diff --git a/renovate.json b/renovate.json
index e8641673ab..3256aa0bb6 100644
--- a/renovate.json
+++ b/renovate.json
@@ -22,11 +22,17 @@
   ],
   "semanticCommits": "disabled",
   "automergeStrategy": "merge-commit",
-  "postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths", "npmDedupe"],
+  "postUpdateOptions": [
+    "gomodTidy",
+    "gomodUpdateImportPaths",
+    "npmDedupe"
+  ],
   "prConcurrentLimit": 10,
   "internalChecksFilter": "strict",
   "osvVulnerabilityAlerts": true,
-  "labels": ["dependency-upgrade"],
+  "labels": [
+    "dependency-upgrade"
+  ],
   "packageRules": [
     {
       "description": "Require approval for go and python minor version",
@@ -38,7 +44,9 @@
         "docker.io/library/golang",
         "mcr.microsoft.com/devcontainers/go"
       ],
-      "matchUpdateTypes": ["minor"],
+      "matchUpdateTypes": [
+        "minor"
+      ],
       "dependencyDashboardApproval": true
     },
     {
@@ -57,22 +65,30 @@
         "github.com/google/pprof",
         "github.com/golangci/misspell/cmd/misspell"
       ],
-      "extends": ["schedule:quarterly"]
+      "extends": [
+        "schedule:quarterly"
+      ]
     },
     {
       "description": "elasticsearch CI images are published about once a month and do not use semantic versioning or short tags",
-      "matchDepNames": ["elasticsearch"],
-      "extends": ["schedule:quarterly"]
+      "matchDepNames": [
+        "elasticsearch"
+      ],
+      "extends": [
+        "schedule:quarterly"
+      ]
     },
     {
       "description": "devcontainer is an optional tool used by some Forgejo contributors when working on the codebase",
-      "matchPackagePrefixes": [
-        "ghcr.io/devcontainers/features/",
-        "ghcr.io/devcontainers-contrib/features/"
-      ],
       "groupName": "devcontainer packages",
-      "extends": ["schedule:quarterly"],
-      "automerge": true
+      "extends": [
+        "schedule:quarterly"
+      ],
+      "automerge": true,
+      "matchPackageNames": [
+        "ghcr.io/devcontainers/features/{/,}**",
+        "ghcr.io/devcontainers-contrib/features/{/,}**"
+      ]
     },
     {
       "description": "Group golang packages",
@@ -86,26 +102,42 @@
     },
     {
       "description": "Group nodejs packages",
-      "matchDepNames": ["node", "docker.io/node", "docker.io/library/node"],
+      "matchDepNames": [
+        "node",
+        "docker.io/node",
+        "docker.io/library/node"
+      ],
       "groupName": "nodejs packages",
       "versionCompatibility": "^(?<version>[^-]+)(?<compatibility>-.*)?$",
       "versioning": "node"
     },
     {
       "description": "Automerge renovate updates",
-      "matchDatasources": ["docker"],
-      "matchPackageNames": ["ghcr.io/visualon/renovate"],
-      "matchUpdateTypes": ["minor", "patch", "digest"],
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchPackageNames": [
+        "ghcr.io/visualon/renovate"
+      ],
+      "matchUpdateTypes": [
+        "minor",
+        "patch",
+        "digest"
+      ],
       "automerge": true
     },
     {
       "description": "x/tools/* are used in the CI only and upgraded together",
-      "matchPackagePrefixes": [
-        "golang.org/x/tools"
+      "matchUpdateTypes": [
+        "minor",
+        "patch",
+        "digest"
       ],
-      "matchUpdateTypes": ["minor", "patch", "digest"],
       "automerge": true,
-      "groupName": "x/tools"
+      "groupName": "x/tools",
+      "matchPackageNames": [
+        "golang.org/x/tools{/,}**"
+      ]
     },
     {
       "description": "Split minor and patch updates",
@@ -123,15 +155,27 @@
     },
     {
       "description": "Automerge patch updates",
-      "matchDepNames": ["vue", "github.com/urfave/cli/v2", "swagger-ui-dist"],
-      "matchUpdateTypes": ["patch"],
+      "matchDepNames": [
+        "vue",
+        "github.com/urfave/cli/v2",
+        "swagger-ui-dist"
+      ],
+      "matchUpdateTypes": [
+        "patch"
+      ],
       "automerge": true
     },
     {
       "description": "Update renovate with higher prio to come through rate limit",
-      "matchDatasources": ["docker"],
-      "matchPackageNames": ["ghcr.io/visualon/renovate"],
-      "extends": ["schedule:weekly"],
