[Nawid3333]

Dependabot now also opens version-update PRs for fsaunpack/, the helper that unpacks and serves a saved .fsa archive. Until now it only watched it for security fixes, so express 5 never arrived as a PR.

It ships nothing: fsaunpack is not part of the extension, so merging this releases nothing.

What changes

• .github/dependabot.yml: a weekly npm entry for /fsaunpack, with the same 5-day cooldown and dependencies label as the root entry, placed right after it.
• docs/maintenance.md: a row for it in the update-source table.

What you'll get

• After this merges: Dependabot's next run should open a PR for express 4.22.3 → 5.2.1, a major.
• Every fsaunpack PR waits for you. update-prs.yml merges only PRs that change nothing but the root package.json and pnpm-lock.yaml. Its comment will name the fsaunpack files as the reason.
• Test it by hand. CI neither installs nor runs fsaunpack, so a green check says nothing about it.
• For express 5: it matches route paths differently. testserver.mjs registers each recorded URL's path as a route, and a path with *, : or brackets can behave differently or throw.

Checks

• The file parses (js-yaml): three update entries (npm /, npm /fsaunpack, github-actions /).
• update-prs.yml (line 326) hands on any PR that changes a file other than the root package.json and pnpm-lock.yaml.
• ci.yml runs on every PR to main, with no path filter, so the gate always gets a CI result.
• Doesn't overlap with the other session's actionlint-Dockerfile PR: that one adds its entry at the end of the file and its table row further down.

🤖 Generated with Claude Code