chore: Configure Renovate for Automated Dependency Management

[doordash-renovate]

Welcome to Renovate! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.

📚 See our Reading List for relevant documentation you may be interested in reading.

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to renovate.json in this branch and select the Retry/Rebase checkbox below. Renovate will update the Pull Request description the next time it runs.

---

Detected Package Files

• .github/actions/prepare-test/action.yml (github-actions)
• .github/actions/release-initialise/action.yml (github-actions)
• .github/workflows/__all-platform-bundle.yml (github-actions)
• .github/workflows/__analysis-kinds.yml (github-actions)
• .github/workflows/__analyze-ref-input.yml (github-actions)
• .github/workflows/__autobuild-action.yml (github-actions)
• .github/workflows/__autobuild-direct-tracing-with-working-dir.yml (github-actions)
• .github/workflows/__autobuild-working-dir.yml (github-actions)
• .github/workflows/__build-mode-autobuild.yml (github-actions)
• .github/workflows/__build-mode-manual.yml (github-actions)
• .github/workflows/__build-mode-none.yml (github-actions)
• .github/workflows/__build-mode-rollback.yml (github-actions)
• .github/workflows/__bundle-from-nightly.yml (github-actions)
• .github/workflows/__bundle-from-toolcache.yml (github-actions)
• .github/workflows/__bundle-toolcache.yml (github-actions)
• .github/workflows/__bundle-zstd.yml (github-actions)
• .github/workflows/__cleanup-db-cluster-dir.yml (github-actions)
• .github/workflows/__config-export.yml (github-actions)
• .github/workflows/__config-input.yml (github-actions)
• .github/workflows/__cpp-deptrace-disabled.yml (github-actions)
• .github/workflows/__cpp-deptrace-enabled-on-macos.yml (github-actions)
• .github/workflows/__cpp-deptrace-enabled.yml (github-actions)
• .github/workflows/__diagnostics-export.yml (github-actions)
• .github/workflows/__export-file-baseline-information.yml (github-actions)
• .github/workflows/__extractor-ram-threads.yml (github-actions)
• .github/workflows/__global-proxy.yml (github-actions)
• .github/workflows/__go-custom-queries.yml (github-actions)
• .github/workflows/__go-indirect-tracing-workaround-diagnostic.yml (github-actions)
• .github/workflows/__go-indirect-tracing-workaround-no-file-program.yml (github-actions)
• .github/workflows/__go-indirect-tracing-workaround.yml (github-actions)
• .github/workflows/__go-tracing-autobuilder.yml (github-actions)
• .github/workflows/__go-tracing-custom-build-steps.yml (github-actions)
• .github/workflows/__go-tracing-legacy-workflow.yml (github-actions)
• .github/workflows/__init-with-registries.yml (github-actions)
• .github/workflows/__javascript-source-root.yml (github-actions)
• .github/workflows/__job-run-uuid-sarif.yml (github-actions)
• .github/workflows/__language-aliases.yml (github-actions)
• .github/workflows/__local-bundle.yml (github-actions)
• .github/workflows/__multi-language-autodetect.yml (github-actions)
• .github/workflows/__overlay-init-fallback.yml (github-actions)
• .github/workflows/__packaging-codescanning-config-inputs-js.yml (github-actions)
• .github/workflows/__packaging-config-inputs-js.yml (github-actions)
• .github/workflows/__packaging-config-js.yml (github-actions)
• .github/workflows/__packaging-inputs-js.yml (github-actions)
• .github/workflows/__remote-config.yml (github-actions)
• .github/workflows/__resolve-environment-action.yml (github-actions)
• .github/workflows/__rubocop-multi-language.yml (github-actions)
• .github/workflows/__ruby.yml (github-actions)
• .github/workflows/__rust.yml (github-actions)
• .github/workflows/__split-workflow.yml (github-actions)
• .github/workflows/__start-proxy.yml (github-actions)
• .github/workflows/__submit-sarif-failure.yml (github-actions)
• .github/workflows/__swift-autobuild.yml (github-actions)
• .github/workflows/__swift-custom-build.yml (github-actions)
• .github/workflows/__unset-environment.yml (github-actions)
• .github/workflows/__upload-ref-sha-input.yml (github-actions)
• .github/workflows/__upload-sarif.yml (github-actions)
• .github/workflows/__with-checkout-path.yml (github-actions)
• .github/workflows/check-expected-release-files.yml (github-actions)
• .github/workflows/codeql.yml (github-actions)
• .github/workflows/codescanning-config-cli.yml (github-actions)
• .github/workflows/debug-artifacts-failure-safe.yml (github-actions)
• .github/workflows/debug-artifacts-safe.yml (github-actions)
• .github/workflows/label-pr-size.yml (github-actions)
• .github/workflows/post-release-mergeback.yml (github-actions)
• .github/workflows/pr-checks.yml (github-actions)
• .github/workflows/prepare-release.yml (github-actions)
• .github/workflows/publish-immutable-action.yml (github-actions)
• .github/workflows/python312-windows.yml (github-actions)
• .github/workflows/query-filters.yml (github-actions)
• .github/workflows/rebuild.yml (github-actions)
• .github/workflows/rollback-release.yml (github-actions)
• .github/workflows/test-codeql-bundle-all.yml (github-actions)
• .github/workflows/update-bundle.yml (github-actions)
• .github/workflows/update-release-branch.yml (github-actions)
• .github/workflows/update-supported-enterprise-server-versions.yml (github-actions)
• package.json (npm)
• tests/multi-language-repo/global.json (nuget)
• .github/workflows/update-supported-enterprise-server-versions/Pipfile (pipenv)
• renovate.json (renovate-config)

