Fix renovate auto merge config

[svartkanin]

Auto merge was not working ever as the wrong type was supplied

[codefiles]

LGTM

This comment is mostly to document how I reviewed this.

To check locally using a Renovate container:

$ podman pull docker.io/renovate/renovate
$ podman run \
>	--tty \
>	--rm \
>	--volume ./:/usr/src/app \
>	--env LOG_LEVEL=debug \
>	renovate --platform=local

Below is an excerpt of the mypy section from DEBUG: packageFiles with updates (repository=local)

         "poetry": [
           {
             "deps": [
               ...
               {
                 "packageName": "mypy",
                 "depName": "mypy",
                 "datasource": "pypi",
                 "depType": "project.optional-dependencies",
                 "currentValue": "==2.3.0",
                 "currentVersion": "2.3.0",
                 "managerData": {"depGroup": "dev"},
                 "updates": [],
                 "versioning": "pep440",
                 "warnings": [],
                 "sourceUrl": "https://github.com/python/mypy",
                 "registryUrl": "https://pypi.org/pypi",
                 "changelogUrl": "https://mypy.readthedocs.io/en/latest/changelog.html",
                 "mostRecentTimestamp": "2026-07-13T11:28:38.000Z",
                 "currentVersionTimestamp": "2026-07-13T11:28:38.000Z",
                 "currentVersionAgeInDays": 22,
                 "fixedVersion": "2.3.0"
               },
               ...
             "packageFile": "pyproject.toml"
           }
         ],

This shows that for example, mypy will have the depType of project.optional-dependencies. This comes from the pyproject.toml file.

devDependencies is an npm dependency type, the wrong type for mypy. The matchDepTypes fails in this case and the automerge is not applied.

References:

• https://docs.renovatebot.com/modules/platform/local/
• https://docs.renovatebot.com/troubleshooting/#self-hosted
• https://docs.renovatebot.com/configuration-options/#packagerulesmatchdeptypes
• https://docs.npmjs.com/specifying-dependencies-and-devdependencies-in-a-package-json-file/

[correctmost]

I wonder if a cooldown period should be specified before auto-merging happens? A lot of projects are adopting delays to avoid supply chain attacks.

• https://docs.renovatebot.com/key-concepts/minimum-release-age
• https://cooldowns.dev/#dependency-update-bots
• https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns

[svartkanin]

@correctmost that makes sense, as I understand with a cooldown period the PR won't even be raised until the cooldown period passed, so that should be fine.
If you feel like raising the PR and including this one as well I can approve and merge it