Configure and enable Renovate dependency automation #4

New issue

Closed

opened 2026-07-17 01:17:53 +00:00 by claude-bot · 2 comments

claude-bot commented

2026-07-17 01:17:53 +00:00

Contributor

Renovate is already running against this repo - the self-hosted renovate-bot opened onboarding PR #2 on 2026-06-23 from branch renovate/configure. It detects all six package files (root + backend package.json, both Dockerfiles, both compose files).

With default config it wants to open 13 PRs immediately, nearly all majors: React 19, Vite 8, Tailwind 4, Express 5, jose 6, recharts 3, dotenv 17, lucide-react 1.x, node 26, postgres 18.

Add a renovate.json that:

groups related deps (React + types, Vite ecosystem)
schedules PRs weekly rather than at any time
limits concurrent open PRs
auto-merges dev-dependency patch/minor once CI exists
keeps every major as its own manual PR

Then merge PR #2 to activate. Depends on CI landing first for auto-merge to be safe.

Renovate is already running against this repo - the self-hosted `renovate-bot` opened onboarding PR #2 on 2026-06-23 from branch `renovate/configure`. It detects all six package files (root + backend `package.json`, both Dockerfiles, both compose files). With default config it wants to open 13 PRs immediately, nearly all majors: React 19, Vite 8, Tailwind 4, Express 5, jose 6, recharts 3, dotenv 17, lucide-react 1.x, node 26, postgres 18. Add a `renovate.json` that: - groups related deps (React + types, Vite ecosystem) - schedules PRs weekly rather than `at any time` - limits concurrent open PRs - auto-merges dev-dependency patch/minor once CI exists - keeps every major as its own manual PR Then merge PR #2 to activate. Depends on CI landing first for auto-merge to be safe.

claude-bot added this to the v1.1.0 - Test & Ops Hardening milestone

2026-07-17 01:17:53 +00:00

claude-bot added the

ops

label

2026-07-17 01:17:53 +00:00

claude-bot commented

2026-07-17 01:29:22 +00:00

Author

Contributor

Added renovate.json:

Weekly off-hours schedule (* 0-6 * * 1, America/Chicago) instead of at any time.
prConcurrentLimit: 3, prHourlyLimit: 2.
All majors require dependency-dashboard approval (major.dependencyDashboardApproval: true), which is what prevents the 13 major PRs from landing at once. Docker majors (node, postgres) are separately gated the same way.
Grouped: React + types, Vite ecosystem, CSS tooling (tailwind/postcss/autoprefixer), and all Docker images.
Auto-merge devDependency patch+minor, and production-dependency patch only.

Activation note: once renovate.json is committed to main, Renovate treats the repo as onboarded and should close PR #2 on its own — no need to merge the onboarding PR.

Caveat worth reading before trusting auto-merge: with no lockfiles committed (#19), in-range minor/patch PRs are close to meaningless since npm install already resolves the newest in-range version, and lockFileMaintenance is currently a no-op. Renovate's real value here is the major updates until #19 is fixed. I'd hold off on auto-merge until lockfiles and a green CI run both exist.

Staged in the working tree; not yet committed.

Added `renovate.json`: - Weekly off-hours schedule (`* 0-6 * * 1`, `America/Chicago`) instead of `at any time`. - `prConcurrentLimit: 3`, `prHourlyLimit: 2`. - **All majors require dependency-dashboard approval** (`major.dependencyDashboardApproval: true`), which is what prevents the 13 major PRs from landing at once. Docker majors (node, postgres) are separately gated the same way. - Grouped: React + types, Vite ecosystem, CSS tooling (tailwind/postcss/autoprefixer), and all Docker images. - Auto-merge devDependency patch+minor, and production-dependency patch only. **Activation note:** once `renovate.json` is committed to `main`, Renovate treats the repo as onboarded and should close PR #2 on its own — no need to merge the onboarding PR. **Caveat worth reading before trusting auto-merge:** with no lockfiles committed (#19), in-range minor/patch PRs are close to meaningless since `npm install` already resolves the newest in-range version, and `lockFileMaintenance` is currently a no-op. Renovate's real value here is the major updates until #19 is fixed. I'd hold off on auto-merge until lockfiles and a green CI run both exist. Staged in the working tree; not yet committed.

claude-bot referenced this issue

2026-07-17 01:41:03 +00:00

Add CI, Renovate config, changelog, and lockfiles; refresh docs #20

claude-bot commented

2026-07-17 02:00:52 +00:00

Author

Contributor

Done in #20, merged as a0d604b. renovate.json gates all majors behind dashboard approval, schedules weekly off-hours, groups React/Vite/CSS/Docker, and limits concurrency.

With #19 fixed, lockFileMaintenance is now active and in-range updates are meaningful. Worth checking that the onboarding PR #2 auto-closed now that renovate.json is on main.

Done in #20, merged as `a0d604b`. `renovate.json` gates all majors behind dashboard approval, schedules weekly off-hours, groups React/Vite/CSS/Docker, and limits concurrency. With #19 fixed, `lockFileMaintenance` is now active and in-range updates are meaningful. Worth checking that the onboarding PR #2 auto-closed now that `renovate.json` is on `main`.

claude-bot closed this issue

2026-07-17 02:00:52 +00:00

claude-bot referenced this issue

2026-07-17 03:09:29 +00:00

Payback sensitivity table (escalation × degradation grid) #48