From fe8b8eb8081e45dfcce837a1ff29a4bfcc3cc6e4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edgars=20Egl=C4=ABtis?=
 <37242620+eglitise@users.noreply.github.com>
Date: Tue, 31 Mar 2026 21:30:27 +0300
Subject: [PATCH] chore: update Renovate config (#22125)

* chore: update Renovate config

* update config
---
 renovate/README.md    | 3 +++
 renovate/default.json | 7 +++++++
 2 files changed, 10 insertions(+)

diff --git a/renovate/README.md b/renovate/README.md
index 6202fc8ed..97ce8574b 100644
--- a/renovate/README.md
+++ b/renovate/README.md
@@ -36,8 +36,11 @@ Appium extension authors--or anyone else--may use this config as well.
 
 - `config:js-app` - everything gets pinned except peer deps (plus a bunch of other reasonable defaults)
 - `group:definitelyTyped` - Groups all `@types/*` packages into one PR
+- `security:minimumReleaseAgeNpm` - Delays updates for 3 days after they have been published to `npm`, protecting against supply chain attacks
+  - Packages under the Appium organization are excluded from this
 - `:automergeStableNonMajor` - Automatically merges "patch" and "minor" updates for semver stable (>=1.0.0) packages (assuming they pass CI)
 - `:automergeDigest` - Automatically merges "digest" updates (assuming they pass CI)
+- `:configMigration` - Automatically creates PRs for Renovate config file migration updates
 - `:enableVulnerabilityAlerts` - For "security" purposes
 - `:rebaseStalePrs` - Renovate will automatically rebase its PRs
 - `:semanticCommits` - Renovate will use semantic commit messages
diff --git a/renovate/default.json b/renovate/default.json
index 6320c38c2..3e360f757 100644
--- a/renovate/default.json
+++ b/renovate/default.json
@@ -4,8 +4,10 @@
   "extends": [
     "config:js-app",
     "group:definitelyTyped",
+    "security:minimumReleaseAgeNpm",
     ":automergeStableNonMajor",
     ":automergeDigest",
+    ":configMigration",
     ":enableVulnerabilityAlerts",
     ":rebaseStalePrs",
     ":semanticCommits",
@@ -16,6 +18,11 @@
       "matchPackageNames": ["ora"],
       "matchUpdateTypes": ["major"],
       "enabled": false
+    },
+    {
+      "description": "Disable minimum release age checks for Appium organization packages",
+      "matchRepositories": ["appium/**"],
+      "minimumReleaseAge": null
     }
   ],
   "semanticCommitScope": "{{#if parentDir}}{{parentDir}}{{else}}deps{{/if}}"