renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    "helpers:pinGitHubActionDigests"
  ],
  "commitBody": "Generated by renovateBot",
  "prConcurrentLimit": 5,
  "minimumReleaseAge": "2 weeks",
  "vulnerabilityAlerts": {
    "enabled": true,
    "minimumReleaseAge": "2 days",
    "prConcurrentLimit": 0,
    "prHourlyLimit": 0,
    "schedule": []
  },
  "packageRules": [
    {
      "matchManagers": ["github-actions"],
      "groupName": "github workflows"
    },
    {
      "matchManagers": ["dockerfile"],
      "groupName": "docker deps"
    },
    {
      "matchManagers": ["npm"],
      "groupName": "npm deps"
    },
    {
      "description": "First-party deps, no need to quarantine new releases",
      "matchManagers": ["gomod"],
      "groupName": "livekit deps",
      "matchPackageNames": [
        "github.com/livekit{/,}**"
      ],
      "minimumReleaseAge": null
    },
    {
      "description": "The go directive is the module minimum, owned by the go toolchain and dependency requirements; the build toolchain is pinned in .go-version instead",
      "matchManagers": ["gomod"],
      "matchDepTypes": ["golang"],
      "enabled": false
    },
    {
      "description": "Build toolchain pin (.go-version): a patch bump (stays on the current minor) and a minor bump each get their own approvable PR",
      "matchDatasources": ["golang-version"],
      "separateMinorPatch": true
    }
  ],
  "customManagers": [
    {
      "customType": "regex",
      "managerFilePatterns": [
        "/(^|/)\\.go-version$/"
      ],
      "matchStrings": ["^(?<currentValue>\\d+\\.\\d+\\.\\d+)"],
      "datasourceTemplate": "golang-version",
      "depNameTemplate": "golang"
    }
  ],
  "postUpdateOptions": [
    "gomodTidy"
  ],
  "schedule": ["on sunday"],
  "updateNotScheduled": false
}