From db6592871f88369ca05471588b689be3d90a72e7 Mon Sep 17 00:00:00 2001
From: Kim Gustyr <kim.gustyr@flagsmith.com>
Date: Mon, 9 Nov 2026 15:15:38 +0100
Subject: [PATCH 1/2] ci(Renovate): Upgrade to Renovate 44 and drop uv lock
 file maintenance

renovatebot/github-action was pinned to v46.1.20, which runs the floating
renovate:43 image (43.288.0). Transitive security updates for uv.lock landed
in Renovate 44.221.0 (renovatebot/renovate#47482), so bump the action to
v46.3.13, which runs renovate:44.

Since security:only-security-updates disables everything, the action never
got updated; re-enable updates for it.

Lock file maintenance is no longer needed for uv, as vulnerable lockfile-only
dependencies are now remediated directly; keep it for npm.
---
 .github/workflows/renovate.yml |  2 +-
 renovate.json                  | 14 +++++++++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index ea6dcb12e590..195de9d3810a 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -46,7 +46,7 @@ jobs:
                   f.write(f"value={json.dumps(value)}\n")
 
       - name: Run Renovate
-        uses: renovatebot/github-action@3064367f740a1a91cca218698a63902689cce200
+        uses: renovatebot/github-action@266fef21329c44765ad42f9dea1f01f5d2d91084 # v46.3.13
         env:
           RENOVATE_TOKEN: ${{ steps.app-token.outputs.token }}
           RENOVATE_FORCE: ${{ steps.force.outputs.value }}
diff --git a/renovate.json b/renovate.json
index 59d65335676a..6c4fde4b8796 100644
--- a/renovate.json
+++ b/renovate.json
@@ -12,6 +12,12 @@
     "enabled": true,
     "schedule": ["before 9am on monday"]
   },
+  "pep621": {
+    "lockFileMaintenance": {
+      "description": "Not needed for uv, as Renovate remediates vulnerable transitive uv.lock dependencies directly",
+      "enabled": false
+    }
+  },
   "packageRules": [
     {
       "matchManagers": ["pep621"],
@@ -50,7 +56,13 @@
       "rangeStrategy": "bump"
     },
     {
-      "description": "Re-enable lock file maintenance, which security:only-security-updates disables. Keep last with an empty scope to ensure commit scope is applied correctly.",
+      "description": "Keep Renovate itself up to date, so we get new features such as transitive security updates",
+      "matchPackageNames": ["renovatebot/github-action"],
+      "enabled": true
+    },
+    {
+      "description": "Re-enable lock file maintenance for npm, which security:only-security-updates disables. Keep last with an empty scope to ensure commit scope is applied correctly.",
+      "matchManagers": ["npm"],
       "matchUpdateTypes": ["lockFileMaintenance"],
       "enabled": true,
       "semanticCommitScope": ""

From 4fd417b114656fe440c0fe0404fc5ef6c17697a3 Mon Sep 17 00:00:00 2001
From: Kim Gustyr <kim.gustyr@flagsmith.com>
Date: Mon, 9 Nov 2026 15:42:55 +0100
Subject: [PATCH 2/2] ci(Renovate): Keep security-only policy for the Renovate
 action

---
 renovate.json | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/renovate.json b/renovate.json
index 6c4fde4b8796..1e3afabb9403 100644
--- a/renovate.json
+++ b/renovate.json
@@ -55,11 +55,6 @@
       "enabled": true,
       "rangeStrategy": "bump"
     },
-    {
-      "description": "Keep Renovate itself up to date, so we get new features such as transitive security updates",
-      "matchPackageNames": ["renovatebot/github-action"],
-      "enabled": true
-    },
     {
       "description": "Re-enable lock file maintenance for npm, which security:only-security-updates disables. Keep last with an empty scope to ensure commit scope is applied correctly.",
       "matchManagers": ["npm"],