chore(deps): add npm/bun coverage to Dependabot

[elkaix]

What

Adds an npm package-ecosystem entry to .github/dependabot.yml covering the five tracked JS directories: web, vis, docs (bun), packages/install-counter-worker, and examples/feedback-worker. Grouped weekly minor/patch bumps, mirroring the existing uv block.

Why

Dependabot only watched the uv (Python) ecosystem. The npm side had no version-update coverage, so the 26 open npm security alerts (1 critical vitest, plus high-sev vite/rollup/esbuild/hono/dompurify/… — mostly dev & build tooling) had no remediation path and no bot PRs.

Companion change

Dependabot automated-security-fixes has been enabled on the repo (was disabled), so the existing alert backlog now gets remediation PRs directly. This config keeps the lockfiles current so they don't drift back.

Scope

• blackbox/ and .worktrees/ are gitignored and not scanned — coverage is exactly the 5 real packages.
• Unrelated to PR feat: Agent phase-0 enhancements + review/login hardening #89 (the agent phase-0 branch); intentionally a separate branch off main.

Summary by CodeRabbit

• Chores
  • Updated dependency management automation configuration to improve efficiency and maintenance workflows across multiple project directories.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e5c6d782-ad38-4c91-99fa-6a205cf7a2c4

📥 Commits

Reviewing files that changed from the base of the PR and between 1b840f4 and a26fcb1.

📒 Files selected for processing (1)

• .github/dependabot.yml

---

📝 Walkthrough

Walkthrough

Dependabot configuration is extended to automate npm dependency updates. A new npm ecosystem entry targets multiple directories with weekly Monday scheduling, groups minor and patch updates, and limits concurrent pull requests to five.

Changes

npm Dependency Updates Configuration

Layer / File(s)	Summary
Dependabot npm configuration .github/dependabot.yml	New npm ecosystem update configuration with weekly Monday schedule, 5 concurrent PR limit, minor/patch grouping, and targets for /web, /vis, /docs, /packages/install-counter-worker, and /examples/feedback-worker directories.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested labels

dependencies

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description covers What, Why, and Scope clearly but omits the required Related Issue link, tests checklist, and changelog/docs generation steps from the template.	Add a 'Related Issue' section linking to the issue number, and clarify whether template checklist items (tests, changelog, docs generation) apply to this configuration-only change.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The pull request title follows the conventional commits format (chore(deps): ...) and accurately describes the main change—adding npm/bun coverage to Dependabot configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-npm-coverage

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!