Configuration Summary

Based on the default config's presets, Renovate will:

• Start dependency updates only once this onboarding PR is merged
• Deliveroo org-inherited Renovate config. Redirects onboarding of new deliveroo repos to Deliveroo's own presets instead of the doordash preset (which the deliveroo installation token cannot fetch cross-org).
• Enable Renovate Dependency Dashboard creation.
• Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
• Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
• Group known monorepo packages together.
• Use curated list of recommended non-monorepo package groupings.
• Show only the Age and Confidence Merge Confidence badges for pull requests.
• Apply crowd-sourced package replacement rules.
• Apply crowd-sourced workarounds for known problems with packages.
• Ensure that every dependency pinned by digest and sourced from Forgejo contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from Gitea contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from GitHub.com and Github enterprise contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from GitLab.com contains a link to the commit-to-commit diff
• Correctly link to the source code for golang.org/x packages
• Link to pkg.go.dev/... for golang.org/x packages' title
• Enable Docker Compose image updating.
• Upgrade Docker tags to newer versions.
• CircleCI config that is not language specific
• Configuration for Go projects
• Configuration for Hopper
• Configuration for infrastructure
• Configuration for JavaScript
• Configuration for Python projects
• Set of configuration to be used for JavaScript projects at Deliveroo
• Shared, base configuration which is used by all other configuration options
• Schedule during typical non-office hours on weekdays (i.e., 10 PM - 5 AM) and anytime on weekends.
• Run Renovate on following schedule: * 0-4,22-23 * * 1-5,* * * * 0,6

---

What to Expect

With your current configuration, Renovate will create 61 Pull Requests:

Update dependency uuid to v13.0.1 [SECURITY]

• Branch name: renovate/npm-uuid-vulnerability
• Merge into: main
• Upgrade uuid to 13.0.1

Update dependency esbuild to ^0.28.0 [SECURITY]

• Branch name: renovate/npm-esbuild-vulnerability
• Merge into: main
• Upgrade esbuild to ^0.28.0

Update dependency follow-redirects to v1.16.0 [SECURITY]

• Branch name: renovate/npm-follow-redirects-vulnerability
• Merge into: main
• Upgrade follow-redirects to 1.16.0

Update dependency js-yaml to v4.2.0 [SECURITY]

• Branch name: renovate/npm-js-yaml-vulnerability
• Merge into: main
• Upgrade js-yaml to 4.2.0

Update dependency node-forge to v1.4.0 [SECURITY]

• Branch name: renovate/npm-node-forge-vulnerability
• Merge into: main
• Upgrade node-forge to 1.4.0

Update actions/create-github-app-token action to v2.2.2

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-create-github-app-token-2.x
• Merge into: main
• Upgrade actions/create-github-app-token to v2.2.2

Update dependency @​actions/artifact-legacy to v1.1.3

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-artifact-legacy-1.x-lockfile
• Merge into: main
• Upgrade @actions/artifact-legacy to 1.1.3

