From de9a00593d89a4c46023f11c9fae4eca86750d10 Mon Sep 17 00:00:00 2001
From: Evan Vetere <ecv@datum.net>
Date: Wed, 9 Sep 2026 16:57:26 -0400
Subject: [PATCH] chore: Extend the shared dependency update policy

Renovate opens pull requests here on its own schedule. None are open
today, so this is the last repository in the sweep rather than a queue
to clear, and it stops one forming.

This replaces the stock recommendation with a reference to the
organization's shared policy. Updates are listed on this repository's
dependency dashboard and open only when someone asks for one, and
security fixes stay exempt and open on their own.

What survives here is GitHub Action and Docker digest pinning.

An audit of every repository carrying its own config found the label
rules and the security priority rule in this file repeated across five
repositories. They now live in the shared preset. The priority rule
matched nothing in any of them, because Renovate's categories are the
fixed manager set and security is not one, so it is dropped rather
than carried forward.

Related to datum-cloud/infra#4926

Claude-Session: https://claude.ai/code/session_0196U66w5xh9yRsAosKcA3if
---
 renovate.json | 17 +----------------
 1 file changed, 1 insertion(+), 16 deletions(-)

diff --git a/renovate.json b/renovate.json
index 1661221d22..281c798072 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,19 +1,4 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended", "helpers:pinGitHubActionDigests", "docker:pinDigests"],
-  "vulnerabilityAlerts": {
-    "enabled": true,
-    "labels": ["security", "renovate"]
-  },
-  "osvVulnerabilityAlerts": true,
-  "packageRules": [
-    {
-      "labels": ["renovate"],
-      "matchPackageNames": ["/.*/"]
-    },
-    {
-      "matchCategories": ["security"],
-      "prPriority": 10
-    }
-  ]
+  "extends": ["local>datum-cloud/.github:renovate-config", "helpers:pinGitHubActionDigests", "docker:pinDigests"]
 }