renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":dependencyDashboard",
    ":semanticCommits",
    ":separateMajorReleases",
    "group:monorepos",
    "group:recommended",
    "workarounds:all"
  ],
  "timezone": "UTC",
  "schedule": [
    "after 9am on monday,tuesday,wednesday,thursday,friday",
    "before 10am on monday,tuesday,wednesday,thursday,friday"
  ],
  "labels": ["dependencies"],
  "prConcurrentLimit": 10,
  "prHourlyLimit": 4,
  "platformAutomerge": true,
  "automergeType": "pr",
  "commitMessagePrefix": "chore(deps): ",
  "commitMessageAction": "update",
  "commitMessageTopic": "{{depName}}",
  "commitMessageExtra": "to {{newVersion}}",
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["before 10am on monday"],
    "timezone": "UTC",
    "commitMessageAction": "refresh",
    "commitMessageTopic": "lock files",
    "groupName": "lock file maintenance"
  },
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["security"],
    "automerge": false
  },
  "packageRules": [
    {
      "description": "Weekly batch for non-major updates (patch PRs are ungrouped below for auto-merge)",
      "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
      "groupName": "non-major dependencies",
      "groupSlug": "non-major",
      "schedule": ["before 10am on monday"],
      "timezone": "UTC"
    },
    {
      "description": "Auto-merge patch updates when CI passes",
      "matchUpdateTypes": ["patch"],
      "groupName": null,
      "automerge": true,
      "automergeType": "pr",
      "minimumReleaseAge": "3 days",
      "ignoreTests": false
    },
    {
      "description": "Major updates as separate PRs with migration context",
      "matchUpdateTypes": ["major"],
      "groupName": null,
      "automerge": false,
      "labels": ["dependencies", "major-update"],
      "prBodyNotes": [
        "This is a major version upgrade. Review the release notes and migration guide linked below before merging."
      ]
    },
    {
      "description": "Stellar SDK major releases require manual review",
      "matchPackagePatterns": ["^@stellar/"],
      "matchUpdateTypes": ["major"],
      "automerge": false,
      "dependencyDashboardApproval": true,
      "labels": ["dependencies", "stellar-sdk", "manual-review"],
      "prBodyNotes": [
        "Stellar SDK major releases may include breaking API changes. Confirm Soroban compatibility and run the full test suite before merging."
      ]
    },
    {
      "description": "Stellar packages use semver bump ranges; major updates use separate rules above",
      "matchPackagePatterns": ["^@stellar/"],
      "rangeStrategy": "bump"
    },
    {
      "description": "GitHub Actions use digest pinning where applicable",
      "matchManagers": ["github-actions"],
      "pinDigests": true
    },
    {
      "description": "Rust crate updates respect workspace lockfiles",
      "matchManagers": ["cargo"],
      "rangeStrategy": "bump"
    }
  ]
}