Skip to content

chore: update renovate to refresh lockfile 1x a month#4138

Merged
castastrophe merged 1 commit into
spectrum-twofrom
castastrophe/chore-lockfile-refresh-renovate-s2
Aug 18, 2025
Merged

chore: update renovate to refresh lockfile 1x a month#4138
castastrophe merged 1 commit into
spectrum-twofrom
castastrophe/chore-lockfile-refresh-renovate-s2

Conversation

@castastrophe
Copy link
Copy Markdown
Contributor

Description

This update adds monthly lockfile maintenance to Renovate configuration to ensure dependency lockfiles are regularly refreshed. The primary goal is to keep caniusedb and other indirect dependencies up-to-date, even when they're not direct project dependencies.

Motivation and context

Lockfiles can become stale over time, especially for indirect dependencies like caniusedb that are pulled in by other packages. By enabling monthly lockfile maintenance, we ensure that:

  • Indirect dependencies are regularly updated to their latest compatible versions
  • Security vulnerabilities in transitive dependencies are addressed more promptly
  • Build consistency is maintained across different environments
  • The project benefits from performance improvements and bug fixes in underlying packages

This change helps maintain the overall health and security of the dependency tree without requiring manual intervention.

Author's checklist

  • I have read the CONTRIBUTING and PULL_REQUESTS documents.
  • I have reviewed at the Accessibility Practices for this feature, see: Aria Practices
  • I have added automated tests to cover my changes.
  • I have included a well-written changeset if my change needs to be published.
  • I have included updated documentation if my change required it.

Reviewer's checklist

  • Includes a Github Issue with appropriate flag or Jira ticket number without a link
  • Includes thoughtfully written changeset if changes suggested include patch, minor, or major features
  • Automated tests cover all use cases and follow best practices for writing
  • Validated on all supported browsers
  • All VRTs are approved before the author can update Golden Hash

Manual review test cases

  • Verify Renovate configuration is valid

    1. Go to the .github/renovate.json file
    2. Check that the lockFileMaintenance section is properly configured
    3. Expect monthly scheduling to be enabled
  • Confirm lockfile maintenance behavior

    1. Wait for the next monthly Renovate run
    2. Check that lockfiles are updated appropriately
    3. Expect caniusedb and other indirect dependencies to be refreshed

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Aug 18, 2025

⚠️ No Changeset found

Latest commit: 3384b67

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@castastrophe castastrophe self-assigned this Aug 18, 2025
@castastrophe castastrophe added dependencies Pull requests that update a dependency file size-1 XS ~1-6hrs; nearly trivial, a few hours, could do more than one in a single day. skip_vrt Add to a PR to skip running VRT (but still pass the action) ready-for-review S2 Spectrum 2 labels Aug 18, 2025
@github-actions
Copy link
Copy Markdown
Contributor

File metrics

Summary

Total size: 1.43 MB*

🎉 No changes detected in any packages

* Size is the sum of all main files for packages in the library.
* An ASCII character in UTF-8 is 8 bits or 1 byte.

@github-actions
Copy link
Copy Markdown
Contributor

📚 Branch preview

PR #4138 has been deployed to Azure Blob Storage: https://spectrumcss.z13.web.core.windows.net/pr-4138/index.html.

@castastrophe castastrophe merged commit 8479ac3 into spectrum-two Aug 18, 2025
19 of 26 checks passed
@castastrophe castastrophe deleted the castastrophe/chore-lockfile-refresh-renovate-s2 branch August 18, 2025 16:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file ready-for-review S2 Spectrum 2 size-1 XS ~1-6hrs; nearly trivial, a few hours, could do more than one in a single day. skip_vrt Add to a PR to skip running VRT (but still pass the action)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants