[AUTO-INF-8] Add Renovate/Dependabot automated dependency update configuration to keep dependencies current and reduce CVE exposure window #10319

New issue

Open

opened 2026-04-18 08:41:46 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-18 08:41:46 +00:00

Owner

Summary

The repository has no automated dependency update configuration (Renovate or Dependabot). This means security patches in transitive and direct dependencies are only applied when a developer manually runs uv lock and notices an update. The window between a CVE being published and the dependency being updated in uv.lock is unbounded.

Background

The existing security posture relies on:

pip-audit / osv-scanner to detect known CVEs (proposed in #9889, #9772)
uv lock --check to detect stale lockfiles (proposed in #10259)
Manual dependency updates by developers

However, none of these tools proactively open PRs when new versions of dependencies are released. Without automated update PRs, the team must manually monitor PyPI for security releases across ~170 runtime packages (as noted in #9772's lockfile analysis).

Finding

No renovate.json, .renovaterc, .github/dependabot.yml, or equivalent configuration file exists in the repository. The uv.lock lockfile pins all ~170 runtime packages to exact versions, which is correct for reproducibility — but requires a proactive update mechanism to keep those pins current.

Risk: The longer a vulnerable version stays pinned in uv.lock, the greater the exposure window. For example, aiohttp was patched for CVE-2026-34515 (issue #1999, #1642) — with Renovate, such patches would be surfaced as automated PRs within hours of the PyPI release.

Proposed Improvement

Add a renovate.json configuration file at the repository root to enable automated dependency update PRs:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:base"],
  "packageRules": [
    {
      "matchManagers": ["pep621"],
      "matchUpdateTypes": ["patch", "minor"],
      "automerge": false,
      "labels": ["dependencies", "security"]
    },
    {
      "matchManagers": ["pep621"],
      "matchUpdateTypes": ["major"],
      "automerge": false,
      "labels": ["dependencies", "breaking-change"]
    },
    {
      "matchDepTypes": ["devDependencies"],
      "matchUpdateTypes": ["patch"],
      "automerge": false
    }
  ],
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["before 6am on Monday"]
  },
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["security", "vulnerability"]
  },
  "prConcurrentLimit": 5,
  "prHourlyLimit": 2
}

Key configuration choices:

lockFileMaintenance — weekly uv lock regeneration to pick up transitive updates
vulnerabilityAlerts — immediate PRs when a dependency has a known CVE
prConcurrentLimit — prevents PR flood (max 5 open dependency PRs at once)
automerge: false — all updates require human review before merge (preserves quality gates)

Expected Impact

Reduces the CVE exposure window from "unbounded" to "hours after PyPI release"
Complements pip-audit/osv-scanner (reactive scanning) with proactive update PRs
Ensures uv.lock stays current with security patches without manual intervention
Each update PR runs the full CI pipeline (coverage ≥97%, all nox sessions) before merge

Acceptance Criteria

renovate.json exists at the repository root with valid configuration
Renovate is enabled for the Forgejo instance (or Dependabot if Renovate is unavailable)
Vulnerability alerts are enabled to generate immediate PRs for CVE-affected packages
Lock file maintenance is scheduled (weekly uv lock regeneration)
PR concurrency limits prevent PR flood
All update PRs must pass CI before merge (no automerge)

Subtasks

Create renovate.json at repository root with the configuration above
Verify Renovate bot is enabled on the Forgejo instance (contact admin if needed)
Test that Renovate correctly detects pyproject.toml and uv.lock as the dependency sources
Confirm vulnerability alerts are working by checking Renovate dashboard
Document the Renovate configuration in CONTRIBUTING.md

Definition of Done

This issue is closed when:

renovate.json is merged to master
Renovate (or equivalent) is actively monitoring the repository
At least one test dependency update PR has been opened and processed through CI
CONTRIBUTING.md documents the automated update process

Duplicate Check

Check 1 — Open issues keyword search (renovate, dependabot, automated.*update, dependency.*update):

