From 6d5de7b3c19ce29d592f7f250e0899c82beab3d0 Mon Sep 17 00:00:00 2001 From: John Bampton Date: Thu, 8 Jan 2026 01:02:09 +1000 Subject: [PATCH] [CI] Dependabot: add a cooldown period for new releases Enforces security best practices by requiring a minimum age for new dependency releases before they are automatically updated by Dependabot. This practice, known as a "cooldown period," helps mitigate supply chain attacks by allowing time for frequently published malicious packages to be identified. https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown- --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 436bdf17c..2be0fbd92 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,7 +5,11 @@ updates: directory: "/" schedule: interval: "daily" + cooldown: + default-days: 7 - package-ecosystem: "github-actions" directory: "/" schedule: interval: "daily" + cooldown: + default-days: 7