{{ message }}
Repository navigation
Commit 6cb8adc
![sml-dependabot-cooldown[bot]](https://avatars.githubusercontent.com/u/322765?v=4&size=40){kind=avatar}
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&size=40){kind=avatar}
Set Dependabot cooldown to 3 days (#79)
Enforces the central supply-chain cooldown on `.github/dependabot.yml`
(`cooldown.default-days = 3`) on every `updates:` entry.
New dependency versions are held for this many days before Dependabot
proposes a version update, so a compromised release has time to be
detected. Security updates (published GHSA/CVE advisories) bypass the
cooldown and are unaffected.
Opened by the central
[`dependabot-cooldown`](https://github.com/softwaremill/github-actions-workflows/blob/main/.github/workflows/dependabot-cooldown.yml)
workflow.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>1 parent 8cec823 commit 6cb8adc
1 file changed
Lines changed: 4 additions & 1 deletion
0 commit comments