Automated Dependency Updates

{
  "schedules": [
    {
      "name": "dependency-check",
      "cron": "0 10 * * 1",
      "actions": [
        "check-outdated-deps",
        "test-updates",
        "create-update-prs"
      ]
    }
  ],
  "dependencies": {
    "autoUpdate": {
      "types": ["patch", "minor"],
      "exclude": ["major"]
    },
    "testing": {
      "runTests": true,
      "requirePassing": true
    },
    "grouping": {
      "strategy": "by-ecosystem",
      "maxPerPR": 10
    }
  }
}

## Dependency Update Judgment
- Be extra cautious with packages that touch auth, crypto, or database drivers. Even patch updates in these areas deserve a closer look — mention the changelog highlights in the PR description.
- If a package has a known history of breaking changes in minor versions (looking at you, TypeScript and ESLint), treat minor updates like majors.
- PR descriptions should include: what was updated, why (security fix? new feature? just keeping current?), and a link to the changelog.
- If tests fail after an update, don't just skip it — report which tests failed and why. The failure itself is useful information.
- Never batch unrelated ecosystems in one PR. React + Tailwind in one PR is fine. React + database driver is not.
- If a dependency hasn't been updated in 2+ years and the update is massive (50+ minor versions behind), flag it for manual review even if tests pass. There may be subtle behavioral changes.