[ts-76]

Summary

Dependabot security-update jobs for /tools/publisher fail on every attempt and will keep failing until npm ships new bundled copies. This adds a scoped .github/dependabot.yml so those attempts stop, while a version-update pull request still arrives when a newer npm release is published.

Root cause

tools/publisher pins npm@12.2.0, which is the latest npm release. Its lockfile marks these packages inBundle: true inside that tarball:

Package	Bundled version	Fixed release to wait for
undici	6.28.0	>= 6.28.1
ip-address	10.5.0	>= 10.7.1
brace-expansion	5.0.9	>= 5.0.12
http-cache-semantics	4.2.0	no fixed release yet (4.3.0 does not change the max-stale path)

Dependabot cannot replace a bundled dependency on its own. The 2026-10-04 jobs for undici, ip-address, and brace-expansion ended with security_update_not_possible / dependency_still_vulnerable. The same limit applies to http-cache-semantics. Those versions are already the accepted publisher risk in tools/publisher/risk-scope.json, enforced by scripts/npm-stage.mjs. Upstream bundling work is npm/cli#10088 and npm/cli#10089.

What this config does

• Adds the repository's first .github/dependabot.yml.
• Configures the npm ecosystem for directory: /tools/publisher only, on the default weekday daily schedule.
• Ignores undici, ip-address, brace-expansion, and http-cache-semantics by name. ignore covers both security updates and version updates. update-types is not used, because that option does not suppress security updates.
• Does not ignore the direct npm dependency, so Dependabot still opens a version-update pull request when a newer npm release exists. GitHub's default three-day version-update cooldown still applies; security updates are not on that cooldown.
• Does not set target-branch. That is required for this entry to apply to security updates (Configuring Dependabot security updates).
• Leaves Dependabot alerts in place. Alerts are a repository setting and are not turned off by dependabot.yml.

Other manifests are unchanged

There was no dependabot.yml before, so version updates were off everywhere and security updates came only from repository settings.

This file does not list:

• root npm (/package-lock.json)
• Bun (/bun.lock and /ui/bun.lock; ui/ has no npm lockfile)
• GitHub Actions (.github/workflows)

Security-update settings apply only when directory matches the manifest. Directories that are not in this file keep the default security-update behavior. Adding those ecosystems here would turn version updates on, which this repository does not have today. The ignore rules are limited to /tools/publisher, so they do not affect the already-patched root brace-expansion or any other package.

Removing the ignores

After a newer npm release is reviewed and its lockfile bundles fixed copies, delete the matching ignore entry:

• undici once the bundle is >= 6.28.1
• ip-address once the bundle is >= 10.7.1
• brace-expansion once the bundle is >= 5.0.12
• http-cache-semantics once that bundled copy is no longer in the accepted set in tools/publisher/risk-scope.json

Update risk-scope.json in the same change. If version updates for the publisher's npm pin are no longer wanted after all four ignores are gone, delete .github/dependabot.yml.

Validation

.github/dependabot.yml parses as YAML and validates against the SchemaStore Dependabot v2 schema (https://json.schemastore.org/dependabot-2.0.json).