Dependabot for LibMan

[VahidN]

It would be nice to have a new dependabot package ecosystem for Library Manager. This would be relatively easy for dependabot to just look at an additional file (libman.json).

[Piedone]

Maybe instead: #803.

[jimmylewis]

While not integrated with dependabot, I did a side project to create a package that scans libman.json and looks for advisories in the GHSA database: https://www.nuget.org/packages/Libman.Audit

Dependabot integration would be better :)

[Piedone]

BTW in Renovate, which is similar to Dependabot (but I think better) you can create configs with custom regex patterns to keep libman.json dependencies up to date.

[Piedone]

We've done this with Renovate here: https://github.com/Lombiq/renovate-config/blob/15eff26a7ae9191fce39c26d3e11de051bcd0e96/default.json5#L65-L91 Renovate configured to automatically update LibMan package references.