.renovaterc.json5

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":semanticCommitsDisabled"
  ],
  "prHourlyLimit": 20,
  "addLabels": [
    "renovate"
  ],
  "osvVulnerabilityAlerts": true,
  // always bump depdenencies even when are in the range
  "rangeStrategy": "bump",
  "vulnerabilityAlerts": {
    "labels": [
      "security"
    ],
    "rangeStrategy": "bump",
    // security fixes must not be delayed by minimumReleaseAge
    "minimumReleaseAge": "0 days",
  },
  // disable autorebasing to save unecessary workflow runs
  "rebaseWhen": "conflicted",
  // hold updates that do not yet satisfy minimumReleaseAge instead of raising a
  // pending PR (which would run CI and fail pnpm's minimumReleaseAge policy)
  "internalChecksFilter": "strict",
  "ignoreDeps": [
    // it must be the same as bundled in Electron
    "node",
    // it must be the oldest possible version to get binary compatibility with older OSes
    "ubuntu"
  ],
  // mise.lock pins a checksum and a URL per tool per platform, but a local
  // `mise install` re-locks only the platform it runs on and silently leaves
  // the other seven stale. Lock file maintenance runs plain `mise lock`, which
  // refreshes every tool on every platform already in the file. Defaults are
  // disabled and weekly, hence the explicit settings; the packageRules below
  // keep it to mise.lock, since pnpm-lock.yaml is maintained by its own
  // workflows and does not want a periodic refresh PR.
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": [
      "at any time"
    ],
    "automerge": true
  },
  "packageRules": [
    {
      "matchUpdateTypes": [
        "lockFileMaintenance"
      ],
      "enabled": false
    },
    {
      "matchManagers": [
        "mise"
      ],
      "matchUpdateTypes": [
        "lockFileMaintenance"
      ],
      "enabled": true
    },
    // delay npm updates until they satisfy pnpm's minimumReleaseAge policy
    // (default 1 day since pnpm v11); only npm packages land in pnpm-lock.yaml,
    // so scope this to the npm datasource and leave other datasources untouched
    {
      "matchDatasources": [
        "npm"
      ],
      "minimumReleaseAge": "25 hours"
    },
    // peerDependencies are widen
    {
      "matchDepTypes": [
        "peerDependencies"
      ],
      "rangeStrategy": "widen",
      "semanticCommitScope": "peer-deps"
    },
    // non-major updates only
    {
      "matchDepNames": [
        "electron",
        "npm"
      ],
      "matchUpdateTypes": [
        "major"
      ],
      "enabled": false
    },
    // patch updates only
    {
      "matchDepNames": [
        "@types/node",
      ],
      "matchUpdateTypes": [
        "major",
        "minor"
      ],
      "enabled": false
    },
    // packages that misuse semver
    {
      "matchDepNames": [
        "node-pty"
      ],
      "versioning": "deb",
      "enabled": true
    },
    // bundle
    {
      "groupName": "electron-builder bundle",
      "matchDepNames": [
        "electron-builder",
        "electron-builder-squirrel-windows"
      ]
    },
    // monorepo
    {
      "groupName": "ogre-tools monorepo",
      "matchSourceUrls": [
        "https://github.com/ogre-works/ogre-tools"
      ]
    }
  ],
  "customManagers": [
    // bundled freelens-k8s-proxy
    {
      "customType": "regex",
      "extractVersionTemplate": "^(?<version>.*)$",
      "managerFilePatterns": [
        "/^freelens/package\\.json$/"
      ],
      "matchStrings": [
        "\"k8sProxyVersion\":\\s*\"(?<currentValue>\\d+\\.\\d+\\.\\d+)\""
      ],
      "datasourceTemplate": "github-releases",
      "depNameTemplate": "freelensapp/freelens-k8s-proxy",
      "versioningTemplate": "semver"
    },
    // bundled helm
    {
      "customType": "regex",
      "extractVersionTemplate": "^(?<version>.*)$",
      "managerFilePatterns": [
        "/^freelens/package\\.json$/"
      ],
      "matchStrings": [
        "\"bundledHelmVersion\":\\s*\"(?<currentValue>\\d+\\.\\d+\\.\\d+)\""
      ],
      "datasourceTemplate": "github-releases",
      "depNameTemplate": "helm/helm",
      "versioningTemplate": "semver"
    },
    // pnpm dlx
    {
      "customType": "regex",
      "extractVersionTemplate": "^(?<version>.*)$",
      "managerFilePatterns": [
        "/package\\.json$/"
      ],
      "matchStrings": [
        "pnpm\\s+dlx\\s+(?<depName>\\S+)@(?<currentValue>\\S+?)[\\s\"|<>]"
      ],
      "datasourceTemplate": "npm",
      "versioningTemplate": "npm"
    },
    // renovate hints after comment
    {
      "customType": "regex",
      "extractVersionTemplate": "^v?(?<version>.*)$",
      "managerFilePatterns": [
        "/^\\.github/workflows/.*\\.ya?ml$/",
        "/^\\.trunk/trunk.yaml/",
        "/^\\.tool-versions$/",
        "/^freelens/electron-builder\\.yml$/"
      ],
      "matchStrings": [
        "(\\s+|.*?@)(?<currentValue>\\S+?)!?\\s*#\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)(\\s+versioning=(?<versioning>\\S+))?(\\s+registryUrl=(?<registryUrl>\\S+))?\\s*\\n"
      ],
      "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver{{/if}}"
    }
  ]
}