Update dependency @​types/node to v20.19.43

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/node-20.x-lockfile
• Merge into: main
• Upgrade @types/node to 20.19.43

Update dependency dotnet-sdk to v9.0.315

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/dotnet-monorepo
• Merge into: main
• Upgrade dotnet-sdk to 9.0.315

Update dependency eslint to v9.39.4

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/eslint-monorepo
• Merge into: main
• Upgrade eslint to 9.39.4

Update dependency nock to v14.0.16

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/nock-14.x-lockfile
• Merge into: main
• Upgrade nock to 14.0.16

Update dependency @​actions/cache to v5.1.0

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-cache-5.x-lockfile
• Merge into: main
• Upgrade @actions/cache to 5.1.0

Update dependency @​actions/glob to ^0.7.0

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-glob-0.x
• Merge into: main
• Upgrade @actions/glob to ^0.7.0

Update dependency @​eslint/compat to v2.1.0

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/eslint-compat-2.x-lockfile
• Merge into: main
• Upgrade @eslint/compat to 2.1.0

Update dependency @​octokit/plugin-retry to v8.1.0

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/octokit-monorepo
• Merge into: main
• Upgrade @octokit/plugin-retry to 8.1.0

Update dependency eslint-import-resolver-typescript to v3.10.1

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/eslint-import-resolver-typescript-3.x-lockfile
• Merge into: main
• Upgrade eslint-import-resolver-typescript to 3.10.1

Update dependency eslint-plugin-github to v6.1.1

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/eslint-plugin-github-6.x-lockfile
• Merge into: main
• Upgrade eslint-plugin-github to 6.1.1

Update dependency eslint-plugin-import-x to v4.17.1

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/eslint-plugin-import-x-4.x-lockfile
• Merge into: main
• Upgrade eslint-plugin-import-x to 4.17.1

Update dependency eslint-plugin-jsdoc to v62.9.0

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/eslint-plugin-jsdoc-62.x-lockfile
• Merge into: main
• Upgrade eslint-plugin-jsdoc to 62.9.0

Update dependency go to 1.26

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/go-1.x
• Merge into: main
• Upgrade go to 1.26

Update dependency jsonschema to v1.5.0

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/jsonschema-1.x
• Merge into: main
• Upgrade jsonschema to 1.5.0

Update dependency python to 3.14

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/python-3.x
• Merge into: main
• Upgrade python to 3.14

Update dependency ruby to v2.7.8

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/ruby-2.x
• Merge into: main
• Upgrade ruby to 2.7.8

Update dependency semver to v7.8.5

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/semver-7.x-lockfile
• Merge into: main
• Upgrade semver to 7.8.5

Update dependency semver to v7.8.5

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/semver-7.x
• Merge into: main
• Upgrade semver to 7.8.5

Update dependency sinon to v21.1.2

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/sinon-21.x-lockfile
• Merge into: main
• Upgrade sinon to 21.1.2
• Upgrade @types/sinon to 21.0.1

Update dependency typescript-eslint to v8.63.0

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/typescript-eslint-monorepo
• Merge into: main
• Upgrade typescript-eslint to 8.63.0

Update ruby/setup-ruby action to v1.316.0

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/ruby-setup-ruby-1.x
• Merge into: main
• Upgrade ruby/setup-ruby to d45b1a4e94b71acab930e56e79c6aa188764e7f9

Update actions/checkout action to v7

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-checkout-7.x
• Merge into: main
• Upgrade actions/checkout to v7

Update actions/create-github-app-token action to v3

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-create-github-app-token-3.x
• Merge into: main
• Upgrade actions/create-github-app-token to v3.2.0

Update actions/github-script action to v9

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-github-script-9.x
• Merge into: main
• Upgrade actions/github-script to v9

Update actions/setup-dotnet action to v6

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-setup-dotnet-6.x
• Merge into: main
• Upgrade actions/setup-dotnet to v6

Update actions/setup-go action to v7

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-setup-go-7.x
• Merge into: main
• Upgrade actions/setup-go to v7

Update actions/setup-node action to v7

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-setup-node-7.x
• Merge into: main
• Upgrade actions/setup-node to v7

Update actions/setup-python action to v7

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-setup-python-7.x
• Merge into: main
• Upgrade actions/setup-python to v7

Update dependency @​actions/artifact to v6

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-artifact-6.x
• Merge into: main
• Upgrade @actions/artifact to ^6.0.0

