chore: update dependencies

[reneleonhardt]

Chores

• Update cargo dependencies, CI dependencies and GitHub Actions (using pinning to improve supply chain security)
• Let Dependabot update github-actions and cargo (respecting a cooldown to improve supply chain security)
• Dropped PostgreSQL 13 from checks, release and runtime requirements (EOL since 2025-11-13)
• Bumped Debian 12 (Bookworm) to 13 (Trixie), and therefore GCC 12 to 14
• Bumped clang 18 to 21

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[reneleonhardt]

I have read the CLA Document and I hereby sign the CLA

[reneleonhardt]

Notes

• Please check manually if Debian 13, GCC 14 and Clang 21 are working as expected
• The Intel Software Development Emulator is available at least for Win x86 too, maybe you want to support Windows too
• It would be easier to update all CI dependencies automatically with renovatebot
• There is no cargo-deny 0.19.2, so curl returned 404 but you didn't let the step fail, you were just happily using the version preinstalled by the runner 😄

https://github.com/tensorchord/VectorChord/actions/runs/20807681917/job/59765092508#step:2:7

curl: (22) The requested URL returned error: 404

gzip: stdin: unexpected end of file
tar: Child returned status 1
tar: Error is not recoverable: exiting now

[usamoi]

Please restrict the scope of this PR to updating the versions of cargo-deny and sqllogictest, and configuring Dependabot for GitHub Actions.

[usamoi]

This raises the minimum required libc version for the binary package, which is unacceptable.

[reneleonhardt]

What about check:psql?

[usamoi]

It's not very important, but it would be better if both use the same version. This way, we won't run into unexpected issues during the release.

[Copilot]

Pull request overview

This PR updates dependencies and drops PostgreSQL 13 support following its EOL date. The changes include updating Cargo dependencies (rusqlite, object, and their transitive dependencies), pinning GitHub Actions with commit hashes for improved supply chain security, removing PostgreSQL 13 from CI matrix configurations, and configuring Dependabot to manage future updates.

Key changes:

• Removed PostgreSQL 13 feature flags and conditional compilation directives from modified source files
• Updated minimum PostgreSQL runtime requirement from 13.0.0 to 14.0.0
• Added Dependabot configuration with cooldown periods for GitHub Actions updates
• Pinned all GitHub Actions to specific commit hashes instead of version tags
• Updated PostgreSQL binaries in CI workflows to latest patch versions
• Updated development tool versions (sqllogictest, cargo-deny, Intel SDE)

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tests/vchordrq/pushdown_plan.slt	Removed PostgreSQL 13-specific test cases
src/lib.rs	Removed pg13 from feature flag conditional for EmitWarningsOnPlaceholders
src/index/storage/buffered.rs	Removed pg13 from extend method feature flag
src/index/storage.rs	Removed pg13 from multiple conditional compilation directives
src/index/scanners.rs	Removed pg13 from dead_code expectation attribute
src/index/gucs.rs	Removed pg13 from GUC default value conditionals and placeholder warnings
crates/xtask/src/main.rs	Removed pg13 from macOS extension suffix matching
crates/xtask/Cargo.toml	Updated object dependency from 0.37.3 to 0.38.1
META.json.in	Updated minimum PostgreSQL requirement from 13.0.0 to 14.0.0
Cargo.toml	Removed pg13 feature definition and updated rusqlite from 0.37.0 to 0.38.0
Cargo.lock	Updated dependency versions including hashbrown, hashlink, libsqlite3-sys, object, rusqlite, and wasmparser
.github/workflows/release.yml	Removed pg13 from version matrix and pinned GitHub Actions to commit hashes
.github/workflows/cla.yml	Pinned contributor-assistant/github-action to commit hash
.github/workflows/check.yml	Removed pg13 from all test matrices, updated PostgreSQL binaries, pinned actions, and updated development tools
.github/dependabot.yml	Added new configuration for Cargo and GitHub Actions dependency updates with cooldown periods

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[usamoi]

Please fix the compilation warnings.

https://github.com/tensorchord/VectorChord/actions/runs/20855548368/job/59923453739?pr=403

[reneleonhardt]

Make sure to squash all commits when merging.

[usamoi]

Thank you!

[reneleonhardt]

You're welcome!

If you're open to it, I could automate more CI dependencies like deny and sqllogic with Renovatebot.
Unfortunately Intel doesn't support Open-Source anymore, I could only try to write a custom datasource for SDE.