From 54fe1b56f837c92b530ad9e69dd1b54ca697c662 Mon Sep 17 00:00:00 2001
From: devdudeio <strebe_monatlich_0r@icloud.com>
Date: Fri, 18 Sep 2026 04:01:42 +0200
Subject: [PATCH] chore(dependabot): weekly npm, docker and actions updates

Detected ecosystems:
- npm at "/" - pnpm workspace (pnpm-workspace.yaml covers packages/* and
  apps/*) with a single pnpm-lock.yaml, so one root entry updates every
  workspace package. Per-package entries would fight over that one lockfile.
- docker at "/docker" - demo-server, facilitator and proxy Dockerfiles, all on
  a node:26-slim tag.
- github-actions at "/" - ci.yml and release.yml, SHA-pinned.

Prefixes follow the repo's semantic-release setup, as in chainvue/verus-rpc.

Groups follow the peer edges, because a split bump is what actually breaks the
build: in peculium-wallet Dependabot bumped vitest and left
@vitest/coverage-v8 on the old major, and the peer mismatch took CI down. This
repo has both that pair and three more of the same shape:
- vitest: vitest, @vitest/*, vite
- eslint: eslint, @eslint/*, typescript-eslint, @typescript-eslint/*, globals,
  typescript
- nestjs: @nestjs/* plus reflect-metadata and rxjs, which they peer-depend on -
  one package moving alone puts the DI container out of step across several
  workspace packages at once
- drizzle-sqlite: drizzle-orm, drizzle-kit, better-sqlite3 and its @types
- semantic-release: core, @semantic-release/* and multi-semantic-release

typescript majors are ignored for the same reason as in verus-rpc:
typescript-eslint's peer range does not admit TS 7, so the PR could not pass
lint.

Claude-Session: https://claude.ai/code/session_01AxFbkWrzkhDieg5RGm8YdK
---
 .github/dependabot.yml | 93 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 93 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..cf35007
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,93 @@
+# Dependabot for the v402 monorepo.
+#
+# Ecosystems found in the repo:
+# - npm at "/" — pnpm workspace (pnpm-workspace.yaml covers packages/* and
+#   apps/*), so one entry at the root updates every workspace package through
+#   the single pnpm-lock.yaml. No per-package entries: they would fight over
+#   the same lockfile.
+# - docker at "/docker" — demo-server, facilitator and proxy Dockerfiles, all
+#   on a node base image tag.
+# - github-actions at "/" — ci.yml and release.yml, SHA-pinned.
+#
+# Commit-message prefixes follow the repo's semantic-release setup (angular
+# preset), as in chainvue/verus-rpc: runtime -> fix(deps), dev ->
+# chore(deps-dev), actions -> ci(deps).
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: ci
+      include: scope
+
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: fix
+      prefix-development: chore
+      include: scope
+    groups:
+      # Peer-coupled families, grouped so a bump cannot land half-applied.
+      # The concrete incident: in peculium-wallet Dependabot bumped `vitest`
+      # and left `@vitest/coverage-v8` on the old major; the peer mismatch
+      # broke CI. Same shape of breakage applies to every group below.
+      vitest:
+        patterns:
+          - vitest
+          - "@vitest/*"
+          - vite
+      eslint:
+        patterns:
+          - eslint
+          - "@eslint/*"
+          - typescript-eslint
+          - "@typescript-eslint/*"
+          - globals
+          - typescript
+      # NestJS: @nestjs/* packages peer-depend on each other and on
+      # reflect-metadata and rxjs. A single package moving to a new major puts
+      # the whole DI container out of step, across several workspace packages
+      # at once.
+      nestjs:
+        patterns:
+          - "@nestjs/*"
+          - reflect-metadata
+          - rxjs
+      # drizzle-kit generates against drizzle-orm's schema API, and
+      # better-sqlite3 has to match its own @types package.
+      drizzle-sqlite:
+        patterns:
+          - drizzle-orm
+          - drizzle-kit
+          - better-sqlite3
+          - "@types/better-sqlite3"
+      # semantic-release plugins are pinned to the core's plugin API, and
+      # multi-semantic-release wraps that same core.
+      semantic-release:
+        patterns:
+          - semantic-release
+          - "@semantic-release/*"
+          - multi-semantic-release
+      dev-dependencies:
+        dependency-type: development
+        update-types: ["minor", "patch"]
+    ignore:
+      # Same gate as chainvue/verus-rpc: TypeScript majors are held back by
+      # typescript-eslint's peer range (`>=4.8.4 <6.1.0` as of 8.6x), so a TS 7
+      # bump would fail lint and the PR could never go green.
+      - dependency-name: typescript
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: docker
+    directory: "/docker"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: fix
+      include: scope