diff --git a/package-lock.json b/package-lock.json
index 9f375cee15..c247aa7d1f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,7 +10,7 @@
       "license": "MPL-2.0",
       "dependencies": {
         "blueimp-md5": "2.19.0",
-        "devbridge-autocomplete": "2.0.1",
+        "devbridge-autocomplete": "2.0.7",
         "jquery": "3.7.1",
         "jquery-contextmenu": "2.10.2",
         "jquery-datetimepicker": "2.5.21",
@@ -935,9 +935,9 @@
       }
     },
     "node_modules/devbridge-autocomplete": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/devbridge-autocomplete/-/devbridge-autocomplete-2.0.1.tgz",
-      "integrity": "sha512-Y4ftxTnLVjfDfGXbhaIh3l6jrYQJuTQDLH1WoPkzd3XMKJo5eYFv83I53wXRxeuO3L2WWAYZA+oa0t5eiSMx0A==",
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/devbridge-autocomplete/-/devbridge-autocomplete-2.0.7.tgz",
+      "integrity": "sha512-KEeqVfX4ZiZMgQwnnbcl2PxPoY8DWGDNpOoP+32vrBPMZ/Uq7FHN3unEVfPO3Pk9/HSBiaT+PUbpL4QmQgVxbg==",
       "license": "MIT",
       "engines": {
         "node": ">=20"
diff --git a/package.json b/package.json
index 453b55ff88..cfb0c831f0 100644
--- a/package.json
+++ b/package.json
@@ -11,7 +11,7 @@
   "//": "The generated files are not committed; the Docker assets stage builds them from this lockfile. Dependabot proposes upgrades and CI tests them with no regeneration step needed; treat majors (jquery 4.x, mermaid 13.x, devbridge 2.x) as manual, tested reviews. A bump now moves a library's stylesheet along with its script, so review upgrades for visual changes too. bpopup is not published to npm and remains vendored under js/jquery/plugins/bPopup/.",
   "dependencies": {
     "blueimp-md5": "2.19.0",
-    "devbridge-autocomplete": "2.0.1",
+    "devbridge-autocomplete": "2.0.7",
     "jquery": "3.7.1",
     "jquery-contextmenu": "2.10.2",
     "jquery-datetimepicker": "2.5.21",