Madison Grubb
1b88019fb9
Unpinning the CLI keeps the previous install behavior, and leaving minimumReleaseAge in place for vulnerabilityAlerts means a malicious release can't be pulled in immediately.
33 lines
948 B
JSON
33 lines
948 B
JSON
{
|
|
"extends": [
|
|
"config:recommended",
|
|
":configMigration",
|
|
"group:allNonMajor",
|
|
":disableDependencyDashboard",
|
|
"abandonments:recommended"
|
|
],
|
|
"gitAuthor": "Renovate Bot <renovate@keligrubb.com>",
|
|
"semanticCommits": "enabled",
|
|
"semanticCommitType": "chore",
|
|
"semanticCommitScope": "deps",
|
|
"prBodyTemplate": "{{{header}}}{{{table}}}{{{warnings}}}{{{notes}}}{{{changelogs}}}{{{controls}}}",
|
|
"minimumReleaseAge": "3 days",
|
|
"rangeStrategy": "auto",
|
|
"labels": ["dependencies"],
|
|
"osvVulnerabilityAlerts": true,
|
|
"vulnerabilityAlerts": {
|
|
"enabled": true,
|
|
"labels": ["security", "dependencies"]
|
|
},
|
|
"prConcurrentLimit": 5,
|
|
"prHourlyLimit": 5,
|
|
"dockerfile": {
|
|
"digest": { "enabled": false }
|
|
},
|
|
"packageRules": [
|
|
{ "matchDatasources": ["docker"], "pinDigests": false },
|
|
{ "matchManagers": ["dockerfile"], "pinDigests": false },
|
|
{ "matchUpdateTypes": ["pin"], "enabled": false }
|
|
]
|
|
}
|