From 43590f1509450b0957b811c161e4e8b231b1c9ce Mon Sep 17 00:00:00 2001
From: openhands <openhands@all-hands.dev>
Date: Fri, 16 Oct 2026 17:16:40 +0200
Subject: [PATCH] feat(renovate): add OSV security alerts and pin the automerge
 strategy

Enable osvVulnerabilityAlerts (Gitea has no advisory feed of its own) with the
OSV summary on the dependency dashboard, and let security fixes skip the 3-day
minimumReleaseAge in their own labelled PR. Set automergeStrategy to squash so
automerged dependency updates match the repository history.
---
 renovate.json | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/renovate.json b/renovate.json
index 18ccbec4..229e35d5 100644
--- a/renovate.json
+++ b/renovate.json
@@ -8,6 +8,10 @@
 	],
 	"labels": ["dependencies"],
 	"dependencyDashboard": true,
+	"dependencyDashboardOSVVulnerabilitySummary": "all",
+	"osvVulnerabilityAlerts": true,
+	"configMigration": true,
+	"automergeStrategy": "squash",
 	"prConcurrentLimit": 5,
 	"prHourlyLimit": 3,
 	"minimumReleaseAge": "3 days",
@@ -28,6 +32,13 @@
 			"labels": ["major"],
 			"dependencyDashboardApproval": true
 		},
+		{
+			"description": "Beveiligingsfixes (OSV) niet tegenhouden door de wachttijd en in een eigen PR",
+			"matchCategories": ["security"],
+			"minimumReleaseAge": null,
+			"groupName": "security fixes",
+			"addLabels": ["security"]
+		},
 		{
 			"description": "Docker-compose draait op :latest; geen digest-pin-ruis",
 			"matchManagers": ["docker-compose"],