From 75eebb153c4852b1080b5306f98e594bbfc376bd Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 13 Nov 2026 12:09:09 +0000
Subject: [PATCH 1/2] Add renovate.json

---
 renovate.json | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 renovate.json

diff --git a/renovate.json b/renovate.json
new file mode 100644
index 00000000..5db72dd6
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}

From 0fd0acd8a6a53fd5134e4a0d9ab67fb141d13879 Mon Sep 17 00:00:00 2001
From: HeavenVR <git@heavenvr.tech>
Date: Fri, 13 Nov 2026 13:30:18 +0100
Subject: [PATCH 2/2] chore: tune Renovate config and remove Dependabot

Group non-major updates per ecosystem and GitHub Actions updates, run weekly,
wait 3 days after a release, and use chore for all dependency commits.
Dependabot version updates are removed so the two bots don't duplicate PRs.
---
 .github/dependabot.yml              | 42 -----------------------------
 docs/DEVELOPING.md                  |  2 +-
 renovate.json                       | 37 ++++++++++++++++++++++++-
 scripts/ci_build_gate.py            |  2 +-
 scripts/tests/test_ci_build_gate.py |  2 +-
 5 files changed, 39 insertions(+), 46 deletions(-)
 delete mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 08fb49d7..00000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
-version: 2
-updates:
-  # Weekly checks for updates in Github Actions (CI/CD workflows)
-  - package-ecosystem: 'github-actions'
-    directory: '/'
-    schedule:
-      interval: 'weekly'
-      day: monday
-      time: '06:00'
-    groups:
-      ci-cd:
-        patterns:
-          - '*'
-
-  # Weekly checks for pip package updates in build system scripts
-  - package-ecosystem: 'pip'
-    directory: '/'
-    schedule:
-      interval: 'weekly'
-      day: monday
-      time: '06:00'
-    groups:
-      build-system:
-        patterns:
-          - '*'
-
-  # Weekly checks for npm package updates in frontend
-  - package-ecosystem: 'npm'
-    directory: '/frontend'
-    schedule:
-      interval: 'weekly'
-      day: monday
-      time: '06:00'
-    groups:
-      frontend:
-        patterns:
-          - '*'
diff --git a/docs/DEVELOPING.md b/docs/DEVELOPING.md
index 95534f7d..0e1238f5 100644
--- a/docs/DEVELOPING.md
+++ b/docs/DEVELOPING.md
@@ -334,7 +334,7 @@ pnpm install
 pnpm run check && pnpm run lint
 ```
 
-Commit `package.json` and `pnpm-lock.yaml`. Dependabot also opens bumps for these.
+Commit `package.json` and `pnpm-lock.yaml`. Renovate also opens bumps for these.
 
 ### FlatBuffers schemas
 
diff --git a/renovate.json b/renovate.json
index 5db72dd6..3eea7381 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,6 +1,41 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended"
+    "config:recommended",
+    ":semanticCommitTypeAll(chore)",
+    "helpers:pinGitHubActionDigests",
+    "schedule:weekly"
+  ],
+  "minimumReleaseAge": "3 days",
+  "packageRules": [
+    {
+      "description": "One PR for all non-major npm updates",
+      "matchManagers": ["npm"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "npm non-major"
+    },
+    {
+      "description": "One PR for all non-major Python updates",
+      "matchManagers": ["pip_requirements", "pep621"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "python non-major"
+    },
+    {
+      "description": "One PR for all GitHub Actions updates",
+      "matchManagers": ["github-actions"],
+      "matchDepTypes": ["action"],
+      "groupName": "github-actions"
+    },
+    {
+      "description": "pnpm overrides are security floors for transitive packages, not versions to bump",
+      "matchManagers": ["npm"],
+      "matchDepTypes": ["pnpm-workspace.overrides", "pnpm.overrides", "overrides"],
+      "enabled": false
+    },
+    {
+      "description": "Our own packages skip the release-age delay, as in pnpm-workspace.yaml",
+      "matchPackageNames": ["@openshock/**"],
+      "minimumReleaseAge": null
+    }
   ]
 }
diff --git a/scripts/ci_build_gate.py b/scripts/ci_build_gate.py
index 584148cd..774b8e8a 100644
--- a/scripts/ci_build_gate.py
+++ b/scripts/ci_build_gate.py
@@ -30,7 +30,7 @@
     re.compile(r'(^|/)\.gitkeep$'),
     re.compile(r'^\.claude/'),
     re.compile(r'^\.github/ISSUE_TEMPLATE/'),
-    re.compile(r'^\.github/dependabot\.yml$'),
+    re.compile(r'^renovate\.json$'),
     # Dev-only schema submodule and its codegen helpers; builds use the generated sources.
     re.compile(r'^schemas(/|$)'),
     re.compile(r'^scripts/(fetch_flatc\.py|generate_schemas\.py|flatc|flatc\.exe)$'),
diff --git a/scripts/tests/test_ci_build_gate.py b/scripts/tests/test_ci_build_gate.py
index 0e3e45d2..2066cde6 100644
--- a/scripts/tests/test_ci_build_gate.py
+++ b/scripts/tests/test_ci_build_gate.py
@@ -140,7 +140,7 @@ def test_nightly_with_unchanged_sha_skips():
     '.gitkeep',
     '.claude/settings.json',
     '.github/ISSUE_TEMPLATE/bug_report.yml',
-    '.github/dependabot.yml',
+    'renovate.json',
     'schemas',
     'schemas/HubToGatewayMessage.fbs',
     'scripts/fetch_flatc.py',