fix(renovate): drop the inert confidence gate, raise npm quarantine to 3 days

[BryanFRD]

Closes #193

The third-party npm rule advertised two gates — a release-age quarantine and a merge-confidence check — but only one of them existed. matchMergeConfidence is not a Renovate option (the real one is matchConfidence), so it matched nothing and constrained nothing. Every third-party npm patch and minor has been auto-merging on release age alone, across every repo consuming this preset.

renovate-config-validator on main before this change:

"topic": "Configuration Error",
"message": "Invalid configuration option: packageRules[3].matchMergeConfidence"

Approach

Option 2 from the issue — remove the dead option and strengthen the gate that actually works.

The alternative was renaming to matchConfidence, which sounds like the obvious fix but is not: it needs a Mend merge-confidence API key, and without one every package reports neutral, which would not match ["high", "very high"]. The rule would stop matching entirely and npm auto-merge would silently switch off org-wide — a large behavioural change arriving as a side effect of a typo fix. That is a decision worth making deliberately, not by accident, so it stays available as a follow-up rather than being smuggled in here.

Change

• matchMergeConfidence removed
• minimumReleaseAge: 1 day → 3 days

Three days is where most malicious publishes are detected and yanked; one day catches only the fastest cases. This deliberately makes npm stricter than the sibling Cargo rule (still 1 day) — npm is where these attacks actually land, and that rule's own comment already acknowledges release age is its only gate.

The description now states what the rule does rather than what it was believed to do, and records why matchConfidence was not adopted, so the next reader does not re-litigate it.

Verification

npx --package renovate renovate-config-validator default.json
INFO: Config validated successfully against 1 file(s)

The file is now clean end to end — this and the vulnerabilityAlerts.prPriority removal in #192 were the only two findings the validator had.

Trade-off worth naming

Routine patches now wait three days instead of one. For a security-relevant bump that is too slow — but those come through vulnerabilityAlerts, which has its own minimumReleaseAge: 0 and is unaffected by this rule.

[Copilot]

🟢 Ready to approve

The change cleanly removes an invalid Renovate option and adjusts an already-used, validated gate (minimumReleaseAge) with low risk of unintended configuration behavior.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Updates the shared Renovate preset to remove a non-functional (and invalid) npm “merge confidence” gate and instead strengthen the effective safety gate by extending the npm release-age quarantine period.

Changes:

• Removes the inert/invalid matchMergeConfidence packageRule option (previously rejected by renovate-config-validator).
• Increases third-party npm minimumReleaseAge from 1 day to 3 days.
• Rewrites the rule description to accurately reflect the actual gating behavior and why matchConfidence was not adopted.

File summaries

File	Description
default.json	Removes invalid confidence gating from the third-party npm rule and raises the npm minimum release age quarantine to 3 days, updating the description to match reality.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.