renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":semanticCommits"
  ],
  "schedule": [
    "before 5am"
  ],
  "timezone": "Asia/Ho_Chi_Minh",
  "prConcurrentLimit": 5,
  "prHourlyLimit": 3,
  "labels": [
    "dependencies"
  ],
  "rangeStrategy": "bump",
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": [
      "before 5am"
    ],
    "automerge": true,
    "automergeType": "pr"
  },
  "packageRules": [
    {
      "description": "Hold every update for 7 days so a malicious or yanked release is caught before it lands",
      "matchPackageNames": [
        "*"
      ],
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Group minor updates for review (prod scope by default)",
      "matchUpdateTypes": [
        "minor"
      ],
      "groupName": "minor dependencies",
      "groupSlug": "all-minor",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Auto-merge dev-scope minor updates after cooldown",
      "matchUpdateTypes": [
        "minor"
      ],
      "matchDepTypes": [
        "devDependencies",
        "dependency-groups",
        "tool.uv.dev-dependencies",
        "tool.pdm.dev-dependencies"
      ],
      "groupName": "non-major dev dependencies",
      "groupSlug": "non-major-dev",
      "automerge": true,
      "automergeType": "pr",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Auto-merge patch updates after cooldown",
      "matchUpdateTypes": [
        "patch"
      ],
      "groupName": "patch dependencies",
      "groupSlug": "all-patch",
      "automerge": true,
      "automergeType": "pr",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Pin dev-group tooling so the lockfile cannot outrun the cooldown. minimumReleaseAge governs when Renovate opens a PR, not what the resolver picks: with the global rangeStrategy:bump and an open-ended floor, `uv lock` resolves the newest release regardless. Observed 2026-07-25 on PR #901 — a patch update intended for ruff 0.15.22 locked 0.16.0, a minor, and Renovate reported 'a pending version that has not yet passed the Minimum Release Age threshold'. The 7-day supply-chain wait above was being bypassed silently on every dependency PR. Pinning is correct here and ONLY here: dev-group tools never reach the published wheel metadata. Do not copy this to a runtime dependency of a published library — an `==` pin there propagates into every consumer's resolve (see mcp-core #684/#692, where pinning pydantic broke the whole stack).",
      "matchDepTypes": [
        "devDependencies",
        "dependency-groups",
        "tool.uv.dev-dependencies",
        "tool.pdm.dev-dependencies"
      ],
      "rangeStrategy": "pin",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Auto-merge GitHub Actions digest updates after cooldown",
      "matchManagers": [
        "github-actions"
      ],
      "matchUpdateTypes": [
        "digest",
        "pinDigest"
      ],
      "groupName": "github-actions digests",
      "groupSlug": "gha-digests",
      "automerge": true,
      "automergeType": "pr",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Pin GitHub Actions to SHA for security",
      "matchManagers": [
        "github-actions"
      ],
      "pinDigests": true,
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Pin PSR to v10 — block Renovate downgrades",
      "matchPackagePatterns": [
        "^python-semantic-release/"
      ],
      "matchManagers": [
        "github-actions"
      ],
      "allowedVersions": ">=10.0.0",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Pin semgrep <1.162 — semgrep >=1.162 pins mcp==1.23.3, which conflicts with the project's mcp floor and makes the [security] extra unresolvable (see pyproject.toml comment). Closed PRs #684, #703. rangeStrategy:in-range-only stops the global bump strategy from raising the floor to 1.161.0 (which ALSO pins mcp==1.23.3) — only lock refreshes inside the existing >=1.0,<1.162 range are allowed.",
      "matchPackageNames": [
        "semgrep"
      ],
      "allowedVersions": "<1.162",
      "rangeStrategy": "in-range-only",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Pin Python runtime to 3.13.x",
      "matchPackageNames": [
        "python"
      ],
      "allowedVersions": ">=3.13.0 <3.14.0",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Pin Node.js runtime to 24.x",
      "matchPackageNames": [
        "node"
      ],
      "allowedVersions": ">=24.0.0 <25.0.0",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Pin Java runtime to 21.x LTS",
      "matchPackageNames": [
        "java"
      ],
      "allowedVersions": ">=21.0.0 <22.0.0",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Disable runtime version updates from mise (pinned in CLAUDE.md)",
      "matchManagers": [
        "mise"
      ],
      "matchDepNames": [
        "python",
        "node",
        "java"
      ],
      "enabled": false,
      "minimumReleaseAge": "7 days"
    }
  ],
  "semanticCommits": "enabled",
  "commitMessagePrefix": "fix(deps):",
  "commitMessageAction": "update",
  "commitMessageTopic": "{{depName}}",
  "semanticCommitType": "fix",
  "semanticCommitScope": "deps",
  "golang": {
    "postUpdateOptions": [
      "gomodTidy"
    ]
  }
}