chore(renovate): batch updates monthly and age releases 7 days - #30
Merged
Conversation
The shared marimo-team config sets no schedule, no release-age floor, and no automerge, so Renovate fired continuously and every major opened its own PR. Combined with an empty bypass_actors list on the default branch ruleset, nothing could ever merge itself and PRs only accumulated. A monthly schedule plus a 7-day minimumReleaseAge is the same posture marimo/marimo already runs. The age floor is the point: a compromised npm release is usually yanked within hours, so refusing anything younger than a week filters most package-poisoning attacks without human review. Vulnerability alerts opt out of both the schedule and the floor so a real CVE fix is not delayed a week. Pin, digest, patch and minor updates automerge on green CI; majors still need a review since they can break the build. abandonmentThreshold is disabled because the packages it flagged (clsx, lz-string) are stable rather than unmaintained, and the dashboard section was pure noise. The equivalent pnpm-level minimumReleaseAge is deliberately not set yet. Four package.json floors currently point at releases younger than seven days, so pnpm resolution fails with NO_MATURE_MATCHING_VERSION until they age out on 2026-08-03.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reduces Renovate PR volume and adds supply-chain protection against package poisoning.
What changes
schedule:monthly— updates arrive in one predictable batch instead of a continuous stream. Same cadencemarimo/marimouses.minimumReleaseAge: "7 days"— Renovate will not propose a version published within the last week. A compromised npm release is usually yanked within hours, so this filters most package-poisoning attacks without needing a human to spot them.prConcurrentLimit: 3— caps how much can be open at once.abandonmentThreshold: null— drops the dashboard's "Abandoned Dependencies" section. It flaggedclsx,class-variance-authorityandlz-string, which are stable rather than unmaintained.vulnerabilityAlertsopts out of both the schedule and the age floor, so a real CVE fix is not delayed by a week.Why PRs were piling up
The shared
marimo-team/.github:renovate-configsets no schedule, no release-age floor and no automerge. Separately, the default-branch ruleset requires 1 approving review with an emptybypass_actorslist, so Renovate could never merge anything — five PRs sat green andBLOCKED. Automerge here only works once Renovate is added to that bypass list.Follow-up: pnpm-level floor
The stronger version of this protection is
minimumReleaseAgeinpnpm-workspace.yaml, which blocks installing anything too new — including transitive deps and manualpnpm add, neither of which Renovate covers.It cannot land yet. Four
package.jsonfloors point at releases younger than 7 days, so a fresh resolution fails:Regenerating the lockfile does not help — no older version satisfies those caret ranges. They mature on 2026-08-03, after which this becomes a one-line follow-up. Once Renovate refuses to propose anything under 7 days, package.json floors can no longer outrun the pnpm policy.
Verification
python3 -c "import json; json.load(open(\"renovate.json\"))"passes.