keligrubb/renovate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Releases Activity

improve renovate: osv vulnerability alerts, abandonment reporting, pr limits #8

Merged
Keli Grubb merged 3 commits from improve-renovate-security-and-pinning into main 2026-08-13 14:33:55 +00:00
Conversation 0 Commits 3 Files Changed 2
+21 -4
Keli Grubb commented 2026-08-13 14:27:15 +00:00
Owner
Copy Link
Copy Source

Summary

  • turn on osvVulnerabilityAlerts + vulnerabilityAlerts so vulnerable deps get their own PRs labeled security, instead of just riding along in the grouped non-major PR
  • vuln PRs still respect the 3 day minimumReleaseAge cooldown on purpose. bypassing it would let a compromised release (shai-hulud style) land the moment it publishes, which is worse than sitting on a known cve for 3 days
  • add abandonments:recommended so unmaintained packages get flagged early
  • add dependencies label plus prConcurrentLimit / prHourlyLimit of 5 so a first run on a stale repo doesn't dump 30 prs
  • no workflow behavior changes. schedule stays hourly, install stays as-is. just fixed the readme, which said every 6 hours while the cron was hourly

needs dependencies and security labels to exist on the repos (or org-wide), otherwise labeling just no-ops.

## Summary * turn on `osvVulnerabilityAlerts` + `vulnerabilityAlerts` so vulnerable deps get their own PRs labeled `security`, instead of just riding along in the grouped non-major PR * vuln PRs still respect the 3 day `minimumReleaseAge` cooldown on purpose. bypassing it would let a compromised release (shai-hulud style) land the moment it publishes, which is worse than sitting on a known cve for 3 days * add `abandonments:recommended` so unmaintained packages get flagged early * add `dependencies` label plus `prConcurrentLimit` / `prHourlyLimit` of 5 so a first run on a stale repo doesn't dump 30 prs * no workflow behavior changes. schedule stays hourly, install stays as-is. just fixed the readme, which said every 6 hours while the cron was hourly needs `dependencies` and `security` labels to exist on the repos (or org-wide), otherwise labeling just no-ops.
Keli Grubb added 1 commit 2026-08-13 14:27:16 +00:00
improve renovate: osv alerts, pin cli, slower cron d771c4c97f 
Prioritize vulnerability fix PRs, pin Renovate via package-lock for
reproducible runs, and drop the hourly schedule to every 6 hours.
Keli Grubb added 1 commit 2026-08-13 14:29:50 +00:00
drop renovate version pin and keep release-age cooldown for vulns 1b88019fb9 
Unpinning the CLI keeps the previous install behavior, and leaving
minimumReleaseAge in place for vulnerabilityAlerts means a malicious
release can't be pulled in immediately.
Keli Grubb changed title from improve renovate: osv alerts, pin cli, slower cron to improve renovate: osv vulnerability alerts, abandonment reporting, slower cron 2026-08-13 14:30:04 +00:00
Keli Grubb added 1 commit 2026-08-13 14:31:15 +00:00
keep the hourly schedule bec9fe6f4a 
Reverts the cron change and fixes the README, which claimed every 6
hours while the workflow ran hourly.
Keli Grubb changed title from improve renovate: osv vulnerability alerts, abandonment reporting, slower cron to improve renovate: osv vulnerability alerts, abandonment reporting, pr limits 2026-08-13 14:31:22 +00:00
Keli Grubb merged commit 6e7190e985 into main 2026-08-13 14:33:55 +00:00
Keli Grubb deleted branch improve-renovate-security-and-pinning 2026-08-13 14:33:55 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
dependencies
Pull requests that update a dependency file
 security
Vulnerability-driven dependency update
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
renovate-bot (Renovate Bot) keligrubb (Keli Grubb)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: keligrubb/renovate#8