Location: repo root — no renovate.json, .renovaterc, or dependabot.yml
Problem
Dependency updates happen only when someone runs npm audit by hand. That is why #24 lists eleven advisories spanning several months of patch releases (react-router-dom 7.15.1 → 7.18.3, katex 0.16.11 → 0.16.47, sanitize-html 2.17.4 → 2.17.5). It also means matrix-js-sdk and the @lotusguild/element-call-embedded fork drift silently.
Suggested fix
Gitea supports Renovate via the self-hosted renovate/renovate image on a cron (there are community Gitea Actions for it). Configure it with: extends: ["config:recommended"], security updates grouped and auto-PR'd, matrix-js-sdk and @lotusguild/* as separate groups with manual review, and a weekly schedule so the shared runner isn't flooded. Pair with the audit-gate issue so security PRs are visibly prioritised.
Filed from the September 2026 client audit (CI pipeline review, branch lotus @ 4bea4895).
**Location:** repo root — no `renovate.json`, `.renovaterc`, or `dependabot.yml`
### Problem
Dependency updates happen only when someone runs `npm audit` by hand. That is why #24 lists eleven advisories spanning several months of patch releases (react-router-dom 7.15.1 → 7.18.3, katex 0.16.11 → 0.16.47, sanitize-html 2.17.4 → 2.17.5). It also means matrix-js-sdk and the `@lotusguild/element-call-embedded` fork drift silently.
### Suggested fix
Gitea supports Renovate via the self-hosted `renovate/renovate` image on a cron (there are community Gitea Actions for it). Configure it with: `extends: ["config:recommended"]`, security updates grouped and auto-PR'd, `matrix-js-sdk` and `@lotusguild/*` as separate groups with manual review, and a weekly schedule so the shared runner isn't flooded. Pair with the audit-gate issue so security PRs are visibly prioritised.
---
_Filed from the September 2026 client audit (CI pipeline review, branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:57:44 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Location: repo root — no
renovate.json,.renovaterc, ordependabot.ymlProblem
Dependency updates happen only when someone runs
npm auditby hand. That is why #24 lists eleven advisories spanning several months of patch releases (react-router-dom 7.15.1 → 7.18.3, katex 0.16.11 → 0.16.47, sanitize-html 2.17.4 → 2.17.5). It also means matrix-js-sdk and the@lotusguild/element-call-embeddedfork drift silently.Suggested fix
Gitea supports Renovate via the self-hosted
renovate/renovateimage on a cron (there are community Gitea Actions for it). Configure it with:extends: ["config:recommended"], security updates grouped and auto-PR'd,matrix-js-sdkand@lotusguild/*as separate groups with manual review, and a weekly schedule so the shared runner isn't flooded. Pair with the audit-gate issue so security PRs are visibly prioritised.Filed from the September 2026 client audit (CI pipeline review, branch
lotus@4bea4895).