chore: add Renovate configuration

[MikeMcC399]

• supports resolution of issue Automate dependency updates (Renovate) #238

Situation

Currently all dependency updates in this repo have to be done manually.

Unlike other active repos owned by cypress-io, this repo has not been set up to use Renovate.

Change

Add a renovate.json configuration (see https://docs.renovatebot.com/config-overview/)

Configuration Notes

• allow automerge except for major version updates. Note that with branch protection rules, this still means that each PR needs to be manually approved before Renovate automerges. Major version updates require the extra step of being manually merged after having been approved.

• ci tests run in CircleCI using the circle.yml configuration. Since the associated tests are not testing against specific websites, as is the case in other cypress-io repos, special settings for prConcurrentLimit (default 10) or prHourlyLimit (default 2) are not needed. For transparency, they are however explicitly set to their default values in the configuration.

• rangeStrategy set to bump will bump the range. For example "eslint": "^10.0.2" would be bumped to "eslint": "^10.0.3".

• lockfilemaintenance runs by default once a week on Mondays

• labels specified are type: dependencies and renovate as used in other Cypress repos. These labels do not currently exist in this repo and need to be added.

• ESlint-related dependencies are grouped together. Especially eslint and @eslint/js are often updated together, and this reduces the number of generated PRs. (globals is not grouped with eslint, although it is related, since it is listed in dependencies rather than in devDependencies and will trigger a package release if updated. It therefore needs to be kept separate.)

Verification

npx --yes --package renovate -- renovate-config-validator

---

Note

Low Risk
Low risk: this only introduces Renovate configuration and does not change runtime or library code; the main impact is increased automated dependency PR activity/automerge behavior.

Overview
Introduces a repository-level renovate.json to enable Renovate-managed dependency update PRs, including a dependency dashboard and lockfile maintenance.

Configures automerge for non-major updates (with majors requiring manual merge), bumps version ranges via rangeStrategy: "bump", applies standard labels, and groups ESLint-related packages into a single update stream.

^{Written by Cursor Bugbot for commit ca2b7fe. This will update automatically on new commits. Configure here.}

[cypress-app-bot]

• Create a Draft Pull Request if your PR is not ready for review. Mark the PR as Ready for Review when you're ready for a Cypress team member to review the PR.

[Copilot]

Pull request overview

Adds Renovate configuration to automate dependency update PRs for this repository, addressing #238 and aligning the repo with dependency update automation used in other Cypress projects.

Changes:

• Add renovate.json with recommended base preset and dependency dashboard enabled
• Enable automerge for non-major updates while disabling automerge for major updates
• Configure update limits, range bumping, lockfile maintenance, labels, and grouping for ESLint-related dependencies

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[MikeMcC399]

Additional tasks

The following tasks cannot be carried out through a PR and need admin privileges:

Add labels

type: dependencies and renovate labels should be added to the repo

Enable Renovate

Activate Renovate for this repo. It should then show on https://developer.mend.io/github/cypress-io under the list of "Installed Repositories" with "Renovate Status": activated

[MikeMcC399]

@jennifer-shehane

Thank you for merging!

Will you now enable Renovate for this repo?