chore: let renovate manage bun.lock with weekly maintenance #253

Merged

lucas merged 1 commit from agent/issue-252-renovate-bun-lockfile-maintenance into main

2026-11-11 10:23:57 +01:00

omp-deck commented

2026-11-11 10:23:16 +01:00

Collaborator

Closes: #252

.renovaterc now lists the bun manager in enabledManagers (right after npm) and enables top-level lockFileMaintenance. Config-only change; no lockfile or manifest touched.

Why both edits are needed:

caniuse-lite is transitive, so only lockFileMaintenance can advance it — and it is off under config:recommended.
lockFileMaintenance for bun.lock is implemented by the bun manager, which was not in enabledManagers. Without it the npm manager would also edit package.json ranges without regenerating bun.lock, breaking bun install --frozen-lockfile.

"npm" is kept deliberately: the bun manager excludes a package.json from the npm manager's results when it claims it, and the repo has only bun.lock at the root, so there is no duplicate-PR risk.

No schedule, automerge or commitMessage* overrides: Renovate's own default for lockFileMaintenance is before 4am on monday, evaluated in the configured Europe/Berlin timezone, and the resulting PR is reviewed by hand.

Verification:

npx --yes --package renovate@44.14.12 renovate-config-validator .renovaterc (the version pinned in .forgejo/workflows/renovate.yml) → Config validated successfully against 1 file(s), exit 0.
bun install --frozen-lockfile → 936 packages installed, no frozen-lockfile error, confirming the change is config-only.

Post-merge observable (not runnable here): the first Monday run opens chore(deps): lock file maintenance on renovate/lock-file-maintenance, modifying bun.lock only; merging it advances caniuse-lite past 1.0.30001793 and clears the browserslist staleness warning from the web-build stage.

Closes: #252 `.renovaterc` now lists the `bun` manager in `enabledManagers` (right after `npm`) and enables top-level `lockFileMaintenance`. Config-only change; no lockfile or manifest touched. Why both edits are needed: - `caniuse-lite` is transitive, so only `lockFileMaintenance` can advance it — and it is off under `config:recommended`. - `lockFileMaintenance` for `bun.lock` is implemented by the `bun` manager, which was not in `enabledManagers`. Without it the `npm` manager would also edit `package.json` ranges without regenerating `bun.lock`, breaking `bun install --frozen-lockfile`. `"npm"` is kept deliberately: the bun manager excludes a `package.json` from the npm manager's results when it claims it, and the repo has only `bun.lock` at the root, so there is no duplicate-PR risk. No `schedule`, `automerge` or `commitMessage*` overrides: Renovate's own default for `lockFileMaintenance` is `before 4am on monday`, evaluated in the configured `Europe/Berlin` timezone, and the resulting PR is reviewed by hand. Verification: - `npx --yes --package renovate@44.14.12 renovate-config-validator .renovaterc` (the version pinned in `.forgejo/workflows/renovate.yml`) → `Config validated successfully against 1 file(s)`, exit 0. - `bun install --frozen-lockfile` → 936 packages installed, no frozen-lockfile error, confirming the change is config-only. Post-merge observable (not runnable here): the first Monday run opens `chore(deps): lock file maintenance` on `renovate/lock-file-maintenance`, modifying `bun.lock` only; merging it advances `caniuse-lite` past `1.0.30001793` and clears the browserslist staleness warning from the `web-build` stage.

omp-deck added 1 commit

2026-11-11 10:23:17 +01:00

chore: let renovate manage bun.lock with weekly maintenance 9e8771ef12

Renovate ignored bun.lock entirely: the bun manager was missing from
enabledManagers, and config:recommended keeps lockFileMaintenance off.
Transitive dependencies such as caniuse-lite therefore never advanced,
which is what makes the web build warn about stale browserslist data.

Enabling the bun manager also stops the npm manager from editing semver
ranges in package.json without regenerating bun.lock, which would break
`bun install --frozen-lockfile` in CI and the Docker build.

lockFileMaintenance keeps Renovate's default weekly schedule (before 4am
on monday, in the configured Europe/Berlin timezone); the resulting pull
request is reviewed and merged by hand.

Co-Authored-By: Claude Opus 5 via omp-deck