v2.3.0

Dependency updates now come from GitHub's built-in Dependabot, with no app or third-party account to set up, and CI checks every install for known vulnerabilities.

Changed

• Dependabot replaces Renovate (#23). .github/dependabot.yml opens update PRs every Monday, only for releases at least 3 days old. Minor and patch dev-tool updates arrive as one PR, and GitHub Actions updates as another. Exact pins stay exact. The Renovate app now requires registering a Mend account, which a starter template shouldn't require.
• Some versions are raised by hand. Dependabot doesn't update the Node version in devEngines.runtime, the zizmor version in ci.yml, or @types/node majors. There is no weekly lockfile refresh.
• CI runs pnpm audit --audit-level high (#23) after installing, and fails on high or critical advisories. GitHub's Dependabot alerts can't see this template's dependencies: pnpm 12 writes a two-document pnpm-lock.yaml, and GitHub's dependency graph reads only the first document (dependabot-core#15904).
• No known advisories. fast-uri 3.1.9, which arrives through commitlint, clears two moderate and two low advisories.

Fixed

• The marker check ignores prose (#22). Lines like ## Example: usage or // For example: no longer fail the template's own CI. This only affects contributors to the template.

Changes for existing projects

Before (v2.2.0)	After (v2.3.0)
renovate.json	.github/dependabot.yml; uninstall the Renovate app if you installed it
ci.yml # renovate: comment on ZIZMOR_VERSION	a plain comment; raise the version by hand
no audit step	ci.yml: pnpm audit --audit-level high after "Install dependencies"
no zizmor config	.github/zizmor.yml: rules.dependabot-cooldown.config.days: 3; without it, zizmor fails CI on the 3-day cooldown

Notes:

• Keep three settings equal: minimumReleaseAge in pnpm-workspace.yaml, cooldown.default-days in dependabot.yml, and days in .github/zizmor.yml.
• Run pnpm audit before adding the CI step, and fix what it finds first. Moderate and low advisories don't fail CI.