From d8de2ad167402b22007b068d81e4ab95394c1591 Mon Sep 17 00:00:00 2001 From: Gregory Oschwald Date: Thu, 30 Oct 2025 14:26:53 -0700 Subject: [PATCH] Set Dependabot cooldown period to 4 days This addresses the zizmor findings by setting a cooldown period of 4 days for all package ecosystems in dependabot.yml. Related to: ENG-3236 --- .github/dependabot.yml | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 03f9f086..c952aea6 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,17 +1,21 @@ version: 2 updates: - package-ecosystem: maven - directory: "/" + directory: / schedule: interval: daily - time: "14:00" + time: '14:00' open-pull-requests-limit: 10 groups: jackson: patterns: - - "com.fasterxml.jackson*" - - package-ecosystem: "github-actions" - directory: "/" + - com.fasterxml.jackson* + cooldown: + default-days: 4 + - package-ecosystem: github-actions + directory: / schedule: interval: daily - time: "14:00" + time: '14:00' + cooldown: + default-days: 4