Update dependencies and add Dependabot

.github/dependabot.yml

@@ -0,0 +1,27 @@
+# Weekly version updates, grouped into one PR per ecosystem. Security
+# updates come separately and right away (Settings → Advanced Security →
+# Dependabot security updates). CI runs on every PR, including the MSRV
+# build, which catches an update that needs a newer Rust than rust-version.
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: chore
+    groups:
+      cargo-minor:
+        update-types: [minor, patch]
+
+  # Actions stay pinned to a commit SHA; Dependabot bumps the SHA and the
+  # version comment together.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: chore
+    groups:
+      actions:
+        patterns: ['*']

CHANGELOG.md

@@ -6,6 +6,10 @@ All notable changes to plugii are documented here. The format is based on
 
 ## [Unreleased]
 
+### Changed
+
+- Updated dependencies, among them ureq 3.5 and rustls-webpki 0.103.16.
+
 ## [0.1.0] - 2026-10-17
 
 The first release: a rewrite of the `usb-ports` shell script as a Rust CLI

docs/RELEASE.md

@@ -75,6 +75,27 @@ Before or right after pushing the tag, in the repository's
 3. **Enforce HTTPS**, once GitHub has issued the certificate (the box is
    greyed out until then, sometimes for a few minutes).
 
+## Dependency updates
+
+Dependabot (`.github/dependabot.yml`) opens a grouped PR per week for cargo
+and for the pinned GitHub Actions, plus a PR right away for any crate with
+a security advisory. CI runs on each; merge when it's green. The MSRV job
+fails an update that needs a newer Rust than `rust-version`: close it, or
+raise `rust-version` on purpose.
+
+Merging doesn't release anything. The binaries are statically linked, so
+an update only reaches users with the next release:
+
+- **Security fix in a crate the binary uses** (check `cargo tree -i
+  <crate> -e normal`): cut a patch release soon, with a `### Security`
+  entry in CHANGELOG.md naming the advisory.
+- **Routine bumps, dev-dependencies, Actions:** no release of their own;
+  they ship with the next one. A one-line `### Changed` entry
+  ("Updated dependencies") is enough.
+
+`mise run outdated` shows what's pending, including major versions that
+Dependabot proposes on their own (they're outside the group).
+
 ## Later: crates.io
 
 Not part of a release yet. `cargo install --locked plugii` would then work