chore(renovate): weekly batched dependency PRs

Merged
BN
12d ago
+82-0

Replaces ~60 single-dependency Renovate PRs with 8 PRs, refreshed once a week.

Groups (later rules win, so crypto beats breaking):

  • non-breaking-dependencies: minor, patch, digest, pin
  • major-breaking-dependencies: majors plus Cargo 0.x minor bumps (one branch via groupSlug)
  • rust-toolchain: rust alone
  • crypto-crates: aes, cbc, cipher, hkdf, hmac, rsa, sha1, sha2, rcgen, rustls, rustls-native-certs, tokio-rustls, x509-parser
  • Gated deps keep their existing rules: actions/runner, smol-machines/smolvm, node20, node24

Schedule: * 7 * * 1 America/New_York, with updateNotScheduled: false, so branches are created and rebased only on Monday 7am and CI runs once per batch per week.

Approval: dependencyDashboardApproval: false; PRs open without ticking the dashboard.

fixtures/upstream-workflows/** is disabled; those old action pins are test inputs.

Verified with a local renovate@44.155.6 --platform=local --dry-run=full: config accepted, 8 branches produced.

Devin Review

Summary by cubic

Consolidates ~60 per-dependency Renovate PRs into 8 weekly batched PRs, refreshed every Monday 7am America/New_York.

  • Non-breaking updates (minor, patch, digest, pin) land in one PR; majors and Cargo 0.x minor bumps land in a separate breaking PR.
  • Rust toolchain and crypto/TLS crates get dedicated PRs so those changes get focused review.
  • Gated deps (actions/runner, smol-machines/smolvm, node20, node24) keep their existing rules.
  • fixtures/upstream-workflows/** and benchmarks/** are frozen: they pin old versions on purpose as test inputs and for comparable benchmark results.
  • PRs open without dashboard approval; branches are only created and rebased on the weekly schedule.

Summary by CodeRabbit

  • Chores
    • Dependency updates are scheduled for Mondays at 07:00 Eastern Time and no longer run outside the scheduled window.
    • Updates are grouped by compatibility impact, with separate groups for Rust toolchain and cryptography/TLS updates.
    • Updates to selected workflow fixtures and benchmark files are disabled.