feat: automerge security (vulnerability) updates on green CI

Security PRs raised via vulnerabilityAlerts had no automerge, so they sat open until merged by hand — e.g. blog-svelte #35 (sharp) stayed open even though CI was green. These are exactly the updates that should land fastest, and platformAutomerge still gates them on the required checks. Add automerge to the vulnerabilityAlerts block. It overrides the per-repo group rules (e.g. the ungrouped 'svelte + build toolchain'), because Renovate splits vulnerability updates into their own branches anyway. Signed-off-by: Peter Siegmund <peter.siegmund@entwicklung.eq-3.de>
2026-07-25 02:23:39 +02:00
1 changed files with 2 additions and 1 deletions
@@ -10,7 +10,8 @@
  "osvVulnerabilityAlerts": true,
  "vulnerabilityAlerts": {
    "minimumReleaseAge": null,
-    "schedule": ["at any time"]
+    "schedule": ["at any time"],
+    "automerge": true
  },
  "lockFileMaintenance": {
    "enabled": true,