From a0818a5fa0de45ea932d2b37b3d71d490f66576c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Joachim=20L=C3=B8vgaard?= <joachim@loevgaard.dk>
Date: Mon, 21 Sep 2026 11:43:12 +0200
Subject: [PATCH] Let Dependabot watch facebook/php-business-sdk

The Graph API version the client talks to is ApiConfig::APIVersion from
facebook/php-business-sdk, and Meta ships a new major of that package
for every Graph API version, roughly three times a year. Until the
constraint is widened, users of this library stay capped at the previous
Graph API version, and so far somebody had to notice the release by hand.

Dependabot now opens a PR that widens the constraint when a new major is
released, for 1.x and, through target-branch, for 2.x. No composer.lock
is committed, so releases inside the allowed range produce no PR. Other
dependencies are left out on purpose: their ranges already float, and
the dev tools are held on the majors that still support PHP 8.1.
---
 .github/dependabot.yml | 32 ++++++++++++++++++++++++++++++++
 CLAUDE.md              |  2 +-
 2 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..0a70fc4
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,32 @@
+# Dependabot only reads this file from the default branch (1.x). The second entry covers 2.x through target-branch.
+#
+# Only facebook/php-business-sdk is watched. The Graph API version the client talks to is ApiConfig::APIVersion from that
+# package, and Meta ships a new major of it for every Graph API version, a few times a year. Without a PR that widens the
+# constraint, users of this library stay capped at the previous Graph API version.
+#
+# No composer.lock is committed, so a PR is only opened when a release falls outside the allowed range, i.e. for a new
+# major. The other dependencies are left out on purpose: their ranges already float, and the dev tools are held on the
+# majors that still support PHP 8.1.
+version: 2
+
+updates:
+    -   package-ecosystem: "composer"
+        directory: "/"
+        schedule:
+            interval: "weekly"
+        allow:
+            -   dependency-name: "facebook/php-business-sdk"
+        versioning-strategy: "widen"
+        labels:
+            - "dependencies"
+
+    -   package-ecosystem: "composer"
+        directory: "/"
+        target-branch: "2.x"
+        schedule:
+            interval: "weekly"
+        allow:
+            -   dependency-name: "facebook/php-business-sdk"
+        versioning-strategy: "widen"
+        labels:
+            - "dependencies"
diff --git a/CLAUDE.md b/CLAUDE.md
index 7d9a5c7..f026cdd 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -56,4 +56,4 @@ So to add a field: add the public property, map it in `getMapping()`, and regist
 
 **Value objects (`src/ValueObject/`)** — `Fbc`/`Fbp` (extending `Fb`) model the `_fbc`/`_fbp` cookie values with `fromString()` validation and `value()` serialization; assignable to `User::$fbc`/`$fbp` as either the typed object or a raw string.
 
-The `facebook/php-business-sdk` dependency is used only for `Normalizer`, `Util::hash`, and `ApiConfig::APIVersion` (the API version is pinned to whatever that package ships).
+The `facebook/php-business-sdk` dependency is used only for `Normalizer`, `Util::hash`, and `ApiConfig::APIVersion` (the API version is pinned to whatever that package ships). Dependabot (`.github/dependabot.yml`, which GitHub only reads from the default branch) watches this one package and opens a PR that widens the constraint when Meta releases a new major, for `1.x` and, through `target-branch`, for `2.x`. CI covers the normalization and hashing on the new major; run `LiveClientTest` once against it before tagging a release.