docs: add dedicated CVE Lite CLI vs Renovate comparison page

[sonukapoor]

Summary

Renovate is one of the most widely adopted automated dependency update tools in the JS ecosystem. Many teams treat it as their primary security strategy — but it is an automation tool, not a vulnerability scanner. The gap between what Renovate automates and what still needs a scanner is a real and frequently misunderstood distinction.

This issue tracks adding a dedicated comparison page: CVE Lite CLI vs Renovate.

Why a dedicated page

Issue #362 plans to split comparison.md into per-tool pages. Renovate warrants a page now because:

• It is in a different category from the other tools (automation bot vs scanner) — the comparison framing is more nuanced than "which scanner is better"
• The Ghost case study provides a concrete, verifiable proof point: Ghost runs Renovate, yet 26 transitive vulnerabilities remained at the scanned revision
• Developers actively search "Renovate vs [scanner]" when evaluating their security tooling

Three structural gaps to cover

1. No-fix packages — Renovate can only open PRs for versions that exist. Packages with no published non-vulnerable version (sanitize-html, html-minifier, elliptic in Ghost) generate no PRs. A scanner surfaces these explicitly with a "no fix" indicator.

2. Transitive chains outside Renovate's scope — Renovate opens PRs for direct dependencies. Vulnerable packages buried in upstream transitive chains (e.g. babel-traverse@6.26.0 six layers deep in Ghost Admin's build toolchain) are out of reach.

3. Breaking-change upgrades that stall — Renovate can open a major-version bump PR but cannot auto-merge it. Those PRs sit open while the vulnerability remains active. A scanner tells you it is still present.

Positioning angle

Renovate and CVE Lite CLI are complementary — not competing. The page should close with a recommended approach: Renovate for continuous dependency hygiene, CVE Lite CLI before release to see what Renovate could not resolve.

Proof point

Ghost uses Renovate. At revision 359e702, 26 vulnerable packages remained — all transitive, 2 critical. Ghost case study

Related

• docs: split comparison page into per-tool pages with index #362 — split comparison page into per-tool pages (this page should be consistent with that structure)
• docs: add Ghost case study and example lockfile #365 — Ghost case study (where the Renovate proof point originates)