{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":dependencyDashboard",
    ":semanticCommits",
    ":prConcurrentLimit10"
  ],
  "timezone": "Europe/Berlin",
  "schedule": ["before 6am on monday"],
  "labels": ["dependencies"],
  "commitMessagePrefix": "chore(deps):",
  "rangeStrategy": "bump",
  "postUpdateOptions": ["npmDedupe"],
  "vulnerabilityAlerts": {
    "labels": ["security"],
    "schedule": ["at any time"]
  },
  "osvVulnerabilityAlerts": true,
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["before 6am on the first day of the month"]
  },
  "packageRules": [
    {
      "description": "Sicherheitsupdates sofort und priorisiert (nicht auf das Wochenfenster warten).",
      "matchDatasources": ["npm"],
      "isVulnerabilityAlert": true,
      "prPriority": 20,
      "schedule": ["at any time"]
    },
    {
      "description": "Nicht-Major-Updates gebündelt (weniger PR-Rauschen).",
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "npm non-major"
    },
    {
      "description": "AUTH KRITISCH: next-auth/@auth/core ist eine Beta (5.x). Updates NICHT automatisch, sondern einzeln, mit manuellem Review — Auth-Regressionen (siehe F-01) können 'fail open' bedeuten. Auto-Merge hier bewusst AUS.",
      "matchPackageNames": ["next-auth", "@auth/core"],
      "groupName": "auth (manuelles Review!)",
      "labels": ["dependencies", "auth-review-erforderlich"],
      "automerge": false,
      "minimumReleaseAge": "7 days",
      "prPriority": 5
    },
    {
      "description": "Next.js separat halten (Framework-Major-Sprünge brauchen Regressionstest).",
      "matchPackageNames": ["next", "@next/env", "eslint-config-next"],
      "groupName": "next.js",
      "automerge": false
    },
    {
      "description": "Prisma zusammen aktualisieren (Client, Engine und CLI müssen versionsgleich sein).",
      "matchPackageNames": ["prisma", "@prisma/client", "@prisma/adapter-pg"],
      "groupName": "prisma"
    },
    {
      "description": "Docker-Base-Images und Compose-Images ebenfalls durch Renovate pflegen.",
      "matchManagers": ["dockerfile", "docker-compose"],
      "groupName": "docker images",
      "pinDigests": true
    }
  ]
}