From 06724a1a64d1d3ab3613b23ee7788c70590f14b1 Mon Sep 17 00:00:00 2001
From: xscriptor <preciado.oscar.osorio@gmail.com>
Date: Sat, 24 Oct 2026 14:25:56 +0200
Subject: [PATCH 1/2] ci: add dependency security audit and Dependabot

- Run pinned cargo-audit 0.22.2 with --deny warnings on push, PR and weekly
- Add weekly Dependabot updates for cargo and GitHub Actions
- Pin actions by commit SHA and avoid persisted credentials
---
 .github/dependabot.yml               | 34 ++++++++++++++++++++++++++
 .github/workflows/security-audit.yml | 36 ++++++++++++++++++++++++++++
 2 files changed, 70 insertions(+)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/security-audit.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..1a91d14
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,34 @@
+version: 2
+updates:
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "04:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      cargo-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "04:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "ci(deps)"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
new file mode 100644
index 0000000..89b1c76
--- /dev/null
+++ b/.github/workflows/security-audit.yml
@@ -0,0 +1,36 @@
+name: Security audit
+
+on:
+  push:
+  pull_request:
+  schedule:
+    # Weekly, Mondays at 04:17 UTC
+    - cron: "17 4 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-audit-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  audit:
+    name: cargo audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - name: Install stable Rust toolchain
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        with:
+          toolchain: stable
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --version 0.22.2 --locked
+
+      - name: Audit dependencies
+        run: cargo audit --deny warnings

From a53f3dcc9416652d211a6fccdfe6d93b7393377e Mon Sep 17 00:00:00 2001
From: xscriptor <preciado.oscar.osorio@gmail.com>
Date: Sat, 24 Oct 2026 14:29:40 +0200
Subject: [PATCH 2/2] docs: record the v1.0.1 security work in the changelog

---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 272bf75..7f2c8ad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 2026-10-24 — Dependency security automation
+
+- Added `.github/workflows/security-audit.yml`: runs `cargo audit` 0.22.2 with `--deny warnings` on push, pull request and a weekly schedule, with actions pinned by commit SHA and no persisted checkout credentials.
+- Added weekly Dependabot updates for Cargo dependencies and GitHub Actions (`open-pull-requests-limit: 5`, minor/patch grouped).
+- No effect code or assets changed. The current lockfile audits clean (16 crates, 0 vulnerabilities, 0 warnings).
+
 ## 2026-09-12 — WebAssembly effects
 
 - Added `wasm-matrix` (Rust core module): deterministic Matrix-style glyph reveal that settles on the original lines with ANSI sequences intact.