{
	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
	"extends": [
		"config:recommended",
		":timezone(Europe/Amsterdam)",
		":semanticCommits",
		"workarounds:all"
	],
	"labels": ["dependencies"],
	"dependencyDashboard": true,
	"dependencyDashboardOSVVulnerabilitySummary": "all",
	"osvVulnerabilityAlerts": true,
	"configMigration": true,
	"automergeStrategy": "squash",
	"schedule": ["after 4:00 am and before 5:00 am on monday through friday", "at 4:17 am on monday through friday"],
	"timezone": "Europe/Amsterdam",
	"prConcurrentLimit": 5,
	"prHourlyLimit": 3,
	"minimumReleaseAge": "3 days",
	"lockFileMaintenance": {
		"enabled": true
	},
	"packageRules": [
		{
			"description": "Minor en patch: één groeps-PR, automerge pas na groene CI",
			"matchUpdateTypes": ["minor", "patch", "pin", "digest"],
			"groupName": "all non-major dependencies",
			"automerge": true,
			"platformAutomerge": false
		},
		{
			"description": "Major updates vragen goedkeuring via het dependency-dashboard",
			"matchUpdateTypes": ["major"],
			"labels": ["major"],
			"dependencyDashboardApproval": true
		},
		{
			"description": "Beveiligingsfixes (OSV) niet tegenhouden door de wachttijd en in een eigen PR",
			"matchCategories": ["security"],
			"minimumReleaseAge": null,
			"groupName": "security fixes",
			"addLabels": ["security"]
		},
		{
			"description": "Docker-compose draait op :latest; geen digest-pin-ruis",
			"matchManagers": ["docker-compose"],
			"pinDigests": false
		},
		{
			"description": "Node-upgrades worden handmatig gecoördineerd over .nvmrc, package.json engines, @types/node, de Docker-basisimage en de runner; Renovate mag .nvmrc niet los bumpen (check-node-toolchain faalt anders)",
			"matchManagers": ["nvm"],
			"enabled": false
		},
		{
			"description": "De Node-basisimage in de Dockerfile hoort bij dezelfde gecoördineerde Node-upgrade als .nvmrc",
			"matchManagers": ["dockerfile"],
			"matchPackageNames": ["node"],
			"enabled": false
		},
		{
			"description": "De pnpm packageManager-pin is afgestemd op Docker en de runner-toolchain; niet automatisch bumpen",
			"matchPackageNames": ["pnpm"],
			"enabled": false
		}
	]
}