chore(renovate): widen peer ranges and keep pnpm overrides on the dashboard

[CataldoMazzilli]

Why

Renovate opened five PRs in one afternoon (#921, #922, #923, #924, #925). The grouping rules from #901 do work — the Dependency Dashboard holds runtime patches and bundles devDependencies — but they only match dependencies and devDependencies, so updates in any other depType slip straight through.

Two of those PRs are noise, and one kind of them is actively harmful:

• chore(deps): update dependency react-router-dom to ^6.30.6 #921 (react-router-dom ^6.30.0 → ^6.30.6) and chore(deps): update dependency core-js to ^3.50.0 #922 (core-js ^3.39.0 → ^3.50.0) bump peerDependencies ranges. They gain nothing and narrow the range modules are built against: a module resolving react-router-dom 6.30.2 becomes formally incompatible with the shell. The cause is "npm": { "rangeStrategy": "bump" } in the shared zextras/infra-renovate-config:javascript preset, which overrides Renovate's default of widen for peer ranges.
• chore(deps): update dependency conventional-changelog-conventionalcommits to v10 #925 updates a pnpm override, which is a deliberate pin rather than a dependency we track.

What

• peerDependencies → rangeStrategy: "widen". In-range releases stay silent; a new major still opens a PR, but it widens the range (^18.3.1 → ^18.3.1 || ^19.0.0) instead of replacing it, so modules built against the current major keep working.
• pnpm.overrides minor/patch → dependencyDashboardApproval, the same treatment runtime dependencies already get. Majors still open a PR.

Verification

renovate-config-validator passes. Full renovate --platform=local --dry-run=full against main, before and after the change:

• 63 → 58 updates. The five that disappear are all peer-range bumps: core-js, lodash, react-router-dom, @zextras/carbonio-design-system, @zextras/carbonio-ui-preview — the two open PRs plus three that would have landed over the next few days.
• The four peer majors (react, react-dom, react-i18next, react-router-dom) survive, all in widened form.
• vite 7.3.2 → 7.3.6 (override, patch) moves to the dashboard; conventional-changelog-conventionalcommits 9.3.1 → 10.4.0 (override, major) still opens a PR.

Out of scope

• chore(deps): update node.js to v22.23.2 #923 (engines.node) still slips through — same class of gap, left for a follow-up.
• fix(deps): update dependency posthog-js to v1.433.9 #924 (posthog-js) is unrelated to depTypes: its dashboard entry has been open since 3 Sep, before chore(renovate): weekly devDependencies bundle, dashboard approval for runtime minors #901 was merged, so it was never re-evaluated under the approval rule. Closing that PR and deleting its branch makes the next release start from a fresh entry.

#921 and #922 still need to be closed by hand once this lands.

🤖 Generated with Claude Code

[sonarqube-zextras]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• No data about coverage (76.90% Estimated after merge)
• No data about duplications (0.00% Estimated after merge)

Project ID: carbonio-shell-ui

View in SonarQube

[ZxBot]

🎉 This PR is included in version 15.3.7 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