Repository navigation
chore: wait 7 days for new releases and fix Renovate's lock file PRs - #10997
lwwmanning wants to merge 4 commits into
Conversation
Recent npm compromises were usually found and pulled within hours of publication, so a 7-day wait keeps such releases out of this repo with a wide margin. Renovate's security updates skip the wait, so fixes for known vulnerabilities still open at once. For npm, Renovate also applies the wait to lock file maintenance by passing npm's --before, which covers transitive dependencies in vortex-web and .github/vercel-cli. Renovate cannot do this for the Cargo and uv lock files. Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Will Manning <[email protected]>
Merging this PR will improve performance by 11.82%2 warnings
Performance Changes
Tip Curious why performance improved? Comment Comparing 
|
Signed-off-by: Will Manning <[email protected]>
The JS group has made no PR since September. Renovate now runs npm 12, which refuses the registry tarball of @tailwindcss/oxide-wasm32-wasi in vortex-web (npm/cli#9800). Pin Renovate's npm to 11, which CI's Node 24 also ships. The Python group has never made a PR. Renovate runs uv lock inside vortex-python-cuda, which is not a workspace member, and uv cannot find the unpublished vortex-data==0.1.0 on PyPI. Skip lock maintenance for that file and skip PyPI lookups for vortex-data and vortex-data-cuda. The 7-day wait did not reach lock file maintenance: that update has no package name, so the matchPackageNames rule never matched it. Set the wait on the npm group, where Renovate passes it to npm as --before. Renovate cannot apply it to uv, so set exclude-newer to 7 days in pyproject.toml and require uv 0.11.8, the first release that keeps a relative exclude-newer stable in uv.lock. Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Will Manning <[email protected]>
Pinning Renovate to npm 11 trades a current tool for an old major. Keep npm 12 and set allow-remote=all only in the npmrc that Renovate writes for its own npm runs. That matches npm 11's behaviour for these lock files, and developers and CI keep npm's defaults. Remove it when npm/cli#9800 is fixed. Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Will Manning <[email protected]>
lwwmanning
changed the title
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 263e75b3f1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # Skip releases younger than 7 days, the same wait as Renovate's minimumReleaseAge. Renovate cannot | ||
| # apply its wait to uv lock refreshes, so uv applies it. To take an urgent fix sooner, add | ||
| # `exclude-newer-package = { <package> = false }` and remove it once that release is 7 days old. | ||
| exclude-newer = "7 days" |
There was a problem hiding this comment.
When a Python vulnerability is fixed by a release uploaded less than seven days ago, Renovate bypasses its own minimumReleaseAge, but the subsequent uv resolution still reads this unconditional cutoff and treats that fixed release as unavailable. The security PR therefore cannot update uv.lock until the release ages out, contrary to the configured immediate security-update behavior. uv documents that package-specific exclude-newer-package = { package = false } is required to opt out of a global cutoff, so this needs an automatic bypass for Renovate security updates rather than the manual-only workaround in the comment. uv resolution documentation
Useful? React with 👍 / 👎.
| "lockFileMaintenance" | ||
| ] | ||
| ], | ||
| "minimumReleaseAge": "7 days" |
There was a problem hiding this comment.
In this JS lock-file-maintenance rule, minimumReleaseAge is also evaluated against the synthetic lockFileMaintenance update itself, which has no release timestamp. Renovate documents that npm is not marked as enforcing the age during lock-file maintenance and that, with the default timestamp-required and strict filtering behavior used here, such an update remains pending instead of creating a branch; passing --before to npm restricts the generated packages but does not make this status check pass. Consequently this group can continue producing no PRs, so the lock-maintenance update needs to be exempted from Renovate's own age check while retaining the npm-side cutoff. Renovate lock-file-maintenance documentation
Useful? React with 👍 / 👎.
Renovate now waits 7 days after a release before it proposes it. Recent npm compromises were found within hours, so the wait gives a large margin. Security updates skip the wait.
Lock file maintenance has no package name, so the all-packages rule does not reach it. The JS group sets the wait, and Renovate gives it to npm as
--before. For uv,pyproject.tomlsetsexclude-newer = "7 days", which needs uv 0.11.8 or later.This PR also fixes the JS and Python lock file groups, which made no PRs. Renovate's npm 12 refuses a tarball in
vortex-web(npm/cli#9800), so Renovate's npm runs useallow-remote=all. Renovate also skips lock maintenance forvortex-python-cuda, which is outside the uv workspace.🤖 Generated with Claude Code