From 6f0ee77994ab13761a420d98786e264fe8b4a05a Mon Sep 17 00:00:00 2001
From: Oliver Hamlet <git@ortham.net>
Date: Sat, 28 Mar 2026 09:51:34 +0000
Subject: [PATCH] Add a 7-day cooldown to Dependabot checks

So that Dependabot won't open PRs for updates that are less than 7 days old, to reduce the risk of getting caught up in supply chain attacks. The use of cargo-vet already prevents CI builds from passing with un-vetted dependency versions, but this should save a little effort for Python and Node.js dependencies.

Cooldowns aren't supported for GitHub Actions dependencies.
---
 .github/dependabot.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1ba3ab07..fd39f22d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,8 @@ updates:
   directory: "/"
   schedule:
     interval: weekly
+  cooldown:
+    default-days: 7
 
 - package-ecosystem: uv
   directories:
@@ -11,11 +13,15 @@ updates:
     - /python
   schedule:
     interval: weekly
+  cooldown:
+    default-days: 7
 
 - package-ecosystem: npm
   directory: /nodejs
   schedule:
     interval: weekly
+  cooldown:
+    default-days: 7
 
 - package-ecosystem: github-actions
   directory: "/"