🏗️✨：hold dependabot to a week before proposing

.github/dependabot.yml

@@ -5,3 +5,8 @@ updates:
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    # A week between a version being published and being proposed here, which
+    # is the window in which a compromised release tends to be caught and
+    # pulled. Security updates are not held back by this.
+    cooldown:
+      default-days: 7

.renovaterc.json5

@@ -71,5 +71,24 @@
       commitMessagePrefix: "build(deps-dev):",
       labels: ["dependencies", "build", "deps-dev"],
     },
+    // `config:best-practices` already waits, through
+    // `security:minimumReleaseAgeNpm`, but only three days and only for npm --
+    // leaving the action digests and the URL-pinned dprint plugins with no
+    // wait at all. A preset's rules are merged ahead of these, and the last
+    // matching rule wins, so raising the figure has to happen here.
+    {
+      description: "Let a new release be looked at before taking it",
+      matchPackageNames: ["*"],
+      minimumReleaseAge: "7 days",
+    },
+    {
+      // Restores what the preset set and the rule above would undo: renovate
+      // cannot apply the wait to the transitive versions a lockfile refresh
+      // picks up. pnpm enforces it there instead, during the install renovate
+      // runs to produce the branch.
+      description: "Lock file maintenance resolves through the package manager",
+      matchUpdateTypes: ["lockFileMaintenance"],
+      minimumReleaseAge: null,
+    },
   ],
 }

package.json

@@ -35,7 +35,7 @@
     "browserslist-lint": "0.4.0",
     "console-log-level": "1.4.1",
     "cspell": "10.0.1",
-    "cssnano": "8.0.4",
+    "cssnano": "8.0.3",
     "dprint": "0.55.2",
     "editorconfig-checker": "6.1.1",
     "js-yaml": "5.2.3",
@@ -48,7 +48,7 @@
     "markdownlint-cli2": "0.23.2",
     "markdownlint-cli2-formatter-default": "0.0.6",
     "nps": "5.10.0",
-    "postcss": "8.5.26",
+    "postcss": "8.5.25",
     "prettier": "3.9.6",
     "remark": "15.0.1",
     "remark-cli": "12.0.1",
@@ -86,7 +86,7 @@
     "stylelint-config-standard-scss": "17.0.0",
     "typescript": "7.0.2",
     "unified": "11.0.5",
-    "vnu-jar": "26.8.6",
+    "vnu-jar": "26.8.4",
     "zod": "4.4.3",
     "zod-validation-error": "5.0.0"
   }