From 21150ff09f3a89da133e9fff8a00865457ab2824 Mon Sep 17 00:00:00 2001
From: Leitwolf11 <leitwolf1112@gmail.com>
Date: Sat, 10 Oct 2026 22:29:58 +0300
Subject: [PATCH] Hand version updates to Renovate

Renovate proposes the version updates of this repository from now on.
It watches what Dependabot watched, looks once a week, takes a release
a week after it is published, opens one pull request for each kind of
dependency with at most two open, and rebases a pull request only when
it conflicts. A dashboard issue lists what is pending.

The Dependabot configuration is removed, which turns its version
updates off. Dependabot keeps its alerts and its security updates,
which are repository settings. Renovate does not open its own pull
requests for vulnerabilities, so one advisory does not get two fixes.

The configuration passes Renovate's validator and takes effect when
the Renovate app is installed on the repository.
---
 .github/dependabot.yml                  | 18 ----------
 .github/renovate.json5                  | 46 +++++++++++++++++++++++++
 .github/workflows/dependency-review.yml |  2 +-
 3 files changed, 47 insertions(+), 19 deletions(-)
 delete mode 100644 .github/dependabot.yml
 create mode 100644 .github/renovate.json5

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index df20df0..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
-# SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-1.1
-
-version: 2
-updates:
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-  - package-ecosystem: gradle
-    directory: /
-    schedule:
-      interval: weekly
-  - package-ecosystem: pip
-    directory: /
-    schedule:
-      interval: weekly
-
diff --git a/.github/renovate.json5 b/.github/renovate.json5
new file mode 100644
index 0000000..37fa078
--- /dev/null
+++ b/.github/renovate.json5
@@ -0,0 +1,46 @@
+// SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+// SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-1.1
+
+// Renovate proposes the version updates of this repository. Dependabot keeps
+// its alerts and its security updates, which are repository settings; its
+// version updates are off, so that two bots do not open the same pull
+// request.
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  extends: ["config:recommended", "helpers:pinGitHubActionDigests"],
+
+  timezone: "Europe/Istanbul",
+  // Once a week, before the working day.
+  schedule: ["before 6am on monday"],
+
+  // A release is taken a week after it is published: one that turns out to
+  // be broken or malicious is usually withdrawn within days.
+  minimumReleaseAge: "7 days",
+
+  // A pull request is rebased when it conflicts, not whenever the default
+  // branch moves, so that a merge does not start the tests of every open
+  // update again.
+  rebaseWhen: "conflicted",
+  prConcurrentLimit: 2,
+  prHourlyLimit: 2,
+
+  // One issue lists what is pending, so an update need not be a pull request
+  // to be seen.
+  dependencyDashboard: true,
+
+  // Security fixes come from Dependabot security updates. Renovate does not
+  // open its own for the same advisory.
+  vulnerabilityAlerts: { enabled: false },
+
+  ignorePaths: ["legacy/**", "third_party/**", "**/node_modules/**"],
+
+  // What Dependabot watched here, and nothing more for now.
+  enabledManagers: ["github-actions", "gradle", "gradle-wrapper", "pip_requirements"],
+
+  // One pull request for each kind of dependency.
+  packageRules: [
+    { matchManagers: ["github-actions"], groupName: "GitHub Actions" },
+    { matchManagers: ["gradle", "gradle-wrapper"], groupName: "Gradle plugins and libraries" },
+    { matchManagers: ["pip_requirements"], groupName: "Python tools of CI" },
+  ],
+}
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 83ac0c5..ea2f2cf 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -5,7 +5,7 @@ name: Dependency Review
 
 # Looks at the dependencies a pull request adds or changes, and fails when
 # one of them has a known vulnerability of high severity or worse.
-# Dependabot watches what is already there; this holds what comes in.
+# Dependabot alerts report what is already there; this holds what comes in.
 
 on:
   pull_request: