renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "description": "Run by the hosted Mend Renovate App (github.com/apps/renovate). No self-hosted workflow \u2014 see issue #877 for the migration rationale.",
  "extends": [
    "config:recommended",
    ":automergePatch",
    ":maintainLockFilesWeekly",
    ":enableVulnerabilityAlerts"
  ],
  "gitAuthor": "Rotorsoft Renovate <41707007+Rotorsoft@users.noreply.github.com>",
  "rebaseWhen": "conflicted",
  "dependencyDashboard": true,
  "enabledManagers": ["npm", "github-actions"],
  "minimumReleaseAge": "3 days",
  "schedule": ["before 5am on monday"],
  "prConcurrentLimit": 10,
  "prHourlyLimit": 0,
  "suppressNotifications": ["prEditedNotification", "prIgnoreNotification"],
  "packageRules": [
    {
      "groupName": "Non-major dependencies",
      "matchUpdateTypes": ["minor", "patch"]
    },
    {
      "matchDepTypes": ["devDependencies"],
      "groupName": "Dev dependencies"
    },
    {
      "groupName": "Types packages",
      "matchPackageNames": ["/^@types//"]
    },
    {
      "matchManagers": ["github-actions"],
      "matchPackageNames": ["node"],
      "minimumReleaseAge": "30 days"
    },
    {
      "description": "pnpm overrides are security pins, not feature upgrades. They force a transitive dep to the latest fix *within the major its consumers are written against*. A major bump jumps the override target past that major, leaving peers unsatisfied and breaking builds. Closed #1102/#1103/#1104 (and #1162/#1163/#1164 after the pins moved to pnpm-workspace.yaml) for exactly this. Patch/minor on overrides is still fine. Matched by file because the pins live in pnpm-workspace.yaml since the pnpm settings migration; the depType rule alone stopped matching there.",
      "matchUpdateTypes": ["major"],
      "enabled": false,
      "matchFileNames": ["pnpm-workspace.yaml"]
    },
    {
      "description": "Same guard for pnpm.overrides if any pin ever moves back into package.json.",
      "matchDepTypes": ["pnpm.overrides"],
      "matchUpdateTypes": ["major"],
      "enabled": false
    },
    {
      "description": "The docs package is a deliberate TypeScript 6 island (CLAUDE.md \u00a7 Important Constraints). typedoc caps its `typescript` peer at 6.x, and on TS7 it dies inside typedoc reading 'PropertyDeclaration', taking `pnpm -F docs build:all` with it; `check:snippets` fails separately with 'ts.createProgram is not a function', since the TS7 native compiler does not expose the JS API that script uses. The rest of the workspace is on TS7 and pnpm's per-package isolation keeps the two apart. Closed #1342 for exactly this. Revisit when typedoc supports TS7 \u2014 and delete this rule then rather than widening it.",
      "matchFileNames": ["docs/package.json"],
      "matchPackageNames": ["typescript"],
      "matchUpdateTypes": ["major"],
      "enabled": false
    }
  ],
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["before 3am on monday"]
  },
  "rangeStrategy": "bump"
}