renovate-config

Shared Renovate preset for the BlockRun org. Every repo extends default.json so dependency policy lives in one place.

Use it in a repo

Add a renovate.json at the repo root:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["github>blockrunai/renovate-config"]
}

What the preset does

• Weekly grouped PR for all minor/patch updates (low noise), Monday mornings.
• Auto-merges non-major devDependency updates and monthly lockfile maintenance (after CI + a 3-day release-age gate).
• Security: OSV + GitHub vulnerability alerts open an immediate, security-labelled PR, bypassing the schedule.
• Major updates (frameworks etc.) are never auto-merged — they get a standalone, major-labelled PR for manual review.
• Semantic-commit titles; a Dependency Dashboard issue tracks everything.

Activate (one-time, org admin)

Install the Mend Renovate GitHub App on the blockrunai org (or selected repos): https://github.com/apps/renovate — then point its onboarding config at github>blockrunai/renovate-config so new repos inherit the same policy.