From 86def261433ac1778c39a26c3eac3f1946f88773 Mon Sep 17 00:00:00 2001
From: igerber <isaac.gerber@gmail.com>
Date: Sun, 18 Oct 2026 09:59:38 -0400
Subject: [PATCH] chore(ci): refresh the smoke-test npm lockfile and enable
 Dependabot for it

Lockfile-only bump of the transitive undici (7.29.0 -> 7.30.1) and
source-map-js (1.2.1 -> 1.2.2) pins under .github/scripts, clearing all
seven open Dependabot alerts; jsdom stays at 29.1.1. Adds an npm
ecosystem entry for /.github/scripts so future advisories on this
CI-only toolchain arrive as fix PRs instead of orphaned alerts.
---
 .github/dependabot.yml                        | 20 +++++++++++++++++++
 .github/scripts/package-lock.json             | 12 +++++------
 .../20261018-npm-lock-security-refresh.md     | 10 ++++++++++
 3 files changed, 36 insertions(+), 6 deletions(-)
 create mode 100644 changelog.d/20261018-npm-lock-security-refresh.md

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b5e49600b..3e0152fd8 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -44,3 +44,23 @@ updates:
         update-types:
           - "minor"
           - "patch"
+
+  # CI-only Node toolchain for the docs search-excerpt smoke test
+  # (.github/scripts/search_excerpt_smoke.mjs). Weekly version updates keep
+  # the transitive pins (undici, source-map-js, ...) from drifting into
+  # advisories; security-fix PRs for open alerts are governed separately by
+  # the repo's "Dependabot security updates" setting.
+  - package-ecosystem: "npm"
+    directory: "/.github/scripts"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "javascript"
+    groups:
+      npm-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
diff --git a/.github/scripts/package-lock.json b/.github/scripts/package-lock.json
index 1bd471ac7..92e20cfb9 100644
--- a/.github/scripts/package-lock.json
+++ b/.github/scripts/package-lock.json
@@ -416,9 +416,9 @@
       }
     },
     "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+      "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -479,9 +479,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz",
-      "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==",
+      "version": "7.30.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.1.tgz",
+      "integrity": "sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/changelog.d/20261018-npm-lock-security-refresh.md b/changelog.d/20261018-npm-lock-security-refresh.md
new file mode 100644
index 000000000..1b039a4c7
--- /dev/null
+++ b/changelog.d/20261018-npm-lock-security-refresh.md
@@ -0,0 +1,10 @@
+### Security
+- **CI smoke-test lockfile refresh**: bumped the transitive `undici` (7.29.0 -> 7.30.1)
+  and `source-map-js` (1.2.1 -> 1.2.2) pins in `.github/scripts/package-lock.json`,
+  clearing all seven open Dependabot alerts. CI-only (docs search-excerpt smoke test);
+  nothing in the published wheel is affected.
+
+### Internal
+- **Dependabot npm coverage**: added an `npm` ecosystem entry for `/.github/scripts`
+  so the smoke-test toolchain gets weekly version-update PRs (grouped minor/patch)
+  instead of drifting into advisories between manual lockfile refreshes.