renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended", ":automergeRequireAllStatusChecks"],
  "schedule": ["after 6pm and before 11pm"],
  "dependencyDashboard": true,
  "timezone": "Europe/London",
  "lockFileMaintenance": {
    "enabled": true,
    "automerge": true
  },
  "packageRules": [
    {
      "description": "grammY core + plugins move in lockstep: the plugins peer-depend on grammy ^1.x, so a grammy major breaks all three until they ship matching majors.",
      "matchPackageNames": [
        "grammy",
        "@grammyjs/auto-retry",
        "@grammyjs/files",
        "@grammyjs/runner"
      ],
      "groupName": "grammy"
    },
    {
      "description": "Automerge non-major runtime deps — CI (typecheck + compile + test) gates every merge.",
      "matchDepTypes": ["dependencies"],
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true
    },
    {
      "description": "Automerge devDependencies (types/tooling).",
      "matchDepTypes": ["devDependencies"],
      "automerge": true
    },
    {
      "description": "Automerge GitHub Actions bumps.",
      "matchManagers": ["github-actions"],
      "matchUpdateTypes": ["minor", "patch", "digest"],
      "automerge": true
    },
    {
      "description": "Majors get a manual PR + a 3-day soak (a yanked/re-tagged release settles before it's offered) — a green test run still misses runtime behavior changes. Patch/minor auto-merge with no soak (CI-gated).",
      "matchUpdateTypes": ["major"],
      "minimumReleaseAge": "3 days",
      "automerge": false
    },
    {
      "description": "Anthropic Agent SDK stack — grouped + manual. agent-sdk peers @modelcontextprotocol/sdk ^1.29 and zod ^4 (so zod's major is pinned by it); it is 0.x, so minors are breaking, and tests miss runtime paths (setModel saga). Review by hand. Listed last so it overrides the automerge rules above.",
      "matchPackageNames": ["@anthropic-ai/claude-agent-sdk", "@modelcontextprotocol/sdk", "zod"],
      "groupName": "anthropic-ai sdk stack",
      "automerge": false
    },
    {
      "description": "bunfig.toml quarantines any npm release younger than 7 days (minimumReleaseAge). Renovate must not offer one: bun then refuses to resolve the new pin, the lock-file update fails, and the PR lands a package.json bump with no matching lock entry (prettier 3.9.7, #109). Keep this number equal to bunfig's. Placed after the major rule so it overrides that 3-day soak for bun deps.",
      "matchManagers": ["bun"],
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Mirrors minimumReleaseAgeExcludes in bunfig.toml — bun does not quarantine the Agent SDK, so gating it here would only delay it.",
      "matchPackageNames": ["@anthropic-ai/claude-agent-sdk"],
      "minimumReleaseAge": "0 days"
    },
    {
      "description": "Pin @types/node to the Node 24 LTS line. Bun targets Node 24, so the types must match; a mismatch surfaces APIs Bun doesn't implement. @types/node is an `overrides` entry (Renovate manages overrides as deps and kept proposing the v26 major), so cap it here — 24.x patches/minors still flow.",
      "matchPackageNames": ["@types/node"],
      "allowedVersions": "<25"
    }
  ]
}