renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "timezone": "Europe/Berlin",
  "schedule": [
    "every 30 day"
  ],
  "automergeSchedule": "every 30 day",
  "extends": [
    "github>nuxt/renovate-config-nuxt",
    ":labels(dependencies,devops)",
    ":maintainLockFilesWeekly",
    ":enableVulnerabilityAlerts",
    ":automergeLinters",
    ":automergeTypes",
    ":automergeMinor"
  ],
  "baseBranchPatterns": [
    "main"
  ],
  "minimumReleaseAge": "1 day",
  "lockFileMaintenance": {
    "description": "Transitive deps only move during lock file maintenance. Without its own schedule this inherits the top-level `every 30 day`, which overrides the weekly cadence from `:maintainLockFilesWeekly` and lets vulnerable sub-dependencies (tar, minimatch, brace-expansion, ...) sit stale for months. Automerged because these PRs otherwise queue up unreviewed -- `:automergeMinor` does not cover lock file maintenance, so they are not picked up by any other rule. Renovate holds the merge until the `Build & Deploy` checks are green.",
    "enabled": true,
    "schedule": [
      "before 6am on monday"
    ],
    "automerge": true,
    "automergeSchedule": [
      "before 6am on monday"
    ]
  },
  "packageRules": [
    {
      "description": "TypeScript 7 (the Go port) has no stable programmatic API for Volar/vue-tsc yet, so it cannot type-check .vue templates. Revisit once vue-tsc supports it.",
      "matchPackageNames": [
        "typescript"
      ],
      "allowedVersions": "<7.0.0",
      "addLabels": [
        "blocked-by-volar"
      ]
    },
    {
      "description": "Nuxt's Nitro server (@nuxt/nitro-server) still runs on h3 1.x, so h3 2.x types do not match the runtime event and its test helper createEvent is gone. Revisit once @nuxt/nitro-server depends on h3 2.x.",
      "matchPackageNames": [
        "h3"
      ],
      "allowedVersions": "<2.0.0",
      "addLabels": [
        "blocked-by-nitro"
      ]
    }
  ]
}