chore: Configure Renovate 2

[renovate-bot]

Welcome to Renovate! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.

📚 See our Reading List for relevant documentation you may be interested in reading.

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to renovate.json in this branch. Renovate will update the Pull Request description the next time it runs.

---

Detected Package Files

bun

• agent-service/package.json

docker-compose

• bin/local-dev/docker-compose.override.yml
• bin/single-node/docker-compose.yml
• file-service/src/main/resources/docker-compose.yml
• notebook-migration-service/src/main/resources/docker-compose.yml
• sql/docker-compose.yml

dockerfile

• bin/dockerfiles/
  • access-control-service.dockerfile
  • agent-service.dockerfile
  • computing-unit-master.dockerfile
  • computing-unit-worker.dockerfile
  • config-service.dockerfile
  • file-service.dockerfile
  • texera-web-application.dockerfile
  • workflow-compiling-service.dockerfile
  • workflow-computing-unit-managing-service.dockerfile
• bin/pylsp/Dockerfile
• bin/y-websocket-server/Dockerfile
• notebook-migration-service/src/main/resources/Dockerfile

github-actions

• .github/workflows/
  • automatic-email-notif-on-ddl-change.yml
  • benchmarks-pr-comment.yml
  • benchmarks.yml
  • build-and-push-images.yml
  • build.yml
  • check-header.yml
  • comment-commands.yml
  • contributor-checks.yml
  • create-release-candidate.yml
  • dependency-graph.yml
  • direct-backport-push.yml
  • license-binary-checker.yml
  • lint-pr.yml
  • pr-assignment.yml
  • pr-labeler.yml
  • required-checks.yml
  • stale.yml
  • suggest-reviewers.yml
  • sync-docs-to-site.yml

helm-values

• bin/k8s/values.yaml

helmv3

• bin/k8s/Chart.yaml

npm

• bin/y-websocket-server/package.json
• frontend/package.json
• frontend/tools/jschardet-stub/package.json
• pyright-language-service/package.json

nvm

• frontend/.nvmrc

pip_requirements

• amber/
  • dev-requirements.txt
  • operator-requirements.txt
  • requirements.txt

sbt

• access-control-service/build.sbt
• access-control-service/project/build.properties
• amber/build.sbt
• amber/project/build.properties
• amber/project/plugins.sbt
• build.sbt
• common/auth/build.sbt
• common/config/build.sbt
• common/dao/build.sbt
• common/pybuilder/build.sbt
• common/resource/build.sbt
• common/workflow-core/build.sbt
• common/workflow-operator/build.sbt
• common/workflow-operator/project/build.properties
• computing-unit-managing-service/build.sbt
• computing-unit-managing-service/project/build.properties
• computing-unit-managing-service/project/plugins.sbt
• config-service/build.sbt
• file-service/build.sbt
• notebook-migration-service/build.sbt
• notebook-migration-service/project/build.properties
• project/build.properties
• project/plugins.sbt
• workflow-compiling-service/build.sbt
• workflow-compiling-service/project/build.properties

scalafmt

• .scalafmt.conf
• amber/.scalafmt.conf

Configuration Summary

Based on the default config's presets, Renovate will:

• Start dependency updates only once this onboarding PR is merged
• Hopefully safe environment variables to allow users to configure.
• Show all Merge Confidence badges for pull requests.
• Enable Renovate Dependency Dashboard creation.
• Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
• Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
• Group known monorepo packages together.
• Use curated list of recommended non-monorepo package groupings.
• Show only the Age and Confidence Merge Confidence badges for pull requests.
• Apply crowd-sourced package replacement rules.
• Apply crowd-sourced workarounds for known problems with packages.
• Ensure that every dependency pinned by digest and sourced from Forgejo contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from Gitea contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from GitHub.com and Github enterprise contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from GitLab.com contains a link to the commit-to-commit diff
• Correctly link to the source code for golang.org/x packages
• Link to pkg.go.dev/... for golang.org/x packages' title
• Provide a link to octochangelog's improved breakdown for Renovate's changelogs

---

What to Expect

With your current configuration, Renovate will create 192 Pull Requests (at a maximum of 2 PRs per hour):

Manager	security	major	minor	patch
npm	1	29	21	9
sbt	0	28	39	25
docker-compose	0	2	3	2
helm-values	0	0	2	0
pip_requirements	0	7	14	0
github-actions	0	0	4	0
scalafmt	0	1	1	0
helmv3	0	2	5	0
bun	0	0	1	0
dockerfile	0	1	0	0
Total	1	70	90	36

Note that a single PR can update multiple files and/or managers, so the above rows may not align with the number of PRs being listed above.

Security updates:

• ajv, (npm, minor): frontend/package.json

🚸 PR creation will be limited to maximum 2 per hour, so it doesn't swamp any CI resources or overwhelm the project. See docs for prHourlyLimit for details.

---

Warning

Please correct - or verify that you can safely ignore - these dependency lookup failures before you merge this PR.

• Could not determine new digest for update (github-tags package scalacenter/sbt-dependency-submission)

Files affected: .github/workflows/dependency-graph.yml

---

❓ Got questions? Check out Renovate's Docs, particularly the Getting Started section.
If you need any further assistance then you can also request help here.

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

👋 Thanks for your first contribution to Texera, @renovate-bot!

If you're looking for a good place to start, browse issues labeled starter-task; they're scoped to be approachable for newcomers.

