[mheob]

Summary

Renovate has been installed since the repository began and has never opened a pull request. This fixes why, and — because every green pull request here merges itself — makes sure that once it does start, a major cannot land without someone deciding it should. A release-age gate for manual installs rides along, since it is the same policy from the other side.

Changes

.github/renovate.json, four rules on top of the shared preset:

• One weekly window for every update, Monday before 6am Berlin time.
• Majors open as drafts (draftPR).
• TypeScript in packages/api-client capped below 7 (allowedVersions).
• The TanStack Router family disabled — react-router, react-router-devtools, react-router-ssr-query, react-start — matching the exact pins from chore(deps): update dependencies and pnpm 12 #91.

Each rule carries a description saying why, so the reason travels with it into the dashboard.

pnpm-workspace.yaml — minimumReleaseAge: 4320.

CLAUDE.md — one entry under "Non-obvious constraints". Neither Renovate nor Kodiak was documented anywhere in the repository or its planning docs.

Motivation

Why no pull request ever arrived. The preset github>mheob/renovate-config gives dependencies, devDependencies and the package manager separate schedules, and its non-major group puts dependencies and devDependencies into one branch. Together with the two-hour Wednesday window this file used to set, the Dependency Dashboard (#1) listed everything as "Awaiting Schedule" from 2026-09-01 to 2026-09-25. The outcome is observed; Renovate's exact reckoning for a group spanning several schedules was not verified, which is why the fix is a single window that matches everything rather than a tuned intersection. The hosted app visits a repository only every few hours, so a narrow weekly window can be missed week after week.

Why fixing the schedule alone would have been dangerous. Kodiak's configuration lives in mheob/.github's .github/.kodiak.toml, shared across repositories, with require_automerge_label = false and no blocking_labels. #85, #86 and #90 carried no label and were merged by Kodiak all the same. A working schedule would therefore have auto-merged whatever Renovate proposed the moment its checks passed — including two branches the dashboard already showed pending:

• typescript-7.x would lift packages/api-client onto TypeScript 7. CI never runs the client generator, so it passes every check, merges, and breaks the next pnpm run generate:api with nothing pointing back at the cause.
• Sentry 11, once three days old. lib/observability.ts sets every dataCollection field explicitly because of how v10 resolves a partial object; a change there is exactly what decides what leaves the browser, and no test would notice.

Why drafts rather than a dashboard tick or a label. Kodiak never merges a draft, and CI still runs on one — pull_request triggers here carry no draft filter, and Vercel builds previews for drafts too — so the pull request exists with its checks already run, and marking it ready for review is the decision. A dashboard-approval gate would stop the pull request from being created at all, so the decision would have to be made before seeing whether it is green. A blocking label would work just as well — the preset already tags majors major ⚠️, so blocking_labels = ["major ⚠️"] in the Kodiak config would need no Renovate change — but that file governs every repository sharing it, which is a decision beyond this one.

The release-age gate. pnpm-workspace.yaml already listed packages to exclude from a release-age gate that nothing set; pnpm config list confirmed none was in effect. pnpm 12's own release notes name this pattern — a policy that silently is not there — as the reason its settings check got stricter. 4320 minutes is the three days the preset's :security preset gives Renovate, so a manual pnpm add or pnpm update now holds back what Renovate would.

Testing

• renovate-config-validator --strict passes, run both against the file as global config and — without a path argument, so it discovers the file itself — as a repository config, which is the stricter of the two. It was run through npx with install scripts disabled: pnpm 12's dlx refuses to finish while Renovate's dependencies carry unapproved build scripts, and approving them for a validator was not worth it. Its only warning is that RE2 is unbuilt and regex validation may be approximate; this file uses no patterns, only exact names and *.
• pnpm install accepts minimumReleaseAge under pnpm 12 — which now fails on an unrecognised key when the pinned version matches — and pnpm config get minimumReleaseAge reports 4320. The lockfile passes as it stands, because chore(deps): update dependencies and pnpm 12 #91 was resolved under the same window.
• pnpm format and pnpm lint are silent.

What cannot be tested here is Renovate's next run. The first real evidence is the Dependency Dashboard after the coming Monday morning: updates should move out of "Awaiting Schedule", and any major should arrive as a draft.

Breaking Changes

None for the application. Two changes in how dependencies arrive: Renovate majors now appear as drafts that wait for a human, and a manual install refuses any package published less than three days ago. A security fix that is still too fresh goes through --config.minimum-release-age=0 on that one command, as the comment in pnpm-workspace.yaml says.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
kurze-url-api	Ready	Preview	Sep 25, 2026 2:47pm UTC
kurze-url-web	Ready	Preview	Sep 25, 2026 2:47pm UTC