# Dependabot configuration.
# Docs: https://docs.github.com/code-security/dependabot
#
# Cooldown delays non-security PRs so very fresh releases have time to be
# flagged by the ecosystem before we pull them in. Security advisories
# bypass cooldown automatically.
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/mcp/ponymail-mcp"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5
    cooldown:
      default-days: 7
      semver-major-days: 21
      semver-minor-days: 7
      semver-patch-days: 3
    groups:
      npm-minor-patch:
        update-types:
          - "minor"
          - "patch"
    labels:
      - "dependencies"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5
    cooldown:
      default-days: 7
      semver-major-days: 21
      semver-minor-days: 7
      semver-patch-days: 3
    groups:
      actions-minor-patch:
        update-types:
          - "minor"
          - "patch"
    labels:
      - "dependencies"
      - "github-actions"