[jshvn]

Summary

• renovate.json extends github>jshvn/renovate-config, the policy every jshvn repository shares. Nothing here is specific to this repository.
• .github/dependabot.yml is gone. Dependabot alerts stay on; Renovate reads them for its security pull requests, which open at once on any day.
• CLAUDE.md says how updates arrive.

What changes for this repository

• One Monday pull request for the minor and patch updates of the npm devDependencies and the actions, one per major, each assigned to jshvn.
• The first run also opens pull requests that pin the devDependencies to exact versions and the actions (actions/checkout, actions/setup-node, 1password/load-secrets-action) to a commit, and a weekly lock-file refresh.
• A release is taken once it is three days old.
• Once Renovate's first Monday pull request is open, Dependabot's build(deps): bump undici and wrangler #21 and build(deps-dev): bump the dev-dependencies group across 1 directory with 4 updates #23 can be closed: it proposes the same bumps, grouped.

Test plan

• renovate-config-validator --strict --no-global renovate.json passes in ghcr.io/renovatebot/renovate:latest
• check passes here (nothing it runs reads these files)

After merge

Add jshvn/dispatch-cloudflare to the Mend Renovate installation at github.com/settings/installations.