Action Required: Fix Renovate Configuration #291

New issue

Closed

opened 2026-08-06 06:15:40 +00:00 by renovate-bot · 1 comment

renovate-bot commented

2026-08-06 06:15:40 +00:00

Contributor

There is an error with this repository's Renovate configuration that needs to be fixed. As a precaution, Renovate will stop PRs until it is resolved.

Location: renovate.json
Error type: The renovate configuration file contains some invalid settings
Message: Invalid configuration option: osvVulnerabilityAlertsDescription

There is an error with this repository's Renovate configuration that needs to be fixed. As a precaution, Renovate will stop PRs until it is resolved. Location: `renovate.json` Error type: The renovate configuration file contains some invalid settings Message: Invalid configuration option: osvVulnerabilityAlertsDescription

rbrooks referenced this issue from a commit

2026-08-07 03:30:51 +00:00

fix(renovate): drop invalid osvVulnerabilityAlertsDescription option (#291)

claude-bot commented

2026-08-07 03:31:03 +00:00

Contributor

Fixed in dbe90cc on main.

Cause. osvVulnerabilityAlertsDescription is not a Renovate option. There is no <option>Description suffix convention — description is only valid inside an object config, which is why the existing pip-compile block and every packageRules entry can carry one, but a boolean like osvVulnerabilityAlerts cannot. It was added alongside osvVulnerabilityAlerts to explain why that option was needed, and silently invalidated the entire config.

Impact while it was broken: Renovate stopped opening PRs altogether — including the vulnerability-driven ones osvVulnerabilityAlerts was added to enable after #282. So the config error suppressed exactly the capability it was documenting.

Fix. Moved the rationale into vulnerabilityAlerts.description, directly above the option it explains. One line, text preserved.

Verified with Renovate's own validator rather than by inspection — the previous file errors, the new one passes:

docker run --rm -v <dir>:/w -w /w node:22-slim \
  npx --yes --package renovate renovate-config-validator
# INFO: Validating renovate.json
# INFO: Config validated successfully

Worth adding that validator command to the loop for any future renovate.json edit — this class of error is invisible until Renovate's next run, and it fails closed.

Closing; Renovate should also drop this issue on its next run.

Fixed in `dbe90cc` on `main`. **Cause.** `osvVulnerabilityAlertsDescription` is not a Renovate option. There is no `<option>Description` suffix convention — `description` is only valid *inside* an object config, which is why the existing `pip-compile` block and every `packageRules` entry can carry one, but a boolean like `osvVulnerabilityAlerts` cannot. It was added alongside `osvVulnerabilityAlerts` to explain why that option was needed, and silently invalidated the entire config. **Impact while it was broken:** Renovate stopped opening PRs altogether — including the vulnerability-driven ones `osvVulnerabilityAlerts` was added to enable after #282. So the config error suppressed exactly the capability it was documenting. **Fix.** Moved the rationale into `vulnerabilityAlerts.description`, directly above the option it explains. One line, text preserved. Verified with Renovate's own validator rather than by inspection — the previous file errors, the new one passes: ``` docker run --rm -v <dir>:/w -w /w node:22-slim \ npx --yes --package renovate renovate-config-validator # INFO: Validating renovate.json # INFO: Config validated successfully ``` Worth adding that validator command to the loop for any future `renovate.json` edit — this class of error is invisible until Renovate's next run, and it fails closed. Closing; Renovate should also drop this issue on its next run.

claude-bot closed this issue

2026-08-07 03:31:09 +00:00