chore(renovate): align dependency update policy (#2171)

* chore(renovate): align dependency update policy

Reuse SAP AI Provider's portable dependency safeguards.
Keep this monorepo's extraction rules and use pnpm deduplication.

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>
* fix(renovate): preserve existing security labels

Use additive labels for vulnerability fixes so inherited PR labels survive.

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>
* chore(renovate): delay fresh PyPI updates

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>
---------

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

diff --git a/renovate.json b/renovate.json
index 5f2d1bb1ae0ca67fcd020a04ff34279488586a78..aa54191e1a9627441106be88eddcdb3fba29f29a 100644 (file)
--- a/renovate.json
+++ b/renovate.json
@@ -4,11 +4,18 @@
     "config:recommended",
     "abandonments:recommended",
     ":configMigration",
+    "helpers:pinGitHubActionDigests",
+    ":pinDevDependencies",
     "group:allNonMajor",
     "schedule:daily",
     ":maintainLockFilesWeekly",
-    "security:minimumReleaseAgeNpm"
+    "security:minimumReleaseAgeNpm",
+    "security:minimumReleaseAgePypi"
   ],
+  "osvVulnerabilityAlerts": true,
+  "vulnerabilityAlerts": {
+    "addLabels": ["security"]
+  },
   "ignorePresets": [":ignoreModulesAndTests"],
   "ignorePaths": [
     "**/node_modules/**",
@@ -22,8 +29,9 @@
   "packageRules": [
     {
       "matchFileNames": ["**/package.json"],
-      "matchDepTypes": ["dependencies", "devDependencies", "optionalDependencies"],
+      "matchDepTypes": ["dependencies", "optionalDependencies"],
       "rangeStrategy": "bump"
     }
-  ]
+  ],
+  "postUpdateOptions": ["pnpmDedupe"]
 }