chore(deps): security hardening (#4551)

Author: Meierschlumpf

.github/renovate.json5

@@ -15,6 +15,21 @@
       matchUpdateTypes: ["minor", "patch", "pin", "digest"],
       automerge: true,
     },
+    {
+      // disallow automerge for onlyBuiltDependencies
+      matchPackageNames: [
+        "@tree-sitter-grammars/tree-sitter-yaml",
+        "bcrypt",
+        "better-sqlite3",
+        "cpu-features",
+        "esbuild",
+        "sharp",
+        "ssh2",
+        "tree-sitter",
+        "tree-sitter-json",
+      ],
+      automerge: false,
+    },
   ],
   updateInternalDeps: true,
   rangeStrategy: "bump",

.npmrc

@@ -3,3 +3,4 @@
 # @link https://docs.expo.dev/guides/monorepos/#common-issues
 node-linker=hoisted
 strict-peer-dependencies=false
+engine-strict=true

package.json

@@ -50,6 +50,7 @@
     "conventional-changelog-conventionalcommits": "^9.1.0",
     "cross-env": "^10.1.0",
     "jsdom": "^27.2.0",
+    "json5": "^2.2.3",
     "prettier": "^3.6.2",
     "semantic-release": "^25.0.2",
     "testcontainers": "^11.8.1",
@@ -60,7 +61,8 @@
   },
   "packageManager": "[email protected]",
   "engines": {
-    "node": ">=24.11.1"
+    "node": ">=24.11.1",
+    "pnpm": ">=10.22.0"
   },
   "pnpm": {
     "onlyBuiltDependencies": [

pnpm-lock.yaml

@@ -2,3 +2,5 @@ packages:
   - apps/*
   - packages/*
   - tooling/*
+
+minimumReleaseAge: 4320 # Only download deps if they are at least 3 days old (in minutes)

pnpm-workspace.yaml

@@ -0,0 +1,23 @@
+import fs from "fs/promises";
+import { join } from "path";
+import json5 from "json5";
+import { describe, test } from "vitest";
+
+describe("Renovate configuration tests", () => {
+  test("automerge should be disabled for onlyBuiltDependencies", async () => {
+    const packageJson = await import("../package.json");
+    const renovateConfig = await fs.readFile(join(__dirname, "../.github/renovate.json5"), "utf-8").then(json5.parse);
+    const onlyBuiltDependencies = packageJson.pnpm.onlyBuiltDependencies;
+    const automergeDisabledDeps = renovateConfig.packageRules
+      .filter((rule: any) => rule.automerge === false)
+      .flatMap((rule: any) => rule.matchPackageNames || []);
+
+    const missingDeps = onlyBuiltDependencies.filter((dep: string) => !automergeDisabledDeps.includes(dep));
+
+    if (missingDeps.length > 0) {
+      throw new Error(
+        `The following onlyBuiltDependencies are missing automerge disable rules in renovate.json5: ${missingDeps.join(", ")}`,
+      );
+    }
+  });
+});