Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Abandoned Dependencies

The following dependencies have not received updates for an extended period and may be unmaintained.

Note

Packages are marked as abandoned when they exceed the abandonmentThreshold since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity.

View abandoned dependencies (6)

Datasource	Package	Last Updated
bun	@octokit/rest	`2025-10-31`
regex	@semantic-release/exec	`2025-05-09`

Pending Approval

The following branches are pending approval. To create them, click on a checkbox below.

chore(deps): update dependency nanoid to v6
chore(deps): update jdx/mise-action action to v5
chore(deps): update Node.js to v26 (node, @types/node)
🔐 Create all pending approval PRs at once 🔐

Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

chore(deps): maintain lockfiles

Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

chore(dev): update dependency eslint to v10.14.0
fix(deps): update dependency goke to v6.18.0

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

chore(deps): update dependency renovate to v44.198.0
chore(deps): update fro-bot/agent to v0.132.0
Click on this checkbox to rebase all open PRs at once

Vulnerabilities

Renovate has not found any CVEs on osv.dev.

Detected Dependencies

bun (7)

package.json (32)

@octokit/rest ^22.0.1

yaml ^2.6.0

@bfra.me/eslint-config 0.54.0

@bfra.me/prettier-config 0.16.0 → [Updates: 0.16.13]

@bfra.me/tsconfig 0.13.0 → [Updates: 0.13.2]

@stryker-mutator/core 10.1.1

@stryker-mutator/vitest-runner 10.1.1

@types/node 24.19.2 → [Updates: 26.6.6]

@vitest/coverage-v8 5.0.5

@vitest/eslint-plugin 1.6.15 → [Updates: 1.6.28]

eslint 10.13.0 → [Updates: 10.14.0]

eslint-config-prettier 10.1.1 → [Updates: 10.1.8]

eslint-plugin-erasable-syntax-only 0.7.1 → [Updates: 0.7.2]

eslint-plugin-node-dependencies 2.3.0

eslint-plugin-prettier 5.5.0 → [Updates: 5.5.7]

jiti 2.7.0

prettier 3.9.1 → [Updates: 3.9.10]

typescript 6.0.3

vitest 5.0.5

bun 1.4.3 → [Updates: 1.4.4]

brace-expansion >=5.0.12

fast-uri >=4.2.3

flatted >=3.4.2

minimatch >=10.2.3

nanoid >=3.3.18 <4 → [Updates: >=3.3.18 <7]

picomatch >=4.0.4

postcss >=8.5.18

qs >=6.16.1

source-map-js >=1.2.2

undici >=8.12.2

vite >=8.3.3

yaml >=2.8.3

packages/core/package.json (3)

@octokit/rest ^22.0.1

goke 6.17.0 → [Updates: 6.18.0]

zod 4.6.7

packages/dispatch/package.json (2)

@octokit/rest ^22.0.1

yaml ^2.6.0

packages/privacy/package.json (1)

yaml ^2.6.0

packages/registry/package.json (2)

@octokit/rest ^22.0.1

yaml ^2.6.0

packages/test-kit/package.json

packages/wiki-write-core/package.json (3)

@octokit/rest ^22.0.1

yaml ^2.8.3

node >=24

github-actions (34)

.github/actions/setup/action.yaml (2)

jdx/mise-action v4.3.0@c2a87611a18de5b3828c5652fe268e992400cb5c → [Updates: v5.2.4]

oven-sh/setup-bun v2.2.0@0c5077e51419868618aeaa5fe8019c62421857d6

.github/workflows/apply-branding.yaml

.github/workflows/capture-learnings.yaml (10)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → [Updates: v7.0.2]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

fro-bot/agent v0.131.0@5ce2291b002a0b308e4e8e5c13f1b397d1dbd330 → [Updates: v0.132.0]

actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → [Updates: v7.0.2]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

.github/workflows/capture-patterns.yaml (10)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → [Updates: v7.0.2]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

fro-bot/agent v0.131.0@5ce2291b002a0b308e4e8e5c13f1b397d1dbd330 → [Updates: v0.132.0]

actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → [Updates: v7.0.2]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

.github/workflows/check-private-leak.yaml (3)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

jdx/mise-action v4.3.0@c2a87611a18de5b3828c5652fe268e992400cb5c → [Updates: v5.2.4]

oven-sh/setup-bun v2.2.0@0c5077e51419868618aeaa5fe8019c62421857d6

.github/workflows/codeql-analysis.yaml (3)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

github/codeql-action v4.39.0@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee → [Updates: v4.39.1]

github/codeql-action v4.39.0@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee → [Updates: v4.39.1]

.github/workflows/copilot-setup-steps.yaml (1)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

.github/workflows/cross-repo-dispatch.yaml (8)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

.github/workflows/dependency-review.yaml (2)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/dependency-review-action v5.0.0@a1d282b36b6f3519aa1f3fc636f609c47dddb294

.github/workflows/dispatch-renovate.yaml (3)

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

.github/workflows/draft-solutions.yaml (12)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → [Updates: v7.0.2]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

fro-bot/agent v0.131.0@5ce2291b002a0b308e4e8e5c13f1b397d1dbd330 → [Updates: v0.132.0]

actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → [Updates: v7.0.2]

actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → [Updates: v7.0.2]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

.github/workflows/fro-bot.yaml (16)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

fro-bot/agent v0.131.0@5ce2291b002a0b308e4e8e5c13f1b397d1dbd330 → [Updates: v0.132.0]

actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → [Updates: v7.0.2]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

fro-bot/agent v0.131.0@5ce2291b002a0b308e4e8e5c13f1b397d1dbd330 → [Updates: v0.132.0]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

fro-bot/agent v0.131.0@5ce2291b002a0b308e4e8e5c13f1b397d1dbd330 → [Updates: v0.132.0]

actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → [Updates: v7.0.2]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

.github/workflows/gateway-rollout-tracker.yaml (1)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

.github/workflows/improvement-metrics.yaml (5)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → [Updates: v7.0.2]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

.github/workflows/main.yaml (10)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

rhysd/actionlint v1.7.12@914e7df21a07ef503a81201c76d2b11c789d3fca

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → [Updates: v7.0.2]

.github/workflows/manage-cache.yaml (2)

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

.github/workflows/manage-issues.yaml (4)

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/stale v11.0.0@4391f3da665fdf50b6810c1a66712fb9ba21aa93

dessant/lock-threads v6.0.2@89ae32b08ed1a541efecbab17912962a5e38981c

.github/workflows/merge-data.yaml (3)

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

.github/workflows/poll-invitations.yaml (2)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

.github/workflows/private-leak-sentinel.yaml

.github/workflows/publish-wiki.yaml (6)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/setup-node v7.1.0@949feb2413d6458794dcd2491c4babbbce0c15c1

oven-sh/setup-bun v2.2.0@0c5077e51419868618aeaa5fe8019c62421857d6

actions/upload-pages-artifact v5.0.0@fc324d3547104276b827a68afc52ff2a11cc49c9

actions/deploy-pages v5.0.0@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 → [Updates: v5.0.1]

node 24 → [Updates: 26]

.github/workflows/reconcile-repos.yaml (3)

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

.github/workflows/release-wiki-write-core.yaml (7)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → [Updates: v7.0.2]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/setup-node v7.1.0@949feb2413d6458794dcd2491c4babbbce0c15c1

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

node 24 → [Updates: 26]

.github/workflows/rename-tracked-repo.yaml (2)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

.github/workflows/renovate.yaml (1)

bfra-me/.github v4.43.0@e6a1ab17bb68213940f63de91bd0450acdf9fff4

.github/workflows/reset-survey-status.yaml (2)

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

.github/workflows/rollout-tracker-mention.yaml

.github/workflows/scorecard.yaml (4)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

ossf/scorecard-action v2.5.0@fa7117db83c52d787ae5a89f350999701505d78e

actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → [Updates: v7.0.2]

github/codeql-action v4.39.0@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee → [Updates: v4.39.1]

.github/workflows/status-truth.yaml (9)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → [Updates: v7.0.2]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

.github/workflows/survey-repo.yaml (11)

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

fro-bot/agent v0.131.0@5ce2291b002a0b308e4e8e5c13f1b397d1dbd330 → [Updates: v0.132.0]

fro-bot/agent v0.131.0@5ce2291b002a0b308e4e8e5c13f1b397d1dbd330 → [Updates: v0.132.0]

fro-bot/agent v0.131.0@5ce2291b002a0b308e4e8e5c13f1b397d1dbd330 → [Updates: v0.132.0]

actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → [Updates: v7.0.2]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

.github/workflows/unpublish-wiki.yaml (3)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/upload-pages-artifact v5.0.0@fc324d3547104276b827a68afc52ff2a11cc49c9

actions/deploy-pages v5.0.0@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 → [Updates: v5.0.1]

