Enable Renovate lockFileMaintenance to remediate transitive CVEs

[dunningdan]

Problem

51 open Dependabot alerts on this repo, all transitive (present only in yarn.lock, nothing in package.json). Renovate has never touched them, and wasn't going to.

Renovate's vulnerabilityAlerts only opens PRs for dependencies it manages — direct deps. Dependency Dashboard #68 confirms this: under "Detected Dependencies → npm → package.json" it lists 15 packages, and not one of the 51 vulnerable ones is among them. The transitiveRemediation option that used to cover this case has been removed from Renovate (discussion); maintainers point to lockFileMaintenance instead.

Change

Enables lockFileMaintenance, which deletes the lock file and regenerates it, letting transitive deps float up to the newest version their parents' ranges already permit. It is schedule-driven, not triggered by new releases — so it will pick up the existing 7-week backlog on its first run.

Also unsets prHourlyLimit inside vulnerabilityAlerts. Security PRs are exempt from schedule and prConcurrentLimit by default, but not from the hourly limit, so the repo-level cap of 2 was silently throttling them.

Verification

Simulated locally exactly as Renovate does it (rm yarn.lock && yarn install, Node 24.20.0):

• package.json unchanged ✅
• 42 of 51 alerts cleared, including Add open pixee dcs #162 websocket-driver — CVE-2026-54466, critical (CVSS 9.2) → 0.7.5
• yarn build passes, 59 documents processed ✅

What this does not fix

9 alerts survive, because re-resolution provably cannot reach them:

Alerts	Package	Why
#163–166	minimatch, yaml	parents pin exact versions (9.0.3, 2.8.1)
#77, #95, #96	serialize-javascript, uuid	fix requires a major bump the parent's range disallows
#186, #187	image-size	no patched version exists upstream

The first two rows need resolutions overrides in package.json — a follow-up PR. image-size needs a documented risk acceptance (build-time only, reached via @docusaurus/mdx-loader, DoS on malformed .icns, no untrusted image input path).

Follow-ups

• Restore lockFileMaintenance.schedule to before 8am on monday (temporarily at any time here to force the catch-up run)
• Add resolutions for minimatch / yaml / serialize-javascript / uuid (verified locally: clears 7 more, build + dev server both green)
• Risk-accept image-size ISS-924 Add Dependency FAQ #186/Docs refactor and updates #187

🤖 Generated with Claude Code