vig-os · vig-os-release-app · Apr 29, 2026 · Apr 10, 2026 · Apr 11, 2026 · Apr 14, 2026
diff --git a/.devcontainer/CHANGELOG.md b/.devcontainer/CHANGELOG.md
@@ -5,6 +5,25 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.4](https://github.com/vig-os/devcontainer/releases/tag/0.3.4) - 2026-04-29
+
+### Added
+
+- **Renovate config validation on pull requests** ([#520](https://github.com/vig-os/devcontainer/issues/520))
+  - Workflow discovers tracked `renovate*.json` files (excluding `assets/workspace/renovate.json`, whose `extends` uses an unresolved template placeholder) and runs `renovate-config-validator --strict` on the rest when renovate JSON changes
+  - `just test-renovate` recipe mirrors the workflow locally and is included in `just test`
+
+### Changed
+
+- **Bump expected tool versions in image tests**
+  - `gh` 2.89 → 2.92, `just` 1.49 → 1.50, `cargo-binstall` 1.17 → 1.18 to match the latest upstream releases the image now installs
+
+### Fixed
+
+- **Renovate preset blocked all dependency updates** ([#520](https://github.com/vig-os/devcontainer/issues/520))
+  - Split Python `packageRules` so `matchUpdateTypes` and `rangeStrategy` are not combined in one rule; rename `baseBranches` to `baseBranchPatterns`
+  - Remove invalid `uv` from `enabledManagers` (`pep621` continues to handle `pyproject.toml` and `uv.lock`)
+
 ## [0.3.3](https://github.com/vig-os/devcontainer/releases/tag/0.3.3) - 2026-04-10
 
 ### Added
@@ -41,6 +60,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Promote-release draft release validation** ([#507](https://github.com/vig-os/devcontainer/issues/507))
   - Use the paginated releases list API with jq instead of `GET /releases/tags/{tag}`, which returns 404 for draft releases
   - Apply the same release lookup for RC git tag cleanup in upstream and workspace `promote-release.yml`
+- **Promote-release validate job cannot see draft releases** ([#517](https://github.com/vig-os/devcontainer/issues/517))
+  - Elevate `validate` job permissions to `contents: write` so the token has push-level access required by the GitHub API to list draft releases
+  - Use `github.token` instead of the release app token for the draft release check in workspace `promote-release.yml`
 
 ### Security
 

diff --git a/.github/renovate-default.json b/.github/renovate-default.json
@@ -3,7 +3,7 @@
   "extends": ["config:recommended"],
   "timezone": "Etc/UTC",
   "schedule": ["before 9am on monday"],
-  "baseBranches": ["dev"],
+  "baseBranchPatterns": ["dev"],
   "rebaseWhen": "conflicted",
   "gitIgnoredAuthors": ["41898282+github-actions[bot]@users.noreply.github.com"],
   "packageRules": [
@@ -23,21 +23,17 @@
       "semanticCommitScope": "actions"
     },
     {
-      "description": "Python (PEP 621 + uv) — pin ranges, group minor/patch",
-      "matchManagers": ["pep621", "uv"],
-      "matchUpdateTypes": ["minor", "patch"],
-      "groupName": "python (minor and patch)",
+      "description": "Python (PEP 621) — always pin ranges",
+      "matchManagers": ["pep621"],
       "rangeStrategy": "pin",
       "semanticCommitType": "build",
       "semanticCommitScope": "pip"
     },
     {
-      "description": "Python — major updates stay separate",
-      "matchManagers": ["pep621", "uv"],
-      "matchUpdateTypes": ["major"],
-      "rangeStrategy": "pin",
-      "semanticCommitType": "build",
-      "semanticCommitScope": "pip"
+      "description": "Python — group minor/patch",
+      "matchManagers": ["pep621"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "python (minor and patch)"
     },
     {
       "description": "npm",

diff --git a/.github/workflows/promote-release.yml b/.github/workflows/promote-release.yml
@@ -53,7 +53,7 @@ jobs:
     outputs:
       version: ${{ steps.vars.outputs.version }}
     permissions:
-      contents: read
+      contents: write
       pull-requests: read
     defaults:
       run:
@@ -87,7 +87,7 @@ jobs:
 
       - name: Verify draft GitHub Release exists
         env:
-          GH_TOKEN: ${{ steps.release_app_token.outputs.token }}
+          GH_TOKEN: ${{ github.token }}
           VERSION: ${{ steps.vars.outputs.version }}
         run: |
           set -euo pipefail

diff --git a/.vig-os b/.vig-os
@@ -1,2 +1,2 @@
 # vig-os devcontainer configuration
-DEVCONTAINER_VERSION=0.3.3
+DEVCONTAINER_VERSION=0.3.4
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,7 +5,26 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [0.3.3](https://github.com/vig-os/devcontainer-smoke-test/releases/tag/0.3.3) - 2026-04-10
+## [0.3.4](https://github.com/vig-os/devcontainer-smoke-test/releases/tag/0.3.4) - 2026-04-29
+
+### Added
+
+- **Renovate config validation on pull requests** ([#520](https://github.com/vig-os/devcontainer/issues/520))
+  - Workflow discovers tracked `renovate*.json` files (excluding `assets/workspace/renovate.json`, whose `extends` uses an unresolved template placeholder) and runs `renovate-config-validator --strict` on the rest when renovate JSON changes
+  - `just test-renovate` recipe mirrors the workflow locally and is included in `just test`
+
+### Changed
+
+- **Bump expected tool versions in image tests**
+  - `gh` 2.89 → 2.92, `just` 1.49 → 1.50, `cargo-binstall` 1.17 → 1.18 to match the latest upstream releases the image now installs
+
+### Fixed
+
+- **Renovate preset blocked all dependency updates** ([#520](https://github.com/vig-os/devcontainer/issues/520))
+  - Split Python `packageRules` so `matchUpdateTypes` and `rangeStrategy` are not combined in one rule; rename `baseBranches` to `baseBranchPatterns`
+  - Remove invalid `uv` from `enabledManagers` (`pep621` continues to handle `pyproject.toml` and `uv.lock`)
+
+## [0.3.3](https://github.com/vig-os/devcontainer/releases/tag/0.3.3) - 2026-04-10
 
 ### Added
 
@@ -41,6 +60,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Promote-release draft release validation** ([#507](https://github.com/vig-os/devcontainer/issues/507))
   - Use the paginated releases list API with jq instead of `GET /releases/tags/{tag}`, which returns 404 for draft releases
   - Apply the same release lookup for RC git tag cleanup in upstream and workspace `promote-release.yml`
+- **Promote-release validate job cannot see draft releases** ([#517](https://github.com/vig-os/devcontainer/issues/517))
+  - Elevate `validate` job permissions to `contents: write` so the token has push-level access required by the GitHub API to list draft releases
+  - Use `github.token` instead of the release app token for the draft release check in workspace `promote-release.yml`
 
 ### Security
 

diff --git a/docs/pull-requests/pr-117.md b/docs/pull-requests/pr-117.md
@@ -1,18 +1,18 @@
 ---
 type: pull_request
-state: open
+state: closed
 branch: dependabot/github_actions/dev/actions-minor-patch-003dc165f5 → dev
 created: 2026-04-05T11:49:02Z
-updated: 2026-04-06T05:24:28Z
+updated: 2026-04-13T05:26:47Z
 author: dependabot[bot]
 author_url: https://github.com/dependabot[bot]
 url: https://github.com/vig-os/devcontainer-smoke-test/pull/117
-comments: 0
+comments: 1
 labels: dependencies, github_actions
 assignees: none
 milestone: none
 projects: none
-synced: 2026-04-07T04:33:13.916Z
+synced: 2026-04-14T04:45:15.555Z
 ---
 
 # [PR 117](https://github.com/vig-os/devcontainer-smoke-test/pull/117) ci(deps): bump actions/cache from 5.0.3 to 5.0.4 in the actions-minor-patch group across 1 directory
@@ -125,3 +125,22 @@ Relevant for maintainers with write access only.</p>
 </details>
 <br />
 
