4 Commits
Author SHA1 Message Date
Oliver Hamlet 6f0ee77994 Add a 7-day cooldown to Dependabot checks
So that Dependabot won't open PRs for updates that are less than 7 days old, to reduce the risk of getting caught up in supply chain attacks. The use of cargo-vet already prevents CI builds from passing with un-vetted dependency versions, but this should save a little effort for Python and Node.js dependencies.

Cooldowns aren't supported for GitHub Actions dependencies.
2026-03-28 09:51:34 +00:00
Oliver Hamlet d859edc2ba Use Dependabot to keep Actions up to date 2025-10-01 20:11:33 +01:00
Oliver Hamlet 05afacab72 Fix Dependabot config for Cargo
It needs to point at the workspace root.
2025-06-18 20:56:52 +01:00
Oliver Hamlet 88cb968f28 Add dependabot config 2025-06-18 18:49:00 +01:00