This repo has no .github/dependabot.yml, so nothing here is ever updated automatically. It is the only Rust repo in the family without one — xled, xray, and ved all have it.
There is real surface to cover. Cargo.toml declares three dependencies (csv, clap, and encsniff), and there are three workflows (deb.yml, publish-crate.yml, release.yml) whose action versions drift the same way. The security-tooling matrix in ~/notes/security_tooling.md puts this repo in the "public tool with low taint-flow surface" tier: SECURITY.md yes, Dependabot yes, CodeQL skip. SECURITY.md is present and CodeQL is correctly absent, so Dependabot is the one cell that was missed.
Copy .github/dependabot.yml from excelano/xled and change the ecosystem to cargo. Pull the template's current state rather than its initial commit (git show origin/main:.github/dependabot.yml) so this repo starts at the already-bumped versions instead of regenerating a burst of PRs that the sibling has already absorbed.
Expect a one-time burst on first activation — Dependabot proposes major bumps when no update-types filter is set. Steady state after that is near zero.
Related: #2 (no CI to verify those bumps once they arrive — worth landing that first, since merging dependency PRs with no test job is what prompted this sweep).
This repo has no
.github/dependabot.yml, so nothing here is ever updated automatically. It is the only Rust repo in the family without one —xled,xray, andvedall have it.There is real surface to cover.
Cargo.tomldeclares three dependencies (csv,clap, andencsniff), and there are three workflows (deb.yml,publish-crate.yml,release.yml) whose action versions drift the same way. The security-tooling matrix in~/notes/security_tooling.mdputs this repo in the "public tool with low taint-flow surface" tier: SECURITY.md yes, Dependabot yes, CodeQL skip. SECURITY.md is present and CodeQL is correctly absent, so Dependabot is the one cell that was missed.Copy
.github/dependabot.ymlfromexcelano/xledand change the ecosystem tocargo. Pull the template's current state rather than its initial commit (git show origin/main:.github/dependabot.yml) so this repo starts at the already-bumped versions instead of regenerating a burst of PRs that the sibling has already absorbed.Expect a one-time burst on first activation — Dependabot proposes major bumps when no
update-typesfilter is set. Steady state after that is near zero.Related: #2 (no CI to verify those bumps once they arrive — worth landing that first, since merging dependency PRs with no test job is what prompted this sweep).