36 lines
1.6 KiB
JSON
36 lines
1.6 KiB
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"description": [
|
|
"feature-dependency-vulnerability-management-contract D6 / §4 — dependency SECURITY update automation.",
|
|
"Renovate is primary over Dependabot: with a gradle/libs.versions.toml version catalog plus Gradle",
|
|
"lockfiles, Dependabot does not refresh the lockfile (issue #12557), which conflicts with",
|
|
"feature-build-release-supply-chain-contract D8 (dependency locking). Dependabot stays a conditional",
|
|
"alternative for forks that standardize on it or do not use lockfiles.",
|
|
"Transitive vulnerabilities are NOT covered by either bot (direct deps only) — pin them with a Gradle",
|
|
"dependency constraint / resolutionStrategy.force (§4) and regenerate locks (supply-chain D8)."
|
|
],
|
|
"extends": [
|
|
"config:recommended",
|
|
"security:only-security-updates"
|
|
],
|
|
"vulnerabilityAlerts": {
|
|
"description": "Stable GitHub vulnerability alerts → immediate security PR, ignoring schedule.",
|
|
"enabled": true,
|
|
"labels": ["security", "dependencies"]
|
|
},
|
|
"osvVulnerabilityAlerts": true,
|
|
"packageRules": [
|
|
{
|
|
"description": "UNSUPPORTED_IMPL_DECISION (team-policy): auto-merge patch-level security updates once CI is green — lowest breaking risk. Requires trustworthy CI coverage; a fork with weak CI should set this to false.",
|
|
"matchUpdateTypes": ["patch", "pin", "digest"],
|
|
"automerge": true,
|
|
"automergeType": "pr"
|
|
},
|
|
{
|
|
"description": "minor/major security updates require human review (breaking-change risk).",
|
|
"matchUpdateTypes": ["minor", "major"],
|
|
"automerge": false
|
|
}
|
|
]
|
|
}
|