3.x

.github/dependabot.yml

@@ -1,6 +1,106 @@
 version: 2
 updates:
-- package-ecosystem: "github-actions"
-  directory: "/"
-  schedule:
-      interval: "weekly"
+  # GitHub Actions: weekly, grouped. SHA-pinning means most updates are just
+  # noise unless a real CVE lands; weekly cadence is plenty.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns:
+          - '*'
+  # Main npm tree (build, test, lint tooling). Weekly + grouped minor/patch so
+  # routine bumps land in one reviewable PR; majors stay separate.
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      dev-dependencies:
+        patterns:
+          - '*'
+        update-types:
+          - minor
+          - patch
+  # Consumer-shape verification harnesses under typescript/. These exist to
+  # catch packaging regressions, not to ship code - group them all together
+  # so we don't get six separate PRs every time @types/node bumps.
+  - package-ecosystem: npm
+    directory: /typescript
+    schedule:
+      interval: weekly
+    groups:
+      typescript-harness:
+        patterns:
+          - '*'
+  - package-ecosystem: npm
+    directory: /typescript/esm
+    schedule:
+      interval: weekly
+    groups:
+      typescript-harness:
+        patterns:
+          - '*'
+  - package-ecosystem: npm
+    directory: /typescript/esm-with-no-types
+    schedule:
+      interval: weekly
+    groups:
+      typescript-harness:
+        patterns:
+          - '*'
+  - package-ecosystem: npm
+    directory: /typescript/esm-with-specific-types
+    schedule:
+      interval: weekly
+    groups:
+      typescript-harness:
+        patterns:
+          - '*'
+  # Legacy-browser harness: intentionally frozen old Playwright builds used
+  # only to exercise DOMPurify against older engines. They are never shipped
+  # and never updated (bumping them defeats the purpose). This entry exists
+  # solely to stop Dependabot trying - and failing - to open security-update
+  # PRs for them: open-pull-requests-limit 0 disables version PRs, and the
+  # ignore suppresses the playwright security-update attempts. NOTE: this only
+  # quiets Dependabot. OpenSSF Scorecard scans the lockfile via OSV separately
+  # and needs a root osv-scanner.toml entry to clear GHSA-7mvr-c777-76hp.
+  - package-ecosystem: npm
+    directory: /test/legacy-playwright
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    ignore:
+      - dependency-name: playwright
+  # ---------------------------------------------------------------------
+  # 2.x LTS branch. Dependabot watches exactly one branch per entry, so
+  # the entries above (without target-branch) apply only to main. Mirror
+  # the actions and root-npm entries here so 2.x receives routine
+  # dependency updates too. The /typescript/... entries are not mirrored:
+  # those harnesses don't exist on 2.x. Security updates (driven by GHSA
+  # matches) reach 2.x automatically and bypass group settings, so an
+  # incoming CVE patch lands as its own PR rather than being bundled
+  # with the weekly grouped batch.
+  # ---------------------------------------------------------------------
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: '2.x'
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns:
+          - '*'
+  - package-ecosystem: npm
+    directory: /
+    target-branch: '2.x'
+    schedule:
+      interval: weekly
+    groups:
+      dev-dependencies:
+        patterns:
+          - '*'
+        update-types:
+          - minor
+          - patch

.github/workflows/build-and-test-skip.yml

@@ -0,0 +1,70 @@
+name: Build & Test
+
+# Companion workflow for build-and-test.yml.
+#
+# Background: GitHub's required-status-check system leaves PRs stuck in
+# "Waiting for status to be reported" when the workflow that would provide
+# the check is skipped via paths-ignore. GitHub's own documented workaround
+# is to define a twin workflow with the SAME workflow name and SAME job
+# names, gated on the INVERSE path filter, that does nothing but succeed.
+#
+# https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks#handling-skipped-but-required-checks
+#
+# RULES FOR EDITING THIS FILE:
+#
+#   1. The top-level `name:` must match build-and-test.yml exactly. GitHub
+#      identifies required checks by (workflow name, job name) tuple.
+#
+#   2. The `install` job's matrix and name must produce the SAME check
+#      names as build-and-test.yml: "install (20.x)", "install (22.x)",
+#      "install (24.x)", "install (25.x)", "install (26.x)".
+#
+#   3. The `paths` list below must be the INVERSE of the `paths-ignore`
+#      list in build-and-test.yml. If you exclude a path there, include it
+#      here (and vice versa). Mismatched lists = the real tests are
+#      skipped AND this passthrough doesn't fire = PR hangs.
+#
+#   4. Every job is a no-op that exits 0. Do NOT add real work here - this
+#      file exists purely to satisfy the required-check machinery.
+
+on:
+  pull_request:
+    paths:
+      - '**/*.md'
+      - 'demos/**'
+      - 'website/**'
+      - 'LICENSE'
+      - '.gitattributes'
+      - '.editorconfig'
+      - '.prettierrc'
+      - '.nvmrc'
+      - '.gitignore'
+      - '.husky/**'
+      - 'osv-scanner.toml'
+      - '.github/ISSUE_TEMPLATE.md'
+      - '.github/PULL_REQUEST_TEMPLATE.md'
+      - '.github/FUNDING.yml'
+      - '.github/dependabot.yml'
+      - '.github/workflows/codeql-analysis.yml'
+      - '.github/workflows/dependency-review.yml'
+      - '.github/workflows/fuzz.yml'
+      - '.github/workflows/scorecard.yml'
+      - '.github/workflows/sign-release.yml'
+      - '.github/workflows/slsa-provenance.yml'
+      - '.github/workflows/legacy-browsers.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  install:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [20.x, 22.x, 24.x, 25.x, 26.x]
+    steps:
+      - name: No-op (docs-only change, real tests skipped)
+        run: |
+          echo "Skipping build & test - change only touched documentation or"
+          echo "metadata files (see paths-ignore in build-and-test.yml)."
+          echo "Reporting success so the required status check doesn't hang."