New confidence badges on Azure DevOps

[scabana]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Azure DevOps

Please tell us more about your question or problem

Just updated Renovate (can't say it's latest :P 41.91.0). Confidence badges were added since our last update and we get:

Is there any plan to support the badges on Azure DevOps? If not, would it be possible to not enable that preset by default when the platform is Azure DevOps?

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[bitschubse]

Hi all 👋

Just wanted to add some context to this issue:
The mend.io confidence badge image (e.g. https://developer.mend.io/api/mc/badges/confidence/...) used to load correctly in Azure DevOps a few weeks ago. However, it now triggers a CORS error:

Access to image at 'https://developer.mend.io/api/mc/badges/confidence/npm/nx/21.4.1/21.5.2?slim=true' from origin 'https://dev.azure.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

This suggests that the CORS configuration on the mend.io side may have changed recently.

Impact

Due to this issue, the confidence badge feature is currently not usable within Azure DevOps environments, as the images are blocked by the browser and not displayed.

Suggested Resolution

To restore functionality, mend.io would need to include the appropriate CORS headers in their response, such as:

Access-Control-Allow-Origin: https://dev.azure.com

Alternatively, a wildcard (*) could be used if acceptable from a security standpoint.

Would it be possible for the Renovate team to reach out to mend.io or provide guidance on how best to proceed here?

Thanks again for maintaining such a great tool! 🙏

[dalwar23]

Shout out for this discussion be considered for an issue. It's pretty awful that suddenly we can't see the confidence, age or adoption. I have reached out to Azure Support and had discussion and made sure that Azure can't do anything about it. As @bitschubse mentioned, mend.io needs to add the Access-Control-Allow-Origin: https://dev.azure.com header in the response.

Hope this gets solved sooner.

BTW I am using renovate CLI.

[david-vana-creditas]

I just received a response from Mend.io support saying that they have fixed it. I can confirm that it is working again for us.

[jamietanna]

Hey folks, apologies for the delay here - we'd missed this report, but had seen reports from customers, off the back of a change that the Azure DevOps team made that broke all external images being loaded, if they didn't allowlist Azure DevOps via CORS.

As mentioned, we make the relevant changes in the Mend.io hosted backends to handle this, so this should now be fixed - please shout if not.