From 9c356f5e926ce44b3476a2768b752ac7794596e3 Mon Sep 17 00:00:00 2001
From: "Johannes Z." <hannes@aignostics.com>
Date: Wed, 28 Oct 2026 11:05:06 +0100
Subject: [PATCH 1/2] chore(renovate): remove the security-tool release-age
 exemption

Part of OP-3647.
---
 renovate.json | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/renovate.json b/renovate.json
index e4e9da9..7b7fc8a 100644
--- a/renovate.json
+++ b/renovate.json
@@ -48,19 +48,6 @@
       "groupName": "mise tools",
       "matchManagers": ["mise"],
       "separateMajorMinor": false
-    },
-    {
-      "description": "Bypass delay for security tools",
-      "matchPackageNames": [
-        "trivy",
-        "pip-audit",
-        "aquasecurity/trivy-action",
-        "pypa/pip-audit"
-      ],
-      "minimumReleaseAge": null,
-      "automerge": true,
-      "automergeType": "pr",
-      "groupName": "security-tool-updates"
     }
   ]
 }

From 4201c6a0e2e46aa4e14b58548e5b9561abec7ef8 Mon Sep 17 00:00:00 2001
From: Johannes Zorn <hannes@aignostics.com>
Date: Wed, 28 Oct 2026 14:20:56 +0100
Subject: [PATCH 2/2] chore(renovate): stop automerging vulnerability-fix PRs

The org config keeps automerge off for vulnerability fixes, which skip
the 14-day release-age wait. This repo turned it back on. Part of OP-3649.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 renovate.json | 1 -
 1 file changed, 1 deletion(-)

diff --git a/renovate.json b/renovate.json
index 7b7fc8a..25d238c 100644
--- a/renovate.json
+++ b/renovate.json
@@ -16,7 +16,6 @@
   },
   "vulnerabilityAlerts": {
     "enabled": true,
-    "automerge": true,
     "minimumReleaseAge": null
   },
   "lockFileMaintenance": {