Skip to content

Set up Renovate #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ianmacartney merged 2 commits into from
Mar 31, 2026
Merged

Set up Renovate #22

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
031f165
Set up Renovate
Nicolapps Mar 31, 2026
b4a520c
Update renovate.json
Nicolapps Mar 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": ["config:best-practices"],
"schedule": ["* 0-4 * * 1"],
"timezone": "America/Los_Angeles",
"minimumReleaseAge": "30 days",
"packageRules": [
{
"groupName": "Routine updates",
"matchUpdateTypes": ["minor", "patch", "pin", "digest"],
"automerge": true
},
{
"matchUpdateTypes": ["major"],
"automerge": false
},
{
"matchDepTypes": ["devDependencies"],
"automerge": true
}
Comment on lines +17 to +20
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

In Renovate configuration, when multiple packageRules match the same dependency, how are conflicting fields like "automerge" resolved? Does a later broad rule (e.g., matchDepTypes=devDependencies) override an earlier matchUpdateTypes=major rule?

💡 Result:

In Renovate configuration, when multiple packageRules match the same dependency, all matching rules are applied in array order to produce a single resulting config for that dependency/update. For each config option, if it is "mergeable" (typically arrays/objects), values from matching rules are merged (e.g., addLabels appends labels). If non-mergeable (e.g., booleans like automerge), the value from the last matching rule overrides previous ones. "automerge" is a boolean and thus non-mergeable (string types are always non-mergeable, and booleans behave similarly as scalars), so the last matching rule sets its value. A later broad rule (e.g., matchDepTypes=devDependencies) will override an earlier specific rule (e.g., matchUpdateTypes=major) for conflicting fields like automerge, because rules are applied sequentially and later ones override non-mergeable options.

Citations:

devDependencies automerge rule will override major-update protection due to rule precedence.

This rule (lines 18-21) matches all devDependency updates and sets automerge: true. In Renovate's packageRules, when multiple rules match the same dependency, non-mergeable fields like automerge use the value from the last matching rule. Since this rule comes after the earlier "major" rule that sets automerge: false, it will override that setting for major devDependency updates. Given that your devDependencies include high-impact packages (react, react-dom, openai, convex, typescript), auto-merging their major updates is risky.

Add "matchUpdateTypes": ["minor", "patch", "pin", "digest"] to this rule to explicitly exclude major updates, or move this rule before the major rule and adjust accordingly.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@renovate.json` around lines 18 - 21, The current Renovate package rule that
sets "automerge": true for dependencies matching "matchDepTypes":
["devDependencies"] will override the earlier "major" rule because Renovate uses
the last matching rule for non-mergeable fields; update this devDependencies
rule (the one with "matchDepTypes": ["devDependencies"] and "automerge": true)
to explicitly exclude major updates by adding "matchUpdateTypes": ["minor",
"patch", "pin", "digest"], or alternatively move this devDependencies rule
before the rule named/targeting "major" so the major rule’s "automerge": false
remains effective.

]
}
Loading