From 00b7c8e61b2069fb5a505b11ab7c2ad03f560700 Mon Sep 17 00:00:00 2001 From: bikramnehra Date: Tue, 4 Aug 2026 16:36:29 -0700 Subject: [PATCH] add vulnerabilityAlerts so CVE bumps fire off-schedule MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Renovate's weekly Monday cadence is right for normal dep bumps but wrong for security-flagged ones — a P0 CVE landing Tuesday would sit up to seven days until the next scan. `vulnerabilityAlerts.enabled` tells Renovate to read GitHub's Dependabot alert feed and open PRs immediately on a hit, bypassing the cron. Normal bumps keep batching on Monday; only the security-tagged ones jump the queue. Depends on Dependabot Security Alerts being enabled at the org/repo level (Settings → Code security), which was already standing policy before Renovate took over dep bumps. Labels the resulting PRs `security` so they're easy to filter in the review queue. --- default.json | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/default.json b/default.json index 75617c7..c75e3aa 100644 --- a/default.json +++ b/default.json @@ -37,6 +37,18 @@ prConcurrentLimit: 10, prHourlyLimit: 2, + // Open CVE-flagged bumps immediately, off-schedule. Renovate reads + // GitHub's Dependabot alert feed for each repo and, on a hit, opens a + // PR the moment the alert appears — bypassing the Monday cron. Normal + // dep bumps still batch on the weekly cadence; security-flagged ones + // don't wait up to seven days. Depends on Dependabot Security Alerts + // being on at the org/repo level (Settings → Code security), which + // was already the standing policy before Renovate replaced Dependabot. + vulnerabilityAlerts: { + enabled: true, + labels: ["security"], + }, + packageRules: [ { description: "Bundle GitHub Actions bumps into one PR. Workflows pin actions to SHAs, so each PR carries the new tag-comment automatically. Repo-local packageRules append to this.",