chore: make Renovate group, automerge, and refresh dependencies

[Ethan-Arrowood]

Why

Renovate has not run on this repository since 2026-01-29. The last Renovate PR was #432 (created 2026-01-28), and the Dependency Dashboard has been frozen since 2026-01-29 even though Renovate rewrites that issue on every single run. Seven months of drift has accumulated:

Package	Current	Latest
@docusaurus/* (10 packages)	3.9.2	3.10.2
@easyops-cn/docusaurus-search-local	0.52.3	0.55.3
prettier	3.8.1	3.9.6
react / react-dom	19.2.4	19.2.8
typescript	5.9.3	7.0.2 (major)

This PR cannot restart Renovate — the root cause is outside the repository. It fixes the config so that dependencies actually flow well once service resumes, and records the diagnosis.

Diagnosis

Ranked conclusion

#1 — documentation is not enabled in the Renovate app's repository selection (or is disabled on the Mend side). This is the only hypothesis consistent with every observation.

The decisive evidence is a cross-repo comparison. The renovate GitHub App (installation 84209395) is installed on the org with "repository_selection": "selected" — an explicit allowlist exists:

Repo	renovate.json?	Dependency Dashboard last updated	Renovate service
harper	yes	2026-08-27 (today)	healthy
harper-pro	yes	2026-08-27 (today)	healthy
documentation	yes	2026-01-29	stopped
skills	yes	never created	never started

skills is the control that makes this conclusive: it has had a valid renovate.json for months, yet Renovate has never opened an onboarding PR, never created a Dependency Dashboard, and never opened a dependency PR there. Two repos with valid configs get no service at all; two get service the same day. That pattern is governed by repository selection and Mend-side enablement, not by file contents.

Proven in this repo

• The config is not the cause of the stoppage. renovate.json has exactly one commit in its entire history (032ed16d, 2026-01-14, Automate dependency management with Renovate and Socket #416) and was never modified afterward. A file that never changed cannot explain a behavior change on 2026-01-29.
• The config is valid. renovate-config-validator passes on the old file, including --strict.
• No competing config locations. Only renovate.json at the repo root. No .github/renovate.json, no renovate.json5, no .renovaterc*, and no renovate key in package.json. (Multiple config files would itself be a fatal error.)
• Not an app or hosting mismatch. HarperFast/harper has no Renovate workflow among its 26 workflows, so it is not self-hosted via Actions. PR Update dependency prettier to v3.8.1 #432 here and harper#2286 are both authored by the same app/renovate bot. Same Mend cloud app on both repos.
• Not an org-wide outage. Two dashboards were rewritten today.
• Not branch protection. main requires 0 approving reviews, enforce_admins: false, strict: false, block_creations: false. Nothing blocks branch creation or merge — and branch protection could not prevent Renovate from rewriting the Dependency Dashboard issue anyway.
• Not a private-registry auth failure. @harperfast/code-guidelines@0.1.2 is public on npm.
• Not repo size or job timeout. documentation is ~20 MB; harper is ~227 MB (11x larger) and runs fine.
• Not the pinning change. switch to pinned dependencies #433 ("switch to pinned dependencies") landed 2026-02-03, after Renovate had already stopped on 2026-01-29.
• Not a suppressed config-warning artifact. Zero issues match renovate in:title, and dashboard Dependency Dashboard #420 has zero comments.
• Not the org rename. GitHub App installations track repository IDs rather than names, and HarperDB/documentation still redirects to HarperFast/documentation (same created_at, 2022-08-19). A stale full-name cache on Mend's side cannot be ruled out from here, but it would not explain skills.
• Not reviewersFromCodeOwners. .github/CODEOWNERS exists and is valid.

