[j0ker70]

Closes #31.

What changed and why

Renovate will open the weekly dependency update pull requests. It runs as the hosted Mend Renovate app, which the maintainer installs after this merges. Nothing is installed or turned on by this pull request.

renovate.json

• Updates the version catalog, the Gradle wrapper, and the pinned actions and runner image in the workflow. Two regex custom managers cover ktfmt and Gummy Bears, which are catalog versions with no library entry.
• New branches only on Fridays, the whole day, in Asia/Dhaka. The hosted app runs a repository with no merged Renovate pull request only once a day (job scheduling), so a short window could miss the run.
• Releases wait 14 days, and releases with no date wait too (timestamp-required, internalChecksFilter: strict). Security fixes skip the wait and the schedule. Renovate finds them in Dependabot alerts, which are on, and in the OSV database (osvVulnerabilityAlerts, which Renovate marks experimental). A security release that neither lists can be created from the Dependency Dashboard's "Pending Status Checks" section.
• Groups: Kotlin with KSP. Spotless with ktfmt, because ktfmt 0.65 moved to org.jetbrains.kotlinx:ktfmt (v0.65 notes), which only Spotless 8.10.4 or later can load (diffplug/spotless#3135). The ktfmt custom manager looks up the new coordinates. detekt with compose-rules, which also waits for the maintainer's approval on the Dependency Dashboard. Entries that share a catalog version, such as Hilt, Room, AGP, detekt and the coroutines libraries, are grouped automatically.
• Pre-releases: Renovate's default ignoreUnstable offers detekt the next 2.0.0 alpha, a beta or 2.0.0, and gives every other dependency stable releases only.
• Titles start with build: for Gradle and ci: for Actions, with no scope.
• rebaseWhen: behind-base-branch, because the ruleset requires an up-to-date branch. At most five open pull requests, with no hourly limit. No automerge.
• The JDK version in the setup-java step is turned off, because the build needs JDK 17.
• Notes in the pull request descriptions for Spotless and ktfmt (run spotlessApply), AGP (build tools), Kotlin (Hilt) and the Gradle wrapper (run the wrapper task if the jar and scripts didn't change).

The Gradle wrapper. Renovate's gradle-wrapper manager fetches the new checksum and writes distributionSha256Sum before it runs ./gradlew :wrapper (artifacts.ts). A failure of that task is only logged as a warning (L202-L213). The whole step needs gradleWrapper in the server's allowedUnsafeExecutions (L156-L162). Hosted-app pull requests show the app allows it: spockframework/spock#2436 and TNG/property-loader#296 changed distributionSha256Sum in files laid out like ours. So no Dependabot config is needed.

Docs

• AGENTS.md: the dependency rule now says to wait 14 days after a release unless it fixes a security issue. It also lists renovate.json and the validator command.
• docs/testing.md: a new "Dependency updates" section, and workflow 5 now names Renovate. It also says that Renovate leaves out a group member still inside its 14 days.
• docs/roadmap.md: the Phase 2 task now names Renovate, and the CI reference says the project has four GitHub Actions workflows plus Renovate's weekly pull requests, which workflow 1 tests.
• CONTRIBUTING.md: the 14-day rule, no hand-made version bump pull requests, and how to fix a Renovate pull request.
• docs/architecture.md, AndroidLint.kt and the catalog comments point to Renovate.

Checks run locally

• npx --yes --package renovate@44.140.0 -- renovate-config-validator --strict: "Config validated successfully against 1 file(s)". A scratch copy with a misspelled option failed with "Invalid configuration option", so the check works.
• uvx check-jsonschema@0.38.2 --builtin-schema vendor.renovate renovate.json: "ok -- validation done".
• Both custom-manager regexes match only ktfmt = "0.64" and gummyBears = "0.15.0", tested with Node.
• A local Renovate dry run (renovate@44.140.0 --platform=local --dry-run=lookup, with its cache outside the repo) detected the catalog libraries and plugins, the Compose BOM, the wrapper, the runner, ktfmt and Gummy Bears. Every proposed update from Google Maven, Maven Central, the Gradle Plugin Portal and services.gradle.org had a release timestamp. It skipped the four actions, because a local run has no GitHub token. The setup-java JDK version showed as disabled.
• ./gradlew spotlessCheck detekt: passed.

renovate 44.140.0 came out on 2026-10-06 and check-jsonschema 0.38.2 on 2026-09-23, both at least 14 days ago.

What to expect. By Friday 2026-10-23 these updates are past 14 days: Kotlin 2.4.21, Spotless 8.10.4 with ktfmt 0.65 in one pull request, Gummy Bears 0.16.0 and upload-artifact v7.0.2. Spotless 8.10.4's 14 days end at about 10:33 Asia/Dhaka that Friday, counting Renovate's 30-minute buffer. If Renovate runs before then, the group starts with ktfmt alone and Spotless joins on the next run. The ubuntu-26.04 runner update waits until the hosted app runs a Renovate release with runner release dates (renovatebot/renovate#46885, 2026-10-19). compose-rules 0.6.8 waits for approval. setup-java v6.1.0, kotlinx-serialization 1.12.0 and Gradle 9.8.2 are still in their 14 days. AGP, Kotlin, AndroidX and Room pre-releases are not offered.

New dependencies

No dependency of the app or the build. Two tools that never ship:

• Renovate, the hosted Mend Renovate app, AGPL-3.0-only. It runs on Mend's servers, which clone the repository for each run. The maintainer installs it after merge.
• The renovate npm package, run through npx only to validate renovate.json locally.

Checklist

• OpenSpec change archived, or not needed
• docs/architecture.md updated, or the structure of the app didn't change
• ADR added for any decision that would be hard to reverse, or there was none

Reviewer

Final verdict: Ready

• Round 1, Needs changes. Must fix: Renovate's github-actions manager tracks setup-java's java-version: 17, so a JDK 25 update could be approved by mistake. Now turned off. Should fix: the AGP rule's group name added nothing, the PR limits weren't documented, the validator's Node version was missing, and the commit message misstated how often the hosted app runs. All fixed. A note about the runner image was checked and left as it is.
• Round 2, Ready. It asked whether the roadmap should change too, and the maintainer said yes.
• Round 3, after the ktfmt and roadmap changes, Ready. Should fix: Renovate leaves out a group member still inside its 14 days, so the Spotless and ktfmt group can't guarantee that ktfmt arrives with Spotless. docs/testing.md now says so. It also asked for this description to cover the new commits, which it now does.
• Question for the maintainer: when will the app be installed? Before 10:33 Asia/Dhaka on Friday 2026-10-23, the first Spotless and ktfmt pull request would probably start with ktfmt alone and fail until Spotless joins it.

🤖 Generated with Claude Code