chore(deps): 7-day Dependabot cooldown, and re-anchor the fl_lib gitlink

[lollipopkit]

Two unrelated one-liners, kept together rather than as two PRs.

Cooldown

minimumReleaseAge = 604800 in the maintainer's bunfig refuses to install anything published in the last seven days. Dependabot knew nothing about that and kept proposing versions the machine would then decline — #1414, #1427, #1436 and now #1438 are all the same starlight/astro upgrade, arriving five days early and sitting there.

    cooldown:
      default-days: 7

on all four entries. Explicit rather than omitted: with cooldown unset the default is 3 days, and semver-major-days/-minor-/-patch- fall back to default-days when not given, so one line covers every bump type.

Security updates are unaffected, by GitHub's design rather than by anything here: cooldown applies to version updates only. That is the right way round — a fix for a known advisory should not wait a week, and #1424, #1432 and #1439 were all merged the day they existed.

Validated against SchemaStore's dependabot-2.0.json: 0 errors. Every ecosystem used here (cargo, pub, npm, github-actions) is in GitHub's cooldown support table.

fl_lib gitlink

lollipopkit/fl_lib#51 was squashed onto that repository's main as ee1c720. The gitlink still named 0024513 — the PR branch's head, which once that branch is deleted is reachable from nothing on main. Every checkout here uses submodules: recursive, so that is the whole CI rather than one job.

The two commits have an identical tree (git diff ee1c7200 0024513 is empty), so no code changes; it only re-anchors the pointer. Merging this is what makes deleting feat/update-machine-arch in fl_lib safe.

Summary by CodeRabbit

• Chores
  • Dependency updates are now subject to a seven-day cooldown to help provide more predictable update timing.
  • Security-related updates remain exempt from the cooldown for faster delivery.
  • Updated supporting components to incorporate the latest available improvements.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Essentials

Run ID: 266b9530-9f1e-44f1-bbae-159bfecd529d

📥 Commits

Reviewing files that changed from the base of the PR and between 29a4660 and b7706f8.

📒 Files selected for processing (2)

• .github/dependabot.yml
• packages/fl_lib

---

📝 Walkthrough

Walkthrough

Dependabot now applies a seven-day cooldown to Cargo, Pub, npm, and GitHub Actions version updates. Security updates remain immediate. The packages/fl_lib submodule pointer now references commit ee1c7200c95bfc9d692b5dc48960155c8115930c.

Suggested reviewers: gt-610

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-cooldown

---

_{Comment @coderabbitai help to get the list of available commands.}