renovate.json5

{
  $schema: "https://docs.renovatebot.com/renovate-schema.json",
  extends: [
    "config:recommended",
    // Append a "Signed-off-by" trailer to every commit so the DCO check passes.
    ":gitSignOff",
    // Use Conventional Commit messages (e.g. "chore(deps): ...") so commitlint passes.
    ':semanticCommitTypeAll(chore)',
  ],

  "dependencyDashboard": false,

  // Check once a week, early Wednesday, so updates land in one predictable batch.
  timezone: "UTC",
  schedule: ["before 5am on wednesday"],

  // Open a PR for every outdated dependency across all ecosystems Renovate
  // detects here — Go (go.mod), the npm trees (sdks/typescript, examples/typescript,
  // web/dashboard), Python (sdks/python/pyproject.toml, examples/python/requirements.txt),
  // Dockerfiles, GitHub Actions, and the Helm chart. No dependency-dashboard
  // approval gate and no rate limiting, so nothing is held back.
  prConcurrentLimit: 0,
  prHourlyLimit: 0,
  labels: ["dependencies"],

  // Hold every update until the release is at least three days old, and keep a
  // not-yet-aged update out of PRs entirely (internalChecksFilter: strict)
  // rather than opening a pending one. pnpm 11 enforces a one-day
  // minimumReleaseAge supply-chain policy on the lockfile, so a PR raised the
  // moment a version publishes fails the frozen-lockfile lint; waiting past
  // that window keeps dependency PRs green.
  minimumReleaseAge: "3 days",
  internalChecksFilter: "strict",

  // Keep go.mod/go.sum tidy after a Go module update.
  postUpdateOptions: ["gomodTidy"],

  // Refresh lock files (package-lock.json, go.sum, ...) on the same weekly cadence.
  lockFileMaintenance: {
    enabled: true,
    schedule: ["before 5am on wednesday"],
  },
}