admin
24be0b45fd
Replaces the security-flagged `minimumReleaseAge: 0` bypass with a proper datasource swap. Why: ghcr.io OCI manifests for ghcr.io/lukegus/termix don't expose a release timestamp, so Renovate's default `timestamp-required` mode holds updates indefinitely. The previous fix (zeroing the gate) was flagged as a supply-chain control regression -- correctly, since it weakens the stability protection for that package. Cleaner fix: point Renovate's version lookup at the upstream GitHub Releases (Termix-SSH/Termix per the OCI source label) where timestamps ARE published. The 3-day gate then works for termix the same way it works for other packages with intact timestamps. Renovate still updates the same image -- the manager extracts ghcr.io/lukegus/termix from termix.yaml and writes the new tag back; only the version-source lookup is redirected. The ghcr.io registry hosts every release-X.Y.Z tag (verified release-2.3.2 present), so the writeback target stays valid. Major bumps (1.x -> 2.x) continue to queue for dashboard approval via the global major rule. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>