From e0011761e6fee17ac3f98d9d7034f6d76fc2b1b9 Mon Sep 17 00:00:00 2001 From: closer-claudio Date: Sun, 6 Sep 2026 16:19:46 -0700 Subject: [PATCH] renovate: vulnerability-alert fix PRs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Stated explicitly rather than left to the preset default, because `vulnerabilityAlerts.enabled: true` is what reaches `// indirect` Go modules: the gomod manager disables indirect deps, and the alert path re-enables one only when this object says enabled. Fix PRs skip the release-age cooldown (a known-vulnerable version is the worse risk) and take the lowest fixed version — both Renovate defaults for this object. Same change as landed in limen's canonical renovate.json5. Signed-off-by: closer-claudio Co-Authored-By: Claude Fable 5.1 --- renovate.json5 | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/renovate.json5 b/renovate.json5 index c6535ba..f781d95 100644 --- a/renovate.json5 +++ b/renovate.json5 @@ -9,6 +9,17 @@ // Supply-chain cooldown: wait before proposing a bump. Doubles as protection // against the race where a release tag exists but its assets aren't uploaded yet. minimumReleaseAge: "3 days", + // Vulnerability-fix PRs from GitHub's Dependabot alerts (the baseline keeps + // the alerts on for exactly this; Dependabot's OWN update PRs are off — + // Renovate is the one dependency bot). Stated explicitly, not left to the + // preset default, because `enabled: true` here is what reaches `// indirect` + // Go modules: the gomod manager disables indirect deps, and the alert path + // re-enables a dep only when this object says enabled. Fix PRs skip the + // cooldown above (a known-vulnerable version is the worse risk) and take + // the lowest fixed version, both Renovate defaults for this object. + vulnerabilityAlerts: { + enabled: true, + }, // `just do lint commits` enforces DCO on every PR range, bot commits included. commitBody: "Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>", // The update-aqua-checksum workflow pushes a fix-up commit onto Renovate's