chore: fix renovate age-gate gaps and add missing dep-type rules - #630
Merged
Merged
Conversation
- lockFileMaintenance: add minimumReleaseAge "0 days" (Renovate cannot evaluate transitive dep ages → permanent "pending" status without it; pnpm's install-time gate enforces the real cooldown) - lockFileMaintenance: enable automerge - vulnerabilityAlerts: enable automerge (3-day delay still buffers) - Group rule: add explicit minimumReleaseAge "7 days" (does not inherit) - Add peerDependencies widen rule (ts-interface-generator) - Add engines exclusion rule (dts-generator) - Bump pnpm minimumReleaseAge from 3 days to 7 days
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The required empty changeset is missing, so the Changeset workflow will fail.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Updates dependency automation and supply-chain cooldown policies.
Changes:
- Enables automerge for vulnerability and lockfile updates.
- Adds dependency-type handling and explicit age gates.
- Raises pnpm’s release-age gate to seven days.
| File | Description |
|---|---|
renovate.json |
Refines Renovate rules, age gates, and automerge behavior. |
pnpm-workspace.yaml |
Raises the installation cooldown to seven days. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
akudev
requested review from
codeworrior and
petermuessig
and
a balanced review from Copilot
September 21, 2026 11:35
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The seven-day pnpm gate conflicts with Renovate’s three-day vulnerability-update window and can block security automerge.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Resolved since last review (1)
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
"not-pending" waits for CI status checks on the bare branch before opening a PR, but CI only triggers on pull_request events. Result: 8 updates stuck in "Pending Status Checks" on the dashboard, including a security fix for sanitize-html that was autoclosed (#616).
The 7-day install-time gate conflicts with Renovate's 3-day vulnerability alert window: security fix PRs would fail CI until the package is 7 days old, defeating the fast-track. Keep 3 days to align both gates.
The lockfile was regenerated for the 7-day age gate which has been reverted to 3 days. Restore the original versions.
codeworrior
approved these changes
Sep 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.