diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..a48025412
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,609 @@
+# Dependabot configuration for ArgumentumGames/Argumentum
+#
+# Authored by po-2024 (tick 113), dispatched by ai-01 (`3zhzkb`).
+# OPEN AS A PR — NOT merged. Deliberate jsboige arbitration on scope (see PR body).
+#
+# Policy summary:
+#   1. nuget (our .NET pipeline)         -> group + ignore AutoMapper majors (license barrier #588/#887)
+#   2. npm vendored DNNPlatform trees     -> group + ignore majors (unvalidated in CI, #901)
+#   3. npm our trees (CardPen, pdf-val)   -> group + ignore majors
+#
+# Why groups: collapses multiple same-directory bumps into ONE pull request. The repo saw
+# ~34 dependabot PRs in a single cycle (mostly the same package bumped across many 2sxc
+# module trees, e.g. loader-utils x5). `groups` turns N-per-dir into 1-per-dir.
+#
+# Why ignore-major on npm vendored: a major bump edits package.json in a tree that nothing
+# in CI builds or consumes (#901 - webpack-dev-server 5->6 in Bootstrap 4 Instant). Patch/minor
+# are lockfile-only and are merged per precedent #120.
+
+version: 2
+enable-beta-ecosystems: false
+
+updates:
+  # --- 1. NuGet: the .NET pipeline (our code) ---
+  - package-ecosystem: "nuget"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    groups:
+      dotnet:
+        patterns: ["*"]
+    ignore:
+      # AutoMapper 14.0.0 is the LAST MIT release; 15.0.0+ flips to RPL-1.5 / commercial
+      # (Lucky Penny, requireLicenseAcceptance). Pinned by decision jsboige 2026-06-23 (#588).
+      # A dependabot major bump would re-propose the commercial line; ignore it at the source.
+      - dependency-name: "AutoMapper"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "nuget"
+
+  # --- 2. npm: our own trees (customized CardPen fork + pdf-validation tooling) ---
+  - package-ecosystem: "npm"
+    directory: "/Generation/CardPen"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+
+
+  - package-ecosystem: "npm"
+    directory: "/docs/investigations/pdf-validation"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+
+
+  # --- 3. npm: vendored DNNPlatform / 2sxc trees (upstream templates, NOT built by our CI) ---
+  # Each block targets exactly one directory (dependabot does not glob directories).
+  # Patch/minor = lockfile-only no-ops, merged per precedent #120; majors are ignored (#901).
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1-System/Skins/Bootstrap 4 Instant"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/Accordion4"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/AddSearch3"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/Blog5"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/CTA3"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/Content"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/Content/bs5"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/Counter2"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/EventsAndCourses6"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/Faq4"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/Gallery7"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/Glossary3"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/ImageCompare2"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/ImageHotspots3"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/Jobs2"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/MobiusForms5"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/News5"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/PeopleDirectory4"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/PodCast2"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/PopupMessage3"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/QrCode2"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/Swiper2"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/Timeline3"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/1/2sxc/TimelineJs2"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/_default/Skins/2shineBS5"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+
+  - package-ecosystem: "npm"
+    directory: "/DNNPlatform/Portals/_default/Skins/Bootstrap 4 Instant"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    groups:
+      npm:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "npm"
+      - "vendored"
+