From 4d3324b8a29fd0be2683ffe45cd1990ea84c6f4e Mon Sep 17 00:00:00 2001
From: gabriel <admin@g4bri3l.de>
Date: Wed, 7 Oct 2026 13:54:00 +0200
Subject: [PATCH] chore: add Dependabot version updates

The repo had Dependabot alerts but no dependabot.yml, so outdated
dependencies were reported but never proposed as PRs. Add weekly updates
for cargo (all four manifests), npm, pip and GitHub Actions. Minor/patch
updates are grouped per ecosystem; majors get individual PRs. Commit
messages use chore(deps) so they don't trigger releases on their own.
---
 .github/dependabot.yml | 59 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..7a1579a
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,59 @@
+# Weekly dependency updates. Minor/patch updates are grouped into one PR per
+# ecosystem; major updates get individual PRs so breaking changes are
+# reviewed on their own. Security updates are opened regardless of schedule.
+#
+# Commit messages use `chore(deps)` so release-please does not cut a release
+# for them; retitle to `fix(deps)` when an update must ship to users (e.g. a
+# security fix in a crate compiled into the wheels).
+version: 2
+
+updates:
+  - package-ecosystem: cargo
+    directories:
+      - /packages/rust          # core workspace (published to crates.io)
+      - /packages/python        # PyO3 extension (compiled into the wheels)
+      - /packages/rust/wasm     # wasm-bindgen bindings (compiled into the npm package)
+      - /packages/rust/ios      # iOS XCFramework wrapper
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      cargo-minor-patch:
+        update-types: [minor, patch]
+
+  - package-ecosystem: npm
+    directory: /packages/javascript
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      npm-minor-patch:
+        update-types: [minor, patch]
+
+  # pip rather than uv: packages/python/uv.lock is git-ignored, and
+  # Dependabot's uv support requires a committed lockfile.
+  - package-ecosystem: pip
+    directory: /packages/python
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      pip-minor-patch:
+        update-types: [minor, patch]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      actions:
+        patterns: ["*"]