renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "enabledManagers": ["github-actions", "npm", "cargo"],
  "dependencyDashboard": true,
  "timezone": "America/Los_Angeles",
  "schedule": ["* * * * 1"],
  "packageRules": [
    {
      "matchManagers": ["npm", "cargo"],
      "rangeStrategy": "update-lockfile"
    },
    {
      "matchManagers": ["github-actions"],
      "groupName": "github-actions",
      "groupSlug": "github-actions",
      "separateMajorMinor": false
    },
    {
      "description": "Require explicit approval for npm majors so framework migrations and runtime/tooling compatibility get a human review before a branch is created",
      "matchManagers": ["npm"],
      "matchUpdateTypes": ["major"],
      "dependencyDashboardApproval": true
    },
    {
      "description": "react and react-dom ship from one repo on one version number, and react-dom's client asserts an exact match against react at runtime — a split bump throws \"Incompatible React versions\" and fails the lib test suites. @types/react-dom peers on @types/react and both describe the runtime pair, so keep all four in one PR",
      "matchManagers": ["npm"],
      "matchPackageNames": [
        "react",
        "react-dom",
        "@types/react",
        "@types/react-dom"
      ],
      "groupName": "react",
      "groupSlug": "react",
      "separateMajorMinor": false
    },
    {
      "description": "React Router framework packages are peered and released together; do not split runtime and build tooling by dependency type",
      "matchManagers": ["npm"],
      "matchPackageNames": ["react-router", "@react-router/**"],
      "groupName": "react-router",
      "groupSlug": "react-router",
      "separateMajorMinor": false
    },
    {
      "description": "Tailwind core and first-party tooling should be tested together",
      "matchManagers": ["npm"],
      "matchPackageNames": ["tailwindcss", "@tailwindcss/**"],
      "groupName": "tailwindcss",
      "groupSlug": "tailwindcss",
      "separateMajorMinor": false
    },
    {
      "description": "Storybook core and its framework/addon packages are versioned in lockstep and their presets import across packages; a partial bump breaks the build, so keep them in one PR",
      "matchManagers": ["npm"],
      "matchPackageNames": ["storybook", "@storybook/**"],
      "groupName": "storybook",
      "groupSlug": "storybook",
      "separateMajorMinor": false
    },
    {
      "description": "Vitest runs on top of Vite and pins a peer Vite version; the Vite plugins are released against a Vite major. Bump them in one PR so a Vite/Vitest peer mismatch never lands split across incompatible versions",
      "matchManagers": ["npm"],
      "matchPackageNames": ["vite", "@vitejs/**", "vitest", "@vitest/**"],
      "groupName": "vite",
      "groupSlug": "vite",
      "separateMajorMinor": false
    },
    {
      "description": "xterm core and its first-party addons ship from one repo on one beta counter, and each addon peers on the exact core beta it was built against — an addon at beta.N requires ^6.1.0-beta.N, which no earlier core beta satisfies. The addons also compile against core internals, so a partial bump lands an unsatisfied peer range and mismatched internals; keep them in one PR. canopy's fork-base pins are excluded below",
      "matchManagers": ["npm"],
      "matchPackageNames": [
        "@xterm/xterm",
        "@xterm/addon-fit",
        "@xterm/addon-unicode-graphemes"
      ],
      "groupName": "xterm",
      "groupSlug": "xterm",
      "separateMajorMinor": false
    },
    {
      "description": "@types/node must track the pinned Node runtime major and must not expose APIs newer than the runtime we bundle",
      "matchManagers": ["npm"],
      "matchPackageNames": ["@types/node"],
      "allowedVersions": ">=24 <25"
    },
    {
      "matchManagers": ["cargo"],
      "groupName": "cargo",
      "groupSlug": "cargo",
      "separateMajorMinor": false
    },
    {
      "matchManagers": ["npm", "cargo"],
      "matchUpdateTypes": ["patch"],
      "minimumReleaseAge": "1 day"
    },
    {
      "matchManagers": ["npm", "cargo"],
      "matchUpdateTypes": ["minor"],
      "minimumReleaseAge": "3 days"
    },
    {
      "matchManagers": ["npm", "cargo"],
      "matchUpdateTypes": ["major"],
      "minimumReleaseAge": "14 days"
    },
    {
      "description": "Pin @types/vscode to match engines.vscode (^1.85.0) so the typed API surface never outruns the declared minimum VS Code runtime",
      "matchManagers": ["npm"],
      "matchPackageNames": ["@types/vscode"],
      "allowedVersions": "1.85.0"
    },
    {
      "description": "tend manages its own action version (the tend bot opens its own update PRs); don't let Renovate bump max-sixty/tend",
      "matchManagers": ["github-actions"],
      "matchPackageNames": ["max-sixty/tend"],
      "enabled": false
    },
    {
      "description": "Node version is governed by devEngines in package.json; don't let Renovate bump node in GitHub Actions workflows",
      "matchManagers": ["github-actions"],
      "matchPackageNames": ["node"],
      "enabled": false
    },
    {
      "description": "dockview-react is slated for removal; stay on ^5.1.0 and don't churn through major breaking changes (e.g. v6) on a dependency that's getting kicked out",
      "matchManagers": ["npm"],
      "matchPackageNames": ["dockview-react"],
      "enabled": false
    },
    {
      "description": "canopy pins the pristine @xterm/addon-webgl AND @xterm/xterm to the exact commit the SDF fork's sdf branch is based on (the addon's beta counter is offset from core's; canopy/README.md records the current correspondence). They are the UpstreamVsFork regression baseline and move in lockstep with the hand-cut @diffplug/xterm-addon-webgl-sdf tarball, which Renovate cannot see, so bumping either one is a manual edit made when the fork rebases — never a Renovate bump (see canopy/README.md and docs/specs/webgl-text.md). File-scoped: lib and standalone still track upstream betas via the xterm group above. Must stay last; later rules win",
      "matchManagers": ["npm"],
      "matchFileNames": ["canopy/package.json"],
      "matchPackageNames": ["@xterm/**"],
      "enabled": false
    }
  ]
}