[RonnyB71]

Follows up the Dependency Dashboard (#26) before Renovate's next run (Thursday before 07:00, from Digdir's shared config).

renovate.json

• Major updates wait for approval. Renovate lists them in the dashboard, and opens a PR only when someone ticks the checkbox. Without this, each of PostgreSQL 18, Node 26, TypeScript 7, ESLint 10 and others would become its own PR on Thursday. Minor and patch updates come as before.
• The overrides in pnpm-workspace.yaml are left alone.
  • Why: Renovate read our security override undici@<7.30.1 as an ordinary dependency and wanted to upgrade it to ^8. That would force undici 8 on Payload, which uses 7.
  • How they go: the overrides should be removed when Payload and Astro are fixed, not upgraded.
• graphql stays below 17, because Payload requires graphql ^16.8.1.
• @types/node follows the Node major in .nvmrc (below 25). Raise it together with .nvmrc.

Validation:

• renovate-config-validator --strict (Renovate 44.166.0) accepts the file.
• In a local dry run (--platform=local --dry-run=lookup), the three overrides are disabled, and no update to undici 8 is proposed. The run used config:recommended instead of Digdir's shared preset, which the local platform can't fetch.
• The approval requirement for majors only shows up in the dashboard after merge, as a «Pending Approval» section.

Other changes

• @types/node 22.19.9 → 24.19.2, so the types match the runtime (Node 24, .nvmrc).
• src/web/README.md deleted. It's the Astro starter README ("Delete this file"). It held one of the two places Renovate warned about hidden Unicode characters: a zero-width joiner inside the emoji 🧑‍🚀. The other place is soft hyphens in prototype/Saman.dc.html, which is intentional and can't be changed, so the warning stays.

Tests

• tsc passes, pnpm lint passes, and pnpm --filter cms build succeeds.
• pnpm test: CMS 36 passed, web 15 passed.

🤖 Generated with Claude Code