{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:best-practices",
    "docker:enableMajor",
    ":separateMajorReleases"
  ],
  "labels": ["dependencies"],
  "rangeStrategy": "pin",
  "postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths"],
  "dependencyDashboardApproval": false,
  "timezone": "America/New_York",
  "schedule": ["before 6am on monday"],
  "prConcurrentLimit": 0,
  "prHourlyLimit": 0,
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["before 6am on monday"]
  },
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["dependencies", "security"],
    "schedule": ["at any time"],
    "prHourlyLimit": 0,
    "prConcurrentLimit": 0
  },
  "customManagers": [
    {
      "description": "govulncheck pin in the Security workflow. A go install command has no built-in manager.",
      "customType": "regex",
      "managerFilePatterns": ["/^\\.github/workflows/security\\.yml$/"],
      "matchStrings": ["go install (?<depName>golang\\.org/x/vuln)/cmd/govulncheck@(?<currentValue>v\\S+)"],
      "datasourceTemplate": "go"
    }
  ],
  "pip-compile": {
    "managerFilePatterns": ["/^goopy/internal/ecosystem/requirements\\.txt$/"]
  },
  "pip_requirements": {
    "enabled": false
  },
  "packageRules": [
    {
      "description": "Ignore local goopy module (replaced via go.mod replace directive)",
      "matchManagers": ["gomod"],
      "matchPackageNames": ["github.com/pypx/goopy"],
      "enabled": false
    },
    {
      "description": "Ignore our own CI-built deploy images — private GHCR packages consumed as :latest; Renovate can't auth to them (causes 'No docker auth found' warning) and must not digest-pin them",
      "matchDatasources": ["docker"],
      "matchPackageNames": ["ghcr.io/mattstrayer/pypx/**"],
      "enabled": false
    },
    {
      "description": "Catch-all: batch all remaining npm minor/patch into one rolling PR, automerged when CI is green. Specific ecosystem rules below override groupName and automerge. Majors stay individual.",
      "matchManagers": ["npm"],
      "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
      "groupName": "web: misc (non-major)",
      "automerge": true
    },
    {
      "description": "Nuxt + Vite move together — nuxt releases track vite compatibility. nuxt-* covers the Nuxt SEO module family (nuxt-site-config, nuxt-og-image, nuxt-ai-ready, ...), whose peer ranges must move with @nuxtjs/seo or the install breaks. vue and vue-router are direct nuxt dependencies: bumping nuxt alone (e.g. 4.6.2 needs vue ^3.5.44) installs a second vue copy, and Nuxt auto-import types then miss the templates (#307).",
      "matchManagers": ["npm"],
      "matchPackageNames": [
        "nuxt",
        "nuxt-*",
        "vue",
        "vue-router",
        "@nuxt/**",
        "@nuxtjs/**",
        "vite",
        "@vitejs/**",
        "nitropack"
      ],
      "groupName": "web: nuxt + vite",
      "automerge": false
    },
    {
      "description": "Vue ecosystem (vue and vue-router move with nuxt, above)",
      "matchManagers": ["npm"],
      "matchPackageNames": [
        "@vue/**",
        "@vueuse/**"
      ],
      "groupName": "web: vue",
      "automerge": false
    },
    {
      "description": "Tailwind — @tailwindcss/vite is versioned in lockstep with tailwindcss",
      "matchManagers": ["npm"],
      "matchPackageNames": [
        "tailwindcss",
        "@tailwindcss/**"
      ],
      "groupName": "web: tailwind",
      "automerge": false
    },
    {
      "description": "TypeScript + vue-tsc — vue-tsc tracks TS compiler compatibility",
      "matchManagers": ["npm"],
      "matchPackageNames": [
        "typescript",
        "vue-tsc"
      ],
      "groupName": "web: typescript",
      "automerge": false
    },
    {
      "description": "Keep typescript on 6.x. TypeScript 7 ships only the native compiler with no JS compiler API (no lib/tsc), so vue-tsc fails with ERR_PACKAGE_PATH_NOT_EXPORTED (#218). The TS 7.0 announcement says Vue projects must wait for the API planned for 7.1. Remove once vue-tsc supports TypeScript 7.",
      "matchManagers": ["npm"],
      "matchPackageNames": ["typescript"],
      "allowedVersions": "<7"
    },
    {
      "description": "oxc tooling — plugin API must stay compatible with the oxlint version (if oxlint-plugin-complexity breaks, pin oxlint to the last working version)",
      "matchManagers": ["npm"],
      "matchPackageNames": [
        "oxlint",
        "oxlint-plugin-**",
        "oxfmt"
      ],
      "groupName": "web: oxc",
      "automerge": false
    },
    {
      "description": "Test tooling (must come after vue/nuxt rules so @vue/test-utils and @nuxt/test-utils land here)",
      "matchManagers": ["npm"],
      "matchPackageNames": [
        "vitest",
        "@vitest/**",
        "happy-dom",
        "@vue/test-utils",
        "@nuxt/test-utils"
      ],
      "groupName": "web: testing",
      "automerge": false
    },
    {
      "description": "Go dependencies (both api and goopy modules)",
      "matchManagers": ["gomod"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "api: go dependencies"
    },
    {
      "description": "GitHub Actions",
      "matchManagers": ["github-actions"],
      "groupName": "ci: github actions"
    },
    {
      "description": "Docker images (compose + Dockerfiles)",
      "matchManagers": ["dockerfile", "docker-compose"],
      "groupName": "infra: docker"
    },
    {
      "description": "Go toolchain moves atomically: go directive in go.mod files + golang base image (must come after the docker rule to pull golang out of the docker group)",
      "matchDepNames": ["go", "golang"],
      "matchManagers": ["gomod", "dockerfile"],
      "groupName": "go toolchain"
    },
    {
      "description": "pnpm moves atomically: the action-setup version in CI + the deploy/pnpm lockfile that web/Dockerfile installs (must come after the npm catch-all and the actions rule to pull pnpm out of those groups). No automerge, as before deploy/pnpm joined the npm catch-all.",
      "matchDepNames": ["pnpm"],
      "groupName": "pnpm",
      "automerge": false
    },
    {
      "description": "Keep the security floors in pnpm-workspace.yaml as >= ranges. A pin would stop them from picking up later patched versions. Lock file maintenance moves the resolved versions. Only the workspace overrides match, so these packages keep rangeStrategy pin elsewhere.",
      "matchManagers": ["npm"],
      "matchDepTypes": ["pnpm-workspace.overrides"],
      "matchPackageNames": ["glob", "minimatch", "node-forge"],
      "rangeStrategy": "replace"
    },
    {
      "description": "Automerge non-major test tooling updates",
      "matchManagers": ["npm"],
      "matchPackageNames": [
        "vitest",
        "@vitest/**",
        "happy-dom",
        "@vue/test-utils",
        "@nuxt/test-utils"
      ],
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true
    },
    {
      "description": "Automerge patch-level Go dependency updates",
      "matchManagers": ["gomod"],
      "matchUpdateTypes": ["patch"],
      "automerge": true
    },
    {
      "description": "Automerge GitHub Actions minor/patch updates",
      "matchManagers": ["github-actions"],
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true
    }
  ]
}