Two commands, `pnpm view <pkg> dist-tags` and a GitHub advisory's affected ranges, show whether a security fix is backported to the major your consumers use, so an override stays patch-level instead of forcing a major bump.
A missing lockfile setting left mise warning about unresolved tools; the CI lock check also depended on generating locks on glibc rather than musl.
A recurring SyntaxError traced to a brace-expansion patch and an ESM export-shape mismatch: how moving minimatch to v10 removed one patch while a minimatch@3 compatibility patch remained necessary.
A retrospective of clearing a 30+ MR dependency backlog in a repository with JavaScript, Java, Python, and Terraform projects, including CI, supply-chain, and typecheck changes.
Renovate bumps mise.lock but a version pinned inside a workflow run step stays stale, and MISE_LOCKED=1 then aborts. Install tools by name and let the lockfile decide.
A single broken dependency blocked 20 updates in one Renovate PR. Three config changes prevent it from happening again.
Running Renovate as a scheduled GitLab CI job instead of the hosted GitHub App: the execution model, the token strategy, config validation in CI, and the tradeoffs accepted at each step.
Renovate PRs fail CI when Prettier reformats the lockfile. The fix is one line.
Renovate updates mise.toml via the mise manager and packageManager via the npm manager. They land in different PRs. I treated that as defense-in-depth until they disagreed.
Renovate's vulnerability alerts only cover direct dependencies in npm and pip. Here is the CI-gate and manual-remediation pattern that catches the rest, and why I run Renovate without Dependabot.
Closing supply chain gaps in an existing Renovate setup with OSV scanning, SHA pin protection, and cooldown alignment complementing pnpm's minimumReleaseAge.
How to set up Renovate or Dependabot with cooldown policies that complement pnpm's minimumReleaseAge: automated patches without opening the door to compromised packages.