.github/dependabot.yml

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
    commit-message:
      prefix: "deps"
    open-pull-requests-limit: 10
    groups:
      production:
        dependency-type: "production"
      development:
        dependency-type: "development"
    ignore:
      - dependency-name: "react"
        update-types: ["version-update:semver-major"]
      - dependency-name: "react-dom"
        update-types: ["version-update:semver-major"]
      - dependency-name: "next"
        update-types: ["version-update:semver-major"]
      - dependency-name: "eslint"
        update-types: ["version-update:semver-major"]
      - dependency-name: "eslint-config-next"
        update-types: ["version-update:semver-major"]
      # jscpd v5 is a Rust rewrite (native binary, no Node.js programmatic API).
      # scripts/check/check-duplication.mjs is deliberately pinned to jscpd@4 (it
      # parses jscpd-report.json against a frozen baseline). A v5 major would break
      # the duplication gate — migrate the gate intentionally, not via dependabot.
      - dependency-name: "jscpd"
        update-types: ["version-update:semver-major"]
      # @huggingface/transformers is HARD-PINNED at 3.5.2 (exact, no caret) — FROZEN.
      # It is load-bearing for the LLMLingua ONNX compression engine (open-sse/services/
      # compression/engines/llmlingua/ — worker.ts pins @huggingface/transformers@3.5.2)
      # and for local memory embeddings (src/lib/memory/embedding/transformersLocal.ts),
      # and was VPS-validated at 3.5.2 (#4014). 4.x breaks both, and even 3.x minors must
      # be re-validated on the VPS — so freeze ALL auto-bumps (no update-types = ignore
      # every version). Migrate it intentionally, not via dependabot (#4050).
      - dependency-name: "@huggingface/transformers"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

  - package-ecosystem: "npm"
    directory: "/electron"
    schedule:
      interval: "weekly"
      day: "monday"
    commit-message:
      prefix: "deps"

  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
    commit-message:
      prefix: "deps"