Add a Dependabot configuration (#29)

Weekly updates for docker, github-actions, maven. Minor and patch updates are grouped
per ecosystem and new releases wait 7 days before Dependabot proposes
them.

Author: BiosSystem

.github/dependabot.yml

@@ -0,0 +1,45 @@
+# Dependabot: weekly version updates, minor and patch grouped into one pull
+# request per ecosystem, majors on their own. Every update is a pull request
+# that runs CI and gets a review before it is merged. The cooldown holds a new
+# release back for 7 days so a bad or compromised publish can be pulled first;
+# security updates are not delayed by it.
+version: 2
+updates:
+  - package-ecosystem: maven
+    directory: /
+    schedule:
+      interval: weekly
+      day: sunday
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    groups:
+      maven:
+        patterns: ["*"]
+        update-types: [minor, patch]
+
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+      day: sunday
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    groups:
+      docker:
+        patterns: ["*"]
+        update-types: [minor, patch]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: sunday
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    groups:
+      actions:
+        patterns: ["*"]
+        update-types: [minor, patch]

CHANGELOG.md

@@ -1,3 +1,7 @@
+## [Unreleased] - 2026-11-04
+
+- Dependabot: weekly version updates (docker, github-actions, maven); minor and patch grouped, new releases held 7 days. (#28)
+
 ## [2026-11-03] - OdinMS link
 
 - CONTRIBUTING.md and CREDITS.md linked OdinMS to a GitHub repository that returns 404. They now link the archived odinms.de page. (#26)