- Target dev (deps flow through the dev->main batch; automerge works on the
unprotected branch) instead of opening PRs straight against protected main.
- Ignore flutter_client/** -- the Flutter client is retired/legacy; drop the
~9 Flutter dep PRs and keep Android-native + server + web updates.
- Auto-merge GREEN patch/minor/digest/pin bumps; hold ALL majors behind
dependency-dashboard approval (labelled deps:major) for manual review.
- Group Go modules, CI actions, Docker images, Android Gradle, and web npm
non-major bumps into single PRs to cut noise.
- Throttle: weekend schedule, prHourlyLimit 2; monthly lockfile maintenance.
bvandeusen
Renovate Bot