renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "minimumReleaseAge": "3 days",
  "packageRules": [
    {
      "description": "Production dependencies: 3-day cool-down",
      "matchDepTypes": ["dependencies"],
      "minimumReleaseAge": "3 days"
    },
    {
      "description": "Dev/build dependencies: 1-day cool-down",
      "matchDepTypes": ["devDependencies", "build-dependencies"],
      "minimumReleaseAge": "1 day"
    },
    {
      "description": "Security patches: no cool-down (apply immediately)",
      "matchUpdateTypes": ["patch"],
      "matchDepTypes": ["dependencies"],
      "isVulnerabilityAlert": true,
      "minimumReleaseAge": "0 days"
    },
    {
      "description": "GitHub Actions: 3-day cool-down + SHA pinning",
      "matchManagers": ["github-actions"],
      "minimumReleaseAge": "3 days",
      "pinDigests": true
    }
  ]
}