fix(renovate): replace unsupported matchSeverity and uv manager config - #159
fix(renovate): replace unsupported matchSeverity and uv manager config#159williaby wants to merge 1 commit into
Conversation
Renovate 42.92 does not support: - packageRules[N].matchSeverity -> replaced with matchCategories: ["security"] - top-level uv config block -> removed - 'uv' in enabledManagers -> replaced with pip_requirements + pip-compile Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
WalkthroughThis PR reformats the ChangesRenovate Configuration Update
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Review rate limit: 4/5 reviews remaining, refill in 12 minutes. Comment |
There was a problem hiding this comment.
Pull request overview
This PR updates renovate.json to resolve Renovate config validation errors (reported on Renovate 42.92) so Renovate can process dependency updates for this repository again.
Changes:
- Replaces unsupported
matchSeverityusage with a different matching approach for security updates. - Removes/avoids unsupported Renovate configuration related to the
uvmanager. - Reformats several config arrays/fields (no functional intent, but improves readability/consistency).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "description": "Security updates - high priority", | ||
| "matchDatasources": ["pypi", "github-actions"], | ||
| "matchDatasources": [ | ||
| "pypi", | ||
| "github-actions" | ||
| ], | ||
| "vulnerabilityAlerts": { | ||
| "enabled": true | ||
| }, | ||
| "labels": ["security", "dependencies"], | ||
| "labels": [ | ||
| "security", | ||
| "dependencies" | ||
| ], |
| ], | ||
| "matchCategories": [ | ||
| "security" |
| "fileMatch": [ | ||
| "^\\.github/workflows/.*\\.ya?ml$" | ||
| ], |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@renovate.json`:
- Around line 77-80: The rule incorrectly lists "github-actions" in
matchDatasources (datasource) instead of matchManagers; remove "github-actions"
from matchDatasources and create a separate rule that targets GitHub Actions via
matchManagers: ["github-actions"] and (if needed) set the correct datasources
like "github-tags" or "github-digest" in that new rule; ensure you don’t combine
matchManagers and matchDatasources in the same rule because Renovate treats them
with AND logic, preventing GitHub Actions updates from matching the existing
pypi rule.
- Around line 112-114: Remove the invalid matchCategories entry from the
Renovate security updates rule: locate the rule object that already uses
vulnerabilityAlerts and matchDatasources and delete the "matchCategories":
["security"] property so the rule can match correctly; keep the existing
vulnerabilityAlerts and matchDatasources settings unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 43eec048-ca86-4869-a6a0-5d73f2e43215
📒 Files selected for processing (1)
renovate.json
| "matchDatasources": [ | ||
| "pypi", | ||
| "github-actions" | ||
| ], |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat renovate.jsonRepository: williaby/image-preprocessing-detector
Length of output: 5227
🌐 Web query:
Renovate github-actions manager datasource classification
💡 Result:
The github-actions is a manager in Renovate that extracts dependencies from GitHub Actions workflow files (.yml/.yaml in .github/workflows/). It supports multiple datasources depending on the dependency type and reference format: - gitea-tags - github-digest (for non-version-like refs like branches or @main) - github-runners (for runs-on: like ubuntu-24.04) - github-tags (for versioned tags like @v4 or @v4.2.0) Supported depTypes: action, docker, container, service, github-runner, uses-with. Routing examples: - actions/checkout@v4.2.0 → github-tags (version updates) - actions/checkout@v4 → github-tags (version updates) - taiki-e/install-action@cargo-llvm-cov → github-digest (digest pinning) - actions/checkout@main → github-digest (digest pinning) Recent updates include github-branches datasource (added Dec 2025) for branch-based actions and default github-actions versioning (Apr 2026).
Citations:
- 1: https://docs.renovatebot.com/modules/manager/github-actions/
- 2: https://docs.renovatebot.com/modules/datasource/
- 3: feat(datasource): Add github-branches datasource for branch-based GitHub Actions renovatebot/renovate#40172
- 4: https://docs.renovatebot.com/modules/datasource/github-digest/
- 5: https://docs.renovatebot.com/modules/datasource/github-releases/
🌐 Web query:
Renovate matchDatasources vs matchManagers configuration
💡 Result:
matchDatasources and matchManagers are matching criteria used in Renovate's packageRules configuration to selectively apply settings to dependencies. matchManagers matches dependencies extracted by specific package managers (e.g. "npm", "dockerfile", "github-actions", "regex"). It targets how dependencies are detected and parsed from files. matchDatasources matches the datasource assigned to a dependency after extraction (e.g. "npm", "docker", "github-tags"). The datasource determines how Renovate looks up new versions/releases. Key difference: Managers handle file parsing and dependency extraction (matchManagers), while datasources handle version lookup (matchDatasources). A single dependency can have one manager but potentially different datasources (e.g. custom regex manager with docker datasource). Use matchManagers to configure behavior per file type/package format, like custom commit messages for GitHub Actions files. Use matchDatasources for version-related rules, like abandonment checks for npm packages. Examples: - {"matchManagers": ["github-actions"], "commitMessageTopic": "{{depName}}"} - {"matchDatasources": ["npm"], "abandonmentThreshold": "1 year"} Rules are AND-combined across matchers, OR within the same matcher array. All packageRules are evaluated and merged.
Citations:
- 1: https://docs.renovatebot.com/configuration-options/
- 2: https://docs.mend.io/wsk/renovate-package-rules-guide
- 3: https://docs.renovatebot.com/modules/datasource/
- 4: https://renovatebot.com/docs/configuration-options/
- 5: https://renovatebot.com/docs/configuration-options
- 6: https://docs.renovatebot.com/modules/manager/
- 7: https://docs.renovatebot.com/modules/datasource/custom
github-actions is a manager identifier, not a datasource identifier (Line 79).
github-actions is a Renovate manager that extracts dependencies from workflow files and supports datasources like github-tags, github-digest, and github-runners—not a datasource itself. Placing it in matchDatasources will not match GitHub Actions updates.
However, the suggested fix may need refinement. Using both matchManagers and matchDatasources in the same rule applies AND logic, so dependencies must satisfy both criteria. Since github-actions extracts deps that use github-tags/github-digest datasources (not pypi), the proposed rule won't match GitHub Actions dependencies:
- "matchDatasources": [
- "pypi",
- "github-actions"
- ],
+ "matchDatasources": [
+ "pypi"
+ ],To apply security update settings to GitHub Actions, create a separate rule with matchManagers: ["github-actions"].
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "matchDatasources": [ | |
| "pypi", | |
| "github-actions" | |
| ], | |
| "matchDatasources": [ | |
| "pypi" | |
| ], |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@renovate.json` around lines 77 - 80, The rule incorrectly lists
"github-actions" in matchDatasources (datasource) instead of matchManagers;
remove "github-actions" from matchDatasources and create a separate rule that
targets GitHub Actions via matchManagers: ["github-actions"] and (if needed) set
the correct datasources like "github-tags" or "github-digest" in that new rule;
ensure you don’t combine matchManagers and matchDatasources in the same rule
because Renovate treats them with AND logic, preventing GitHub Actions updates
from matching the existing pypi rule.
| "matchCategories": [ | ||
| "security" | ||
| ] |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find . -name "renovate.json" -o -name "renovate.json5" | head -5Repository: williaby/image-preprocessing-detector
Length of output: 97
🏁 Script executed:
cat -n ./renovate.json | head -150Repository: williaby/image-preprocessing-detector
Length of output: 4348
🌐 Web query:
Renovate matchCategories documentation what does it match
💡 Result:
Renovate's matchCategories is a configuration option used within packageRules to match dependencies based on the categories assigned to the package managers that detected them. Each supported package manager in Renovate is assigned one or more predefined categories (e.g., "ansible", "docker", "java", "npm", "terraform", "ci", "iac"). These categories are listed in the official Renovate managers documentation. It supports Renovate's string pattern matching syntax, including: - Exact string matches (e.g., "matchCategories": ["java"] matches dependencies from Java managers like gradle or maven). - Glob patterns (e.g., "matchCategories": ["*"] matches any categorized manager). - Regular expressions (e.g., "matchCategories": ["/^java/"]). - Negations (e.g., "matchCategories": ["!docker"] matches if any non-docker category applies, due to multi-category support). If a manager has multiple categories (e.g., "java" and "docker"), the rule matches if any category matches the pattern. Managers without categories (marked "n/a", like pre-commit) do not match category-based rules. Example: { "packageRules": [ { "matchCategories": ["ci"], "enabled": false } ] } This disables updates from CI managers like github-actions or circleci.
