chore: Add Dependabot version-update cooldown

[ld-repository-standards]

This pull request was auto generated by the LaunchDarkly Github Standards automation platform.

• Ensure every entry under updates in .github/dependabot.yml declares a cooldown of at least 7 days (default-days).
• Add entries for detected package ecosystems that were not yet tracked by Dependabot.

Cooldown applies only to version updates; security updates bypass it, so critical CVE fixes are never delayed.

Ref: SEC-8058.

---

Note

Low Risk
CI-only Dependabot configuration; no application runtime or security logic changes, and security updates still bypass the cooldown.

Overview
Introduces a new .github/dependabot.yml that configures automated dependency updates across the monorepo.

Every updates entry uses a weekly schedule and a cooldown.default-days: 7 so routine version bumps are spaced out; security updates are unaffected by this cooldown per Dependabot behavior.

Coverage includes github-actions at the repo root, gradle for the Flutter example Android projects, and pub for the root plus apps (flutter_client_contract_test_service, sse_contract_test_service) and packages (common, common_client, event_source_client, flutter_client_sdk and its examples).

^{Reviewed by Cursor Bugbot for commit 6c2ff6a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c1885bb. Configure here.}

[cursor]

Dependabot targets missing example_fdv2

Medium Severity

Three new Dependabot updates entries point at packages/flutter_client_sdk/example_fdv2 (pub plus two Gradle paths), but that directory is not in the repository—only example/ exists under flutter_client_sdk. Dependabot will fail those jobs with missing manifest errors instead of scheduling updates.

Additional Locations (1)

• .github/dependabot.yml#L20-L32

 

^{Reviewed by Cursor Bugbot for commit c1885bb. Configure here.}

[pkaeding]

Closing -- The automation has been updated to not enable version-updates if it isn't already enabled.

via LD Research 🤖