Skip to content

chore: add a 7-day Dependabot cooldown to both update entries - #485

Merged
maurycy merged 1 commit into
mainfrom
maurycy/dev-13943-enable-dependabot-with-a-7-day-cooldown-in-every-active
Oct 22, 2026
Merged

maurycy merged 1 commit into
mainfrom
maurycy/dev-13943-enable-dependabot-with-a-7-day-cooldown-in-every-active

Conversation

@maurycy

@maurycy maurycy commented Oct 22, 2026 •

Copy link
Copy Markdown
Contributor

Adds cooldown: default-days: 7 to the npm and github-actions entries. Version updates stay off (open-pull-requests-limit: 0) and security updates ignore the cooldown, so nothing changes today; the cooldown is already in place if version updates are ever switched on.

Part of https://linear.app/terminal49/issue/DEV-13943

🤖 Generated with Claude Code


View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need.

RetriggerView in GreptileConfidence Score: 5/5

This PR appears safe to merge.

Summary

Adds a seven-day Dependabot cooldown to the npm and github-actions entries.

  • Both Dependabot entries now have a seven-day version-update cooldown.

Reviews (1) · Last reviewed commit: "chore: add a 7-day Dependabot cooldown t..." · Reviewed by Greptile

@maurycy maurycy self-assigned this Oct 22, 2026
@vercel

vercel Bot commented Oct 22, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
api Ready Ready Preview Oct 22, 2026 9:50pm UTC

Request Review

@linear-code

linear-code Bot commented Oct 22, 2026

Copy link
Copy Markdown
Contributor

DEV-13943

@maurycy
maurycy requested review from alosec and removed request for dodeja October 22, 2026 21:49
@github-actions github-actions Bot added the risk-shadow:high Shadow-only risk signal: high label Oct 22, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Shadow risk calibration

Signal Result Authority
Path classifier risk:high Deterministic advisory policy
heuristic fallback risk-shadow:high Shadow only

Calibration result: agreement.

Shadow risk never blocks or enables merge. Keep it in observation mode until roughly 50 pull requests have human-reviewed labels, then calibrate before considering any policy use.

@github-actions github-actions Bot added the risk:unknown Advisory evidence unavailable or changed; no merge permission label Oct 22, 2026
@github-actions github-actions Bot added risk:high Advisory path risk; current-head human review needed and removed risk:unknown Advisory evidence unavailable or changed; no merge permission labels Oct 22, 2026
@maurycy
maurycy merged commit b508d66 into main Oct 22, 2026
26 of 27 checks passed
@maurycy
maurycy deleted the maurycy/dev-13943-enable-dependabot-with-a-7-day-cooldown-in-every-active branch October 22, 2026 21:55

This branch was successfully deployed

1 active deployment
Preview — e792f54c Deployed Oct 22, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

risk:high Advisory path risk; current-head human review needed risk-shadow:high Shadow-only risk signal: high

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant