fix(#3482): exclude vulnerability PRs from grouped patch updates

[fullsend-ai-coder]

What:

Add a vulnerabilityAlerts block to renovate.json so Renovate security/vulnerability update PRs are labeled security (and renovate), making CVE-fix PRs easy to spot and route.

Note: an explicit packageRules ungrouping rule is intentionally not added, and neither is a schedule override. Renovate already keeps vulnerability fixes as standalone PRs and creates them immediately — it forces groupName: null and ignores schedule for vulnerability alerts via its built-in force block, which outranks user config, so both would be no-ops. A comment in the file documents this.

Why:

Security update PRs should be clearly labeled so they surface and route quickly. Renovate's defaults already ungroup them from patch bundles and create them immediately; the remaining value here is the routing labels.

The recurring autoclose of standalone security PRs is not fixed by this change. It is caused by Renovate's update deduplication against the long-stalled grouped patch PR #3019, which carries the same bump — a separate root cause tracked in #3483 (EC-2085).

Tickets:

Refs #3482
Follow-up (dedup root cause): #3483

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:29 PM UTC · Completed 2:42 PM UTC

Commit: 87c4a29 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.51% <ø> (ø)
generative	12.25% <ø> (ø)
integration	23.56% <ø> (ø)
unit	72.24% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Review

Findings

Medium

• [pr-framing-mismatch] renovate.json — The PR's framing (title fix(#3482): exclude vulnerability PRs from grouped patch updates, conventional-commit fix( scope, Refs #3482) implies this PR resolves issue Exclude Renovate vulnerability PRs from grouped patch updates to prevent security fixes stalling behind failing CI bundles #3482 by adding an ungrouping rule. In reality the diff adds only two labels under vulnerabilityAlerts, and the PR body itself defers the underlying autoclose/dedup fix to Renovate grouping rule causes security update PRs to be autoclosed without merging #3483. Downstream consequences: (a) the title misdescribes the diff for readers of the git log / changelog; (b) fix( will misclassify the change in any automated release-notes tooling that keys off conventional-commit types, since no defect is actually remediated; (c) the record of what issue Exclude Renovate vulnerability PRs from grouped patch updates to prevent security fixes stalling behind failing CI bundles #3482 authorized versus what shipped is blurred — the originally proposed packageRules entry was declined for defensible reasons (Renovate's built-in force block already ungroups vulnerability alerts) but a different intervention was substituted without updating the issue.
  Remediation: (1) Rename the PR title to reflect the actual change, e.g. chore(#3482): label Renovate vulnerability alert PRs for routing. (2) Change the conventional-commit prefix from fix( to chore(. (3) Use refs #3482 framing rather than fixes — keep Exclude Renovate vulnerability PRs from grouped patch updates to prevent security fixes stalling behind failing CI bundles #3482 open pending the autoclose fix tracked in Renovate grouping rule causes security update PRs to be autoclosed without merging #3483. (4) Add a comment on Exclude Renovate vulnerability PRs from grouped patch updates to prevent security fixes stalling behind failing CI bundles #3482 explaining that the originally proposed packageRules entry is a no-op due to Renovate's built-in force block, and link to Renovate grouping rule causes security update PRs to be autoclosed without merging #3483 for the root-cause work.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Config-only change (12 lines in renovate.json). Verified against Renovate source:

• renovate.json is parsed through stripJsonComments before validation, so the added // line comments do not break config loading (though strict external tooling / IDE schemas may still warn).
• The PR body's force-block justification is accurate: lib/workers/repository/process/vulnerabilities.ts sets force: { ...packageFileConfig.vulnerabilityAlerts }, and the built-in vulnerabilityAlerts default includes groupName: null, so an explicit user packageRules ungrouping entry would in fact be a no-op.
• labels and schedule are valid keys under the vulnerabilityAlerts object (type: 'object', mergeable: true).

Security scan of the diff for injection / Unicode steganography / bidi overrides / permission-manifest changes found nothing — the only non-ASCII byte is a U+2014 em dash in the human-written comment. Net posture is a small improvement (faster surfacing + clear routing labels for CVE fixes).

Remaining concerns are about PR-tracking hygiene rather than the diff itself, and should be addressed before merge.

Prior-review provenance validation failed (PRIOR_REVIEW_PROVENANCE=unverifiable-wrong-app); this run is treated as a first review — no severity anchoring from any prior comment was applied.

Findings

Low

• [intent-mismatch] renovate.json — The PR body uses Closes #3482, but explicitly acknowledges that the observed symptom that gave the issue its title — recurring autoclose of standalone security PRs (go-git v5.19.1→v5.19.2, CVE-2026-71556 / 71557) — is caused by Renovate's update deduplication and is not fixed here. Merging with Closes will close a security-labeled bug while its CVE-exposure root cause remains live and unaddressed.
  Remediation: change Closes #3482 to Refs #3482 / Part of #3482 in the PR body, or file (and reference) the follow-up issue for the deduplication root cause the PR body claims is "tracked separately".
• [missing-followup] renovate.json — The PR body says the deduplication root cause is "tracked separately," but no follow-up issue link is present. Sibling issue Renovate grouping rule causes security update PRs to be autoclosed without merging #3483 ("Renovate grouping rule causes security update PRs to be autoclosed without merging") is still open and covers the same symptom; it is not referenced here either, so the audit trail from CVE symptom to eventual fix is lost.
  Remediation: reference Renovate grouping rule causes security update PRs to be autoclosed without merging #3483 (or a dedicated deduplication follow-up issue) in the PR body wherever "tracked separately" is claimed.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

Critical

• [logic-error] renovate.json:10 — isVulnerabilityAlert is not a valid packageRules matcher in Renovate. Renovate's registered matchers are the match*-prefixed ones (plus matchConfidence); isVulnerabilityAlert is only ever set internally by Renovate itself (in lib/workers/repository/init/vulnerability.ts) on the alert-generated rule, and it is listed in ignoredNodes in lib/config/validation.ts so validators will not warn. Inside this packageRule it is treated as a config value, not a match constraint. Net effect: the rule matches every gomod update (only matchManagers: ["gomod"] actually filters), so groupName: null / groupSlug: null disables grouping for the entire Go ecosystem — the opposite of the stated "keep vulnerability/security PRs standalone" intent — and every gomod update also gets tagged with isVulnerabilityAlert: true.
  Remediation: Remove the packageRule and put the grouping overrides inside the top-level vulnerabilityAlerts object, which Renovate applies as force overrides on the alert-generated rule. For example:

  "vulnerabilityAlerts": {
    "labels": ["security", "renovate"],
    "groupName": null,
    "groupSlug": null
  }

Medium

• [ineffective-configuration] renovate.json:16 — vulnerabilityAlerts.schedule is silently ignored. The Renovate docs (configuration-options.md, vulnerabilityAlerts section) state: "Renovate always ignores commitHourlyLimit, prHourlyLimit, prCommitsPerRunLimit and schedule for vulnerability alerts, you can not override this." So "schedule": ["at any time"] has no runtime effect (vulnerability PRs already bypass schedules by default); it is misleading to future readers.
  Remediation: Drop the schedule key from vulnerabilityAlerts. Retain only supported keys (labels, assignees, automerge, prConcurrentLimit, branchConcurrentLimit, enabled, vulnerabilityFixStrategy, and — per the finding above — groupName/groupSlug).

Low

• [docs-currency] AGENTS.md:170 — The paragraph at line 170 describes renovate.json as extending the org-level preset "with an additional helpers:pinGitHubActionDigests extension," and it explicitly warns agents not to add gomod package rules without maintainer approval. Once the correctness issue above is resolved, AGENTS.md should be updated to record this sanctioned Go/gomod exception and link issues Exclude Renovate vulnerability PRs from grouped patch updates to prevent security fixes stalling behind failing CI bundles #3482/Document intentional Renovate exclusions in AGENTS.md to prevent false-positive config proposals #3458 so future agents don't revert or duplicate it. Note: doing this update now would document a broken configuration — update it only after the fix lands in its final form.
  Remediation: After the correctness fix is applied, update AGENTS.md near line 170 to note the sanctioned vulnerability-alert exemption and cross-reference issues Exclude Renovate vulnerability PRs from grouped patch updates to prevent security fixes stalling behind failing CI bundles #3482 and Document intentional Renovate exclusions in AGENTS.md to prevent false-positive config proposals #3458.

Info

• [provenance-warning] — Prior review context was discarded: provenance validation failed (PRIOR_REVIEW_PROVENANCE=unverifiable-wrong-app). Severity anchoring was skipped for this run; all findings are first-time assessments.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (3)

Review

Findings

Medium

• [logic error] renovate.json:7 — The packageRules entry setting groupName: null and groupSlug: null for isVulnerabilityAlert: true is redundant. Renovate already internally forces groupName: null for vulnerability alerts via its built-in force block, which takes the highest configuration priority and cannot be overridden by user packageRules. This means the rule will never have a practical effect on ungrouping behavior. The actual problem described in issue Exclude Renovate vulnerability PRs from grouped patch updates to prevent security fixes stalling behind failing CI bundles #3482 (standalone security PRs being autoclosed in favor of a stalled grouped PR containing the same version bump) is caused by Renovate's update deduplication logic, not by grouping configuration. The deduplication occurs because the same dependency version bump (e.g., go-git v5.19.1 → v5.19.2) exists in both the standalone security branch and the grouped patch branch, causing Renovate to consider the standalone PR superseded. Setting groupName: null (which is already the default for vulnerability alerts) does not change how deduplication works.
  Remediation: Investigate whether the autoclosing is caused by Renovate's branch/update deduplication logic rather than grouping. Potential approaches: (1) file a Renovate issue about deduplication between vulnerability PRs and grouped PRs that have failing CI, (2) consider splitting the stalled grouped PR (Update go modules (main) (patch) #3019) or removing the go-git update from it so the deduplication trigger is eliminated, (3) if keeping this rule for documentation/intent purposes, add a JSON comment noting it is redundant with Renovate's built-in force behavior and does not address the deduplication root cause.

Low

• [scope limitation] renovate.json:9 — The packageRules entry restricts the vulnerability ungrouping override to matchManagers: ["gomod"] only, while the parent preset groups dependencies across multiple managers (dockerfile, github-actions, npm). Since the entire packageRules entry is redundant (Renovate already forces groupName: null for all vulnerability alerts regardless of manager), this scope limitation is moot. However, if the team decides to keep the rule for documentation purposes, removing matchManagers would make the intent clearer for all dependency types.

---

Labels: PR modifies Renovate configuration for vulnerability alert handling

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 0084347a-773a-457c-8c62-f54f7daa6926

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[cuipinghuo]

Reviewed and adopting for EC-2084. Resolved the merge conflict against current main by keeping only the intended EC-2084 additions (packageRules vulnerability-ungroup rule + vulnerabilityAlerts labels/schedule); dropped the re-added helpers:pinGitHubActionDigests extends line since main removed it in 520e13c (EC-2080) as the org-wide config already provides it. Net diff vs main is exactly the two intended blocks.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:50 PM UTC · Completed 1:59 PM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $4.32

[fullsend-ai-review]

Risk Assessment: low (1/5)

Details

Config-only PR touching a single non-protected, non-security-sensitive file (11 changed lines) authored by a bot — Tier 1 sub-scores are all 1. Linked issue slightly elevates Tier 3 (2.5) because the PR admits it does not satisfy the issue’s stated validation criterion, but Tier 1 dominates the weighted average.

Previous run

Risk Assessment: low (1/5)

Details

Tiny additive renovate config change from a bot, fully scoped to a recent well-defined issue, on a low-churn config file that is trivially revertible.

[cuipinghuo]

Re-approving after amending the Sep-15 merge commit: conflict resolved against current main, and per review the redundant vulnerability-ungroup packageRule was dropped (Renovate already forces groupName: null for vulnerability alerts) with a documenting comment. Kept the useful vulnerabilityAlerts block (security label + immediate creation). Net diff vs main is just those changes.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:15 PM UTC · Completed 2:23 PM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $3.90

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:31 AM UTC · Completed 3:38 AM UTC

Commit: e8f0a9f · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $3.05

[fullsend-ai-review]

See the review comment for full details.