Add seven-day Dependabot cooldowns for npm, PyPI, and NuGet - #2596
Conversation
Exempt @github-scoped npm packages while preserving existing schedules and grouping. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The configuration matches the stated scope and preserves existing schedules and rules.
Review tier: Balanced
Findings: None
What changed in this PR
Adds seven-day Dependabot cooldowns for quarantined registry releases.
Changes:
- Applies cooldowns to npm, PyPI, and NuGet updates.
- Excludes trusted
@github/*npm packages.
| File | Description |
|---|---|
.github/dependabot.yaml |
Configures ecosystem-specific cooldowns. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
SteveSandersonMS
left a comment
SteveSandersonMS
left a comment
There was a problem hiding this comment.
Thanks for this — the cooldown config looks correct and I confirmed cooldown/default-days/exclude are valid, currently-supported Dependabot options for npm, pip, and nuget. One small question for my own understanding: Dependabot's cooldown option is also supported for gomod and maven, but this PR leaves Go and Java out. Is that because those ecosystems don't route through the same quarantined mirror, or just out of scope for now? Either way this looks good to merge.
New dependency releases can be unavailable in downstream registries during their seven-day quarantine, preventing contributors from installing the SDK or its development dependencies.
Add
cooldown.default-days: 7to all three npm entries and the PyPI and NuGet entries, with@github/*excluded from the npm cooldowns. Existing weekly schedules, grouping, ignore rules, and other ecosystems remain unchanged.Dependabot security updates bypass cooldowns. Copilot CLI version updates are managed separately and are unaffected.