Dependabot

[michalfita]

@tstellanova, @tmplt, @jamesmunns Do you think we should set up dependabot to monitor crates we relay on here?

[tmplt]

I do not see the value in a dependabot in a Rust library context. Any dependants will fetch the latest compatible version when pulling the crate anyway.

[tmplt]

It would be useful for new major releases of dependencies (e.g. when embedded-hal v0.1.0 releases, and cortex-m{,-rt} too I suppose). As for non-major releases, these can be checked in a periodic CI pipeline that fetches the most recent compatible version due to the omitted Cargo.lock. If this pipeline fails we'll know if we need to pin a crate version, or if one was pulled.