Update dependency @​actions/artifact-legacy to v6

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-artifact-legacy-6.x
• Merge into: main
• Upgrade @actions/artifact-legacy to ^6.0.0

Update dependency @​actions/cache to v6

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-cache-6.x
• Merge into: main
• Upgrade @actions/cache to ^6.0.0

Update dependency @​actions/core to v3

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-core-3.x
• Merge into: main
• Upgrade @actions/core to ^3.0.0

Update dependency @​actions/exec to v3

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-exec-3.x
• Merge into: main
• Upgrade @actions/exec to ^3.0.0

Update dependency @​actions/github to v9

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-github-9.x
• Merge into: main
• Upgrade @actions/github to ^9.0.0

Update dependency @​actions/http-client to v4

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-http-client-4.x
• Merge into: main
• Upgrade @actions/http-client to ^4.0.0

Update dependency @​actions/io to v3

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-io-3.x
• Merge into: main
• Upgrade @actions/io to ^3.0.0

Update dependency @​actions/tool-cache to v4

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/actions-tool-cache-4.x
• Merge into: main
• Upgrade @actions/tool-cache to ^4.0.0

Update dependency @​ava/typescript to v7

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/ava-typescript-7.x
• Merge into: main
• Upgrade @ava/typescript to 7.0.0

Update dependency @​schemastore/package to v1

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/schemastore-package-1.x
• Merge into: main
• Upgrade @schemastore/package to 1.0.5

Update dependency archiver to v8

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/archiver-8.x
• Merge into: main
• Upgrade archiver to ^8.0.0
• Upgrade @types/archiver to ^8.0.0

Update dependency ava to v8

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/ava-8.x
• Merge into: main
• Upgrade ava to ^8.0.0

Update dependency dotnet-sdk to v10

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/major-dotnet-monorepo
• Merge into: main
• Upgrade dotnet-sdk to 10.0.301

Update dependency eslint to v10

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/major-eslint-monorepo
• Merge into: main
• Upgrade eslint to ^10.0.0

Update dependency eslint-import-resolver-typescript to v4

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/eslint-import-resolver-typescript-4.x
• Merge into: main
• Upgrade eslint-import-resolver-typescript to ^4.0.0

Update dependency eslint-plugin-jsdoc to v63

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/eslint-plugin-jsdoc-63.x
• Merge into: main
• Upgrade eslint-plugin-jsdoc to ^63.0.0

Update dependency glob to v13

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/glob-13.x
• Merge into: main
• Upgrade glob to ^13.0.0

Update dependency globals to v17

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/globals-17.x
• Merge into: main
• Upgrade globals to ^17.0.0

Update dependency https-proxy-agent to v9

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/https-proxy-agent-9.x
• Merge into: main
• Upgrade https-proxy-agent to ^9.0.0

Update dependency node to v24

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/node-24.x
• Merge into: main
• Upgrade node to 24.x
• Upgrade @types/node to ^24.0.0

Update dependency ruby to v4

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/ruby-4.x
• Merge into: main
• Upgrade ruby to 4.0.5

Update dependency sinon to v22

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/sinon-22.x
• Merge into: main
• Upgrade sinon to ^22.0.0
• Upgrade @types/sinon to ^22.0.0

Update dependency typescript to v6

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/typescript-6.x
• Merge into: main
• Upgrade typescript to ^6.0.0

Update GitHub Artifact Actions (major)

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/major-github-artifact-actions
• Merge into: main
• Upgrade actions/download-artifact to v8
• Upgrade actions/upload-artifact to v7

Update ubuntu Docker tag to v24

• Schedule: ["* 0-4,22-23 * * 1-5","* * * * 0,6"]
• Branch name: renovate/ubuntu-24.x
• Merge into: main
• Upgrade ubuntu to 24.04

🚸 PR creation will be limited to maximum 1 per hour, so it doesn't swamp any CI resources or overwhelm the project. See docs for prHourlyLimit for details.

---

Warning

Please correct - or verify that you can safely ignore - these dependency lookup failures before you merge this PR.

• Could not determine new digest for update (github-tags package lerebear/sizeup-action)

Files affected: .github/workflows/label-pr-size.yml

---

❓ Got questions? Check out Renovate's Docs, particularly the Getting Started section.
If you need any further assistance then you can also request help here.

---

• If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by Mend Renovate.