From 19592ffdfb25e6e6c392b0a9a16f277e2ee1953f Mon Sep 17 00:00:00 2001 From: "Ricardo Q. Bazan" Date: Sat, 17 Oct 2026 18:58:00 -0500 Subject: [PATCH] ci: note that Dependabot security PRs skip the release-age cooldown The dependabot.yml header said cooldown does not delay security PRs, but not that pnpm's minimumReleaseAge does not either: since dependabot-core#15170, Dependabot runs pnpm with --config.minimumReleaseAge=0 for security updates. It also read as if security updates were already on; they open PRs only once enabled in the repo's code security settings. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01TkHa1BVnm277qEiEuipG6n --- .github/dependabot.yml | 9 +++++---- README.md | 2 +- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e6e1a7d..b92b54a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,7 +1,8 @@ -# Dependabot security updates only. Version updates stay manual: open-pull-requests-limit: 0 -# turns them off, while security updates still open PRs for every new alert. -# cooldown mirrors pnpm's minimumReleaseAge (24 h). GitHub applies it to version updates only, -# so it does not delay security PRs: check the fixed version's age before merging one. +# Dependabot security updates only. open-pull-requests-limit: 0 turns version updates off; security +# updates, once enabled in the repo's code security settings, open a PR for each new alert. +# cooldown mirrors pnpm's minimumReleaseAge (24 h), but it only delays version updates. Security PRs +# skip both: GitHub ignores cooldown for them, and Dependabot runs pnpm with +# --config.minimumReleaseAge=0 (dependabot-core#15170). Check the fixed version's age before merging. version: 2 updates: - package-ecosystem: npm diff --git a/README.md b/README.md index f836a1e..1a52c0a 100644 --- a/README.md +++ b/README.md @@ -69,7 +69,7 @@ New dependency versions must be at least 24 h old before they get in. Most malic The same flag works with `npm update`. Then run `mise run check-dist` and commit the rebuilt `dist/` together with the lockfile. - **Global npm CLI** in `setup-pnpm` and `setup-pnpm-bun`: an exact version, bumped by hand to a release at least 24 h old (see the comment on the "Update npm" step). Both actions are deprecated in favor of mise, which uses the npm bundled with the locked Node. -- **Security updates**: Dependabot ([`dependabot.yml`](./.github/dependabot.yml)) opens a PR for every new security alert in the root and in each action (version updates stay manual), and [`Dependency audit`](./.github/workflows/dependency-audit.yml) audits every lockfile each Monday, keeping an issue open while advisories remain. Dependabot does not rebuild `dist/`: on its PRs for an action, `Check actions dist sync` fails until someone runs `mise run check-dist` on the branch and pushes the rebuilt `dist/`. +- **Security updates**: once security updates are enabled in the repo settings, Dependabot ([`dependabot.yml`](./.github/dependabot.yml)) opens a PR for every new security alert in the root and in each action (version updates stay manual), and [`Dependency audit`](./.github/workflows/dependency-audit.yml) audits every lockfile each Monday, keeping an issue open while advisories remain. Dependabot does not rebuild `dist/`: on its PRs for an action, `Check actions dist sync` fails until someone runs `mise run check-dist` on the branch and pushes the rebuilt `dist/`. Its PRs also skip the 24 h cooldown (GitHub ignores `cooldown` for security updates, and Dependabot runs pnpm with `minimumReleaseAge=0`), so check the fixed version's publish date before merging one. ## Security linting