chore(deps): no automated dependency update tool (Dependabot/Renovate) configured

[jongio]

Summary

The repository has no automated dependency update tool configured (Dependabot or Renovate). With 12 direct dependencies and 30+ indirect dependencies in go.mod, stale dependencies accumulate silently — security patches, bug fixes, and compatibility updates go unnoticed until someone manually runs go get -u.

Impact

• Security: Vulnerable transitive dependencies may go unpatched for weeks or months.
• Maintenance burden: Manual dependency updates are easy to forget and tedious to batch.
• CI drift: Go toolchain and GitHub Actions versions can fall behind without automated PRs.

Recommended Fix

Add a .github/dependabot.yml with at minimum:

version: 2
updates:
  - package-ecosystem: gomod
    directory: /
    schedule:
      interval: weekly
    labels:
      - dependencies
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
    labels:
      - dependencies

Alternatively, configure Renovate if more granular control is desired (grouping, auto-merge for patches, etc.).

Current State

• go.mod lists 12 direct and 30+ indirect Go modules.
• .github/workflows/ has 3 workflow files referencing GitHub Actions by SHA — good practice, but no automation to bump those SHAs.
• The web/ directory uses npm but also lacks dependency automation.

[jongio]

Consolidated into a single tracking issue.