chore(deps): set up Renovate across the monorepository

[suiramdev]

Summary

Adds renovate.json5, so Renovate keeps every manifest, workflow, image and the .nvmrc current, with pull requests into dev. Renovate reads no Bun workspace catalog, so a regex custom manager covers the 20 shared versions in workspaces.catalog and .github/workflows/renovate-lockfile.yml refreshes bun.lock on its branches. Read renovate.json5 first, then that workflow. contributing/dependencies.mdx is the reader-facing version.

Motivation

• Every dependency moves by hand today, and nothing reports a release that is behind.
• The catalog holds the stack a contributor meets first: react, tailwindcss, typescript, effect, zod, better-auth, orpc, elysia.
• A security advisory reaches the dependency dashboard the day it lands, outside the weekly schedule.
• The two published Freenary images stay out of it, so a release never proposes itself.

Drawbacks

• The custom manager is a second reader of the catalog. A change to the shape of that block can break it silently, which is why docs/engineering/platform.md says to delete it once feat(bun): add catalog extraction and update support renovatebot/renovate#42909 lands.
• A catalog branch carries one extra commit from github-actions[bot], and gitIgnoredAuthors is what stops Renovate treating that as a branch somebody else changed.
• Automerge on patch and minor rests on the build and a three-day release-age floor, because CI runs no tests. A package pinned to a prerelease is held back for review.
• ci.yml gains a workflow_dispatch trigger that exists for one caller.

Prior art

• postUpgradeTasks does exactly what the lock file job does, but needs a self-hosted allowedCommands, which the Mend app does not offer.
• Committing bun.lock with a PAT or an App token would restart CI on its own. A token to store and rotate buys nothing over workflow_dispatch, which GitHub exempts from the no-recursion rule.
• Dependabot has no Bun support at all.

Notes

• No visual change.
• No tests added; verified by running Renovate itself. renovate --platform=local --dry-run=extract reports six managers and the 20 catalog entries, and renovate-config-validator passes with no migration warning.
• Reproduced the failure the lock file job exists for: moving a catalog entry makes bun install --frozen-lockfile fail with the catalog in package.json changed since bun.lock was saved, and bun install --lockfile-only clears it.
• Documentation: adds contributing/dependencies.mdx, its meta.json entry and a card plus one corrected sentence in contributing/index.mdx. docs/engineering/platform.md gains three bullets.
• Merge order. Renovate reads its config from the default branch alone, so this is inert until main carries renovate.json5 and the workflow_dispatch trigger. A second pull request follows this one to put both on main. Until then, leave the Configure Renovate onboarding pull request unmerged: merging it onboards the repository against main with stock defaults and no catalog manager.
• Review summary: config and documentation only, no runtime code.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 424476e4-6ff1-4d8d-bdd1-c8291a539730

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}