Delay dependabot updates and group them and pin shipped packages

[vinlim]

• Delay dependabot updates prevent early supply chain poisoning
• Group updates for dependencies management
• Pin shipped packages

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-29T05:31:04.527476Z	79c9caa	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 79c9caa191

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Exempt fresh versions before enabling the seven-day gate

The parent lockfile includes newly published updates such as ts-jest@29.4.14, but no minimumReleaseAgeExclude entries accompany this seven-day policy. Both .github/workflows/test.yaml and release.yaml run pnpm install --frozen-lockfile; pnpm 11.13.1 revalidates locked versions against minimumReleaseAge, so non-interactive installs will reject these already-approved fresh versions and block CI/releases until they age past seven days. Add exclusions for the current lockfile's immature versions or delay enabling the policy.

Useful? React with 👍 / 👎.