Author	SHA1	Message	Date
Paul Carleton	687d5b4035	chore(deps): ignore major version bumps in dependabot (#195) ... Major bumps of devDeps (eslint, typescript, prettier) need manual config migration and provide no value for conformance testing. Security updates still come through regardless; scheduled updates are now minor/patch only.	2026-03-25 11:42:31 +00:00
Paul Carleton	244eeeb362	Change dependabot to monthly grouped updates (#90) ... - Switch from weekly to monthly schedule - Group all npm dependencies into single PR - Group all GitHub actions into single PR - Add explicit config for examples/servers/typescript directory - Remove cooldown config (less relevant with monthly schedule)	2026-01-05 17:49:21 +00:00
Paul Carleton	6464588da2	Add dependabot config with 7-day dependency cooldown (#57) ... Configures Dependabot to wait 7 days after a package is published before creating update PRs. This helps protect against supply chain attacks by allowing time for malicious packages to be detected and removed. See: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <noreply@anthropic.com>	2025-11-25 20:35:39 +00:00