[jaywedgeworth22]

Fixes OPS-1063.
The rules are written to be copied verbatim into any fleet repo's renovate.json; the Zulip post in the OPS-1063 work topic carries the copy-paste block.

Summary

Adds fleet compatibility guards to renovate.json per OPS-1063 and owner rationale dated 2026-11-10. Renovate was proposing TypeScript 7 and Node 26 where toolchains, deployed runtimes, or platforms cannot take them, so this change pins suggestions to installed majors.

Changes

• TypeScript 5.x and older stays on <6 via matchCurrentVersion. Repos already on TypeScript 7, like BotFleet, are exempt.
• TypeScript 6.x stays on <7 until a human opens 7.
• Node 18 through 25 blocks Node 26+ suggestions for docker and nvm managers. Repos already on 26 or newer are exempt.
• @types/node 18 through 25 stays on <26 to track the runtime major.
• Guard descriptions note to copy the rules into any repo where the suggestion cannot land.

Impact

Reduces incompatible major upgrade PR noise across the fleet and requires deliberate human PRs for TypeScript 6 to 7 and Node 25 to 26 moves. Behavior change is configuration-only with no runtime code change.

Open risks / Review findings (unresolved)

• [high] renovate.json:58 – Node guard uses invalid docker manager so Dockerfile updates bypass block.
• [medium] renovate.json:40 – TypeScript <6 guard misses ^/~-prefixed versions.

Testing

No test evidence reported in the provided changes. Guard matching and Renovate evaluation remain unverified.

[linear-code]

OPS-1063

[jaywedgeworth22]

@kody start-review

[kody-ai]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

⚠️ 2 Kody Rule(s) were not evaluated

These rules declare that they need repository context beyond this diff, and the review could not retrieve it, so they were not judged on this pull request:

• Use Zod .strict() on schemas that parse internally-written cache/config files
• Wrap fire-and-forget async calls with .catch backstops

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​

Automatic approval held: The review is not clean.

[kody-ai]

Node guard uses invalid docker manager so Dockerfile updates bypass block

Dockerfile FROM bumps to node:26+ remain unblocked because docker matches no Renovate manager. Change the matchManagers entry to dockerfile.

Prompt for LLM

File renovate.json, lines 58-59:

Node guard uses invalid docker manager so Dockerfile updates bypass block

matchManagers lists docker which is not a Renovate manager, so the Node 26 block never applies to Dockerfile FROM updates. Renovate matches Dockerfile images under manager dockerfile, leaving node:26+ image bumps unguarded contrary to OPS-1063. Change docker to dockerfile in matchManagers.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[kody-ai]

TypeScript <6 guard misses ^/~-prefixed versions

Caret and tilde ranges like ^5.9.2 bypass the <6 cap because matchCurrentVersion tests the raw value verbatim. Allow the optional prefix in the expression or switch to a version constraint.

Also found in:

• renovate.json:48-50

Prompt for LLM

File renovate.json, lines 40-42:

TypeScript <6 guard misses ^/~-prefixed versions

The typescript 0-5 guard at line 41 never matches caret/tilde ranges like ^5.9.2 so the <6 cap fails open to typescript 7. Renovate regex matchCurrentVersion tests the raw value verbatim without stripping ^/~, defeating the OPS-1063 guard on the most common declaration form. Allow the optional prefix, e.g. /^[\^~v]?[0-5]([.!+~-]|$)/ or use a version constraint instead of regex.

**Also found in:**
- `renovate.json:48-50`

Suggested code:

"matchPackageNames": ["typescript"],
"matchCurrentVersion": "/^[~^v]?[0-5]([.!+~-]|$)/",
"allowedVersions": "<6"

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[kody-ai]

Automatic approval held

Kody's assessment:

Renovate automation guard relies on complex matchCurrentVersion/allowedVersions regexes and exemption claims not verified in the diff; human must validate syntax and effect.