[JackNDwyer]

As part of the Oct 29 security hackathon, we're adding Dependabot to every example repo we're keeping and naming a maintainer for each. You're tagged because you made the most recent changes here.

Once this merges, Dependabot opens PRs only when a security advisory affects a dependency, with fixes grouped together, and requests your review on them. Version bumps stay off. If someone else should own this repo, or it should be archived instead, say so here.

---

Part of the livekit-examples security cleanup.

What

• Adds .github/dependabot.yml for security updates only. Version-update PRs stay off (open-pull-requests-limit: 0), and security fixes are grouped instead of one PR per package.
  • Covers github-actions: /; pip: /src/waver_driver
• Adds .github/CODEOWNERS naming @stephen-derosa as maintainer, so Dependabot PRs request their review.

Why

This repo has 0 open Dependabot alerts (0 critical, 0 high). Examples touched in the last 6 months, or that still get real traffic, get Dependabot and a named maintainer. The rest are being archived.

Renovate keeps handling version bumps here. Dependabot only opens PRs for security advisories.

After merge

Dependabot security updates get switched on for this repo, and grouped fix PRs start arriving.

🤖 Generated with Claude Code