Context
Surfaced during the multi-angle review of #192 (security pass, H-3).
renovate.json auto-merges patch / pin / digest updates for npm packages. For the docker-compose infra images this was explicitly disabled in #192 (nginx-proxy / acme-companion / watchtower require review). For npm there is no carve-out, so a patch bump of a runtime-critical, behaviour-sensitive package — @modelcontextprotocol/sdk, zod, @fastify/static — would merge with no human in the loop.
A patch release of one of these can still carry a behavioural change (a tightened zod coercion, an MCP SDK wire-format fix) that the unit suite might not fully cover, and it ships straight to main.
Proposal
Add a packageRules entry that holds these for review even on patch:
Open question: scope. Options —
- Just the MCP wire stack +
zod (narrow, recommended).
- All
dependencies (not devDependencies) — broader, more review load.
Alternatively, require the integration suite (not just unit) to pass before any npm auto-merge.
Acceptance
Refs
Context
Surfaced during the multi-angle review of #192 (security pass, H-3).
renovate.jsonauto-mergespatch/pin/digestupdates for npm packages. For the docker-compose infra images this was explicitly disabled in #192 (nginx-proxy / acme-companion / watchtower require review). For npm there is no carve-out, so a patch bump of a runtime-critical, behaviour-sensitive package —@modelcontextprotocol/sdk,zod,@fastify/static— would merge with no human in the loop.A patch release of one of these can still carry a behavioural change (a tightened zod coercion, an MCP SDK wire-format fix) that the unit suite might not fully cover, and it ships straight to
main.Proposal
Add a
packageRulesentry that holds these for review even onpatch:{ "matchPackageNames": ["zod"], "matchPackagePrefixes": ["@modelcontextprotocol/", "@nuxtjs/mcp-toolkit"], "automerge": false }Open question: scope. Options —
zod(narrow, recommended).dependencies(notdevDependencies) — broader, more review load.Alternatively, require the integration suite (not just unit) to pass before any npm auto-merge.
Acceptance
zodopen a PR that waits for reviewRefs