From a2d958cb9cc1044479fc4a5aa2e4d7ed814a62a4 Mon Sep 17 00:00:00 2001
From: Dan Dunning <2349188+dunningdan@users.noreply.github.com>
Date: Fri, 4 Sep 2026 16:43:58 -0400
Subject: [PATCH] Enable Renovate lockFileMaintenance to remediate transitive
 CVEs

The repo has 51 open Dependabot alerts, all transitive (lockfile-only).
Renovate's vulnerabilityAlerts only opens PRs for deps it manages, i.e.
entries in package.json - dashboard #68 lists 15 detected npm deps, none
of which are the vulnerable ones. The transitiveRemediation option that
used to cover this was removed from Renovate.

lockFileMaintenance is the supported mechanism: it deletes yarn.lock and
regenerates it, so transitive deps float up to the newest version their
parents' ranges already allow. Verified locally that this clears 42 of
the 51 alerts, including CVE-2026-54466 (websocket-driver, critical);
yarn build passes on the result.

Also unsets prHourlyLimit for vulnerabilityAlerts - security PRs are
exempt from schedule and prConcurrentLimit by default, but not from the
hourly limit, so the repo-level cap of 2 was throttling them.

schedule is temporarily "at any time" to force an initial catch-up run;
a follow-up will restore it to "before 8am on monday".

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 renovate.json | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/renovate.json b/renovate.json
index 3790928..a68ee8e 100644
--- a/renovate.json
+++ b/renovate.json
@@ -8,5 +8,17 @@
   "schedule": ["before 8am every weekday"],
   "automerge": true,
   "automergeType": "pr",
-  "platformAutomerge": true
+  "platformAutomerge": true,
+  "lockFileMaintenance": {
+    "description": "Refreshes yarn.lock so transitive deps pick up patched versions. vulnerabilityAlerts below only covers direct deps in package.json, so this is what remediates transitive CVEs. NOTE: schedule is temporarily 'at any time' to force an initial catch-up run; restore to 'before 8am on monday' once that lands.",
+    "enabled": true,
+    "schedule": ["at any time"],
+    "automerge": true
+  },
+  "vulnerabilityAlerts": {
+    "description": "Security PRs bypass schedule and prConcurrentLimit by default, but not prHourlyLimit - so unset it here.",
+    "enabled": true,
+    "prHourlyLimit": 0,
+    "automerge": true
+  }
 }