chore(ci): refresh the smoke-test npm lockfile and enable Dependabot for it

.github/dependabot.yml

@@ -44,3 +44,23 @@ updates:
         update-types:
           - "minor"
           - "patch"
+
+  # CI-only Node toolchain for the docs search-excerpt smoke test
+  # (.github/scripts/search_excerpt_smoke.mjs). Weekly version updates keep
+  # the transitive pins (undici, source-map-js, ...) from drifting into
+  # advisories; security-fix PRs for open alerts are governed separately by
+  # the repo's "Dependabot security updates" setting.
+  - package-ecosystem: "npm"
+    directory: "/.github/scripts"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "javascript"
+    groups:
+      npm-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"

changelog.d/20261018-npm-lock-security-refresh.md

@@ -0,0 +1,10 @@
+### Security
+- **CI smoke-test lockfile refresh**: bumped the transitive `undici` (7.29.0 -> 7.30.1)
+  and `source-map-js` (1.2.1 -> 1.2.2) pins in `.github/scripts/package-lock.json`,
+  clearing all seven open Dependabot alerts. CI-only (docs search-excerpt smoke test);
+  nothing in the published wheel is affected.
+
+### Internal
+- **Dependabot npm coverage**: added an `npm` ecosystem entry for `/.github/scripts`
+  so the smoke-test toolchain gets weekly version-update PRs (grouped minor/patch)
+  instead of drifting into advisories between manual lockfile refreshes.