Skip to content

chore: add dependabot cooldown configuration#84

Open
andres-qd wants to merge 2 commits into
mainfrom
chore/dependabot-cooldown
Open

chore: add dependabot cooldown configuration#84
andres-qd wants to merge 2 commits into
mainfrom
chore/dependabot-cooldown

Conversation

@andres-qd

Copy link
Copy Markdown

Summary

  • Adds cooldown: default-days: 7 to all Dependabot update entries
  • Delays version updates by 7 days after release to reduce risk of regressions and supply chain attacks
  • Does not affect security updates (those still come immediately)

Ref: https://docs.zizmor.sh/audits/#dependabot-cooldown

@andres-qd andres-qd requested a review from a team as a code owner June 23, 2026 10:26
@github-actions github-actions Bot added the chore label Jun 23, 2026
Comment thread .github/dependabot.yml Outdated
Comment on lines +20 to +21
interval: "weekly" cooldown:
default-days: 7

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

incorrect enter

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in c011f60 — moved cooldown: onto its own line in the github-actions block, matching the gomod and docker sections.

Move cooldown onto its own line in the github-actions dependabot entry,
matching the gomod and docker sections.

Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants