[Deicyde]

Closes #10.

Problem

WikiLean has no Dependabot or Renovate configuration, so npm, pip and SHA-pinned GitHub Actions updates pile up silently. An npm audit of wiki/package-lock.json on main today reports 10 advisories (3 moderate, 5 high, 2 critical). They are in hono, wrangler's transitive deps (miniflare, sharp, undici), vitest/tinypool, ajv and source-map-js.

Change

New .github/dependabot.yml, per the issue's acceptance criteria:

• npm for /wiki, weekly, with minor and patch dev-dependency updates grouped into one PR. wrangler, ajv and esbuild stay out of the group and arrive alone: wrangler is the deploy, backup and rollback tool, which no CI job runs, and an ajv or esbuild bump changes the committed companion validator. @types/node majors are ignored, since the project runs Node 22;
• pip for the root requirements-ci.txt, weekly, as one grouped PR, because the file is a resolved freeze with lockstep pairs (pydantic/pydantic_core, mcp/mcp-types, httpx2/httpcore2). The six pins that brain code seals and CI checks (pg8000, scramp, asn1crypto, python-dateutil, six and PyYAML) are ignored, to be bumped by hand with a profile reseal;
• GitHub Actions, monthly, so the SHA pins in the workflows get reviewed bumps;
• open PRs capped per ecosystem (5, 3, 3).

ci.yml runs on every pull_request with no path filter and uses no secrets, so each update PR runs the protected CI / required gate (worker, python and browser).

Two npm directories are left out on purpose: .github/claude-cli (the poller's pinned CLI, bumped by hand) and .github/backup-wrangler, which scripts/backup_wrangler_lock.py generates from wiki/package-lock.json and CI checks, so it follows wiki's wrangler.

CONTRIBUTING.md (Pull requests) gains a paragraph saying when to merge these PRs. npm and pip PRs change release-affecting files, so they merge at the start of a release cycle and never between a build and its promotion. A wrangler PR (or any npm PR that moves a package Wrangler depends on) also runs python3 scripts/backup_wrangler_lock.py --write, since CI's check fails until it does, and updates the runbook's Wrangler notes. An ajv or esbuild PR may need the validator regenerated. After an upload-artifact bump, Backup D1 should be dispatched once.

How tested

• The file parses as YAML with the three ecosystems, the ignores and the groups above. The sealed pins and lockstep pairs are the ones in requirements-ci.txt and brain/lmfdb_source_dependencies.py / brain/git_harvest_dependencies.py.
• Release-neutral per site/ops/brain_release_authority.py.
• Dependabot itself validates the config after merge, on the repo's Insights → Dependency graph → Dependabot page.

Risks

• Update PRs start arriving after merge, up to the caps.
• wiki/package.json and wiki/package-lock.json are release-affecting, so a merged npm update to the Worker's runtime dependencies rides the next Brain release, like any Worker change.

What Jack must do

• Nothing to configure. The current advisories are not fixed here. Security hardening: agent sandbox, fail-closed auth, request caps, static headers, token sealing #84 moved hono to 4.13.12, which has the security fixes. wrangler, vitest (a major upgrade) and ajv still need decisions on timing and testing, and with this config each arrives as its own PR.

[Deicyde]

Recommendation: merge (at 2173af5d, CI green; the review's fixes are in):

• The six brain-sealed pip pins are ignored, and the pip freeze moves as one grouped PR.
• wrangler, ajv and esbuild stay out of the dev group, and @types/node majors are ignored.
• CONTRIBUTING.md says when to merge these release-affecting PRs: at the start of a release cycle. Any wrangler move also needs scripts/backup_wrangler_lock.py --write, and an ajv or esbuild bump needs the validator regenerated.
• .github/backup-wrangler is named as left out, since it's generated from wiki/package-lock.json.

With #81 closing, there's no merge ordering. Release-neutral.

Posted by the WikiLean PR swarm (lead); updated 2026-10-18.