From c4fce395f6f4a5322f8a9e6fb3422a49f032fe38 Mon Sep 17 00:00:00 2001 From: carole-lavillonniere Date: Thu, 13 Aug 2026 15:01:46 +0200 Subject: [PATCH] chore(renovate): enable updates for indirect Go dependencies Renovate's gomod manager skips deps marked `// indirect` unless a rule enables them, so transitive modules were never proposed for update. That is where Go CVEs usually land. golang.org/x/net is the current example: v0.56.0 has been available since 2026-06-09 and fixes CVE-2026-46600 (HIGH), but go.mod still pins v0.55.0 because the dep is indirect. The last bump to v0.55 (#110) was hand-written for the same reason. The new rule only sets `enabled`, so the grouping and automerge from the "Go dependencies (non-major)" rule still apply, and it is placed before the major rule so major bumps stay disabled. Validated with renovate-config-validator. --- renovate.json | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/renovate.json b/renovate.json index 9fe2a89..d59e108 100644 --- a/renovate.json +++ b/renovate.json @@ -23,6 +23,12 @@ "groupName": "Go dependencies (non-major)", "automerge": true }, + { + "description": "The gomod manager skips '// indirect' deps by default, so CVE fixes in transitive modules were never proposed (golang.org/x/net sat two minor versions behind for months). Enabling them here only sets 'enabled'; the grouping and automerge above still apply, and the major rule below still wins for major bumps.", + "matchManagers": ["gomod"], + "matchDepTypes": ["indirect"], + "enabled": true + }, { "matchManagers": ["gomod"], "excludePackageNames": ["go"],