Repository navigation
Conversation
Updates the Dependabot cooldown default-days configuration from 7 to 21 days across all 29 configured package ecosystem entries (gomod, npm, docker, terraform, devcontainers, and github-actions) in .github/dependabot.yml to provide a longer supply-chain stabilization window before automated version update PRs are opened.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Updates the
cooldown.default-dayssetting from7to21across all 29 package ecosystem configurations in.github/dependabot.yml:gomodmodule directories (/lib,/lib/gen,/util,/tools,/backend, 4/workers/*, and 7/workflows/steps/services/*)npmconfiguration (/)dockerconfigurations (/.dev/*,/.devcontainer,/images)terraformconfiguration (/infra)devcontainersconfiguration (/.devcontainer)github-actionsconfiguration (/)Why
Increasing the cooldown window from 7 days to 21 days provides a stronger supply-chain security buffer against newly published compromised package versions and reduces PR churn from rapid follow-up patch releases shortly after an upstream release. Note that Dependabot security updates are unaffected by the version update cooldown period and will still be raised immediately when advisories are published.
How
Updated
cooldown.default-days: 21on each update entry in.github/dependabot.yml(Dependabot v2 configuration definescooldownper ecosystem/directory entry rather than globally).Corrected Assumptions / Learnings
version: 2,cooldownis configured per entry underupdatesand applies only to scheduled version updates (default-daysapplies across major, minor, and patch updates unless overridden bysemver-major-days,semver-minor-days, orsemver-patch-days). Security updates triggered by GitHub Advisory Database alerts bypass the cooldown period.