[Romuald Lemesle (RomuDeuxfois)]

Proposed changes

• Renovate config moves to renovate.json5 and follows openaev's general settings: 3-day release age, same schedule, limits and labels.
• Majors are proposed on the Dependency Dashboard instead of a standing PR; non-major GitHub Actions updates come in one weekly PR.
• The chore(docker): prefix for image updates is kept.
• Elastic images skip the 3-day wait, as their registry gives no release date.
• Dependabot config removed, Renovate is the only source of update PRs.

Related issues

• Closes chore(renovate): align the Renovate config with openaev #174

How to test this PR

1. After merge, the next Renovate run shows no config error on the Dependency Dashboard.
2. New image updates appear only once they are 3 days old.

Checklist

• The PR title follows the Conventional Commits convention type(scope?): description (#issue)
• I signed my commits
• This PR is linked to an issue
• I consider the submitted work as finished
• I tested the code for its functionality
• I added/updated the relevant documentation
• Where necessary, I refactored code to improve the overall quality

Further comments

Validated with renovate-config-validator --strict. Open Postgres 18 (#127) and Elasticsearch 9 (#44) PRs will be closed by hand after merge, so they show up on the Dependency Dashboard.

🤖 Generated with Claude Code

[Laurent Giovannoni (laugiov)]

Thanks for aligning this. One blocking point, the rest are small.

1. Blocking: minimumReleaseAge freezes the Elasticsearch image. Renovate defaults to minimumReleaseAgeBehaviour: timestamp-required, so a release without a releaseTimestamp is held as pending forever. docker.elastic.co provides no timestamp. A real dry-run (renovate@44.71.0 --platform=local --dry-run=lookup) on this branch logs Marking N release(s) as pending, as they do not have a releaseTimestamp and we're running with minimumReleaseAgeBehaviour=timestamp-required, and returns pendingChecks: true for elasticsearch 8.19.15 → 8.19.24.

openaev already shows it in production. minimumReleaseAge landed there on 2026-06-03 (#6009). Renovate has not opened a single docker.elastic.co PR since: the last ones were merged on 2026-05-22, and the 9.5.x versions now in openaev-dev/docker-compose.yml were set by hand. Docker Hub images (rabbitmq, opensearch, alpine/openssl) kept flowing. The openaev Dependency Dashboard lists the elastic and kibana tags under "Pending Status Checks". Elasticsearch is the only pinned image that moves in this repository, so merging as is stops its updates.

Suggested rule:

{
    description: 'docker.elastic.co publishes no release timestamp, so minimumReleaseAge would hold every update as pending',
    matchPackageNames: [
        'docker.elastic.co/**',
    ],
    minimumReleaseAge: null,
},

The same fix is needed in openaev. I'll open it there separately.

2. Description: #127 and #44 will not move to the Dependency Dashboard on their own. dependencyDashboardApproval only applies to PRs that are not created yet. Existing ones stay open: in openaev, 8 majors opened before #7853 are still open PRs today. If the goal is to have them on the Dashboard, close them by hand.

3. Minor

• lockFileMaintenance is a no-op: this repository has no lock file.
• prConcurrentLimit / branchConcurrentLimit: 60 come from openaev's measured peak (53 open PRs). Here there are 2. Harmless, but the value means nothing for this repository. Keep it only if strict alignment is the point.
• .github/dependabot.yml (github-actions, open-pull-requests-limit: 0) can go too, so Renovate is the only source of dependency PRs.
• The PR template checklist is not ticked.

[Romuald Lemesle (RomuDeuxfois)]

Thanks, all fixed:

1. Added your rule for docker.elastic.co.
2. Removed lockFileMaintenance and dependabot.yml. Kept the limits to have the same config everywhere.