From 01f23eee141d092fb81724117347ea5270e076de Mon Sep 17 00:00:00 2001
From: =?utf8?q?J=C3=A9r=C3=B4me=20Benoit?= <jerome.benoit@piment-noir.org>
Date: Thu, 29 Oct 2026 17:02:34 +0100
Subject: [PATCH] chore(renovate): align dependency update policy (#2171)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

* chore(renovate): align dependency update policy

Reuse SAP AI Provider's portable dependency safeguards.
Keep this monorepo's extraction rules and use pnpm deduplication.

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

* fix(renovate): preserve existing security labels

Use additive labels for vulnerability fixes so inherited PR labels survive.

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

* chore(renovate): delay fresh PyPI updates

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

---------

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>
---
 renovate.json | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/renovate.json b/renovate.json
index 5f2d1bb1..aa54191e 100644
--- a/renovate.json
+++ b/renovate.json
@@ -4,11 +4,18 @@
     "config:recommended",
     "abandonments:recommended",
     ":configMigration",
+    "helpers:pinGitHubActionDigests",
+    ":pinDevDependencies",
     "group:allNonMajor",
     "schedule:daily",
     ":maintainLockFilesWeekly",
-    "security:minimumReleaseAgeNpm"
+    "security:minimumReleaseAgeNpm",
+    "security:minimumReleaseAgePypi"
   ],
+  "osvVulnerabilityAlerts": true,
+  "vulnerabilityAlerts": {
+    "addLabels": ["security"]
+  },
   "ignorePresets": [":ignoreModulesAndTests"],
   "ignorePaths": [
     "**/node_modules/**",
@@ -22,8 +29,9 @@
   "packageRules": [
     {
       "matchFileNames": ["**/package.json"],
-      "matchDepTypes": ["dependencies", "devDependencies", "optionalDependencies"],
+      "matchDepTypes": ["dependencies", "optionalDependencies"],
       "rangeStrategy": "bump"
     }
-  ]
+  ],
+  "postUpdateOptions": ["pnpmDedupe"]
 }
-- 
2.53.0