From bbe66d58722dfe86ba69e7bab0d3f749769a833a Mon Sep 17 00:00:00 2001
From: Pavlo Strunkin <pashidlos@gmail.com>
Date: Tue, 3 Nov 2026 08:16:49 +0200
Subject: [PATCH 1/2] ci: let Dependabot update the semantic-release tooling

release.yml pinned semantic-release and its plugins in an npx line, which
Dependabot cannot read. They now live in a package.json that release.yml
installs, with an npm Dependabot entry; the conventionalcommits preset stays
on 9.x until semantic-release ships conventional-changelog-writer 9.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml        | 18 ++++++++++++++++++
 .github/workflows/release.yml | 10 +++-------
 .gitignore                    |  1 +
 package.json                  |  8 ++++++++
 4 files changed, 30 insertions(+), 7 deletions(-)
 create mode 100644 package.json

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 72fc798..9f94f5f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -27,6 +27,24 @@ updates:
         patterns:
           - "*"
 
+  - package-ecosystem: npm
+    # package.json holds only the release tooling that release.yml installs
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      release-tooling:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # preset 10 needs conventional-changelog-writer 9; semantic-release 25 bundles writer 8
+      - dependency-name: conventional-changelog-conventionalcommits
+        update-types:
+          - version-update:semver-major
+
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2999759..a104dea 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,17 +33,13 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: 24
+      - name: Install the release tooling
+        run: npm install --no-package-lock
       - name: Build, tag and draft the GitHub release
         id: semantic-release
         env:
           GITHUB_TOKEN: ${{ github.token }}
-        # Preset 10+ needs conventional-changelog-writer 9; semantic-release 25 bundles writer 8.
-        run: >
-          npx --yes
-          -p semantic-release@25.0.9
-          -p @semantic-release/exec@7.1.0
-          -p conventional-changelog-conventionalcommits@9.3.1
-          semantic-release
+        run: npx semantic-release
       - uses: actions/upload-artifact@v7
         if: steps.semantic-release.outputs.version
         with:
diff --git a/.gitignore b/.gitignore
index e73dbde..ee2dbf9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,4 @@ __pycache__
 .tox
 .vscode
 .python-version
+node_modules/
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..38402b4
--- /dev/null
+++ b/package.json
@@ -0,0 +1,8 @@
+{
+  "private": true,
+  "devDependencies": {
+    "@semantic-release/exec": "7.1.0",
+    "conventional-changelog-conventionalcommits": "9.3.1",
+    "semantic-release": "25.0.9"
+  }
+}

From d456675316f7e8eff0e104b7de68dfa50c52b3a4 Mon Sep 17 00:00:00 2001
From: Pavlo Strunkin <pashidlos@gmail.com>
Date: Tue, 3 Nov 2026 08:18:27 +0200
Subject: [PATCH 2/2] ci: group release-tooling security updates, skip npm
 audit on install

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml        | 5 +++++
 .github/workflows/release.yml | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9f94f5f..512d246 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -32,6 +32,7 @@ updates:
     directory: "/"
     schedule:
       interval: weekly
+    open-pull-requests-limit: 5
     groups:
       release-tooling:
         patterns:
@@ -39,6 +40,10 @@ updates:
         update-types:
           - minor
           - patch
+      release-tooling-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
     ignore:
       # preset 10 needs conventional-changelog-writer 9; semantic-release 25 bundles writer 8
       - dependency-name: conventional-changelog-conventionalcommits
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a104dea..e14ce66 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,7 +34,7 @@ jobs:
         with:
           node-version: 24
       - name: Install the release tooling
-        run: npm install --no-package-lock
+        run: npm install --no-package-lock --no-audit --no-fund
       - name: Build, tag and draft the GitHub release
         id: semantic-release
         env: