renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended", ":dependencyDashboard"],
  "ignorePaths": [
    "**/node_modules/**",
    "**/bower_components/**",
    "**/vendor/**",
    "**/__tests__/**",
    "**/test/**",
    "**/tests/**",
    "**/__fixtures__/**",
    "**/fixtures/**"
  ],
  "timezone": "Asia/Seoul",
  "semanticCommitScope": null,
  "minimumReleaseAge": "3 days",
  "internalChecksFilter": "strict",
  "packageRules": [
    {
      "description": "The oracle. A socket.io version change is a conformance signal to read, not a chore, so each lands as its own PR and never auto-merges.",
      "matchPackageNames": ["socket.io", "socket.io-client"],
      "groupName": null,
      "automerge": false
    },
    {
      "description": "The 4.7 aliases are exact public-surface inputs for the supported 4.7 line. Allow later 4.7 patches to surface as conformance work, but never collapse this line into 4.8 or a future major.",
      "matchManagers": ["npm"],
      "matchDepNames": ["socket.io-4.7", "socket.io-client-4.7"],
      "allowedVersions": "/^4\\.7\\./"
    },
    {
      "description": "The 4.8 aliases are exact public-surface inputs for the supported 4.8 line. Allow later 4.8 patches to surface as conformance work, but never move this line to a future minor or major.",
      "matchManagers": ["npm"],
      "matchDepNames": ["socket.io-4.8", "socket.io-client-4.8"],
      "allowedVersions": "/^4\\.8\\./"
    },
    {
      "description": "Group build, test, catalog, and package manager tooling in weekly pull requests. Keep patches separate from minor releases because patch updates are readable at a glance, while minor updates deserve closer review.",
      "matchDepTypes": ["devDependencies", "packageManager", "pnpm.catalog.default"],
      "matchPackageNames": ["!socket.io", "!socket.io-client"],
      "groupName": "dev tooling",
      "separateMinorPatch": true,
      "schedule": ["before 6am on monday"]
    },
    {
      "description": "Give pnpm major releases their own pull request because they change dependency installation and lockfile generation independently of the test runner.",
      "matchDepTypes": ["packageManager"],
      "matchDepNames": ["pnpm"],
      "matchUpdateTypes": ["major"],
      "groupName": null
    },
    {
      "description": "Keep the Vitest packages together when a major release changes the runner, browser integration, and coverage integration as one migration.",
      "matchPackageNames": [
        "vitest",
        "@vitest/browser",
        "@vitest/browser-playwright",
        "@vitest/coverage-v8"
      ],
      "matchUpdateTypes": ["major"],
      "groupName": "Vitest"
    },
    {
      "description": "Keep the Node 20 compatibility runner on Vitest 4 because Vitest 5 requires Node 22.12 or newer.",
      "matchFileNames": ["compat/node20/package.json"],
      "matchDepNames": ["vitest"],
      "allowedVersions": "/^4\\./"
    },
    {
      "description": "Keep the Node 20 compatibility runner on Vite 6 because later Vite majors require a newer Node 20 release.",
      "matchFileNames": ["compat/node20/package.json"],
      "matchDepNames": ["vite"],
      "allowedVersions": "/^6\\./"
    },
    {
      "description": "Actions are kept individual. Each one gates every CI job, so a grouped failure would not say which bump broke it. They fall outside the dev tooling group already, since an action's depType is `action` or `uses-with` rather than `devDependencies`, but that is a side effect of how the group is written rather than a decision. Stating it here holds even if the group above widens later.",
      "matchManagers": ["github-actions"],
      "groupName": null
    },
    {
      "description": "Held while the CI matrix keeps Node 22, which is still in maintenance. Moving the floor to Node 24 is a supported-range decision tracked in #143, not an automatic bump. Matched on depName, since the CI matrix reads as depName `node` with packageName `actions/node-versions`, and matchPackageNames compares the latter. A working hold shows as the absence of a node major on the Dependency Dashboard, which is the only way to tell it fired, since config validation checks the schema rather than whether a rule matches anything.",
      "matchDepNames": ["node"],
      "matchUpdateTypes": ["major"],
      "enabled": false
    },
    {
      "description": "Held so a TypeScript major is adopted by hand rather than by the bot. A compiler major can surface new type errors under noUncheckedIndexedAccess, which both dual-run targets exercise. On depName like the rule above, so the hold keeps working if the same name ever arrives from another manager. A working hold shows as the absence of a typescript major on the Dependency Dashboard, which is the only way to tell it fired.",
      "matchDepNames": ["typescript"],
      "matchUpdateTypes": ["major"],
      "enabled": false
    },
    {
      "description": "The two node-version pins in the `node-floor` job are held at every update type, not just major. They are not a toolchain choice that should track the latest release: 20.0.0 is the exact floor `engines.node` declares, and 20.13.0 is the lowest Node 20 that can run vitest 4. Raising either erases what the job proves, and raising both to the same number collapses the two tiers into one, which is how #175 arrived proposing to turn `declared node floor` into a job that verifies nothing. The rule above holds majors for the whole matrix; this one holds these two files' minors and patches as well. A working hold shows as the absence of a node PR touching ci.yml on the Dependency Dashboard. The reason each number was chosen is in a comment beside it in ci.yml, and moving either is a decision to take there rather than a bump to accept.",
      "matchManagers": ["github-actions"],
      "matchDepNames": ["node"],
      "matchCurrentValue": "/^20\\.(0\\.0|13\\.0)$/",
      "enabled": false
    }
  ]
}