+
+---
+---
+
+# Comments (1)
+
+## [Comment #1](https://github.com/vig-os/devcontainer-smoke-test/pull/117#issuecomment-4234046119) by [@dependabot[bot]](https://github.com/apps/dependabot)
+
+_Posted on April 13, 2026 at 05:26 AM_
+
+Looks like actions/cache is updatable in another way, so this is no longer needed.
+
+---
+---
+
+## Commits
+
+### Commit 1: [01832fb](https://github.com/vig-os/devcontainer-smoke-test/commit/01832fb7c4a701fa9d3114c76959604c2ec254a0) by [dependabot[bot]](https://github.com/apps/dependabot) on April 6, 2026 at 05:24 AM
+ci(deps): bump actions/cache, 4 files modified (.github/workflows/sync-issues.yml)
diff --git a/docs/pull-requests/pr-134.md b/docs/pull-requests/pr-134.md
@@ -1,9 +1,9 @@
 ---
 type: pull_request
-state: open
+state: closed (merged)
 branch: release/0.3.3 → main
 created: 2026-04-10T14:13:58Z
-updated: 2026-04-10T14:16:08Z
+updated: 2026-04-10T14:21:49Z
 author: vig-os-release-app[bot]
 author_url: https://github.com/vig-os-release-app[bot]
 url: https://github.com/vig-os/devcontainer-smoke-test/pull/134
@@ -12,7 +12,8 @@ labels: release-kind:final
 assignees: none
 milestone: none
 projects: none
-synced: 2026-04-10T14:16:58.061Z
+merged: 2026-04-10T14:21:47Z
+synced: 2026-04-11T04:22:03.367Z
 ---
 
 # [PR 134](https://github.com/vig-os/devcontainer-smoke-test/pull/134) chore: release 0.3.3
@@ -65,3 +66,30 @@ This PR prepares release 0.3.3 for merge to main.
   - Refresh `.trivyignore`: drop resolved gh/docker-cli and gRPC entries; add Go stdlib and typos-related suppressions plus `jwt-token` false positive
   - Suppress unfixable base-image CVEs: ncurses (CVE-2025-69720), SQLite (CVE-2025-7458), systemd (CVE-2026-29111), zlib/minizip (CVE-2023-45853)
 
