From b063ef82052924687e93f21c2ef36e84e164a92d Mon Sep 17 00:00:00 2001
From: Thomas Isensee <26852629+thomasisensee@users.noreply.github.com>
Date: Thu, 2 Jul 2026 15:35:42 +0200
Subject: [PATCH 1/2] maintenance: add dependabot

---
 .github/dependabot.yml | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..8ac6b8c4
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"

From ff6a9019d0b7f0648b96d69900268075f669b7e8 Mon Sep 17 00:00:00 2001
From: Thomas Isensee <26852629+thomasisensee@users.noreply.github.com>
Date: Thu, 2 Jul 2026 15:39:05 +0200
Subject: [PATCH 2/2] chore: bump github actions versions

---
 {{cookiecutter.project_slug}}/.github/workflows/ci.yml   | 8 ++++----
 {{cookiecutter.project_slug}}/.github/workflows/pypi.yml | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/{{cookiecutter.project_slug}}/.github/workflows/ci.yml b/{{cookiecutter.project_slug}}/.github/workflows/ci.yml
index aa86e446..8488de43 100644
--- a/{{cookiecutter.project_slug}}/.github/workflows/ci.yml
+++ b/{{cookiecutter.project_slug}}/.github/workflows/ci.yml
@@ -21,7 +21,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 {% if cookiecutter.use_submodules == "Yes" %}
       with:
         submodules: 'recursive'
@@ -56,7 +56,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 {% if cookiecutter.use_submodules == "Yes" %}
       with:
         submodules: 'recursive'
@@ -84,7 +84,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 {% if cookiecutter.use_submodules == "Yes" %}
       with:
         submodules: 'recursive'
@@ -135,7 +135,7 @@ jobs:
         lcov --directory ./build{% if cookiecutter.header_only == "No" %}/src{% endif %} --capture --output-file coverage.info --ignore-errors mismatch,unused --exclude '*/catch2/*'
 
     - name: Upload C++ coverage to Codecov
-      uses: codecov/codecov-action@v5
+      uses: codecov/codecov-action@v7
       with:
         fail_ci_if_error: true
         files: ${{ "{{github.workspace}}" }}/coverage.info{% if cookiecutter.python_bindings != "None" %},coverage.xml{% endif %}
diff --git a/{{cookiecutter.project_slug}}/.github/workflows/pypi.yml b/{{cookiecutter.project_slug}}/.github/workflows/pypi.yml
index f3e73b8a..15b1740d 100644
--- a/{{cookiecutter.project_slug}}/.github/workflows/pypi.yml
+++ b/{{cookiecutter.project_slug}}/.github/workflows/pypi.yml
@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: 'recursive'
 
@@ -70,7 +70,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: 'recursive'