bump deps and add a one week buffer to releases that we merge in to allow for vulnerabilities to be caught.
The note is not visible to the blocked user.