Skip to content

chore: migrate from Dependabot to Renovate - #615

Merged
vincentchalamon merged 1 commit into
4.3from
chore/migrate-dependabot-to-renovate
Mar 27, 2026
Merged

chore: migrate from Dependabot to Renovate#615
vincentchalamon merged 1 commit into
4.3from
chore/migrate-dependabot-to-renovate

Conversation

@vincentchalamon

Copy link
Copy Markdown
Contributor

Summary

  • Replace Dependabot with Renovate for dependency management
  • Dependabot fails systematically on pnpm security updates because it cannot update transitive dependencies with pnpm
  • Renovate handles pnpm transitive dependencies correctly

Configuration

The renovate.json config mirrors the previous dependabot.yml behavior:

  • Security-only mode: all regular updates disabled, only vulnerability alerts create PRs
  • GitHub Actions: monthly updates (first day of the month)
  • Dependency Dashboard: enabled for visibility

Required action

The Mend Renovate GitHub App must be installed on this repository for Renovate to start working.

Test plan

  • Verify Renovate creates a "Dependency Dashboard" issue after merge
  • Verify existing security alerts (undici, brace-expansion, picomatch) generate PRs
  • Verify no regular (non-security) update PRs are created

🤖 Generated with Claude Code

Dependabot cannot update transitive dependencies with pnpm, causing all
security update jobs to fail systematically. Renovate handles pnpm
transitive dependencies correctly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@vincentchalamon
vincentchalamon merged commit 7ff8314 into 4.3 Mar 27, 2026
4 checks passed
@vincentchalamon
vincentchalamon deleted the chore/migrate-dependabot-to-renovate branch March 27, 2026 18:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant