{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "description": "Every push to main builds new latest images that auto-updating installs pick up within minutes, so nothing is automerged: every update is a PR to review and merge by hand. Updates are grouped and opened weekly, on Fridays, so they can be reviewed and merged before the weekend; security fixes come in immediately. The Test workflow checks every PR.",
  "extends": ["config:recommended"],
  "timezone": "Europe/Brussels",
  "labels": ["renovate"],
  "schedule": ["* * * * 5"],
  "minimumReleaseAge": "3 days",
  "osvVulnerabilityAlerts": true,
  "vulnerabilityAlerts": {
    "labels": ["renovate", "security"]
  },
  "packageRules": [
    {
      "description": "Python and npm minor/patch updates: one PR per week",
      "matchManagers": ["pip_requirements", "npm"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "non-major dependencies"
    },
    {
      "description": "Base images in the Dockerfiles (python, node, nginx): one PR, also for minor bumps such as Python 3.13 to 3.14",
      "matchManagers": ["dockerfile"],
      "groupName": "Docker base images"
    },
    {
      "description": "GitHub Actions: one PR, majors included",
      "matchManagers": ["github-actions"],
      "groupName": "GitHub Actions"
    }
  ]
}