chore: adopt the shared renovate preset - #26
Merged
Conversation
Renovate is installed org-wide, and this repo had no config — so it was getting
an onboarding PR carrying Renovate's stock posture rather than the org's.
This adopts the shared preset instead:
{ "extends": ["github>nanohype/.github"] }
which brings the reviewed posture: patch and minor open a PR rather than
automerging, majors are labelled for review, CVE-triggered updates are excluded
from automerge twice over, GitHub Actions are grouped and pinned to commit SHAs,
and related packages move together so a split PR cannot land half an upgrade.
What there is to manage here: the pnpm workspace, tofu, and the actions in 2 workflows
postcss pulls nanoid 3.3.16, which carries GHSA-2v37-7h3g-55p8 (CVSS 8.2) — custom generators can loop indefinitely when size is zero. The build workflow runs osv-scanner over pnpm-lock.yaml, so this was failing every PR, not just this one. Pinned with a pnpm override alongside the three already there, in the same shape postcss and fast-uri use. The constraint is ^3.3.17, not >=3.3.17: the open-ended form resolves to nanoid 6, which is ESM-only and is not the API postcss calls. The caret keeps the fix inside the 3.x line the parent supports. Third repo with this same advisory today, after nanohype's six lockfiles and portal's web lockfile. Nothing looks across repos for a shared advisory, which is part of why the org is adopting Renovate — osvVulnerabilityAlerts would have raised all of them on their own.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Renovate is installed org-wide and this repo had no config, so it would otherwise take Renovate's stock posture rather than the org's reviewed one.
This adopts the shared preset:
{ "extends": ["github>nanohype/.github"] }What that brings
automergeType: branch, which commits straight to the base branch without opening a PR at alldeps,majorfor reviewvulnerabilityAlertsand a last-position packageRule, since per-package rules override top-level settings)Adoption was decided per repo, not by default
Repos with nothing to manage are deliberately not getting a config —
homebrew-taphas no manifests and no workflows, and a config there would be a control managing nothing.tenantsandclustersare skipped too: they are portal-driven GitOps, machine-written, and bot PRs into a repo another system writes are noise nobody reviews.https://claude.ai/code/session_012iMnbboJuiUMSvu7n8oRhz
What there is to manage here
the pnpm workspace, tofu, and the actions in 2 workflows