From f2cbdd50b172116c5e9bd3388104e578e7d834c6 Mon Sep 17 00:00:00 2001 From: "Ricardo Q. Bazan" Date: Sat, 17 Oct 2026 18:57:59 -0500 Subject: [PATCH] ci: note that Dependabot security PRs skip the release-age cooldown The dependabot.yml header said cooldown does not delay security PRs, but not that pnpm's minimumReleaseAge does not either: since dependabot-core#15170, Dependabot runs pnpm with --config.minimumReleaseAge=0 for security updates. It also read as if security updates were already on; they open PRs only once enabled in the repo's code security settings. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01TkHa1BVnm277qEiEuipG6n --- .github/dependabot.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d98bf74..54173ee 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,7 +1,8 @@ -# Dependabot security updates only. Version updates stay manual: open-pull-requests-limit: 0 -# turns them off, while security updates still open PRs for every new alert. -# cooldown mirrors pnpm's minimumReleaseAge (24 h). GitHub applies it to version updates only, -# so it does not delay security PRs: check the fixed version's age before merging one. +# Dependabot security updates only. open-pull-requests-limit: 0 turns version updates off; security +# updates, once enabled in the repo's code security settings, open a PR for each new alert. +# cooldown mirrors pnpm's minimumReleaseAge (24 h), but it only delays version updates. Security PRs +# skip both: GitHub ignores cooldown for them, and Dependabot runs pnpm with +# --config.minimumReleaseAge=0 (dependabot-core#15170). Check the fixed version's age before merging. version: 2 updates: - package-ecosystem: npm