+
+
+---
+---
+
+## Commits
+
+### Commit 1: [8e9b28c](https://github.com/vig-os/devcontainer-smoke-test/commit/8e9b28ce2715c17233abf55e6d83ed0c1015df70) by [vig-os-release-app[bot]](https://github.com/apps/vig-os-release-app) on April 10, 2026 at 01:54 PM
+chore: sync dev with main (#132), 14 files modified (CHANGELOG.md)
+
+### Commit 2: [88566c6](https://github.com/vig-os/devcontainer-smoke-test/commit/88566c60812ba7e42fe58bf30bae8a2cfcff3fe9) by [commit-action-bot[bot]](https://github.com/apps/commit-action-bot) on April 10, 2026 at 02:11 PM
+chore: deploy 0.3.3, 6 files modified (.devcontainer/CHANGELOG.md, .vig-os, CHANGELOG.md)
+
+### Commit 3: [c6e7346](https://github.com/vig-os/devcontainer-smoke-test/commit/c6e73469a439cec5801cce26576f66ccc5015b53) by [vig-os-release-app[bot]](https://github.com/apps/vig-os-release-app) on April 10, 2026 at 02:12 PM
+chore: deploy 0.3.3 (#133), 6 files modified (.devcontainer/CHANGELOG.md, .vig-os, CHANGELOG.md)
+
+### Commit 4: [4cb7b74](https://github.com/vig-os/devcontainer-smoke-test/commit/4cb7b74f480fbc746c9d2093b016d5b66b89f9ab) by [commit-action-bot[bot]](https://github.com/apps/commit-action-bot) on April 10, 2026 at 02:13 PM
+chore: freeze changelog for release 0.3.3, 14 files modified (CHANGELOG.md)
+
+### Commit 5: [9416934](https://github.com/vig-os/devcontainer-smoke-test/commit/9416934c2e11f8e2ccd3ba74c0fa03909a9945e0) by [commit-action-bot[bot]](https://github.com/apps/commit-action-bot) on April 10, 2026 at 02:13 PM
+chore: prepare release 0.3.3, 14 files modified (CHANGELOG.md)
+
+### Commit 6: [41fa9c3](https://github.com/vig-os/devcontainer-smoke-test/commit/41fa9c344433590ae272c1b3573268b56695bc08) by [commit-action-bot[bot]](https://github.com/apps/commit-action-bot) on April 10, 2026 at 02:16 PM
+chore: finalize release 0.3.3, 2 files modified (CHANGELOG.md)
+
+### Commit 7: [e9eae4a](https://github.com/vig-os/devcontainer-smoke-test/commit/e9eae4a53f0c13edab9e7de78cec948b09dca9ec) by [commit-action-bot[bot]](https://github.com/apps/commit-action-bot) on April 10, 2026 at 02:17 PM
+chore: sync issues and PRs, 260 files modified (docs/pull-requests/pr-130.md, docs/pull-requests/pr-131.md, docs/pull-requests/pr-132.md, docs/pull-requests/pr-133.md, docs/pull-requests/pr-134.md)
diff --git a/docs/pull-requests/pr-135.md b/docs/pull-requests/pr-135.md
@@ -0,0 +1,39 @@
+---
+type: pull_request
+state: closed (merged)
+branch: chore/sync-main-to-dev-33-1 → dev
+created: 2026-04-10T14:23:14Z
+updated: 2026-04-10T14:24:16Z
+author: vig-os-release-app[bot]
+author_url: https://github.com/vig-os-release-app[bot]
+url: https://github.com/vig-os/devcontainer-smoke-test/pull/135
+comments: 0
+labels: none
+assignees: none
+milestone: none
+projects: none
+merged: 2026-04-10T14:24:15Z
+synced: 2026-04-11T04:22:02.460Z
+---
+
+# [PR 135](https://github.com/vig-os/devcontainer-smoke-test/pull/135) chore: sync dev with main
+
+Syncs `dev` with `main` (sync-main-to-dev workflow).
+
+
+---
+---
+
+## Commits
+
+### Commit 1: [9416934](https://github.com/vig-os/devcontainer-smoke-test/commit/9416934c2e11f8e2ccd3ba74c0fa03909a9945e0) by [commit-action-bot[bot]](https://github.com/apps/commit-action-bot) on April 10, 2026 at 02:13 PM
+chore: prepare release 0.3.3, 14 files modified (CHANGELOG.md)
+
+### Commit 2: [41fa9c3](https://github.com/vig-os/devcontainer-smoke-test/commit/41fa9c344433590ae272c1b3573268b56695bc08) by [commit-action-bot[bot]](https://github.com/apps/commit-action-bot) on April 10, 2026 at 02:16 PM
+chore: finalize release 0.3.3, 2 files modified (CHANGELOG.md)
+
+### Commit 3: [e9eae4a](https://github.com/vig-os/devcontainer-smoke-test/commit/e9eae4a53f0c13edab9e7de78cec948b09dca9ec) by [commit-action-bot[bot]](https://github.com/apps/commit-action-bot) on April 10, 2026 at 02:17 PM
+chore: sync issues and PRs, 260 files modified (docs/pull-requests/pr-130.md, docs/pull-requests/pr-131.md, docs/pull-requests/pr-132.md, docs/pull-requests/pr-133.md, docs/pull-requests/pr-134.md)
+
+### Commit 4: [7241038](https://github.com/vig-os/devcontainer-smoke-test/commit/72410387662cb2bdbd7f30241171d7d3b64bc9f8) by [vig-os-release-app[bot]](https://github.com/apps/vig-os-release-app) on April 10, 2026 at 02:21 PM
+chore: release 0.3.3 (#134), 266 files modified (.devcontainer/CHANGELOG.md, .vig-os, CHANGELOG.md, docs/pull-requests/pr-130.md, docs/pull-requests/pr-131.md, docs/pull-requests/pr-132.md, docs/pull-requests/pr-133.md, docs/pull-requests/pr-134.md)
diff --git a/docs/pull-requests/pr-136.md b/docs/pull-requests/pr-136.md
@@ -0,0 +1,79 @@
+---
+type: pull_request
+state: open
+branch: dependabot/pip/dev/pandas-gte-3.0.2 → dev
+created: 2026-04-13T05:26:24Z
+updated: 2026-04-13T05:26:25Z
+author: dependabot[bot]
