[igerber]

Summary

• Lockfile-only refresh of .github/scripts/package-lock.json: transitive undici 7.29.0 -> 7.30.1 and source-map-js 1.2.1 -> 1.2.2. This clears all seven open Dependabot alerts (six undici advisories, one source-map-js advisory). jsdom stays at 29.1.1 and package.json is unchanged; both new versions satisfy the existing ^7.25.0 / ^1.2.1 ranges.
• Add an npm ecosystem entry for /.github/scripts to .github/dependabot.yml (weekly, grouped minor/patch) so the smoke-test toolchain gets version-update PRs instead of drifting into advisories between manual refreshes. Added the javascript label it references.
• Changelog fragment under Security + Internal.

Exposure context: this lockfile only pins the Node toolchain for the docs search-excerpt smoke test in docs-tests.yml. The harness loads locally built HTML from disk and performs no network fetches, so the undici HTTP paths named in the advisories never execute. Nothing in the published wheel is affected.

Methodology references (required if estimator / math changes)

• Method name(s): N/A - no methodology changes
• Paper / source link(s): N/A
• Any intentional deviations from the source (and why): None

Validation

• Tests added/updated: No test changes. npm ci --ignore-scripts against the refreshed lock installs cleanly (39 packages) and npm audit --package-lock-only reports 0 vulnerabilities. changelog_compile.py check passes; tests/test_changelog_fragments.py passes.
• Backtest / simulation / notebook evidence (if applicable): N/A. The docs-tests.yml path filter includes .github/scripts/**, so the search-excerpt smoke test runs against the refreshed lock once CI is gated on.

Security / privacy

• Confirm no secrets/PII in this PR: Yes

Changelog

• changelog.d/ fragment added (or N/A - no user-visible change): Yes

[github-actions]

Overall assessment: ✅ Looks good

No P0, P1, P2, or P3 findings identified in the supplied diff.

Executive summary

• No estimator, inference, identification, or statistical default changes.
• Both refreshed dependencies satisfy their existing version ranges and CI’s Node 24 requirements.
• Dependabot configuration targets the correct manifest directory and follows existing grouping conventions.
• Changelog and static checks pass. Installation, audit, and behavioral smoke tests were not independently rerun.

Methodology

No findings. Checked scope against docs/methodology/REGISTRY.md; no causal inference methods or paper-dependent implementations are affected.

Code Quality

No findings. Dependabot YAML parses correctly, and the npm entry specifies a valid manifest directory, weekly schedule, and minor/patch group (.github/dependabot.yml:L53-L66).

The manifest and lockfile agree. Updated versions satisfy undici: ^7.25.0 and source-map-js: ^1.2.1 (.github/scripts/package-lock.json:L418-L426, .github/scripts/package-lock.json:L481-L489).

Performance

No findings. The changes affect the CI dependency set and update automation; no library performance paths change.

Maintainability

No findings. The npm configuration follows the existing ecosystem entries and correctly distinguishes version updates from security updates.

Tech Debt

No findings. The diff introduces no apparent deferred implementation work.

Security

No findings in the diff. Updated entries retain official npm registry URLs and valid SHA-512 integrity-field formats. The harness context supports the stated local-file exposure assessment.

Clearance of all seven Dependabot alerts was not independently verified.

Documentation/Tests

No findings. The fragment follows the repository convention and accurately describes the changes (changelog.d/20261018-npm-lock-security-refresh.md:L1-L10).

Verified:

• Changelog compiler check.
• YAML structure, manifest/lock consistency, dependency ranges, and Node engine compatibility.
• Existing workflow triggers and install/smoke-test steps.

A fresh install, npm audit, and behavioral smoke test were not run because the environment is read-only with restricted network access. Pytest is unavailable.