renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    "helpers:pinGitHubActionDigests"
  ],
  "branchPrefix": "chore/",
  "dependencyDashboard": true,
  "prConcurrentLimit": 5,
  "prHourlyLimit": 2,
  "rebaseWhen": "behind-base-branch",
  "separateMinorPatch": true,
  "minimumReleaseAge": "3 days",
  "ignorePaths": [
    ".rpm-packaging/**",
    "ors-test-scenarios/src/test/resources/**",
    "**/node_modules/**"
  ],
  "ignoreDeps": [
    "org.heigit.ors:openrouteservice",
    "com.fasterxml.jackson.datatype:jackson-datatype-jts"
  ],
  "packageRules": [
    {
      "description": "Every major waits for a human tick on the Dependency Dashboard",
      "matchUpdateTypes": ["major"],
      "dependencyDashboardApproval": true
    },
    {
      "description": "Runtime JDK stays on Corretto 21 LTS (pom targets Java 17)",
      "matchDatasources": ["docker"],
      "matchPackageNames": ["docker.io/amazoncorretto"],
      "allowedVersions": "<22"
    },
    {
      "description": "Spring Boot stays on 3.x. Spring Boot 4 needs migration.",
      "matchPackageNames": ["org.springframework.boot:spring-boot-starter-parent"],
      "allowedVersions": "<4"
    },
    {
      "description": "springdoc stays on 2.x. springdoc 3.x requires Spring Boot 4.",
      "matchPackageNames": ["org.springdoc:springdoc-openapi-starter-webmvc-ui"],
      "allowedVersions": "<3"
    },
    {
      "description": "commons-cli 2.0-gt2-pre1 is a fork and a false positive. Not an Apache release.",
      "matchPackageNames": ["commons-cli:commons-cli"],
      "allowedVersions": "!/-gt2/"
    },
    {
      "description": "graphhopper-core is prebuilt against hppc 0.8.x (uses HashOrderMixing, removed in hppc 0.9). Bumping past 0.8.x breaks graph building at runtime unless graphhopper.version is upgraded too.",
      "matchPackageNames": ["com.carrotsearch:hppc"],
      "allowedVersions": "<0.9"
    },
    {
      "description": "All patch updates in one PR",
      "matchUpdateTypes": ["patch"],
      "groupName": "all patch dependencies",
      "labels": ["dependencies", "build"]
    },
    {
      "description": "All minor updates in one PR",
      "matchUpdateTypes": ["minor"],
      "groupName": "all minor dependencies",
      "labels": ["dependencies", "build"]
    },
    {
      "description": "The published image stays reviewable on its own",
      "matchManagers": ["dockerfile"],
      "matchFileNames": ["Dockerfile"],
    "groupName": "docker base images",
      "pinDigests": true,
      "labels": ["dependencies", "container :whale:", "security"]
    },
    {
      "description": "Workflow YAML is a different review surface than the POMs",
      "matchManagers": ["github-actions"],
      "groupName": "github actions",
      "labels": ["dependencies", "ci"]
    },
    {
      "description": "MUST stay last. overrides config:recommended's fix(deps) TO chore so dependency PRs can stay out of the hand-curated CHANGELOG",
      "matchPackageNames": ["*"],
      "semanticCommitType": "chore"
    }
  ]
}