From: Jérôme Benoit <jerome.benoit@piment-noir.org>
Date: Thu, 29 Oct 2026 16:02:34 +0000 (+0100)
Subject: chore(renovate): align dependency update policy (#2171)
X-Git-Tag: cli@v5.0.0~22
X-Git-Url: https://git.piment-noir.org/?a=commitdiff_plain;h=01f23eee141d092fb81724117347ea5270e076de;p=e-mobility-charging-stations-simulator.git

chore(renovate): align dependency update policy (#2171)

* chore(renovate): align dependency update policy

Reuse SAP AI Provider's portable dependency safeguards.
Keep this monorepo's extraction rules and use pnpm deduplication.

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

* fix(renovate): preserve existing security labels

Use additive labels for vulnerability fixes so inherited PR labels survive.

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

* chore(renovate): delay fresh PyPI updates

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

---------

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>
---

diff --git a/renovate.json b/renovate.json
index 5f2d1bb1..aa54191e 100644
--- a/renovate.json
+++ b/renovate.json
@@ -4,11 +4,18 @@
     "config:recommended",
     "abandonments:recommended",
     ":configMigration",
+    "helpers:pinGitHubActionDigests",
+    ":pinDevDependencies",
     "group:allNonMajor",
     "schedule:daily",
     ":maintainLockFilesWeekly",
-    "security:minimumReleaseAgeNpm"
+    "security:minimumReleaseAgeNpm",
+    "security:minimumReleaseAgePypi"
   ],
+  "osvVulnerabilityAlerts": true,
+  "vulnerabilityAlerts": {
+    "addLabels": ["security"]
+  },
   "ignorePresets": [":ignoreModulesAndTests"],
   "ignorePaths": [
     "**/node_modules/**",
@@ -22,8 +29,9 @@
   "packageRules": [
     {
       "matchFileNames": ["**/package.json"],
-      "matchDepTypes": ["dependencies", "devDependencies", "optionalDependencies"],
+      "matchDepTypes": ["dependencies", "optionalDependencies"],
       "rangeStrategy": "bump"
     }
-  ]
+  ],
+  "postUpdateOptions": ["pnpmDedupe"]
 }