[rthaut]

Closes #296

Included updates

• @emotion/react: 11.11.3 → 11.14.0 (supersedes Bump @emotion/react from 11.11.3 to 11.14.0 #284)
• prettier: 3.9.5 → 3.9.6 (supersedes Bump prettier from 3.9.5 to 3.9.6 #283; the lockfile resolves 3.9.9 within the ^3.9.6 range)
• react-router-dom: 6.30.4 → 6.30.6 (fixes GHSA-jjmj-jmhj-qwj2, open redirect)
• Lockfile refresh with npm audit fix (no --force), in-range only. Notable: web-ext 10.5.0 → 10.7.0, addons-linter 10.8.0 → 10.13.0, shell-quote 1.8.4 → 1.10.0, fast-uri 3.1.4 → 3.1.8, undici 7.28.0 → 7.30.0, js-yaml 4.3.0 → 4.3.2, postcss 8.5.16 → 8.5.28, nanoid 3.3.15 → 3.3.19, image-size 2.0.2 → 2.0.4, immutable 3.8.3 → 3.8.4, brace-expansion, @remix-run/router 1.23.3 → 1.23.4.
• esbuild 0.27.7 → 0.27.2 (a downgrade within wxt's ^0.27.1 range). GHSA-g7r4-m6w7-qqqr affects 0.27.3 through 0.28.0 and has no 0.27.x fix, so npm resolved the last unaffected 0.27 release.

Supersedes #283
Supersedes #284

Dependabot configuration

• npm and github-actions: one group for minor and patch updates each, open-pull-requests-limit: 10.
• New bundler entry for /docs, so the Jekyll docs/Gemfile.lock gets update PRs (it currently has open alerts and no coverage).

Not included

• Bump react-dropzone from 14.2.3 to 16.0.0 #280 (react-dropzone 16), Bump wxt from 0.20.27 to 0.21.2 #281 (wxt 0.21), Bump notistack from 2.0.8 to 3.0.2 #282 (notistack 3): CI is green on each, but they are runtime or build-tool majors that need a manual check of the options UI and built extensions. They stay as separate PRs.
• Bump pnpm/action-setup from 6.0.9 to 6.1.0 #286 (pnpm/action-setup) only touches the visual recap workflow and is handled separately.

Remaining alerts

These alerts have no in-range fix: react-router 6.x (GHSA-wrjc-x8rr-h8h6, GHSA-337j-9hxr-rhxg; fixed only in 7.18), @material-table/core (needs v8), and toolchain transitives under svg2png (request, form-data, tough-cookie, phantomjs), wxt/web-ext-run (fx-runner, firefox-profile/adm-zip, shell-quote, tmp), and extract-zip. The docs/Gemfile.lock alerts are left for the new bundler updates.

Validation

• npm ci and npm test (lint, Chrome/Edge/Firefox builds, manifest smoke test, zips, web-ext lint)
• The Dependabot YAML parses.

Risk

Low. The direct bumps are a minor (@emotion/react, which now matches @emotion/styled 11.14.1) and patches. The transitive changes are dev tooling only, except @remix-run/router, which is the patch that comes with react-router 6.30.6.