renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":automergeRequireAllStatusChecks",
    ":separateMultipleMajorReleases",
    ":configMigration",
    "group:rust-futuresMonorepo",
    "helpers:pinGitHubActionDigests",
    "docker:disable",
    ":maintainLockFilesWeekly"
  ],
  "schedule": "* 0-3 * * 1#2,1#4",
  "autoApprove": true,
  "automergeStrategy": "squash",
  "prHourlyLimit": 0,
  "prConcurrentLimit": 20,
  "rebaseWhen": "conflicted",
  "labels": [
    "changelog/chore"
  ],
  "minor": { "enabled": false },
  "patch": { "enabled": false },
  "osvVulnerabilityAlerts": true,
  "vulnerabilityAlerts": {
    "enabled": true,
    "vulnerabilityFixStrategy": "lowest"
  },
  "npmrc": "allow-remote=all",
  "npmrcMerge": true,
  "packageRules": [
    {
      "description": "Wait 7 days after a release before proposing it, so most malicious publishes are found and removed upstream first. Security updates skip this wait. Lock file maintenance has no package name, so this rule does not reach it; see the lock file maintenance rules below.",
      "matchPackageNames": ["*"],
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "vortex-data and vortex-data-cuda are built from this repository, not taken from PyPI.",
      "matchDatasources": ["pypi"],
      "matchPackageNames": ["vortex-data", "vortex-data-cuda"],
      "enabled": false
    },
    {
      "description": "vortex-python-cuda is not a uv workspace member and pins the unpublished vortex-data==0.1.0, so uv cannot lock it from its own directory. The workspace uv.lock already includes its dependencies.",
      "matchFileNames": ["vortex-python-cuda/pyproject.toml"],
      "matchUpdateTypes": ["lockFileMaintenance"],
      "enabled": false
    },
    {
      "matchPackageNames": [
        "ubuntu",
        "python"
      ],
      "enabled": false
    },
    {
      "groupName": "arrow-rs",
      "matchManagers": ["cargo"],
      "matchUpdateTypes": [
        "major"
      ],
      "matchSourceUrls": [
        "https://github.com/apache/arrow-rs"
      ]
    },
    {
      "description": "Do not split lance-bench grouped majors by target major",
      "matchManagers": [
        "cargo"
      ],
      "matchFileNames": [
        "benchmarks/lance-bench/Cargo.toml"
      ],
      "separateMultipleMajor": false
    },
    {
      "description": "Keep lance-bench dependency majors together because they are tested as one benchmark stack",
      "groupName": "lance benchmark dependencies",
      "groupSlug": "lance-bench",
      "matchManagers": [
        "cargo"
      ],
      "matchFileNames": [
        "benchmarks/lance-bench/Cargo.toml"
      ],
      "matchUpdateTypes": [
        "major"
      ]
    },
    {
      "groupName": "flatbuffers",
      "matchSourceUrls": [
        "https://github.com/google/flatbuffers"
      ]
    },
    {
      "groupName": "tonic",
      "matchSourceUrls": [
        "https://github.com/hyperium/tonic"
      ]
    },
    {
      "description": "Disable routine npm dependency updates; keep security alerts and lock file maintenance",
      "matchManagers": [
        "npm"
      ],
      "matchUpdateTypes": [
        "digest",
        "major",
        "minor",
        "patch",
        "pin",
        "replacement"
      ],
      "enabled": false
    },
    {
      "description": "Keep pinned GitHub Actions current, in one PR per run. minor and patch are off above so Cargo.toml floors don't rise on downstream users, but actions have no downstream users: without this, the actions pinned to an exact version (actions/cache v6.1.0, crate-ci/typos, and about 30 more) would never get a patch release, security fixes included.",
      "matchManagers": ["github-actions"],
      "matchUpdateTypes": ["minor", "patch", "digest"],
      "enabled": true,
      "groupName": "GitHub Actions",
      "groupSlug": "github-actions"
    },
    {
      "description": "Do not split vortex-web's grouped majors by target major, so they share one PR",
      "matchManagers": [
        "npm"
      ],
      "matchFileNames": [
        "vortex-web/package.json"
      ],
      "separateMultipleMajor": false
    },
    {
      "description": "Propose major updates for the explore app in vortex-web, all in one PR per run. Lock file maintenance already takes compatible releases, but without this a new major (Vite, React, Storybook) never arrives. Not automerged: a person reviews the group. vortex-web installs with Bun; Renovate's npm manager also reads and updates bun.lock.",
      "matchManagers": [
        "npm"
      ],
      "matchFileNames": [
        "vortex-web/package.json"
      ],
      "matchUpdateTypes": [
        "major"
      ],
      "enabled": true,
      "automerge": false,
      "groupName": "vortex-web major updates",
      "groupSlug": "vortex-web-major",
      "groupSingleUpdates": true
    },
    {
      "groupName": "Rust lock file maintenance",
      "groupSlug": "rust-lock-file-maintenance",
      "matchManagers": [
        "cargo"
      ],
      "matchUpdateTypes": [
        "lockFileMaintenance"
      ]
    },
    {
      "description": "Renovate cannot apply minimumReleaseAge to uv lock file maintenance. The 7-day wait comes from exclude-newer in pyproject.toml instead.",
      "groupName": "Python lock file maintenance",
      "groupSlug": "python-lock-file-maintenance",
      "matchManagers": [
        "pep621"
      ],
      "matchUpdateTypes": [
        "lockFileMaintenance"
      ]
    },
    {
      "description": "Renovate passes the 7-day wait to npm as --before, for .github/vercel-cli. It cannot pass the wait to Bun, so for vortex-web the minimumReleaseAge in vortex-web/bunfig.toml enforces it. A lock refresh has no release timestamp, so timestamp-optional lets its stability check pass instead of holding the branch forever; npm's --before and bunfig.toml still apply the wait. The top-level npmrc sets allow-remote=all only for Renovate's npm runs: npm 12 refuses some registry tarballs of packages with bundleDependencies (npm/cli#9800). vortex-web had one but now installs with Bun, and the .github/vercel-cli tree has none today. The npmrc stays in case a Vercel CLI update brings one in. Remove it when the bug is fixed.",
      "groupName": "JS lock file maintenance",
      "groupSlug": "js-lock-file-maintenance",
      "matchManagers": [
        "npm"
      ],
      "matchUpdateTypes": [
        "lockFileMaintenance"
      ],
      "minimumReleaseAge": "7 days",
      "minimumReleaseAgeBehaviour": "timestamp-optional"
    }
  ],
  "customManagers": [
    {
      "description": "Update DuckDB version in vortex-duckdb/build.rs",
      "customType": "regex",
      "managerFilePatterns": [
        "/vortex-duckdb/build\\.rs/"
      ],
      "matchStrings": [
        "const DEFAULT_DUCKDB_VERSION: &str = \"(?<currentValue>[0-9]+\\.[0-9]+\\.[0-9]+)\";"
      ],
      "depNameTemplate": "duckdb/duckdb",
      "datasourceTemplate": "github-releases",
      "extractVersionTemplate": "^v?(?<version>.*)$"
    }
  ]
}