ci(dependabot): version updates for fsaunpack, each waiting for you

.github/dependabot.yml

@@ -22,7 +22,8 @@
 #
 # Security updates are separate from this file (Settings > Code security >
 # Dependabot security updates) and still open a PR for any vulnerable package,
-# including the fsaunpack tool, which has its own package-lock.json.
+# including the fsaunpack tool, which has its own package-lock.json (and its own
+# entry below for version updates).
 version: 2
 updates:
   - package-ecosystem: 'npm'
@@ -72,6 +73,22 @@ updates:
       # come, so there is nothing for Dependabot to offer; the way on is Mediabunny.
       - dependency-name: 'mp4-muxer'
 
+  # fsaunpack: the helper that unpacks a saved .fsa archive and serves it with
+  # express (fsaunpack/, its own package.json and package-lock.json). It is not
+  # part of the extension, and CI neither installs nor runs it, so a green run says
+  # nothing about an update here. Every one waits for the owner: update-prs.yml
+  # merges only PRs that change nothing but the root package.json and
+  # pnpm-lock.yaml.
+  - package-ecosystem: 'npm'
+    directory: '/fsaunpack'
+    schedule:
+      interval: 'weekly'
+    cooldown:
+      default-days: 5
+    open-pull-requests-limit: 5
+    labels:
+      - 'dependencies'
+
   # Workflow actions are pinned to a commit SHA with the version as a comment,
   # so a moved or hijacked tag cannot change what runs next to the AMO signing
   # keys. Nothing arrives on its own any more; Dependabot updates the SHA and

docs/maintenance.md

@@ -14,6 +14,7 @@ workflows, which stay silent while they pass.
 | npm tooling, minor/patch | one grouped Dependabot PR a week (`tooling-minor-and-patch`) | merged by `update-prs.yml` | nothing (a comment on the PR records the merge) |
 | npm shipped libraries (fuse.js, pako, sortablejs) | one grouped Dependabot PR a week (`shipped-minor-and-patch`) | waits for you: the build copies them into the extension, so its bundle differs from the release's | one comment, and the assignment |
 | npm major | a Dependabot PR of its own | waits for you | one comment, and the assignment |
+| fsaunpack (express) | a Dependabot PR for `fsaunpack/`, the helper that unpacks and serves a saved `.fsa` archive; not part of the extension | waits for you: CI does not run fsaunpack, so try it by hand before merging | one comment, and the assignment |
 | GitHub Actions | one grouped Dependabot PR a week (minor/patch), a major on its own | waits for you: it changes workflow files | one comment, and the assignment |
 | pnpm 11.x | a PR from `toolchain-updates.yml` (Mondays 07:00 UTC) on `toolchain/pnpm-<version>`, changing only `packageManager`, once the release is 5 days old; one in conflict with `main` is rebuilt on it weekly | merged by `update-prs.yml` | nothing (a comment on the PR records the merge) |
 | pnpm next major | a PR from `toolchain-updates.yml`, once dependabot/dependabot-core#15904 is closed | waits for you | one comment, and the assignment |