From 7d4228bd42a76a9cc8d73e636bd99a94a07c2718 Mon Sep 17 00:00:00 2001
From: Josh Radcliff <jradcliff@users.noreply.github.com>
Date: Thu, 1 Oct 2026 11:30:20 -0400
Subject: [PATCH] ci(renovate): keep tink on Java 8 compatible versions

---
 .github/renovate.json5 | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 2e8bec5..e85837c 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -15,6 +15,23 @@
     "dependencyDashboardLabels": [
         "type: process",
     ],
+    // https://docs.renovatebot.com/configuration-options/#packagerules
+    "packageRules": [
+        {
+            "description": "Stay on Java 8 compatible versions of Tink (1.19.0+ dropped Java 8)",
+            "matchPackageNames": [
+                "com.google.crypto.tink:tink",
+            ],
+            "allowedVersions": "< 1.19.0",
+        },
+        {
+            "description": "Stay on Java 8 compatible versions of Tink GCP KMS extension (1.11.0+ dropped Java 8)",
+            "matchPackageNames": [
+                "com.google.crypto.tink:tink-gcpkms",
+            ],
+            "allowedVersions": "< 1.11.0",
+        },
+    ],
     "rebaseWhen": "behind-base-branch",
     "semanticCommits": "enabled",
     // Create PR for vulnerability alerts immediately.