.json, composer.lock | require, require-dev, config.platform.php, repositories of type composer in file order, then Packagist; the locked version is the starting point of an update |
gomod | go.mod, go.sum | the go directive (golang-version), requires, // indirect on a security fix; go mod tidy next to every module with a go.sum |
terraform | *.tf, .terraform.lock.hcl | required_providers, registry modules; a provider bump moves version and hashes in the lock along |
terraform-version | .terraform-version | tfenv's file, the value as written |
custom.regex | whatever managerFilePatterns name | see Configuration |
Datasources
| Name | Asks | Notes |
|---|---|---|
docker | the registry's /v2/ API | tags, a tag's digest when pinning; bearer tokens per realm; the estate's own registry with the platform token, others anonymously |
gitlab-tags, gitlab-releases, gitlab-packages | a GitLab instance's REST API | the instance from the environment unless registryUrls names another; paginated |
github-releases, github-tags | api.github.com | with GITHUB_COM_TOKEN when set; otherwise the 60-per-hour limit |
npm | the registry's package document | registryUrls; deprecated as a string or a boolean |
packagist | the Composer repository protocol | Packagist and every registry that speaks it, GitLab's group registry with its provider format included; repositories in file order until one has the package |
pypi | the JSON API | under the PEP 503 name; a release yanked in every file is deprecated |
node-version | nodejs.org/dist/index.json | read once per process |
golang-version | go.dev | the Go toolchain |
go | the module proxy, or the instance for modules there | a go/vN tag in a subdirectory of a project is resolved over its tags |
helm | a chart repository's index.yaml | needs registryUrls; the index is fetched once per repository |
terraform-provider, terraform-module | the registry protocol (discovery first) | OpenTofu's or HashiCorp's registry; provider hashes for the lock |
git-tags, git-refs | git ls-remote | any repository git reaches; git-refs for a branch pinned by commit |
custom.* | whatever customDatasources declare | defaultRegistryUrlTemplate, format, transformTemplates; apk indexes (custom.wolfi and those from PINUP_APK_VIEWS) are served natively from the APKINDEX |
A datasource's failure is a warning in the plan against that dependency, never a failed run for the repository.
Versionings
| Name | Orders | Notes |
|---|---|---|
semver | strict semver | a leading v stays as written |
semver-partial | semver with partial versions | 1 and 1.2 are ranges |
semver-coerced | anything that starts like a version | |
loose | leading numeric components | no notion of prerelease: 1.0.0-alpha is stable here, and Satisfies is equality |
docker | image tags | version and compatibility segment (22-alpine3.21); a different suffix or component count is a different image, not an update |
apk | Wolfi/Alpine package versions | -rN revisions, epochs |
composer | Composer constraints | ^, ~, *, stability flags, dev- branches |
npm | npm ranges | ^, ~, x, ||, hyphen ranges |
node | Node.js | semver, engines ranges as npm ranges |
go | Go modules | v prefix, pseudo-versions, +incompatible |
go-mod-directive | the go directive | 1.27 admits 1.27.x |
hashicorp | Terraform constraints | ~>, >=, , |
regex | regex:<pattern> | named groups major, minor, patch, prerelease, compatibility |
pep440 | Python versions | epoch, a/b/rc, .post, .dev, local; specifier sets |
A datasource names its default versioning; a rule's versioning or an annotation's versioning= overrides it.