Skip to content

Update renovate configs from maintainer and user feedback#388

Open
jonbartels wants to merge 1 commit into
mainfrom
tweak-renovate-configs
Open

Update renovate configs from maintainer and user feedback#388
jonbartels wants to merge 1 commit into
mainfrom
tweak-renovate-configs

Conversation

@jonbartels

@jonbartels jonbartels commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Fixes to address comments from users and maintainers on Renvoate bot.

renovatebot/renovate#35165 I think this is key. We reference reccomended presets but I think some of those generate behaviors that are undesirable to OIE.

This PR was done by human hands and eyes, no clankers. I read https://docs.renovatebot.com/configuration-options/ and took the comments from maintainers and users in Discord.

Grouping is working but there is some bad pattern matching. It uses group:package style naming and some patterns had org.foo.bar* and did not group, but the ones with org.foo.bar:* did group

The all-minor-and-patch rule needs to go. Theres like 50 packages in there. Thats not what we want. It bundles all those minor updates into one massive set. Pauls clanker called this out as non-blocking in PR #358 but I think it is a problem. Thats one big-big PR.

If you're tweaking, I think the 2-day cooldown is too short, and something like 7-14 would be more appropriate for non-security patches. We don't move that quickly, and with it only checking once a month, anyway, we don't need it bringing in patches that fresh.

I can do days, but I do not think I can distinguish between security updates and other updates. This PR sets it to 14 days. I think security always gets pushed. See next topic.

I know when I was looking, there is also a way to limit the number of PRs it has opened at one time, so that we don't get overwhelmed with them.

We have this. Its set to 10, but per Renvoate docs:

Renovate always creates security PRs, even if the concurrent PR limit is already reached. Security PRs have [SECURITY] in their PR title.

The batch from PR #358 was entirely security updates. Renovate has many held updates that are non-security. These are visible at https://developer.mend.io/

Screenshot shows the ugly all-minor-and-patch behavior. It also shows groups working for non-security updates.
image

Signed-off-by: Jon Bartels <jonathan.bartels@gmail.com>
@jonbartels
jonbartels force-pushed the tweak-renovate-configs branch from c48917a to 6e536ef Compare July 24, 2026 23:59
@github-actions

Copy link
Copy Markdown

Test Results

654 tests  ±0   654 ✅ ±0   3m 29s ⏱️ +47s
108 suites ±0     0 💤 ±0 
108 files   ±0     0 ❌ ±0 

Results for commit 6e536ef. ± Comparison against base commit ac47cc8.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants