[stefan-schott-sonarsource]

---

Summary by Gitar

• Dependency config:
  • Added minimumReleaseAge set to 5 days in renovate.json to align with the Step Security policy
• Submodule exemption:
  • Set minimumReleaseAge to null for git-submodules manager in renovate.json
• Package exemption:
  • Set minimumReleaseAge to null for org.sonarsource* and com.sonarsource* packages in renovate.json

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

SONARPHP-1963

[felix-pauck-sonarsource]

LGTM! 👍

Not approving for now due to the open clarification question.

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Adding a five-day Renovate release cooldown may delay dependency updates, while SonarSource packages and git submodules remain exempt.

Adds a 5-day minimumReleaseAge to renovate.json to align with the Step Security policy, with exemptions for git-submodules and org.sonarsource*/com.sonarsource* packages. The top-level setting would have blocked build-logic/common submodule updates, and that is now addressed by the submodule exemption.

✅ 1 closed

✅ Bug: Top-level minimumReleaseAge will block build-logic/common submodule updates

📄 .github/renovate.json:10 📄 .github/renovate.json:11-14 📄 .github/renovate.json:20-22 🔗 link 🔗 link
The new minimumReleaseAge is set at the top level, so it also covers the git-submodules manager, which this config turns on deliberately (cloneSubmodulesFilter: build-logic/common, git-submodules.enabled: true). Submodule updates come from the git-refs datasource, and that datasource has no release timestamps (git-refs datasource: "Release timestamp support: No").

Since Renovate 42, minimumReleaseAgeBehaviour defaults to timestamp-required. An update with no timestamp is treated as never having reached the minimum age (minimum release age). The result is that build-logic/common submodule bumps stay pending forever and no PR is ever opened. Any custom.regex deps whose datasource has no timestamps are affected the same way.

The fix is to add a packageRule for git-submodules that turns the age check off. Another option is to set minimumReleaseAgeBehaviour: "timestamp-optional" for those managers. The docs also recommend internalChecksFilter: "strict" with minimumReleaseAge, so branches aren't created while updates are still pending.

Verification Rules 1/1 met

Functional validation No results

Rules 1 passed 2 not applicable

✅ Repository license compliance

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[felix-pauck-sonarsource]

LGTM! 👍