# Dependency update PRs wait out the same 7-day cooldown that .npmrc's
# min-release-age enforces locally. Security-advisory PRs are exempt
# from cooldown by design, so CVE fixes still arrive promptly.
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
    cooldown:
      default-days: 7
    open-pull-requests-limit: 5

  - package-ecosystem: uv
    directory: /prime-agent-runtime
    schedule:
      interval: weekly
    cooldown:
      default-days: 7

  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
    cooldown:
      default-days: 7