Citations:
- 1: https://github.com/renovatebot/renovate/blob/main/docs/usage/string-pattern-matching.md
- 2: https://docs.renovatebot.com/string-pattern-matching/
- 3: https://linkedin.com/company/team-renovate
- 4: https://docs.renovatebot.com/modules/manager
- 5: feat!: categories renovatebot/renovate#16534
🌐 Web query:
Renovate all valid manager categories list complete
💡 Result:
The complete list of valid Renovate manager categories, as documented in the official Renovate documentation, is as follows: - ansible - batect - bazel - c - cd - ci - custom - dart - docker - dotnet - elixir - golang - haskell - helm - iac - java - js - kubernetes - node - perl - php - python - ruby - rust - swift - terraform Additionally, there is a "No Category" group for managers like asdf, copier, devbox, etc. These categories group supported managers (e.g., 'ansible' includes ansible and ansible-galaxy managers) and are used for configuration options like matchCategories in packageRules. The list is up-to-date as per the current Renovate docs on 2026-05-04.
Citations:
🌐 Web query:
Renovate vulnerability severity filter critical high configuration
💡 Result:
Renovate does not currently support direct configuration to filter vulnerability alerts (via vulnerabilityAlerts or osvVulnerabilityAlerts) by severity levels like critical or high only. Recent updates (as of April 2026) parse and store severity from GitHub alerts and expose vulnerabilitySeverity for templating (e.g., commit messages), but no built-in filtering option exists in vulnerabilityAlerts config or packageRules matchers like matchSeverity. Users have requested this feature (e.g., GitHub discussion #33600, issue #33993), but it remains unimplemented. Workarounds include using dependencyDashboardApproval: true in vulnerabilityAlerts for manual review, or custom packageRules with matchJsonata to approximate filtering using exposed severity fields, though this requires advanced templating knowledge and may not fully suppress low-severity PRs.
Citations:
- 1: Filter only critical / high severity vulnerabilities alerts renovatebot/renovate#33600
- 2: Parse/store severity levels from GitHub vulnerability alerts renovatebot/renovate#33993
- 3: feat(vulnerabilities): set, maintain and expose vulnerabilitySeverity for templated fields renovatebot/renovate#21939
- 4: feat(vulnerability): add severity and CVSS details to GitHub Dependabot alerts renovatebot/renovate#42568
- 5: packageRules.matchSeverity renovatebot/renovate#27838
Remove invalid matchCategories field from the security updates rule (Line 112-114).
matchCategories matches Renovate manager categories (like python, ci, docker, etc.), not vulnerability severity. The value "security" is not a valid manager category and will prevent this rule from matching as intended.
Suggested fix
- "matchCategories": [
- "security"
- ]The rule already properly filters for security updates via vulnerabilityAlerts and matchDatasources, so this field can be safely removed.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "matchCategories": [ | |
| "security" | |
| ] |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@renovate.json` around lines 112 - 114, Remove the invalid matchCategories
entry from the Renovate security updates rule: locate the rule object that
already uses vulnerabilityAlerts and matchDatasources and delete the
"matchCategories": ["security"] property so the rule can match correctly; keep
the existing vulnerabilityAlerts and matchDatasources settings unchanged.
|
Closing — merge conflict after other PRs merged. Renovate will recreate. |
Summary
Renovate 42.92 reports validation errors for two patterns in this repo's
renovate.json:packageRules[N].matchSeverityis not a recognized field → replaced withmatchCategories: ["security"]"uv"config block is not a valid Renovate schema key → removed"uv"inenabledManagersis not a supported manager name in this version → replaced withpip_requirements+pip-compileThese errors caused Renovate to skip the repo with an "invalid config" warning on every run.
Test plan
Repository has invalid configfor this repoGenerated with Claude Code
Summary by CodeRabbit