diff --git a/renovate.json b/renovate.json
index 4e0a4b8cfe3..3ddbebc5a05 100644
--- a/renovate.json
+++ b/renovate.json
@@ -9,18 +9,17 @@
   "schedule": [
     "every 3 weeks on Monday"
   ],
+  "vulnerabilityAlerts": {
+    "description": "Security updates bypass the packageRules grouping below (Renovate resets their groupName), so apply the same groupId grouping to them here.",
+    "groupName": "{{{replace ':.*' '' depName}}} security"
+  },
   "packageRules": [
     {
-      "groupName": "com.fasterxml.jackson.core",
-      "matchPackageNames": [
-        "com.fasterxml.jackson.core{/,}**"
-      ]
-    },
-    {
-      "groupName": "com.github.ben-manes.caffeine",
-      "matchPackageNames": [
-        "com.github.ben-manes.caffeine{/,}**"
-      ]
+      "description": "Group every Maven update by its groupId by default. The more specific rules below run later and override this where a group must span several groupIds, pin a version, or stay disabled.",
+      "matchDatasources": [
+        "maven"
+      ],
+      "groupName": "{{{replace ':.*' '' depName}}}"
     },
     {
       "groupName": "com.github.vlsi",
@@ -28,18 +27,6 @@
         "com.github.vlsi{/,}**"
       ]
     },
-    {
-      "groupName": "com.github.weisj",
-      "matchPackageNames": [
-        "com.github.weisj{/,}**"
-      ]
-    },
-    {
-      "groupName": "com.google.auto.service",
-      "matchPackageNames": [
-        "com.google.auto.service{/,}**"
-      ]
-    },
     {
       "groupName": "com.google.errorprone",
       "matchPackageNames": [
@@ -79,25 +66,6 @@
         "github/**"
       ]
     },
-    {
-      "groupName": "io.burt",
-      "matchPackageNames": [
-        "io.burt{/,}**"
-      ]
-    },
-    {
-      "groupName": "net.minidev json-smart",
-      "matchPackageNames": [
-        "net.minidev:accessors-smart{/,}**",
-        "net.minidev:json-smart{/,}**"
-      ]
-    },
-    {
-      "groupName": "com.miglayout",
-      "matchPackageNames": [
-        "com.miglayout{/,}**"
-      ]
-    },
     {
       "groupName": "commons-* (classic)",
       "description": "Classic Apache Commons artifacts where groupId == artifactId",
@@ -110,72 +78,6 @@
         "commons-net{/,}**"
       ]
     },
-    {
-      "groupName": "org.ajoberstar.grgit",
-      "matchPackageNames": [
-        "org.ajoberstar.grgit{/,}**"
-      ]
-    },
-    {
-      "groupName": "org.apache.activemq",
-      "matchPackageNames": [
-        "org.apache.activemq{/,}**"
-      ]
-    },
-    {
-      "groupName": "org.apache.commons",
-      "matchPackageNames": [
-        "org.apache.commons{/,}**"
-      ]
-    },
-    {
-      "groupName": "org.apache.ftpserver",
-      "matchPackageNames": [
-        "org.apache.ftpserver{/,}**"
-      ]
-    },
-    {
-      "groupName": "org.apache.httpcomponents4",
-      "matchPackageNames": [
-        "org.apache.httpcomponents:{/,}**"
-      ]
-    },
-    {
-      "groupName": "org.apache.httpcomponents5",
-      "matchPackageNames": [
-        "org.apache.httpcomponents.client5:{/,}**"
-      ]
-    },
-    {
-      "groupName": "org.apache.logging.log4j",
-      "matchPackageNames": [
-        "org.apache.logging.log4j{/,}**"
-      ]
-    },
-    {
-      "groupName": "org.apache.tika",
-      "matchPackageNames": [
-        "org.apache.tika{/,}**"
-      ]
-    },
-    {
-      "groupName": "org.bouncycastle",
-      "matchPackageNames": [
-        "org.bouncycastle{/,}**"
-      ]
-    },
-    {
-      "groupName": "org.eclipse.jetty",
-      "matchPackageNames": [
-        "org.eclipse.jetty{/,}**"
-      ]
-    },
-    {
-      "groupName": "org.hamcrest",
-      "matchPackageNames": [
-        "org.hamcrest{/,}**"
-      ]
-    },
     {
       "groupName": "org.jetbrains.kotlin",
       "description": "Kotlin compiler plugins (jvm, kapt, serialization, ...) share a version",
@@ -183,24 +85,6 @@
         "org.jetbrains.kotlin{/,}**"
       ]
     },
-    {
-      "groupName": "org.jetbrains.lets-plot",
-      "matchPackageNames": [
-        "org.jetbrains.lets-plot{/,}**"
-      ]
-    },
-    {
-      "groupName": "org.jodd",
-      "matchPackageNames": [
-        "org.jodd{/,}**"
-      ]
-    },
-    {
-      "groupName": "org.openjdk.jmh",
-      "matchPackageNames": [
-        "org.openjdk.jmh{/,}**"
-      ]
-    },
     {
       "groupName": "org.slf4j",
       "allowedVersions": "< 2.0.0",