---
# yaml-language-server: $schema=https://json.schemastore.org/dependabot-2.0.json
#
# Dependabot only bumps yarn.lock here (`versioning-strategy: lockfile-only`).
# The lockfile does not change what consumers install — they resolve the
# dependency ranges in package.json themselves — so these updates must not cut
# a release. @ivuorinen/semantic-release-config has no rule for the `lockfile`
# scope, so like any chore it releases nothing; the default `chore(deps)` would
# publish a patch with no consumer-visible change.
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    versioning-strategy: lockfile-only
    schedule:
      interval: weekly
    cooldown:
      default-days: 7
    commit-message:
      prefix: 'chore(lockfile)'