From 2c8012915d543f45ce7b0d292fea663feffc27e2 Mon Sep 17 00:00:00 2001
From: "Daniel Szoke (via Pi Coding Agent)"
 <daniel.szoke+pi_coding_agent@sentry.io>
Date: Thu, 6 Aug 2026 09:33:09 +0200
Subject: [PATCH] build(dependabot): Configure grouped Cargo dependency updates

Keep compatible dependency versions current in Cargo.lock so CI exercises recent releases without changing the versions resolved by library users. Group minor and patch updates into one pull request while leaving major updates as individual notices because they may require user-facing compatibility review.
---
 .github/dependabot.yml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..da8131e5
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,19 @@
+version: 2
+# Keep Cargo.lock current so CI runs against the latest compatible dependency
+# versions. This does not affect dependency resolution for library users and can
+# reduce stale-dependency RUSTSEC alerts. Major updates are separate PRs because
+# they may be breaking for users and are treated primarily as upgrade notices.
+updates:
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: weekly
+    # Avoid changing Cargo.toml when the existing requirement allows the update.
+    versioning-strategy: increase-if-necessary
+    groups:
+      non-major:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch