# Dependabot configuration for the dotnet/iot repository.
#
# All NuGet projects across the repo (except /eng/common, which is
# Arcade-maintained) are scanned by a single update block. PRs are bundled
# into these groups:
#
#   - dotnet-runtime  -> System.* and Microsoft.Extensions.*
#                        (any version bump, including majors — these all ship
#                        together on the .NET release train, so a major like
#                        9.x -> 10.x lands across them simultaneously and is
#                        best reviewed as one PR).
#   - skiasharp       -> SkiaSharp and SkiaSharp.NativeAssets.*
#                        (any version bump — the managed package and its
#                        native asset packages must be kept at matching
#                        versions, so they always land in one PR).
#   - all-dependencies -> everything else, minor/patch only. Majors of these
#                         packages fall out as individual PRs so breaking-
#                         change risk gets dedicated review.
#
# Arcade packages (Microsoft.DotNet.*) are ignored entirely — those SDKs
# are updated outside of Dependabot via the standard Arcade flow.
version: 2
updates:
  - package-ecosystem: "nuget"
    directories:
      - "/**"
      - "!/eng/common/**"
    schedule:
      interval: "weekly"
      day: "wednesday"
    open-pull-requests-limit: 5
    ignore:
      - dependency-name: "Microsoft.DotNet.*"
    groups:
      dotnet-runtime:
        patterns:
          - "System.*"
          - "Microsoft.Extensions.*"
      skiasharp:
        patterns:
          - "SkiaSharp"
          - "SkiaSharp.NativeAssets.*"
      all-dependencies:
        patterns:
          - "*"
        exclude-patterns:
          - "System.*"
          - "Microsoft.Extensions.*"
          - "SkiaSharp"
          - "SkiaSharp.NativeAssets.*"
        update-types:
          - "minor"
          - "patch"