feat: bump dependency ranges in Renovate pull requests

[cryptodev-2s]

Explanation

By default Renovate leaves a manifest alone when the new version already satisfies the declared range, so #10318 bumped ts-jest to 29.4.12 in yarn.lock and touched no package.json at all. That keeps the declared minimum at the old version and produces no changelog entry, since nothing published changed.

We want a changelog entry for every dependency bump, so rangeStrategy: bump moves the range with the release: ^29.4.11 becomes ^29.4.12 across every workspace that declares it, the same as Dependabot does today. Out of range updates like #10320 already behaved this way.

peerDependencies are exempted back to widen. An explicit rangeStrategy overrides Renovate's peer handling (npm/range.ts), and 11 peer entries here have simple ranges that would be narrowed rather than broadened, @babel/runtime ^7.0.0 most obviously. The other 11 are complex ranges like ^16.8.0 || ^17.0.0 and widen regardless.

The cost is diff size. A single patch now rewrites the same line in every manifest that declares the dependency, and each of those packages needs an entry. #10322 is what writes them.

Important

Depends on #10322. Without it the repair workflow still skips Renovate pull requests, and every one of them lands red on Check changelog.

References

Depends on #10322. Follows #10317. Part of WPC-1161.

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Low Risk
Tooling-only change to Renovate; it does not alter runtime code, but it will enlarge dependency PR diffs across workspaces.

Overview
Renovate is configured to raise semver ranges in package.json when a newer release still satisfies the existing constraint (rangeStrategy: bump), matching Dependabot behavior so lockfile-only bumps no longer skip manifest updates and downstream changelog tooling can see a published change.

A peer-only override sets rangeStrategy: widen for peerDependencies, undoing the global bump so wide peer ranges stay broadened instead of tightened.

Note: This is meant to work with the changelog repair workflow in #10322; without that, Renovate PRs may fail Check changelog.

^{Reviewed by Cursor Bugbot for commit 9ab221a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f2a33f8. Configure here.}

[mcmire]

LGTM.

[mcmire]

Didn't realize that this was the default for peer dependencies (source here). I would think that Renovate would leave peer deps alone, but I guess that strategy may limit the degree could upgrade production deps. I guess we can see how well this strategy works out in practice. We don't have many peer deps anyway so maybe it doesn't matter.