PaperClipAI/.github/dependabot.yml

version: 2
updates:
  - package-ecosystem: npm
    directory: "/"
    schedule:
      interval: weekly
      day: monday
      time: "06:00"
    # Each dependency update gets its own pull request, including major
    # version bumps. A grouped major PR cannot merge when one member has
    # a blocked upgrade, so it hides the other ready majors. Separate PRs
    # let each major land on its own. The limit holds the initial burst
    # of pending majors plus the regular minor and patch updates.
    open-pull-requests-limit: 20
    labels:
      - "dependencies"
    # Dependabot's npm parser reads only dependencies, devDependencies, and
    # optionalDependencies — never peerDependencies. It cannot see the
    # optional OpenTelemetry peer dependencies in server/package.json, so it
    # never bumps their declared versions. The same limit applies to the
    # optional @sentry/node peer dependency in server/package.json: Dependabot
    # cannot bump it either, for the same reason. @sentry/browser stays a
    # normal devDependency of ui/package.json, so Dependabot does track that
    # one.
    ignore:
      # @types/node describes the APIs available in the supported Node runtime.
      # Runtime major upgrades are deliberate compatibility changes, so keep
      # Dependabot on the current major until the runtime baseline moves too.
      - dependency-name: "@types/node"
        update-types:
          - "version-update:semver-major"

  # Sandbox providers (packages/plugins/sandbox-providers/*). pnpm-workspace.yaml
  # keeps them out of the root workspace on purpose, so the "/" entry above never
  # sees them. Each provider is a standalone published package with its own
  # version ranges.
  #
  # Each lockfile has exactly one entry, so every pull request changes a
  # manifest and the lockfile that installs it together, and CI can pass.
  #
  # scripts/typecheck-sandbox-providers is a small pnpm workspace that lists every
  # provider without its own lockfile, and holds one lockfile for them. CI
  # installs that lockfile frozen. Dependabot updates this workspace as one unit:
  # one pull request per dependency changes every provider that uses the
  # dependency, and the shared lockfile, together. So this entry needs no
  # `groups`. One entry per provider would open a separate pull request for each
  # provider for the same package, and each one would fail CI because the shared
  # lockfile would stay old.
  #
  # Dependabot does not expand a workspace glob that starts with ../, so that
  # workspace lists each provider by its full path. A test checks the list.
  #
  # Providers are published libraries, so Dependabot's default versioning
  # strategy keeps a range when a new version fits it. It widens the range when a
  # release falls outside it, for example zod 3 to zod 4.
  - package-ecosystem: npm
    directory: "/scripts/typecheck-sandbox-providers"
    schedule:
      interval: weekly
      day: monday
      time: "06:00"
    open-pull-requests-limit: 10
    labels:
      - "dependencies"
    ignore:
      # Same reason as the "/" entry.
      - dependency-name: "@types/node"
        update-types:
          - "version-update:semver-major"

  # Daytona is the only provider with its own lockfile. The release build and the
  # Daytona end-to-end job install it frozen, so the shared workspace above leaves
  # Daytona out, and scripts/typecheck-test-programs.mjs installs Daytona from
  # this lockfile (LOCKED_PROVIDERS). This entry is the only one that changes
  # Daytona's package.json, and it changes this lockfile in the same pull request.
  - package-ecosystem: npm
    directory: "/packages/plugins/sandbox-providers/daytona"
    schedule:
      interval: weekly
      day: monday
      time: "06:00"
    open-pull-requests-limit: 5
    labels:
      - "dependencies"
    ignore:
      # Same reason as the "/" entry.
      - dependency-name: "@types/node"
        update-types:
          - "version-update:semver-major"

  # No entry for packages/paperclip-runner/scripts/pi-distribution or
  # kimi-distribution. Every direct dependency there is a pinned provider
  # release, and the pins feed each provider's ACPX commandDigest. The Runner
  # checks compare the Pi lockfile with PI_DISTRIBUTION_PINS, and the Kimi build
  # compares the SHA-256 of its package-lock.json with a pin. So a Dependabot
  # change to either lockfile fails CI (for example #18998), and a real upgrade
  # also starts saved sessions fresh. Change these by hand (see
  # rules/acpx-profile-identity.mdc). pi-acp@0.0.33 needs zod ^3.25.0 as a
  # direct dependency, so the Pi zod pin (3.25.76) cannot move to zod 4 until
  # pi-acp allows it. GitHub security alerts still cover both lockfiles.

  - package-ecosystem: github-actions
    directory: "/"
    schedule:
      interval: weekly
      day: monday
      time: "06:00"
    open-pull-requests-limit: 5
    ignore:
      # This first-party workflow follows CODEOWNERS-protected master.
      - dependency-name: "paperclipai/paperclip/.github/workflows/pr-trusted.yml"