Add a Dependabot config so version updates run, not just security updates

[a-akimov]

Motivation and Context

Dependabot already opens pull requests against this repo, so it looks covered, but those are security
updates: they run from repository settings and need no config file, and their branches carry Dependabot's
own ecosystem ids rather than configured group names (dependabot/uv/..., dependabot/npm_and_yarn/...,
dependabot/cargo/...). There has never been a .github/dependabot.yml in this repo, so scheduled
version updates have never run. Dependencies only get bumped here when something is vulnerable.

Routine drift therefore went unnoticed for a long time. When I audited every example on 2026-09-16, the gaps were:

Example	Dependency	Pinned	Latest
mcp-client-go	anthropic-sdk-go	v1.14.0	v1.74.0 (59 releases)
both Rust	rmcp	3.1.2	3.4.0
mcp-client-rust	jsonschema	0.35	0.56.0
both Go	go-sdk	v1.7.0	v1.8.0
mcp-client-python	anthropic	1.4.0	1.7.0
mcp-client-typescript	@anthropic-ai/sdk	0.124.0	0.127.0
both Ruby	mcp	floors only, no lockfile	1.6.0

These examples are the companion code for two official tutorials, so a reader copying from them should be
copying current SDK usage.

What changed

One .github/dependabot.yml with a weekly entry per ecosystem: uv, npm, gomod, cargo, bundler,
and github-actions. Each entry lists both example directories for its language, plus /tests/helpers for
npm, and groups all of that ecosystem's dependencies into a single pull request so the weekly volume is six
at worst rather than one per dependency.

Existing behaviour is untouched: groups defaults to applies-to: version-updates, so the automatic
security-update grouping keeps working as it does today.

How Has This Been Tested?

Config only, so there is nothing for CI to exercise. I validated that the file parses as YAML and that each
block resolves to the ecosystem and directories intended, and checked the keys against the Dependabot
options reference: directories (plural) is valid and takes paths relative to the repository root,
bundler is the correct ecosystem value for Ruby, and directory: / is what GitHub Actions expects.
GitHub will report any remaining schema problem on the repo's Dependabot page once this merges.

Breaking Changes

None.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Additional context

AI assistance: this config and description were prepared with Claude Code and reviewed by me.

[Copilot]

Copilot review overview

🟢 Approval recommended

The configuration matches the repository’s dependency manifests and workflow structure.

Review effort: Lite
Findings: None

What changed in this PR

Adds scheduled Dependabot version updates for all repository ecosystems.

Changes:

• Configures weekly updates for Python, Node, Go, Rust, Ruby, and GitHub Actions.
• Groups dependencies by ecosystem to limit pull-request volume.
• Covers all discovered example and test-helper directories.

File	Description
.github/​dependabot.yml	Adds valid multi-directory Dependabot configurations.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.