Summary

• Add 7-day cooldown to Dependabot version updates for both github-actions and npm ecosystems
• Delays auto-upgrade PRs for newly published versions, giving the community time to flag compromised releases (such as the one axios unfortunately recently experienced)
• Security updates (via Dependabot security advisories) are unaffected if configured, and still fire immediately
• See We should all be using dependency cooldowns for a thorough explanation of benefits

Summary by cubic

Adds a 7-day cooldown to Dependabot version updates for github-actions and npm to slow down auto-upgrades and reduce supply-chain risk. Security advisories still open immediately.

Description

• Summary of changes
  • Set cooldown.default-days: 7 for github-actions and npm in .github/dependabot.yml.
  • Kept weekly schedule and existing labels.
• Reasoning
  • Avoids pulling in freshly published, potentially compromised releases.
• Additional context
  • Synced with latest v1.x; no behavior changes.
  • Security advisory PRs bypass the cooldown.

Docs

No docs changes. This only affects Dependabot timing:

• Version update PRs delay by 7 days.
• Security advisories remain immediate.

Testing

No code or tests changed. Tests are not needed for this config-only update.

• Post-merge, verify Dependabot logs show version updates deferred by 7 days.

^{Written for commit 1845898. Summary will update on new commits.}