chore: harden npm supply chain (pnpm 11 + min-release-age + renovate)

.github/renovate.json

@@ -1,48 +1,74 @@
 {
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:base",
+    "config:recommended",
     ":semanticCommitTypeAll(chore)",
-    ":rebaseStalePrs"
+    ":rebaseStalePrs",
+    ":dependencyDashboard",
+    "security:openssf-scorecard"
   ],
+  "timezone": "Europe/Berlin",
   "schedule": ["before 4am on Monday"],
+  "prConcurrentLimit": 5,
+  "prHourlyLimit": 2,
+  "rangeStrategy": "bump",
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": ["before 4am on Monday"]
+  },
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "labels": ["security"],
+    "schedule": [],
+    "minimumReleaseAge": null,
+    "prPriority": 10
+  },
+  "osvVulnerabilityAlerts": true,
   "packageRules": [
     {
+      "description": "Wait 7 days before suggesting any npm update (matches .npmrc minimum-release-age)",
       "matchDatasources": ["npm"],
-      "minimumReleaseAge": "3 days"
+      "minimumReleaseAge": "7 days"
     },
     {
-      "matchPackagePatterns": ["eslint"],
+      "description": "Group eslint packages",
+      "matchPackageNames": ["/eslint/"],
       "groupName": "eslint"
     },
     {
-      "matchPackagePatterns": ["jest", "testing-library", "swc"],
+      "description": "Group testing packages",
+      "matchPackageNames": ["/jest/", "/testing-library/", "/swc/", "/vitest/"],
       "groupName": "testing"
     },
     {
-      "matchPackagePatterns": ["postcss", "tailwind"],
+      "description": "Group tailwind/postcss",
+      "matchPackageNames": ["/postcss/", "/tailwind/"],
       "groupName": "tailwind"
     },
     {
-      "matchPackagePatterns": [
-        "@marigold/components",
-        "@marigold/system",
-        "@marigold/theme-core",
-        "@marigold/icons",
-        "@marigold/eslint-config",
-        "@marigold/prettier-config"
-      ],
+      "description": "Group marigold packages",
+      "matchPackageNames": ["/^@marigold//"],
       "groupName": "marigold"
     },
     {
-      "packageRules": [
-        {
-          "description": "Automerge non-major updates",
-          "matchUpdateTypes": ["minor", "patch"],
-          "matchCurrentVersion": "!/^0/",
-          "automerge": true
-        }
-      ]
+      "description": "Automerge non-major updates of stable (>=1.0) packages",
+      "matchUpdateTypes": ["minor", "patch"],
+      "matchCurrentVersion": "!/^0/",
+      "automerge": true,
+      "automergeType": "pr",
+      "platformAutomerge": true
+    },
+    {
+      "description": "Never automerge major updates; require manual review and extra release-age",
+      "matchUpdateTypes": ["major"],
+      "automerge": false,
+      "labels": ["major-update"],
+      "minimumReleaseAge": "14 days"
+    },
+    {
+      "description": "Pin GitHub Actions to commit SHAs to mitigate supply-chain risk",
+      "matchManagers": ["github-actions"],
+      "pinDigests": true
     }
-  ],
-  "timezone": "Europe/Berlin"
+  ]
 }

.node-version

@@ -1 +1 @@
-20
+22

.npmrc

@@ -1 +1,2 @@
-package-manager-strict=false
+package-manager-strict=false
+minimum-release-age=10080

package.json

@@ -15,7 +15,10 @@
     "test:watch": "vitest watch --config vite.config.ts",
     "test:ci": "vitest run --config vite.config.ts --coverage"
   },
-  "packageManager": "pnpm@9.15.9",
+  "packageManager": "pnpm@11.1.2",
+  "engines": {
+    "node": ">=22.13"
+  },
   "dependencies": {
     "@code-hike/mdx": "0.9.0",
     "@marigold/components": "11.3.0",