From 484bfbf74fa22839a91a69bab8435d3838b5256e Mon Sep 17 00:00:00 2001
From: copilotcoder <copilotcoder@darkhelm.org>
Date: Tue, 14 Jul 2026 08:46:08 -0400
Subject: [PATCH] perf: harden renovate gitea api timeouts

---
 .gitea/workflows/renovate.yml |  2 +-
 renovate.json                 | 31 ++++++++++++++++---------------
 2 files changed, 17 insertions(+), 16 deletions(-)

diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index 8dec261..dc2da80 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -290,7 +290,7 @@ jobs:
           SELECTED_TOKEN_SOURCE="${SELECTED_TOKEN_RESULT%%:*}"
           SELECTED_TOKEN="${SELECTED_TOKEN_RESULT#*:}"
           export RENOVATE_TOKEN="${SELECTED_TOKEN}"
-          RENOVATE_HOST_RULES_PAYLOAD="[{\"matchHost\":\"${ENDPOINT_AUTHORITY}\",\"token\":\"${SELECTED_TOKEN}\",\"authType\":\"Token-Only\"},{\"matchHost\":\"registry.npmjs.org\",\"timeout\":90000,\"concurrentRequestLimit\":1},{\"matchHost\":\"pypi.org\",\"timeout\":90000,\"concurrentRequestLimit\":2},{\"matchHost\":\"files.pythonhosted.org\",\"timeout\":90000,\"concurrentRequestLimit\":2},{\"matchHost\":\"mcr.microsoft.com\",\"timeout\":90000,\"concurrentRequestLimit\":2}]"
+          RENOVATE_HOST_RULES_PAYLOAD="[{\"matchHost\":\"${ENDPOINT_AUTHORITY}\",\"token\":\"${SELECTED_TOKEN}\",\"authType\":\"Token-Only\",\"timeout\":180000,\"concurrentRequestLimit\":2},{\"matchHost\":\"registry.npmjs.org\",\"timeout\":90000,\"concurrentRequestLimit\":1},{\"matchHost\":\"pypi.org\",\"timeout\":90000,\"concurrentRequestLimit\":2},{\"matchHost\":\"files.pythonhosted.org\",\"timeout\":90000,\"concurrentRequestLimit\":2},{\"matchHost\":\"mcr.microsoft.com\",\"timeout\":90000,\"concurrentRequestLimit\":2}]"
 
           # Authenticate GitHub datasource calls to avoid anonymous GraphQL rate limiting.
           if [ -n "${RENOVATE_GITHUB_COM_TOKEN:-}" ]; then
diff --git a/renovate.json b/renovate.json
index 15ba034..2dab343 100644
--- a/renovate.json
+++ b/renovate.json
@@ -11,6 +11,7 @@
   "prConcurrentLimit": 5,
   "branchConcurrentLimit": 10,
   "prHourlyLimit": 2,
+  "configMigration": false,
   "enabledManagers": [
     "docker-compose",
     "dockerfile",
@@ -22,12 +23,12 @@
     {
       "description": "Automerge non-major updates for high-confidence packages",
       "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
-      "matchPackagePatterns": [
-        "^@types/",
-        "^eslint",
-        "^prettier",
-        "^ruff",
-        "^pytest"
+      "matchPackageNames": [
+        "/^@types//",
+        "/^eslint/",
+        "/^prettier/",
+        "/^ruff/",
+        "/^pytest/"
       ],
       "automerge": true,
       "automergeType": "branch"
@@ -59,13 +60,13 @@
       "description": "Group Frontend dev tools updates",
       "matchManagers": ["npm"],
       "matchDepTypes": ["devDependencies"],
-      "matchPackagePatterns": [
-        "^@typescript-eslint/",
-        "^eslint",
-        "^prettier",
-        "^vite",
-        "^vitest",
-        "^playwright"
+      "matchPackageNames": [
+        "/^@typescript-eslint//",
+        "/^eslint/",
+        "/^prettier/",
+        "/^vite/",
+        "/^vitest/",
+        "/^playwright/"
       ],
       "groupName": "Frontend dev tools",
       "schedule": ["before 9am on monday"]
@@ -81,8 +82,8 @@
     },
     {
       "description": "Security updates - high priority",
-      "matchPackagePatterns": [".*"],
-      "vulnerabilityAlerts": true,
+      "matchPackageNames": ["/.*/"],
+      "vulnerabilityAlerts": { "enabled": true },
       "prPriority": 10,
       "automerge": false,
       "labels": ["security"],