oxynote/.github/dependabot.yml

# dependabot covers every subproject: web, server/core, server/auth-realtime,
# datagen and e2e — plus the GitHub Actions workflows, the subprojects'
# Dockerfiles and the compose stacks. Each entry gets grouped update PRs
# (never one PR per dependency): a "safe" group with minor and patch updates,
# and a separate "breaking" group for major updates. The commit-message prefix
# names the subproject, so it shows up in every dependabot PR title.
#
# When a dependency matches several groups, dependabot puts it in the first
# matching group, so order matters within each entry's `groups` block.
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/web"
    schedule:
      interval: "monthly"
    commit-message:
      prefix: "deps(web)"
    # web/packages/lezer-promql is a vendored upstream fork that should track
    # upstream, not dependabot. These dependencies are only used there, so
    # ignoring them keeps the fork untouched.
    ignore:
      - dependency-name: "@lezer/*"
      - dependency-name: "@rollup/plugin-node-resolve"
      - dependency-name: "@types/jest"
      # codemirror-promql pins lezer-promql exactly, and vite aliases that
      # import to the fork — so any bump needs the fork re-synced to the
      # matching upstream tag or the generated term ids drift apart.
      - dependency-name: "@prometheus-io/codemirror-promql"
      # typescript-eslint caps typescript at <6.1.0 and vue-tsc has not
      # caught up with the 7.x native port, so 6.x is the ceiling until
      # both support it.
      - dependency-name: "typescript"
        versions: [">=7.0.0"]
      # @electron-forge/plugin-fuses peers @electron/fuses ^1.0.0; no forge
      # release supports 2.x yet.
      - dependency-name: "@electron/fuses"
        versions: [">=2.0.0"]
      # @vee-validate/zod peers zod ^3.24.0 and has no v4 release.
      - dependency-name: "zod"
        versions: [">=4.0.0"]
    groups:
      # better-auth does not follow semver — 1.x minor releases can be
      # breaking, so its minor updates go into this breaking-changes group
      # instead of the safe group. It must stay first so it wins the overlap
      # with the catch-all groups below. Patch releases still fall through to
      # the safe group.
      better-auth-breaking:
        patterns:
          - "better-auth"
          - "@better-auth/*"
        update-types:
          - "major"
          - "minor"
      breaking:
        patterns:
          - "*"
        update-types:
          - "major"
      safe:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"

  - package-ecosystem: "npm"
    directory: "/server/auth-realtime"
    schedule:
      interval: "monthly"
    commit-message:
      prefix: "deps(auth-realtime)"
    ignore:
      # typescript-eslint caps typescript at <6.1.0 and vue-tsc has not
      # caught up with the 7.x native port, so 6.x is the ceiling until
      # both support it.
      - dependency-name: "typescript"
        versions: [">=7.0.0"]
      # the runtime is node 24 everywhere (both Dockerfiles and CI), and
      # types ahead of it compile against apis that are not there.
      - dependency-name: "@types/node"
        versions: [">=25.0.0"]
      # @hono/node-ws peers @hono/node-server ^1.19.11; no release supports 2.x.
      - dependency-name: "@hono/node-server"
        versions: [">=2.0.0"]
    groups:
      # same better-auth non-semver caveat as the web entry above: minor
      # releases are treated as breaking, patch releases fall through to the
      # safe group.
      better-auth-breaking:
        patterns:
          - "better-auth"
          - "@better-auth/*"
        update-types:
          - "major"
          - "minor"
      breaking:
        patterns:
          - "*"
        update-types:
          - "major"
      safe:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"

  - package-ecosystem: "npm"
    directory: "/e2e"
    schedule:
      interval: "monthly"
    commit-message:
      prefix: "deps(e2e)"
    ignore:
      # typescript-eslint caps typescript at <6.1.0 and vue-tsc has not
      # caught up with the 7.x native port, so 6.x is the ceiling until
      # both support it.
      - dependency-name: "typescript"
        versions: [">=7.0.0"]
      # the runtime is node 24 everywhere (both Dockerfiles and CI), and
      # types ahead of it compile against apis that are not there.
      - dependency-name: "@types/node"
        versions: [">=25.0.0"]
    groups:
      breaking:
        patterns:
          - "*"
        update-types:
          - "major"
      safe:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"

  - package-ecosystem: "gomod"
    directory: "/server/core"
    schedule:
      interval: "monthly"
    commit-message:
      prefix: "deps(core)"
    groups:
      breaking:
        patterns:
          - "*"
        update-types:
          - "major"
      safe:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"

  - package-ecosystem: "gomod"
    directory: "/datagen"
    schedule:
      interval: "monthly"
    commit-message:
      prefix: "deps(datagen)"
    groups:
      breaking:
        patterns:
          - "*"
        update-types:
          - "major"
      safe:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"

  - package-ecosystem: "npm"
    directory: "/docker/prod/launcher"
    schedule:
      interval: "monthly"
    commit-message:
      prefix: "deps(launcher)"
    ignore:
      # typescript-eslint caps typescript at <6.1.0 and vue-tsc has not
      # caught up with the 7.x native port, so 6.x is the ceiling until
      # both support it.
      - dependency-name: "typescript"
        versions: [">=7.0.0"]
      # the runtime is node 24 everywhere (both Dockerfiles and CI), and
      # types ahead of it compile against apis that are not there.
      - dependency-name: "@types/node"
        versions: [">=25.0.0"]
    groups:
      breaking:
        patterns:
          - "*"
        update-types:
          - "major"
      safe:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"
    commit-message:
      prefix: "deps(actions)"
    groups:
      breaking:
        patterns:
          - "*"
        update-types:
          - "major"
      safe:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"

  # base images in each subproject's Dockerfile.dev. Grouping is per
  # directory, and the directory shows up in the PR title, so the subproject
  # stays identifiable even with the shared prefix.
  - package-ecosystem: "docker"
    directories:
      - "/web"
      - "/server/core"
      - "/server/auth-realtime"
      - "/datagen"
      - "/docker/prod"
    schedule:
      interval: "monthly"
    commit-message:
      prefix: "deps(docker)"
    ignore:
      # the runtime tracks the active node LTS line (24). Odd majors are
      # never LTS and even ones only become LTS ~6 months after release, so
      # majors are bumped by hand when the next LTS ships instead of every
      # time a current release appears.
      - dependency-name: "node"
        versions: [">=25.0.0"]
    groups:
      breaking:
        patterns:
          - "*"
        update-types:
          - "major"
      safe:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"

  # images pinned in the dev stack (docker/docker-compose.dev.yaml) and the
  # e2e stack (e2e/docker-compose*.yaml).
  - package-ecosystem: "docker-compose"
    directories:
      - "/docker"
      - "/docker/prod"
      - "/e2e"
    schedule:
      interval: "monthly"
    commit-message:
      prefix: "deps(docker)"
    groups:
      breaking:
        patterns:
          - "*"
        update-types:
          - "major"
      safe:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"