[IzaakGough]

The repo has no Dependabot config, so dependency updates are not raised automatically.

This adds one for the uv lockfile, matching the config used in firebase-functions-test.

• Minor and patch updates are grouped into one PR to cut down on Dependabot noise.
• A 7-day cooldown delays new releases, reducing the chance of pulling a freshly compromised package.
• Major updates are ignored and stay a manual decision.

Checked the YAML parses. Not yet tested by a Dependabot run.

[gemini-code-assist]

Code Review

This pull request adds a .github/dependabot.yml file to automate dependency updates. However, two configuration issues were identified: Dependabot does not support uv as a standalone package ecosystem (it should be changed to pip), and the cooldown option is unsupported and will cause schema validation errors.