+author_url: https://github.com/dependabot[bot]
+url: https://github.com/vig-os/devcontainer-smoke-test/pull/136
+comments: 0
+labels: dependencies, python
+assignees: none
+milestone: none
+projects: none
+synced: 2026-04-14T04:45:20.800Z
+---
+
+# [PR 136](https://github.com/vig-os/devcontainer-smoke-test/pull/136) build(deps-dev): update pandas requirement from >=2.2 to >=3.0.2
+
+Updates the requirements on [pandas](https://github.com/pandas-dev/pandas) to permit the latest version.
+<details>
+<summary>Release notes</summary>
+<p><em>Sourced from <a href="https://github.com/pandas-dev/pandas/releases">pandas's releases</a>.</em></p>
+<blockquote>
+<h2>pandas 3.0.2</h2>
+<p>We are pleased to announce the release of pandas 3.0.2.
+This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.</p>
+<p>See the <a href="https://pandas.pydata.org/docs/dev/whatsnew/v3.0.2.html">full whatsnew</a> for a list of all the changes.</p>
+<p>Pandas 3.0 supports Python 3.11 and higher.
+The release can be installed from PyPI:</p>
+<pre><code>python -m pip install --upgrade pandas==3.0.*
+</code></pre>
+<p>Or from conda-forge</p>
+<pre><code>conda install -c conda-forge pandas=3.0
+</code></pre>
+<p>Please report any issues with the release on the <a href="https://github.com/pandas-dev/pandas/issues">pandas issue tracker</a>.</p>
+<p>Thanks to all the contributors who made this release possible.</p>
+</blockquote>
+</details>
+<details>
+<summary>Commits</summary>
+<ul>
+<li><a href="https://github.com/pandas-dev/pandas/commit/ab90747e3dae0e69b1bdbf083820b8075689b34b"><code>ab90747</code></a> RLS: 3.0.2 (<a href="https://redirect.github.com/pandas-dev/pandas/issues/64934">#64934</a>)</li>
+<li><a href="https://github.com/pandas-dev/pandas/commit/6f270137a27f8de4bd1afd7d71220e0760429750"><code>6f27013</code></a> Backport PR <a href="https://redirect.github.com/pandas-dev/pandas/issues/64931">#64931</a> on branch 3.0.x (DOC/BLD: temporary disable upload of docs...</li>
+<li><a href="https://github.com/pandas-dev/pandas/commit/48ddc60d6efe8d942dbe1495dea725a9d7db15ef"><code>48ddc60</code></a> Backport PR <a href="https://redirect.github.com/pandas-dev/pandas/issues/64664">#64664</a> on branch 3.0.x (BUG: DataFrame.sum() crashes on empty Dat...</li>
+<li><a href="https://github.com/pandas-dev/pandas/commit/8774488df19d0859ddc05a24210783b66da27ef7"><code>8774488</code></a> [backport 3.0.x] PERF: fix slow python loop in validation for ArrowStringArra...</li>
+<li><a href="https://github.com/pandas-dev/pandas/commit/33af6cc04ed6331c23a49655c4c7bb8f90351da3"><code>33af6cc</code></a> Backport PR <a href="https://redirect.github.com/pandas-dev/pandas/issues/64133">#64133</a> on branch 3.0.x (BUG: str.find returns byte offset instead...</li>
+<li><a href="https://github.com/pandas-dev/pandas/commit/4ef49d815aae99b6ba5627ab0a54ba0819336652"><code>4ef49d8</code></a> [backport 3.0.x] BUG: fix convert_dtypes dropping values from sliced mixed-dt...</li>
+<li><a href="https://github.com/pandas-dev/pandas/commit/0668f3451120e5552cdc8cf5d85f6d1238ce4e12"><code>0668f34</code></a> [backport 3.0.x] BUG: Fix HDFStore.put with StringDtype columns and compressi...</li>
+<li><a href="https://github.com/pandas-dev/pandas/commit/23f2f442ea1af6deddfefef2a4a1e4cb44328c3d"><code>23f2f44</code></a> [backport 3.0.x] BUG: Suppress unnecessary RuntimeWarning in to_datetime with...</li>
+<li><a href="https://github.com/pandas-dev/pandas/commit/83ba804de35ec98798d31474d044cff7666bebd6"><code>83ba804</code></a> Backport PR <a href="https://redirect.github.com/pandas-dev/pandas/issues/64886">#64886</a>: BUG: Compute Variance of Complex Numbers Correctly (<a href="https://redirect.github.com/pandas-dev/pandas/issues/64892">#64892</a>)</li>
+<li><a href="https://github.com/pandas-dev/pandas/commit/bb5ca1a7a96130fa0e8e2a3987c051e4473f7792"><code>bb5ca1a</code></a> Backport PR <a href="https://redirect.github.com/pandas-dev/pandas/issues/64386">#64386</a> on branch 3.0.x (BUG: fix sort_index AssertionError with R...</li>
+<li>Additional commits viewable in <a href="https://github.com/pandas-dev/pandas/compare/v2.2.0...v3.0.2">compare view</a></li>
+</ul>
+</details>
+<br />
+
+
+Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
+
+[//]: # (dependabot-automerge-start)
+[//]: # (dependabot-automerge-end)
+
+---
+
+<details>
+<summary>Dependabot commands and options</summary>
+<br />
+
+You can trigger Dependabot actions by commenting on this PR:
+- `@dependabot rebase` will rebase this PR
+- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
+- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
+- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
+- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
+- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
+
+
+</details>