From 838ec01d2a28b4a5467e6510ec8f58c3203db436 Mon Sep 17 00:00:00 2001
From: Kevin Boshold <github@proxy.boshol.de>
Date: Fri, 14 Aug 2026 09:08:29 +0200
Subject: [PATCH] chore(deps): wait 7 days before adopting new releases

Both dependabot and pnpm now skip versions published in the last week, so a pulled or compromised release does not land in the lockfile.
---
 .github/dependabot.yml | 4 ++++
 .npmrc                 | 3 +++
 2 files changed, 7 insertions(+)
 create mode 100644 .npmrc

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5551d15..82eeaf3 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -15,6 +15,10 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    # Wait a week after a release before PRing it, so pulled/broken versions
+    # never land here.
+    cooldown:
+      default-days: 7
     groups:
       npm-dependencies:
         patterns:
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..b95fa9d
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,3 @@
+# Ignore versions published less than 7 days ago (10080 minutes), so a pulled
+# or compromised release never gets installed. Mirrors the dependabot cooldown.
+minimum-release-age=10080