You can drive common housekeeping yourself by commenting one of these commands on its own line:

• Issues. Comment /take to assign an open issue to yourself, or /untake to release it. You can find unclaimed work with the search filter is:issue is:open no:assignee.
• Sub-issues. To link issues into a parent/child hierarchy, comment /sub-issue #5166 #5222 on the parent to attach those children (or /unsub-issue #5166 #5222 to detach them). From a child issue, comment /parent-issue #5166 to set its parent, or /unparent-issue to clear it (the current parent is detected automatically). References may be written as #5166 or as a bare 5166; cross-repository references are not supported.
• Pull requests (author only). Comment /request-review @user to request a review from someone, or /unrequest-review @user to withdraw that request.

Each command must match exactly: /take this will not work, only /take does. For the full contribution flow, see CONTRIBUTING.md.

[github-actions]

👋 Thanks for opening this pull request, @renovate-bot!

It looks like the pull request description doesn't quite follow our template yet:

• The What changes were proposed in this PR? section is missing; please keep the template's headings.
• The How was this PR tested? section is missing; please keep the template's headings.
• The Was this PR authored or co-authored using generative AI tooling? section is missing; please keep the template's headings.

Filling out the template helps reviewers understand and triage your contribution faster. Please edit the description to complete it. This message will disappear automatically once the template is followed.

You can find the template prompts by editing the description, or see CONTRIBUTING.md for the full contribution flow.

[github-actions]

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

• Contributors with relevant context: @Yicong-Huang
  You can notify them by mentioning @Yicong-Huang in a comment.

[Copilot]

Pull request overview

Adds a baseline Renovate configuration to enable automated dependency update PRs across Texera’s multi-language/tooling stack (sbt, npm/bun, Docker, GitHub Actions, etc.).

Changes:

• Introduces renovate.json using Renovate’s config:recommended preset.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Yicong-Huang]

We will do detailed configuration in #6848

[Yicong-Huang]

let's directly merge #6848

[forking-renovate]

Renovate is disabled

Renovate is disabled because there is no Renovate configuration file. To enable Renovate, you can either (a) change this PR's title to get a new onboarding PR, and merge the new onboarding PR, or (b) create a Renovate config file, and commit that file to your base branch.

[github-actions]

⚠️ Benchmark changes need a look

🟢 4 better · 🔴 1 worse · ⚪ 10 noise (<±5%) · 0 without baseline

Compared against main 7e4a9b4 benchmarked on this same runner, so the delta is largely free of cross-runner hardware noise. The "7d avg" column still reflects the gh-pages dashboard. Treat <±5% as noise unless repeated.

Dashboard · Run

	config	throughput	MB/s	latency	max Δ latest / 7d
🔴	bs=10 sw=10 sl=64	395	0.241	25,764/30,937/30,937 us	🟢 -21.7% / 🔴 +101.0%
🟢	bs=100 sw=10 sl=64	777	0.475	127,323/147,604/147,604 us	🟢 -10.5% / 🔴 +35.3%
⚪	bs=1000 sw=10 sl=64	903	0.551	1,103,362/1,163,582/1,163,582 us	⚪ within ±5% / 🔴 +11.2%

Baseline details

Latest main 7e4a9b4 from same runner

config	metric	PR	latest main	7d avg	Δ latest	Δ 7d
bs=10 sw=10 sl=64	throughput	395 tuples/sec	397 tuples/sec	754.55 tuples/sec	-0.5%	-47.7%
bs=10 sw=10 sl=64	MB/s	0.241 MB/s	0.242 MB/s	0.461 MB/s	-0.4%	-47.7%
bs=10 sw=10 sl=64	p50	25,764 us	22,887 us	12,816 us	+12.6%	+101.0%
bs=10 sw=10 sl=64	p95	30,937 us	39,507 us	16,594 us	-21.7%	+86.4%
bs=10 sw=10 sl=64	p99	30,937 us	39,507 us	19,806 us	-21.7%	+56.2%
bs=100 sw=10 sl=64	throughput	777 tuples/sec	789 tuples/sec	969.38 tuples/sec	-1.5%	-19.8%
bs=100 sw=10 sl=64	MB/s	0.475 MB/s	0.482 MB/s	0.592 MB/s	-1.5%	-19.7%
bs=100 sw=10 sl=64	p50	127,323 us	121,987 us	103,584 us	+4.4%	+22.9%
bs=100 sw=10 sl=64	p95	147,604 us	164,927 us	109,097 us	-10.5%	+35.3%
bs=100 sw=10 sl=64	p99	147,604 us	164,927 us	117,304 us	-10.5%	+25.8%
bs=1000 sw=10 sl=64	throughput	903 tuples/sec	908 tuples/sec	1,004 tuples/sec	-0.6%	-10.0%
bs=1000 sw=10 sl=64	MB/s	0.551 MB/s	0.554 MB/s	0.613 MB/s	-0.5%	-10.1%
bs=1000 sw=10 sl=64	p50	1,103,362 us	1,101,259 us	1,002,357 us	+0.2%	+10.1%
bs=1000 sw=10 sl=64	p95	1,163,582 us	1,141,492 us	1,046,463 us	+1.9%	+11.2%
bs=1000 sw=10 sl=64	p99	1,163,582 us	1,141,492 us	1,073,661 us	+1.9%	+8.4%

Raw CSV

config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,505.98,200,128000,395,0.241,25763.97,30937.04,30937.04
1,100,10,64,20,2572.40,2000,1280000,777,0.475,127322.88,147603.71,147603.71
2,1000,10,64,20,22150.46,20000,12800000,903,0.551,1103361.64,1163581.74,1163581.74

[Yicong-Huang]

reopen this for testing trigger renovate bot