Configure dependabot to find modules

[philpennock]

This configures dependabot to know about the sub-directories being independent modules, instead of expecting go.mod to be in the repo root.

[synadia-claude-reviewer]

Claude finished @philpennock's task in 1m 18s —— View job

---

PR Review

• Gather context
• Review dependabot configuration
• Post findings

---

The configuration looks correct and well-structured for this multi-module repo.

directories: ["/*/""] — The glob pattern correctly targets all top-level directories (/counters/, /jetstreamext/, /kvcodec/, etc.). Dependabot gracefully skips directories without a matching go.mod, so .github/ being in scope is harmless.

Test subdirectories excluded — counters/test/, jetstreamext/test/, etc. are at two levels deep and won't match "/*/". This is the right call: those modules use replace directives pointing to the local parent (replace github.com/synadia-io/orbit.go/counters => ../), which would trip up dependabot's PR generation. They carry the heavier transitive deps (e.g. nats-server/v2) but those updates will flow in through the parent module's updates anyway.

group-by: dependency-name — Groups all modules updating the same dependency into one PR. Good fit for this repo since the modules share many common deps (nats.go, nkeys, compress, etc.), keeping the PR count manageable.

One thing to be aware of: the default open-pull-requests-limit is 5. With 8 top-level modules and a weekly schedule this is unlikely to be a bottleneck in practice, but worth knowing if PRs start getting blocked.

No correctness, security, or structural issues. LGTM.

[philpennock]

Testing: none really viable, but the LSP schema check is happy with everything except for a non-error warning that it would like the cooldown to be longer (and uncommenting the cooldown block and raising that to 7 resolves that warning).