dependency-manager

Looking at the code, it looks like autoload files are loaded in the order of packages given by PackageSorter::sortPackages().

This should be documented in https://getcomposer.org/doc/04-schema.md#files. (Also, I have no idea what the sorting done by PackageSorter::sortPackages() actually is. It says 'dependency weight' but what does that mean?)

• I am on the latest Poet

@zharinov We should use uppercase for i in a follow up PR. 😉

 function replaceSecretsInObject(

Originally posted by @viceice in renovatebot/renovate#13445 (comment)

Describe the bug
CodeQL show that we are logging paths directly. We should instead escape and then log them.

To Reproduce
Results are shown here: https://github.com/gomods/athens/pull/1748/checks?check_run_id=4567576462

Expected behavior

We can simply log escaped paths provided by net/url: https://pkg.go.dev/net/url#URL.EscapedPath

Additional context
Add an

If CPM_SOURCE_CACHE is set to an empty string, CPM fails with file DOWNLOAD error: cannot create directory '/cpm' - Specify file by full.

We currently don't support compiler options which are two parameters, like -encoding UTF-8, and commas also seem to be invalid in parameters, presumably excluded by some regex...