version: 2
updates:
  # Base images in the root Dockerfile (node:22-alpine).
  - package-ecosystem: docker
    directory: /
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 5
    labels:
      - dependencies
      - docker

  # Base image in the cron sidecar (alpine).
  - package-ecosystem: docker
    directory: /docker
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 5
    labels:
      - dependencies
      - docker

  # GitHub Actions in workflow files.
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 5
    labels:
      - dependencies
      - ci

  # npm runtime + dev dependencies.
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 10
    labels:
      - dependencies
      - npm
    groups:
      # Batch low-risk minor/patch bumps so the reviewer queue stays small.
      minor-and-patch:
        update-types:
          - minor
          - patch
    ignore:
      # @anthropic-ai/bedrock-sdk is PINNED to an exact version in package.json.
      # 0.32.0 arrived inside a grouped minor-and-patch bump (#884) and broke
      # Bedrock streaming in prod: the SDK returned an empty stream ("request
      # ended without sending any chunks"), taking down the in-app AI assistant
      # and invoice OCR. Do NOT let dependabot bump it until 0.32.x streaming is
      # verified against Bedrock. Enforced by scripts/checks/no-new-antipatterns.mjs
      # (pinned-dep). See DECISIONS.md (2026-07-08).
      - dependency-name: "@anthropic-ai/bedrock-sdk"