Skip to content

chore: update Renovate config #463

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
olivermeyer wants to merge 1 commit into from
Closed

chore: update Renovate config #463

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 18 additions & 7 deletions renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,29 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:recommended"
],
"extends": ["config:recommended"],
"timezone": "Europe/Berlin",
"schedule": "before 2am every weekday",
"schedule": ["at any time"],
"labels": [
"bot",
"renovate",
"dependencies",
"skip:test:long_running",
"skip:codecov"
],
"ignorePaths": [
"plugins/manifest/package.json"
"lockFileMaintenance": {
Copy link

@claude claude bot Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great addition! 🔧

Lock file maintenance is a critical feature for repositories using uv:

What it does:

  • Updates uv.lock even when no direct dependencies changed
  • Picks up transitive dependency updates
  • Ensures lockfile stays fresh and secure

Schedule rationale:

  • ✅ Monday 5 AM: Runs after main schedule, catches transitive updates from weekend
  • ✅ Weekly frequency: Balanced between freshness and PR volume
  • ✅ Early morning: Gives team full workday to review if issues arise

Benefits for this medical device SDK:

  1. Security: Transitive CVE fixes applied automatically
  2. Reproducibility: Fresh lock file prevents drift
  3. Compliance: Audit trail of all dependency changes (including indirect)

This is especially important given the SDK's security posture (HIPAA compliance, medical data handling).

"enabled": true,
"schedule": ["before 5am on monday"]
},
"packageRules": [
Copy link

@claude claude bot Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Excellent addition! 👍

Grouping minor and patch updates significantly reduces PR noise while maintaining safety:

  • ✅ Major updates: Still come as individual PRs (easier to review breaking changes)
  • ✅ Minor/Patch updates: Grouped together (faster review, less context switching)

This aligns well with the repository's CI/CD strategy where:

  • All PRs get skip:test:long_running label (line 10)
  • Fast feedback loop (~15 min for lint + audit + regular tests)
  • Comprehensive validation before merge

Tip: If grouped PRs become too large, consider adding separateMajorMinor: true to split minor from patch, but current config is optimal for this repository size.

{
"groupName": "minor and patch dependencies",
"matchManagers": ["pep621"],
"matchUpdateTypes": ["minor", "patch"]
},
{
"groupName": "GitHub Actions",
"matchManagers": ["github-actions"],
"separateMajorMinor": false
}
]
}
}
Loading