diff --git a/.github/workflows/dependency-security-maintenance.yml b/.github/workflows/dependency-security-maintenance.yml
new file mode 100644
index 000000000..f8b431928
--- /dev/null
+++ b/.github/workflows/dependency-security-maintenance.yml
@@ -0,0 +1,14 @@
+name: Dependency Security Maintenance
+
+on:
+  schedule:
+    - cron: "0 2 * * 2" # every Tuesday at 02:00 UTC
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  npm-audit:
+    uses: js-soft/github-actions/.github/workflows/dependency-security-maintenance.yml@main
+    secrets:
+      github-token: ${{ secrets.GH_PAT }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c81d7934d..0e4e84b5e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -23,5 +23,5 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - run: npx prettier -c .
-      - run: npx better-npm-audit audit --exclude 1119441
+      - run: npx better-npm-audit audit
       - run: npx markdownlint-cli **/*.md
diff --git a/.nsprc b/.nsprc
new file mode 100644
index 000000000..9fe7dc17f
--- /dev/null
+++ b/.nsprc
@@ -0,0 +1,3 @@
+{
+    "1119441": {}
+}
diff --git a/package-lock.json b/package-lock.json
index 342d297c8..60e3a24a1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -206,9 +206,9 @@
             "dev": true
         },
         "node_modules/brace-expansion": {
-            "version": "1.1.16",
-            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
-            "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+            "version": "1.1.18",
+            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+            "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
@@ -805,9 +805,9 @@
             }
         },
         "node_modules/readdir-glob/node_modules/brace-expansion": {
-            "version": "2.1.2",
-            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
-            "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
+            "version": "2.1.4",
+            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
+            "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
@@ -1212,9 +1212,9 @@
             "dev": true
         },
         "brace-expansion": {
-            "version": "1.1.16",
-            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
-            "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+            "version": "1.1.18",
+            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+            "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
             "dev": true,
             "requires": {
                 "balanced-match": "^1.0.0",
@@ -1726,9 +1726,9 @@
             },
             "dependencies": {
                 "brace-expansion": {
-                    "version": "2.1.2",
-                    "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
-                    "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
+                    "version": "2.1.4",
+                    "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
+                    "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
                     "dev": true,
                     "requires": {
                         "balanced-match": "^1.0.0"