renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":dependencyDashboard",
    ":semanticCommits",
    "security:openssf-scorecard"
  ],
  "timezone": "Europe/Berlin",
  "schedule": ["before 6am on monday"],
  "labels": ["dependencies"],
  "rangeStrategy": "bump",
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["before 6am on the first day of the month"]
  },
  "vulnerabilityAlerts": {
    "labels": ["security"],
    "schedule": ["at any time"]
  },
  "packageRules": [
    {
      "description": "Patch and minor updates ride together; majors stay separate so they get read.",
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "non-major dependencies"
    },
    {
      "description": "Keep the Rust toolchain current — this crate uses inline assembly and target specifics.",
      "matchManagers": ["custom.regex"],
      "matchPackageNames": ["rust"],
      "groupName": "rust toolchain"
    }
  ]
}