renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:best-practices", ":semanticCommits"],
  "labels": ["dependencies"],
  "timezone": "Pacific/Auckland",
  "schedule": ["before 9am on monday"],
  "osvVulnerabilityAlerts": true,
  "rebaseWhen": "conflicted",
  "prConcurrentLimit": 10,
  "abandonmentThreshold": null,
  "lockFileMaintenance": {
    "enabled": true,
    "automerge": true,
    "schedule": ["before 6am on monday"]
  },
  "packageRules": [
    {
      "description": "Auto-merge minor/patch PRs when CI passes (7-day wait, stricter than the 3-day default)",
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true,
      "automergeType": "pr",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Auto-open PRs for major updates; review manually",
      "matchUpdateTypes": ["major"],
      "automerge": false
    },
    {
      "description": "TypeScript 7 breaks collection-reviewer-web's Next.js build (Next fails to detect TypeScript, build worker crashes with \"The id argument must be of type string\") - CI doesn't cover this subproject so this won't show as a failing check, hold off until Next.js/TS7 compatibility is confirmed manually",
      "matchPackageNames": ["typescript"],
      "matchUpdateTypes": ["major"],
      "enabled": false
    },
    {
      "description": "React (collection-reviewer-web)",
      "groupName": "React",
      "matchPackageNames": ["/^react/", "/^@types/react/"]
    },
    {
      "description": "Next.js (collection-reviewer-web)",
      "groupName": "Next.js",
      "matchPackageNames": ["/^next/", "/^@next//", "/^eslint-config-next/"]
    },
    {
      "description": "AWS's own Swift Lambda packages tend to release in lockstep; keep them in one PR",
      "groupName": "Swift AWS Lambda runtime",
      "matchManagers": ["swift"],
      "matchPackageNames": [
        "awslabs/swift-aws-lambda-runtime",
        "swift-server/swift-aws-lambda-events"
      ]
    },
    {
      "description": "swift-async-algorithms is pinned to >=1.1.4 in Package.swift to work around a region-isolation build failure with newer Swift compilers (see the comment there) — require manual review on every update, not just majors",
      "matchManagers": ["swift"],
      "matchPackageNames": ["apple/swift-async-algorithms"],
      "automerge": false
    }
  ],
  "customManagers": [
    {
      "customType": "regex",
      "description": "Track the Swift base image pinned in scripts/build.sh — still the real build path, since the SAM Makefile's build-NZImageApiFunction target calls this script",
      "managerFilePatterns": ["/^scripts/build\\.sh$/"],
      "matchStrings": ["swift:(?<currentValue>[\\w.\\-]+)\\s*\\\\"],
      "depNameTemplate": "swift",
      "datasourceTemplate": "docker",
      "versioningTemplate": "docker"
    }
  ]
}