chore: configure Dependabot for the Bun ecosystem

[rozx]

Summary

Dependabot's security update job for @quasar/app-vite fails on every push to main:

Dependabot detected that Bun is misconfigured in this repository ... Dependabot's `npm_and_yarn`
ecosystem cannot update `bun.lock`. Set `package-ecosystem: "bun"` in your dependabot.yml

The repo has no dependabot.yml, so GitHub's default security updates detect the project as npm_and_yarn, which can't update bun.lock.

This adds .github/dependabot.yml with package-ecosystem: 'bun' for /. open-pull-requests-limit: 0 turns off scheduled version-update PRs, so adding the file doesn't start a stream of upgrade PRs; security updates still run.

Notes for reviewers

• Config only; no app code changes. The pre-commit hook bumped src/constants/version.ts, and main was merged in afterwards (no conflicts).
• Drop the open-pull-requests-limit: 0 line if you also want weekly version updates.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1a7d4e7744

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

不要关闭 Bun 唯一受支持的更新路径

GitHub 当前仅支持 Bun 的版本更新，不支持安全更新，且依赖图支持列表中也没有 Bun（参见 Dependabot 支持矩阵 和 依赖图生态列表）。在这种情况下，open-pull-requests-limit: 0 又会关闭版本更新，因此该配置不会生成任何依赖更新 PR，也无法恢复提交说明中失败的安全更新；应允许定期 Bun 版本更新，或改用实际支持 Bun 漏洞更新的工具/流程。

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T03:05:33.695727Z	1a7d4e7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• .github/dependabot.yml
• src/constants/version.ts

Verified: package-ecosystem: 'bun' with directory: '/' correctly targets the root bun.lock/package.json and resolves the reported Dependabot security-update failure; open-pull-requests-limit: 0 is the documented pattern for keeping security updates while suppressing version-update PRs (matches the file comments and PR description); the version.ts change is the standard auto-generated build bump.

---

_{Reviewed by glm-5.3 · Input: 18.8K · Output: 4.3K · Cached: 157.7K}