version: 2

# Security updates always come through regardless of these settings.
# Scheduled (non-security) updates are limited to minor/patch only —
# major bumps of devDeps like eslint/typescript are manual decisions.

updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: monthly
    groups:
      all-dependencies:
        patterns:
          - '*'
    ignore:
      - dependency-name: '*'
        update-types: ['version-update:semver-major']

  - package-ecosystem: npm
    directory: /examples/servers/typescript
    schedule:
      interval: monthly
    groups:
      all-dependencies:
        patterns:
          - '*'
    ignore:
      - dependency-name: '*'
        update-types: ['version-update:semver-major']

  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: monthly
    groups:
      all-actions:
        patterns:
          - '*'
    ignore:
      - dependency-name: '*'
        update-types: ['version-update:semver-major']