chore(deps): decline OpenApi v3 + js-yaml v5 majors; encode the rationale in renovate config

[ANcpLua]

Complete-and-verified

Resolution for the two open renovate majors (#465, #425): both decline on evidence, and this PR makes the decision durable + self-documenting via packageRules (local rules merge on top of the fleet preset).

Microsoft.OpenApi 2.9.0 → 3.7.0 (#465) — declined

• 3.x makes IOpenApiMediaType.Example read-only. The Microsoft.AspNetCore.OpenApi XML-comment source generator still assigns it, producing CS0200 in generated code (OpenApiXmlCommentSupport.generated.cs), which this repo's hard rules forbid hand-editing.
• Reproduced today on current main with the latest available Microsoft.AspNetCore.OpenApi (10.0.9 — no newer exists on NuGet): same two CS0200 errors as the PR's CI. Reverted, build back to 0 errors.
• Second occurrence: deps: Update dependency Microsoft.OpenApi to v3 #462 already reverted this exact bump; Directory.Packages.props documents the 2.9.0 pin (which also clears GHSA-v5pm-xwqc-g5wc). Blocked upstream until ASP.NET's generator supports OpenAPI.NET v3 — the rule description says exactly when to re-enable.

js-yaml ^4.2.0 → ^5.0.0 (#425) — declined

• js-yaml is not a dependency — it's an npm overrides security floor from the deps: dashboard dependency sweep — npm audit (vite 8.1.0, js-yaml ≥4.2.0) + @vitejs/plugin-react 6.0.2 #406 audit sweep.
• Every consumer (openapi-typescript → @redocly/openapi-core, shadcn → cosmiconfig) declares ^4.x and resolves 4.3.0 naturally; npm audit: 0 vulnerabilities.
• Forcing v5 through overrides pushes an out-of-range major with real breaking changes (quoteStyle/forceQuotes dump API) into the generate:ts and shadcn toolchain for zero security gain. The floor should follow consumers into v5, not lead them.

Both renovate PRs will be closed with a comment linking here once this merges.

Verification

• renovate.json schema-valid (packageRules with matchDepNames/matchUpdateTypes).
• OpenApi repro + revert: internal/qyl.instrumentation builds 0 errors on main afterward.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• renovate.json is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: dca5ebef-5141-4b83-81b0-83506d3d68e9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Makes the decision to decline two Renovate major updates durable and self-documenting by encoding the rationale directly in Renovate config, so future Renovate runs won’t reopen the same majors without an intentional config change.

Changes:

• Adds a Renovate packageRules entry to disable major updates for Microsoft.OpenApi (documenting the generated-code break caused by OpenAPI.NET v3).
• Adds a Renovate packageRules entry to disable major updates for js-yaml (documenting that it’s only an overrides security floor and v5 would be out-of-range for current consumers).