Searched open issues pages 1–7 (350 issues): No matches for "renovate", "dependabot", "automated dependency update", or "dependency update automation"
Related open issues found: #9889 (broad dependency security hardening — mentions Renovate/Dependabot as a brief recommendation in item 8 of "Recommended Remediations", but does not create a dedicated actionable issue for it), #9772 (pip-audit CI addition — does not mention Renovate/Dependabot)

Check 2 — Cross-area search (other AUTO-INF workers):

Reviewed all AUTO-INF-1 through AUTO-INF-10 open issues: None create a dedicated Renovate/Dependabot configuration issue
#9890 (AUTO-INF-5): Docker caching and release SBOMs — does not cover Renovate/Dependabot

Check 3 — Closed issues search (renovate, dependabot, automated.*dependency, dependency.*update):

Searched closed issues pages 1–81 (4050 issues): No matches for "renovate", "dependabot", or "automated dependency update"
Closest match: #1999 (fix(deps): upgrade aiohttp to remediate CVE-2026-34515) — this is a manual fix, not automated update infrastructure

Check 4 — Dedup proof:

Issue #9889 mentions "Enable dependency update automation (Dependabot/Renovate)" as item 8 of 8 in a broad list of recommendations. It does not create a dedicated issue, does not provide configuration, and does not define acceptance criteria for this specific improvement. This issue provides the concrete implementation details, configuration, and acceptance criteria that #9889 lacks.
No existing issue proposes a renovate.json configuration file or Dependabot setup.

Check 5 — Uncertainty check:

Confident this is not a duplicate. The distinction is clear: #9889 is a broad security hardening issue that mentions Renovate as one of many recommendations; this issue is a dedicated, actionable proposal with concrete configuration and acceptance criteria for automated dependency updates.

Automated by CleverAgents Bot
Supervisor: Test Infrastructure Pool | Agent: test-infra-pool-supervisor
Worker: [AUTO-INF-8] Dependency Security Analysis

