{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "timezone": "America/Chicago",
  "schedule": ["before 6am on monday"],
  "labels": ["dependencies"],
  "rangeStrategy": "bump",
  "packageRules": [
    {
      "description": "Group all non-major updates into one weekly PR",
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "non-major dependencies"
    },
    {
      "description": "Majors stay separate — each needs its own verification pass (see docs/QA_PLAN.md B0 dependency recon)",
      "matchUpdateTypes": ["major"],
      "dependencyDashboardApproval": true
    },
    {
      "description": "xlsx is pinned to the official SheetJS CDN tarball (npm line is abandoned with unfixed CVEs) — do not touch",
      "matchPackageNames": ["xlsx"],
      "enabled": false
    },
    {
      "description": "typescript is capped at 6.x until typescript-eslint supports TS 7 (peer <6.1.0)",
      "matchPackageNames": ["typescript"],
      "allowedVersions": "<7.0.0"
    }
  ],
  "vulnerabilityAlerts": { "enabled": true },
  "osvVulnerabilityAlerts": true
}