chore(renovate): enable vulnerabilityAlerts so CVE bumps fire off-schedule - #5
Merged
Merged
Conversation
Renovate's weekly Monday cadence is right for normal dep bumps but wrong for security-flagged ones — a P0 CVE landing Tuesday would sit up to seven days until the next scan. `vulnerabilityAlerts.enabled` tells Renovate to read GitHub's Dependabot alert feed and open PRs immediately on a hit, bypassing the cron. Normal bumps keep batching on Monday; only the security-tagged ones jump the queue. Depends on Dependabot Security Alerts being enabled at the org/repo level (Settings → Code security), which was already standing policy before Renovate took over dep bumps. Labels the resulting PRs `security` so they're easy to filter in the review queue.
bikramnehra
added a commit
that referenced
this pull request
Aug 4, 2026
The rename PR (#4) moved default.json5 → default.json but missed the CI workflow, which is hardcoded to the old filename. Every run since has failed with `File does not exist "default.json5"` — PR #4 and PR #5 both merged past a red check because the check isn't required. Point the validator at default.json. Confirmed locally: exit 0, "Config validated successfully" (with the harmless JSON5-in-.json deprecation warn, which does not fail --strict).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Renovate's weekly Monday cadence is right for normal dep bumps but wrong for security-flagged ones — a P0 CVE landing Tuesday would sit up to seven days until the next scan. Today's Inspector-driven push surfaced 35 critical findings on forge-prod nodes that had accumulated since the July 20 Renovate outage; keeping the response time short is worth a small config lever.
Change
Enable
vulnerabilityAlertsat the shared preset. Renovate reads GitHub's Dependabot alert feed for each repo and, on a hit, opens a PR immediately — bypassing the cron. Normal bumps keep batching on Monday; security-flagged ones jump the queue.Requirements
Dependabot Security Alerts must be enabled at the org/repo level (Settings → Code security). This has been standing policy since we replaced Dependabot with Renovate, so no additional org-side change is needed.
Effect
forgeandforge-infra) picks up the behavior on the next Renovate run.securityfor easy review-queue filtering.Followup (not blocking)
renovate-config-validatorwarns that the file is JSON5-syntax inside a.jsonextension:Support for this will be removed in a future release. Renovate accepts it today. Two options for later:default.json5AND update both consumers togithub>HyperbolicLabs/.github//default.json5(explicit path)Both keep the current behavior; option 1 preserves the inline WHY comments better. Filing a followup issue separately.