Respect disabled hostRules (enabled: false) globally in datasources and lockfile updates

[loganprice]

Tell us more.

In airgapped or strictly controlled internal network environments, Renovate has no access to public internet registries (such as api.nuget.org, registry.npmjs.org, or pypi.org).

Currently, users can configure hostRules with enabled: false to block traffic to these public registries. While this blocks outbound requests at the HTTP layer, it still leads to lookup warnings, noisy error logs, and package manager restore failures because:

1. Datasources still resolve and attempt to query the disabled default public registries.
2. Ecosystem managers (like NuGet, npm, and Python) dynamically rebuild credentials or configuration files (like nuget.config, .npmrc, or keyring environment variables) that hardcode or reference these disabled hosts, causing the lockfile generation tools (dotnet restore, npm install, pipenv lock, etc.) to attempt to connect to them.

Proposed Solutions

Solution 1: Respect enabled: false in hostRules across datasources and managers
Users can already configure hostRules with enabled: false to block traffic to specific hosts. This solution extends that behavior to act as a proper registry filter:

• Global Datasource Filtering: Filter out disabled registries in resolveRegistryUrls so lookups are never attempted against them.
• Ecosystem Managers (npm, NuGet, Pipenv, Poetry, pip-compile): Filter out and skip disabled registries when building lockfile-related configuration files (like nuget.config, .npmrc) and environment credentials.

Configuration Example

{
  "hostRules": [
    {
      "matchHost": "api.nuget.org",
      "enabled": false
    }
  ]
}

Solution 2: Introduce disableDefaultRegistries configuration option
Instead of managing a blocklist of public hosts, introduce a new boolean configuration option disableDefaultRegistries (default false).

• When disableDefaultRegistries is set to true, Renovate's datasources will not fall back to default public registries if no registries are explicitly configured in the repository.
• If no custom registries are declared in the project files (e.g., package.json, NuGet.config) or specified in Renovate configuration (such as in packageRules registryUrls), Renovate will return an empty list of registries, preventing any network requests from leaking to public internet registries.

Configuration Example

{
  "disableDefaultRegistries": true,
    "packageRules": [
    {
      "matchDatasources": ["npm"],
      "registryUrls": ["https://my-internal-npm-mirror.company.com/registry"]
    },
    {
      "matchDatasources": ["nuget"],
      "registryUrls": ["https://my-internal-nuget-mirror.company.com/registry"]
    }
  ]
}

[loganprice]

Both originally proposed solutions have been implemented find the branches below:

Solution 1: https://github.com/loganprice/renovate/tree/disable_public_repos
Solution 2: https://github.com/loganprice/renovate/tree/disable_default_registries