chore(deps): bump gh-aw toolchain to v0.68.7 + pydantic 2.13.2

.github/aw/actions-lock.json

@@ -3,12 +3,12 @@
     "actions/github-script@v9": {
       "repo": "actions/github-script",
       "version": "v9",
-      "sha": "373c709c69115d41ff229c7e5df9f8788daa9553"
+      "sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
     },
-    "github/gh-aw-actions/setup@v0.68.3": {
+    "github/gh-aw-actions/setup@v0.68.7": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.68.3",
-      "sha": "ba90f2186d7ad780ec640f364005fa24e797b360"
+      "version": "v0.68.7",
+      "sha": "f52802884d655622f0a2dfd6d6a2250983c95523"
     }
   }
 }

.github/dependabot.yml

@@ -9,3 +9,9 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    ignore:
+      # Embedded in compiled .lock.yml files generated by `gh aw compile`.
+      # Upgrades must go through .github/aw/actions-lock.json + recompile,
+      # not via direct edits to the compiled workflows.
+      - dependency-name: "github/gh-aw-actions/*"
+      - dependency-name: "actions/github-script"

.github/workflows/copilot-setup-steps.yml

@@ -21,9 +21,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Install gh-aw extension
-        uses: github/gh-aw/actions/setup-cli@5a06d310cf45161bde77d070065a1e1489fc411c # v0.68.1
+        uses: github/gh-aw/actions/setup-cli@f916d5de5199f770e46151d455ab1f0288981cc9 # v0.68.7
         with:
-          version: v0.68.1
+          version: v0.68.7
       - name: Install uv
         uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
       - name: Install Python dependencies

pyproject.toml

@@ -13,7 +13,7 @@ description = "Python CLI tools monorepo"
 readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
-    "pydantic>=2.13.0,<3",
+    "pydantic>=2.13.2,<3",
     "click>=8.3.2,<9",
     "rich>=15.0.0,<16",
     "loguru>=0.7.3,<1",