renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":separateMajorReleases",
    ":combinePatchMinorReleases",
    ":enableVulnerabilityAlertsWithLabel(security)",
    "helpers:pinGitHubActionDigests",
    "group:dotnetMonorepo",
    "group:nugetMonorepo"
  ],
  "prHourlyLimit": 10,
  "prConcurrentLimit": 10,

  "minimumReleaseAge": "3 days",

  "recreateWhen": "never",
  "labels": ["Dependency Management"],

  "packageRules": [
    {
      "description": "Group GitHub Actions updates (digest re-pins keep the # vX comment, e.g. NuGet/login, dessant/lock-threads)",
      "matchManagers": ["github-actions"],
      "groupName": "GitHub Actions"
    },
    {
      "description": "Pinning GitHub Actions names the group rather than the generic dependencies topic.",
      "matchManagers": ["github-actions"],
      "matchUpdateTypes": ["pin", "pinDigest"],
      "group": {
        "commitMessageTopic": "GitHub Actions digests"
      }
    },
    {
      "description": "reactiveui/* actions and reusable workflows stay on @main so every repository picks up a shared change on its next run.",
      "matchManagers": ["github-actions"],
      "matchPackageNames": ["/^reactiveui//"],
      "pinDigests": false
    },
    {
      "description": "Actions from GitHub and Microsoft are pinned by digest and taken as soon as they are released.",
      "matchManagers": ["github-actions"],
      "matchPackageNames": ["/^actions//", "/^github//", "/^microsoft//"],
      "pinDigests": true,
      "minimumReleaseAge": "0 days"
    },
    {
      "description": "Minor, patch and digest updates to actions from GitHub and Microsoft merge automatically.",
      "matchManagers": ["github-actions"],
      "matchPackageNames": ["/^actions//", "/^github//", "/^microsoft//"],
      "matchUpdateTypes": ["minor", "patch", "digest", "pin", "pinDigest"],
      "automerge": true
    },
    {
      "description": "Every Docker image is pinned by digest, and a new digest is taken as soon as it is pushed so image security fixes are not held back.",
      "matchDatasources": ["docker"],
      "pinDigests": true,
      "minimumReleaseAge": "0 days"
    },
    {
      "description": "Digest updates to Microsoft's, Docker's Dockerfile syntax and ReactiveUI's container images merge automatically.",
      "matchDatasources": ["docker"],
      "matchPackageNames": ["/^mcr\\.microsoft\\.com//", "/^ghcr\\.io/reactiveui//", "docker/dockerfile"],
      "matchUpdateTypes": ["digest", "pin", "pinDigest"],
      "automerge": true
    },
    {
      "description": "Group the Android binding libraries, which are versioned and released together. These two prefixes are the only Xamarin-prefixed packages still consumed (ReactiveUI.AndroidX, ReactiveUI.Validation.AndroidX); the Xamarin.Forms-era Xamarin.Android.Support.* line is gone.",
      "matchManagers": ["nuget"],
      "groupName": "AndroidX",
      "matchPackageNames": ["/^Xamarin\\.AndroidX\\./", "/^Xamarin\\.Google\\./"]
    },
    {
      "description": "Group Reactive Extensions (Rx.NET) packages",
      "matchManagers": ["nuget"],
      "groupName": "Rx.NET (System.Reactive)",
      "matchPackageNames": [
        "/^System\\.Reactive(\\.|$)/",
        "/^Microsoft\\.Reactive\\./",
        "/^System\\.Interactive(\\.|$)/",
        "/^System\\.Linq\\.Async(\\.|$)/"
      ]
    },
    {
      "description": "Group .NET test frameworks (xUnit + NUnit + Test SDK)",
      "matchManagers": ["nuget"],
      "groupName": ".NET test stack",
      "matchPackageNames": [
        "/^xunit(\\.|$)/",
        "/^NUnit/",
        "/^Verify\\./",
        "/^Microsoft\\.NET\\.Test\\.Sdk$/",
        "/^coverlet\\./"
      ]
    },
    {
      "description": "Group Refit packages",
      "matchManagers": ["nuget"],
      "groupName": "Refit",
      "matchPackageNames": ["/^Refit(\\.|$)/"]
    },
    {
      "description": "Group ReactiveUI family",
      "matchManagers": ["nuget"],
      "groupName": "ReactiveUI",
      "matchPackageNames": ["/^ReactiveUI(\\.|$)/"]
    },
    {
      "description": "Group Avalonia UI ecosystem (incl. Avalonia.ReactiveUI)",
      "matchManagers": ["nuget"],
      "groupName": "Avalonia",
      "matchPackageNames": ["/^Avalonia(\\.|$)/"]
    },
    {
      "description": "Group Uno Platform packages, including the Uno.Sdk entry under msbuild-sdks in global.json",
      "matchManagers": ["nuget"],
      "groupName": "Uno Platform",
