chore: Configure Renovate by renovate[bot] · Pull Request #1 · apify/n8n-nodes-apify

renovate · 2026-03-31T14:36:32Z

Welcome to Renovate! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.

📚 See our Reading List for relevant documentation you may be interested in reading.

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to renovate.json in this branch. Renovate will update the Pull Request description the next time it runs.

Detected Package Files

.github/workflows/ci.yml (github-actions)
.github/workflows/claude-md-maintenance.yml (github-actions)
.github/workflows/publish.yml (github-actions)
package.json (npm)

Configuration Summary

Based on the default config's presets, Renovate will:

Start dependency updates only once this onboarding PR is merged
Hopefully safe environment variables to allow users to configure.
Show all Merge Confidence badges for pull requests.
Enable Renovate Dependency Dashboard creation.
Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
Group known monorepo packages together.
Use curated list of recommended non-monorepo package groupings.
Show only the Age and Confidence Merge Confidence badges for pull requests.
Apply crowd-sourced package replacement rules.
Apply crowd-sourced workarounds for known problems with packages.
Ensure that every dependency pinned by digest and sourced from Forgejo contains a link to the commit-to-commit diff
Ensure that every dependency pinned by digest and sourced from Gitea contains a link to the commit-to-commit diff
Ensure that every dependency pinned by digest and sourced from GitHub.com and Github enterprise contains a link to the commit-to-commit diff
Ensure that every dependency pinned by digest and sourced from GitLab.com contains a link to the commit-to-commit diff
Correctly link to the source code for golang.org/x packages
Link to pkg.go.dev/... for golang.org/x packages' title
Provide a link to octochangelog's improved breakdown for Renovate's changelogs
If Renovate detects semantic commits, it will use semantic commit type chore for all commits.
Run Renovate on following schedule: * * * * 3

What to Expect

With your current configuration, Renovate will create 10 Pull Requests, up to a maximum of 13 over time (see docs for prConcurrentLimit):

chore(deps): update dependency @types/node to v24.13.3

Schedule: ["* * * * 3"]
Branch name: renovate/node-24.x-lockfile
Merge into: master
Upgrade @types/node to 24.13.3

chore(deps): update dependency eslint to v9.39.5

Schedule: ["* * * * 3"]
Branch name: renovate/eslint-monorepo
Merge into: master
Upgrade eslint to 9.39.5

chore(deps): update dependency nock to v14.0.17

Schedule: ["* * * * 3"]
Branch name: renovate/nock-14.x-lockfile
Merge into: master
Upgrade nock to 14.0.17

chore(deps): update dependency prettier to v3.9.6

Schedule: ["* * * * 3"]
Branch name: renovate/prettier-3.x-lockfile
Merge into: master
Upgrade prettier to 3.9.6

chore(deps): update dependency ts-jest to v29.4.12

Schedule: ["* * * * 3"]
Branch name: renovate/ts-jest-29.x-lockfile
Merge into: master
Upgrade ts-jest to 29.4.12

chore(deps): update apify/actions action to v1.4.1

Schedule: ["* * * * 3"]
Branch name: renovate/apify-actions-1.x
Merge into: master
Upgrade apify/actions to v1.4.1

chore(deps): update dependency @n8n/node-cli to ^0.45.0

Schedule: ["* * * * 3"]
Branch name: renovate/n8n-node-cli-0.x
Merge into: master
Upgrade @n8n/node-cli to ^0.45.0

chore(deps): update actions/checkout action to v7

Schedule: ["* * * * 3"]
Branch name: renovate/actions-checkout-7.x
Merge into: master
Upgrade actions/checkout to v7

chore(deps): update actions/setup-node action to v7

Schedule: ["* * * * 3"]
Branch name: renovate/actions-setup-node-7.x
Merge into: master
Upgrade actions/setup-node to v7

chore(deps): update dependency eslint to v10

Schedule: ["* * * * 3"]
Branch name: renovate/major-eslint-monorepo
Merge into: master
Upgrade eslint to ^10.0.0

chore(deps): update dependency typescript to v7

Schedule: ["* * * * 3"]
Branch name: renovate/typescript-7.x
Merge into: master
Upgrade typescript to ^7.0.0

chore(deps): update npm to v12

Schedule: ["* * * * 3"]
Branch name: renovate/npm-12.x
Merge into: master
Upgrade npm to 12.0.2

chore(deps): lock file maintenance

Schedule: ["* * * * 3"]
Branch name: renovate/lock-file-maintenance
Merge into: master
Regenerate lock files to use latest dependency versions

🚸 PR creation will be limited to maximum 2 per hour, so it doesn't swamp any CI resources or overwhelm the project. See docs for prHourlyLimit for details.

❓ Got questions? Check out Renovate's Docs, particularly the Getting Started section.
If you need any further assistance then you can also request help here.

This PR was generated by Mend Renovate. View the repository job log.

Renovate governs what enters package-lock.json, and npm ci installs from the lockfile without applying min-release-age. So the .npmrc cooldown added in #51 only covers local resolution -- this is what gates the versions that actually ship. Matches the 1-day cooldown already set in .npmrc. Refs #12 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

drobnikj

I guess this is just kick off of the renovate flow, but the main issue is to correctly set the renovate config with all settings. There is for example one for Apify proxy https://github.com/apify/apify-proxy/blob/develop/renovate.json5
Let's draft one for n8n and we could discuss in PR.

drobnikj · 2026-08-19T08:17:38Z

+  "extends": [
+    "config:recommended"
+  ],
+  "minimumReleaseAge": "1 day"


Suggestion: A one-day quarantine is short for a supply-chain guard — most compromised npm releases are caught over several days, not hours. Consider 3-5 days, which still keeps updates timely.

I agree. I changed it to 3 days. Btw if I am not wrong, most of apify repos has min release age setup to 1 day though

Switch renovate.json -> renovate.json5 (supported filename) so the non-obvious parts can carry comments. Verified against the Renovate 44 docs and source: - minimumReleaseAgeBehaviour defaults to `timestamp-required`, so update types Renovate cannot timestamp (lockFileMaintenance, bump, lockfileUpdate, rollback, pin, replacement) would be held back indefinitely by a blanket cooldown. Carve them out, mirroring Renovate's own security:minimumReleaseAge* presets. - Enable lockFileMaintenance: Renovate passes `--before=<now - cooldown>` to npm, but an existing lock file with newer packages makes npm fail ETARGET and Renovate retries without it. Regenerating the lock file is what makes the cooldown reach transitive dependencies. - Disable updates to `engines`: node/npm entries there are consumer-facing minimums, not versions to track. - Add :semanticCommitTypeAll(chore) so dependency bumps are not labelled `fix:` by config:recommended's :semanticPrefixFixDepsChoreOthers. Left out deliberately: vulnerabilityAlerts.minimumReleaseAge=null (already the default; security updates bypass the cooldown) and prCreation (no longer recommended as of Renovate 42.19.9). Config validated with renovate-config-validator --strict (44.35.1). Refs #12 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

- Drop packageRules; trim comments to one-liners. - Raise minimumReleaseAge (and .npmrc's min-release-age) from 1 to 3 days, matching Renovate's own security:minimumReleaseAgeNpm preset. Three days clears npm's 72-hour unpublish window, so a version cannot vanish from the registry after it has been installed. - Label dependency PRs t-integration/dependencies. - Enable weekly lockFileMaintenance, which is what extends the cooldown to transitive dependencies: npm applies min-release-age from .npmrc when it rebuilds the lock file. Config validated with renovate-config-validator --strict (44.35.1). Refs #12 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

FilipMasar · 2026-08-19T21:54:34Z

I guess this is just kick off of the renovate flow, but the main issue is to correctly set the renovate config with all settings. There is for example one for Apify proxy https://github.com/apify/apify-proxy/blob/develop/renovate.json5 Let's draft one for n8n and we could discuss in PR.

Yeah, my plan was to keep it simple and merge it asap to fix the vulnerabilities. I dig deeper and added some more config. There are way more options, but I would not add those right now (like automerge, grouping, etc...). I would wait for some PRs and then adjust it. What do you think?

Replace the deprecated later.js `every weekday` schedule with cron `* * * * 3`, and pin lockFileMaintenance to the same slot so it no longer uses its built-in `before 4am on monday` default. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Co-authored-by: Jakub Drobník <drobnik.j@gmail.com>

Add renovate.json

e9a75bc

renovate Bot force-pushed the renovate/configure branch from ca5e56e to e9a75bc Compare March 31, 2026 14:40

FilipMasar and others added 2 commits August 18, 2026 14:30

Merge remote-tracking branch 'origin/master' into renovate/configure

58aaed1

FilipMasar requested review from FilipMasar, JanHranicky and drobnikj August 18, 2026 12:34

FilipMasar linked an issue Aug 18, 2026 that may be closed by this pull request

n8n: Configure Renovate in apify/n8n-nodes-apify #12

Closed

drobnikj approved these changes Aug 19, 2026

View reviewed changes

FilipMasar and others added 2 commits August 19, 2026 23:07

FilipMasar requested a review from drobnikj August 19, 2026 21:55

JanHranicky approved these changes Aug 20, 2026

View reviewed changes

FilipMasar removed their request for review August 24, 2026 10:49

drobnikj approved these changes Aug 25, 2026

View reviewed changes

Comment thread renovate.json5 Outdated

Comment thread renovate.json5 Outdated

FilipMasar and others added 3 commits August 25, 2026 11:34

Apply suggestion from @drobnikj

b32adbe

Co-authored-by: Jakub Drobník <drobnik.j@gmail.com>

remove comments, fix formating

a508157

FilipMasar merged commit 28c613a into master Aug 25, 2026
2 checks passed

FilipMasar deleted the renovate/configure branch August 25, 2026 11:43

Navigation Menu

Uh oh!

chore: Configure Renovate - #1

chore: Configure Renovate#1
FilipMasar merged 8 commits into
masterfrom
renovate/configure

renovate Bot commented Mar 31, 2026 •

edited

Loading

Uh oh!

drobnikj left a comment

Uh oh!

drobnikj Aug 19, 2026

Uh oh!

FilipMasar Aug 19, 2026

Uh oh!

FilipMasar commented Aug 19, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

renovate Bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Detected Package Files

Configuration Summary

What to Expect

Uh oh!

drobnikj left a comment

Choose a reason for hiding this comment

Uh oh!

drobnikj Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

FilipMasar Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

FilipMasar commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

renovate Bot commented Mar 31, 2026 •

edited

Loading

FilipMasar commented Aug 19, 2026 •

edited

Loading