Merge the Renovate change into this branch

The pull request that hands version updates to Renovate is folded in
here, so that the two workflow changes are tested and merged once.

2 files changed, 46 insertions, 18 deletions

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index b19178a..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
-# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
-
-version: 2
-updates:
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-  - package-ecosystem: npm
-    directory: /frontend
-    schedule:
-      interval: weekly
-  - package-ecosystem: gradle
-    directory: /backend
-    schedule:
-      interval: weekly
-
diff --git a/.github/renovate.json5 b/.github/renovate.json5
new file mode 100644
index 0000000..6d8623b
--- /dev/null
+++ b/.github/renovate.json5
@@ -0,0 +1,46 @@
+// SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+// SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+// Renovate proposes the version updates of this repository. Dependabot keeps
+// its alerts and its security updates, which are repository settings; its
+// version updates are off, so that two bots do not open the same pull
+// request.
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  extends: ["config:recommended", "helpers:pinGitHubActionDigests"],
+
+  timezone: "Europe/Istanbul",
+  // Once a week, before the working day.
+  schedule: ["before 6am on monday"],
+
+  // A release is taken a week after it is published: one that turns out to
+  // be broken or malicious is usually withdrawn within days.
+  minimumReleaseAge: "7 days",
+
+  // A pull request is rebased when it conflicts, not whenever the default
+  // branch moves, so that a merge does not start the tests of every open
+  // update again.
+  rebaseWhen: "conflicted",
+  prConcurrentLimit: 2,
+  prHourlyLimit: 2,
+
+  // One issue lists what is pending, so an update need not be a pull request
+  // to be seen.
+  dependencyDashboard: true,
+
+  // Security fixes come from Dependabot security updates. Renovate does not
+  // open its own for the same advisory.
+  vulnerabilityAlerts: { enabled: false },
+
+  ignorePaths: ["**/node_modules/**"],
+
+  // What Dependabot watched here, and nothing more for now.
+  enabledManagers: ["github-actions", "npm", "gradle", "gradle-wrapper"],
+
+  // One pull request for each kind of dependency.
+  packageRules: [
+    { matchManagers: ["github-actions"], groupName: "GitHub Actions" },
+    { matchManagers: ["npm"], groupName: "Frontend packages" },
+    { matchManagers: ["gradle", "gradle-wrapper"], groupName: "Backend plugins and libraries" },
+  ],
+}