From 6689040fc6baafc7f2e901d43604d5e3046559aa Mon Sep 17 00:00:00 2001
From: Renaud Chaput <renchap@gmail.com>
Date: Mon, 22 Sep 2025 11:08:35 +0200
Subject: [PATCH] Renovate config improvements (#36209)

---
 .github/renovate.json5 | 25 +++++++++++++++++++++++++
 package.json           |  3 ++-
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 07400a07a4..ae55152585 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -6,6 +6,7 @@
     ':labels(dependencies)',
     ':prConcurrentLimitNone', // Remove limit for open PRs at any time.
     ':prHourlyLimit2', // Rate limit PR creation to a maximum of two per hour.
+    ':enableVulnerabilityAlertsWithLabel(security)',
   ],
   rebaseWhen: 'conflicted',
   minimumReleaseAge: '3', // Wait 3 days after the package has been published before upgrading it
@@ -17,6 +18,11 @@
   postUpdateOptions: ['yarnDedupeHighest'],
   // The types are now included in recent versions,we ignore them here until we upgrade and remove the dependency
   ignoreDeps: ['@types/emoji-mart'],
+  postUpgradeTasks: {
+    // If JS deps are changed, then copy the MSW worker file, as it needs to be in sync with the version of MSW installed)
+    commands: ['yarn', 'yarn msw:updateWorker'],
+    fileFilters: ['yarn.lock'],
+  },
   packageRules: [
     {
       // Require Dependency Dashboard Approval for major version bumps of these node packages
@@ -93,6 +99,19 @@
       matchUpdateTypes: ['patch', 'minor'],
       groupName: 'eslint (non-major)',
     },
+    {
+      // Group all Storybook-related packages in the same PR
+      matchManagers: ['npm'],
+      matchPackageNames: [
+        'chromatic',
+        'storybook',
+        '@storybook/*',
+        'msw',
+        'msw-storybook-addon',
+      ],
+      matchUpdateTypes: ['patch', 'minor'],
+      groupName: 'storybook (non-major)',
+    },
     {
       // Group actions/*-artifact in the same PR
       matchManagers: ['github-actions'],
@@ -141,6 +160,12 @@
       matchUpdateTypes: ['patch', 'minor'],
       groupName: 'opentelemetry-ruby (non-major)',
     },
+    {
+      // Group Playwright Ruby & JS deps in the same PR, as they need to be in sync
+      matchManagers: ['bundler', 'npm'],
+      matchPackageNames: ['playwright-ruby-client', 'playwright'],
+      groupName: 'Playwright',
+    },
     // Add labels depending on package manager
     { matchManagers: ['npm', 'nvm'], addLabels: ['javascript'] },
     { matchManagers: ['bundler', 'ruby-version'], addLabels: ['ruby'] },
diff --git a/package.json b/package.json
index 9f494efe90..fcc74dc83f 100644
--- a/package.json
+++ b/package.json
@@ -31,7 +31,8 @@
     "typecheck": "tsc --noEmit",
     "storybook": "storybook dev -p 6006",
     "build-storybook": "storybook build",
-    "chromatic": "npx chromatic -d storybook-static"
+    "chromatic": "npx chromatic -d storybook-static",
+    "msw:updateWorker": "msw init"
   },
   "repository": {
     "type": "git",