# Dependency updates.
#
# ── Read this before turning it on ───────────────────────────────────────────
# Four packages in this kit are pinned to an exact version in `.ncurc.json`, and
# they are pinned for reasons Dependabot cannot know:
#
#   radix-ui, tailwind-merge   compiled into `dist` / vendored into `src`. A bump
#                              changes what consumers run without appearing in
#                              any lock file, and `src/lib/tw-merge.test.ts`
#                              fails until the vendored copy is re-copied by hand.
#   lucide-react               the icon suite compares this kit's own drawings
#                              against it; a bump fails that test on geometry
#                              nobody here touched.
#   typescript                 held at 6 — 7 breaks the dts build.
#
# They are listed under `ignore` below so Dependabot leaves them alone. Keep that
# list and `.ncurc.json` in step; if you unpin one, unpin it in both places.
#
# For everything else, `/update-deps` (the Claude Code skill) classifies updates
# by what a consumer can observe and is the better path when you have it. This
# file is the unattended fallback.

version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: monthly
    open-pull-requests-limit: 5
    # One PR for all the dev tooling rather than fifteen. The kit ships no
    # runtime dependencies, so almost everything here is dev-only anyway.
    groups:
      dev-dependencies:
        dependency-type: development
        update-types: [minor, patch]
    ignore:
      - dependency-name: radix-ui
      - dependency-name: tailwind-merge
      - dependency-name: lucide-react
      - dependency-name: typescript

  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: monthly