Use unaltered BennettBot config

This is a temporary commit.

Author: alarthast

renovate.json5

@@ -10,34 +10,31 @@
     // report on abandoned pacakges
     // https://docs.renovatebot.com/presets-abandonments/
     "abandonments:recommended",
+    // 3 day cooldown for npm security updated
+    // https://docs.renovatebot.com/presets-security/#securityminimumreleaseagenpm
+    "security:minimumReleaseAgeNpm",
     // We don't want automated docker/docker-compose/Dockerfile updates
     "docker:disable",
     // Add the nice badges to PRs
     // https://docs.renovatebot.com/presets-mergeConfidence/#mergeconfidenceall-badges
     "mergeConfidence:all-badges"
   ],
   // Label all Reonvate PRs with "dependencies"
-  "labels": [
-    "dependencies"
-  ],
+  "labels": ["dependencies"],
   // update transitive deps by updating the entire lockfile
   // We run this on the same schedule; add a note for the reviewer to do the
   // default dependencies first to reduce the amount needed for review in the
   // full lockfile update
   "lockFileMaintenance": {
-    "enabled": true,
-    "minimumReleaseAge": "7 days",
-    "schedule": [
-      "* 0-3 * * WED"
-    ],
-    "prBodyNotes": [
-      ":information_source: Before reviewing this PR, merge any prod/dev dependency PRs and rebase."
-    ]
+      "enabled": true,
+      "minimumReleaseAge": "7 days",
+      "schedule": [
+        "* 0-3 * * WED"
+      ],
+      "prBodyNotes": [":information_source: Before reviewing this PR, merge any prod/dev dependency PRs and rebase."]
   },
   // don't auto-update python-version, we want to manage python updates ourselves
-  "ignorePaths": [
-    ".python-version"
-  ],
+  "ignorePaths": [".python-version"],
   // Note package rules apply only to direct dependencies
   // group dependencies by dev/prod, cooldown 7 days, run early Wed mornings
   // rangeStrategy: widen expands the range when a new version is found and updates the lockfile (with respect to the cooldown).
@@ -48,24 +45,37 @@
   "packageRules": [
     // We handle github runners (ubuntu versions etc) manually
     {
-      "matchDatasources": [
-        "github-runners"
-      ],
+      "matchDatasources": ["github-runners"],
       "enabled": false
     },
-    // pep621 covers pyproject.toml and uv.lock files
-    // https://docs.renovatebot.com/modules/manager/pep621/
     {
-      "matchManagers": [
-        "pep621"
-      ],
-      "matchDepTypes": [
-        "dependency-groups",
-        "tool.uv.dev-dependencies"
+      "matchManagers": ["npm"],
+      "matchDepTypes": ["devDependencies"],
+      "addLabels": ["js"],
+      "groupName": "js dev dependencies",
+      "minimumReleaseAge": "7 days",
+      "schedule": [
+        "* 0-3 * * WED"
       ],
-      "addLabels": [
-        "python"
+      "rangeStrategy": "widen"
+    },
+    {
+      "matchManagers": ["npm"],
+      "matchDepTypes": ["dependencies"],
+      "addLabels": ["js"],
+      "groupName": "js prod dependencies",
+      "minimumReleaseAge": "7 days",
+      "schedule": [
+        "* 0-3 * * WED"
       ],
+      "rangeStrategy": "widen"
+    },
+    // pep621 covers pyproject.toml and uv.lock files
+    // https://docs.renovatebot.com/modules/manager/pep621/
+    {
+      "matchManagers": ["pep621"],
+      "matchDepTypes": ["dependency-groups", "tool.uv.dev-dependencies"],
+      "addLabels": ["python"],
       "groupName": "python dev dependencies",
       "rangeStrategy": "widen",
       "minimumReleaseAge": "7 days",
@@ -74,17 +84,9 @@
       ],
     },
     {
-      "matchManagers": [
-        "pep621"
-      ],
-      "matchDepTypes": [
-        "project.dependencies",
-        "project.optional-dependencies",
-        "tool.uv.sources"
-      ],
-      "addLabels": [
-        "python"
-      ],
+      "matchManagers": ["pep621"],
+      "matchDepTypes": ["project.dependencies", "project.optional-dependencies", "tool.uv.sources"],
+      "addLabels": ["python"],
       "groupName": "python prod dependencies",
       "rangeStrategy": "widen",
       "minimumReleaseAge": "7 days",
@@ -93,12 +95,8 @@
       ],
     },
     {
-      "matchManagers": [
-        "github-actions"
-      ],
-      "addLabels": [
-        "actions"
-      ],
+      "matchManagers": ["github-actions"],
+      "addLabels": ["actions"],
       "minimumReleaseAge": "7 days",
       "schedule": [
         "* 0-3 * * WED"
@@ -108,9 +106,7 @@
     // when Renovate opens a PR for pinning GHA dependencies to digests
     {
       "description": "Disable minimumReleaseAge for pinDigest update types",
-      "matchUpdateTypes": [
-        "pinDigest"
-      ],
+      "matchUpdateTypes": ["pinDigest"],
       "minimumReleaseAge": null,
     },
     // EXAMPLE: If required, pin a specific dependency to an upper allowed version
@@ -126,8 +122,6 @@
   // dependabot alerts are enabled in the repo
   // https://docs.renovatebot.com/configuration-options/#vulnerabilityalerts
   "vulnerabilityAlerts": {
-    "addLabels": [
-      "security"
-    ]
+    "addLabels": ["security"]
   }
 }