From 705fe2d78c8814dffac9467fe06d1da0f0a57b77 Mon Sep 17 00:00:00 2001
From: Andreas Albert <andreas.albert@quantco.com>
Date: Fri, 24 Jul 2026 15:06:42 +0200
Subject: [PATCH] ci: Have dependabot keep `Cargo.lock` up to date

Add a cargo ecosystem entry to dependabot using the lockfile-only
versioning strategy, so transitive Rust dependencies are refreshed
monthly without touching `Cargo.toml` constraints.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/dependabot.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 32553f89..9a45aa91 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -12,3 +12,16 @@ updates:
       prefix: ci
     cooldown:
       default-days: 7
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: monthly
+    versioning-strategy: lockfile-only
+    groups:
+      cargo:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: build
+    cooldown:
+      default-days: 7