chore: Configure Renovate

[renovate]

Welcome to Renovate! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.

📚 See our Reading List for relevant documentation you may be interested in reading.

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to renovate.json in this branch. Renovate will update the Pull Request description the next time it runs.

---

Detected Package Files

devcontainer

• .devcontainer/devcontainer.json

docker-compose

• docker/docker-compose-examples/cluster-mode/docker-compose-node-1.yml
• docker/docker-compose-examples/cluster-mode/docker-compose-node-2.yml
• docker/docker-compose-examples/experiments/docker-compose.yml
• docker/docker-compose-examples/lgtm-observability/docker-compose.yml
• docker/docker-compose-examples/push-publish/docker-compose.yml
• docker/docker-compose-examples/single-node-debug-mode/docker-compose.yml
• docker/docker-compose-examples/single-node-demo-site/docker-compose.yml
• docker/docker-compose-examples/single-node-metrics-monitoring/docker-compose.yml
• docker/docker-compose-examples/single-node-os-migration/docker-compose.yml
• docker/docker-compose-examples/single-node/docker-compose.yml
• docker/docker-compose-examples/with-opensearch-dashboard/docker-compose.yml
• docker/docker-compose-examples/with-redis-session/docker-compose-node-1.yml
• docker/docker-compose-examples/with-redis-session/docker-compose-node-2.yml
• docker/docker-compose-examples/with-redis/docker-compose-node-1.yml
• docker/docker-compose-examples/with-redis/docker-compose-node-2.yml
• dotCMS/src/docker-compose/it-test/docker-compose.yml
• dotCMS/src/docker-compose/local-run/docker-compose.yml
• dotcms-postman/docker-compose.yml

dockerfile

• docker/dev-env/Dockerfile
• docker/docker-compose-examples/single-node-os-migration/Dockerfile-opensearch-py
• docker/java-base/Dockerfile
• docker/pg-base/Dockerfile
• dotCMS/src/main/docker/original/Dockerfile
• tools/dotcms-cli/cli/src/main/docker/
  • Dockerfile.jvm
  • Dockerfile.legacy-jar
  • Dockerfile.native
  • Dockerfile.native-micro
• tools/dotcms-cli/src/main/docker/
  • Dockerfile.jvm
  • Dockerfile.legacy-jar
  • Dockerfile.native
  • Dockerfile.native-micro

github-actions

• .github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
• .github/actions/core-cicd/deployment/deploy-docker/action.yml
• .github/actions/core-cicd/deployment/deploy-javadoc/action.yml
• .github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml
• .github/actions/core-cicd/deployment/deploy-jfrog/action.yml
• .github/actions/core-cicd/maven-job/action.yml
• .github/actions/core-cicd/notification/notify-slack/action.yaml
• .github/actions/core-cicd/setup-java/action.yml
• .github/actions/legacy-release/sbom-generator/action.yml
• .github/workflows/
  • ai_claude-backend-reviewer.yml
  • ai_claude-orchestrator.yml
  • ai_claude-rollback-safety.yml
  • cicd_3-trunk.yml
  • cicd_4-nightly.yml
  • cicd_5-lts.yml
  • cicd_6-release.yml
  • cicd_comp_ai-release-notes-phase.yml
  • cicd_comp_build-phase.yml
  • cicd_comp_cli-native-build-phase.yml
  • cicd_comp_deployment-phase.yml
  • cicd_comp_finalize-phase.yml
  • cicd_comp_initialize-phase.yml
  • cicd_comp_pr-area-labeler.yml
  • cicd_comp_publish-pr-test-image.yml
  • cicd_comp_release-phase.yml
  • cicd_comp_release-prepare-phase.yml
  • cicd_comp_test-phase.yml
  • cicd_evergreen-tracks-admin.yml
  • cicd_evergreen-tracks-promote.yml
  • cicd_manual_build-docker-context.yml
  • cicd_manual_build-java-base.yml
  • cicd_manual_publish-starter.yml
  • cicd_post-workflow-reporting.yml
  • cicd_pr_qa-stuck-check-validate.yml
  • cicd_release-cli.yml
  • cicd_release-sdk.yml
  • cicd_scheduled_image-cve-scan.yml
  • cicd_scheduled_notify-seated-prs.yml
  • cicd_scheduled_qa-stuck-check.yml
  • cicd_weekly-rolling-tags.yml
  • issue_autodoc.yml
  • issue_comp_frontend-notify.yml
  • issue_comp_label-conditional-labeling.yml
  • issue_comp_link-issue-to-pr.yml
  • issue_comp_release-labeling.yml
  • issue_manual_label-customer_deployed-issues.yml
  • issue_manual_label-issues.yml
  • issue_on-change_assign-issues-to-qa-project.yml
  • issue_on-open_add-to-triage-project..yml
  • issue_scheduled_stale-action.yml
  • legacy-release_comp_maven-build-docker-image.yml
  • legacy-release_maven-release-process.yml
  • legacy-release_sbom-generator.yaml
  • publish_docs.yml
  • security_scheduled_pentest.yml
  • utility_discover-docker-tags.yml
• tools/dotcms-cli/action/.github/workflows/main.yml

helm-values

• test-jmeter/helm-chart/jmeter-performance/values.yaml

maven

• bom/application/pom.xml
• bom/logging/pom.xml
• bom/pom.xml
• build-parent/pom.xml
• core-web/apps/dotcms-ui-e2e/pom.xml
• core-web/pom.xml
• dotCMS/pom.xml
• dotcms-integration/pom.xml
• dotcms-postman/pom.xml
• e2e/dotcms-e2e-java/pom.xml
• e2e/dotcms-e2e-node/pom.xml
• e2e/pom.xml
• independent-projects/core-plugins/pom.xml
• independent-projects/core-plugins/tika-api/pom.xml
• independent-projects/core-plugins/tika-plugin/pom.xml
• independent-projects/pom.xml
• nodejs-parent/pom.xml
• osgi-base/core-bundles/pom.xml
• osgi-base/pom.xml
• osgi-base/system-bundles/pom.xml
• parent/pom.xml
• pom.xml
• reports/pom.xml
• test-jmeter/pom.xml
• test-karate/pom.xml
• tools/dotcms-cli/api-data-model/pom.xml
• tools/dotcms-cli/cli/pom.xml
• tools/dotcms-cli/pom.xml

maven-wrapper

• .mvn/wrapper/maven-wrapper.properties
• mvnw
• mvnw.cmd

mise

• .mise.toml

npm

• .github/actions/issues/issue-fetcher/package.json
• .github/actions/issues/issue-labeler/package.json
• .github/actions/legacy-release/changelog-report/package.json
• .github/actions/legacy-release/rc-changelog/package.json
• .github/scripts/gather-release-data/package.json
• .github/scripts/release-qa-status/package.json
• core-web/apps/mcp-server/package.json
• core-web/libs/dot-layout-grid/package.json
• core-web/libs/dotcms-js/package.json
• core-web/libs/dotcms-models/package.json
• core-web/libs/dotcms-webcomponents/package.json
• core-web/libs/dotcms/package.json
• core-web/libs/edit-content-bridge/package.json
• core-web/libs/sdk/ai/package.json
• core-web/libs/sdk/analytics/package.json
• core-web/libs/sdk/angular/package.json
• core-web/libs/sdk/client/package.json
• core-web/libs/sdk/create-app/package.json
• core-web/libs/sdk/experiments/package.json
• core-web/libs/sdk/react/package.json
• core-web/libs/sdk/types/package.json
• core-web/libs/sdk/uve/package.json
• core-web/libs/sdk/vue/package.json
• core-web/package.json
• dotCMS/src/main/webapp/ext/tinymcev7/package.json
• dotCMS/src/main/webapp/ext/uve/package.json
• dotCMS/src/main/webapp/html/js/dojo/custom-build/dijit/package.json
• dotCMS/src/main/webapp/html/js/dojo/custom-build/dojo/package.json
• dotCMS/src/main/webapp/html/js/dojo/custom-build/dojox/package.json
• dotCMS/src/main/webapp/html/js/legacy_custom_field_bridge/package.json
• dotcms-postman/package.json
• e2e/dotcms-e2e-node/frontend/package.json
• starter/nextjs/package.json

