From 92c9ec64d3fa6a961fdda651881a5ec5b8cf6f07 Mon Sep 17 00:00:00 2001 From: Brandon Cook Date: Wed, 17 Jun 2026 12:40:18 +1000 Subject: [PATCH] ci(dependabot): add a 10-day cooldown on all ecosystems Dependabot will not propose a dependency release until it has been public for at least 10 days, so a freshly published (possibly compromised or soon-yanked) version is never auto-PR'd before the ecosystem can react. Co-Authored-By: Claude Opus 4.8 --- .github/dependabot.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 41ae3dd..bd674c3 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,6 +6,11 @@ updates: schedule: interval: "weekly" open-pull-requests-limit: 5 + # Only propose a release once it has been public for 10 days, so a freshly + # published (and possibly compromised or soon-yanked) version is never + # auto-PR'd until the ecosystem has had time to react. + cooldown: + default-days: 10 # GitHub Actions are SHA-pinned in .github/workflows/*; Dependabot bumps the # pin (and the trailing `# vX.Y.Z` comment) when a new release lands. @@ -14,3 +19,5 @@ updates: schedule: interval: "weekly" open-pull-requests-limit: 5 + cooldown: + default-days: 10