renovate.json

{
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
    "extends": [
        "config:recommended"
    ],
    "branchPrefix": "deps/",
    "labels": [
        "Dependencies"
    ],
    "dependencyDashboardLabels": [
        "Dependencies"
    ],
    "assignees": [],
    "prConcurrentLimit": 10,
    "prHourlyLimit": 0,
    "commitBodyTable": true,
    "rangeStrategy": "bump",
    "timezone": "UTC",
    "configMigration": true,
    "internalChecksFilter": "strict",
    "minimumReleaseAgeBehaviour": "timestamp-optional",
    "logLevelRemap": [
        {
            "matchMessage": "/Some .+ did not have a releaseTimestamp, but as we're running with minimumReleaseAgeBehaviour=timestamp-optional, proceeding/",
            "newLogLevel": "info"
        }
    ],
    "ignorePaths": [
        ".vortex/**"
    ],
    "enabledManagers": [
        "composer",
        "npm",
        "dockerfile",
        "docker-compose",
        "github-actions",
        "custom.regex"
    ],
    "packageRules": [
        {
            "groupName": "PHP - Language version - Skipped to update manually",
            "groupSlug": "php-language-version",
            "matchDepNames": [
                "php"
            ],
            "matchManagers": [
                "composer"
            ],
            "enabled": false
        },
        {
            "groupName": "JavaScript - Language versions - Skipped to update manually",
            "groupSlug": "js-language-versions",
            "matchDepNames": [
                "node",
                "npm"
            ],
            "matchManagers": [
                "npm"
            ],
            "enabled": false
        },
        {
            "description": "Workaround for https://github.com/renovatebot/renovate/issues/24993: avoid bumping constraints with stability flags.",
            "matchManagers": [
                "composer"
            ],
            "matchCurrentValue": "/@(dev|alpha|beta|RC|stable)$/",
            "rangeStrategy": "update-lockfile"
        },
        {
            "groupName": "PHP - All packages - Major - Skipped to update manually",
            "groupSlug": "php-all-major",
            "matchDatasources": [
                "packagist"
            ],
            "matchFileNames": [
                "composer.json"
            ],
            "matchUpdateTypes": [
                "major"
            ],
            "enabled": false,
            "matchPackageNames": [
                "/.*/"
            ]
        },
        {
            "groupName": "PHP - All packages except core - Minor and patch",
            "groupSlug": "php-all-except-core-minor-patch",
            "matchDatasources": [
                "packagist"
            ],
            "matchFileNames": [
                "composer.json"
            ],
            "separateMinorPatch": false,
            "schedule": [
                "before 2am on Sunday"
            ],
            "matchPackageNames": [
                "/.*/",
                "!drupal/core-composer-scaffold",
                "!drupal/core-project-message",
                "!drupal/core-recommended",
                "!drupal/core-dev"
            ],
            "minimumReleaseAge": "14 days",
            "automerge": true
        },
        {
            "description": "Drupal core has no 'minimumReleaseAge', so its security releases are proposed on the next daily run.",
            "groupName": "PHP - Drupal core - Minor and patch",
            "groupSlug": "php-drupal-core-minor-patch",
            "matchFileNames": [
                "composer.json"
            ],
            "schedule": [
                "before 2am"
            ],
            "matchDatasources": [
                "packagist"
            ],
            "matchUpdateTypes": [
                "patch",
                "minor"
            ],
            "matchDepNames": [
                "drupal/core-composer-scaffold",
                "drupal/core-project-message",
                "drupal/core-recommended",
                "drupal/core-dev"
            ],
            "automerge": true
        },
        {
            "groupName": "JavaScript - Non-root packages - Skipped to update manually",
            "groupSlug": "js-non-root",
            "matchDatasources": [
                "npm"
            ],
            "matchFileNames": [
                "**/package.json",
                "!package.json"
            ],
            "enabled": false,
            "matchPackageNames": [
                "/.*/"
            ]
        },
        {
            "groupName": "JavaScript - All packages - Major - Skipped to update manually",
            "groupSlug": "js-all-major",
            "matchDatasources": [
                "npm"
            ],
            "matchFileNames": [
                "package.json"
            ],
