From 08d112ccbad82fdc8bbfedd20699c2399afe072e Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sun, 15 Feb 2026 15:30:59 +0000
Subject: [PATCH 1/3] Add renovate.json

---
 renovate.json | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 renovate.json

diff --git a/renovate.json b/renovate.json
new file mode 100644
index 00000000..5db72dd6
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}

From 9335ca2da1ec6f24848ebeb2d224109fe295c467 Mon Sep 17 00:00:00 2001
From: Jakub Novak <jakub@e2b.dev>
Date: Sun, 15 Feb 2026 07:42:50 -0800
Subject: [PATCH 2/3] feat: setup renovate

---
 .../workflows/validate-renovate-config.yaml   | 16 +++++++++
 .gitignore                                    |  4 ++-
 renovate.json                                 |  6 ----
 renovate.json5                                | 36 +++++++++++++++++++
 4 files changed, 55 insertions(+), 7 deletions(-)
 create mode 100644 .github/workflows/validate-renovate-config.yaml
 delete mode 100644 renovate.json
 create mode 100644 renovate.json5

diff --git a/.github/workflows/validate-renovate-config.yaml b/.github/workflows/validate-renovate-config.yaml
new file mode 100644
index 00000000..1ca810d3
--- /dev/null
+++ b/.github/workflows/validate-renovate-config.yaml
@@ -0,0 +1,16 @@
+name: validate renovate config
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  validate-renovate-config:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Validate Renovate config
+        uses: suzuki-shunsuke/github-action-renovate-config-validator@v2.0.0
diff --git a/.gitignore b/.gitignore
index a5c9d15f..b74489d7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -290,4 +290,6 @@ cython_debug/
 .idea/
 
 # VS Code
-.vscode/
\ No newline at end of file
+.vscode/
+
+.DS_Store
diff --git a/renovate.json b/renovate.json
deleted file mode 100644
index 5db72dd6..00000000
--- a/renovate.json
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended"
-  ]
-}
diff --git a/renovate.json5 b/renovate.json5
new file mode 100644
index 00000000..616f7b69
--- /dev/null
+++ b/renovate.json5
@@ -0,0 +1,36 @@
+// configuration options: https://docs.renovatebot.com/configuration-options/
+// list of all presets: https://docs.renovatebot.com/presets-default/
+{
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+  extends: ['config:recommended', ':automergeRequireAllStatusChecks'],
+  dependencyDashboard: true,
+  // let it fly for now, we've got a lot to catch up on
+  //  schedule: [
+  //    "0 * * * *"
+  //  ],
+  timezone: 'UTC',
+  // Always squash PRs when automerging
+  automergeType: 'pr',
+  automergeStrategy: 'squash',
+  packageRules: [
+    {
+      description: 'Group and automerge patch updates after CI passes',
+      matchUpdateTypes: ['patch'],
+      automerge: true,
+      groupName: 'patch-updates',
+    },
+    {
+      description: 'Create PRs for minor updates without automerge',
+      matchUpdateTypes: ['minor'],
+      automerge: false,
+    },
+    {
+      description: 'Require dashboard approval for major updates',
+      matchUpdateTypes: ['major'],
+      dependencyDashboardApproval: true,
+      automerge: false,
+    },
+  ],
+  prConcurrentLimit: 3,
+  rebaseWhen: 'auto',
+}

From 44c285d64cde703fa4a8dcd9bc09d8c551a55575 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jakub=20Nov=C3=A1k?= <jakub@e2b.dev>
Date: Sun, 15 Feb 2026 07:44:31 -0800
Subject: [PATCH 3/3] Potential fix for code scanning alert no. 4: Workflow
 does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .github/workflows/validate-renovate-config.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/validate-renovate-config.yaml b/.github/workflows/validate-renovate-config.yaml
index 1ca810d3..a5feb8c6 100644
--- a/.github/workflows/validate-renovate-config.yaml
+++ b/.github/workflows/validate-renovate-config.yaml
@@ -1,5 +1,8 @@
 name: validate renovate config
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     branches: