version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
    commit-message:
      prefix: "deps"
    open-pull-requests-limit: 10
    groups:
      production:
        dependency-type: "production"
      development:
        dependency-type: "development"
    ignore:
      - dependency-name: "react"
        update-types: ["version-update:semver-major"]
      - dependency-name: "react-dom"
        update-types: ["version-update:semver-major"]
      - dependency-name: "next"
        update-types: ["version-update:semver-major"]
      - dependency-name: "eslint"
        update-types: ["version-update:semver-major"]
      - dependency-name: "eslint-config-next"
        update-types: ["version-update:semver-major"]
      # typescript majors are peer-blocked by typescript-eslint, which pins a hard
      # upper bound (8.64.0 → peerDependencies.typescript ">=4.8.4 <6.1.0"). A TS 7
      # bump therefore violates the peer and takes down the whole toolchain at once —
      # #7068 grouped it with 6 harmless bumps and turned Build + Lint + Quality Ratchet
      # + Unit (6/8, 8/8) + Integration (1/2, 2/2) + dast-smoke red in one shot, blocking
      # the innocuous updates riding along with it. Un-ignore once typescript-eslint
      # widens the peer, and migrate TS majors intentionally (own PR, own CI run).
      - dependency-name: "typescript"
        update-types: ["version-update:semver-major"]
      # jscpd v5 is a Rust rewrite (native binary, no Node.js programmatic API).
      # scripts/check/check-duplication.mjs is deliberately pinned to jscpd@4 (it
      # parses jscpd-report.json against a frozen baseline). A v5 major would break
      # the duplication gate — migrate the gate intentionally, not via dependabot.
      - dependency-name: "jscpd"
        update-types: ["version-update:semver-major"]
      # ioredis is a SOFT/optional dependency loaded through a dynamic import
      # (src/lib/quota/redisQuotaStore.ts — "Redis driver requires ioredis package"),
      # so a breaking major never fails at build or typecheck time: the only consumers
      # are the distributed quota store (redisQuotaStore.ts, storeFactory.ts) and the
      # `import type Redis` in src/shared/utils/rateLimiter.ts. Nothing in the unit or
      # vitest suites exercises a live Redis connection, so a v5→v6 API break would ship
      # green and only surface at runtime for operators running distributed quota — the
      # exact users least able to absorb it. #9310 grouped that major with 9 harmless
      # bumps; majors here need their own PR and a deliberate migration review.
      - dependency-name: "ioredis"
        update-types: ["version-update:semver-major"]
      # @huggingface/transformers is VPS-validated at ^4.2.0 (migrated intentionally in
      # #9962). It is load-bearing for the LLMLingua ONNX compression engine (open-sse/
      # services/compression/engines/llmlingua/ — @atjsh/llmlingua-2@2.0.5 peers on
      # "@huggingface/transformers": "^3.5.2 || ^4.0.0") and for local memory embeddings
      # (src/lib/memory/embedding/transformersLocal.ts). Further majors must be re-validated
      # on the VPS — so keep auto-bumps frozen (no update-types = ignore every version).
      # Migrate it intentionally, not via dependabot (#4050).
      - dependency-name: "@huggingface/transformers"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

  - package-ecosystem: "npm"
    directory: "/electron"
    schedule:
      interval: "weekly"
      day: "monday"
    commit-message:
      prefix: "deps"

  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
    commit-message:
      prefix: "deps"