renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "github>grafana/grafana-renovate-config//presets/base",
    "github>grafana/grafana-renovate-config//presets/shared-workflows",
    "security:only-security-updates"
  ],
  "packageRules": [
    {
      "description": "Always update grafana/shared-workflows actions to their latest releases. Overrides the wildcard enabled:false from security:only-security-updates.",
      "matchManagers": ["github-actions"],
      "matchPackageNames": ["grafana/shared-workflows"],
      "enabled": true
    },
    {
      "description": "Always update these to latest, all update types. Overrides the wildcard enabled:false from security:only-security-updates.",
      "matchPackageNames": [
        "pyroscope",
        "py-spy",
        "openssl/openssl"
      ],
      "enabled": true
    },
    {
      "description": "Split openssl/openssl patch updates into their own stream so they survive when minor/major are disabled below.",
      "matchPackageNames": ["openssl/openssl"],
      "separateMinorPatch": true
    },
    {
      "description": "Restrict openssl/openssl to patch-level updates only, to keep it on the longest-supported LTS branch (3.5, EOL 2030-04-08). Never move to a non-LTS branch. See AGENTS.md.",
      "matchPackageNames": ["openssl/openssl"],
      "matchUpdateTypes": ["major", "minor"],
      "enabled": false
    }
  ],
  "customManagers": [
    {
      "description": "Track the OpenSSL C library version pinned via ARG OPENSSL_VERSION in the Dockerfile, resolved against openssl/openssl GitHub releases.",
      "customType": "regex",
      "managerFilePatterns": ["/Dockerfile/"],
      "matchStrings": ["ARG OPENSSL_VERSION=(?<currentValue>[\\d.]+)"],
      "depNameTemplate": "openssl/openssl",
      "datasourceTemplate": "github-releases",
      "extractVersionTemplate": "^openssl-(?<version>.*)$"
    },
    {
      "description": "Track the Rust toolchain pinned via ENV RUST_VERSION in the Dockerfiles, so it is bumped together with the dtolnay/rust-toolchain pins in workflows.",
      "customType": "regex",
      "managerFilePatterns": ["/Dockerfile/"],
      "matchStrings": ["ENV RUST_VERSION=(?<currentValue>\\S+)"],
      "depNameTemplate": "rust",
      "datasourceTemplate": "rust-version"
    }
  ]
}