From 7ef7fc8972fb961bd86b7c1749d1ac53ddda3714 Mon Sep 17 00:00:00 2001 From: Rick Staa Date: Mon, 26 Oct 2026 20:53:11 +0100 Subject: [PATCH] ci(dependabot): pick up npm patch releases after three days Patch releases carry most security fixes, so they no longer wait the full seven day cooldown. Minor and major updates keep it. Co-Authored-By: Claude Sonnet 5.5 --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d9fd02a..d417f3e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,8 +6,10 @@ updates: interval: weekly # Never install a release younger than a week: gives the ecosystem time # to detect and yank compromised versions before we ever resolve them. + # Patch releases carry most security fixes, so they wait only three days. cooldown: default-days: 7 + semver-patch-days: 3 # One combined PR per week instead of one per package. groups: minor-and-patch: