Task Summary
Our Renovate config (.github/renovate.json5) intends routine dependency bumps to use chore(...) and only vulnerability fixes to use fix(...), as the header comment states. In practice, extends: ['config:recommended'] pulls in the :semanticPrefixFixDepsChoreOthers preset, whose packageRules type runtime dependencies as fix and override our top-level semanticCommitType: 'chore'. So routine, non-security bumps come through as fix(...) — e.g. #7060 (ng-zorro-antd v22), #7059 (fuse.js v7) — while devDependency bumps correctly stay chore(...). The split we observe is runtime-dep vs devDependency, not security vs non-security.
Fix: append a catch-all packageRule (matchPackageNames: ['*'] → semanticCommitType: 'chore') that runs last and overrides the preset, so every routine bump is chore(...); vulnerabilityAlerts is applied as a higher-priority layer for security branches and keeps its fix(...) type. Also set commitMessageSuffix: '' in vulnerabilityAlerts to drop Renovate's default [SECURITY] title suffix — the security label already identifies those PRs.
Task Type
Task Summary
Our Renovate config (
.github/renovate.json5) intends routine dependency bumps to usechore(...)and only vulnerability fixes to usefix(...), as the header comment states. In practice,extends: ['config:recommended']pulls in the:semanticPrefixFixDepsChoreOtherspreset, whosepackageRulestype runtime dependencies asfixand override our top-levelsemanticCommitType: 'chore'. So routine, non-security bumps come through asfix(...)— e.g. #7060 (ng-zorro-antd v22), #7059 (fuse.js v7) — while devDependency bumps correctly staychore(...). The split we observe is runtime-dep vs devDependency, not security vs non-security.Fix: append a catch-all
packageRule(matchPackageNames: ['*'] → semanticCommitType: 'chore') that runs last and overrides the preset, so every routine bump ischore(...);vulnerabilityAlertsis applied as a higher-priority layer for security branches and keeps itsfix(...)type. Also setcommitMessageSuffix: ''invulnerabilityAlertsto drop Renovate's default[SECURITY]title suffix — thesecuritylabel already identifies those PRs.Task Type