fix(deps): restore trustworthy dependency automation (#1572)

Co-authored-by: Test <test@example.com>

Author: FelixTJDietrich

.changeset/solid-ends-decide.md

@@ -0,0 +1,4 @@
+---
+---
+
+No release note: this updates dependency automation and its generated client output without changing operator- or user-facing behavior.

.github/workflows/reusable-docker-build.yml

@@ -280,7 +280,7 @@ jobs:
 
       - name: Install cosign
         if: inputs.single-arch
-        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Sign and verify image
         if: inputs.single-arch
@@ -413,7 +413,7 @@ jobs:
           push-to-registry: true
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       # --recursive: sign each child manifest so per-platform verify works.
       - name: Sign image with cosign

SECURITY.md

@@ -46,7 +46,7 @@ Out of scope:
 
 Independent of this reporting channel, the project runs:
 
-- **Dependency updates**: [Renovate](https://docs.renovatebot.com/) (Mend-hosted) with vulnerability alerts prioritized and auto-merged ([`renovate.json`](renovate.json))
+- **Dependency updates**: [Renovate](https://docs.renovatebot.com/) proposes vulnerability fixes without dashboard approval or a minimum release age ([`renovate.json`](renovate.json))
 - **Dependency & secret scanning in CI**: Trivy filesystem scan and TruffleHog ([`ci-security-scan.yml`](.github/workflows/ci-security-scan.yml))
 - **Static analysis**: GitHub CodeQL
 - **Native alerts**: GitHub secret scanning and Dependabot dependency alerts

bun.lock

@@ -151,11 +151,11 @@ Check the current release: `git describe --tags --abbrev=0` or
 
 ## Dependency management
 
-Dependencies are managed through the
-[Renovate Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/). Approved
-updates are scheduled after the configured release-age checks; vulnerability alerts may run and merge
-independently. Bot PRs are exempt from the changeset check — when a dependency bump is user-facing,
-a maintainer adds the changeset.
+Routine dependency updates require approval through the
+[Renovate Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) and observe
+the configured schedule and release age. Vulnerability-fix pull requests bypass those controls but
+still require review. Bot PRs are exempt from the changeset check — when a dependency bump is
+user-facing, a maintainer adds the changeset.
 
 Exact pins remain exact during Renovate updates. Formatter upgrades must include and separately review
 any resulting mechanical formatting changes.

docs/contributor/release-management.mdx

@@ -1,6 +1,5 @@
 {
 	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
-	"description": "Renovate config - dashboard only, manual updates",
 	"extends": [
 		"config:best-practices",
 		":semanticCommitTypeAll(chore)",
@@ -11,9 +10,16 @@
 	"timezone": "Europe/Berlin",
 	"schedule": ["before 7am on monday"],
 	"minimumReleaseAge": "3 days",
-	"platformAutomerge": true,
-	"automergeStrategy": "squash",
 	"semanticCommitScope": "deps",
+	"enabledManagers": [
+		"bun",
+		"maven",
+		"maven-wrapper",
+		"dockerfile",
+		"docker-compose",
+		"github-actions",
+		"custom.regex"
+	],
 	"dependencyDashboard": true,
 	"dependencyDashboardTitle": "Dependency Dashboard",
 	"lockFileMaintenance": {
@@ -23,32 +29,53 @@
 	"rangeStrategy": "replace",
 	"packageRules": [
 		{
-			"description": "Group Java/Spring",
 			"matchManagers": ["maven"],
-			"groupName": "Java dependencies",
+			"matchDepTypes": ["compile", "runtime", "provided", "optional", "parent", "parent-root"],
+			"matchUpdateTypes": ["minor", "patch", "digest", "pin", "pinDigest"],
+			"groupName": "Java runtime and framework dependencies",
+			"labels": ["dependencies", "java"]
+		},
+		{
+			"matchManagers": ["maven"],
+			"matchDepTypes": ["build", "test"],
+			"matchUpdateTypes": ["minor", "patch", "digest", "pin", "pinDigest"],
+			"groupName": "Java developer tooling",
 			"labels": ["dependencies", "java"]
 		},
 		{
-			"description": "Group webapp non-major updates",
 			"matchFileNames": ["webapp/package.json"],
+			"matchDepTypes": ["dependencies"],
+			"matchUpdateTypes": ["minor", "patch"],
+			"groupName": "Webapp runtime dependencies",
+			"labels": ["dependencies", "webapp"]
+		},
+		{
+			"matchFileNames": ["webapp/package.json"],
+			"matchDepTypes": ["devDependencies"],
 			"matchUpdateTypes": ["minor", "patch"],
-			"groupName": "Webapp dependencies",
+			"groupName": "Webapp developer tooling",
 			"labels": ["dependencies", "webapp"]
 		},
 		{
-			"description": "Group documentation deps",
 			"matchFileNames": ["docs/package.json"],
-			"groupName": "Documentation dependencies",
+			"matchDepTypes": ["dependencies"],
+			"matchUpdateTypes": ["minor", "patch"],
+			"groupName": "Documentation runtime dependencies",
+			"labels": ["dependencies", "docs"]
+		},
+		{
+			"matchFileNames": ["docs/package.json"],
+			"matchDepTypes": ["devDependencies"],
+			"matchUpdateTypes": ["minor", "patch"],
+			"groupName": "Documentation developer tooling",
 			"labels": ["dependencies", "docs"]
 		},
 		{
-			"description": "Major updates",
 			"matchUpdateTypes": ["major"],
 			"minimumReleaseAge": "7 days",
 			"labels": ["dependencies", "breaking"]
 		},
 		{
-			"description": "Core frameworks",
 			"matchPackageNames": [
 				"typescript",
 				"react",
@@ -60,38 +87,23 @@
 			"groupName": "Core frameworks"
 		},
 		{
-			"description": "GitHub Actions",
 			"matchManagers": ["github-actions"],
+			"matchUpdateTypes": ["minor", "patch", "digest", "pin", "pinDigest"],
 			"groupName": "GitHub Actions",
 			"labels": ["dependencies", "ci"]
 		},
 		{
-			"description": "Docker images",
 			"matchManagers": ["dockerfile", "docker-compose"],
-			"groupName": "Docker images",
-			"pinDigests": true,
 			"labels": ["dependencies", "infrastructure"]
 		},
 		{
-			"description": "Release runtime images",
-			"matchPackageNames": [
-				"docker.io/library/alpine",
-				"docker.io/library/nats",
-				"docker.io/library/nginx",
-				"docker.io/library/traefik",
-				"alpine",
-				"nats",
-				"nginx",
-				"traefik"
-			],
-			"groupName": "Release runtime images",
-			"automerge": false,
-			"labels": ["dependencies", "infrastructure", "security"]
+			"matchUpdateTypes": ["major"],
+			"groupName": null
 		}
 	],
 	"customManagers": [
 		{
-			"description": "Track ARG <PKG>_VERSION pins in Dockerfiles via a `# renovate:` magic comment, so Renovate handles bumps for tools installed inside the image (e.g. agent-pi's @earendil-works/pi-coding-agent).",
+			"description": "Track Dockerfile ARG version pins",
 			"customType": "regex",
 			"managerFilePatterns": ["/(^|/)Dockerfile$/"],
 			"matchStrings": [
@@ -110,7 +122,7 @@
 			"versioningTemplate": "semver"
 		},
 		{
-			"description": "Keep the release evidence inventory aligned with reviewed upstream image pins",
+			"description": "Track release image tags and digests",
 			"customType": "regex",
 			"managerFilePatterns": ["/^security/release-images\\.json$/"],
 			"matchStrings": [
@@ -120,8 +132,8 @@
 		}
 	],
 	"vulnerabilityAlerts": {
+		"enabled": true,
 		"labels": ["security", "dependencies"],
-		"schedule": ["at any time"],
 		"minimumReleaseAge": null,
 		"dependencyDashboardApproval": false,
 		"automerge": false,

renovate.json

@@ -1,10 +1,10 @@
-import { defaultPlugins, defineConfig } from "@hey-api/openapi-ts";
+import { defineConfig } from "@hey-api/openapi-ts";
 
 export default defineConfig({
 	input: "../server/openapi.yaml",
 	output: "src/api",
 	plugins: [
-		...defaultPlugins,
+		"@hey-api/typescript",
 		"@hey-api/client-fetch",
 		{
 			name: "@tanstack/react-query",
@@ -15,16 +15,13 @@ export default defineConfig({
 			bigInt: false,
 			name: "@hey-api/transformers",
 		},
-		// The transformers plugin only *emits* `transformers.gen.ts`; the SDK ignores it unless asked.
-		// Without this the generated types promise `Date` while the fetch client hands back the raw
-		// ISO string, so anything typed against the client (`.toLocaleDateString()`) throws on the
-		// first real response while every `new Date(…)` fixture stays green.
+		// Apply generated date transformers so SDK values match their Date types.
 		{
 			name: "@hey-api/sdk",
 			transformer: true,
 		},
 	],
-	// Generated query hooks do not support SSE responses; Mentor uses use-mentor-chat.ts.
+	// SSE operations use the streaming client rather than generated query hooks.
 	parser: {
 		filters: {
 			operations: {

webapp/openapi-ts.config.ts

@@ -69,7 +69,7 @@
 	"devDependencies": {
 		"@chromatic-com/storybook": "5.2.1",
 		"@gitlab/svgs": "^3.160.0",
-		"@hey-api/openapi-ts": "0.97.1",
+		"@hey-api/openapi-ts": "0.97.3",
 		"@oxlint/plugins": "1.79.0",
 		"@playwright/test": "1.60.0",
 		"@primer/primitives": "11.9.0",
@@ -86,6 +86,7 @@
 		"@testing-library/dom": "10.4.1",
 		"@testing-library/react": "16.3.2",
 		"@testing-library/user-event": "14.6.1",
+		"@types/hast": "3.0.5",
 		"@types/node": "24.12.4",
 		"@types/react": "19.2.14",
 		"@types/react-dom": "19.2.3",
@@ -109,8 +110,7 @@
 		"typescript7": "npm:typescript@7.0.2",
 		"vite": "8.2.2",
 		"vite-plugin-terminal": "1.4.0",
-		"vitest": "4.1.11",
-		"@types/hast": "3.0.5"
+		"vitest": "4.1.11"
 	},
 	"msw": {
 		"workerDirectory": [

webapp/package.json

@@ -48,10 +48,7 @@ export const createClient = (config: Config = {}): Client => {
     };
 
     if (opts.security) {
-      await setAuthParams({
-        ...opts,
-        security: opts.security,
-      });
+      await setAuthParams(opts);
     }
 
     if (opts.requestValidator) {

webapp/src/api/client/client.gen.ts

@@ -151,12 +151,13 @@ type MethodFn = <
 
 type SseFn = <
   TData = unknown,
-  TError = unknown,
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  _TError = unknown,
   ThrowOnError extends boolean = false,
   TResponseStyle extends ResponseStyle = 'fields',
 >(
   options: Omit<RequestOptions<never, TResponseStyle, ThrowOnError>, 'method'>,
-) => Promise<ServerSentEventsResult<TData, TError>>;
+) => Promise<ServerSentEventsResult<TData>>;
 
 type RequestFn = <
   TData = unknown,