From e38a2472be71885c6e216f7f66e1a8a6456ea3b7 Mon Sep 17 00:00:00 2001 From: Evan Vetere Date: Mon, 9 Nov 2026 08:28:48 -0500 Subject: [PATCH] fix: Stop major bumps of pnpm security floors An overrides entry keyed with a version selector, such as "react-router@<6.30.6": "^6.30.6", lifts old copies of a package to a patched release on the same major. Renovate treated the value as an ordinary range and proposed raising it to the next major, which forces every copy onto that major and breaks packages that still need the old one: react-router 8 breaks Remix v2 in milo-os/activity and milo-os/service-catalog. Key changes: - Disable major updates for npm, pnpm and pnpm-workspace overrides whose key carries a version selector - Leave minor and patch updates, and overrides without a selector, untouched --- renovate-config.json | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/renovate-config.json b/renovate-config.json index c198d37..8d27c19 100644 --- a/renovate-config.json +++ b/renovate-config.json @@ -47,6 +47,14 @@ "matchDepTypes": ["overrides"], "rangeStrategy": "bump" }, + { + "description": "Do not propose a major update for an overrides entry keyed with a version selector, such as \"react-router@<6.30.6\": \"^6.30.6\". That entry is a security floor that lifts old copies to a patched release on the same major; raising its value to the next major forces every copy onto it and breaks packages that still need the old major. Minor and patch updates still apply.", + "matchManagers": ["npm"], + "matchDepTypes": ["overrides", "pnpm.overrides", "pnpm-workspace.overrides"], + "matchDepNames": ["/^(@[^/]+\\/)?[^@/]+@/"], + "matchUpdateTypes": ["major"], + "enabled": false + }, { "matchDepNames": ["/^(docker\\.io/)?(library/)?node$/"], "groupName": "Node.js",