.github/workflows/update-metadata.yaml (3)

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

.github/workflows/update-repo-settings.yaml (1)

bfra-me/.github v4.43.0@e6a1ab17bb68213940f63de91bd0450acdf9fff4

.github/workflows/wiki-lint.yaml (7)

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → [Updates: v7.0.2]

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → [Updates: v8.0.2]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]

actions/create-github-app-token v3.3.0@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

mise (1)

mise.toml (3)

node 24.22.0 → [Updates: 24.22.2, 26.13.0]

bun 1.4.3 → [Updates: 1.4.4]

python 3.15.0 → [Updates: 3.15.2]

npm (2)

quartz-site/local-plugin/package.json

quartz-site/local-plugin/sanitizer/package.json

regex (5)

.github/actions/setup/action.yaml (1)

jdx/mise 2026.10.6 → [Updates: 2026.10.23]

.github/workflows/check-private-leak.yaml (1)

jdx/mise 2026.10.6 → [Updates: 2026.10.23]

.github/workflows/main.yaml (1)

renovate 44.192.2 → [Updates: 44.198.0]

.github/workflows/release-wiki-write-core.yaml (8)

semantic-release 25.0.9

@semantic-release/exec 7.1.0

@semantic-release/npm 13.2.0

@semantic-release/github 12.0.10

@semantic-release/commit-analyzer 13.0.1

@semantic-release/release-notes-generator 14.1.1

conventional-changelog-conventionalcommits 10.4.1

conventional-changelog-writer 9.3.0

default.json (2)

bfra-me/renovate-config 5.3.1

bfra-me/renovate-config 5.3.1

renovate-config (1)

.github/renovate.json5

Check here to trigger a Renovate run on this repository

@fro-bot

@fro-bot Investigate why Renovate doesn't detect/update Renovate config presets pinned to semver. In default.json, the bfra-me/renovate-config presets should be detected but are not and must be updated manually:

The pins are valid. The inherited regex manager never scans default.json. There is also a separate patch-update rule that would suppress patch bumps after detection is fixed.

Root cause

The inherited bfra-me/renovate-config default preset includes renovate-config.json5(bfra-me/renovate-config). That custom manager uses github-releases and recognizes both reference formats in our extends array, but its managerFilePatterns only cover conventional Renovate configuration filenames. default.json is missing. The upstream main version has the same omission.

Loading a file as a shared preset does not automatically select it for dependency extraction. Renovate’s file-selection implementation selects manager inputs using those patterns.

I reproduced the filename/content checks using the upstream manager and our actual file:

Check	Result
Existing patterns select `.github/renovate.json5`	Yes
Existing patterns select `default.json`	No
Existing content regexes recognize both pinned references	Yes, both capture `5.2.8`
Adding `/^default\.json$/` selects the file	Yes

This isolates the detection failure before release lookup, scheduling, or dashboard approval. This was a targeted reproduction, not a full Renovate dry run.

Fix

Add '/^default\\.json$/' to managerFilePatterns in upstream bfra-me/renovate-config/renovate-config.json5. That fixes the existing manager for shared preset repositories. A repository-local custom manager targeting default.json can provide an immediate workaround.
In our .github/renovate.json5, add this exception after the blanket patch-disable rule:
```
{
  matchPackageNames: ['bfra-me/renovate-config'],
  matchUpdateTypes: ['patch'],
  enabled: true,
}
```
Without that exception, the pins can become detectable while patch updates still remain disabled.

Acceptance should verify both references appear under default.json in extracted dependencies and that an eligible newer patch produces an update. The existing config-validation gate does not prove extraction coverage—consistent with our runtime-parity learning.

Investigation complete; no repository files changed.

Run Summary

Field	Value
Event	issue_comment
Repository	fro-bot/.github
Run ID	39721615269
Cache	hit
Session	ses_e9e2a9baeffeB2g5bqVncoGCh0

Navigation Menu

Repository navigation

Dependency Dashboard #2828

Abandoned Dependencies

Pending Approval

Awaiting Schedule

Pending Status Checks

Open

Vulnerabilities

Detected Dependencies

Root cause

Fix

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Dependency Dashboard #2828

Description

Abandoned Dependencies

Pending Approval

Awaiting Schedule

Pending Status Checks

Open

Vulnerabilities

Detected Dependencies

Activity

marcusrbrown commented on Oct 22, 2026

fro-bot commented on Oct 22, 2026

Root cause

Fix

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions