chore: let Renovate keep dependencies current

[christianhuening]

Nothing was watching dependencies between manual refreshes. Current state:

• web/: 39 outdated, 28 of them majors — tiptap 2→3 (×20), tailwind 3→4, typescript 5.9→7.0, vite 7→8, vitest 4→5, jsdom 29→30, @vitejs/plugin-react 4→6, @types/node 24→26
• One live advisory: GHSA-cp6q-959q-f8rh, moderate — mergeAttributes() in @tiptap/core turns an own __proto__ key into inherited executable DOM attributes. Vulnerable <3.30.4; we are on 2.27.2, so there is no fix inside the 2.x line — closing it means the tiptap 3 migration.
• Rust: cargo deny check advisories is clean, with the four documented ignores intact. e2e/: clean apart from @types/node.
• GitHub Actions, the Dockerfile base images and rust-toolchain.toml were unmanaged entirely.

Policy

Patch and minor merge themselves once CI is green — nextest, vitest, playwright, clippy and cargo-deny all gate the PR.

Majors never open a PR on their own. They are listed on the Dependency Dashboard issue and raised one at a time when someone ticks the box, so tiptap 2→3 stays a deliberate piece of work rather than eight red PRs landing together.

Weekly lockFileMaintenance is the part that is easy to undervalue: refreshing the lockfiles is the only route by which a patched transitive dependency arrives, because bumping a direct dependency cannot pull one in. The h2 and chacha20 advisories patched by hand for 0.3.0 were exactly that shape.

Three versions that live in more than one file

Each is grouped into a single PR. Bumping one side alone either breaks the build or drifts silently past the comments that tell humans to keep them in sync:

what	pinned in
Rust	rust-toolchain.toml, dtolnay/rust-toolchain@…, rust:…-alpine
pnpm	packageManager ×2, pnpm/action-setup version:
Node	node:…-alpine, setup-node node-version:

Custom managers cover the four Renovate has no built-in manager for, plus the Dockerfile's ZIG_VERSION. Each regex was checked against the real files rather than assumed — they match all three setup-node and action-setup blocks in ci.yml, not just the first, and resolve the right currentValue:

rust-toolchain.toml -> '1.97.1'
ci.yml node-version -> '24'  (×3)
ci.yml pnpm version -> '11'  (×3)
Dockerfile ZIG      -> '0.16.0'

Config passes renovate-config-validator.

Deliberately not automated

• prosemirror-model / -state / -view — pinned exactly in web/pnpm-workspace.yaml to deduplicate the core that @tiptap/pm and y-prosemirror both pull. The comment there records that taking prosemirror-view 1.42 changed how a remote replace-the-document update applies and broke history restore in a way only CI reproduced. Renovate would read 1.41.8 → 1.41.9 as an ordinary patch and merge it under the automerge policy. Dashboard-only.
• The security floors in the same overrides block (nanoid, lodash-es, dompurify) — they exist because a parent hard-pins a vulnerable version, so raising one needs a human to confirm the parent still resolves.
• @playwright/test — ships the browser binaries the e2e suite actually runs against.

Two things to action

1. This file is inert until the Renovate GitHub App is installed on the repository. Nothing happens on merge until then.
2. main has no branch protection — no required status checks. Automerge still waits for CI (Renovate checks the results itself), but nothing at the platform level enforces it. Worth adding required checks before this goes live.

🤖 Generated with Claude Code