You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Replace the Dependabot config with a Renovate config based on
config:best-practices: weekly Monday schedule in Europe/Amsterdam,
7-day minimum release age, OSV vulnerability alerts, exact version
pins and weekly lock file maintenance. Security updates bypass the
schedule, wait 3 days and get a security label.
The Sentry packages stay grouped through config:recommended's
group:monorepos preset (sentry-javascript).
Read the wrangler version with ltrimstr("^") instead of cut -c2- so
the deploy step keeps working once package.json holds exact versions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PvRm4BkK7RdvnMAS87zfDp
config:best-practices extends security:minimumReleaseAgeNpm, whose npm
package rule sets a 3-day minimum release age and takes precedence over
the root-level value. Add a repository rule for npm major, minor and
patch updates so they wait 7 days, keeping the preset's exceptions for
pin, replacement and lock file maintenance updates.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PvRm4BkK7RdvnMAS87zfDp
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
Devcontainer digest pinning needs an explicit override, and missing MCR release timestamps block image updates.
No open issues 🎉
2 previously missed issues
In code that hasn't changed since last review
Allow MCR images without release timestamps
.github/renovate.json:23
The global seven-day release-age requirement also applies to .devcontainer.json:3, which uses an image from mcr.microsoft.com. Renovate's Docker datasource provides release timestamps only for Docker Hub, so the default timestamp-required behavior leaves this image's updates pending indefinitely. Add a timestamp-optional exception for MCR images while retaining the age requirement wherever timestamps are available. This is separate from enabling devcontainer digest pinning.
Enable digest pinning for devcontainer images
.github/renovate.json:28
The inherited docker:pinDigests preset explicitly sets pinDigests: false for the devcontainer manager. As a result, .devcontainer.json's image will remain unpinned despite the stated goal. Add a package rule overriding that exception for devcontainers; the release-timestamp restriction also needs to be addressed separately.
docker:pinDigests disables digest pinning for the devcontainer manager,
so the devcontainer image stayed unpinned. Turn it back on.
Renovate's Docker datasource only gets release timestamps from Docker
Hub. With the default timestamp-required behaviour, images from other
registries, such as the mcr.microsoft.com devcontainer image, never
pass minimumReleaseAge and never get updates. Use timestamp-optional
for Docker images; images with a timestamp still wait 7 days.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PvRm4BkK7RdvnMAS87zfDp
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/dependabot.ymlwith.github/renovate.jsonbased onconfig:best-practices.securitylabel.group:monorepospreset.wrangler.yml: read the wrangler version withltrimstr("^")so the deploy keeps working with exact versions.Follow-up
Generated by Claude Code