chore(deps): update dependencies and wait 5 days for new releases

.devcontainer/devcontainer.json

@@ -1,11 +1,13 @@
 {
   "name": "browser-reporting-api",
-  "image": "mcr.microsoft.com/devcontainers/base:bookworm",
+  "image": "mcr.microsoft.com/devcontainers/base:trixie",
   "features": {
     "ghcr.io/devcontainers/features/go:1": {
       "version": "1.27"
     },
-    "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {}
+    "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
+      "moby": false
+    }
   },
   "forwardPorts": [8080],
   "postCreateCommand": "go mod download",

.github/dependabot.yaml

@@ -1,9 +1,15 @@
 version: 2
+
+# Version updates wait until a release is 5 days old, so a broken or
+# compromised release is more likely to be caught before it is proposed.
+# Security updates aren't delayed.
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 5
     groups:
       github-actions:
         patterns: ["*"]
@@ -12,6 +18,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 5
     groups:
       go-modules:
         patterns: ["*"]
@@ -21,6 +29,19 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 5
     groups:
       docker:
         patterns: ["*"]
+
+  # images in docker-compose.yml
+  - package-ecosystem: "docker-compose"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 5
+    groups:
+      docker-compose:
+        patterns: ["*"]

.github/workflows/semantic-check.yaml

@@ -15,7 +15,7 @@ jobs:
     name: Semantic Commit Message Check
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+      - uses: amannn/action-semantic-pull-request@2252a14e810aa9b85c2d560bd7070c802206ecf6 # v6.1.2
         name: Check PR for Semantic Commit Message
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CONTRIBUTING.md

@@ -53,6 +53,16 @@ Docker Compose, with the settings in `.env` (copy `.env.example`).
 - Error responses are seen by clients. Return a generic message for server
   errors, and log the details.
 
+## Dependencies
+
+Dependabot proposes updates to Go modules, GitHub Actions, and the images in
+the Dockerfile and `docker-compose.yml` every week. It waits until a release
+is 5 days old, so a broken or compromised release is more likely to be caught
+first, but it doesn't delay security updates. Follow the same rule when
+updating by hand: take a release younger than 5 days only when it fixes a
+known vulnerability. Actions are pinned to a full commit SHA, with the
+version in a comment.
+
 ## Commits and releases
 
 Pull request titles follow [Conventional Commits](https://www.conventionalcommits.org/)

docker-compose.yml

@@ -19,7 +19,7 @@ services:
 
   # sends the example reports in both formats, once the api is healthy
   demo-sender:
-    image: curlimages/curl:8.12.1
+    image: curlimages/curl:8.23.0
     depends_on:
       api:
         condition: service_healthy