Hand version updates to Renovate

Renovate proposes the version updates of this repository from now on.
It watches what Dependabot watched, looks once a week, takes a release
a week after it is published, opens one pull request for each kind of
dependency with at most two open, and rebases a pull request only when
it conflicts. A dashboard issue lists what is pending.

The Dependabot configuration is removed, which turns its version
updates off. Dependabot keeps its alerts and its security updates,
which are repository settings. Renovate does not open its own pull
requests for vulnerabilities, so one advisory does not get two fixes.

The configuration passes Renovate's validator and takes effect when
the Renovate app is installed on the repository.

2 files changed, 50 insertions, 18 deletions

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 6bad227c..00000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
-# SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-1.1
-
-version: 2
-updates:
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-  - package-ecosystem: bazel
-    directory: /
-    schedule:
-      interval: weekly
-  - package-ecosystem: pip
-    directory: /
-    schedule:
-      interval: weekly
-
diff --git a/.github/renovate.json5 b/.github/renovate.json5
new file mode 100644
index 00000000..0e6bbfb0
--- /dev/null
+++ b/.github/renovate.json5
@@ -0,0 +1,50 @@
+// SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+// SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-1.1
+
+// Renovate proposes the version updates of this repository. Dependabot keeps
+// its alerts and its security updates, which are repository settings; its
+// version updates are off, so that two bots do not open the same pull
+// request.
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  extends: ["config:recommended", "helpers:pinGitHubActionDigests"],
+
+  // This repository is a fork, which Renovate leaves alone unless it is told
+  // that the fork is maintained in its own right.
+  forkProcessing: "enabled",
+
+  timezone: "Europe/Istanbul",
+  // Once a week, before the working day.
+  schedule: ["before 6am on monday"],
+
+  // A release is taken a week after it is published: one that turns out to
+  // be broken or malicious is usually withdrawn within days.
+  minimumReleaseAge: "7 days",
+
+  // A pull request is rebased when it conflicts, not whenever the default
+  // branch moves, so that a merge does not start the tests of every open
+  // update again.
+  rebaseWhen: "conflicted",
+  prConcurrentLimit: 2,
+  prHourlyLimit: 2,
+
+  // One issue lists what is pending, so an update need not be a pull request
+  // to be seen.
+  dependencyDashboard: true,
+
+  // Security fixes come from Dependabot security updates. Renovate does not
+  // open its own for the same advisory.
+  vulnerabilityAlerts: { enabled: false },
+
+  ignorePaths: ["third_party/**", "**/node_modules/**"],
+
+  // What Dependabot watched here, and nothing more for now.
+  enabledManagers: ["github-actions", "bazel-module", "pip_requirements"],
+
+  // One pull request for each kind of dependency.
+  packageRules: [
+    { matchManagers: ["github-actions"], groupName: "GitHub Actions" },
+    { matchManagers: ["bazel-module"], groupName: "Bazel modules" },
+    { matchManagers: ["pip_requirements"], groupName: "Python tools of CI" },
+  ],
+}