{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended", ":disableRateLimiting"],
  "timezone": "Australia/Brisbane",
  "schedule": ["after 2am and before 5am"],
  "labels": ["dependencies"],
  "prConcurrentLimit": 6,
  "rangeStrategy": "bump",
  "lockFileMaintenance": { "enabled": true, "schedule": ["before 5am on sunday"] },
  "vulnerabilityAlerts": { "enabled": true, "labels": ["security"], "schedule": ["at any time"] },
  "osvVulnerabilityAlerts": true,
  "packageRules": [
    { "description": "Patch and minor updates of everything except the framework, grouped into one PR a night",
      "matchUpdateTypes": ["minor", "patch"], "excludePackageNames": ["next", "react", "react-dom", "prisma", "@prisma/client", "@prisma/adapter-pg"],
      "groupName": "minor and patch updates" },
    { "description": "Framework and ORM one PR each so a breaking change is reviewed on its own",
      "matchPackageNames": ["next", "react", "react-dom", "prisma", "@prisma/client", "@prisma/adapter-pg"],
      "groupName": null },
    { "description": "Capacitor and Android tooling together — they must move as a set",
      "matchPackagePatterns": ["^@capacitor/", "^@capgo/", "^@capawesome/"], "groupName": "capacitor" },
    { "description": "Major updates never auto-grouped; reviewed one by one", "matchUpdateTypes": ["major"], "groupName": null }
  ]
}