group @dallay/agentsync updates in Renovate

[yacosta738]

Group all @dallay/agentsync package and platform-specific binary updates into a single PR under the agentsync group in renovate.json.

---

PR created automatically by Jules for task 10643315326089919140 started by @yacosta738

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e7ea85f9-96e4-4cde-a8d9-68900dc6464c

📥 Commits

Reviewing files that changed from the base of the PR and between c5235a4 and 48af3d4.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• renovate.json

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Improved dependency update management by grouping related AgentSync packages and platform-specific binaries into a single automatically merged update.

Walkthrough

The Renovate configuration adds a package rule for @dallay/agentsync* packages. The rule groups matching updates under agentsync and enables one automerged pull request.

Changes

Agentsync Renovate configuration

Layer / File(s)	Summary
Configure agentsync package grouping renovate.json	Renovate matches @dallay/agentsync* packages and groups their updates under the agentsync pull request group.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Poem

I hop through the config,
Agentsync updates align,
One bundle takes the trail,
Renovate keeps watch,
And merges cleanly in time.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The description accurately explains the Renovate grouping change for @dallay/agentsync packages and platform-specific binaries.
Title check	✅ Passed	The title clearly identifies the Renovate grouping of @dallay/agentsync updates, which is the main change.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/renovate-group-agentsync-10643315326089919140

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[semgrep-code-dallay]

Semgrep identified a blocking 🔴 issue in your code:

Package rule for dev dependencies lacks minimumReleaseAge, allowing auto-merge of newly released packages that could be malicious or unstable.

More details about this

This packageRules entry matches dev dependencies using "matchDepTypes": ["devDependencies"] but doesn't specify a minimumReleaseAge. Without this setting, Renovate will immediately propose updates for any newly published package versions.

Exploit scenario:

1. An attacker publishes a malicious version of a popular npm package (e.g., a dev tool like eslint or webpack) to npm.
2. Your repository's CI/CD automatically runs because Renovate creates a pull request to upgrade the package within minutes of its release.
3. The malicious package's postinstall script executes during npm install, giving the attacker access to steal secrets from your CI environment (like GitHub tokens or API keys).
4. Because this rule has "automerge": true, the compromised dependency could merge and deploy to production without human review if the malicious code is subtle enough to pass tests.

Setting "minimumReleaseAge": "7 days" creates a safety window for the community to identify and report poisoned packages before they're automatically merged into your codebase.

To resolve this comment:

✨ Commit fix suggestion

1. Add "minimumReleaseAge": "7 days" to the packageRules entry that matches devDependencies.
2. Place it in the same object as "matchDepTypes": ["devDependencies"], for example: "schedule": ["after 5pm", "every weekend"], "minimumReleaseAge": "7 days".
3. Keep the value at 7 days or more, because values below 7 days still allow very new releases to be auto-merged too quickly.
4. Alternatively, if you intentionally want this rule to skip the delay, add "minimumReleaseAge": false to this specific packageRules entry to make the exception explicit.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by renovate-missing-minimum-release-age.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud