fix(ci): keep Renovate from rewriting peer OR ranges

[yamcodes]

Security updates were still rewriting peer ranges even though peerDependencies are disabled.

#2033 turned @arkenv/vite-plugin's Vite peer range from ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0 into ^8.0.16 ^8.0.16 ^8.0.16 ^8.0.16 ^8.0.16. Vulnerability alerts force rangeStrategy: update-lockfile, and Renovate then switches that to bump when the range has no lockfile entry. bump rewrites each || alternative and joins them with spaces.

vulnerabilityAlerts.rangeStrategy is now auto. npm widens peers, so an in-range peer range stays as written, and a pinned devDependency still moves to the fixed version. Regular (non-security) updates still skip peerDependencies.

  

[changeset-bot]

⚠️ No Changeset found

Latest commit: c94a8f3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pullfrog]

✅ No new issues found.

Reviewed changes

• Renovate vulnerability range strategy — .github/renovate.json sets vulnerabilityAlerts.rangeStrategy: "auto" (previously the implicit update-lockfile), with comments explaining the ||-range corruption from #2033.
• Regression guard — scripts/sync-lib/renovate.test.js adds a string-presence test asserting the vulnerabilityAlerts block keeps "enabled": true and "rangeStrategy": "auto".

The fix is behaviorally correct. Under the old default, a vulnerability update on a range with no lockedVersion (peers normally) escalates update-lockfile → bump, and npm's bump replaces each || alternative and space-joins them, producing exactly the ^8.0.16 ^8.0.16 … corruption in #2033. auto makes npm resolve peers to widen, so the escalation never fires and an in-range fix leaves the range untouched, while pinned devDependencies still move to the fixed version. The peerDependencies: enabled: false packageRule remains correct for regular updates because the vulnerability rule re-enables peers via its force, and it does not override rangeStrategy.

The added test is a literal string check — consistent with the other tests in the same file — and can't validate Renovate's runtime behavior, but it does pin the regression line. No blocking or minor issues.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}