drop renovate version pin and keep release-age cooldown for vulns

Unpinning the CLI keeps the previous install behavior, and leaving minimumReleaseAge in place for vulnerabilityAlerts means a malicious release can't be pulled in immediately.
2026-08-13 10:29:48 -04:00
parent d771c4c97f
commit 1b88019fb9
6 changed files with 28 additions and 7711 deletions
@@ -17,8 +17,7 @@
  "osvVulnerabilityAlerts": true,
  "vulnerabilityAlerts": {
    "enabled": true,
-    "labels": ["security", "dependencies"],
-    "minimumReleaseAge": "0 days"
+    "labels": ["security", "dependencies"]
  },
  "prConcurrentLimit": 5,
  "prHourlyLimit": 5,