renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [":dependencyDashboardApproval"],
  "enabledManagers": ["github-actions", "npm"],
  "minimumReleaseAge": "7 days",
  "schedule": [],
  "updateNotScheduled": false,
  "semanticCommitScope": "",
  "semanticCommitType": "deps",
  "packageRules": [
    {
      "matchManagers": ["github-actions"],
      "dependencyDashboardCategory": "GitHub Actions updates"
    },
    {
      "matchManagers": ["npm"],
      "dependencyDashboardCategory": "JavaScript updates"
    },
    {
      "matchDepTypes": ["devDependencies"],
      "semanticCommitScope": "dev",
      "semanticCommitType": "deps",
      "automerge": true
    },
    {
      "matchUpdateTypes": ["patch"],
      "automerge": true
    },
    {
      "matchUpdateTypes": ["lockFileMaintenance"],
      "automerge": true
    },
    {
      "matchManagers": ["npm", "github-actions"],
      "matchPackageNames": ["node", "actions/node-versions"],
      "groupName": "node",
      "allowedVersions": "<27"
    },
    {
      "description": "Pin @types/node to the oldest supported Node.js line (22.x) so type checking reflects the minimum supported runtime rather than a newer one.",
      "matchManagers": ["npm"],
      "matchPackageNames": ["@types/node"],
      "allowedVersions": "<23"
    },
    {
      "matchManagers": ["npm"],
      "matchPackageNames": ["@bytecodealliance/jco"],
      "allowedVersions": "<=1.5.0"
    },
    {
      "description": "Never automerge Eve. It is pre-1.0 (30 minor lines in under a year) so a minor release may break, and `@arcjet/guard/vercel-eve/v0` types against `ToolDefinition`, `ApprovalContext`, `ApprovalStatus`, `SessionContext` and `HookEventMap`. A green typecheck is necessary but not sufficient: the namespace also depends on two `Symbol.for` brands `defineTool` stamps, on the definition-source key staying non-enumerable and configurable, and on stream-event payload fields — runtime contracts a typecheck cannot see. Keep the range below 1.0; `vercel-eve/v1` is added deliberately, not by a bump. This rule is last in `packageRules` so it wins over the devDependencies and patch automerge rules above.",
      "matchManagers": ["npm"],
      "matchPackageNames": ["eve"],
      "automerge": false,
      "allowedVersions": "<1"
    },
    {
      "description": "Never automerge @mastra/core majors. `@arcjet/guard/mastra/v1` types against Processor, createTool, ToolHooks, and RequestContext reserved keys. A green typecheck is necessary but not sufficient. Keep the range on 1.x; mastra/v2 is added deliberately, not by a bump.",
      "matchManagers": ["npm"],
      "matchPackageNames": ["@mastra/core"],
      "automerge": false,
      "allowedVersions": "<2"
    },
    {
      "description": "Never automerge @anthropic-ai/claude-agent-sdk. It is pre-1.0 and tracks Claude Code patch-for-patch, so a minor release may break. `@arcjet/guard/claude-agent-sdk/v0` types against SdkMcpToolDefinition, Options.hooks, HookCallback, and HookJSONOutput. Keep the range below 1.0; claude-agent-sdk/v1 is added deliberately, not by a bump.",
      "matchManagers": ["npm"],
      "matchPackageNames": ["@anthropic-ai/claude-agent-sdk"],
      "automerge": false,
      "allowedVersions": "<1"
    },
    {
      "description": "Never automerge langchain, @langchain/langgraph, or @langchain/core majors. `@arcjet/guard/langgraph/v1` types against ToolNode, StructuredTool, and RunnableConfig. `@arcjet/guard/langchain/v1` types against createAgent, wrapToolCall, and ToolMessage.isInstance — wrapToolCall only sees runtime.configurable.thread_id as of langchain 1.2.34, and a bare wrapToolCall return is the messages-reducer crash. A green typecheck is necessary but not sufficient. Keep the range on 1.x; langchain/v2 and langgraph/v2 are added deliberately, not by a bump.",
      "matchManagers": ["npm"],
      "matchPackageNames": ["langchain", "@langchain/langgraph", "@langchain/core"],
      "automerge": false,
      "allowedVersions": "<2"
    },
    {
      "description": "Never automerge genkit majors. `@arcjet/guard/genkit/v1` types against ToolAction, defineTool, ActionContext and the `generateMiddleware` tool hook. A green typecheck is necessary but not sufficient: the namespace also depends on `defineTool` registering the action on `registry.actionsById` (plus a `/tool.v2/<name>` twin over the same handler), and on `resolveToolRequest` treating a `ToolResponsePart` returned without calling `next()` as a completed tool result — runtime contracts a typecheck cannot see. Keep the range on 1.x; genkit/v2 is added deliberately, not by a bump.",
      "matchManagers": ["npm"],
      "matchPackageNames": ["genkit"],
      "automerge": false,
      "allowedVersions": "<2"
    },
    {
      "description": "Never automerge @strands-agents/sdk majors. `@arcjet/guard/strands-agents/v1` types against tool({ callback }), FunctionTool / ZodTool `_callback`, Plugin / addHook, BeforeToolCallEvent.cancel, and HookOrder. A green typecheck is necessary but not sufficient: the namespace also depends on addHook keying the registry by constructor identity, on ZodTool.stream() delegating to `_functionTool._callback` (closed over at construction), and on BeforeToolsEvent.cancel skipping per-tool hooks — runtime contracts a typecheck cannot see. The floor is 1.1.0 because HookOrder + interrupt() shipped then. Keep the range on 1.x; strands-agents/v2 is added deliberately, not by a bump.",
      "matchManagers": ["npm"],
      "matchPackageNames": ["@strands-agents/sdk"],
      "automerge": false,
      "allowedVersions": "<2"
    },
    {
      "description": "Never automerge @openai/agents. It is pre-1.0, so a minor release may break. `@arcjet/guard/openai-agents/v0` types against FunctionTool, tool({ execute }), RunContext, and run() / Runner. A green typecheck is necessary but not sufficient. Keep the range below 1.0; openai-agents/v1 is added deliberately, not by a bump.",
      "matchManagers": ["npm"],
      "matchPackageNames": ["@openai/agents"],
      "automerge": false,
      "allowedVersions": "<1"
    },
    {
      "description": "Never automerge @tanstack/ai. It is pre-1.0, so a minor release may break. `@arcjet/guard/tanstack-ai/v0` types against ChatMiddleware, onBeforeToolCall, BeforeToolCallDecision, and chat({ context }). A green typecheck is necessary but not sufficient: the namespace also depends on onBeforeToolCall first-win composition (a preceding toolCacheMiddleware skip means Guard never runs) and on execute throws being swallowed into { error } — runtime contracts a typecheck cannot see. Keep the range below 1.0; tanstack-ai/v1 is added deliberately, not by a bump. This rule is last in packageRules so it wins over the devDependencies and patch automerge rules above.",
      "matchManagers": ["npm"],
      "matchPackageNames": ["@tanstack/ai"],
      "automerge": false,
      "allowedVersions": "<1"
    }
  ],
  "lockFileMaintenance": {
    "enabled": true
  },
  "prBodyTemplate": "{{{header}}}{{{table}}}{{{warnings}}}{{{notes}}}{{{changelogs}}}",
  "prBodyColumns": ["Package", "Change"],
  "ignorePresets": ["mergeConfidence:all-badges"],
  "vulnerabilityAlerts": {
    "enabled": false
  }
}