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchPackageNames": [
+        "ghcr.io/visualon/renovate"
+      ],
+      "extends": [
+        "schedule:weekly"
+      ],
       "prPriority": 10,
       "groupName": "renovate"
     },
@@ -143,19 +187,30 @@
         "docker.io/golang",
         "docker.io/library/golang"
       ],
-      "matchUpdateTypes": ["patch"],
+      "matchUpdateTypes": [
+        "patch"
+      ],
       "prPriority": 10,
-      "schedule": ["at any time"]
+      "schedule": [
+        "at any time"
+      ]
     },
     {
       "description": "Disable actions/cascading-pr for now <https://github.com/renovatebot/renovate/issues/28120>",
-      "matchDepNames": ["actions/cascading-pr"],
-      "matchManagers": ["github-actions"],
+      "matchDepNames": [
+        "actions/cascading-pr"
+      ],
+      "matchManagers": [
+        "github-actions"
+      ],
       "enabled": false
     },
     {
       "description": "Automerge some packages when CI succeeds",
-      "extends": ["packages:linters", "packages:test"],
+      "extends": [
+        "packages:linters",
+        "packages:test"
+      ],
       "matchDepNames": [
         "github.com/editorconfig-checker/editorconfig-checker/v2/cmd/editorconfig-checker",
         "github.com/golangci/golangci-lint/cmd/golangci-lint",
@@ -168,38 +223,50 @@
         "vite-string-plugin",
         "@vue/test-utils"
       ],
-      "matchPackagePrefixes": [
-        "@eslint-community/",
-        "@playwright/",
-        "@stoplight/spectral-cli",
-        "@stylistic/",
-        "mcr.microsoft.com/devcontainers/"
-      ],
-      "automerge": true
+      "automerge": true,
+      "matchPackageNames": [
+        "@eslint-community/{/,}**",
+        "@playwright/{/,}**",
+        "@stoplight/spectral-cli{/,}**",
+        "@stylistic/{/,}**",
+        "mcr.microsoft.com/devcontainers/{/,}**"
+      ]
     },
     {
       "description": "Hold back on some package updates for a few days",
-      "matchDepNames": ["monaco-editor"],
+      "matchDepNames": [
+        "monaco-editor"
+      ],
       "minimumReleaseAge": "30 days"
     },
     {
       "description": "disallow `eslint-plugin-no-use-extend-native` v0.6.0+, requires eslint v9",
-      "matchDepNames": ["eslint-plugin-no-use-extend-native"],
+      "matchDepNames": [
+        "eslint-plugin-no-use-extend-native"
+      ],
       "allowedVersions": "<0.6.0"
     },
     {
       "description": "Require approval for stable branches (must be last rule to override all others)",
-      "matchBaseBranches": ["/^v\\d+\\.\\d+\\/forgejo$/"],
+      "matchBaseBranches": [
+        "/^v\\d+\\.\\d+\\/forgejo$/"
+      ],
       "dependencyDashboardApproval": true,
-      "schedule": ["at any time"]
+      "schedule": [
+        "at any time"
+      ]
     }
   ],
   "customManagers": [
     {
       "description": "Update go-version in forgejo workflows",
       "customType": "regex",
-      "fileMatch": ["^.forgejo/workflows/.+\\.yml$"],
-      "matchStrings": ["\\s+go-version: ['\"]?(?<currentValue>.+?)['\"]?\\s"],
+      "fileMatch": [
+        "^.forgejo/workflows/.+\\.yml$"
+      ],
+      "matchStrings": [
+        "\\s+go-version: ['\"]?(?<currentValue>.+?)['\"]?\\s"
+      ],
       "depNameTemplate": "go",
       "datasourceTemplate": "golang-version",
       "versioningTemplate": "go-mod-directive"
@@ -207,15 +274,21 @@
     {
       "description": "Update node-version in forgejo workflows",
       "customType": "regex",
-      "fileMatch": ["^.forgejo/workflows/.+\\.yml$"],
-      "matchStrings": ["\\s+node-version: ['\"]?(?<currentValue>.+?)['\"]?\\s"],
+      "fileMatch": [
+        "^.forgejo/workflows/.+\\.yml$"
+      ],
+      "matchStrings": [
+        "\\s+node-version: ['\"]?(?<currentValue>.+?)['\"]?\\s"
+      ],
       "depNameTemplate": "node",
       "datasourceTemplate": "node-version"
     },
     {
       "description": "Update deps inside Makefile",
       "customType": "regex",
-      "fileMatch": ["^Makefile$"],
+      "fileMatch": [
+        "^Makefile$"
+      ],
       "matchStrings": [
         " \\?= (?<depName>.+?)@(?<currentValue>.+?) # renovate: datasource=(?<datasource>.+?)(?: packageName=(?<packageName>.+?))?( versioning=(?<versioning>.+?))?\\s"
       ]