renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":dependencyDashboard"
  ],
  "labels": ["dependencies"],
  "osvVulnerabilityAlerts": true,
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["dependencies", "security"]
  },
  "packageRules": [
    {
      "description": "Disable all updates by default (security-only mode)",
      "matchPackageNames": ["*"],
      "enabled": false
    },
    {
      "description": "GitHub Actions — monthly updates",
      "matchManagers": ["github-actions"],
      "enabled": true,
      "schedule": ["before 5am on the first day of the month"]
    }
  ]
}