Skip to content

group @dallay/agentsync updates in Renovate #554

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yacosta738 merged 1 commit into from
Aug 12, 2026
Merged

group @dallay/agentsync updates in Renovate #554

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 30 additions & 30 deletions pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,11 @@
"automerge": true
},
"packageRules": [
{
"description": "Group all @dallay/agentsync packages and platform-specific binaries into a single PR.",
"matchPackageNames": ["@dallay/agentsync*"],
"groupName": "agentsync"
},
Comment on lines +19 to +23

@semgrep-code-dallay semgrep-code-dallay Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified a blocking 🔴 issue in your code:

Package rule for dev dependencies lacks minimumReleaseAge, allowing auto-merge of newly released packages that could be malicious or unstable.

More details about this

This packageRules entry matches dev dependencies using "matchDepTypes": ["devDependencies"] but doesn't specify a minimumReleaseAge. Without this setting, Renovate will immediately propose updates for any newly published package versions.

Exploit scenario:

  1. An attacker publishes a malicious version of a popular npm package (e.g., a dev tool like eslint or webpack) to npm.
  2. Your repository's CI/CD automatically runs because Renovate creates a pull request to upgrade the package within minutes of its release.
  3. The malicious package's postinstall script executes during npm install, giving the attacker access to steal secrets from your CI environment (like GitHub tokens or API keys).
  4. Because this rule has "automerge": true, the compromised dependency could merge and deploy to production without human review if the malicious code is subtle enough to pass tests.

Setting "minimumReleaseAge": "7 days" creates a safety window for the community to identify and report poisoned packages before they're automatically merged into your codebase.

To resolve this comment:

✨ Commit fix suggestion
  1. Add "minimumReleaseAge": "7 days" to the packageRules entry that matches devDependencies.
  2. Place it in the same object as "matchDepTypes": ["devDependencies"], for example: "schedule": ["after 5pm", "every weekend"], "minimumReleaseAge": "7 days".
  3. Keep the value at 7 days or more, because values below 7 days still allow very new releases to be auto-merged too quickly.
  4. Alternatively, if you intentionally want this rule to skip the delay, add "minimumReleaseAge": false to this specific packageRules entry to make the exception explicit.
💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by renovate-missing-minimum-release-age.

You can view more details about this finding in the Semgrep AppSec Platform.

{
"description": "Baseline rule enforcing 3-day minimum release age for supported package updates (dependencies, devDependencies, etc.). Note: pnpm-workspace.yaml controls release age validation for lockfile maintenance.",
"matchManagers": ["npm", "pnpm"],
Expand Down
Loading