Add dependabot config

.github/dependabot.yml

@@ -0,0 +1,34 @@
+version: 2
+updates:
+- package-ecosystem: github-actions
+  directory: /.github/workflows
+  schedule:
+    interval: quarterly
+  cooldown:
+    default-days: 7
+  groups:
+    gha-patches:
+      update-types:
+      - patch
+
+- package-ecosystem: uv
+  directory: /
+  schedule:
+    interval: quarterly
+  cooldown:
+    default-days: 7
+  groups:
+    uv.lock-patches:
+      update-types:
+      - patch
+
+- package-ecosystem: "pre-commit"
+  directory: "/"
+  schedule:
+    interval: "quarterly"
+  cooldown:
+    default-days: 7
+  groups:
+    pre-commit-all:
+      patterns:
+        - "*"

.github/workflows/dependabot-auto-changelog.yml

@@ -0,0 +1,19 @@
+name: Dependabot Changelog Entry
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+    branches: [main]
+
+jobs:
+  update-changelog:
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v7
+      - uses: crambl/dependabot-changelog-writer@478f44ae023312b697349f9d12b646936020936f  #v1.3.1
+        with:
+          section-header: 'Maintenance'

CHANGELOG.md

@@ -83,6 +83,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Maintenance
 
+- Setup dependabot to keep dependencies up-to-date. [\#718]((https://github.com/mllam/neural-lam/pull/718) @observingClouds
+
 - Split the monolithic `neural_lam/utils.py` into a `neural_lam/utils/` package with one module per concern (`buffer_list`, `graph`, `networks`, `plot`, `logging`, `tensor`, `time`); `utils/__init__.py` re-exports the full public API so existing imports are unaffected. Pure code movement, no behavioural change. [\#682](https://github.com/mllam/neural-lam/pull/682) @Sir-Sloth-The-Lazy
 
 - Add comprehensive type hints to GraphLAM in `neural_lam/models/step_predictors/graph/graph_lam.py` [\#669](https://github.com/mllam/neural-lam/pull/669) @GiGiKoneti