Skip to content

ci(dependabot): configure 30-day cooldown period for dependency version updates - #254

Merged
spelech merged 1 commit into
mainfrom
chore/dependabot-30-day-cooldown
Sep 30, 2026
Merged

spelech merged 1 commit into
mainfrom
chore/dependabot-30-day-cooldown

Conversation

@spelech

@spelech spelech commented Sep 30, 2026

Copy link
Copy Markdown
Owner

Summary

Configures GitHub Dependabot with a cooldown of 30 days (default-days: 30) across all active ecosystems:

  • nuget (root)
  • npm (/frontend)
  • github-actions (root)
  • docker (root)

Details

  • Ensures Dependabot only opens version update pull requests for releases published at least 30 days ago.
  • Protects the project from bleeding-edge regressions and early supply chain issues.
  • Security updates (CVE/GHSA advisories) remain unaffected by cooldown and will continue to open immediately as expected.

@spelech
spelech merged commit bd7af2b into main Sep 30, 2026
8 checks passed
@spelech
spelech deleted the chore/dependabot-30-day-cooldown branch September 30, 2026 06:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant