chore(renovate): tune for "Automated PRs" - security bypass, burst caps, lockfile hold

[wormeyman]

The Renovate GitHub App is live as of 2026-07-30, enabled with Automated PRs, Require config file and Create onboarding PRs. The config landed in #56 was written for an app that was not yet on, so it now has to hold up unattended rather than describe an intent.

Note "Require config file" means merging #56 first was load-bearing: with that setting and no config on the default branch, Renovate would have done nothing at all, silently.

Changes

setting	why
timezone: America/Los_Angeles	the schedule was UTC, so "before 6am on monday" fired ~midnight Sunday local
prConcurrentLimit: 3, prHourlyLimit: 2	the first run sees every pending update at once, and each PR now costs a ~4 min CI run
vulnerabilityAlerts	a CVE fix could otherwise sit ~10 days: up to 3 for the age floor, then up to 7 for the Monday window
osvVulnerabilityAlerts: true	GitHub advisories miss ecosystem-only reports
lockFileMaintenance: { enabled: false }	it is automated pnpm up for the lockfile
dependencyDashboardApproval	deliberately NOT set

The two non-obvious ones

vulnerabilityAlerts.minimumReleaseAge is "25 hours", not 0. The obvious move is to drop the age floor entirely for security fixes. That would be wrong here: pnpm 11 refuses anything younger than 24h without writing a minimumReleaseAgeExclude: bypass into pnpm-workspace.yaml, so a same-day security PR would reintroduce precisely the hazard the top-of-file comment exists to prevent - the way vue-tsc@3.3.8 once waived the guard silently. 25 hours clears pnpm with an hour to spare and still cuts the wait from 3 days to ~1.

lockFileMaintenance is pinned off rather than left off. It is off by default, but it is also automated pnpm up for the lockfile, and that is the one dependency operation this repo has measured as harmful: re-resolving the ~22 surrounding transitive packages triggered TS2321: Excessive stack depth comparing types ... 'UserConfig' in vite.config.ts, while installing the same target versions directly did not. Explicit so it cannot get switched on as tidying.

dependencyDashboardApproval is deliberately unset. It would require ticking a box per update before a PR appears, which re-imposes scan-only behaviour at the config layer and would quietly defeat the app's "Automated PRs" setting. PRs are wanted; what is not wanted is anything merging unread, which is automerge: false's job.

Verification

renovate-config-validator exit 0. CI verify runs on this PR.

CLAUDE.md's "Renovate is inert until the GitHub App is enabled on the repo" is now false and is corrected in the same commit.

Not done here

• Branch protection on main requiring verify - a repository setting, not a file. It is also the prerequisite for ever enabling narrow automerge (Action digest re-pins), which stays off until it exists.
• Renovate will likely propose the bumps already tracked as Bump wrangler 4.115.0 + @cloudflare/vitest-pool-workers 0.19.0 (deferred: 24h release-age gate) #48/Bump pinned pnpm 11.17.0 -> 11.18.0 (deferred: 24h release-age gate) #53 and in flight as deps(worker): bump wrangler 4.115.0 + vitest-pool-workers 0.19.0 #51. Once deps(worker): bump wrangler 4.115.0 + vitest-pool-workers 0.19.0 #51 lands, Bump wrangler 4.115.0 + @cloudflare/vitest-pool-workers 0.19.0 (deferred: 24h release-age gate) #48 can close; Bump pinned pnpm 11.17.0 -> 11.18.0 (deferred: 24h release-age gate) #53 can probably be closed in favour of the bot.

🤖 Generated with Claude Code

https://claude.ai/code/session_01F3a2HLJ4beKARi7SPmaM54