version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    exclude-paths:
      - "packages/twenty-apps/**"
    schedule:
      interval: "weekly"
    # Version-update PRs disabled (limit 0). Security advisory updates are a
    # separate channel and still open automatically — only routine version
    # bumps are turned off to stop the constant PR churn.
    open-pull-requests-limit: 0
    versioning-strategy: "lockfile-only"
    assignees:
      - "mabdullahabaid"
    ignore:
      - dependency-name: "@graphql-yoga/nestjs"
      - dependency-name: "@nestjs/graphql"
      - dependency-name: "@ptc-org/nestjs-query-graphql"
      - dependency-name: "typeorm"
      # chokidar is pinned to v3 via a resolution: v4+ dropped native macOS
      # FSEvents and hits EMFILE on a repo this size (see #20316)
      - dependency-name: "chokidar"
  # Public Twenty apps are standalone packages (own lockfiles) excluded from the
  # root entry above. Each app folder is updated weekly, grouped into a single PR.
  - package-ecosystem: "npm"
    directories:
      - "/packages/twenty-apps/public/*"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 0
    versioning-strategy: "lockfile-only"
    groups:
      twenty-apps-public:
        patterns:
          - "*"
  # Internal Twenty apps, same treatment as the public apps above.
  - package-ecosystem: "npm"
    directories:
      - "/packages/twenty-apps/internal/*"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 0
    versioning-strategy: "lockfile-only"
    groups:
      twenty-apps-internal:
        patterns:
          - "*"