Thanks for catching this. Apologies for not noticing it in #7770

No problem, it wasn't obvious and I only noticed after merging the same thing in some other projects!

I find this interesting - codecov/feedback#112 (comment)

Yes, that might what we need to do in the end. I've not see rate-limiting cause problems for us, so I think it's better to stick to v3 for a bit longer to give time for things to settle, it might be that things will change.

As of now, there are no plans to drop support for v3.

but if we're pinning to 3.1.5 for nodejs20, it is not as relevant as it could be.

We can go back to v3=v3.1.6 if we don't mind the Node.js 16 warnings. In any case, I don't see pinning to v3.1.5 as a long-term solution, rather a stopgap for the time being.

It occurs to me that we could keep v4 for pushes and workflow dispatches, and only downgrade for pull requests? hugovk#111

This seems to add more complexity than we need right now, and will be extra work to make sure Renovate doesn't update the wrong bit. And hopefully we can choose only v3 or v4 or something soonish.