[olivermeyer]

Why?
The SDK is deprecated and gets only bug and security fixes until it is retired, so routine dependency updates only add Renovate PRs that nobody merges. Security fixes must still reach the SDK, both for direct dependencies and for vulnerable transitive dependencies in uv.lock, which the Scheduled Audit workflow reports.

How?
A last packageRules entry turns off all updates, and vulnerabilityAlerts.enabled: true makes Renovate force vulnerability fix PRs through that rule; the weekly lock file maintenance from config:best-practices stays on, because it has no package name and matchPackageNames: ["*"] does not match it. The file drops every setting that only shapes normal updates (groups, range strategy, extractVersion, the copied org config comments), which takes it from about 200 to about 60 lines. The skip:test:long_running label goes too, so the long-running tests run on the few Renovate PRs that are left.

🤖 Generated with Claude Code

[ox-security]

OX Security reviewed this pull request — nothing to fix.

✔ No issues found

Branch chore/renovate-security-only → main

View scan in OX Security →

[claude]

Claude finished @olivermeyer's task in 3m 4s —— View job

---

Code Review: Renovate Security-Only Configuration

Reviewing PR #769 to configure Renovate for security updates only, aligning with the SDK's maintenance mode policy.

Todo List

• Read CLAUDE.md maintenance mode policy
• Review renovate.json changes
• Verify security-only configuration correctness
• Check commit message format (conventional commits)
• Verify documentation consistency
• Post comprehensive review findings
• Apply verdict label

---

Review Summary

This PR excellently implements the security-only update policy required by the SDK's maintenance mode. The configuration is technically sound, well-documented, and perfectly aligned with the maintenance mode rules.

✅ CRITICAL CHECKS - All Pass

1. Test Markers

Status: ✅ N/A (no code changes)

2. Test Coverage

Status: ✅ N/A (no code changes)

3. Code Quality

Status: ✅ N/A (configuration file only)

4. Conventional Commits

Status: ✅ PASS

$ git log --oneline origin/main..HEAD
5fe9494 chore(renovate): open only security updates

Commit message correctly follows conventional commit format: chore(renovate): <description>

✅ REPOSITORY-SPECIFIC REVIEW AREAS - All Pass

5. Architecture Compliance

Status: ✅ N/A (configuration only, no architecture impact)

6. Testing Strategy

Status: ✅ EXCELLENT - Enhanced testing for security PRs

Finding: The PR removes the skip:test:long_running label from Renovate PRs.

Analysis: This is the correct decision because:

• Security PRs will be rare (only when vulnerabilities are discovered)
• Security fixes require thorough validation before merge
• Running the full test suite (including long-running tests) on security PRs ensures no regressions
• The cost of running long tests on a few security PRs per month is negligible vs. the risk of merging an untested security fix

7. Medical Device & Security

Status: ✅ EXCELLENT - Strengthens security posture

This configuration enhances the SDK's security posture by:

1. Eliminating noise from routine dependency updates
2. Ensuring security fixes are surfaced immediately via vulnerability alerts
3. Requiring manual review of security fixes (automerge: false in vulnerabilityAlerts)
4. Maintaining transitive dependency security via weekly lock file maintenance

8. Breaking Changes

Status: ✅ None

This is a pure configuration change with no user-facing impact.

9. CI/CD Impact

Status: ✅ POSITIVE

Changes:

• Security PRs will now run the full test suite including long-running tests
• Fewer overall Renovate PRs (only security + weekly lock file maintenance)
• CI load significantly reduced

10. Documentation & Maintenance Mode Alignment

Status: ✅ PERFECT ALIGNMENT

CLAUDE.md (lines 36-48) states:

## Maintenance mode

The Aignostics Python SDK is deprecated. Support ends on April 30, 2027.
Until that date, the SDK is in maintenance mode.

Use these rules for each change:

1. Accept anomaly fixes through PR-SOP-01.
2. Accept dependency updates that fix vulnerabilities.  ← THIS PR IMPLEMENTS THIS
3. Reject new features.
4. Keep the deprecation warning in each release.

