chore: add shared renovate config with version bumping

[lawrence-u10d]

Summary

• Adds renovate.json5 extending shared Unstructured config
• Enables security-only dependency updates (Python, Docker, GitHub Actions)
• Includes automatic version bumping and CHANGELOG updates on security fixes

Test plan

• Verify Renovate picks up config and creates dependency dashboard
• Test version bump script locally with mock changes

🤖 Generated with Claude Code

---

Note

Sets up Renovate to manage security-only Python dependency updates and automates versioning/changelog maintenance.

• Introduces renovate.json5 extending org preset; for PyPI vulnerability alerts runs scripts/renovate-security-bump.sh (branch execution) with file filters for unstructured_inference/__version__.py and CHANGELOG.md
• Adds scripts/renovate-security-bump.sh that detects versioning style (__version__.py or pyproject.toml), computes release version (strip -dev or bump patch), updates the version file, infers changed packages from diffs (requirements, uv.lock, pyproject.toml), and inserts a security-focused entry in CHANGELOG.md respecting existing format

^{Written by Cursor Bugbot for commit a746443. This will update automatically on new commits. Configure here.}

[cursor]

New CHANGELOG entry prepended before main file header

The create_new_changelog_entry function prepends the new version entry to the beginning of the file by concatenating tmp_file before CHANGELOG_FILE. For CHANGELOGs that have a main header like # Changelog or introductory text at the top, this inserts the new version section BEFORE the header, corrupting the file structure. Since the script is explicitly described as a "Shared script for Renovate" (line 5) intended for reuse, this breaks when used with repos that follow the common pattern of having a title header before version entries.

 

[cursor]

Prepending breaks CHANGELOGs with title headers

The create_new_changelog_entry() function uses cat to prepend the new version entry directly to the beginning of the CHANGELOG file. If the CHANGELOG follows Keep a Changelog format with a title header like # Changelog and description at the top, the new version entry would be inserted before this title, corrupting the document structure. The new entry should be inserted after any title/description but before the first version entry.

 

[cursor]

Non-bracketed version headers with dates won't match

The grep pattern for non-bracketed CHANGELOG format uses (\s*$) which requires the version to be at end of line. This fails to match common CHANGELOG headers that include dates like ## 1.2.0-dev1 - 2024-01-01. The bracketed format on line 251 doesn't have this restriction. When the dev header can't be matched, the script falls back to creating a new entry instead of renaming the existing one, potentially creating duplicate version entries in the CHANGELOG.