nvm

• .nvmrc
• core-web/.nvmrc

pep621

• cicd/evergreen-tracks/pyproject.toml

Configuration Summary

Based on the default config's presets, Renovate will:

• Start dependency updates only once this onboarding PR is merged
• Hopefully safe environment variables to allow users to configure.
• Show all Merge Confidence badges for pull requests.
• Enable Renovate Dependency Dashboard creation.
• Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
• Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
• Group known monorepo packages together.
• Use curated list of recommended non-monorepo package groupings.
• Show only the Age and Confidence Merge Confidence badges for pull requests.
• Apply crowd-sourced package replacement rules.
• Apply crowd-sourced workarounds for known problems with packages.
• Ensure that every dependency pinned by digest and sourced from Forgejo contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from Gitea contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from GitHub.com and Github enterprise contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from GitLab.com contains a link to the commit-to-commit diff
• Correctly link to the source code for golang.org/x packages
• Link to pkg.go.dev/... for golang.org/x packages' title
• Provide a link to octochangelog's improved breakdown for Renovate's changelogs

---

What to Expect

With your current configuration, Renovate will create 545 Pull Requests (at a maximum of 2 PRs per hour):

Manager	major	minor	patch	replacement
npm	95	143	60	1
maven	54	103	34	0
maven-wrapper	0	1	1	0
github-actions	23	12	1	0
docker-compose	5	7	2	0
mise	0	1	0	0
nvm	1	1	0	0
dockerfile	3	3	0	0
devcontainer	2	0	0	0
Total	183	271	98	1

Note that a single PR can update multiple files and/or managers, so the above rows may not align with the number of PRs being listed above.

🚸 PR creation will be limited to maximum 2 per hour, so it doesn't swamp any CI resources or overwhelm the project. See docs for prHourlyLimit for details.

---

Warning

Please correct - or verify that you can safely ignore - these dependency lookup failures before you merge this PR.

• Failed to look up docker package ghcr.io/dotcms/elasticsearch: no-result

Files affected: dotcms-postman/docker-compose.yml

---

❓ Got questions? Check out Renovate's Docs, particularly the Getting Started section.
If you need any further assistance then you can also request help here.

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

❌ Issue Linking Required

This PR could not be linked to an issue. All PRs must be linked to an issue for tracking purposes.

How to fix this:

Option 1: Add keyword to PR body (Recommended - auto-removes this comment)
Edit this PR description and add one of these lines:

• Fixes #123 or Closes #123 — same-repo issue
• Fixes org/repo#123 or Closes org/repo#123 — cross-repo or private issue
• Closes https://github.com/org/repo/issues/123 — full GitHub URL
• Other supported keywords: fix, fixed, close, closed, resolve, resolved

Option 2: Link via GitHub UI (Note: won't clear the failed check)

1. Go to the PR → Development section (right sidebar)

2. Click "Link issue" and select an existing issue

3. Push a new commit or re-run the workflow to clear the failed check
   Option 3: Use branch naming
   Create a new branch with one of these patterns:

• 123-feature-description (number at start)

• issue-123-feature-description (issue-number at start)

• feature-issue-123 (issue-number anywhere)

Why is this required?

Issue linking ensures proper tracking, documentation, and helps maintain project history. It connects your code changes to the problem they solve.
---This comment was automatically generated by the issue linking workflow