version: 2
updates:
  # Fifteen Go modules, each with its own go.mod and no workspace tying them
  # together, so a single entry cannot reach them: `directories` with a glob
  # is what covers the hack/ fixtures without listing every one by hand.
  # Grouped, because the alternative is what prompted this file -- one
  # advisory in a shared dependency opened nine separate alerts.
  - package-ecosystem: gomod
    directories:
      - "/api"
      - "/ingest"
      - "/alerting"
      - "/enterprise"
      - "/proto"
      - "/cli"
      - "/terraform"
      - "/deploy/operator"
      - "/hack/*"
    schedule:
      interval: weekly
      day: tuesday
      time: "09:00"
      timezone: Etc/UTC
    open-pull-requests-limit: 5
    groups:
      # Majors stay out: a Go major is an import path change, never a bump.
      go-minor-and-patch:
        update-types:
          - minor
          - patch
  - package-ecosystem: cargo
    directories:
      - "/agent"
      - "/search"
    schedule:
      interval: weekly
      day: tuesday
      time: "09:00"
      timezone: Etc/UTC
    groups:
      cargo-minor-and-patch:
        update-types:
          - minor
          - patch
  - package-ecosystem: npm
    directory: "/web"
    schedule:
      interval: weekly
      day: tuesday
      time: "09:00"
      timezone: Etc/UTC
    ignore:
      # TypeScript 7 cannot be installed here at all: no @sveltejs/kit
      # release accepts it. 2.70.3 (latest) peers `^5.3.3 || ^6.0.0` and
      # even 3.0.0-next.27 peers `^6.0.0`; svelte-check caps at 6 as well.
      # `npm ci` fails ERESOLVE before anything is built, so the PR cannot
      # be made green from this side. Drop this entry once a SvelteKit
      # release peers ^7 -- minor and patch updates still come through.
      - dependency-name: typescript
        update-types: ["version-update:semver-major"]
    groups:
      npm-minor-and-patch:
        update-types:
          - minor
          - patch
  - package-ecosystem: github-actions
    directory: "/"
    schedule:
      interval: weekly
      day: tuesday
      time: "09:00"
      timezone: Etc/UTC
    groups:
      actions:
        patterns:
          - "*"