Skip to content

Commit 0ceed88

Browse files
committed
dependabot: set cooldown.default-days to 4
After further consideration, I'm convinced by the arguments in favor of using dependency cooldowns to reduce exposure to supply-chain attacks: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns Remove suppression of https://docs.zizmor.sh/audits/#dependabot-cooldown Signed-off-by: Kevin Locke <[email protected]>
1 parent 3b6e0c4 commit 0ceed88

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

.github/dependabot.yml

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,15 @@
22
# https://docs.github.com/code-security/supply-chain-security/configuration-options-for-dependency-updates
33
version: 2
44
updates:
5-
- package-ecosystem: "github-actions" # zizmor: ignore[dependabot-cooldown]
5+
- package-ecosystem: "github-actions"
66
directory: "/"
77
schedule:
88
interval: "daily"
9-
- package-ecosystem: "pip" # zizmor: ignore[dependabot-cooldown]
9+
cooldown:
10+
default-days: 4
11+
- package-ecosystem: "pip"
1012
directory: "/"
1113
schedule:
1214
interval: "daily"
15+
cooldown:
16+
default-days: 4

0 commit comments

Comments
 (0)