Add dependabot.yml.

[reitermarkus]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew style with your changes locally?
• Have you successfully run brew tests with your changes locally?
• Have you successfully run brew man locally and committed any changes?

---

Move to the GitHub-native version of @dependabot.

[MikeMcQuaid]

@reitermarkus Can we move these back to being immediate updates? Weekly is a long time to wait for security updates.

Also: does this support more than security updates e.g. patch versions etc.?

[reitermarkus]

Can we move these back to being immediate updates?

The immediate/daily updates are way too noisy if you ask me.

Also: does this support more than security updates e.g. patch versions etc.?

What do you mean exactly?

[MikeMcQuaid]

The immediate/daily updates are way too noisy if you ask me.

If we can selectively make some (noisy) gems not be immediate: that'd be fine. We want to have immediate security updates.

What do you mean exactly?

Prevoiously we had stuck with the "old" dependabot because the new one didn't support non-security bumps, initially at least. Has this changed?

[reitermarkus]

If we can selectively make some (noisy) gems not be immediate: that'd be fine. We want to have immediate security updates.

Which of our dependencies actually pose a security threat that requires immediate action?

Has this changed?

It just bumped the sorbet Gems and it's always bumping the GitHub actions in cask repos, so I think so.

[MikeMcQuaid]

Which of our dependencies actually pose a security threat that requires immediate action?

Potentially: any of those that are vendored.