chore(deps): security hardening (#4551)

.github/renovate.json5

@@ -15,6 +15,21 @@
       matchUpdateTypes: ["minor", "patch", "pin", "digest"],
       automerge: true,
     },
+    {
+      // disallow automerge for onlyBuiltDependencies
+      matchPackageNames: [
+        "@tree-sitter-grammars/tree-sitter-yaml",
+        "bcrypt",
+        "better-sqlite3",
+        "cpu-features",
+        "esbuild",
+        "sharp",
+        "ssh2",
+        "tree-sitter",
+        "tree-sitter-json",
+      ],
+      automerge: false,
+    },
   ],
   updateInternalDeps: true,
   rangeStrategy: "bump",