From 586a8db7ca2c664a23bf7f8972204b35f5b53765 Mon Sep 17 00:00:00 2001
From: Matthew Schile <mschile@cypress.io>
Date: Wed, 27 May 2026 13:55:40 -0600
Subject: [PATCH] chore: add minimum release age and vulnerability alerts to
 renovate config

Add a 7-day minimum release age for all dependencies to avoid
pulling in potentially unstable new releases. Exempt the cypress
package from this cooldown so updates are available immediately.

Enable OSV vulnerability alerts and bypass the cooldown period
for vulnerability fixes so they are addressed without delay.
---
 renovate.json | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/renovate.json b/renovate.json
index de999fe95..608bdfd0f 100644
--- a/renovate.json
+++ b/renovate.json
@@ -6,11 +6,22 @@
   "major": {
     "automerge": false
   },
+  "minimumReleaseAge": "7 days",
+  "osvVulnerabilityAlerts": true,
+  "vulnerabilityAlerts": {
+    "minimumReleaseAge": "0 days"
+  },
   "prHourlyLimit": 2,
   "updateNotScheduled": false,
   "timezone": "America/New_York",
   "schedule": [
     "every weekend"
   ],
-  "masterIssue": true
+  "masterIssue": true,
+  "packageRules": [
+    {
+      "matchPackageNames": ["cypress"],
+      "minimumReleaseAge": "0 days"
+    }
+  ]
 }