From 53fa6b2493c43ee4c5f986c8efa2ade62d02b4c6 Mon Sep 17 00:00:00 2001 From: Austin McKinley <54160+amckinley@users.noreply.github.com> Date: Tue, 2 Jun 2026 11:04:28 -0700 Subject: [PATCH] ci: add dependabot config with 7-day cooldown (#10475) Co-authored-by: Claude Opus 4.7 (1M context) --- .github/dependabot.yml | 44 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000000..9404af75f7 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,44 @@ +version: 2 +# Dependabot auto-update config. +# +# Cooldown (7 days) is the point of this config: it delays version-update +# PRs until a newly-published version has aged. Supply-chain attacks like +# the tanstack Shai-Hulud compromise (2026-05-11) live minutes-to-hours +# before the registry yanks them; a 7-day cooldown keeps poisoned +# versions out of our lockfiles. +# +# Security updates bypass cooldown and continue to flow immediately. See: +# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown +# +# Auto-merge is deliberately NOT enabled. Every dependabot PR gets human +# review. + +updates: + - package-ecosystem: npm + directory: / + schedule: + interval: weekly + day: monday + cooldown: + default-days: 7 + open-pull-requests-limit: 5 + groups: + production: + dependency-type: production + update-types: [minor, patch] + development: + dependency-type: development + update-types: [minor, patch] + + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + day: monday + cooldown: + default-days: 7 + open-pull-requests-limit: 3 + groups: + actions: + patterns: ["*"] + update-types: [minor, patch]