Keep Node.js on major versions in every repo

.github/workflows/validate.yml

@@ -24,6 +24,6 @@ jobs:
           node-version: 24
       # Unpinned on purpose: validate against the schema the hosted app runs.
       - name: Validate presets
-        run: npx --yes --package renovate -- renovate-config-validator --strict --no-global default.json weekly.json monthly.json approve-merges.json node.json
+        run: npx --yes --package renovate -- renovate-config-validator --strict --no-global default.json weekly.json monthly.json approve-merges.json
       - name: Validate repo config
         run: npx --yes --package renovate -- renovate-config-validator --strict --no-global .github/renovate.json

README.md

@@ -22,11 +22,10 @@ Repos follow `main`. A change here reaches every repo on its next Renovate run,
 
 | Preset | What it does |
 | --- | --- |
-| `default` | Labels, Europe/Budapest timezone, security updates at any time, 3 day minimum release age on registries with release timestamps, SHA-pinned actions, monthly lock file maintenance. Regular updates are not merged automatically; non-major GitHub Actions updates and lock file maintenance merge unattended once checks pass. |
+| `default` | Labels, Europe/Budapest timezone, security updates at any time, 3 day minimum release age on registries with release timestamps, SHA-pinned actions, Node.js runtime on majors only, monthly lock file maintenance. Regular updates are not merged automatically; non-major GitHub Actions updates and lock file maintenance merge unattended once checks pass. |
 | `weekly` | PRs open Friday 18:00 to Saturday 08:00, then nothing changes until the next window. |
 | `monthly` | PRs open on the 1st and 2nd of the month, then nothing changes until the next window. |
 | `approve-merges` | Approving a non-major PR merges it once the required checks pass. |
-| `node` | Node.js runtime: majors only, one PR across every file that pins it. |
 
 Outside the window, open PRs are neither updated nor rebased. Tick the rebase checkbox in a PR, or a checkbox on the Dependency Dashboard, to act on one anyway.
 

default.json

@@ -66,6 +66,17 @@
       "groupName": "all non-major pre-commit hooks",
       "groupSlug": "all-minor-patch-pre-commit"
     },
+    {
+      "description": "Node.js runtime: major versions only, never pinned, wherever it is declared (.nvmrc, .node-version, Dockerfiles, dev containers, setup-node inputs). Matches nothing in repos without Node.",
+      "matchDepNames": ["node"],
+      "matchUpdateTypes": ["minor", "patch", "pin", "pinDigest"],
+      "enabled": false
+    },
+    {
+      "description": "One PR for every Node.js runtime bump, so .nvmrc, Dockerfiles and workflows move together.",
+      "matchDepNames": ["node"],
+      "groupName": "Node.js runtime version"
+    },
     {
       "description": "actions/python-versions: only minor and major bumps matter.",
       "matchManagers": ["github-actions"],