[rhein1]

Two packages with confirmed dependency-audit failures lack scheduled Dependabot version-update coverage. CodeQL init/analyze updates also arrive separately, which caused the mixed-version failure addressed by #515.

Add weekly npm entries only for /claude-agent-sdk and /deliverables/openrouter-top60-integration-pack, using the existing five-open-PR limit per entry. Preserve /mcp, /n8n, and GitHub Actions schedules/limits and the existing absence of reviewer/label overrides.

Under the existing GitHub Actions entry, group github/codeql-action/* with applies-to: version-updates, so matching init/analyze version updates are proposed together. Other action updates and security-update policy are unchanged. Grouping is supported by GitHub's current options reference; it does not guarantee dependency resolution or successful updates.

Validation:

• YAML parsed with duplicate-key rejection; documented structure, exact two-directory scope, existing-policy equality, group matching/exclusion, and manifest/lock path checks passed.
• Independent read-only review and remote commit/file read-back passed.
• Only .github/dependabot.yml changes. No dependency manifests, lockfiles, workflow checks, credentials or repository security settings change.
• Exact-head hosted checks: 7 passed, 2 failed, 0 pending/not-run checks, all on bc62d58c9efcc17c71f225c4e2fc1226f13d8704.
  • GitHub's Dependabot app configuration validation passed: “All changes look good,” zero annotations. This is service-side configuration validation, not a package updater scan.
  • CodeQL passed JavaScript/TypeScript and Python analysis; the CodeQL app check also passed with no new alerts in changed code.
  • Python SDK 3.8/3.14 and payment-contracts passed.
  • validate failed at the unchanged OpenRouter Zod dependency audit (GHSA-mrhx-c7xc-m3w5, affected <4.6.6).
  • adapter-conformance failed at the unchanged Claude SDK dependency audit: 6 vulnerabilities (2 moderate, 4 high). No audits or checks were weakened.
  • The validation run reports 47 skipped steps: 45 later validation steps and two adapter post-setup cleanup steps. Commands after failed audits, including Claude typecheck/test/test:cli, did not run.
• Local checks were limited to YAML/source/policy validation. Git/npm DNS remains unavailable; no network retry or package installation was attempted for this change.

Coverage versus observation: this proposes npm version-update coverage for four directories rather than two. No new Dependabot scan or remediation is claimed. GitHub uses configuration on the default branch; this PR remains a draft. Existing vulnerable versions and audit failures remain until separate dependency repairs are completed.

Related: #515, #509, #510. Existing PRs and their branches remain untouched. No merge, release, deployment, alert dismissal or operational activation is included.