From 758266574bda5b6173517fe88368ae0818dc90cc Mon Sep 17 00:00:00 2001
From: Stephan Windischmann <stephan.windischmann@seequent.com>
Date: Fri, 28 Aug 2026 14:57:18 +1200
Subject: [PATCH 1/2] Add Dependabot configuration

---
 .github/dependabot.yml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..586e006c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,17 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "npm" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "daily"
+      time: "07:00"
+      timezone: "Pacific/Auckland"
+    assignees:
+      - "kirk-spragg" # Security Champion for DevOps.
+    cooldown:
+      default-days: 4

From 5a61951fdf5cf0334b418560f38c8a97995c0e03 Mon Sep 17 00:00:00 2001
From: Stephan Windischmann <stephan.windischmann@seequent.com>
Date: Fri, 28 Aug 2026 15:00:32 +1200
Subject: [PATCH 2/2] Add Renovate config

---
 .github/renovate.json | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 .github/renovate.json

diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 00000000..6f74b031
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,30 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended", "group:allNonMajor", "schedule:monthly"],
+  "timezone": "Pacific/Auckland",
+  "labels": ["dependencies"],
+  "lockFileMaintenance": {
+    "enabled": true,
+    "automerge": false,
+    "schedule": ["every 3 months on the first day of the month"]
+  },
+  "minimumReleaseAge": "4 days",
+  "prCreation": "not-pending",
+  "packageRules": [
+    {
+      "matchDepTypes": ["devDependencies"],
+      "automerge": false
+    },
+    {
+      "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
+      "automerge": false
+    },
+    {
+      "matchUpdateTypes": ["major"]
+    }
+  ],
+  "vulnerabilityAlerts": {
+    "labels": ["security"],
+    "automerge": false
+  }
+}