chore(ci): enable Dependabot security updates

[LukasWodka]

Rolls the Dependabot pilot out to this repo. Part of standardising every repo on the same pipeline.

Why now. The pilot landed on backend (backend#577) on 2026-07-23 with an explicit condition: roll out to the rest if the noise is acceptable after a week. Measured 2026-07-31 — backend opened 1 Dependabot PR in that window (merged), cli opened 1. That is not a noise problem.

Meanwhile only 2 of 10 repos had any Dependabot config at all, so security advisories on the other eight went unattended. design-system currently carries 4 open alerts (1 critical, 3 high) that nothing was going to surface.

What this is. Security updates only, identical in shape to the backend pilot:

• open-pull-requests-limit: 0 disables version updates; security updates have their own built-in limit and still fire when an advisory drops.
• Grouped per ecosystem, and every group splits by update-type so a grouped PR never mixes patch with minor/major.
• Labelled work-type:tech-debt + dependencies.

Ecosystems come from a scan of this repo's tree, not from assumption — see the comments in the file for what was found and where.

Deliberately not included: the auto-merge workflow. allow_auto_merge is false on this repo (it is true only on backend), so shipping dependabot-auto-merge.yml here would be inert. Auto-merge needs two repo settings flipped first — Allow auto-merge and Allow GitHub Actions to create and approve pull requests — which is Lukas's call, per repo. Until then Dependabot PRs simply queue for a human, which is the safe default.

Context: backend#1371 §5.

---

Note

Low Risk
CI-only Dependabot configuration with no application runtime or auth changes.

Overview
Introduces .github/dependabot.yml so security advisories on workflow dependencies can open PRs here, aligned with the backend pilot.

Security updates only: open-pull-requests-limit: 0 turns off routine version bumps; Dependabot still opens security-update PRs (separate built-in cap). Weekly schedule on github-actions at repo root.

PRs get labels work-type:tech-debt and dependencies. Security updates are grouped by patch vs minor so a single PR does not mix update types (intended to pair with patch-only auto-merge elsewhere).

No auto-merge workflow is added in this PR; that depends on repo settings not enabled here.

^{Reviewed by Cursor Bugbot for commit 4036415. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 36 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• .github#112 — promote: cross-repo change guidance (develop -> main) · author: @LukasWodka · no reviewer assigned
• backend#1146 — docs(rfc): platform cost & autoscaling architecture · author: @saadqbal · reviewer: @LukasWodka, @saqlainsyed007, @aptracebloc
• backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1261 — RFC-BACKEND-0008: board & process reset (decision RFC — for markup) · author: @LukasWodka · reviewer: @saadqbal
• backend#1284 — docs(deploy): backend deploy runbook skeleton (#1263) · author: @LukasWodka · no reviewer assigned
• backend#1332 — feat(check-model): allow KNN/GaussianProcess on a single-edge owned dataset (#923 follow-up) · author: @divyasinghds · no reviewer assigned
• backend#1353 — chore(ci): baseline historical gitleaks findings + wire caller · author: @LukasWodka · no reviewer assigned
• backend#1361 — feat(tasks): bound ExperimentQueue growth for PAUSED experiments (backend#1351) · author: @saqlainsyed007 · no reviewer assigned
• claude-skills#14 — feat(skill): add tracebloc-frontend-app skill · author: @waqaskhanroghani · reviewer: @saadqbal

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 4036415. Configure here.}

[shujaatTracebloc]

Reviewed against the pilot (backend#577):

• Single file .github/dependabot.yml, no code/runtime changes.
• Security-updates-only shape holds: every update block sets open-pull-requests-limit: 0 (version updates off), weekly schedule, labels work-type:tech-debt + dependencies, and groups scoped applies-to: security-updates with patch/minor split.
• Configured ecosystems/directories match this repo's actual manifests in the tree.
• GitHub's native .github/dependabot.yml validation passes; CI + Bugbot green; no unresolved threads.

LGTM 👍

[LukasWodka]

/fr-pass