Commit graph conformance/.github/dependabot.yml
Author SHA1 Message Date
Paul Carleton
244eeeb362
Change dependabot to monthly grouped updates (#90)
- Switch from weekly to monthly schedule
- Group all npm dependencies into single PR
- Group all GitHub actions into single PR
- Add explicit config for examples/servers/typescript directory
- Remove cooldown config (less relevant with monthly schedule)
2026-01-05 17:49:21 +00:00
Paul Carleton
6464588da2
Add dependabot config with 7-day dependency cooldown (#57)
Configures Dependabot to wait 7 days after a package is published
before creating update PRs. This helps protect against supply chain
attacks by allowing time for malicious packages to be detected and
removed.

See: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <noreply@anthropic.com>
2025-11-25 20:35:39 +00:00