chore: resolve dependency security alerts

.github/actions/setup-postgres/action.yml

@@ -140,9 +140,17 @@ runs:
           -e POSTGRES_DB=postgres \
           -p 5432:5432 \
           postgres-language-server-dev:latest
-        # Wait for postgres to be ready
-        for _ in {1..30}; do
-          if docker exec postgres pg_isready -U postgres; then
+        # Wait for the image's init scripts to finish before checking readiness;
+        # pg_isready can briefly catch Docker's temporary bootstrap server.
+        for _ in {1..60}; do
+          if docker logs postgres 2>&1 | grep -Eq "PostgreSQL init process complete|Skipping initialization"; then
+            break
+          fi
+          sleep 1
+        done
+
+        for _ in {1..60}; do
+          if docker exec postgres psql -U postgres -d postgres -tAc "SELECT 1" >/dev/null; then
             break
           fi
           sleep 1

.github/workflows/pull_request.yml

@@ -136,11 +136,12 @@ jobs:
           key: ${{ runner.os }}-tree-sitter-${{ hashFiles('.tree-sitter-cli-version', 'crates/pgls_treesitter_grammar/grammar.js', 'crates/pgls_treesitter_grammar/tree-sitter.json', 'rust-toolchain.toml', 'Cargo.lock') }}
 
       - name: Setup tree-sitter
-        run: command -v tree-sitter || cargo install tree-sitter-cli --version "$(cat .tree-sitter-cli-version)" --locked
-        shell: bash
+        uses: tree-sitter/setup-action/cli@v2
+        with:
+          tree-sitter-ref: v0.25.9
 
       - name: Setup sqlx-cli
-        run: command -v sqlx ||cargo install sqlx-cli
+        run: command -v sqlx || cargo install sqlx-cli --version 0.8.6 --locked
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
@@ -206,8 +207,9 @@ jobs:
           key: ${{ runner.os }}-tree-sitter-${{ hashFiles('.tree-sitter-cli-version', 'crates/pgls_treesitter_grammar/grammar.js', 'crates/pgls_treesitter_grammar/tree-sitter.json', 'rust-toolchain.toml', 'Cargo.lock') }}
 
       - name: Setup tree-sitter
-        run: command -v tree-sitter || cargo install tree-sitter-cli --version "$(cat .tree-sitter-cli-version)" --locked
-        shell: bash
+        uses: tree-sitter/setup-action/cli@v2
+        with:
+          tree-sitter-ref: v0.25.9
 
       - name: Run clippy
         run: cargo clippy --all-targets -- -D warnings
@@ -246,9 +248,10 @@ jobs:
             ~/.cargo/bin/tree-sitter
             target/**/build/pgls_treesitter_grammar-*/out/generated
           key: ${{ runner.os }}-tree-sitter-${{ hashFiles('.tree-sitter-cli-version', 'crates/pgls_treesitter_grammar/grammar.js', 'crates/pgls_treesitter_grammar/tree-sitter.json', 'rust-toolchain.toml', 'Cargo.lock') }}
-      - name: setup tree-sitter
-        run: command -v tree-sitter || cargo install tree-sitter-cli --version "$(cat .tree-sitter-cli-version)" --locked
-        shell: bash
+      - name: Setup tree-sitter
+        uses: tree-sitter/setup-action/cli@v2
+        with:
+          tree-sitter-ref: v0.25.9
       - name: Build main binary
         run: cargo build -p pgls_cli --release
       - name: Setup Bun
@@ -336,9 +339,10 @@ jobs:
             ~/.cargo/bin/tree-sitter
             target/**/build/pgls_treesitter_grammar-*/out/generated
           key: ${{ runner.os }}-tree-sitter-${{ hashFiles('.tree-sitter-cli-version', 'crates/pgls_treesitter_grammar/grammar.js', 'crates/pgls_treesitter_grammar/tree-sitter.json', 'rust-toolchain.toml', 'Cargo.lock') }}
-      - name: setup tree-sitter
-        run: command -v tree-sitter || cargo install tree-sitter-cli --version "$(cat .tree-sitter-cli-version)" --locked
-        shell: bash
+      - name: Setup tree-sitter
+        uses: tree-sitter/setup-action/cli@v2
+        with:
+          tree-sitter-ref: v0.25.9
       - name: Ensure RustFMT on nightly toolchain
         run: rustup component add rustfmt --toolchain nightly
       - name: Setup Bun

crates/pgls_workspace/Cargo.toml

@@ -13,7 +13,7 @@ version              = "0.0.0"
 
 [dependencies]
 globset = "0.4.16"
-lru     = "0.12"
+lru     = "0.16.3"
 
 ignore                            = { workspace = true }
 json-strip-comments               = { workspace = true }

uv.toml

@@ -0,0 +1,2 @@
+# Require newly published package versions to be at least 3 days old before resolution.
+exclude-newer = "3d"