From 0f9b8a79bc3df8a7deb8b8d6754c5cdaa4a06baa Mon Sep 17 00:00:00 2001 From: Zachary Lowden Date: Mon, 10 Aug 2026 17:08:32 -0500 Subject: [PATCH] chore(renovate): gate major updates behind dependency-dashboard approval (#3797) Renovate's first scheduled run queued three major bumps at once: clickhouse-server v26, node v24, and postgres v18. The node one rewrites the base image of every service under apps/ plus containers/image-stub in a single PR titled "update node.js to v24". Majors now require an explicit tick on the Dependency Dashboard before a branch or PR is created. They stay listed there, so nothing becomes invisible. Digest pins and patch/minor updates are separate updateTypes and keep flowing automatically. --- renovate.json | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/renovate.json b/renovate.json index a89745975f..881ead33d6 100644 --- a/renovate.json +++ b/renovate.json @@ -3,6 +3,10 @@ "extends": ["config:recommended", "docker:pinDigests"], "enabledManagers": ["dockerfile", "nvm"], "schedule": ["before 6am on monday"], + "major": { + "description": "A major bump is never opened unasked. Majors stay VISIBLE on the Dependency Dashboard (issue #3789) with an unticked checkbox, and a branch/PR is only created once a human ticks it. Digest pins and patch/minor updates are unaffected and keep flowing automatically — they are separate updateTypes. Motivation: the first scheduled run queued three majors at once, one of which (node v24) rewrites the base image of every service under apps/ plus containers/image-stub in a single PR.", + "dependencyDashboardApproval": true + }, "packageRules": [ { "description": "Keep the root Dockerfile's node tag and .nvmrc in ONE pull request. src/__tests__/node-version-consistency.test.ts asserts the two agree, so a bump that moves only one of them reds that guard. Scoped to the two files that guard actually reads: the per-service images under apps/ and containers/ are on their own cadence and must not be dragged into this group.",