Skip to content

fix(ci): keep Renovate from rewriting peer OR ranges #2063

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yamcodes merged 1 commit into from
Oct 9, 2026
Merged

fix(ci): keep Renovate from rewriting peer OR ranges #2063

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion .github/renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,14 @@
"schedule": ["on friday"],
"vulnerabilityAlerts": {
"enabled": true,
// Default is update-lockfile. For a range with no lockfile entry
// (peerDependencies), Renovate then switches that to bump. bump
// rewrites each `||` alternative and joins them with spaces, so
// `^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0` becomes
// `^8.0.16 ^8.0.16 ^8.0.16 ^8.0.16 ^8.0.16` (see #2033).
// `auto` widens peers and leaves an in-range peer range unchanged.
// Pinned devDependencies still move to the fixed version.
"rangeStrategy": "auto",
},
"osvVulnerabilityAlerts": true,
"updateInternalDeps": true,
Expand All @@ -21,7 +29,9 @@
// Note: Order by least important to most important,
// see note at the end of https://docs.renovatebot.com/configuration-options/#packagerules

// Do not edit peer dependency ranges in package manifests.
// Do not edit peer dependency ranges on regular updates.
// Security updates re-enable peers; vulnerabilityAlerts.rangeStrategy
// above stops those from rewriting `||` ranges.
{
"matchDepTypes": ["peerDependencies"],
"enabled": false,
Expand Down
13 changes: 13 additions & 0 deletions scripts/sync-lib/renovate.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,19 @@ describe("Renovate configuration", () => {
expect(pnpmGroup).toContain('"examples/**"');
});

it("keeps security updates from rewriting peer OR ranges", () => {
const alertsStart = config.indexOf('"vulnerabilityAlerts"');
const alertsEnd = config.indexOf('"osvVulnerabilityAlerts"');
const alerts = config.slice(alertsStart, alertsEnd);

expect(alertsStart).toBeGreaterThanOrEqual(0);
expect(alertsEnd).toBeGreaterThan(alertsStart);
expect(alerts).toContain('"enabled": true');
// update-lockfile is rewritten to bump for unlocked ranges, which
// joins `||` alternatives with spaces. auto widens peers instead.
expect(alerts).toContain('"rangeStrategy": "auto"');
});

it("keeps generated examples excluded from Renovate updates", () => {
const disableRuleStart = config.indexOf(
'"description": "Disable sync-generated example apps"',
Expand Down
Loading