diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..96d92a4
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,17 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+# Basic `dependabot.yml` file with
+# minimum configuration for two package managers
+
+version: 2
+updates:
+  # Enable version updates for npm
+  - package-ecosystem: "npm"
+    # Look for `package.json` and `lock` files in the `root` directory
+    directory: "/"
+    # Check the npm registry for updates every day (weekdays)
+    schedule:
+      interval: "weekly"
diff --git a/docs/Gemfile.lock b/docs/Gemfile.lock
index 8b3daae..3d6f5fd 100644
--- a/docs/Gemfile.lock
+++ b/docs/Gemfile.lock
@@ -211,10 +211,9 @@ GEM
       jekyll-feed (~> 0.9)
       jekyll-seo-tag (~> 2.1)
     minitest (5.19.0)
-    nokogiri (1.15.4)
-      mini_portile2 (~> 2.8.2)
+    nokogiri (1.18.4-aarch64-linux-gnu)
       racc (~> 1.4)
-    nokogiri (1.15.4-aarch64-linux)
+    nokogiri (1.18.4-x86_64-linux-gnu)
       racc (~> 1.4)
     octokit (4.25.1)
       faraday (>= 1, < 3)
@@ -222,7 +221,7 @@ GEM
     pathutil (0.16.2)
       forwardable-extended (~> 2.6)
     public_suffix (4.0.7)
-    racc (1.7.1)
+    racc (1.8.1)
     rb-fsevent (0.11.2)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
diff --git a/todo.txt b/todo.txt
index c13afca..0df47b0 100644
--- a/todo.txt
+++ b/todo.txt
@@ -1,45 +1,14 @@
-- Test midi bindings.
+pcm.pipedal_aux_in {
+    type file
+    file "/tmp/aux_input_fifo"
+    infile "/tmp/aux_input_fifo"
+    format "raw"
+    slave {
+        pcm null
+        format S16_LE
+        rate 48000
+        channels 2
+    }
+}
 
-    -- Toggle
-    -- Switch
-    -- List 
-    -- Dial.
-
--- make sure trigger controls are set to default value after load/save.
-
-- reset trigger controls after processing.
-- reset triggers before loading.
-- review trigger binding behavior.
-- triggers dont' change save state.
-- Feature for directory locations.
-
-
-- center ellipsis on file properties.
-
-- State of MIDI plugins:
-   - plugin routing is implemented. (maybe needs a not-cheating UI)
-   - MIDI message routing is not.
-   - No routing of midi messages yet. 
-   - Midi Channel Filter dialog is implemented, but not yet hooked up. 
-   - Need to think about Midi Channel filters for system and control bindings. A separate filter?
-   - Bunch of new LV2 interfaces probably needed -- most especially program selection.
-   - SF2 plugin loads the SF2 file on the Scheduler thread, blocking everyone else fo sevearl seconds. Completion
-   - becomes a SIGNIFICANT issue, since it's going to leak upward of 1G of memory!
-   - Severe memory trash/state trash of the SF2 plugin in LV2 restore state. (starts complaining about DBus notification failures!)
-   - Suspect the bin64 library which has several buffer overrun problems.
-
-
-X Start and end connectors are missing in PedalboardView when no device selected (Do they have zero outputs?)
-X Review docs changes once we go live.
-
-- Localisation: support non-UTF8 code pages.
-- unicode commandline arguments. (probably the hotspot name)
-- review unicode filenames (this is probably ok)
-
-- BUG: gc problems when we have an animated output control on phones only.
-
-
-Pri Description
------------------
-5 Re-use plugin instances when rebuilding pedalboard.
-8 Migrate to Vite toolchain.
+Move to /usr/local because...?