version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5
    groups:
      security-patches:
        applies-to: security-updates
        update-types:
          - "patch"
      # One weekly pull request per dependency kind instead of a trickle of
      # single bumps: patch and minor updates travel together and pass the
      # same checks once. Majors stay single so each gets its own review.
      production-weekly:
        dependency-type: "production"
        update-types:
          - "patch"
          - "minor"
      development-weekly:
        dependency-type: "development"
        update-types:
          - "patch"
          - "minor"
    ignore:
      # zod 4.5 made `z.iso.datetime()` require seconds, so a request carrying
      # `2026-01-01T06:15Z` that passes today would be refused with a 422 on
      # every route that validates a timestamp, and 4.6 rewrites nullable and
      # primitive unions in the generated JSON Schema from `anyOf` to `type`
      # arrays, which reshapes the OpenAPI document and every MCP tool schema.
      # Both are contract changes for the web client, the iOS app and MCP
      # callers, not a routine bump, so the move past 4.4 gets its own change
      # with the timestamp producers audited. Patch releases on 4.4 still
      # arrive.
      - dependency-name: "zod"
        versions: [">=4.5.0"]
      # Next 16.4.0 breaks URL state after history traversal: with a sheet
      # opened through `?doc=`, Back leaves it open, and `[` / `]` sometimes
      # do not move `?day=`. Reproduced in three end-to-end journeys (3 of 40
      # repeated runs on 16.4.0, 0 of 80 on 16.3.8 with everything else
      # equal). 16.3.8 carries every published security fix, so the line
      # waits for a 16.4 patch; the two packages that move with it wait too.
      - dependency-name: "next"
        versions: ["16.4.0"]
      - dependency-name: "eslint-config-next"
        versions: ["16.4.0"]
      - dependency-name: "@next/bundle-analyzer"
        versions: ["16.4.0"]
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 3
    groups:
      # init, analyze and upload-sarif are one release pinned in three places.
      # Bumped separately, a run mixes two versions and analyze refuses the
      # config init wrote ("Loaded a configuration file for version 4.37.7, but
      # running version 4.37.9"), so none of the single-action pull requests can
      # reach green on its own. They travel together.
      codeql-action:
        patterns:
          - "github/codeql-action*"
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 3
  # The `docker` ecosystem above reads the Dockerfile only. The bundled
  # database lives in `docker-compose.yml`, which GitHub treats as its own
  # ecosystem, so without this block a new PostgreSQL minor release never
  # reaches us and the pin ages silently.
  - package-ecosystem: "docker-compose"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 3
    ignore:
      # A PostgreSQL major is a migration, not an update: the on-disk format
      # changes, so the operator has to run pg_upgrade or dump and restore.
      # The first run of this ecosystem proposed 16.15 -> 18.6, which would
      # have handed self-hosters a database their data directory cannot be
      # read by. Minor releases still arrive as PRs; a major is a deliberate
      # project decision with a migration guide behind it.
      - dependency-name: "postgres"
        update-types: ["version-update:semver-major"]