            "matchUpdateTypes": [
                "major"
            ],
            "enabled": false,
            "matchPackageNames": [
                "/.*/"
            ]
        },
        {
            "groupName": "JavaScript - All packages - Minor and patch",
            "groupSlug": "js-all-minor-patch",
            "matchDatasources": [
                "npm"
            ],
            "matchFileNames": [
                "package.json"
            ],
            "separateMinorPatch": false,
            "schedule": [
                "before 2am on Sunday"
            ],
            "matchPackageNames": [
                "/.*/"
            ],
            "minimumReleaseAge": "14 days",
            "automerge": true
        },
        {
            "groupName": "Container images - All - Major, minor and patch",
            "groupSlug": "container-images-all-major-minor-patch",
            "matchFileNames": [
                ".docker/**",
                "docker-compose.yml",
                ".circleci/**",
                ".github/workflows/**"
            ],
            "schedule": [
                "before 3am"
            ],
            "matchManagers": [
                "dockerfile",
                "docker-compose",
                "custom.regex"
            ],
            "minimumReleaseAge": "14 days",
            "automerge": true
        },
        {
            "description": "npm packages that CI runs at a pinned version through 'npx'.",
            "groupName": "CI tools - All - Major, minor and patch",
            "groupSlug": "ci-tools-all-major-minor-patch",
            "matchManagers": [
                "custom.regex"
            ],
            "matchDatasources": [
                "npm"
            ],
            "schedule": [
                "before 3am"
            ],
            "minimumReleaseAge": "14 days",
            "automerge": true
        },
        {
            "description": "Renovate publishes several releases a day, so the image that runs Renovate in CircleCI is proposed weekly in a group of its own.",
            "groupName": "CI tools - Renovate - Major, minor and patch",
            "groupSlug": "ci-tools-renovate-major-minor-patch",
            "matchFileNames": [
                ".circleci/update-dependencies.yml"
            ],
            "schedule": [
                "before 3am on Sunday"
            ],
            "minimumReleaseAge": "14 days",
            "automerge": true
        },
        {
            "groupName": "GitHub Actions - All - Major, minor and patch",
            "groupSlug": "github-actions-all-major-minor-patch",
            "schedule": [
                "before 3am"
            ],
            "matchManagers": [
                "github-actions"
            ],
            "pinDigests": true,
            "minimumReleaseAge": "14 days",
            "automerge": true
        }
    ],
    "customManagers": [
        {
            "customType": "regex",
            "managerFilePatterns": [
                "/^docker-compose\\.yml$/"
            ],
            "matchStrings": [
                "IMAGE:\\s*\"?\\${(?:.*):-(?<depName>.*?):(?<currentValue>.*?)(?:\\@sha256:.*)?}\"?"
            ],
            "datasourceTemplate": "docker",
            "versioningTemplate": "docker"
        },
        {
            "customType": "regex",
            "managerFilePatterns": [
                "/^\\.circleci/config\\.yml$/",
                "/^\\.github/workflows/.+\\.yml$/"
            ],
            "matchStrings": [
                "docker run[^\\n]*?\\s(?<depName>[a-z0-9][a-z0-9._\\-]*(?:/[a-z0-9._\\-]+)+):(?<currentValue>v?[0-9][\\w.\\-]*)"
            ],
            "datasourceTemplate": "docker",
            "versioningTemplate": "docker"
        },
        {
            "customType": "regex",
            "managerFilePatterns": [
                "/^\\.circleci/config\\.yml$/",
                "/^\\.github/workflows/.+\\.yml$/"
            ],
            "matchStrings": [
                "npx --yes (?<depName>@?[a-z0-9][a-z0-9._\\-]*(?:/[a-z0-9._\\-]+)?)@(?<currentValue>[0-9][\\w.\\-]*)"
            ],
            "datasourceTemplate": "npm",
            "versioningTemplate": "npm"
        },
        {
            "description": "The image is looked up as the 'renovate' npm package, which records the release dates that 'minimumReleaseAge' needs.",
            "customType": "regex",
            "managerFilePatterns": [
                "/^\\.circleci/update-dependencies\\.yml$/"
            ],
            "matchStrings": [
                "image:\\s*[\"']?(?<depName>renovate/renovate):(?<currentValue>\\d+\\.\\d+\\.\\d+)(?:-[a-z]+)?[\"']?\\s"
            ],
            "packageNameTemplate": "renovate",
            "datasourceTemplate": "npm",
            "versioningTemplate": "npm"
        }
    ]
}