version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      minor-and-patch:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
    # Version updates stop at the current major version. This stack is pinned to
    # specific majors (Next 16, React 19, Tailwind 4, Vitest 5, ESLint 9), and a
    # major bump is a deliberate change inside a milestone, not a weekly pull
    # request. An ignore rule scoped with `update-types` does not hold back
    # security updates, so those still open a pull request.
    ignore:
      - dependency-name: "*"
        update-types:
          - "version-update:semver-major"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      minor-and-patch:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"