SRE-1092: Bump Renovate to 44.101.2 in install-renovate

[claude]

Requested by Tim Diekmann · Slack thread

Before: install-renovate pins Renovate 44.34.3, whose lockfile resolves adm-zip 0.6.0. That version is affected by GHSA-vwc7-r8mq-g2x9 (extraction follows destination symlinks) and GHSA-7q85-xj36-vmfc (memory allocation from the declared uncompressed size).

After: install-renovate pins Renovate 44.101.2, which resolves adm-zip 0.6.1 and keeps js-yaml at 4.3.2.

How

• Set renovate to 44.101.2 in .github/actions/install-renovate/package.json.
• Regenerated package-lock.json with npm install --package-lock-only.

This ports hashintel/.github#111 now that .github is being emptied (hashintel/.github#112).

npm audit still reports two moderate qs advisories (GHSA-x5fp-wj9c-mxmx, GHSA-4mjr-xmp4-gh2g), reached through azure-devops-node-api. They are on main too, and a later Renovate release fixes them.

🤖 Generated with Claude Code

https://claude.ai/code/session_012vhP8cbLCbnWdQP7LLFB5A

[cursor]

PR Summary

Low Risk
Dev-only CI tooling pin with no application runtime impact; main residual risk is unverified Renovate behavior on dependency PR workflows until housekeeping runs.

Overview
Bumps the centrally pinned Renovate used by the composite install-renovate action from 44.34.3 to 44.101.2, with a regenerated package-lock.json so CI installs the new tree via npm ci.

The lockfile refresh pulls in a large transitive update set (AWS SDK clients, OpenTelemetry—including new OTLP gRPC trace export—got 16, google-auth-library 11, azure-devops-node-api 17, @redis/client 6, and related Renovate internals). Notable for security: adm-zip moves to 0.6.1, addressing symlink traversal and allocation issues present at 0.6.0.

qs-related moderate advisories via azure-devops-node-api may still appear in npm audit; the PR description notes those also exist on main and may need a later Renovate bump to clear fully.

^{Reviewed by Cursor Bugbot for commit f96969d. Bugbot is set up for automated code reviews on this repo. Configure here.}