# To get started with Dependabot version updates, you'll need to specify which

# package ecosystems to update and where the package manifests are located.

# Please see the documentation for all configuration options:

# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file

version: 2

updates:

- package-ecosystem: 'npm' # See documentation for possible values

directory: '/' # Location of package manifests

schedule:

interval: 'weekly'

open-pull-requests-limit: 10

ignore:

- dependency-name: '@playwright/test'

- dependency-name: '@mediapipe/tasks-vision'

# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#groups

groups:

# Always update react and react-dom together

react-packages:

patterns:

- 'react'

- 'react-dom'

rollup-packages:

patterns:

- 'rollup'

- '@rollup/*'

- 'rollup-plugin-*'

#

# pkg.json "dependencies"

#

prod-deps:

dependency-type: 'production'

update-types:

- 'minor'

- 'patch'

exclude-patterns:

# Excluding all 0.x leading-zero package (since dependabot consider eg: 0.7.3 -> 0.8.0 minor bump / as opposed to semver)

- '@mediapipe/tasks-vision'

- 'glsl-noise'

- 'maath'

- 'stats.js'

- 'suspend-react'

- 'three-mesh-bvh'

- 'troika-three-text'

- 'tunnel-rat'

#

# pkg.json "devDependencies"

#

dev-deps:

dependency-type: 'development'

update-types:

- 'minor'

- 'patch'

exclude-patterns:

# Excluding all 0.x leading-zero package (since dependabot consider eg: 0.7.3 -> 0.8.0 minor bump / as opposed to semver)

- '@types/three'

- 'eslint-plugin-storybook'

- 'three'

# Sensitive ones (we prefer handling those separately)

- 'react'

- 'react-dom'

- '@react-three/fiber'