chore: pin semantic-release plugin versions

[mahmoud-elmorabea]

Problem

deploy-sdk.yml passes an extra_plugins list to cycjimmy/semantic-release-action. Unpinned entries there are installed at latest at release time, so the release pipeline's behaviour changes without any commit to this repo. That has already broken releases twice:

• Run 32482771165 (Aug 21) — failed in generateNotes, before any tag was cut: Missing helper: conventional-changelog-conventionalcommits requires conventional-changelog-writer@9 or newer. The unpinned preset had floated into the incompatible 10.x line. Fixed by db93d2d (ci: pin semantic-release and changelog preset versions #639); 6.6.3 released cleanly ~40 minutes later, no version burned.
• Run 30559203085 (Jul 30) — the tag job succeeded and then Deploy to npm failed at "Install npm 11.5.1+ for OIDC support" with EBADENGINE ... npm@12.0.2 Required: node ^22 || ^24 || >=26, Actual: node v20.20.2 — same class of defect (npm install -g npm@latest under a pinned Node 20). Fixed by 7c6f6cd (fix: pin npm to 11.x in the npm deploy job #626) and 21feea4 (ci: move CI onto supported node and ruby runtimes #635).

Both incidents are already fixed. What remained is that #639 pinned only semantic_version and the changelog preset — @semantic-release/github and @semantic-release/exec were still unpinned, leaving the same failure mode live.

What changed

Pinned the two remaining floating entries to the versions the workflow already resolves today, matching the style of the existing preset pin:

Plugin	Before	After
@semantic-release/github	unpinned (latest)	12.0.9
@semantic-release/exec	unpinned (latest)	7.1.0

Both are the current latest on npm and both predate the most recent successful release run (33205068114, 6.10.0, Aug 28), so this pins to what CI is already installing — no behaviour change, just determinism. Peer ranges (semantic-release: >=24.1.0) are satisfied by the pinned semantic_version: 25.0.9.

@semantic-release/changelog and @semantic-release/git are also used by .releaserc.json but are not listed here — they are bundled by cycjimmy/semantic-release-action itself, which is already SHA-pinned, so they are deterministic.

Dependabot blind spot

.github/dependabot.yml watches only github-actions, which resolves uses: refs and nothing else. No Dependabot ecosystem parses extra_plugins, so these versions are invisible to automated updates and will go stale with no PR.

I did not change dependabot.yml: there is no configuration that would actually cover these strings (adding an npm ecosystem would open PRs for the SDK's own dependency tree and still would not read the workflow). Instead the constraint is recorded as a comment next to the pins so the next person bumps them deliberately.

Out of scope

• The orphan 6.6.0 tag (npm jumps 6.5.2 → 6.6.1) is intentionally left alone.
• The post-release sample-app job is unchanged. This repo is the healthy reference for MBL-2324 — it takes an sdk_version input rather than using git describe, and that behaviour is deliberately preserved.

Fixes MBL-2324

[github-actions]

Sample app builds 📱

Below you will find the list of the latest versions of the sample apps. It's recommended to always download the latest builds of the sample apps to accurately test the pull request.

---

• Android APN: 650.1.0 (29803099)
• iOS FCM: 650.1.0 (29803099)

[Shahroz16]

Looks good. The semantic-release plugins are pinned to compatible versions, the install replay resolves cleanly, and the action-provided changelog and git plugins are already pinned as well.