[renovate]

Welcome to Renovate! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.

📚 See our Reading List for relevant documentation you may be interested in reading.

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to renovate.json in this branch. Renovate will update the Pull Request description the next time it runs.

---

Detected Package Files

• .github/workflows/ci.yml (github-actions)
• .node-version (nodenv)
• package.json (npm)
• pnpm-workspace.yaml (npm)

Configuration Summary

Based on the default config's presets, Renovate will:

• Start dependency updates only once this onboarding PR is merged
• Hopefully safe environment variables to allow users to configure.
• Show all Merge Confidence badges for pull requests.
• Enable Renovate Dependency Dashboard creation.
• Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
• Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
• Group known monorepo packages together.
• Use curated list of recommended non-monorepo package groupings.
• Show only the Age and Confidence Merge Confidence badges for pull requests.
• Apply crowd-sourced package replacement rules.
• Apply crowd-sourced workarounds for known problems with packages.
• Ensure that every dependency pinned by digest and sourced from Forgejo contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from Gitea contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from GitHub.com and Github enterprise contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from GitLab.com contains a link to the commit-to-commit diff
• Correctly link to the source code for golang.org/x packages
• Link to pkg.go.dev/... for golang.org/x packages' title
• Provide a link to octochangelog's improved breakdown for Renovate's changelogs

---

What to Expect

With your current configuration, Renovate will create 10 Pull Requests:

chore(deps): update dependency @​types/node to v26.6.5

• Schedule: ["at any time"]
• Branch name: renovate/node-26.x-lockfile
• Merge into: main
• Upgrade @types/node to 26.6.5

chore(deps): update dependency publint to v0.3.25

• Schedule: ["at any time"]
• Branch name: renovate/publint-0.x-lockfile
• Merge into: main
• Upgrade publint to 0.3.25

chore(deps): update vitest monorepo to v5.0.3

• Schedule: ["at any time"]
• Branch name: renovate/vitest-monorepo
• Merge into: main
• Upgrade @vitest/coverage-v8 to sha512-+klsyz7BvT1vCU28Zkfzms1Ia78XD0V41U3FUtRaa3S+vOr/EXvK1O6BvVD7l1RzEjm6SONR2aybOvDDf9u0mQ==
• Upgrade vitest to sha512-xMw97S3rjdtj5dkVat7jCsqWBpvchs3RlpQctUqwJD0KkERk40vz2fJ77lDwW/Vzh/pk18eItYAzkodhSes3jQ==

fix(deps): update dependency effect to v4.0.2

• Schedule: ["at any time"]
• Branch name: renovate/effect-4.x
• Merge into: main
• Upgrade effect to sha512-YeYnLqSFrL4+tCOXRrfNP03w8FILoF/wDl+ukraJAGzXrjcS383W7LAAvGBbLatEyktmLxRq+9xJinx7QzXW5A==

chore(deps): update dependency bun to v1.4.3

• Schedule: ["at any time"]
• Branch name: renovate/bun-1.x
• Merge into: main
• Upgrade bun to sha512-EvQQ2dUJlixjKgJjeXZvdsHUWIKnVfYufrQNDHa++0YM4XksQ4GtGofEdRnQSiyNp/yUWiX6SlqS8zugZCo+2A==

chore(deps): update dependency knip to v6.41.0

• Schedule: ["at any time"]
• Branch name: renovate/knip-6.x-lockfile
• Merge into: main
• Upgrade knip to 6.41.0

chore(deps): update dependency playwright to v1.64.0

• Schedule: ["at any time"]
• Branch name: renovate/playwright-monorepo
• Merge into: main
• Upgrade playwright to 1.64.0

chore(deps): update pnpm to v12.10.1

• Schedule: ["at any time"]
• Branch name: renovate/pnpm-12.x
• Merge into: main
• Upgrade pnpm to sha512-ukCjfrGjcNYP6oxM8dNkwTvMzvUY6YrSvO6VT1OdONo3RY5YJho/pV4GUjRQ6g//+fSXsTW+QfLBXBZCusrObA==

chore(deps): update vite-plus monorepo to v1.1.0

• Schedule: ["at any time"]
• Branch name: renovate/vite-plus-monorepo
• Merge into: main
• Upgrade vite to sha512-Ai6HQP1zG0H3ZrmStEaMVKtDzW0xU3VgMzm3LFaXDQMEp8nAqvp0VGoU8HmpB9xv9vDSl+UxiSNOpuY9T714OQ==
• Upgrade vite-plus to sha512-khkRlY70qqbBV0QmF9QKXSrhxIRYftb1H05AJMowMoq7iouchmAoXYeReZ8pKKMOadqrWVxFa3S9BA2m7w59iA==

chore(deps): update dependency ubuntu to v26

• Schedule: ["at any time"]
• Branch name: renovate/ubuntu-26.x
• Merge into: main
• Upgrade ubuntu to 26.04-arm

🚸 PR creation will be limited to maximum 2 per hour, so it doesn't swamp any CI resources or overwhelm the project. See docs for prHourlyLimit for details.

---

❓ Got questions? Check out Renovate's Docs, particularly the Getting Started section.
If you need any further assistance then you can also request help here.

---

This PR was generated by Mend Renovate. View the repository job log.

[capy-ai]

Capy found 2 potential issues (1 high, 1 medium).

View 1 other finding in Capy.

[capy-ai]

fix(deps) commits will auto-publish SDK releases

High Severity

Renovate's config:recommended uses semantic commit type fix for production dependencies (the onboarding description already lists fix(deps): update dependency effect to v4.0.2). This repo's semantic-release pipeline on main treats any fix commit as a patch release and publishes @putdotio/sdk to npm with no human gate on the release environment. Merging those Renovate PRs would bump and publish the public package for routine dependency churn. Existing Dependabot npm updates deliberately use commit prefix chore, which does not release. Set semanticCommits / commitMessagePrefix so dependency updates stay chore (or equivalent non-releasing types), matching .github/dependabot.yml.

---

Renovate duplicates Dependabot without shared policy

Medium Severity

The repo already runs Dependabot for npm and github-actions (monthly schedule, patch/minor vs major groups, 1-day cooldown, chore/ci prefixes, and an explicit ignore of vitest / @vitest/* because Vite+ pins them). This file only extends config:recommended, so after merge Renovate will open its own stream of PRs (the onboarding body lists 10, including a separate vitest monorepo bump and ubuntu-26 runner images) on top of Dependabot. That yields duplicate PRs, conflicting lockfile races, and CI noise, and can break verify if vitest drifts from vite-plus. Either disable Dependabot when enabling Renovate, or port the same schedule, grouping, commit prefixes, and vitest ignores into renovate.json before merge.

[altaywtf]

Superseded: renovate.json is on the default branch.