Adds new admin option “skipInstalls” that is applicable for npm-only for now (including lerna-npm). If set to false, Renovate will perform a full install of modules rather than `—package-lock-only`. This is necessary in some cases to work around bugs in npm.

Self-hosted bot users can set this option themselves on the bot’s config, but app users will require it to be enabled per-repository by the app admin.

If the current value is already unstable then we presume the user is happy to take newer unstable versions. However we should not presume that they want to keep jumping versions if so and instead would prefer to stabilise.

Discussed in #2258 but does not close it

Necessary because of https://npm.community/t/scoped-packages-have-latest-version-disappear-temporarily-soon-after-publish/633

Until the npmjs registry can return consistent results, we need to disable roll back PRs.

Closes #2148

Contains GitHub specific changes from #2323

COPY --from= can specify external images. Add support to renovate them.

Adds field prettyDepType available for templates, currently used for npm only. Allows for PR titles like “Update devDependency left-pad to v1.3.0” instead of default “Update dependency left-pad to v1.3.0”.

To enable in PR titles: add this configuration: `"commitMessageTopic": "{{prettyDepType}} {{depName}}”`

This is not enabled by default as otherwise it could lead to the reopening of previously manually-closed PRs.

Closes #2371, Closes #1863

Closes #2374

If the dependency already is the latest version, filteredVersions is
empty here, and then the early exit skips over the pinning code

fix(docker): resolve relative URLs from registry

The default prefix is library/. Using amd64/ as the prefix created weird
issues with pinning to digests that matched no images.

Supports github.com only