Approvers:

• myakove
• rnetser

Reviewers:

• myakove
• rnetser

• hold
• verified
• wip
• lgtm
• approve
• automerge

• Conventional Title: Mode: fix (claude/claude-opus-4-6-1m)
• Cherry-Pick Conflict Resolution: Enabled (claude/claude-opus-4-6-1m)
• Test Oracle: Triggers: approved (claude/claude-opus-4-6[1m]); /test-oracle can be used anytime

• Suspicious Path Detection: Monitors paths: .claude/, .vscode/, .cursor/, .devcontainer/, .pi/, .github/workflows/, .github/actions/
• Committer Identity Check: Verifies last committer matches PR author
• Mandatory: Security checks block merge (use /security-override to bypass — maintainers only)

• Bump pi-sidecar dependencies to 1.1.5 for both npm and Python lockfiles.
• Teach Renovate to track and group npm updates separately from Python dependencies.
• Improve future dependency automation for the sidecar-helper Node project.

graph TD
  R(["Renovate"]) --> C["renovate.json"] --> N["npm-deps rule"] --> PL["sidecar-helper/package-lock.json"] --> NR[("npm registry")]
  R --> C --> P["python-deps rule"] --> UL["uv.lock"] --> PY[("PyPI")]

  subgraph Legend
    direction LR
    _svc(["Service"]) ~~~ _file["File"] ~~~ _reg[("Registry")]
  end

Loading

The following are alternative approaches to this PR:

1. Scope npm rule to sidecar-helper only (matchPaths)

• ➕ Avoids accidentally managing npm deps elsewhere if more Node projects are added later
• ➕ Keeps Renovate PRs tightly focused on the intended package-lock.json
• ➖ Slightly more config complexity
• ➖ Needs updating if npm projects move/expand

2. Use enabledManagers instead of broad packageRules

• ➕ Simpler intent: explicitly enable npm + Python managers at the top level
• ➕ Reduces reliance on catch-all matchPackagePatterns
• ➖ Less flexibility for grouping/overrides if more managers are added
• ➖ May still require packageRules for grouping behavior

Recommendation: The current approach (adding an npm-specific packageRule) is sound and consistent with existing Python grouping. Consider additionally scoping the npm rule via matchPaths (e.g., sidecar-helper/**) if this repo may gain other npm workspaces, to prevent unintended Renovate PR noise.

Other (3) +6 / -0

renovate.jsonAdd separate Renovate grouping for Python vs npm managers +6/-0

Add separate Renovate grouping for Python vs npm managers

• Adds explicit matchManagers for the existing Python dependency rule and introduces a new npm rule grouped as npm-deps. This allows Renovate to manage npm dependencies alongside Python while keeping PRs grouped by ecosystem.

renovate.json

package-lock.jsonUpdate @myk-org/pi-sidecar lock entry to 1.1.5 +0/-0

Update @myk-org/pi-sidecar lock entry to 1.1.5

• Updates the Node lockfile so @myk-org/pi-sidecar resolves to version 1.1.5. This keeps the sidecar-helper dependency aligned with the desired pi-sidecar release.

sidecar-helper/package-lock.json

uv.lockBump pi-sidecar-client to 1.1.5 in Python lockfile +0/-0

Bump pi-sidecar-client to 1.1.5 in Python lockfile

• Updates the uv lockfile to pin pi-sidecar-client at version 1.1.5. This aligns the Python client dependency with the same pi-sidecar version used by the npm sidecar-helper.

uv.lock

Description

docs/testing-and-maintenance.md still documents Renovate as having a single unscoped packageRule
that groups everything into "python-deps", but renovate.json now scopes Python managers and adds a
separate "npm-deps" group. This creates documentation drift where operators will expect one grouping
stream but will see different PR grouping behavior.

Code

renovate.json[R15-22]

+      "matchManagers": ["pip_requirements", "pip-compile", "pep621"],
      "matchPackagePatterns": ["*"],
      "groupName": "python-deps"
+    },
+    {
+      "matchManagers": ["npm"],
+      "matchPackagePatterns": ["*"],
+      "groupName": "npm-deps"

Relevance

⭐ Low

Similar “update docs snippet to match config” suggestion was definitely_rejected in PR #1118;
docs-sync not enforced.

PR-#1118
PR-#1109

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The repo docs explicitly embed a Renovate config snippet and describe single-stream grouping, but
the actual renovate.json in this PR now contains two scoped rules (python-deps and npm-deps), so the
documentation no longer matches behavior.

renovate.json[13-23]
docs/testing-and-maintenance.md[289-323]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The documentation for Renovate configuration is now stale. `docs/testing-and-maintenance.md` shows the old `renovate.json` (single `python-deps` rule without `matchManagers`) and states that updates are grouped into a single `python-deps` stream, but the actual config now splits into `python-deps` and `npm-deps` and scopes the managers.

### Issue Context
This PR changed `renovate.json` packageRules to:
- Scope Python grouping by manager via `matchManagers`
- Add an `npm-deps` group

But the docs still show the pre-change config and behavior.

### Fix Focus Areas
- docs/testing-and-maintenance.md[289-323]
- (optional, if these are checked-in generated artifacts in this repo) docs/testing-and-maintenance.html[~549-566]
- (optional, if this is a checked-in generated artifact in this repo) docs/llms-full.txt[~7909-7926]

### Suggested fix
- Update the JSON snippet in `docs/testing-and-maintenance.md` to match the new `renovate.json` (include both packageRules and their group names).
- Update the explanatory bullets to mention the separate `npm-deps` group (and that Python grouping is now manager-scoped).
- If `docs/testing-and-maintenance.html` and `docs/llms-full.txt` are generated-and-committed, regenerate/update them to keep docs consistent.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools