renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    "github>camunda/infra-renovate-config:herodevs.json5"
  ],
  "commitMessagePrefix": "deps:",
  "dependencyDashboard": true,
  "prConcurrentLimit": 50,
  "prHourlyLimit": 10,
  "updateNotScheduled": false,
  "schedule": [
    "* 20-23,0-8 * * 1-5",
    "* * * * 0,6"
  ],
  "labels": [
    "dependencies"
  ],
  "timezone": "Europe/Berlin",
  "customManagers": [
    {
      "customType": "regex",
      "managerFilePatterns": [
        "/^docker-images\\.properties$/"
      ],
      "matchStrings": [
        "^.*=(?<currentValue>.*)$"
      ],
      "depNameTemplate": "{{{matchString}}}",
      "datasourceTemplate": "docker"
    }
  ],
  "hostRules": [
    {
      "hostType": "docker",
      "matchHost": "https://reg.mini.dev",
      "username": "minimus",
      "password": "{{ secrets.INFRA_MINIMUS_REGISTRY_TOKEN }}"
    },
    {
      "hostType": "maven",
      "matchHost": "https://artifacts.camunda.com",
      "username": "{{ secrets.ARTIFACTORY_USERNAME }}",
      "password": "{{ secrets.ARTIFACTORY_PASSWORD }}"
    }
  ],
  "packageRules": [
    {
      "groupName": "all non-major dependencies",
      "groupSlug": "all-minor-patch",
      "matchPackageNames": [
        "*"
      ],
      "matchUpdateTypes": [
        "minor",
        "patch"
      ],
      "automerge": true
    },
    {
      "matchManagers": [
        "maven",
        "dockerfile"
      ],
      "matchUpdateTypes": [
        "minor",
        "patch",
        "pin",
        "digest"
      ],
      "automerge": true
    },
    {
      "matchManagers": [
        "github-actions"
      ],
      "automerge": true
    },
    {
      "matchBaseBranches": [
        "stable/*"
      ],
      "matchUpdateTypes": [
        "major"
      ],
      "enabled": false
    },
    {
      "matchBaseBranches": [
        "stable/*"
      ],
      "matchPackageNames": [
        "io.camunda*"
      ],
      "matchUpdateTypes": [
        "major",
        "minor",
        "replacement"
      ],
      "enabled": false
    },
    {
      "matchPackageNames": [
        "io.camunda.connector{/,}**"
      ],
      "enabled": false
    },
    {
      "matchBaseBranches": [
        "stable/8.6",
        "stable/8.7"
      ],
      "enabled": false,
      "matchPackageNames": [
        "com.google.http-client:google-http-client{/,}**"
      ]
    },
    {
      "matchPackageNames": [
        "camunda/infra-global-github-actions"
      ],
      "matchUpdateTypes": [
        "digest"
      ],
      "changelogUrl": "https://github.com/camunda/infra-global-github-actions/compare/{{currentDigest}}..{{newDigest}}",
      "schedule": ["on sunday"]
    },
    {
      "description": "Disable major version updates to prevent breaking transitive dependency compatibility with langchain4j.",
      "matchUpdateTypes": [
        "major"
      ],
      "matchPackageNames": [
        "org.opensearch.client:opensearch-java",
        "co.elastic.clients:elasticsearch-java",
        "org.elasticsearch.client:elasticsearch-rest-client"
      ],
      "enabled": false
    },
    {
      "description": "Pin Box SDK to v5 line; v10 drops the legacy com.box.sdk package and the auto-paginating iterators.",
      "matchUpdateTypes": ["major"],
      "matchPackageNames": ["com.box:box-java-sdk"],
      "enabled": false
    },
    {
      "description": "Disable major version updates for json-schema-validator — v3 is a complete API rewrite requiring a dedicated migration.",
      "matchUpdateTypes": [
        "major"
      ],
      "matchPackageNames": [
        "com.networknt:json-schema-validator"
      ],
      "enabled": false
    },
    {
        "description": "kafka-clients: stay on the Apache versioning track. The Confluent Platform builds (-ce/-ccs/-cp suffixes, e.g. 8.2.1-ce) are republished under the same org.apache.kafka coordinates via artifacts.camunda.com and must not be treated as upgrades to the Apache releases (x.y.z).",
        "matchPackageNames": [
          "org.apache.kafka:kafka-clients"
        ],
        "allowedVersions": "!/-(ce|ccs|cp\\d*)$/"
      },
    {
      "description": "Disable minor/major updates for google-auth-library-oauth2-http — 1.50.0+ removes the setSecurityProvider method used by connector-google-gemini's vertexai client, breaking its tests. Requires code migration. google-auth-library-credentials is included because parent/pom.xml pins both to the same version.google-auth-library-oauth2-http property, so leaving it unblocked would let Renovate bump the shared property through that dependency instead.",
      "matchUpdateTypes": [
        "major",
        "minor"
      ],
      "matchPackageNames": [
        "com.google.auth:google-auth-library-oauth2-http",
        "com.google.auth:google-auth-library-credentials"
      ],
      "enabled": false
    },
    {
      "description": "Disable minor/major updates for the Google Cloud libraries-bom used by connector-google-gemini specifically — 26.86.0+ pulls in google-auth-library-oauth2-http 1.50.0+ which breaks the connector's vertexai tests. Scoped to the files that feed that module; the independently-versioned libraries-bom in secret-providers/pom.xml is unaffected and can keep updating.",
      "matchUpdateTypes": [
        "major",
        "minor"
      ],
      "matchPackageNames": [
        "com.google.cloud:libraries-bom"
      ],
      "matchFileNames": [
        "parent/pom.xml",
        "connectors/google/pom.xml"
      ],
      "enabled": false
    },
    {
      "description": "Disable major version updates for Apache Tika in connector-embeddings-vector-database — 4.0.0 (GA, released 2026-08-21) is a hard blocker there, not a mirror/staleness issue. (1) tika-parsers-standard-package was restructured from a shaded jar into a POM-only aggregator, so a plain jar dependency on it no longer resolves. (2) Tika 4's Parser interface dropped parse(InputStream,...) in favor of parse(TikaInputStream,...); langchain4j-document-parser-apache-tika 1.19.0, which this connector uses, still calls the old signature and would fail with NoSuchMethodError at runtime even if (1) were fixed — confirmed via bytecode inspection of both jars. Needs LangChain4j to ship Tika 4 support, plus a dependency-shape migration on our side. Scoped to this file only (matching the Google libraries-bom rule above) — connector-aws-bedrock's independent tika-core dependency only uses the MimeTypes API, confirmed compatible with 4.0.0, so it can keep receiving major-version proposals. Tracked in camunda/connectors#8502. Re-enable once that lands.",
      "matchUpdateTypes": ["major"],
      "matchPackageNames": ["org.apache.tika:tika-core", "org.apache.tika:tika-parsers-standard-package"],
      "matchFileNames": ["connectors/embeddings-vector-database/pom.xml"],
      "enabled": false
    },
    {
      "description": "Disable minor/major updates for maven-surefire-plugin and maven-failsafe-plugin — 3.6.0 breaks the build in two ways. First, it removed the `hourly` RunOrder configured in parent/pom.xml, so every module fails at surefire:test before a single test runs. Second, once a supported runOrder is set, Byte Buddy can no longer self-attach its agent inside the forked JVM (\"Could not self-attach to current VM using external process\"), so System Stubs' EnvironmentVariableMocker and Mockito's inline MockMaker both fail to initialise — 390 errors in connector-runtime-core alone. Upgrading needs a real migration: a supported runOrder plus an explicit -javaagent (or surefire classloader settings) so the agent no longer relies on self-attach. Patch updates on the 3.5.x line are unaffected. maven-failsafe-plugin is listed because connectors-e2e-test-agentic-ai pins it to the same plugin.version.maven-surefire-plugin property, so leaving it unblocked would let Renovate bump the shared property through that dependency instead.",
      "matchUpdateTypes": [
        "major",
        "minor"
      ],
      "matchPackageNames": [
        "org.apache.maven.plugins:maven-surefire-plugin",
        "org.apache.maven.plugins:maven-failsafe-plugin"
      ],
      "enabled": false
    }
  ],
  "baseBranchPatterns": [
    "main",
    "/^stable\\/.*/"
  ]
}