Disable Markdown Badges from Exposing Internal Package Names

[Chrimle]

Renovate may comment using Markdown badges (), which will link to mend.io containing meta information about packages - even for non-public packages. Since it is markdown, a request is sent to mend.io with this meta information...

Is there a way to completely disable this behavior?

[jamietanna]

I'm trying to find a previous Discussion we've had about this, looking at the way that non-public packages can be opted out, but that leads to enumeration attacks - so we won't add the "only show the badge if it's a public package"

In the case that you'd prefer to not have the Merge Confidence badges in your repository, you can use ignorePresets (or set it on shared config across your org)

[Chrimle]

Will investigate it. But I would consider this an issue. Self-hosting RenovateBot would suggest that it shouldn't rely on external integrations too much. After all, there is a reason for self-hosting in the first place.

About solutions, wouldn't it be possible to evaluate whether a private/custom artifactory/registry is used, and if so, prevent package information from being sent to 3rd parties?

[jamietanna]

See #39265 (reply in thread) for more details

As mentioned, if it's something that's concerning to you and your organisation, you can disable the preset altogether

In the future, #29563 / #31625 may make it possible for you to then opt-in specific registries to use the Merge Confidence badges