[Feature][Build] Enable Dependabot security updates via .asf.yaml #9279

Search before asking

• I had searched in the issues and found no similar feature requirement.

Use case

.github/dependabot.yml (since #9089) only configures version updates.
For Go, those only cover direct dependencies; // indirect modules are never
bumped. Security fixes in indirect modules therefore go unnoticed upstream.

Example: github.com/go-jose/go-jose/v4 (indirect, via coreos/go-oidc/v3
→ helpers/oidchelper) is affected by GHSA-mgcc-cww5-fp2q
(CVE-2026-116587, high), published 2026-10-14. The weekly go-minor-patch
group (#9268) does not include it. My fork has Dependabot security
updates enabled and got a PR for it on 2026-10-28; apache/devlake did
not. I opened #9278 for this one manually.

Description

Would the maintainers consider enabling Dependabot alerts and security
updates for this repository? For ASF repositories this is controlled by
.asf.yaml:

github:
  dependabot_alerts: true
  dependabot_updates: true

Security-update PRs follow the existing commit-message prefix
(build(deps)) and the ignore rules in .github/dependabot.yml. They only
appear when an advisory affects a dependency, so the additional PR volume
should be low.

I can open a PR for the .asf.yaml change if you would like that. Since
it changes repository settings, I would rather ask first.

Related issues

#9089

Are you willing to submit a PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct