diff --git a/package-lock.json b/package-lock.json
index ef293ffac..81cf89ef2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13,7 +13,7 @@
         "ast-types": "^0.16.0",
         "bluebird": "^3.5.0",
         "boxen": "^5.1.2",
-        "camelcase": "^10.0.0",
+        "camelcase": "^6.0.0",
         "chalk": "^4.1.2",
         "cli-highlight": "^2.1.11",
         "cli-table3": "^0.6.0",
@@ -7375,18 +7375,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/boxen/node_modules/camelcase": {
-      "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz",
-      "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/brace-expansion": {
       "version": "1.1.13",
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
@@ -7686,12 +7674,11 @@
       }
     },
     "node_modules/camelcase": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-10.0.0.tgz",
-      "integrity": "sha512-p1wew5BGDCONz/5R+xHF6ByqXQM2V+5r4e+FdlFUeROawuMPimdDOFLw5k2QSqp1rm5h2QAglToqJyvnsl3ArQ==",
-      "license": "MIT",
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz",
+      "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==",
       "engines": {
-        "node": ">=22"
+        "node": ">=10"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
@@ -14549,19 +14536,6 @@
         "@types/yargs-parser": "*"
       }
     },
-    "node_modules/jest-validate/node_modules/camelcase": {
-      "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz",
-      "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/jest-watcher": {
       "version": "28.1.3",
       "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-28.1.3.tgz",
diff --git a/package.json b/package.json
index aaec20d3b..b5274f7ea 100644
--- a/package.json
+++ b/package.json
@@ -84,7 +84,7 @@
     "ast-types": "^0.16.0",
     "bluebird": "^3.5.0",
     "boxen": "^5.1.2",
-    "camelcase": "^10.0.0",
+    "camelcase": "^6.0.0",
     "chalk": "^4.1.2",
     "cli-highlight": "^2.1.11",
     "cli-table3": "^0.6.0",
diff --git a/renovate.json b/renovate.json
index 453be503a..64b0dd030 100644
--- a/renovate.json
+++ b/renovate.json
@@ -81,6 +81,17 @@
       "description": "Pinned to v4 — migration to v5+ not yet done",
       "matchPackageNames": ["husky"],
       "allowedVersions": "<5.0.0"
+    },
+    {
+      "description": "ESM-only from v7, do not upgrade until ESM is supported",
+      "matchPackageNames": ["camelcase"],
+      "allowedVersions": "<7.0.0"
+    },
+    {
+      "description": "Never auto-merge major updates. Renovate still opens a PR and runs CI, but it waits for a human to merge.",
+      "matchUpdateTypes": ["major"],
+      "automerge": false,
+      "addLabels": ["major-update", "needs-review"]
     }
   ]
 }