      "matchPackageNames": ["/^Uno(\\.|$)/"]
    },
    {
      "description": "Group Splat packages",
      "matchManagers": ["nuget"],
      "groupName": "Splat",
      "matchPackageNames": ["/^Splat(\\.|$)/"]
    },
    {
      "description": "Group NuGet client libraries (NuGet/NuGet.Client family)",
      "matchManagers": ["nuget"],
      "groupName": "NuGet client",
      "matchPackageNames": ["/^NuGet\\./"]
    },
    {
      "description": "Group Microsoft.Extensions.* and Microsoft.Bcl.* (lockstep with .NET runtime cadence)",
      "matchManagers": ["nuget"],
      "groupName": "Microsoft.Extensions",
      "matchPackageNames": ["/^Microsoft\\.Extensions\\./", "/^Microsoft\\.Bcl\\./"]
    },
    {
      "description": "Group Microsoft.AspNetCore.* (lockstep via $(AspNetVersion))",
      "matchManagers": ["nuget"],
      "groupName": "ASP.NET Core",
      "matchPackageNames": ["/^Microsoft\\.AspNetCore\\./"]
    },
    {
      "description": "Group .NET MAUI packages (lockstep via $(MauiVersion))",
      "matchManagers": ["nuget"],
      "groupName": ".NET MAUI",
      "matchPackageNames": ["/^Microsoft\\.Maui(\\.|$)/"]
    },
    {
      "description": "Group Roslyn (Microsoft.CodeAnalysis.*) packages",
      "matchManagers": ["nuget"],
      "groupName": "Roslyn (Microsoft.CodeAnalysis)",
      "matchPackageNames": ["/^Microsoft\\.CodeAnalysis(\\.|$)/"]
    },
    {
      "description": "Group Microsoft.Testing.Platform / Extensions (move together)",
      "matchManagers": ["nuget"],
      "groupName": "Microsoft.Testing",
      "matchPackageNames": ["/^Microsoft\\.Testing\\./"]
    },
    {
      "description": "Group SourceLink providers",
      "matchManagers": ["nuget"],
      "groupName": "SourceLink",
      "matchPackageNames": ["/^Microsoft\\.SourceLink\\./"]
    },
    {
      "description": "Group Microsoft App Center SDK",
      "matchManagers": ["nuget"],
      "groupName": "App Center",
      "matchPackageNames": ["/^Microsoft\\.AppCenter(\\.|$)/"]
    },
    {
      "description": "Group Akavache packages (lockstep release versions)",
      "matchManagers": ["nuget"],
      "groupName": "Akavache",
      "matchPackageNames": ["/^Akavache(\\.|$)/"]
    },
    {
      "description": "Group SQLitePCLRaw bundles & providers",
      "matchManagers": ["nuget"],
      "groupName": "SQLitePCLRaw",
      "matchPackageNames": ["/^SQLitePCLRaw(\\.|$)/"]
    },
    {
      "description": "Group Prism.* packages",
      "matchManagers": ["nuget"],
      "groupName": "Prism",
      "matchPackageNames": ["/^Prism(\\.|$)/"]
    },
    {
      "description": "Group TUnit packages",
      "matchManagers": ["nuget"],
      "groupName": "TUnit",
      "matchPackageNames": ["/^TUnit(\\.|$)/"]
    },
    {
      "description": "Group Roslynator analyzers",
      "matchManagers": ["nuget"],
      "groupName": "Roslynator",
      "matchPackageNames": ["/^Roslynator(\\.|$)/"]
    },
    {
      "description": "Group Microsoft.Windows.* (WindowsAppSDK, SDK build tools, CsWinRT)",
      "matchManagers": ["nuget"],
      "groupName": "Microsoft.Windows",
      "matchPackageNames": ["/^Microsoft\\.Windows\\./", "/^Microsoft\\.WindowsAppSDK$/"]
    },
    {
      "description": "Group Zensical / MkDocs ecosystem (pip)",
      "matchManagers": ["pip_requirements"],
      "groupName": "Zensical & MkDocs",
      "matchPackageNames": [
        "/^zensical(\\.|$|-)/",
        "/^mkdocs(\\.|$|-)/",
        "/^pymdown-extensions$/"
      ]
    },
    {
      "description": "ASP.NET Core & MAUI are multi-targeted per .NET major (one PackageVersion per major, selected by IsTargetFrameworkCompatible bands) so each entry stays matched to its TFM. Block cross-major bumps that would collapse those entries onto a single version; within-major patch/minor updates still flow.",
      "matchManagers": ["nuget"],
      "matchUpdateTypes": ["major"],
      "enabled": false,
      "matchPackageNames": ["/^Microsoft\\.AspNetCore\\./", "/^Microsoft\\.Maui(\\.|$)/"]
    },
    {
      "description": "Keep Roslyn (Microsoft.CodeAnalysis.*) on its current major band. The compiler API and the analyzers move on independent major lines that are pinned to the toolchain in use, so block cross-major bumps; within-major patch/minor updates still flow.",
      "matchManagers": ["nuget"],
      "matchUpdateTypes": ["major"],
      "enabled": false,
      "matchPackageNames": ["/^Microsoft\\.CodeAnalysis(\\.|$)/"]
    }
  ]
}