{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended", "docker:pinDigests"],
  "description": "Audit pass 3 #145 (B4): pin docker base image digests and auto-bump them. The `docker:pinDigests` preset rewrites every `FROM image:tag` in committed Dockerfiles into `FROM image:tag@sha256:...` and opens PRs whenever an upstream image rebuilds.",
  "labels": ["dependencies", "docker", "audit-pass-3"],
  "dockerfile": {
    "fileMatch": ["(^|/)Dockerfile[^/]*$", "(^|/)Dockerfile\\.[^/]+$"]
  },
  "packageRules": [
    {
      "matchManagers": ["dockerfile"],
      "matchUpdateTypes": ["digest"],
      "schedule": ["before 6am on monday"],
      "groupName": "docker base image digests",
      "automerge": false
    },
    {
      "matchManagers": ["dockerfile"],
      "matchUpdateTypes": ["pinDigest"],
      "automerge": false,
      "prPriority": 5
    },
    {
      "matchManagers": ["npm"],
      "matchDepTypes": ["devDependencies"],
      "matchUpdateTypes": ["patch"],
      "groupName": "npm devDependencies (patch)",
      "automerge": false
    }
  ],
  "vulnerabilityAlerts": {
    "enabled": true
  }
}