chore(deps): Dependabot roll-up

.github/dependabot.yml

@@ -6,17 +6,23 @@
 # Weekly, grouped per ecosystem, so the queue is one PR per ecosystem a week rather than one per
 # package. Security updates are not grouped or delayed by this file; they open as soon as an
 # advisory is published (Settings > Code security > Dependabot security updates).
+#
+# Each version update waits 7 days after its release (cooldown). A hijacked package is usually caught
+# and pulled within days, so the wait keeps a fresh, compromised release out of the queue. Security
+# updates ignore the cooldown.
 version: 2
 updates:
   - package-ecosystem: github-actions
     directory: /
     schedule: { interval: weekly, day: monday }
+    cooldown: { default-days: 7 }
     groups:
       actions: { patterns: ["*"] }
 
   - package-ecosystem: cargo
     directory: /
     schedule: { interval: weekly, day: monday }
+    cooldown: { default-days: 7 }
     ignore:
       # Held at 3.1.x in Cargo.toml: 3.2 changes protocol-version negotiation (SEP-2567), which
       # clients can see. It moves in its own PR, not inside a grouped minor bump.
@@ -31,22 +37,35 @@ updates:
   - package-ecosystem: npm
     directory: /vscode-iris-agentic-dev
     schedule: { interval: weekly, day: monday }
+    cooldown: { default-days: 7 }
     groups:
       extension-minor:
         update-types: [minor, patch]
+    # Tied to the oldest VS Code the extension supports (engines.vscode ^1.99.0, which runs on
+    # Node 20). Newer typings let code use APIs that release lacks, and which 7 needs Node 22.22.
+    # Move these together with engines.vscode, by hand.
+    ignore:
+      - dependency-name: "@types/vscode"
+      - dependency-name: "@types/node"
+        versions: [">=21"]
+      - dependency-name: which
+        versions: [">=7"]
 
   - package-ecosystem: npm
     directory: /
     schedule: { interval: weekly, day: monday }
+    cooldown: { default-days: 7 }
     groups:
       lint-tooling: { patterns: ["*"] }
 
   - package-ecosystem: pip
     directory: /.github/requirements
     schedule: { interval: weekly, day: monday }
+    cooldown: { default-days: 7 }
     groups:
       ci-python: { patterns: ["*"] }
 
   - package-ecosystem: docker
     directory: /
     schedule: { interval: weekly, day: monday }
+    cooldown: { default-days: 7 }

.github/workflows/release.yml

@@ -354,14 +354,14 @@ jobs:
           cp iris-agentic-dev-linux-x86_64 bin/iris-agentic-dev-amd64
           cp iris-agentic-dev-linux-aarch64 bin/iris-agentic-dev-arm64
           chmod +x bin/iris-agentic-dev-amd64 bin/iris-agentic-dev-arm64
-      - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         id: meta
         with:
           images: ghcr.io/intersystems-community/iris-agentic-dev
@@ -370,7 +370,7 @@ jobs:
             type=raw,value=latest
       - name: Build and push
         id: push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           push: true