From 2f89832c1df019295ff0ece6e022474789efc802 Mon Sep 17 00:00:00 2001
From: alextomas955 <295956354+alextomas955@users.noreply.github.com>
Date: Mon, 20 Jul 2026 12:20:31 -0400
Subject: [PATCH 1/2] ci: add Dependabot configuration

---
 .github/dependabot.yml | 111 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 111 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..08ab0877
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,111 @@
+version: 2
+
+updates:
+  # NuGet — every project sits one level down under src/Cove.<Name>/ (each folder holds one
+  # .csproj). Targeting the project directories directly means discovery never depends on the
+  # solution file being parsed, and new projects added under src/ are covered automatically.
+  - package-ecosystem: "nuget"
+    directories:
+      - "/src/*"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 5
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 7
+    groups:
+      entity-framework:
+        patterns:
+          - "Microsoft.EntityFrameworkCore*"
+          - "Npgsql*"
+          - "Pgvector*"
+      test:
+        patterns:
+          - "xunit*"
+          - "Xunit.*"
+          - "Microsoft.NET.Test.Sdk"
+          - "coverlet.*"
+          - "Microsoft.AspNetCore.Mvc.Testing"
+      serilog:
+        patterns:
+          - "Serilog*"
+      nuget-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # npm — two standalone packages, each with its own lockfile: the SPA (ui/) and the published
+  # extension frontend SDK (sdk/frontend/). They are not npm workspaces, so each directory is
+  # listed explicitly.
+  - package-ecosystem: "npm"
+    directories:
+      - "/ui"
+      - "/sdk/frontend"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 5
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 7
+    groups:
+      react:
+        patterns:
+          - "react"
+          - "react-dom"
+          - "@types/react"
+          - "@types/react-dom"
+      tanstack:
+        patterns:
+          - "@tanstack/*"
+      npm-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # GitHub Actions — all workflow action versions under .github/workflows.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 5
+    groups:
+      actions-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Docker — both base images live under docker/ (Dockerfile and Dockerfile.app); the docker
+  # updater matches any file whose name contains "dockerfile", so one directory entry covers both.
+  - package-ecosystem: "docker"
+    directory: "/docker"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 5
+    groups:
+      docker-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Docker Compose — the deployment stacks under docker/ pin external images (e.g. the
+  # pgvector database); Compose is a separate ecosystem from the Dockerfile updater above.
+  - package-ecosystem: "docker-compose"
+    directory: "/docker"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 5
+    groups:
+      docker-compose-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"

From 80c0f081ea3b947b787ca7bdcd6d0aa41a35bdb8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 28 Jul 2026 06:42:00 +0000
Subject: [PATCH 2/2] Bump seroval from 1.5.2 to 1.5.6 in /ui

Bumps [seroval](https://github.com/lxsmnsyc/seroval) from 1.5.2 to 1.5.6.
- [Release notes](https://github.com/lxsmnsyc/seroval/releases)
- [Commits](https://github.com/lxsmnsyc/seroval/commits)

---
updated-dependencies:
- dependency-name: seroval
  dependency-version: 1.5.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 ui/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ui/package-lock.json b/ui/package-lock.json
index 16e236f2..4037af7e 100644
--- a/ui/package-lock.json
+++ b/ui/package-lock.json
@@ -4610,9 +4610,9 @@
       }
     },
     "node_modules/seroval": {
-      "version": "1.5.2",
-      "resolved": "https://registry.npmjs.org/seroval/-/seroval-1.5.2.tgz",
-      "integrity": "sha512-xcRN39BdsnO9Tf+VzsE7b3JyTJASItIV1FVFewJKCFcW4s4haIKS3e6vj8PGB9qBwC7tnuOywQMdv5N4qkzi7Q==",
+      "version": "1.5.6",
+      "resolved": "https://registry.npmjs.org/seroval/-/seroval-1.5.6.tgz",
+      "integrity": "sha512-rVQVWjjSvlINzaQPZH5JFqsqEsIWdTxY3iJZCnTL/5gQbXIRooVZKI60tVCkOVfzcRPejboxO2t0P89dg5mQaA==",
       "license": "MIT",
       "engines": {
         "node": ">=10"