6464588da2Configures Dependabot to wait 7 days after a package is published before creating update PRs. This helps protect against supply chain attacks by allowing time for malicious packages to be detected and removed. See: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <noreply@anthropic.com>
16 lines
267 B
YAML
16 lines
267 B
YAML
version: 2
|
|
|
|
updates:
|
|
- package-ecosystem: npm
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
cooldown:
|
|
default-days: 7
|
|
|
|
- package-ecosystem: github-actions
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
cooldown:
|
|
default-days: 7
|