[JackNDwyer]

As part of the Oct 29 security hackathon, we're adding Dependabot to every example repo we're keeping and naming a maintainer for each. You're tagged because you made the most recent changes here.

Once this merges, Dependabot opens PRs only when a security advisory affects a dependency, with fixes grouped together, and requests your review on them. Version bumps stay off. If someone else should own this repo, or it should be archived instead, say so here.

---

Part of the livekit-examples security cleanup.

What

• Adds .github/dependabot.yml for security updates only. Version-update PRs stay off (open-pull-requests-limit: 0), and security fixes are grouped instead of one PR per package.
  • Covers npm: /
• Adds .github/CODEOWNERS naming @davidliu as maintainer, so Dependabot PRs request their review.

Why

This repo has 6 open Dependabot alerts (1 critical, 2 high). Examples touched in the last 6 months, or that still get real traffic, get Dependabot and a named maintainer. The rest are being archived.

After merge

Dependabot security updates get switched on for this repo, and grouped fix PRs start arriving.

🤖 Generated with Claude Code