donutbrowser/.github/dependabot.yml

version: 2

updates:
  # Frontend dependencies (root package.json). pnpm-workspace.yaml makes the
  # root lockfile cover donut-sync/package.json too, so this entry updates both.
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "saturday"
      time: "09:00"
    allow:
      - dependency-type: "all"
    ignore:
      # donut-sync stays on TypeScript 6: Nest CLI and ts-jest need the
      # compiler API, which TypeScript 7.0 does not ship (it returns in 7.1).
      # The root is on 7 already, so this only holds donut-sync back.
      - dependency-name: "typescript"
        update-types: ["version-update:semver-major"]
    groups:
      frontend-dependencies:
        patterns:
          - "*"
    commit-message:
      prefix: "deps"
      include: "scope"

  # Rust dependencies
  - package-ecosystem: "cargo"
    directory: "/src-tauri"
    schedule:
      interval: "weekly"
      day: "saturday"
      time: "09:00"
    allow:
      - dependency-type: "all"
    ignore:
      # Held below 1.25 on purpose (see the note in src-tauri/Cargo.toml):
      # from 1.25 it pulls in aws-lc, which needs CMake and NASM to build.
      - dependency-name: "shadowsocks"
        versions: [">=1.25"]
      # Moves with Tauri (see the note in src-tauri/Cargo.toml): two gtk-sys
      # versions cannot both link gtk-3.
      - dependency-name: "gtk"
        versions: [">=0.19"]
    groups:
      rust-dependencies:
        patterns:
          - "*"
    commit-message:
      prefix: "deps(rust)"
      include: "scope"

  # E2E harness crate. Its only registry dependency is the pinned tauri-wd
  # driver; Cargo.lock there is generated from src-tauri's and not committed.
  - package-ecosystem: "cargo"
    directory: "/e2e/app"
    schedule:
      interval: "weekly"
      day: "saturday"
      time: "09:00"
    ignore:
      # Held below 1.25 on purpose (see the note in src-tauri/Cargo.toml):
      # from 1.25 it pulls in aws-lc, which needs CMake and NASM to build.
      - dependency-name: "shadowsocks"
        versions: [">=1.25"]
      # Moves with Tauri (see the note in src-tauri/Cargo.toml): two gtk-sys
      # versions cannot both link gtk-3.
      - dependency-name: "gtk"
        versions: [">=0.19"]
    groups:
      e2e-rust-dependencies:
        patterns:
          - "*"
    commit-message:
      prefix: "deps(e2e)"
      include: "scope"

  # Standalone SDKs for the local REST API
  - package-ecosystem: "pip"
    directory: "/sdk/python"
    schedule:
      interval: "weekly"
      day: "saturday"
      time: "09:00"
    allow:
      - dependency-type: "all"
    groups:
      sdk-python-dependencies:
        patterns:
          - "*"
    commit-message:
      prefix: "deps(sdk)"
      include: "scope"

  # donut-sync image base (node:*-alpine)
  - package-ecosystem: "docker"
    directory: "/donut-sync"
    schedule:
      interval: "weekly"
      day: "saturday"
      time: "09:00"
    ignore:
      # Node majors follow .node-version and are moved by hand.
      - dependency-name: "node"
        update-types: ["version-update:semver-major"]
    groups:
      docker-dependencies:
        patterns:
          - "*"
    commit-message:
      prefix: "deps(docker)"
      include: "scope"

  # GitHub Actions
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "saturday"
      time: "09:00"
    groups:
      github-actions:
        patterns:
          - "*"
    commit-message:
      prefix: "ci"
      include: "scope"