chore(repo): configure renovate (#330)

renovate.json5

@@ -0,0 +1,62 @@
+{
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+  /**
+   * Documentation: https://docs.renovatebot.com/configuration-options
+   *
+   * This configuration file can be locally validated:
+   * 1. `npm i -g renovate` will install the validator
+   * 2. `renovate-config-validator` will run the validator
+   */
+
+  /**
+   * Enable the dependency dashboard, which creates an issue in the repo
+   */
+  dependencyDashboard: true,
+  /**
+   * Apply these labels to every PR
+   */
+  labels: ['dependencies'],
+  /**
+   * The minimum age (in days) for updates that have a release timestamp header to be PR'ed.
+   * This will not batch releases together - if package A gets a release on Monday, Tuesday and Wednesday and has a
+   * `minimumReleaseAge: 3` and runs every day, then a PR will be created on:
+   * - Thursday (for Monday's release)
+   * - Friday (for Tuesday's release)
+   * - Saturday (for Wednesday's release)
+   *
+   * This setting is to prevent a compromised package from being merged into Stencil in the first three days of its
+   * release date
+   *
+   * A value of 3 days was chosen as npm packages younger than 72 hours old can be unpublished. This prevents merging
+   * support for a package that could be removed from the registry.
+   */
+  minimumReleaseAge: '3 days',
+  /**
+   * Note: Renovate will evaluate all packageRules and not stop once it gets a first match.
+   */
+  packageRules: [
+    {
+      matchPackageNames: ['@types/node'],
+      allowedVersions: '<21.0.0',
+    },
+    {
+      matchPackageNames: ['@types/jest', 'jest', 'ts-jest'],
+      groupName: 'Jest',
+    },
+    {
+      matchPackageNames: ['typescript'],
+      allowedVersions: '<5.1.0',
+    },
+  ],
+  // Never rebase the branch or update it unless manually requested to avoid noisy PR emails
+  rebaseWhen: 'never',
+  // Note: Timezone for the schedule is specified as UTC
+  schedule: ['every weekday before 11am'],
+  /**
+   * Ensure semantic commits are enabled for commits + PR titles.
+   *
+   * By default, Angular-style semantic commits will have a type of 'chore' and a scope of 'deps':
+   * `chore(deps): _your git commit title here_`
+   */
+  semanticCommits: "enabled",
+}