chore(deps): add renovate.json5

[KooshaPari]

User description

Renovate config: cargo + github-actions weekly Monday, grouped non-major updates.

Note

Low Risk
Low risk: adds only repository automation config and does not change runtime code paths. Impact is limited to how dependency update PRs are scheduled and grouped.

Overview
Adds renovate.json5 to enable Renovate with weekly (Monday, before 4am) dependency update PRs using config:base and group:allNonMajor.

Configures bump range strategy, rate limits (prHourlyLimit/prConcurrentLimit), default dependencies labeling, security-labeled vulnerability alerts, and package rules to group non-major updates for cargo and github-actions (including digests).

^{Reviewed by Cursor Bugbot for commit 1ed4dbc. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

CodeAnt-AI Description

Add scheduled dependency update PRs with grouped non-major updates

What Changed

• Dependency update PRs are now created on Monday before 4am instead of at unpredictable times
• Non-major Rust and GitHub Actions updates are grouped into fewer PRs
• Dependency PRs now use a shared dependencies label, and security alerts get a separate security label
• Update volume is capped so the repository is less likely to receive too many dependency PRs at once

Impact

✅ Fewer dependency update PRs
✅ Easier review of routine updates
✅ Clearer security alert tracking

🔄 Retrigger CodeAnt AI Review

Details

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Warning

Rate limit exceeded

@KooshaPari has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 20 minutes and 1 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: c1ad0478-e4f1-4265-a804-c422b1d937d3

📥 Commits

Reviewing files that changed from the base of the PR and between 6d76897 and 1ed4dbc.

📒 Files selected for processing (1)

• renovate.json5

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/add-renovate-2026-04-27

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch chore/add-renovate-2026-04-27

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit 1ed4dbc. Configure here.}

[cursor]

New config uses deprecated config:base preset name

Low Severity

This brand-new configuration file uses config:base, which was renamed to config:recommended in Renovate v36 (June 2023). While Renovate's migration code still handles the old name, a newly added config file is better off using the current canonical name to avoid relying on deprecated compatibility shims.

 

^{Reviewed by Cursor Bugbot for commit 1ed4dbc. Configure here.}

[codeant-ai]

CodeAnt AI finished reviewing your PR.

[codeant-ai]

CodeAnt AI is running the review.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

Sequence Diagram

This PR adds a Renovate configuration that runs weekly on Monday before 4am to create grouped, labeled dependency update pull requests for Rust and GitHub Actions, with separate labeling for security alerts and limits on PR volume.

sequenceDiagram
    participant Scheduler
    participant Renovate
    participant GitHost
    participant Maintainer

    Scheduler->>Renovate: Trigger weekly run before 4am Monday
    Renovate->>Renovate: Scan dependencies and security alerts
    Renovate->>Renovate: Group non major Rust and GitHub Actions updates
    Renovate->>GitHost: Create labeled dependency and security PRs
    GitHost-->>Maintainer: Notify about grouped update PRs

Loading

---

Generated by CodeAnt AI

[codeant-ai]

Suggestion: This repository already has active Dependabot rules for both cargo and github-actions in .github/dependabot.yml, so adding Renovate for the same ecosystems will create duplicate dependency PRs and conflicting update churn. Disable one bot (or scope Renovate to non-overlapping managers) so only a single updater owns each ecosystem. [logic error]

Severity Level: Major ⚠️

- ⚠️ Duplicate cargo update PRs from Dependabot and Renovate.
- ⚠️ Duplicate GitHub Actions update PRs from both bots.
- ⚠️ Noisy dependency workflow complicates reviewer triage and merging.

Steps of Reproduction ✅

1. Push this repository to GitHub with existing Dependabot config at
`.github/dependabot.yml:1-19`, where `package-ecosystem: "cargo"` and `package-ecosystem:
"github-actions"` are both configured with their own schedules and labels.

2. Enable Renovate for the repository so that GitHub reads `renovate.json5:1-25`,
including `packageRules` at lines 13-24 that match managers `"cargo"` and
`"github-actions"` for non-major updates.

3. Allow any Rust dependency in `Cargo.toml` at the repo root to become outdated;
Dependabot (per `.github/dependabot.yml:3-10`) opens a cargo update PR, while Renovate
(per `renovate.json5:13-18`) also opens a grouped non-major cargo PR for the same outdated
packages.

4. Allow any GitHub Actions workflow in `.github/workflows/` to reference an outdated
action version; Dependabot (per `.github/dependabot.yml:12-19`) opens a `github-actions`
update PR and Renovate (per `renovate.json5:19-23`) opens a separate grouped
`github-actions` PR, resulting in duplicate automation for the same ecosystem.

Fix in Cursor | Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖

This is a comment left during a code review.

**Path:** renovate.json5
**Line:** 13:24
**Comment:**
	*Logic Error: This repository already has active Dependabot rules for both `cargo` and `github-actions` in `.github/dependabot.yml`, so adding Renovate for the same ecosystems will create duplicate dependency PRs and conflicting update churn. Disable one bot (or scope Renovate to non-overlapping managers) so only a single updater owns each ecosystem.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎

[codeant-ai]

CodeAnt AI finished running the review.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

CodeAnt AI is running the review.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

Sequence Diagram

This PR adds a Renovate configuration that schedules weekly dependency update checks, grouping non-major Rust and GitHub Actions updates into labeled pull requests with separate handling for security alerts.

sequenceDiagram
    participant Scheduler
    participant Renovate
    participant Repo
    participant Maintainer

    Scheduler->>Renovate: Weekly Monday trigger
    Renovate->>Repo: Scan cargo and GitHub Actions dependencies
    Renovate->>Renovate: Group non major updates for cargo and actions
    Renovate->>Repo: Create dependency PRs with dependencies label
    Renovate->>Repo: Create security PRs with security label
    Repo-->>Maintainer: Show grouped dependency and security PRs

Loading

---

Generated by CodeAnt AI

[codeant-ai]

Suggestion: The schedule is defined without a timezone, so "before 4am on monday" is interpreted in Renovate's runtime timezone (commonly UTC), which can run at the wrong local time/day versus team expectations. Add an explicit timezone to make execution deterministic. [possible bug]

Severity Level: Major ⚠️

- ⚠️ Dependency update timing tied to Renovate's default timezone.
- ⚠️ Potential mismatch with maintainers' expected local update window.

Steps of Reproduction ✅

1. Open `renovate.json5:8`, where the schedule is configured as `"schedule": ["before 4am
on monday"]` without any `"timezone"` field in this file or elsewhere in the repo (no
other Renovate config files are present).

2. According to Renovate's documented behavior (referenced by the `$schema` at line 2),
when `timezone` is omitted, the schedule is evaluated in Renovate's default timezone
(commonly UTC or the host/repo timezone), not in an explicitly defined project-local
timezone.

3. Enable the Renovate GitHub App for this repository so that it honors the `schedule` in
`renovate.json5`; dependency update PRs will then be created "before 4am on monday" in
that default timezone.

4. If the team expects "before 4am on Monday" in a specific local timezone (e.g., their
office region) rather than Renovate's default, the actual PR creation time may differ from
their local Monday/4am expectation; this behavior stems directly from the missing
`"timezone"` setting next to the `schedule` entry in `renovate.json5`.

Fix in Cursor | Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖

This is a comment left during a code review.

**Path:** renovate.json5
**Line:** 8:8
**Comment:**
	*Possible Bug: The schedule is defined without a `timezone`, so "before 4am on monday" is interpreted in Renovate's runtime timezone (commonly UTC), which can run at the wrong local time/day versus team expectations. Add an explicit timezone to make execution deterministic.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎

[codeant-ai]

CodeAnt AI finished running the review.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn