Renovate Selective Updates POC

This repository demonstrates using Renovate to perform selective package updates targeting CVE-fixed versions, instead of updating everything to latest.

What this repo contains

• package.json with an intentionally vulnerable version of lodash (4.17.19). Renovate should propose updating only to >= 4.17.21 < 5.
• Dockerfile pinned to alpine:3.19.0. Renovate should propose updating only to the 3.20.x line.
• renovate.json configuration that:
  • Disables all updates by default
  • Enables only selected security-related updates with allowedVersions
  • Labels these PRs with security and cve-fix

Expected behavior

• Renovate opens a PR to update lodash from 4.17.19 to a fixed patch in the 4.x line (>=4.17.21 <5).
• Renovate opens a PR to update the Docker base image from alpine:3.19.0 to the latest 3.20.x tag.
• No other dependencies should be updated.