Could not test from here — needs the owner's browser

1. GitHub → Organization settings → GitHub Apps → Renovate (installation 84209395) → Repository access.
   Healthy: documentation (and skills) appear in the selected-repositories list.
   Broken: they are absent. Fix by adding them.
2. https://developer.mend.io/github/HarperFast/documentation
   Healthy: the repo is listed, shows Enabled, and has a job log entry within the last ~24 hours.
   Broken: "repository not found / not installed", an explicit disabled state, or a last job dated on or near 2026-01-29.
3. The Mend job log for the run after 2026-01-29. Whatever error is recorded there names the actual cause. This is the single highest-value artifact and it is only visible in that dashboard.
4. If the repo is listed but stale, toggle it off/on (or use Mend's re-onboard/reset) to re-enqueue a job. Ticking the "Check this box to trigger a request for Renovate to run again" checkbox on dashboard Dependency Dashboard #420 is also a cheap live test: if Renovate is reachable at all, that box gets consumed within minutes. It has been sitting unconsumed, which is itself consistent with CORE-1825 Add/Update "install harpedb" subtopics #1.

Config changes

Grouping

• @docusaurus/** grouped into one docusaurus monorepo PR. Verified that all ten packages — including tsconfig, types, and module-type-aliases — publish 3.10.2 in lockstep, so grouping them is correct and any solo bump breaks the build. Renovate's built-in group:monorepos preset (part of config:recommended) already recognizes Docusaurus, so this is partly belt-and-braces, but making it explicit removes the dependency on every package's repository metadata resolving correctly and gives the group a place to hang the automerge policy below.
• react + react-dom grouped. Same reason, smaller blast radius.

Automerge

• Patch and minor devDependencies automerge with automergeType: "pr". Every dependency here is a devDependency, and I confirmed empirically that Renovate PRs get a full npm run build: Deploy PR Preview ran and succeeded on PR Update dependency prettier to v3.8.1 #432 at creation time, because that workflow's path filter includes package.json and package-lock.json. So a green branch really does mean the site builds.
• platformAutomerge: false — this one is deliberate and worth flagging. main's required status checks are only TypeScript Check, Lint Check, and Format Check. The build is not a required check. GitHub-native auto-merge (Renovate's default) merges as soon as required checks pass, so it would have merged dependency bumps without ever waiting for the Docusaurus build. Turning it off makes Renovate wait for the whole branch to be green, build included.
• automergeSchedule: ["at any time"] so the weekly PR schedule does not also delay merges by up to a week.
• Held back from automerge: all majors; 0.x minors (a minor is a breaking change below 1.0 — currently @easyops-cn/docusaurus-search-local and @harperfast/code-guidelines); and Docusaurus minors, since a minor can change rendering without failing the build and the PR preview deployment deserves a human look. Docusaurus patches still automerge.

TypeScript 5.9.3 → 7.0.2

Gated behind dependencyDashboardApproval: true rather than pinned or blocked. TypeScript 7 is a full compiler rewrite and @docusaurus/tsconfig 3.x is not validated against it. Dashboard approval keeps the upgrade visible and one click away without a PR nagging in the queue — whereas an allowedVersions pin would quietly hide it.

lockFileMaintenance

Enabled, monthly, automerged. Note this differs from harper and skills, which both disable it — and the difference is justified: all direct dependencies here were pinned to exact versions in #433, so lockfile maintenance is now the only mechanism by which transitive dependencies ever get security or bug fixes. Monthly keeps the noise low, and it is gated by the same green-build requirement.

prConcurrentLimit: 2 → 10, prHourlyLimit: 2 → 4

A limit of 2 throttles hard against a 7-month backlog, and with minimumReleaseAge: "7 days" a blocked queue can stay blocked for weeks. 10 is also config:recommended's own default. Grouping means the backlog is only ~6 PRs, so this should drain in one run; consider lowering back to ~5 once caught up.

schedule / timezone / semanticCommits

Added to match harper and skills, which both use the identical America/New_York + before 9am on Monday + semanticCommits: "enabled" triple. This makes all three org configs consistent and produces chore(deps): prefixes like the other repos.

Verification caveat: because of this schedule, the first run after the app-side fix will appear on a Monday morning ET. Do not read the quiet days in between as the outage continuing — use the dashboard checkbox to force a run.

Kept unchanged, as intended

minimumReleaseAge: "7 days", internalChecksFilter: "strict", and reviewersFromCodeOwners: true.

Also noticed (not changed here)

• npm run lint is echo 0; — a no-op. The required Lint Check status therefore provides no signal at all. Two of main's three required checks are meaningful (tsc, prettier --check); the third is theater.
• The build is not a required status check, which is why platformAutomerge had to be disabled above. Adding Deploy PR Preview to main's required checks would be the cleaner fix and would let native auto-merge be used again.
• Cleanup PR Preview failed on PR Update dependency prettier to v3.8.1 #432's close-event run. Unrelated to Renovate, but it is failing.

Verification

• renovate-config-validator --strict passes. (It caught a real error in my first draft: before 9am on the first Monday of the month is not a parseable schedule.)
• npm run format:write then npm run format:check — clean.
• npm run build — succeeds. The broken-anchor warnings are pre-existing on main and unrelated.

Only renovate.json is modified; package.json and package-lock.json are untouched.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request significantly expands the Renovate configuration in renovate.json by defining schedules, limits, and granular package rules for automerging, pinning digests, and grouping dependencies like Docusaurus and React. Feedback was provided to simplify the rules for 0.x minor updates and major updates by combining them into a single rule using the breaking update type.

[gemini-code-assist]

You can simplify these two rules into a single one by using the breaking value for matchUpdateTypes. Renovate considers major updates (e.g., 1.x -> 2.x) and minor updates for 0.x packages (e.g., 0.1.x -> 0.2.x) as breaking changes. This makes the configuration more concise and semantic.

		{
			"description": "Never automerge breaking changes (major updates, or minor updates for 0.x packages).",
			"matchUpdateTypes": ["breaking"],
			"automerge": false
		},

[Ethan-Arrowood]

Checked this one carefully and I'm not taking it - breaking is not a valid matchUpdateTypes value, and the way it fails is the problem.

Renovate 44.48.2's own shipped types (dist/config/types.d.ts:444):

type UpdateType = 'major' | 'minor' | 'patch' | 'pin' | 'digest' | 'pinDigest'
  | 'lockFileMaintenance' | 'lockfileUpdate' | 'rollback' | 'bump' | 'replacement';

No breaking. The published renovate-schema.json enum agrees.

The dangerous part is that nothing would have caught this. The schema's matchUpdateTypes is an anyOf whose second branch is a bare {"type": "string"}, so any string validates. I confirmed it with a control: a rule using matchUpdateTypes: ["definitelyNotAnUpdateType"] passes renovate-config-validator --strict with "Config validated successfully."

So had I applied this, the rule would have validated clean, silently matched nothing, and let major bumps and 0.x minors fall through to the automerge default - merged with no review. A verbose config is much cheaper than that.

Keeping the two explicit rules. They're wordier but they demonstrably match what they say: matchUpdateTypes: ["major"], and matchCurrentVersion: "/^0\\./" + matchUpdateTypes: ["minor"] for the 0.x case.

_{sent with Claude Opus 5}

[kriszyp]

LGTM
_{🤖 Reviewed with Codex}

[kriszyp]

This also automerges patch/minor updates to @signalwire/docusaurus-plugin-llms-txt, but PR CI only builds; it does not run the flat-Markdown assertions at .github/workflows/deploy.yaml:64. A plugin regression that still lets Docusaurus build but stops emitting per-section Markdown, llms.txt, or llms-full.txt would pass .github/workflows/pr-preview.yaml:65 and validation, merge automatically here, then fail the GitHub Pages deployment. Please either run the same artifact verification on PRs before enabling automerge, or add a later package rule with automerge: false for this plugin.