Avoid dependency updates which mandate a major version bump.

> Note: This commit also switches to using the JSON5 format for the Renovate
> configuration, which supports much-needed comments for this file!

We'll need to reserve these sorts of bumps for Apollo Server 3.x, though one
of the design goals of Apollo Server 3.x is also to decouple this close
pairing between HTTP server frameworks and Apollo Server itself.

Put another way, while changes in Apollo Server 3.x (like dropping Node.js 6
and 8) constitute necessary major version bumps which are directly related
to Apollo Server itself, it's our hope that we'll never need to bump the
version of Apollo Server ever again to account for a major version bump
which happens in any one of the supported HTTP frameworks.  It's certainly
not convenient that when Hapi releases a new version and Apollo Server has
to bump its Express version!

A better, more minimalistic approach to the Apollo Server handler and
abstractions which move the interfaces between HTTP servers and the Apollo
Server request pipeline should make this more reasonable.

For now, it's best to quash the belief that we'll be able to eventually land
the Renovate PRs which suggest these major bumps and stop them from recurring.

Ref: #2382
Ref: #2371
Ref: #2426
Ref: #2201
Ref: #2647

Author: abernix

renovate.json

@@ -0,0 +1,67 @@
+{
+  "extends": [
+    "apollo-open-source"
+  ],
+  "automerge": false,
+  "packageRules": [
+    {
+      "packageNames": ["@types/node"],
+      "allowedVersions": "8.x"
+    },
+    // Currently limited because of a bug in Lerna 3.14.0, as reported in:
+    // https://github.com/lerna/lerna/issues/2107.  Note this can now be
+    // reverted, since it's resolved, but I'll reserve that for a follow-up
+    // commit.
+    {
+      "packageNames": ["lerna"],
+      "allowedVersions": "=3.13.4"
+    },
+    /*
+      Avoid major version bumps to server frameworks (those used by the
+      various Apollo Server integrations (e.g. Fastify, Express, Koa, etc.),
+      which must be reserved for a major version bump to Apollo Server itself.
+
+      For more thoughts here, see my comment on the commits that introduced
+      these threshholds via `git blame`.
+    */
+    {
+      "packageNames": ["fastify", "fastify-cors"],
+      "allowedVersions": "<2"
+    },
+    {
+      "packageNames": ["koa-bodyparser"],
+      "allowedVersions": "<4"
+    },
+    {
+      "packageNames": ["@koa/cors"],
+      "allowedVersions": "<3"
+    },
+    {
+      "packageNames": ["ws"],
+      "allowedVersions": "<7"
+    },
+    /*
+      Docs-related Renovate rules
+
+      These ensure that the `docs/` folder, which is its own application with
+      its own dependencies which lives inside this repository, plays by its
+      own Renovate rules.  Those rules are defined within the external (npm)
+      package called `renovate-config-apolllo-docs` (defined here only by
+      the `apollo-docs` suffix).
+    */
+    {
+      "paths": [
+        "docs/package.json"
+      ],
+      "extends": [
+        "apollo-docs"
+      ],
+      // We need to tell Renovate to check the branches for each major version
+      // of Apollo Server.  "Past" major versions should be added here!
+      "baseBranches": [
+        "master",
+        "version-2"
+      ]
+    }
+  ]
+}