## Summary The repository has no automated dependency update configuration (Renovate or Dependabot). This means security patches in transitive and direct dependencies are only applied when a developer manually runs `uv lock` and notices an update. The window between a CVE being published and the dependency being updated in `uv.lock` is unbounded. ## Background The existing security posture relies on: - `pip-audit` / `osv-scanner` to detect known CVEs (proposed in #9889, #9772) - `uv lock --check` to detect stale lockfiles (proposed in #10259) - Manual dependency updates by developers However, none of these tools *proactively* open PRs when new versions of dependencies are released. Without automated update PRs, the team must manually monitor PyPI for security releases across ~170 runtime packages (as noted in #9772's lockfile analysis). ## Finding No `renovate.json`, `.renovaterc`, `.github/dependabot.yml`, or equivalent configuration file exists in the repository. The `uv.lock` lockfile pins all ~170 runtime packages to exact versions, which is correct for reproducibility — but requires a proactive update mechanism to keep those pins current. **Risk:** The longer a vulnerable version stays pinned in `uv.lock`, the greater the exposure window. For example, `aiohttp` was patched for CVE-2026-34515 (issue #1999, #1642) — with Renovate, such patches would be surfaced as automated PRs within hours of the PyPI release. ## Proposed Improvement Add a `renovate.json` configuration file at the repository root to enable automated dependency update PRs: ```json { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": ["config:base"], "packageRules": [ { "matchManagers": ["pep621"], "matchUpdateTypes": ["patch", "minor"], "automerge": false, "labels": ["dependencies", "security"] }, { "matchManagers": ["pep621"], "matchUpdateTypes": ["major"], "automerge": false, "labels": ["dependencies", "breaking-change"] }, { "matchDepTypes": ["devDependencies"], "matchUpdateTypes": ["patch"], "automerge": false } ], "lockFileMaintenance": { "enabled": true, "schedule": ["before 6am on Monday"] }, "vulnerabilityAlerts": { "enabled": true, "labels": ["security", "vulnerability"] }, "prConcurrentLimit": 5, "prHourlyLimit": 2 } ``` Key configuration choices: 1. **`lockFileMaintenance`** — weekly `uv lock` regeneration to pick up transitive updates 2. **`vulnerabilityAlerts`** — immediate PRs when a dependency has a known CVE 3. **`prConcurrentLimit`** — prevents PR flood (max 5 open dependency PRs at once) 4. **`automerge: false`** — all updates require human review before merge (preserves quality gates) ## Expected Impact - Reduces the CVE exposure window from "unbounded" to "hours after PyPI release" - Complements `pip-audit`/`osv-scanner` (reactive scanning) with proactive update PRs - Ensures `uv.lock` stays current with security patches without manual intervention - Each update PR runs the full CI pipeline (coverage ≥97%, all nox sessions) before merge ## Acceptance Criteria - [ ] `renovate.json` exists at the repository root with valid configuration - [ ] Renovate is enabled for the Forgejo instance (or Dependabot if Renovate is unavailable) - [ ] Vulnerability alerts are enabled to generate immediate PRs for CVE-affected packages - [ ] Lock file maintenance is scheduled (weekly `uv lock` regeneration) - [ ] PR concurrency limits prevent PR flood - [ ] All update PRs must pass CI before merge (no automerge) ## Subtasks - [ ] Create `renovate.json` at repository root with the configuration above - [ ] Verify Renovate bot is enabled on the Forgejo instance (contact admin if needed) - [ ] Test that Renovate correctly detects `pyproject.toml` and `uv.lock` as the dependency sources - [ ] Confirm vulnerability alerts are working by checking Renovate dashboard - [ ] Document the Renovate configuration in CONTRIBUTING.md ## Definition of Done This issue is closed when: 1. `renovate.json` is merged to master 2. Renovate (or equivalent) is actively monitoring the repository 3. At least one test dependency update PR has been opened and processed through CI 4. CONTRIBUTING.md documents the automated update process ### Duplicate Check **Check 1 — Open issues keyword search (`renovate`, `dependabot`, `automated.*update`, `dependency.*update`):** - Searched open issues pages 1–7 (350 issues): No matches for "renovate", "dependabot", "automated dependency update", or "dependency update automation" - Related open issues found: #9889 (broad dependency security hardening — mentions Renovate/Dependabot as a brief recommendation in item 8 of "Recommended Remediations", but does not create a dedicated actionable issue for it), #9772 (pip-audit CI addition — does not mention Renovate/Dependabot) **Check 2 — Cross-area search (other AUTO-INF workers):** - Reviewed all AUTO-INF-1 through AUTO-INF-10 open issues: None create a dedicated Renovate/Dependabot configuration issue - #9890 (AUTO-INF-5): Docker caching and release SBOMs — does not cover Renovate/Dependabot **Check 3 — Closed issues search (`renovate`, `dependabot`, `automated.*dependency`, `dependency.*update`):** - Searched closed issues pages 1–81 (4050 issues): No matches for "renovate", "dependabot", or "automated dependency update" - Closest match: #1999 (fix(deps): upgrade aiohttp to remediate CVE-2026-34515) — this is a manual fix, not automated update infrastructure **Check 4 — Dedup proof:** - Issue #9889 mentions "Enable dependency update automation (Dependabot/Renovate)" as item 8 of 8 in a broad list of recommendations. It does not create a dedicated issue, does not provide configuration, and does not define acceptance criteria for this specific improvement. This issue provides the concrete implementation details, configuration, and acceptance criteria that #9889 lacks. - No existing issue proposes a `renovate.json` configuration file or Dependabot setup. **Check 5 — Uncertainty check:** - Confident this is not a duplicate. The distinction is clear: #9889 is a broad security hardening issue that mentions Renovate as one of many recommendations; this issue is a dedicated, actionable proposal with concrete configuration and acceptance criteria for automated dependency updates. --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure Pool | Agent: test-infra-pool-supervisor Worker: [AUTO-INF-8] Dependency Security Analysis

HAL9000 added the

labels

2026-04-18 08:42:33 +00:00