🐛 ci(renovate): fix OOM crash and stop using Mend's default gitAuthor

The 2026-07-03 runs surfaced two config problems:

- The grouped "renovate/all" branch made Renovate fetch and hold the
  changelog of every upgrade instance separately (Traefik v3.0.0->v3.7.6
  was fetched ~10x, once per compose file), which blew the default 4GB
  V8 heap: "FATAL ERROR: ... JavaScript heap out of memory" (exit 134),
  killing the run after the branch was pushed but before the PR was
  opened. Disable changelog fetching (release notes were truncated in
  the grouped PR body anyway) and raise the Node heap to 8GB as a
  safety net.

- No gitAuthor was set, so commits were authored as Mend's
  renovate@whitesourcesoftware.com, which GitHub flags "Unverified"
  (Vigilant Mode) and Renovate warns about on every run. Use the token
  owner's noreply address instead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/dependabot.yml

@@ -1,24 +0,0 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
-version: 2
-updates:
-  # Maintain dependencies for Go
-  - package-ecosystem: "gomod"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Maintain dependencies for build tools
-  - package-ecosystem: "gomod"
-    directory: "/tools"
-    schedule:
-      interval: "weekly"
-
-  # Maintain dependencies for GitHub Actions
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"

.github/workflows/main.yml

@@ -15,8 +15,13 @@ jobs:
     name: Main Process
     runs-on: ubuntu-latest
     env:
-      GO_VERSION: 1.23
+      # Keep in sync with go.mod. Capped at 1.22 because the plugin is run by
+      # yaegi (bundled in Traefik) and even Traefik v3.7.1 ships yaegi v0.16.1,
+      # which only supports Go 1.22. Building on the floor makes go build / go
+      # test reject newer stdlib before yaegi_test does.
+      GO_VERSION: 1.22
       GOLANGCI_LINT_VERSION: v1.63.4
+      # yaegi_test guard — pin to the version current Traefik bundles.
       YAEGI_VERSION: v0.16.1
       CGO_ENABLED: 0
     defaults:

.github/workflows/renovate.yml

@@ -0,0 +1,41 @@
+name: Renovate
+
+# Self-hosted Renovate: opens dependency-update PRs on a weekly schedule.
+# Config lives in /renovate.json. Requires a repo/org secret RENOVATE_TOKEN
+# (a PAT with `repo` + `workflow` scope, or a fine-grained token with
+# contents:write + pull-requests:write) so Renovate can push branches and open
+# PRs. Trigger manually from the Actions tab via "Run workflow" to test.
+
+on:
+  schedule:
+    - cron: "0 4 * * 1" # every Monday at 04:00 UTC
+  workflow_dispatch:
+    inputs:
+      logLevel:
+        description: "Renovate log level"
+        required: false
+        default: "info"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: renovate
+  cancel-in-progress: false
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run Renovate
+        uses: renovatebot/github-action@v46.1.14
+        with:
+          token: ${{ secrets.RENOVATE_TOKEN }}
+        env:
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+          RENOVATE_ONBOARDING: "false"
+          RENOVATE_REQUIRE_CONFIG: "required"
+          # The grouped "all" branch holds many upgrades; changelog/PR-body
+          # rendering for it blew the default 4GB V8 heap (exit 134 OOM).
+          NODE_OPTIONS: "--max-old-space-size=8192"
+          LOG_LEVEL: ${{ github.event.inputs.logLevel || 'info' }}

examples/appsec-enabled/docker-compose.yml

@@ -47,7 +47,7 @@ services:
       - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecappsechost=crowdsec:7422"
 
   crowdsec:
-    image: crowdsecurity/crowdsec:v1.6.1-2
+    image: crowdsecurity/crowdsec:v1.6.8
     container_name: "crowdsec"
     restart: unless-stopped
     environment:

examples/behind-proxy/docker-compose.yml

@@ -79,7 +79,7 @@ services:
   
 
   crowdsec:
-    image: crowdsecurity/crowdsec:v1.6.1-2
+    image: crowdsecurity/crowdsec:v1.6.8
     container_name: "crowdsec"
     restart: unless-stopped
     environment:

examples/captcha/README.md

@@ -52,7 +52,7 @@ More information is available on configuring Crowdsec in the [official documenta
 ```yaml
   ...
   crowdsec:
-    image: crowdsecurity/crowdsec:v1.6.1-2
+    image: crowdsecurity/crowdsec:v1.6.8
     volumes:
       # For captcha and ban mixed decision
       - './profiles.yaml:/etc/crowdsec/profiles.yaml:ro' 

examples/captcha/docker-compose.yml

@@ -55,7 +55,7 @@ services:
       - "traefik.http.middlewares.crowdsec.plugin.bouncer.captchaHTMLFilePath=/captcha.html"
 
   crowdsec:
-    image: crowdsecurity/crowdsec:v1.6.1-2
+    image: crowdsecurity/crowdsec:v1.6.8
     container_name: "crowdsec"
     restart: unless-stopped
     environment:

examples/custom-ban-page/docker-compose.yml

@@ -46,7 +46,7 @@ services:
       - "traefik.http.middlewares.crowdsec.plugin.bouncer.banFilePath=/ban.html"
 
   crowdsec:
-    image: crowdsecurity/crowdsec:v1.6.1-2
+    image: crowdsecurity/crowdsec:v1.6.8
     container_name: "crowdsec"
     restart: unless-stopped
     environment:

examples/custom-captcha/docker-compose.yml

@@ -59,7 +59,7 @@ services:
       - "traefik.http.middlewares.crowdsec.plugin.bouncer.captchaHTMLFilePath=/captcha.html"
 
   crowdsec:
-    image: crowdsecurity/crowdsec:v1.6.1-2
+    image: crowdsecurity/crowdsec:v1.6.8
     container_name: "crowdsec"
     restart: unless-stopped
     environment:

examples/redis-cache/docker-compose.yml

@@ -71,7 +71,7 @@ services:
 
 
   crowdsec:
-    image: crowdsecurity/crowdsec:v1.6.1-2
+    image: crowdsecurity/crowdsec:v1.6.8
     container_name: "crowdsec"
     restart: unless-stopped
     environment:
@@ -87,7 +87,7 @@ services:
       - "traefik.enable=false"
 
   redis-secure:
-    image: "redis:7.0.12-alpine"
+    image: "redis:8.8.0-alpine"
     container_name: "redis-secure"
     hostname: redis-secure
     restart: unless-stopped

examples/tls-auth/Dockerfile

@@ -1,4 +1,4 @@
-FROM ubuntu:24.04
+FROM ubuntu:26.04
 
 RUN apt-get update && apt-get install -y curl wget
 RUN VERSION=$(curl --silent "https://api.github.com/repos/cloudflare/cfssl/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/') && VNUMBER=${VERSION#"v"} && wget https://github.com/cloudflare/cfssl/releases/download/${VERSION}/cfssl_${VNUMBER}_linux_amd64 -O cfssl && chmod +x cfssl && mv cfssl /usr/local/bin

examples/tls-auth/docker-compose.yml

@@ -71,7 +71,7 @@ services:
       # Define AppSec host and port informations
       - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecappsechost=crowdsec:7422"
   crowdsec:
-    image: crowdsecurity/crowdsec:latest
+    image: crowdsecurity/crowdsec:v1.6.8
     container_name: "crowdsec"
     restart: unless-stopped
     environment:

examples/trusted-ips/docker-compose.yml

@@ -65,7 +65,7 @@ services:
 
 
   crowdsec:
-    image: crowdsecurity/crowdsec:v1.6.1-2
+    image: crowdsecurity/crowdsec:v1.6.8
     container_name: "crowdsec"
     restart: unless-stopped
     environment:

renovate.json

@@ -0,0 +1,77 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "gitAuthor": "Renovate Bot <22881669+maxlerebourg@users.noreply.github.com>",
+  "fetchChangeLogs": "off",
+  "labels": ["dependencies"],
+  "ignorePaths": ["**/vendor/**", "**/node_modules/**"],
+  "rangeStrategy": "bump",
+  "prConcurrentLimit": 1,
+  "branchPrefix": "renovate/",
+  "commitMessagePrefix": "⬆️ renovate: ",
+  "groupName": "all",
+  "dependencyDashboard": false,
+  "packageRules": [
+    {
+      "description": "Cap the Go version at what yaegi supports. The plugin is interpreted by yaegi (bundled in Traefik), and even Traefik v3.7.1 ships yaegi v0.16.1 = Go 1.22. A newer Go would break the plugin on every current Traefik. Raise this only once Traefik ships a yaegi supporting a newer Go.",
+      "matchManagers": ["gomod"],
+      "matchDepNames": ["go", "toolchain"],
+      "allowedVersions": "<1.23"
+    },
+    {
+      "description": "whoami is a throwaway demo backend; leave it on latest",
+      "matchPackageNames": ["traefik/whoami"],
+      "enabled": false
+    }
+  ],
+  "customManagers": [
+    {
+      "description": "Plugin self-pin in docker-compose CLI args (--experimental.plugins.bouncer.version=vX)",
+      "customType": "regex",
+      "managerFilePatterns": ["/(^|/)docker-compose[^/]*\\.ya?ml$/"],
+      "matchStrings": [
+        "experimental\\.plugins\\.bouncer\\.version=(?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+)"
+      ],
+      "depNameTemplate": "maxlerebourg/crowdsec-bouncer-traefik-plugin",
+      "datasourceTemplate": "github-tags"
+    },
+    {
+      "description": "Plugin self-pin in the Traefik Helm values (version: \"vX\")",
+      "customType": "regex",
+      "managerFilePatterns": ["/^examples/kubernetes/traefik/values\\.ya?ml$/"],
+      "matchStrings": [
+        "version:\\s*\"(?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+)\""
+      ],
+      "depNameTemplate": "maxlerebourg/crowdsec-bouncer-traefik-plugin",
+      "datasourceTemplate": "github-tags"
+    },
+    {
+      "description": "Traefik image tag in the Traefik Helm values (no repository key, so match by file)",
+      "customType": "regex",
+      "managerFilePatterns": ["/^examples/kubernetes/traefik/values\\.ya?ml$/"],
+      "matchStrings": ["tag:\\s*(?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+)"],
+      "depNameTemplate": "traefik",
+      "datasourceTemplate": "docker"
+    },
+    {
+      "description": "Crowdsec image tag in the Crowdsec Helm values (no repository key, so match by file)",
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^examples/kubernetes/crowdsec/values\\.ya?ml$/"
+      ],
+      "matchStrings": ["tag:\\s*(?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+)"],
+      "depNameTemplate": "crowdsecurity/crowdsec",
+      "datasourceTemplate": "docker"
+    },
+    {
+      "description": "Pinned Traefik binary in the e2e mock suite (TRAEFIK_VERSION:-vX in common.sh)",
+      "customType": "regex",
+      "managerFilePatterns": ["/^tests/e2e/mock/lib/common\\.sh$/"],
+      "matchStrings": [
+        "TRAEFIK_VERSION:-(?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+)"
+      ],
+      "depNameTemplate": "traefik/traefik",
+      "datasourceTemplate": "github-releases"
+    }
+  ]
+}