From dbfe29b5665837e3c7153bde7c892354b0fc9941 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 13 Nov 2026 12:09:19 +0000
Subject: [PATCH 1/2] Add renovate.json

---
 renovate.json | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 renovate.json

diff --git a/renovate.json b/renovate.json
new file mode 100644
index 00000000..5db72dd6
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}

From 8a190080641771d86267a2996c6e13b9f32959b0 Mon Sep 17 00:00:00 2001
From: HeavenVR <git@heavenvr.tech>
Date: Fri, 13 Nov 2026 13:30:18 +0100
Subject: [PATCH 2/2] chore: tune Renovate config and remove Dependabot

Group non-major updates per ecosystem and GitHub Actions updates, run weekly,
wait 3 days after a release, and use chore for all dependency commits.
Dependabot version updates are removed so the two bots don't duplicate PRs.
---
 .github/dependabot.yml                 | 32 --------------------
 .github/workflows/update-toolchain.yml |  2 +-
 renovate.json                          | 42 +++++++++++++++++++++++++-
 3 files changed, 42 insertions(+), 34 deletions(-)
 delete mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 4b6ea5cd..00000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
-version: 2
-updates:
-  # Check for Nuget package updates
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-      time: '10:00'
-    groups:
-      npm:
-        patterns:
-          - '*' # Group all updates together
-
-  # Check for Github Actions version updates (for CI/CD)
-  - package-ecosystem: github-actions
-    directories:
-      - /
-      - /.github/actions/* # composite actions are not covered by `/`
-    schedule:
-      interval: weekly
-      day: monday
-      time: '10:00'
-    groups:
-      github-actions:
-        patterns:
-          - '*' # Group all updates together
diff --git a/.github/workflows/update-toolchain.yml b/.github/workflows/update-toolchain.yml
index 1174eff8..b7754c1d 100644
--- a/.github/workflows/update-toolchain.yml
+++ b/.github/workflows/update-toolchain.yml
@@ -1,6 +1,6 @@
 on:
   schedule:
-    - cron: '0 6 * * 1' # weekly, Monday 06:00 UTC — matches dependabot.yml's cadence
+    - cron: '0 6 * * 1' # weekly, Monday 06:00 UTC — same day as Renovate's weekly schedule
   workflow_dispatch: # Manually invoked by user.
 
 name: update-toolchain
diff --git a/renovate.json b/renovate.json
index 5db72dd6..7bd50aee 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,6 +1,46 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended"
+    "config:recommended",
+    ":semanticCommitTypeAll(chore)",
+    "helpers:pinGitHubActionDigests",
+    "schedule:weekly"
+  ],
+  "minimumReleaseAge": "3 days",
+  "packageRules": [
+    {
+      "description": "One PR for all non-major npm updates",
+      "matchManagers": ["npm"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "npm non-major"
+    },
+    {
+      "description": "One PR for all GitHub Actions updates",
+      "matchManagers": ["github-actions"],
+      "matchDepTypes": ["action"],
+      "groupName": "github-actions"
+    },
+    {
+      "description": "pnpm overrides are security floors for transitive packages, not versions to bump",
+      "matchManagers": ["npm"],
+      "matchDepTypes": ["pnpm-workspace.overrides", "pnpm.overrides", "overrides"],
+      "enabled": false
+    },
+    {
+      "description": "Our own packages skip the release-age delay, as in pnpm-workspace.yaml",
+      "matchPackageNames": ["@openshock/**"],
+      "minimumReleaseAge": null
+    },
+    {
+      "description": "The pnpm patch is keyed to an exact SignalR version, so bumps need the patch refreshed by hand",
+      "matchPackageNames": ["@microsoft/signalr"],
+      "groupName": null
+    },
+    {
+      "description": "Node, pnpm and the base image are bumped together by .github/workflows/update-toolchain.yml",
+      "matchFileNames": [".nvmrc", "Dockerfile", "package.json"],
+      "matchDepNames": ["node", "pnpm"],
+      "enabled": false
+    }
   ]
 }