From 84dd12a20011c258270a52617070deda23d69d5f Mon Sep 17 00:00:00 2001 From: Robert Blust Date: Wed, 9 Sep 2026 09:28:50 +0200 Subject: [PATCH] No cooldown, because the default one proposes downgrades Dependabot offered this repository a downgrade again on 2026-09-09, minutes after the last change to `dependabot.yml` was merged, and every one of them was closed and came back. The cause is the cooldown GitHub applies when the key is absent: three days, during which every release younger than that is dropped, the pinned one included, and the highest version left is offered. For a package pinned by tag and released more than once a week, that is the version below the pin. Every offer this week was the newest release older than three days at that hour. That contradicts what the file said. The meta-model paragraph claimed the downgrade does not recur while every recent tag carries a Release; all sixty-nine design tags carry one and it recurred anyway. So `cooldown: default-days: 0` is stated on the npm entry, with the reason above it, and the two group paragraphs shrink to the rule and a pointer. Nothing is lost by zero: the pins are editorial and move when the owner decides, so the cooldown protected nothing here. Siblings: companygraph/companygraph.github.io and guestgraph/guestgraph.github.io, same branch name Verified: the YAML parses; conventions-check and conventions-sync check pass. Co-Authored-By: Claude Fable 5.1 --- .github/dependabot.yml | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 50611ca..a92615f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -21,6 +21,17 @@ updates: directory: "/" schedule: interval: "weekly" + # Zero, stated, because Dependabot applies three days when the key is absent. The cooldown + # drops every release younger than that and offers the highest version left — the pinned + # release included, so for a package pinned by tag and released more than once a week the + # offer is a DOWNGRADE. It came on 2026-09-09 as v0.55.0 down to v0.30.0 in the design group + # and v0.15.0 down to v0.13.2 in the meta-model group, each the newest release older than + # three days at that hour, and each returned on the next run after its pull request was + # closed; a run is triggered by every change to this file. With zero, Dependabot sees the + # pinned release and proposes nothing. Nothing is lost: the pins are editorial and move when + # the owner decides, so a cooldown protected nothing here. + cooldown: + default-days: 0 groups: # Declared first on purpose: Dependabot puts a dependency in the FIRST group it matches, # so naming the design package here keeps it out of minor-and-patch below. A design @@ -29,11 +40,8 @@ updates: # to be read rather than merged on sight: it goes red until someone runs `npm run design` # and commits what changed. # - # A pull request from this group proposing a LOWER version is closed, never merged, for - # the reason the meta-model group below spells out: the release cooldown, not the tag - # ranking. It reached this group on 2026-09-08, when v0.55.0 was offered a downgrade to - # v0.30.0 (#159, closed) on the day the release was cut, and it stops once the release - # ages past the cooldown. All three sites carry the warning on this group. + # A pull request from this group proposing a LOWER version is closed, never merged. The + # cooldown block above says why one appears and what stops it. design: patterns: - "@robertblust/design" @@ -46,12 +54,7 @@ updates: # A pull request from this group proposing a LOWER version is closed, never merged. That # happened three times on 2026-09-02 — v0.5.0 down to v0.4.1, a commit predating the # instance parser, so it has no lib/ and the import fails. CI caught it every time. The - # cause is Dependabot's release cooldown, not its tag ranking: it dates each git tag by - # that tag's GitHub Release and filters out anything released within three days. - # meta-model had a Release for v0.5.0 alone, so the newest tag was excluded as too fresh - # while the older tags, carrying no Release and therefore no date to filter on, all - # survived — leaving v0.4.1 the best of the remainder. It stops once a release ages past - # the cooldown, and does not recur while every recent tag carries one. + # cooldown block above says why one appears and what stops it. meta-model: patterns: - "companygraph-meta-model"