From af245cb1a155efe87a1708db58c08fc202dc3b42 Mon Sep 17 00:00:00 2001
From: Renovate Bot <renovate-bot@fabledsword.com>
Date: Thu, 21 May 2026 04:01:28 +0000
Subject: [PATCH 1/2] Add renovate.json

---
 renovate.json | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 renovate.json

diff --git a/renovate.json b/renovate.json
new file mode 100644
index 00000000..5db72dd6
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}
-- 
2.52.0


From 807b05558380852f50403fb45e49ce2856efa449 Mon Sep 17 00:00:00 2001
From: bvandeusen <bryan.vandeusen@fabledsword.com>
Date: Sun, 7 Jun 2026 11:59:12 -0400
Subject: [PATCH 2/2] chore: tune Renovate config (group, throttle, automerge
 minor/patch, hold majors)

- Target dev (deps flow through the dev->main batch; automerge works on the
  unprotected branch) instead of opening PRs straight against protected main.
- Ignore flutter_client/** -- the Flutter client is retired/legacy; drop the
  ~9 Flutter dep PRs and keep Android-native + server + web updates.
- Auto-merge GREEN patch/minor/digest/pin bumps; hold ALL majors behind
  dependency-dashboard approval (labelled deps:major) for manual review.
- Group Go modules, CI actions, Docker images, Android Gradle, and web npm
  non-major bumps into single PRs to cut noise.
- Throttle: weekend schedule, prHourlyLimit 2; monthly lockfile maintenance.
---
 renovate.json | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 56 insertions(+), 1 deletion(-)

diff --git a/renovate.json b/renovate.json
index 5db72dd6..3d6ea392 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,6 +1,61 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended"
+    "config:recommended",
+    ":semanticCommits"
+  ],
+  "baseBranches": ["dev"],
+  "timezone": "America/New_York",
+  "schedule": ["every weekend"],
+  "prHourlyLimit": 2,
+  "prConcurrentLimit": 8,
+  "ignorePaths": [
+    "**/node_modules/**",
+    "**/vendor/**",
+    "flutter_client/**"
+  ],
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": ["before 5am on the first day of the month"]
+  },
+  "packageRules": [
+    {
+      "description": "Auto-merge patch/minor/digest/pin bumps once CI is green",
+      "matchUpdateTypes": ["minor", "patch", "digest", "pin"],
+      "automerge": true
+    },
+    {
+      "description": "Hold all major bumps for manual approval via the dependency dashboard",
+      "matchUpdateTypes": ["major"],
+      "automerge": false,
+      "dependencyDashboardApproval": true,
+      "addLabels": ["deps", "deps:major"]
+    },
+    {
+      "description": "Group Go module updates into one PR",
+      "matchManagers": ["gomod"],
+      "groupName": "go modules"
+    },
+    {
+      "description": "Group CI workflow action bumps",
+      "matchManagers": ["github-actions"],
+      "groupName": "ci actions"
+    },
+    {
+      "description": "Group Docker base-image bumps (Dockerfile + compose)",
+      "matchManagers": ["dockerfile", "docker-compose"],
+      "groupName": "docker images"
+    },
+    {
+      "description": "Group the Android Gradle/Kotlin toolchain",
+      "matchManagers": ["gradle", "gradle-wrapper"],
+      "groupName": "android gradle"
+    },
+    {
+      "description": "Group web npm non-major bumps",
+      "matchManagers": ["npm"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "web npm (non-major)"
+    }
   ]
 }
-- 
2.52.0