renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    "helpers:pinGitHubActionDigests",
    ":dependencyDashboard",
    ":semanticCommits",
    ":gitSignOff"
  ],
  "assigneesFromCodeOwners": true,
  "timezone": "Europe/Berlin",
  "schedule": ["before 5am on saturday"],
  "labels": ["dependencies", "3. to review"],
  "rangeStrategy": "bump",
  "rebaseWhen": "conflicted",
  "ignoreUnstable": false,
  "minimumReleaseAge": "4 days",
  "baseBranchPatterns": ["master", "stable35", "stable34", "stable33", "stable32"],
  "enabledManagers": ["composer", "github-actions", "npm"],
  "ignoreDeps": ["node", "npm", "php"],
  "packageRules": [
    {
      "description": "Automerge non-major npm and composer minor/patch updates",
      "matchManagers": ["npm", "composer"],
      "matchUpdateTypes": ["minor", "patch"],
      "matchCurrentVersion": "!/^0/",
      "automerge": true,
      "automergeType": "pr",
      "platformAutomerge": true,
      "labels": ["dependencies", "4. to release"],
      "reviewers": []
    },
    {
      "description": "Do not automerge @nextcloud/vue — requires UI testing after updates",
      "matchPackageNames": ["@nextcloud/vue"],
      "automerge": false,
      "labels": ["dependencies", "3. to review"]
    },
    {
      "description": "Group GitHub Actions updates into one PR",
      "matchManagers": ["github-actions"],
      "groupName": "GitHub Actions"
    },
    {
      "description": "Only allow patch-level updates on stable branches",
      "matchBaseBranches": ["/^stable/"],
      "matchUpdateTypes": ["major", "minor"],
      "enabled": false
    }
  ],
  "vulnerabilityAlerts": {
    "enabled": true,
    "semanticCommitType": "fix",
    "schedule": "before 7am every weekday",
    "dependencyDashboardApproval": false,
    "commitMessageSuffix": ""
  },
  "osvVulnerabilityAlerts": true
}