version: 2
updates:
  # Python - root (requirements.txt)
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "monthly"
    target-branch: "master"
    open-pull-requests-limit: 5
    ignore:
      # SQLAlchemy 1.4 is the 2.0 transition release and is not a drop-in
      # change for this codebase; alembic >=1.11 requires SQLAlchemy 2.
      # Hold both until the SQLAlchemy 2 migration lands.
      - dependency-name: "SQLAlchemy"
        versions: [">=1.4"]
      - dependency-name: "alembic"
        versions: [">=1.11"]
    groups:
      python-dependencies:
        patterns:
          - "*"
        update-types:
          - "patch"
          - "minor"

  # Python - controller
  - package-ecosystem: "pip"
    directory: "/controller"
    schedule:
      interval: "monthly"
    target-branch: "master"
    open-pull-requests-limit: 5
    groups:
      controller-dependencies:
        patterns:
          - "*"
        update-types:
          - "patch"
          - "minor"

  # npm - app
  - package-ecosystem: "npm"
    directory: "/app"
    schedule:
      interval: "monthly"
    target-branch: "master"
    open-pull-requests-limit: 5
    ignore:
      # Major upgrades below need their own migration branch, not a bump PR.
      # maplibre-gl 6: /map build depends on pinned babel/terser handling.
      - dependency-name: "maplibre-gl"
        versions: [">=6"]
      # react-dropzone 15+ changed the accept API; 20 requires Node >=22.
      - dependency-name: "react-dropzone"
        versions: [">=15"]
      # React 19: @react-three/fiber 8 pins react <19.
      - dependency-name: "react"
        update-types: ["version-update:semver-major"]
      - dependency-name: "react-dom"
        update-types: ["version-update:semver-major"]
      - dependency-name: "@types/react"
        update-types: ["version-update:semver-major"]
      - dependency-name: "@types/react-dom"
        update-types: ["version-update:semver-major"]
      # TypeScript 6+/7 breaks the react-scripts toolchain.
      - dependency-name: "typescript"
        versions: [">=6"]
      # Mantine 9: all @mantine packages move together with app code changes.
      - dependency-name: "@mantine/*"
        update-types: ["version-update:semver-major"]
      # Cypress 16 requires Node >=22; CI and the app image run Node 20.
      - dependency-name: "cypress"
        versions: [">=16"]
      # react-router 8 is a routing migration across ~40 files.
      - dependency-name: "react-router"
        update-types: ["version-update:semver-major"]
      # @testing-library/react 14+ async act semantics break menu/popover tests.
      - dependency-name: "@testing-library/react"
        update-types: ["version-update:semver-major"]
      # Cypress component testing resolves the top-level webpack-dev-server and only
      # accepts major 5; 6 crashes cypress.config.js ("Unexpected major version").
      - dependency-name: "webpack-dev-server"
        versions: [">=6"]
    groups:
      npm-dependencies:
        patterns:
          - "*"
        update-types:
          - "patch"
          - "minor"