renovate.json

{
  "$schema": "https://json.schemastore.org/renovate.json",
  "extends": ["config:recommended", "group:allNonMajor"],
  "enabledManagers": [
    "github-actions",
    "npm",
    "docker-compose",
    "dockerfile",
    "pep621"
  ],
  "timezone": "America/New_York",
  "schedule": ["before 9am on Monday"],
  "dependencyDashboard": true,
  "dependencyDashboardAutoclose": true,
  "minimumReleaseAge": "7 days",
  "labels": ["dependencies"],
  "rangeStrategy": "bump",
  "pinDigests": true,
  "prConcurrentLimit": 10,
  "vulnerabilityAlerts": { "groupName": null, "schedule": [] },
  "packageRules": [
    {
      "description": "Group first-party GitHub Actions (actions/*); auto-merge minor and patch — low supply-chain risk",
      "groupName": "GitHub Actions (first-party)",
      "matchDatasources": ["github-actions"],
      "matchPackageNames": ["actions/*"],
      "automerge": true,
      "matchUpdateTypes": ["minor", "patch"]
    },
    {
      "description": "Group third-party GitHub Actions; require manual review — these run with deploy secrets",
      "groupName": "GitHub Actions (third-party)",
      "matchDatasources": ["github-actions"],
      "matchPackageNames": ["!actions/*"]
    },
    {
      "description": "Disable noisy peerDependency update PRs",
      "matchDepTypes": ["peerDependencies"],
      "enabled": false
    },
    {
      "description": "Group Python (uv/pyproject.toml) minor and patch updates into one PR, separate from the npm non-major group — different lockfile, keeps uv.lock churn reviewable on its own",
      "groupName": "Python dependencies (non-major)",
      "groupSlug": "python-non-major",
      "matchManagers": ["pep621"],
      "matchUpdateTypes": ["minor", "patch"]
    },
    {
      "description": "Do not auto-update the Python base image; adopt interpreter upgrades manually",
      "matchDatasources": ["docker"],
      "matchPackageNames": ["python"],
      "enabled": false
    },
    {
      "description": "Hold TypeScript at 6.x: 7.0 is the native (Go) port and is too new to adopt. Renovate rolls all 7.x into one \"to v7\" upgrade, so raise this to <7.2.0 (or drop the rule) when ready to migrate rather than closing the PR.",
      "matchDatasources": ["npm"],
      "matchPackageNames": ["typescript"],
      "allowedVersions": "<7.0.0"
    },
    {
      "description": "Hold at <1.9.0: 1.9.0 rewired AdvancedMarker onClick to the gmp-click DOM event (upstream PR #997), dropping event.stop()/event.latLng. Shipped as a minor but breaks marker clicks at runtime. Remove this rule with the migration.",
      "matchDatasources": ["npm"],
      "matchPackageNames": ["@vis.gl/react-google-maps"],
      "allowedVersions": "<1.9.0"
    },
    {
      "description": "Hold the brace-expansion@<1.1.16 override at <3.0.0: minimatch@3.1.5 (pulled in by eslint-plugin-react, eslint-plugin-jsx-a11y, and commitizen's glob@7.2.3) does `require('brace-expansion')` and calls the result directly. 1.x/2.x still export a callable default (`module.exports = expandTop`); 3.0.0 switched to ESM-only, and 4.x/5.x ship a dual build whose CJS side exports only a named `expand` — either way minimatch@3.1.5 throws `TypeError: expand is not a function` the first time a brace-containing glob reaches it. See pnpm-workspace.yaml's matching override comment. Does not affect the separate `brace-expansion@>=3.0.0 <5.0.9` override, which feeds modern minimatch@10.x and is fine at 5.x. Remove this rule only once minimatch@3.1.5 is gone from the dependency tree (i.e. those three packages upgrade past it).",
      "matchDatasources": ["npm"],
      "matchDepNames": ["brace-expansion@<1.1.16"],
      "allowedVersions": "<3.0.0"
    }
  ]
}