This PR precisely implements rule #2 by configuring Renovate to only open PRs for vulnerability fixes.

🔍 Technical Configuration Review

Implementation Mechanism

The security-only behavior is achieved through three coordinated settings:

1. Block all normal updates (lines 54-56):

{
  "matchPackageNames": ["*"],
  "enabled": false
}

2. Force vulnerability fixes through (lines 31-36):

"vulnerabilityAlerts": {
  "enabled": true,
  "automerge": false,
  // ...
}

3. Preserve lock file maintenance (lines 44-46):

{
  "matchUpdateTypes": ["lockFileMaintenance"],
  "minimumReleaseAgeBehaviour": "timestamp-optional"
}

Why This Works

According to Renovate documentation, when vulnerabilityAlerts.enabled: true is set, Renovate forces vulnerability fix PRs through packageRules as if they were configured with force: true. This allows security PRs to bypass the final enabled: false rule.

Lock file maintenance continues to work because:

• It has no associated package name
• The matchPackageNames: ["*"] rule doesn't match it
• It runs on schedule from config:best-practices (weekly)
• It updates transitive dependencies in uv.lock, catching vulnerable indirect dependencies

✅ Configuration Quality

Removed ~140 lines of settings that only apply to normal updates:

• Grouping rules (minor/patch, GitHub Actions, pre-commit)
• Range strategies (widen for pep621)
• Python version update rules
• Runtime-critical package rules
• GitHub Actions digest pinning
• Rebase timing settings
• Pre-commit manager config

Kept essential settings:

• Security vulnerability detection (osvVulnerabilityAlerts)
• Conventional commit formatting
• Automerge infrastructure (for future potential use)
• Proper labeling for CI (skip:codecov, renovate, manager labels)

Result: Clean, focused configuration that clearly expresses intent.

📝 Documentation Quality

The inline comments are excellent:

• Line 4-7: Clear explanation of the security-only policy
• Line 29-30: Explains how vulnerabilityAlerts.enabled forces PRs through
• Line 35: Updated path reference from org config to repo config ✅
• Line 40-42: References upstream Renovate issue for temporary workaround
• Line 48-52: Clear description of the blocking rule and its interactions

🎯 Specific Improvements Worth Noting

1. Correct prHeader update (line 35):

   • Old: aignostics/renovate-config
   • New: renovate.json (this repo)
   • ✅ Correctly points to the actual configuration file

2. Lock file maintenance timestamp fix (lines 40-46):

   • Preserves the workaround for fix: correct release-age checks for digest and lock file maintenance renovatebot/renovate#46645
   • Ensures weekly lock file maintenance doesn't get blocked
   • Includes reference to upstream issue for future cleanup

3. Clear intent in comments:

   • Every major section explains why not just what
   • References the deprecation policy directly
   • Explains the forcing mechanism for vulnerability alerts

🚀 Expected Behavior After Merge

Renovate will create PRs for:

1. ✅ Vulnerability fixes (immediate, labeled security)
2. ✅ Weekly lock file maintenance (updates uv.lock including transitive deps)

Renovate will NOT create PRs for:

1. ❌ Routine version bumps
2. ❌ Minor/patch updates
3. ❌ Major version updates
4. ❌ GitHub Actions updates
5. ❌ Pre-commit hook updates

All security PRs will:

• Run the full CI test suite (including long-running tests)
• Require manual review and approval
• NOT automerge (must be merged by a person)
• Include advisory details from OSV/GitHub Security

Summary

This PR is exemplary:

• ✅ Perfect alignment with maintenance mode policy
• ✅ Technically correct implementation
• ✅ Excellent documentation and comments
• ✅ Conventional commit format
• ✅ Improved security testing (full suite on security PRs)
• ✅ Significant simplification (~60 lines vs ~200)
• ✅ No breaking changes
• ✅ Clear intent and easy to understand

Recommendation: Approve and merge. This is exactly the configuration the SDK needs in maintenance mode.

---

Verdict: ✅ claude:review:passed

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.
see 18 files with indirect coverage changes

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud