fix(#3482): exclude vulnerability PRs from grouped patch updates

[fullsend-ai-coder]

What:

Add a packageRules entry to renovate.json that excludes vulnerability/security PRs from being grouped with patch update bundles. Also add vulnerabilityAlerts configuration for proper labeling and scheduling.

Why:

Standalone security PRs (e.g., #3473-3475 for CVE-2026-71556 and CVE-2026-71557) have been repeatedly autoclosed by Renovate's deduplication logic because the same version bump exists in a grouped patch PR (#3019) that has been failing CI for months. This is a recurring pattern — the same thing happened with go-git v5.19.1 in April 2026 (#3250-3253 autoclosed, manual PR #3335 needed weeks later). The fix ensures security PRs remain standalone and can merge independently of stalled grouped PRs.

Tickets:

#3482

---

Closes #3482

Post-script verification

• Branch is not main/master (agent/3482-exclude-vuln-from-group)
• Secret scan passed (gitleaks — 61ed8a355ace58359e1255b0ea2ce01a9d378f50..HEAD)
• PR body secret scan passed (gitleaks — no-git)

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:29 PM UTC · Completed 2:42 PM UTC

Commit: 87c4a29 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.40% <ø> (-0.01%)	⬇️
generative	16.36% <ø> (ø)
integration	27.58% <ø> (ø)
unit	71.97% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Review

Findings

Medium

• [logic error] renovate.json:7 — The packageRules entry setting groupName: null and groupSlug: null for isVulnerabilityAlert: true is redundant. Renovate already internally forces groupName: null for vulnerability alerts via its built-in force block, which takes the highest configuration priority and cannot be overridden by user packageRules. This means the rule will never have a practical effect on ungrouping behavior. The actual problem described in issue Exclude Renovate vulnerability PRs from grouped patch updates to prevent security fixes stalling behind failing CI bundles #3482 (standalone security PRs being autoclosed in favor of a stalled grouped PR containing the same version bump) is caused by Renovate's update deduplication logic, not by grouping configuration. The deduplication occurs because the same dependency version bump (e.g., go-git v5.19.1 → v5.19.2) exists in both the standalone security branch and the grouped patch branch, causing Renovate to consider the standalone PR superseded. Setting groupName: null (which is already the default for vulnerability alerts) does not change how deduplication works.
  Remediation: Investigate whether the autoclosing is caused by Renovate's branch/update deduplication logic rather than grouping. Potential approaches: (1) file a Renovate issue about deduplication between vulnerability PRs and grouped PRs that have failing CI, (2) consider splitting the stalled grouped PR (Update go modules (main) (patch) #3019) or removing the go-git update from it so the deduplication trigger is eliminated, (3) if keeping this rule for documentation/intent purposes, add a JSON comment noting it is redundant with Renovate's built-in force behavior and does not address the deduplication root cause.

Low

• [scope limitation] renovate.json:9 — The packageRules entry restricts the vulnerability ungrouping override to matchManagers: ["gomod"] only, while the parent preset groups dependencies across multiple managers (dockerfile, github-actions, npm). Since the entire packageRules entry is redundant (Renovate already forces groupName: null for all vulnerability alerts regardless of manager), this scope limitation is moot. However, if the team decides to keep the rule for documentation purposes, removing matchManagers would make the intent clearer for all dependency types.

---

Labels: PR modifies Renovate configuration for vulnerability alert handling

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[medium] logic error

The packageRules entry setting groupName: null and groupSlug: null for isVulnerabilityAlert: true is redundant. Renovate already internally forces groupName: null for vulnerability alerts via its built-in force block. The actual problem (autoclosing of standalone security PRs) is caused by Renovate's update deduplication logic, not by grouping configuration. This rule will not prevent the autoclosing behavior described in issue #3482.

Suggested fix: Investigate whether the autoclosing is caused by Renovate's branch/update deduplication logic. Consider: (1) filing a Renovate issue about deduplication between vulnerability PRs and grouped PRs with failing CI, (2) splitting the stalled grouped PR (#3019), or (3) keeping this rule with documentation noting its redundancy.

[fullsend-ai-review]

[low] scope limitation

The packageRules entry restricts the vulnerability ungrouping override to matchManagers: [gomod] only, while the parent preset groups dependencies across multiple managers. Since the entire packageRules entry is redundant, this scope limitation is moot.